better-supabase 0.8.0 → 0.9.0

package/dist/sign-in-D0xN6E_l.js

@@ -0,0 +1,360 @@
+import { t as clearOnUserChange } from "./user-change-XzvgafU4.js";
+import { c as liveKey, d as shownCount, f as startBroadcast, g as specKey, h as sessionUserId, i as countSource, m as startLiveQuery, p as startLiveCount, t as NO_COUNT } from "./client-CvITjt-9.js";
+import { t as ClientContext } from "./context-wDKxSl9x.js";
+import { useSession } from "./react/session.js";
+import { createElement, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
+//#region src/react/hooks.ts
+const LOADING = {
+	status: "loading",
+	user: null,
+	claims: null
+};
+/** Provides the better-supabase client to the hooks. */
+function BetterSupabaseProvider(props) {
+	const { client, queryClient } = props;
+	useEffect(() => queryClient ? clearOnUserChange(queryClient, client.auth) : void 0, [client, queryClient]);
+	const value = useMemo(() => ({
+		client,
+		queryClient
+	}), [client, queryClient]);
+	return createElement(ClientContext.Provider, { value }, props.children);
+}
+function useClientContext() {
+	const value = useContext(ClientContext);
+	if (!value) throw new Error("better-supabase: wrap your app in <BetterSupabaseProvider client={bs}>");
+	return value;
+}
+function useClient() {
+	return useClientContext().client;
+}
+/** The session state for UI: `loading`, `signed-out` or `signed-in` with the user and claims. */
+function useAuth() {
+	const client = useClient();
+	return useSyncExternalStore(client.auth.subscribe, client.auth.current, () => LOADING);
+}
+function useSupabase() {
+	return useClient().supabase;
+}
+/**
+* Hooks typed for your schema.
+*
+* ```ts
+* export const { useDb, useQueries, useAuth } = createHooks<typeof bs>();
+* ```
+*/
+function createHooks() {
+	return {
+		useDb() {
+			const client = useClient();
+			useAuth();
+			return client.db;
+		},
+		useQueries() {
+			const client = useClient();
+			useAuth();
+			return client.queries;
+		},
+		useSupabase,
+		useAuth,
+		useSession
+	};
+}
+/**
+* Subscribes to a topic while mounted. Pass `null` values to pause. It
+* resubscribes when the topic or the signed-in user changes.
+*
+* ```ts
+* useBroadcast(customersTopic, organizationId ? { organizationId } : null, {}, { invalidate: ['customers'] });
+* ```
+*/
+function useBroadcast(topic, values, handlers, options) {
+	const context = useContext(ClientContext);
+	const supabase = options?.client ?? context?.client.supabase;
+	if (!supabase) throw new Error("better-supabase: useBroadcast needs <BetterSupabaseProvider client={bs}> or { client: supabase }");
+	const queryClient = options?.queryClient ?? context?.queryClient;
+	const auth = useBroadcastAuth(options?.client === void 0 ? context?.client : void 0, supabase);
+	const [status, setStatus] = useState("closed");
+	const latest = useRef({
+		handlers,
+		options
+	});
+	latest.current = {
+		handlers,
+		options
+	};
+	const name = values ? topic.topic(values) : null;
+	const userId = auth.userId;
+	const self = options?.self;
+	if (options?.invalidate && !queryClient) throw new Error("better-supabase: useBroadcast({ invalidate }) needs <BetterSupabaseProvider queryClient={...}> or { queryClient }");
+	useEffect(() => {
+		if (!name || auth.status === "loading") return;
+		return startBroadcast({
+			supabase,
+			topic,
+			name,
+			latest: () => latest.current,
+			queryClient,
+			onStatus: setStatus
+		});
+	}, [
+		supabase,
+		topic,
+		name,
+		userId,
+		auth.status,
+		queryClient,
+		self
+	]);
+	return status;
+}
+const NO_AUTH = () => () => void 0;
+/**
+* The user `useBroadcast` subscribes as: the provider's auth snapshot, or
+* for a plain supabase-js client, its auth state.
+*/
+function useBroadcastAuth(client, supabase) {
+	const snapshot = useSyncExternalStore(client?.auth.subscribe ?? NO_AUTH, client?.auth.current ?? (() => LOADING), () => LOADING);
+	const [plain, setPlain] = useState({
+		status: "loading",
+		userId: null
+	});
+	useEffect(() => {
+		if (client) return;
+		const { data } = supabase.auth.onAuthStateChange((_event, session) => {
+			setPlain({
+				status: session ? "signed-in" : "signed-out",
+				userId: session ? sessionUserId(session) : null
+			});
+		});
+		return () => {
+			data.subscription.unsubscribe();
+		};
+	}, [client, supabase]);
+	return client ? {
+		status: snapshot.status,
+		userId: snapshot.user?.id ?? null
+	} : plain;
+}
+/**
+* The spec from the render whose key last changed, so effects keep the
+* original values (`bigint`, Temporal) and only rerun on a different query.
