better-supabase 0.5.0 → 0.6.0

package/dist/actor-CQTlc1Hh.d.ts

@@ -0,0 +1,43 @@
+//#region src/auth/actor.d.ts
+/** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
+interface ActClaim {
+  readonly sub: string;
+  readonly act?: ActClaim;
+  readonly [claim: string]: unknown;
+}
+/**
+ * Who acts for the user, from the outermost level of the RFC 8693 `act`
+ * claim, by its `kind`:
+ *
+ * - `oauth-client`: an `act` without `kind` (prior actors stay on `chain`),
+ *   else the OAuth `client_id` of a Supabase OAuth server token. Only this
+ *   kind is limited to the scopes the user delegated.
+ * - `support`: an admin in a support session (`act.kind: "support"`, from
+ *   `supportClaims`). An `act` without `kind` but with `session_id`, as
+ *   0.5.0 minted it, is an invalid chain.
+ * - `impersonation`: an admin acting as the user (`act.kind:
+ *   "impersonation"`, from `actClaim`).
+ */
+type SessionActor = {
+  readonly kind: "oauth-client";
+  readonly id: string;
+  readonly chain?: ActClaim;
+} | {
+  readonly kind: "support";
+  readonly id: string;
+  readonly sessionId: string;
+  /** `act.read_only`; a support token without it is read-only. */
+  readonly readOnly: boolean;
+  readonly reason?: string;
+} | {
+  readonly kind: "impersonation";
+  readonly id: string;
+  readonly reason?: string;
+};
+/** What the user delegated to the actor: the token's OAuth `scope`. */
+interface SessionDelegation {
+  readonly scopes: readonly string[];
+  readonly chain?: ActClaim;
+}
+//#endregion
+export { SessionActor as n, SessionDelegation as r, ActClaim as t };