better-supabase 0.4.0 → 0.5.1

package/dist/{mfa-byfjruR9.js → view-Bn6HNKUe.js}

@@ -1,87 +1,9 @@
-import { n as dbError } from "./errors-L0xK41y_.js";
+import { n as dbError } from "./errors-DtwXa6b8.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
 import { n as decodeJwtPayload } from "./base64-D2gsioCY.js";
+import { a as delegationOf, i as actorOf, n as impersonatorOf, r as userContext } from "./impersonation-BgSHAYLf.js";
 import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
 import { extractCredentials, verifyCredentials } from "@supabase/server/core";
-//#region src/auth/impersonation.ts
-/** The `act` claim for an impersonated session. */
-function actClaim(options) {
-	return {
-		sub: options.actor,
-		reason: options.reason
-	};
-}
-/** The impersonator in `claims.act`, or `undefined` for a normal session. */
-function impersonatorOf(claims) {
-	const act = claims["act"];
-	if (typeof act !== "object" || act === null) return void 0;
-	const { sub, reason } = act;
-	if (typeof sub !== "string" || sub === "") return void 0;
-	return typeof reason === "string" ? {
-		id: sub,
-		reason
-	} : { id: sub };
-}
-//#endregion
-//#region src/auth/actor.ts
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function copyAct(level) {
-	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
-	return Object.fromEntries(entries);
-}
-/**
-* Reads only `act` and `client_id`, the way PermDock's `actorOf` does. An
-* `act` that is not a chain of objects each with a non-empty `sub` is
-* `{ ok: false }`: the session must not pass as the user alone.
-*/
-function actorOf(claims) {
-	const outer = claims["act"];
-	if (outer !== void 0) {
-		let level = outer;
-		while (level !== void 0) {
-			if (!isRecord(level)) return {
-				ok: false,
-				reason: "invalid-chain"
-			};
-			const sub = level["sub"];
-			if (typeof sub !== "string" || sub === "") return {
-				ok: false,
-				reason: "invalid-chain"
-			};
-			level = level["act"];
-		}
-		if (!isRecord(outer) || typeof outer["sub"] !== "string") return {
-			ok: false,
-			reason: "invalid-chain"
-		};
-		return {
-			ok: true,
-			actor: {
-				id: outer["sub"],
-				kind: "oauth-client",
-				chain: copyAct(outer)
-			}
-		};
-	}
-	const client = claims["client_id"];
-	if (typeof client === "string" && client !== "") return {
-		ok: true,
-		actor: {
-			id: client,
-			kind: "oauth-client"
-		}
-	};
-	return { ok: true };
-}
-/** The OAuth `scope` claim (a space-separated string or a list); `undefined` when empty. */
-function delegationOf(claims) {
-	const scope = claims["scope"];
-	const scopes = typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : Array.isArray(scope) ? scope.filter((item) => typeof item === "string") : [];
-	return scopes.length > 0 ? { scopes } : void 0;
-}
-//#endregion
 //#region src/auth/refresh.ts
 /**
 * How long a finished refresh is reused for requests still carrying the old
@@ -284,7 +206,7 @@ function serverEnv(options) {
 		url: env.url,
 		publishableKeys: { default: env.publishableKey },
 		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
-		jwks: options.jwks ?? env.jwksUrl
+		jwks: options.jwks ?? env.jwks ?? env.jwksUrl
 	};
 }
 const MEMO_SIZE = 256;
@@ -295,7 +217,7 @@ let memoByJwks = /* @__PURE__ */ new WeakMap();
 * and island resolves the same token again; this skips the signature check.
 */
 function memoFor(options) {
-	const jwks = options.jwks;
+	const jwks = options.jwks ?? options.env.jwks;
 	if (jwks && typeof jwks === "object" && !(jwks instanceof URL)) {
 		let memo = memoByJwks.get(jwks);
 		if (!memo) memoByJwks.set(jwks, memo = /* @__PURE__ */ new Map());
@@ -311,6 +233,42 @@ function memoFor(options) {
 	if (!memo) memoByUrl.set(key, memo = /* @__PURE__ */ new Map());
 	return memo;
 }
+function sameJson(a, b) {
+	if (a === b) return true;
+	if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
+	if (Array.isArray(a) !== Array.isArray(b)) return false;
+	const left = Object.entries(a);
+	const right = new Map(Object.entries(b));
+	return left.length === right.size && left.every(([key, value]) => right.has(key) && sameJson(value, right.get(key)));
+}
+/**
+* Records a token that `@supabase/server` verified for this request, so the
+* next `resolveAuth` with these options doesn't verify it again. Only when
+* `claims` is the token's own payload, it hasn't expired, and its `iss` and
+* `aud` pass the checks these options would apply; otherwise returns false
+* and the token is verified as usual.