+*/
+function useHeldSpec(spec) {
+	const key = spec ? specKey(spec) : null;
+	const [held, setHeld] = useState({
+		key,
+		spec: spec ?? null
+	});
+	if (held.key === key) return held;
+	const next = {
+		key,
+		spec: spec ?? null
+	};
+	setHeld(next);
+	return next;
+}
+/**
+* Keeps a query fresh: invalidates every cached query that read a table the
+* spec touches whenever one of them changes. Pass `null` to pause. It
+* resubscribes when the spec, tenant or user changes.
+*
+* ```ts
+* const spec = betterSupabase.spec.customers.findMany({ include: { notes: true } });
+* const { data } = useQuery(q.$spec(spec));
+* useLiveQuery(spec);
+* ```
+*/
+function useLiveQuery(spec, options = {}) {
+	const { client, queryClient } = useClientContext();
+	const auth = useAuth();
+	const [status, setStatus] = useState("closed");
+	if (spec && !queryClient) throw new Error("better-supabase: useLiveQuery needs <BetterSupabaseProvider queryClient={...}>");
+	const held = useHeldSpec(spec);
+	const joined = useRef(null);
+	const key = liveKey(client, held.spec, auth, options);
+	const latest = useRef({
+		auth,
+		options
+	});
+	latest.current = {
+		auth,
+		options
+	};
+	useEffect(() => {
+		if (key === null || !held.spec || !queryClient) return;
+		const resumed = joined.current === held.key;
+		joined.current = held.key;
+		return startLiveQuery({
+			client,
+			queryClient,
+			spec: held.spec,
+			auth: latest.current.auth,
+			options: latest.current.options,
+			resumed,
+			onStatus: setStatus
+		});
+	}, [
+		client,
+		queryClient,
+		held,
+		key
+	]);
+	return status;
+}
+/**
+* A count that stays current: refetches only the `count` spec (a HEAD
+* request) after each debounced change to a table it reads, and after the
+* channel rejoins. Takes a spec or a `bs.liveCount()` seed; pass `null` to
+* pause. Doesn't need a `QueryClient`.
+*
+* ```tsx
+* const { count } = useLiveCount(seed); // seed = await bs.liveCount(spec)
+* ```
+*/
+function useLiveCount(source, options = {}) {
+	const { client } = useClientContext();
+	const auth = useAuth();
+	const parsed = countSource(source, options);
+	const [state, setState] = useState(NO_COUNT);
+	const stateRef = useRef(NO_COUNT);
+	const [status, setStatus] = useState("closed");
+	const held = useHeldSpec(parsed.spec);
+	const joined = useRef(null);
+	const key = liveKey(client, held.spec, auth, options);
+	const latest = useRef({
+		auth,
+		options
+	});
+	latest.current = {
+		auth,
+		options
+	};
+	const hasInitial = parsed.initial !== void 0;
+	const { seedAt } = parsed;
+	useEffect(() => {
+		if (key === null || !held.spec || held.key === null) return;
+		const specKey = held.key;
+		const previous = joined.current?.key === specKey ? joined.current : null;
+		joined.current = {
+			key: specKey,
+			at: previous?.at ?? seedAt ?? 0
+		};
+		return startLiveCount({
+			client,
+			spec: held.spec,
+			key: specKey,
+			auth: latest.current.auth,
+			options: latest.current.options,
+			immediate: !hasInitial && !previous,
+			since: previous ? previous.at : seedAt,
+			onState: (update) => {
+				const next = update(stateRef.current);
+				stateRef.current = next;
+				if (next.error === void 0 && joined.current?.key === specKey) joined.current = {
+					key: specKey,
+					at: next.at
+				};
+				setState(next);
+			},
+			onStatus: setStatus
+		});
+	}, [
+		client,
+		held.spec,
+		held.key,
+		key,
+		hasInitial,
+		seedAt
+	]);
+	const shown = shownCount(state, held.key, parsed);
+	return {
+		count: shown.count,
+		status,
+		error: shown.error
+	};
+}
+//#endregion
+//#region src/react/sign-in.ts
+function useAuthApi(options, hook) {
+	const context = useContext(ClientContext);
+	const auth = options.client?.auth ?? context?.client.supabase.auth;
+	if (!auth) throw new Error(`better-supabase: ${hook} needs <BetterSupabaseProvider client={bs}> or { client: supabase }`);
+	return auth;
+}
+/** Runs auth calls with `pending` and `error` state; the latest call owns the state. */
+function usePending(options) {
+	const [state, setState] = useState({
+		pending: false,
+		error: void 0
+	});
+	const latest = useRef({
+		call: 0,
+		options
+	});
+	latest.current.options = options;
+	return {
+		state,
+		run: useMemo(() => async (call) => {
+			latest.current.call += 1;
+			const id = latest.current.call;
+			setState({
+				pending: true,
+				error: void 0
+			});
+			let error;
+			try {
+				({error} = await call());
+			} catch (cause) {
+				if (id === latest.current.call) setState({
+					pending: false,
+					error: void 0
+				});
+				throw cause;
+			}
+			if (id === latest.current.call) setState({
+				pending: false,
+				error: error ?? void 0
+			});
+			if (!error) latest.current.options.onSuccess?.();
+			return error ?? void 0;
+		}, [])
+	};
+}
+/**
+* Sign-in calls with `pending` and `error` state. The session lands in the
+* client's auth store, so `useAuth()` updates on its own.
