better-supabase 0.5.1 → 0.6.0

package/dist/temporal-CVlIV2DZ.js

@@ -1,40 +0,0 @@
-const TEMPORAL_MISSING = `Temporal is not available in this runtime. Import "temporal-polyfill/global" once at startup.`;
-/** The runtime's `Temporal`, or `undefined` before the polyfill loads. */
-function optionalTemporal() {
-	return globalThis.Temporal;
-}
-/**
-* The current instant, the default `now` everywhere. Without Temporal it
-* throws a `TypeError` that names the polyfill.
-*/
-function nowInstant() {
-	const namespace = optionalTemporal();
-	if (namespace === void 0) throw new TypeError(TEMPORAL_MISSING);
-	return namespace.Now.instant();
-}
-const ISO_TAGS = /* @__PURE__ */ new Set([
-	"Temporal.Instant",
-	"Temporal.PlainDateTime",
-	"Temporal.PlainDate",
-	"Temporal.PlainTime"
-]);
-/**
-* The text Postgres reads back for a Temporal value: ISO 8601, with a
-* `ZonedDateTime` sent as its instant because Postgres rejects the
-* `[Region/City]` annotation. `undefined` for anything else.
-*
-* Values are recognized by `Symbol.toStringTag`, not `instanceof`, so values
-* from another realm or a second copy of the polyfill still encode.
-*/
-function temporalText(value) {
-	if (typeof value !== "object" || value === null) return void 0;
-	if (!(Symbol.toStringTag in value)) return void 0;
-	const tag = value[Symbol.toStringTag];
-	if (ISO_TAGS.has(tag)) return String(value);
-	return tag === "Temporal.ZonedDateTime" && isZoned(value) ? String(value.toInstant()) : void 0;
-}
-function isZoned(value) {
-	return "toInstant" in value && typeof value.toInstant === "function";
-}
-//#endregion
-export { temporalText as i, nowInstant as n, optionalTemporal as r, TEMPORAL_MISSING as t };

package/dist/user-change-CHFEUro1.js

@@ -1,49 +0,0 @@
-//#region src/query/invalidate.ts
-function isString(value) {
-	return typeof value === "string";
-}
-function queryTables(query) {
-	const tables = query.meta?.["bsTables"];
-	if (Array.isArray(tables)) {
-		const list = tables;
-		return list.every(isString) ? list : list.filter(isString);
-	}
-	const [prefix, table] = query.queryKey;
-	return prefix === "bs" && typeof table === "string" ? [table] : void 0;
-}
-/**
-* Invalidates every query that read one of `tables`: better-supabase queries
-* by their `meta.bsTables`, and other `['bs', table, ...]` keys by prefix.
-*/
-function invalidateTables(client, tables) {
-	if (tables.length === 0) return Promise.resolve();
-	const changed = new Set(tables);
-	return client.invalidateQueries({ predicate: (query) => queryTables(query)?.some((table) => changed.has(table)) ?? false });
-}
-//#endregion
-//#region src/query/user-change.ts
-/**
-* Removes every `['bs', ...]` query when the signed-in user changes or signs
-* out, so the next user never sees the previous user's rows. Returns the
-* function that stops listening. `BetterSupabaseProvider` calls it for React;
-* call it yourself with Vue, Solid, Svelte or Angular Query.
