better-supabase 0.5.0 → 0.6.0

package/dist/blocks/settings/index.js

@@ -0,0 +1,104 @@
+import { n as dbError } from "../../errors-B11Duf73.js";
+import { r as err, t as AsyncResult } from "../../result-DzUbqgdW.js";
+import { n as validate } from "../../standard-BK0cqJ7y.js";
+import { n as rpcTransport, r as sqlTransport } from "../../block-transport-BLr-ZgLc.js";
+import { d as isRecord, i as blockCall, n as applyTemporal } from "../../block-helpers-DWHxHsEQ.js";
+//#region src/blocks/settings/settings.ts
+/**
+* Declares the app's settings with a Standard Schema per key. Values are
+* validated before they are written, and stored values that no longer match
+* their schema read as the default.
+*/
+function defineSettings(spec) {
+	const user = spec.user ?? {};
+	const organization = spec.organization ?? {};
+	const platform = spec.platform ?? {};
+	return {
+		schemas: {
+			user,
+			organization,
+			platform
+		},
+		connect: (options) => {
+			applyTemporal(options);
+			const call = blockCall(options.transport, options.schema, options.mappers);
+			return {
+				user: userScope(user, call),
+				organization: organizationScope(organization, call),
+				platform: platformScope(platform, call)
+			};
+		}
+	};
+}
+/** Stored values merged over the defaults; unknown keys are dropped. */
+async function merged(entries, stored) {
+	const values = isRecord(stored) ? stored : {};
+	const out = {};
+	for (const [key, entry] of Object.entries(entries)) out[key] = await readValue(entry, values[key]);
+	return out;
+}
+async function readValue(entry, stored) {
+	if (stored === void 0) return entry.default;
+	const parsed = await validate(entry.schema, stored);
+	return parsed.ok ? parsed.data : entry.default;
+}
+function unknownSetting(key) {
+	return AsyncResult.from(() => Promise.resolve(err(dbError("invalid_input", `Unknown setting "${key}"`))));
+}
+/** Reads every key, or one key, through `fn`. */
+function reader(entries, call, fn, args, key) {
+	if (key !== void 0 && !(key in entries)) return unknownSetting(key);
+	return call(fn, args, async (stored) => {
+		const values = await merged(entries, stored);
+		return key === void 0 ? values : values[key];
+	});
+}
+/** Validates `value` with the key's schema, then writes the output through `fn`. */
+function writer(entries, call, fn, args, key, value) {
+	const entry = entries[key];
+	if (!entry) return unknownSetting(key);
+	return AsyncResult.from(() => validate(entry.schema, value, `setting "${key}"`)).andThen((output) => call(fn, {
+		...args,
+		key,
+		value: { value: output ?? null }
+	}, () => output));
+}
+function remover(entries, call, fn, args, key) {
+	if (!(key in entries)) return unknownSetting(key);
+	return call(fn, {
+		...args,
+		key
+	}, (removed) => removed === true);
+}
+function userScope(entries, call) {
+	function get(key) {
+		return reader(entries, call, "get_user_settings", {}, key);
+	}
+	return {
+		get,
+		set: (key, value) => writer(entries, call, "set_user_setting", {}, key, value),
+		reset: (key) => remover(entries, call, "reset_user_setting", {}, key)
+	};
+}
+function organizationScope(entries, call) {
+	function get(organizationId, key) {
+		return reader(entries, call, "get_organization_settings", { tenant: organizationId }, key);
+	}
+	return {
+		get,
+		set: (organizationId, key, value) => writer(entries, call, "set_organization_setting", { tenant: organizationId }, key, value),
+		reset: (organizationId, key) => remover(entries, call, "reset_organization_setting", { tenant: organizationId }, key)
+	};
+}
+function platformScope(entries, call) {
+	function get(key) {
+		return reader(entries, call, "get_platform_settings", {}, key);
+	}
+	return {
+		get,
+		set: (key, value) => writer(entries, call, "set_platform_setting", {}, key, value),
+		reset: (key) => remover(entries, call, "reset_platform_setting", {}, key)
+	};
+}
+//#endregion
+export { defineSettings, rpcTransport, sqlTransport };

package/dist/blocks/sso/index.d.ts

@@ -0,0 +1,198 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult, w as ErrorMapper } from "../../result-D7y2fT87.js";
+import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
+import { r as BlockTemporalOptions } from "../../block-helpers-CKtbFcRv.js";
+import { s as ApiKeys } from "../../api-keys-rCGtKaZA.js";
+//#region src/blocks/sso/sso.d.ts