+*/
+function rememberVerified(options, verified) {
+	const { token, claims, user } = verified;
+	const now = Math.floor((options.now ?? Date.now)() / 1e3);
+	const expiresAt = typeof claims.exp === "number" ? claims.exp : null;
+	if (expiresAt === null || expiresAt <= now) return false;
+	if (!sameJson(decodeJwtPayload(token), claims)) return false;
+	const issuers = [options.issuer ?? `${options.env.url}/auth/v1`].flat();
+	if (typeof claims.iss !== "string" || !issuers.includes(claims.iss)) return false;
+	const audiences = [options.audience ?? "authenticated"].flat();
+	const aud = claims.aud;
+	const given = Array.isArray(aud) ? aud : [aud];
+	if (!audiences.some((audience) => given.includes(audience))) return false;
+	remember(memoFor(options), token, {
+		kind: "user",
+		token,
+		claims,
+		user,
+		expiresAt
+	}, expiresAt);
+	return true;
+}
 function remembered(memo, token, now) {
 	const hit = memo.get(token);
 	if (!hit) return void 0;
@@ -385,7 +343,7 @@ async function checkClaims(state, options) {
 	if (!actorOf(state.claims).ok) return {
 		kind: "invalid",
 		reason: "actor",
-		error: dbError("unauthorized", "The token's act claim is not a chain of actors with a sub", { code: "ACTOR_INVALID" })
+		error: dbError("unauthorized", "The token's act claim is not a chain of actors with a sub, or has a kind other than support or impersonation", { code: "ACTOR_INVALID" })
 	};
 	if (!options.claims) return state;
 	let outcome = options.claims["~standard"].validate(state.claims);
@@ -444,7 +402,7 @@ function base64url(text) {
 * fetch it as before.
 */
 function prefetchJwks(options) {
-	if (options.jwks !== void 0) return Promise.resolve();
+	if (options.jwks !== void 0 || options.env.jwks !== void 0) return Promise.resolve();
 	return verifyCredentials({
 		token: PREFETCH_TOKEN,
 		apikey: null
@@ -546,6 +504,10 @@ async function resolveAuth(request, options) {
 		token: null,
 		apikey: credentials.apikey
 	}, options.secret === true ? ["secret"] : options.secret.map((name) => `secret:${name}`), options, "bearer"), cookies);
+	if (options.cookies === false) return resolution({
+		kind: "anon",
+		reason: "none"
+	}, cookies);
 	const name = options.cookie?.name ?? sessionCookieName(options.env.url);
 	const session = readSession(cookies(), name);
 	if (!session) {
@@ -611,19 +573,7 @@ async function resolveAuth(request, options) {
 /** The repository context (`actor`, `claims`) for an auth state. */
 function authContext(auth) {
 	switch (auth.kind) {
-		case "user": {
-			const impersonator = impersonatorOf(auth.claims);
-			return {
-				actor: {
-					id: auth.user.id,
-					kind: "user",
-					...auth.user.role === void 0 ? {} : { role: auth.user.role },
-					...auth.user.email === void 0 ? {} : { email: auth.user.email },
-					...impersonator ? { impersonator: impersonator.id } : {}
-				},
-				claims: auth.claims
-			};
-		}
+		case "user": return userContext(auth.user, auth.claims);
 		case "service": return {
 			actor: {
 				id: `service:${auth.keyName}`,
@@ -682,4 +632,53 @@ function checkAal(auth, required) {
 	});
 }
 //#endregion
-export { delegationOf as _, clientIp as a, AUTH_CACHE_HEADERS as c, readSession as d, serializeCookie as f, actorOf as g, refreshSession as h, authContext as i, applyCookieWrites as l, writeSession as m, amrOf as n, prefetchJwks as o, sessionCookieName as p, checkAal as r, resolveAuth as s, aalOf as t, parseCookies as u, actClaim as v, impersonatorOf as y };
+//#region src/auth/view.ts
+/** Whether the token belongs to an anonymous user (`signInAnonymously()`). */
+function isAnonymousUser(claims) {
+	return "is_anonymous" in claims && claims.is_anonymous === true;
+}
+/** Drops the token from an `AuthState`, leaving only serializable fields. */
+function toSession(auth) {
+	switch (auth.kind) {
+		case "user": {
+			const impersonator = impersonatorOf(auth.claims);
+			const outcome = actorOf(auth.claims);
+			const actor = outcome.ok ? outcome.actor : void 0;
+			const client = actor?.kind === "oauth-client" ? actor : void 0;
+			const scopes = client ? delegationOf(auth.claims)?.scopes : void 0;