-*
-* ```ts
-* const stop = clearOnUserChange(queryClient, bs.auth);
-* ```
-*/
-function clearOnUserChange(queryClient, auth) {
-	let user;
-	const check = () => {
-		const snapshot = auth.current();
-		if (snapshot.status === "loading") return;
-		const id = snapshot.user?.id ?? null;
-		if (user !== void 0 && user !== id) queryClient.removeQueries({ queryKey: ["bs"] });
-		user = id;
-	};
-	const stop = auth.subscribe(check);
-	check();
-	return stop;
-}
-//#endregion
-export { invalidateTables as n, clearOnUserChange as t };

package/dist/webhooks/index.d.ts

@@ -1,285 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { P as TableKey, k as Row, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
-import { S as ErrorMapper, a as AsyncResult, u as Result } from "../executor-BunPOO-k.js";
-import { a as EventHub } from "../events-aIO7vsIk.js";
-import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
-import { g as RequestContext } from "../plugin-o144f322.js";
-import { r as EventSink } from "../index-DOESKG27.js";
-import { i as sqlTransport, n as RpcClient, r as rpcTransport, t as KitTransport } from "../kit-transport-B82k1djG.js";
-import { _ as PublicUrlOptions, a as hmacSigner, b as publicUrl, c as WebhookSecretStore, d as WebhookPolicyError, f as WebhookRequest, g as AllowUrl, h as fetchTransport, i as WebhookSigner, l as sqlSecretStore, m as WebhookTransport, n as StandardWebhooksOptions, o as standardWebhooks, p as WebhookResponse, r as WebhookSignInput, s as RotateSecretOptions, t as HmacSignerOptions, u as FetchTransportOptions, v as ResolveHost, y as isPublicAddress } from "../signers-Cc6r98SW.js";
-//#region src/webhooks/verify.d.ts
-interface VerifiedWebhook<T = unknown> {
-  readonly id: string;
-  readonly timestamp: Temporal.Instant;
-  readonly payload: T;
-  readonly body: string;
-}
-interface VerifyOptions {
-  /** Allowed clock skew in seconds. Defaults to 300. */
-  readonly tolerance?: number;
-  readonly now?: () => Temporal.Instant;
-}
-type WebhookInput = Request | {
-  readonly headers: Headers | Readonly<Record<string, string>>;
-  readonly body: string;
-};
-/** Constant-time string comparison. */
-export declare function timingSafeEqual(a: string, b: string): boolean;
-/** Headers for a signed Standard Webhooks request. */
-export declare function signWebhook(secret: string, message: {
-  readonly id: string;
-  readonly body: string;
-  readonly timestamp?: Temporal.Instant;
-}): Promise<Record<string, string>>;
-/**
- * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
- * `webhook-signature`) and parses the JSON body. Pass several secrets while
- * rotating.
- */
-export declare function verifyWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
-/** Checks a shared-secret header (database webhooks), in constant time. */
-export declare function verifySharedSecret(request: Request, secret: string, headerName?: string): boolean;
-interface HookUser {
-  readonly id: string;
-  readonly email?: string;
-  readonly phone?: string;
-  readonly app_metadata?: Readonly<Record<string, unknown>>;
-  readonly user_metadata?: Readonly<Record<string, unknown>>;
-  readonly [key: string]: unknown;
-}
-interface AuthHookError {
-  readonly error: {
-    readonly http_code: number;
-    readonly message: string;
-  };
-}
-interface AuthHooks {
-  custom_access_token: {
-    input: {
-      readonly user_id: string;
-      readonly claims: Readonly<Record<string, unknown>> & {
-        readonly sub: string;
-        readonly role: string;
-      };
-      readonly authentication_method: string;
-    };
-    output: {
-      readonly claims: Readonly<Record<string, unknown>>;
-    };
-  };
-  send_email: {
-    input: {
-      readonly user: HookUser;
-      readonly email_data: {
-        readonly token: string;
-        readonly token_hash: string;
-        readonly redirect_to: string;
-        readonly email_action_type: string;
-        readonly site_url: string;
-        readonly token_new: string;
-        readonly token_hash_new: string;
-        /** Auth adds fields over time (`old_email`, `factor_type`, ...). */
-        readonly [key: string]: unknown;
-      };
-    };
-    output: Record<never, never>;
-  };
-  send_sms: {
-    input: {
-      readonly user: HookUser;
-      readonly sms: {
-        readonly otp: string;
-      };
-    };
-    output: Record<never, never>;
-  };
-  mfa_verification_attempt: {
-    input: {
-      readonly factor_id: string;
-      readonly factor_type: string;
-      readonly user_id: string;
-      readonly valid: boolean;
-    };
-    output: {
-      readonly decision: "continue" | "reject";
-      readonly message?: string;
-    };
-  };
-  password_verification_attempt: {
-    input: {
-      readonly user_id: string;
-      readonly valid: boolean;
-    };
-    output: {
-      readonly decision: "continue" | "reject";
-      readonly message?: string;
-      readonly should_logout_user?: boolean;
-    };
-  };
-  before_user_created: {
-    input: {
-      readonly metadata: Readonly<Record<string, unknown>>;
-      readonly user: HookUser;
-    };
-    output: Record<never, never>;
-  };
-}
-type AuthHookKind = keyof AuthHooks;
-/** Rejects a hook with a status and message Supabase Auth passes to the client. */
-export declare function hookError(status: number, message: string): AuthHookError;
-/**
- * A `(request) => Response` handler for a Supabase Auth hook: verifies the
- * Standard Webhooks signature, types the payload and serializes the answer.