+/** The DNS record that proves a domain belongs to the organization. */
+interface DomainRecord {
+  readonly type: "TXT";
+  readonly name: string;
+  readonly value: string;
+}
+interface OrganizationDomain {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly domain: string;
+  readonly verifiedAt: Temporal.Instant | undefined;
+  /** New users with a confirmed email at the domain join with this role. */
+  readonly autoJoinRole: string | undefined;
+  /** Sessions of users at the domain need SAML (`sso_access_token_check`). */
+  readonly enforceSso: boolean;
+  readonly createdBy: string | undefined;
+  readonly createdAt: Temporal.Instant;
+  /** Publish this TXT record, then call `verifyDomain`. */
+  readonly record: DomainRecord;
+}
+interface SsoProvider {
+  /** The Supabase Auth SSO provider id, for `signInWithSSO({ providerId })`. */
+  readonly id: string;
+  readonly organizationId: string;
+  readonly type: "saml";
+  readonly metadataUrl: string | undefined;
+  readonly domains: readonly string[];
+  readonly createdAt: Temporal.Instant;
+}
+/** The provider an email address signs in with. */
+interface SsoDomain {
+  readonly domain: string;
+  readonly organizationId: string;
+  readonly providerId: string;
+  readonly enforceSso: boolean;
+}
+interface SsoOptions extends BlockTemporalOptions {
+  /** The caller's transport (`rpcTransport(supabase)`). */
+  readonly transport: BlockTransport;
+  /** The module schema (`sql.modules.sso.schema`), default `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+}
+interface Sso {
+  /** Claims a domain (needs `sso.manage`); publish its `record`, then verify it. */
+  addDomain(organizationId: string, domain: string): AsyncResult<OrganizationDomain>;
+  domains(organizationId: string): AsyncResult<readonly OrganizationDomain[]>;
+  /** Sets auto-join and SSO enforcement; both need a verified domain. */
+  updateDomain(domainId: string, settings: {
+    readonly autoJoinRole?: string | null;
+    readonly enforceSso?: boolean;
+  }): AsyncResult<OrganizationDomain>;
+  removeDomain(domainId: string): AsyncResult<boolean>;
+  providers(organizationId: string): AsyncResult<readonly SsoProvider[]>;
+  /** The SSO provider for an email address, for the sign-in page. Works signed out. */
+  domainFor(email: string): AsyncResult<SsoDomain | undefined>;
+}
+/** Organization domains and SSO lookups as the caller. */
+export declare function createSso(options: SsoOptions): Sso;
+/** Looks up the TXT strings at a name; an empty list when it has none. */
+type TxtResolver = (name: string, signal?: AbortSignal) => Promise<readonly string[]>;
+interface DohResolverOptions {
+  /** A DNS-over-HTTPS JSON endpoint. Default Cloudflare's `https://cloudflare-dns.com/dns-query`. */
+  readonly endpoint?: string;
+  readonly fetch?: typeof fetch;
+}
+/** TXT lookups over DNS-over-HTTPS (the `application/dns-json` API). */
+export declare function dohResolver(options?: DohResolverOptions): TxtResolver;
+interface SsoAuthAdmin {
+  /** The project URL (`SUPABASE_URL`). */
+  readonly url: string;
+  /** A secret or service-role key. Server-only. */
+  readonly secretKey: string;
+  readonly fetch?: typeof fetch;
+}
+interface SsoAdminOptions extends BlockTemporalOptions {
+  /** A service-role transport: these functions are granted to `service_role` only. */
+  readonly transport: BlockTransport;
+  /** Supabase Auth's admin API, for SAML providers. */
+  readonly auth?: SsoAuthAdmin;
+  /** TXT lookups for `verifyDomain`. Default `dohResolver()`. */
+  readonly resolver?: TxtResolver;
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+}
+/** Who asked, so the database checks `sso.manage`; omit for app-owned calls. */
+interface SsoActor {
+  readonly actorId?: string;
+}
+type SamlMetadata = {
+  readonly metadataUrl: string;
+  readonly metadataXml?: never;
+} | {
+  readonly metadataXml: string;
+  readonly metadataUrl?: never;
+};
+type SamlProviderInput = SamlMetadata & {
+  /** Verified domains of the organization whose users sign in with this provider. */
+  readonly domains: readonly string[];
+  /** Supabase Auth's `attribute_mapping`, such as `{ keys: { email: { name: "mail" } } }`. */
+  readonly attributeMapping?: Readonly<Record<string, unknown>>;
+  readonly nameIdFormat?: string;
+};
+interface SsoAdmin {
+  /** Looks up the domain's TXT record and marks it verified when the token is there. */