+			const delegation = client && (scopes || client.chain) ? {
+				scopes: scopes ?? [],
+				...client.chain ? { chain: client.chain } : {}
+			} : void 0;
+			return {
+				kind: "user",
+				user: auth.user,
+				claims: auth.claims,
+				expiresAt: auth.expiresAt,
+				...auth.profile === void 0 ? {} : { profile: auth.profile },
+				aal: aalOf(auth.claims),
+				anonymous: isAnonymousUser(auth.claims),
+				amr: amrOf(auth.claims),
+				...impersonator ? { impersonator } : {},
+				...actor ? { actor } : {},
+				...delegation ? { delegation } : {}
+			};
+		}
+		case "service": return {
+			kind: "service",
+			keyName: auth.keyName
+		};
+		case "anon": return {
+			kind: "anon",
+			reason: auth.reason
+		};
+		case "invalid": return {
+			kind: "invalid",
+			reason: auth.reason,
+			error: auth.error
+		};
+		default: return auth;
+	}
+}
+//#endregion
+export { writeSession as _, checkAal as a, prefetchJwks as c, AUTH_CACHE_HEADERS as d, applyCookieWrites as f, sessionCookieName as g, serializeCookie as h, amrOf as i, rememberVerified as l, readSession as m, toSession as n, authContext as o, parseCookies as p, aalOf as r, clientIp as s, isAnonymousUser as t, resolveAuth as u, refreshSession as v };

package/dist/{view-B64o81wp.d.ts → view-CbgObAeb.d.ts}

@@ -1,30 +1,8 @@
-import { p as DbError } from "./result-CqEsbgYs.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-C7MNQ1Ob.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-BAqQcwMW.js";
+import { _ as DbError } from "./executor-BunPOO-k.js";
+import { n as Impersonator, o as AuthState, s as InvalidReason } from "./impersonation-BmePsuxz.js";
+import { n as AmrEntry, t as Aal } from "./mfa-Cu96oJdw.js";
+import { n as SessionActor, r as SessionDelegation } from "./actor-DaJjqD5R.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
-//#region src/auth/actor.d.ts
-/** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
-interface ActClaim {
-  readonly sub: string;
-  readonly act?: ActClaim;
-  readonly [claim: string]: unknown;
-}
-/**
- * The app acting for the user: the outermost `sub` of an RFC 8693 `act`
- * chain (prior actors stay on `chain`), else the OAuth `client_id` of a
- * Supabase OAuth server token.
- */
-interface SessionActor {
-  readonly id: string;
-  readonly kind: "oauth-client";
-  readonly chain?: ActClaim;
-}
-/** What the user delegated to the actor: the token's OAuth `scope`. */
-interface SessionDelegation {
-  readonly scopes: readonly string[];
-  readonly chain?: ActClaim;
-}
-//#endregion
 //#region src/auth/view.d.ts
 /**
  * The verified caller as plain data: no token, no clients. Safe to return
@@ -48,16 +26,29 @@ type AuthSession<C = unknown, P = unknown> = {
   readonly profile?: P;
   /** `aal2` once the user verified a second factor in this session. */
   readonly aal: Aal;
+  /**
+   * Signed in with `signInAnonymously()` (the `is_anonymous` claim). Guards
+   * refuse these users unless `allow` lists `'anonymous'`; `'anon'` means
+   * no session and never admits them.
+   */
+  readonly anonymous: boolean;
   /** How the user signed in (`password`, `totp`, `sso/saml`, ...). */
   readonly amr: readonly AmrEntry[];
-  /** Set when an admin acts as this user (the `act` claim), for a banner. */
+  /**
+   * Set when an admin acts as this user in a support session or an
+   * impersonated session (`act.kind`), for a banner. Matches `actor`.
+   */
   readonly impersonator?: Impersonator;
   /**
-   * The OAuth client or agent acting for the user (`client_id`, or the
-   * outermost `sub` of the `act` chain), as PermDock's `actorOf` reads it.
+   * Who acts for the user: an OAuth client or agent (`client_id`, or an
+   * `act` chain without `kind`), a support session or an impersonated
+   * session, as PermDock's `actorOf` reads it.
    */
   readonly actor?: SessionActor;
-  /** The scopes the user granted `actor`, plus its `act` chain. Set only with `actor`. */
+  /**
+   * The scopes the user granted an `oauth-client` actor, plus its `act`
+   * chain. Never set for a support or impersonated session.