- *
- * ```ts
- * export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
- *   claims: { ...claims, tenant_id: await orgFor(user_id) },
- * }));
- * ```
- */
-export declare function authHook<K extends AuthHookKind>(_kind: K, secret: string | readonly string[], handler: (payload: AuthHooks[K]["input"], webhook: VerifiedWebhook<AuthHooks[K]["input"]>) => AuthHooks[K]["output"] | AuthHookError | Promise<AuthHooks[K]["output"] | AuthHookError>, options?: VerifyOptions): (request: Request) => Promise<Response>;
-interface DatabaseWebhookPayload {
-  readonly type: "INSERT" | "UPDATE" | "DELETE";
-  readonly table: string;
-  readonly schema: string;
-  readonly record: Readonly<Record<string, unknown>> | null;
-  readonly old_record: Readonly<Record<string, unknown>> | null;
-}
-interface DatabaseChange<R> {
-  readonly type: "INSERT" | "UPDATE" | "DELETE";
-  readonly table: string;
-  readonly record: R | null;
-  readonly oldRecord: Partial<R> | null;
-}
-export declare function isDatabaseWebhook(value: unknown): value is DatabaseWebhookPayload;
-/**
- * Reads a database webhook payload for `table` as an app-cased change.
- * Returns `null` for other tables or payloads that aren't database webhooks.
- */
-export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
-//#endregion
-//#region src/webhooks/outgoing.d.ts
-/** One claimed delivery, as `shouldDeliver`, `transform` and `headers` see it. */
-interface WebhookDelivery {
-  readonly id: string;
-  readonly endpointId: string;
-  readonly url: string;
-  readonly type: string;
-  readonly payload: unknown;
-  /** 1 on the first try. Counted when the delivery is claimed. */
-  readonly attempt: number;
-  readonly tenant: string | null;
-  readonly eventId: string | null;
-  readonly runId: string | null;
-  readonly createdAt: Temporal.Instant;
-}
-interface RetryPolicy {
-  /** Attempts before a delivery is dead-lettered. Defaults to 8. */
-  readonly maxAttempts?: number;
-  /**
-   * Seconds before the next attempt. Defaults to 5 seconds, 5 minutes, 30
-   * minutes, 2 hours, 5 hours, then 10 hours, each with full jitter. A
-   * receiver's `Retry-After` wins when it asks for longer, up to a day.
-   */
-  readonly backoff?: (attempt: number) => number;
-  /** Statuses worth retrying. Defaults to 408, 429 and 5xx; network errors always retry. */
-  readonly retryable?: (status: number) => boolean;
-}
-interface WebhooksOptions {
-  /** `sqlTransport(postgres.admin)` for the worker, or the user's connection to manage. */
-  readonly transport: KitTransport;
-  /** `kits.webhooks-out.schema`. Defaults to `better_supabase`. */
-  readonly schema?: string;
-  /** Defaults to `fetchTransport({ allowUrl })`. */
-  readonly http?: WebhookTransport;
-  /** Used by the default `http`. Defaults to `publicUrl()`. */
-  readonly allowUrl?: AllowUrl;
-  /** Defaults to `standardWebhooks()`. */
-  readonly signer?: WebhookSigner;
-  /** Defaults to `sqlSecretStore(transport)`. */
-  readonly secrets?: WebhookSecretStore;
-  readonly retry?: RetryPolicy;
-  /** Return `false` (or throw) to cancel a delivery instead of sending it. */
-  readonly shouldDeliver?: (delivery: WebhookDelivery) => boolean | Promise<boolean>;
-  /**
-   * The JSON body. Defaults to the Standard Webhooks envelope,
-   * `{ type, timestamp, data }`.