+  verifyDomain(domainId: string, options?: SsoActor & {
+    readonly signal?: AbortSignal;
+  }): AsyncResult<OrganizationDomain>;
+  /** Creates a SAML provider in Supabase Auth and records it for the organization. */
+  addSamlProvider(organizationId: string, input: SamlProviderInput, options?: SsoActor): AsyncResult<SsoProvider>;
+  updateSamlProvider(providerId: string, input: Partial<SamlProviderInput> & {
+    readonly domains: readonly string[];
+  }, options?: SsoActor): AsyncResult<SsoProvider>;
+  /** Deletes the provider from Supabase Auth; `undefined` when the organization has no such provider. */
+  removeSamlProvider(providerId: string, options?: SsoActor): AsyncResult<SsoProvider | undefined>;
+}
+/** Domain verification and SAML providers with a service-role client. */
+export declare function createSsoAdmin(options: SsoAdminOptions): SsoAdmin;
+//#endregion
+//#region src/blocks/sso/scim.d.ts
+interface ScimHandlerOptions extends BlockTemporalOptions {
+  /** A service-role transport: the SCIM functions are granted to `service_role` only. */
+  readonly transport: BlockTransport;
+  /** Verifies the bearer token: an organization API key with the `scim` scope. */
+  readonly keys: Pick<ApiKeys, "verify">;
+  /** The path the handler is mounted at, such as `/scim/v2`. Default empty. */
+  readonly basePath?: string;
+  /** The API key scope SCIM needs. Default `scim`. */
+  readonly scope?: string;
+  /** Page size and the largest `count`. Default 100. */
+  readonly maxResults?: number;
+  readonly documentationUri?: string;
+  readonly schema?: string;
+}
+/**
+ * A SCIM 2.0 service provider (RFC 7644) as a web handler: `/Users` and
+ * `/Groups` with filters, PATCH and ETags, plus the discovery endpoints.
+ * Each request authenticates with an organization API key that has the
+ * `scim` scope, and only touches that organization.
+ */
+export declare function scimHandler(options: ScimHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/blocks/sso/scim-filter.d.ts
+type CompareOp = "eq" | "ne" | "co" | "sw" | "ew" | "gt" | "ge" | "lt" | "le";
+type ScimFilter = {
+  readonly op: "and" | "or";
+  readonly left: ScimFilter;
+  readonly right: ScimFilter;
+} | {
+  readonly op: "not";
+  readonly filter: ScimFilter;
+} | {
+  readonly op: "pr";
+  readonly path: string;
+} | {
+  readonly op: CompareOp;
+  readonly path: string;
+  readonly value: string | number | boolean | null;
+} | {
+  readonly op: "value";
+  readonly path: string;
+  readonly filter: ScimFilter;
+};
+/** A filter the service provider can't parse or apply: 400 `invalidFilter`. */
+export declare class ScimFilterError extends Error {
+  override readonly name = "ScimFilterError";
+}
+/** Parses a SCIM filter; throws `ScimFilterError`. */
+declare function parseFilter(input: string): ScimFilter;
+/** Whether `resource` matches; a multi-valued attribute matches when any value does. */
+declare function matches(resource: Record<string, unknown>, filter: ScimFilter): boolean;
+//#endregion
+//#region src/blocks/sso/scim-schema.d.ts
+/** SCIM 2.0 schema URIs and the attributes this service provider supports (RFC 7643). */
+export declare const SCIM_USER = "urn:ietf:params:scim:schemas:core:2.0:User";
+export declare const SCIM_GROUP = "urn:ietf:params:scim:schemas:core:2.0:Group";
+interface ScimAttribute {
+  readonly name: string;
+  readonly type: "string" | "boolean" | "complex" | "reference";
+  readonly multiValued: boolean;
+  readonly description: string;
+  readonly required: boolean;
+  readonly caseExact?: boolean;
+  readonly canonicalValues?: readonly string[];
+  readonly referenceTypes?: readonly string[];
+  readonly mutability: "readOnly" | "readWrite" | "immutable" | "writeOnly";
+  readonly returned: "always" | "never" | "default" | "request";
+  readonly uniqueness?: "none" | "server" | "global";
+  readonly subAttributes?: readonly ScimAttribute[];
+}
+//#endregion
+export { type BlockTransport, type DohResolverOptions, type DomainRecord, type OrganizationDomain, type SamlMetadata, type SamlProviderInput, type ScimAttribute, type ScimFilter, type ScimHandlerOptions, type Sso, type SsoActor, type SsoAdmin, type SsoAdminOptions, type SsoAuthAdmin, type SsoDomain, type SsoOptions, type SsoProvider, type TxtResolver, matches as matchesScimFilter, parseFilter as parseScimFilter, rpcTransport, sqlTransport };