+   */
   readonly delegation?: SessionDelegation;
 } | {
   readonly kind: "service";
@@ -76,4 +67,4 @@ type AnonReason = Extract<AuthState, {
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
 declare function toSession<C, P>(auth: AuthState<C, P>): AuthSession<C, P>;
 //#endregion
-export { SessionDelegation as a, SessionActor as i, toSession as n, ActClaim as r, AuthSession as t };
+export { toSession as n, AuthSession as t };

package/dist/webhooks/index.d.ts

@@ -1,7 +1,12 @@
 /// <reference lib="esnext.temporal" />
-import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { o as Result } from "../result-CqEsbgYs.js";
-import { t as BetterSupabase } from "../define-CRS2MRV3.js";
+import { P as TableKey, k as Row, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
+import { S as ErrorMapper, a as AsyncResult, u as Result } from "../executor-BunPOO-k.js";
+import { a as EventHub } from "../events-aIO7vsIk.js";
+import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
+import { g as RequestContext } from "../plugin-o144f322.js";
+import { r as EventSink } from "../index-DOESKG27.js";
+import { i as sqlTransport, n as RpcClient, r as rpcTransport, t as KitTransport } from "../kit-transport-B82k1djG.js";
+import { _ as PublicUrlOptions, a as hmacSigner, b as publicUrl, c as WebhookSecretStore, d as WebhookPolicyError, f as WebhookRequest, g as AllowUrl, h as fetchTransport, i as WebhookSigner, l as sqlSecretStore, m as WebhookTransport, n as StandardWebhooksOptions, o as standardWebhooks, p as WebhookResponse, r as WebhookSignInput, s as RotateSecretOptions, t as HmacSignerOptions, u as FetchTransportOptions, v as ResolveHost, y as isPublicAddress } from "../signers-Cc6r98SW.js";
 //#region src/webhooks/verify.d.ts
 interface VerifiedWebhook<T = unknown> {
   readonly id: string;
@@ -73,6 +78,8 @@ interface AuthHooks {
         readonly site_url: string;
         readonly token_new: string;
         readonly token_hash_new: string;
+        /** Auth adds fields over time (`old_email`, `factor_type`, ...). */
+        readonly [key: string]: unknown;
       };
     };
     output: Record<never, never>;
@@ -151,4 +158,128 @@ export declare function isDatabaseWebhook(value: unknown): value is DatabaseWebh
  */
 export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
 //#endregion
-export type { AuthHookError, AuthHookKind, AuthHooks, DatabaseChange, DatabaseWebhookPayload, VerifiedWebhook, VerifyOptions, WebhookInput };
+//#region src/webhooks/outgoing.d.ts
+/** One claimed delivery, as `shouldDeliver`, `transform` and `headers` see it. */
+interface WebhookDelivery {
+  readonly id: string;
+  readonly endpointId: string;
+  readonly url: string;
+  readonly type: string;
+  readonly payload: unknown;
+  /** 1 on the first try. Counted when the delivery is claimed. */
+  readonly attempt: number;
+  readonly tenant: string | null;
+  readonly eventId: string | null;
+  readonly runId: string | null;
+  readonly createdAt: Temporal.Instant;
+}
+interface RetryPolicy {
+  /** Attempts before a delivery is dead-lettered. Defaults to 8. */
+  readonly maxAttempts?: number;
+  /**
+   * Seconds before the next attempt. Defaults to 5 seconds, 5 minutes, 30
+   * minutes, 2 hours, 5 hours, then 10 hours, each with full jitter. A
+   * receiver's `Retry-After` wins when it asks for longer, up to a day.
+   */
+  readonly backoff?: (attempt: number) => number;
+  /** Statuses worth retrying. Defaults to 408, 429 and 5xx; network errors always retry. */
+  readonly retryable?: (status: number) => boolean;
+}
+interface WebhooksOptions {
+  /** `sqlTransport(postgres.admin)` for the worker, or the user's connection to manage. */
+  readonly transport: KitTransport;
+  /** `kits.webhooks-out.schema`. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  /** Defaults to `fetchTransport({ allowUrl })`. */
+  readonly http?: WebhookTransport;
+  /** Used by the default `http`. Defaults to `publicUrl()`. */
+  readonly allowUrl?: AllowUrl;
+  /** Defaults to `standardWebhooks()`. */
+  readonly signer?: WebhookSigner;
+  /** Defaults to `sqlSecretStore(transport)`. */
+  readonly secrets?: WebhookSecretStore;
+  readonly retry?: RetryPolicy;
+  /** Return `false` (or throw) to cancel a delivery instead of sending it. */
+  readonly shouldDeliver?: (delivery: WebhookDelivery) => boolean | Promise<boolean>;
+  /**
+   * The JSON body. Defaults to the Standard Webhooks envelope,
+   * `{ type, timestamp, data }`.