-   */
-  readonly transform?: (delivery: WebhookDelivery) => unknown;
-  /** Extra headers, e.g. an `idempotency-key`. */
-  readonly headers?: (delivery: WebhookDelivery) => Readonly<Record<string, string>>;
-  /** Characters of the response body kept in the log. Defaults to 2000. */
-  readonly responseBodyLimit?: number;
-  /** `betterSupabase.events`, for `webhook.*` kit events. */
-  readonly events?: EventHub;
-  readonly context?: RequestContext;
-  readonly errorMappers?: readonly ErrorMapper[];
-}
-interface PublishInput {
-  readonly type: string;
-  readonly data: unknown;
-  readonly tenant?: string;
-  /** With an id, publishing it again never queues a second delivery. */
-  readonly id?: string;
-}
-interface DispatchInput {
-  readonly endpointId: string;
-  readonly type: string;
-  readonly data: unknown;
-  /** An external run id stored with the delivery, e.g. a workflow run. */
-  readonly runId?: string;
-  readonly eventId?: string;
-}
-interface DeliverWebhooksOptions {
-  /** Deliveries per claim. Defaults to 25. */
-  readonly batch?: number;
-  /**
-   * Requests in flight at once. Defaults to 10, so a batch of 25 at the
-   * 10-second timeout finishes well inside the lease.
-   */
-  readonly concurrency?: number;
-  /** How long a claim holds a delivery. Defaults to `'2 minutes'`. */
-  readonly lease?: string;
-  readonly budgetMs?: number;
-}
-interface DeliverWebhooksResult {
-  readonly succeeded: number;
-  /** Failed attempts that will retry. */
-  readonly retrying: number;
-  /** Deliveries that ran out of attempts or can't succeed. */
-  readonly dead: number;
-  readonly canceled: number;
-  /** Endpoints disabled after failing for `disableAfter`. */
-  readonly disabled: number;
-}
-interface WebhooksRouteOptions extends DeliverWebhooksOptions {
-  readonly secret: string | undefined;
-  readonly onError?: (error: unknown) => void;
-}
-interface Webhooks {
-  /** Queues the event for each subscribed endpoint; returns how many. */
-  publish(event: PublishInput): AsyncResult<number>;
-  /** Sends to one endpoint outside its subscriptions; returns the delivery id. */
-  dispatch(input: DispatchInput): AsyncResult<string>;
-  /** Queues a finished delivery again. */
-  redeliver(deliveryId: string): AsyncResult<string>;
-  /** A new signing secret, returned once. */
-  rotateSecret(endpointId: string, options?: RotateSecretOptions): AsyncResult<string>;
-  /** Sends due deliveries. Run it from a cron route or a job. */
-  deliver(options?: DeliverWebhooksOptions): Promise<DeliverWebhooksResult>;
-  /** A `GET`/`POST` handler for Vercel Cron that runs `deliver` behind a bearer secret. */
-  deliverRoute(options: WebhooksRouteOptions): (request: Request) => Promise<Response>;
-  /**
-   * An `EventSink` that publishes CloudEvents, e.g. from the outbox relay.
-   * Endpoints subscribe to unprefixed types, so it removes `typePrefix`
-   * (`dev.better-supabase` by default, the relay's default) and the dot.
-   */
-  sink(options?: WebhookSinkOptions): EventSink;
-}
-interface WebhookSinkOptions {
-  /** The relay's `typePrefix`. */
-  readonly typePrefix?: string;
-}
-export declare function createWebhooks(options: WebhooksOptions): Webhooks;
-//#endregion
-export { type AllowUrl, type AuthHookError, type AuthHookKind, type AuthHooks, type DatabaseChange, type DatabaseWebhookPayload, type DeliverWebhooksOptions, type DeliverWebhooksResult, type DispatchInput, type FetchTransportOptions, type HmacSignerOptions, type KitTransport, type PublicUrlOptions, type PublishInput, type ResolveHost, type RetryPolicy, type RotateSecretOptions, type RpcClient, type StandardWebhooksOptions, type VerifiedWebhook, type VerifyOptions, type WebhookDelivery, type WebhookInput, WebhookPolicyError, type WebhookRequest, type WebhookResponse, type WebhookSecretStore, type WebhookSignInput, type WebhookSigner, type WebhookSinkOptions, type WebhookTransport, type Webhooks, type WebhooksOptions, type WebhooksRouteOptions, fetchTransport, hmacSigner, isPublicAddress, publicUrl, rpcTransport, sqlSecretStore, sqlTransport, standardWebhooks };

package/skills/better-supabase-auth/references/permdock.md

@@ -1,122 +0,0 @@
-# better-supabase next to PermDock
-
-PermDock handles authorization and better-supabase handles tokens and data.
-They share one access token hook and one claim contract, and neither imports
-the other.
-
-## Who owns what
-
-| Area                 | better-supabase                                             | PermDock                                                                               |
-| -------------------- | ----------------------------------------------------------- | -------------------------------------------------------------------------------------- |
-| Access token hook    | none                                                        | `permdock supabase hook generate`, the only hook                                       |
-| Claims               | `features`, through `supabase.hook.claims`                  | `user_role`, `roles`, `memberships`, the tenant claim, `attrs`, `authz_ver`            |
-| SQL helpers          | the SQL kit (`better_supabase.*`)                           | `permdock rls generate`: `permdock_has`, `permitted_<scope>_ids`, `member_<scope>_ids` |
-| Storage and Realtime | `defineBucket`, `defineTopic` with a `permdock` policy mode | the helpers those policies call                                                        |
-| MCP                  | `createMcp` with `authorize` and `visible`                  | the permissions in each tool's `meta`                                                  |
-
-## Rules
-
-- Don't run `better-supabase sql add tenant` (it stops without `--force`),
-  don't call `membership_claims()` from a hook, and don't write `roles`,
-  `user_role`, `memberships` or the tenant claim yourself. Doctor reports
-  BS407 when a hook does.
-- `sql add entitlements` is fine: `features` is not a PermDock claim. Add
-  `claims: { features: 'better_supabase.feature_claims' }` to `supabase.hook`
-  in `permdock.config.ts`, run `permdock supabase hook generate`, and
-  `hasEntitlement(session, ...)` works.
-- Run `permdock supabase inspect --out` before `sql add entitlements`. With
-  `permdock.manifest.json` present, the module reads PermDock's
-  `member_<scope>_ids` helpers and doesn't add `tenant`. The scope is the
-  manifest's root scope (the `rls.scopes` entry without `within`); set
-  `entitlements.permdock: { scope }` in `better-supabase.config.ts` for
-  another one.
-- Name the same tenant claim on both sides. A non-default `claims.tenant` in
-  `better-supabase.config.ts` must also be PermDock's `rls.tenantClaim` and
-  go to `subjectFromSupabase` or `subjectFromSupabaseSession` as `{ tenant }`.
-- Validate claims with PermDock's schema: `betterSupabase.claims(supabaseClaims().extend(appClaims))`.
-- The helpers live in PermDock's `rls.schema` (`permdock` by default). Buckets
-  and topics in `permdock` mode call them in `permdock` unless their `schema`
-  option names another schema; it must equal `rls.schema`.
-- Use the scope names the manifest declares (`organization`, not PermDock's
-  `tenant` alias): the helpers are named after them, and doctor reports a
-  key checked at another scope than its catalog entry.
-- The entitlements module needs PermDock's hook to fill `claims.features`
-  from `better_supabase.feature_claims`
-  (`supabase.hook.claims: { features: 'better_supabase.feature_claims' }`).
-- The `permdock` policy mode checks role and scope only. Use it only for
-  permissions whose `rowConditions` is `false` in `permissions.catalog.json`.
-  A missing flag or a key the catalog doesn't list is unknown and refused;
-  regenerate the catalog with a current `permdock catalog`.
-  Leave permissions with row conditions to the policies
-  `permdock rls generate` writes; doctor reports BS214 and `permdock doctor`
-  PD037 otherwise.
-- `permdock` mode compares ids as text, so a path or topic segment must be
-  the id's lowercase form.