+   */
+  readonly transform?: (delivery: WebhookDelivery) => unknown;
+  /** Extra headers, e.g. an `idempotency-key`. */
+  readonly headers?: (delivery: WebhookDelivery) => Readonly<Record<string, string>>;
+  /** Characters of the response body kept in the log. Defaults to 2000. */
+  readonly responseBodyLimit?: number;
+  /** `betterSupabase.events`, for `webhook.*` kit events. */
+  readonly events?: EventHub;
+  readonly context?: RequestContext;
+  readonly errorMappers?: readonly ErrorMapper[];
+}
+interface PublishInput {
+  readonly type: string;
+  readonly data: unknown;
+  readonly tenant?: string;
+  /** With an id, publishing it again never queues a second delivery. */
+  readonly id?: string;
+}
+interface DispatchInput {
+  readonly endpointId: string;
+  readonly type: string;
+  readonly data: unknown;
+  /** An external run id stored with the delivery, e.g. a workflow run. */
+  readonly runId?: string;
+  readonly eventId?: string;
+}
+interface DeliverWebhooksOptions {
+  /** Deliveries per claim. Defaults to 25. */
+  readonly batch?: number;
+  /**
+   * Requests in flight at once. Defaults to 10, so a batch of 25 at the
+   * 10-second timeout finishes well inside the lease.
+   */
+  readonly concurrency?: number;
+  /** How long a claim holds a delivery. Defaults to `'2 minutes'`. */
+  readonly lease?: string;
+  readonly budgetMs?: number;
+}
+interface DeliverWebhooksResult {
+  readonly succeeded: number;
+  /** Failed attempts that will retry. */
+  readonly retrying: number;
+  /** Deliveries that ran out of attempts or can't succeed. */
+  readonly dead: number;
+  readonly canceled: number;
+  /** Endpoints disabled after failing for `disableAfter`. */
+  readonly disabled: number;
+}
+interface WebhooksRouteOptions extends DeliverWebhooksOptions {
+  readonly secret: string | undefined;
+  readonly onError?: (error: unknown) => void;
+}
+interface Webhooks {
+  /** Queues the event for each subscribed endpoint; returns how many. */
+  publish(event: PublishInput): AsyncResult<number>;
+  /** Sends to one endpoint outside its subscriptions; returns the delivery id. */
+  dispatch(input: DispatchInput): AsyncResult<string>;
+  /** Queues a finished delivery again. */
+  redeliver(deliveryId: string): AsyncResult<string>;
+  /** A new signing secret, returned once. */
+  rotateSecret(endpointId: string, options?: RotateSecretOptions): AsyncResult<string>;
+  /** Sends due deliveries. Run it from a cron route or a job. */
+  deliver(options?: DeliverWebhooksOptions): Promise<DeliverWebhooksResult>;
+  /** A `GET`/`POST` handler for Vercel Cron that runs `deliver` behind a bearer secret. */
+  deliverRoute(options: WebhooksRouteOptions): (request: Request) => Promise<Response>;
+  /**
+   * An `EventSink` that publishes CloudEvents, e.g. from the outbox relay.
+   * Endpoints subscribe to unprefixed types, so it removes `typePrefix`
+   * (`dev.better-supabase` by default, the relay's default) and the dot.
+   */
+  sink(options?: WebhookSinkOptions): EventSink;
+}
+interface WebhookSinkOptions {
+  /** The relay's `typePrefix`. */
+  readonly typePrefix?: string;
+}
+export declare function createWebhooks(options: WebhooksOptions): Webhooks;
+//#endregion
+export { type AllowUrl, type AuthHookError, type AuthHookKind, type AuthHooks, type DatabaseChange, type DatabaseWebhookPayload, type DeliverWebhooksOptions, type DeliverWebhooksResult, type DispatchInput, type FetchTransportOptions, type HmacSignerOptions, type KitTransport, type PublicUrlOptions, type PublishInput, type ResolveHost, type RetryPolicy, type RotateSecretOptions, type RpcClient, type StandardWebhooksOptions, type VerifiedWebhook, type VerifyOptions, type WebhookDelivery, type WebhookInput, WebhookPolicyError, type WebhookRequest, type WebhookResponse, type WebhookSecretStore, type WebhookSignInput, type WebhookSigner, type WebhookSinkOptions, type WebhookTransport, type Webhooks, type WebhooksOptions, type WebhooksRouteOptions, fetchTransport, hmacSigner, isPublicAddress, publicUrl, rpcTransport, sqlSecretStore, sqlTransport, standardWebhooks };