-- In MCP servers, narrow `tool.meta` with PermDock's `isPermission`, answer
-  `visible` with `mayUse` and `authorize` with `can`. A tool without a
-  PermDock permission in `meta` is denied: `visible` returns `false` and
-  `authorize` returns `{ allowed: false }`. Use `decide` instead of `can` to
-  put the denial reason in the refusal. `can` decides without a row, so check
-  row-conditioned permissions inside `run` or rely on RLS.
-- In oRPC and Hono, pass the adapter's auth state to PermDock:
-  `createPermDock(policy, { subject: ({ context }) => subjectFromSupabaseSession(context.auth) })`
-  from `permdock/orpc`, or `(c) => subjectFromSupabaseSession(c.get("auth"))`
-  from `permdock/hono`. Fail closed: export one builder that takes a
-  permission (`(permission) => authed.use(pd.protect(permission))`, or the
-  route helper `[bs.middleware(), pd.protect(permission)]` in Hono), and don't
-  install `bs.middleware()` app-wide, so a route without a permission has no
-  `db`.
-- In Next.js, cache the permission snapshot in a `'use cache: private'`
-  loader. The user id and the snapshot only exist after `bs.cached()`
-  returns, so pass it the static tags only, then tag and time the entry from
-  inside the loader with Next.js's `cacheTag` and `cacheLife`:
-
-  ```ts
-  import { cacheLife, cacheTag } from "next/cache";
-  import { snapshotFor } from "permdock";
-  import { cacheLifeFor, snapshotTag } from "permdock/next";
-  import { subjectFromSupabaseSession } from "permdock/supabase";
-
-  export async function loadSnapshot(orgId: string) {
-    "use cache: private";
-    const { session } = await bs.cached({ tags: [`org:${orgId}`] });
-    const snapshot = snapshotFor(policy, subjectFromSupabaseSession(session), {
-      tenant: orgId,
-    });
-    if (session.kind === "user") cacheTag(snapshotTag(session.user.id));
-    cacheLife(cacheLifeFor(snapshot));
-    return snapshot;
-  }
-  ```
-
-  `bs.cached()` already caps the stale time at the token's expiry, and Next.js
-  keeps the smaller `stale` of the two `cacheLife` calls. When a role or plan
-  changes, drop the user's entries and the snapshot with
-  `bs.invalidateSession(userId, { tags: [snapshotTag(userId)] })`.
-
-- Doctor BS405 measures `memberships` plus `attrs` against PermDock's 1 KB
-  budget and the whole token against 2 KB; run `doctor --as <user id>`.
-- For the SQL kit, set `kits.access.model: 'permdock'` and
-  `kits.access.functions.canAssign: 'permdock.permdock_can_assign({role}, {tenant}::text)'`
-  (use the manifest's `rls.schema`), then run `permdock supabase inspect --out`
-  before `sql add`. The kit reads the schema, the root scope and its id type
-  from `permdock.manifest.json`, and `sql add` stops instead of guessing when
-  the manifest can't give them. Every permission key the kit modules check
-  (`kitPermissionKeys` from `better-supabase/sql`) must be
-  `rowConditions: false` in `permissions.catalog.json`; map others with
-  `kits.<module>.permissions`. Doctor reports BS411.
-- Under that model `can_user()` and `member_can()` answer for the caller only
-  and raise SQLSTATE `0A000` for another user. Invitations skip the inviter
-  re-check at accept time and notifications don't filter recipients by read
-  permission; check both in the app when they matter.
-- The `act` claim says who acts: `kind: "support"` (support sessions,
-  `session.actor.kind === 'support'` with `sessionId` and `readOnly`),
-  `kind: "impersonation"` (`actingAs`), or no `kind` for an OAuth client or
-  agent chain (`oauth-client`, limited by `scopes`). Another `kind` makes the
-  session invalid. `session.impersonator` is set for the first two only.
-  `supabaseClaimFixtures` in `better-supabase/testing` has one token of each.
-- Only `allow: ['anonymous']` admits `signInAnonymously()` users; `'anon'`
-  means no session. Pair the default `allow` with PermDock's
-  `rls: { anonymousSignIns: 'deny' }` in `permdock.config.ts`.
-
-Docs: https://bettersupabase.com/docs/auth/permdock.md