+*
+* ```tsx
+* const signIn = useSignIn({ onSuccess: () => router.push('/') });
+* <button disabled={signIn.pending} onClick={() => signIn.password({ email, password })} />
+* ```
+*/
+function useSignIn(options = {}) {
+	const auth = useAuthApi(options, "useSignIn");
+	const { state, run } = usePending(options);
+	const calls = useMemo(() => ({
+		password: (credentials) => run(() => auth.signInWithPassword({ ...credentials })),
+		otp: (credentials) => run(() => auth.signInWithOtp(credentials)),
+		verifyOtp: (params) => run(() => auth.verifyOtp(params)),
+		oauth: (provider, oauthOptions) => run(() => auth.signInWithOAuth(oauthOptions ? {
+			provider,
+			options: oauthOptions
+		} : { provider }))
+	}), [auth, run]);
+	return {
+		...state,
+		...calls
+	};
+}
+/** `auth.signOut()` with `pending` and `error` state. The provider clears cached queries. */
+function useSignOut(options = {}) {
+	const auth = useAuthApi(options, "useSignOut");
+	const { state, run } = usePending(options);
+	const signOut = useMemo(() => (signOutOptions) => run(() => auth.signOut(signOutOptions ? { ...signOutOptions } : void 0)), [auth, run]);
+	return {
+		...state,
+		signOut
+	};
+}
+//#endregion
+export { createHooks as a, useBroadcastAuth as c, useSupabase as d, BetterSupabaseProvider as i, useLiveCount as l, useSignIn as n, useAuth as o, useSignOut as r, useBroadcast as s, usePending as t, useLiveQuery as u };

package/dist/signatures-B41ApWXA.js

@@ -0,0 +1,145 @@
+import { n as dbError } from "./errors-8i6tSICm.js";
+import { c as optionalTemporal, s as nowInstant } from "./temporal-CB5Fpo5d.js";
+import { n as temporalMissing } from "./temporal-required-DqRzr7i0.js";
+import { a as ok, r as err } from "./result-BlgnMB0H.js";
+import { i as toBase64, r as fromBase64 } from "./base64-BmeCBgGo.js";
+import { r as timingSafeEqual, t as encoder } from "./hmac-DCud0myt.js";
+//#region src/core/signatures.ts
+/** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
+function secretBytes(secret) {
+	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
+	try {
+		return fromBase64(raw);
+	} catch {
+		throw new TypeError("Webhook secret is not valid base64");
+	}
+}
+const keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+	let key = keys.get(secret);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", secretBytes(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign", "verify"]);
+		if (keys.size < 16) {
+			keys.set(secret, key);
+			key.catch(() => keys.delete(secret));
+		}
+	}
+	return key;
+}
+/** The prefix of a Standard Webhooks Ed25519 public key (`v1a` signatures). */
+const PUBLIC_KEY_PREFIX = "whpk_";
+const publicKeys = /* @__PURE__ */ new Map();
+function publicKeyFor(key) {
+	let imported = publicKeys.get(key);
+	if (!imported) {
+		imported = crypto.subtle.importKey("raw", fromBase64(key.slice(5)), { name: "Ed25519" }, false, ["verify"]);
+		if (publicKeys.size < 16) {
+			publicKeys.set(key, imported);
+			imported.catch(() => publicKeys.delete(key));
+		}
+	}
+	return imported;
+}
+async function signature(secret, content) {
+	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await keyFor(secret), encoder.encode(content))));
+}
+function decodeSignature(value) {
+	try {
+		return fromBase64(value);
+	} catch {
+		return;
+	}
+}
+function header(headers, name) {
+	if (headers instanceof Headers) return headers.get(name);
+	return Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1] ?? null;
+}
+const unauthorized = (code, message) => dbError("unauthorized", message, { code });
+/**
+* The error for a webhook id `options.seen` already recorded, or for a
+* `seen` that throws; `undefined` for a first delivery or without `seen`.
+*/
+async function replayed(options, id, until) {
+	if (!options.seen || id === "") return;
+	try {
+		if (!await options.seen(id, until)) return;
+	} catch {
+		return dbError("unexpected", "Could not check the webhook id for a replay", { code: "WEBHOOK_DEDUPE_FAILED" });
+	}
+	return dbError("conflict", "Webhook was already received", { code: "WEBHOOK_REPLAYED" });
+}
+/** Headers for a signed Standard Webhooks request. */
+async function signWebhook(secret, message) {
+	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
+	return {
+		"webhook-id": message.id,
+		"webhook-timestamp": timestamp,
+		"webhook-signature": `v1,${await signature(secret, `${message.id}.${timestamp}.${message.body}`)}`
+	};
+}
+/**
+* Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+* `webhook-signature`, or the `svix-` names Svix-based senders use) and
+* parses the JSON body. Pass several secrets while rotating.
+*/
+async function verifyWebhook(input, secrets, options = {}) {
+	const headers = input.headers;
+	const prefix = header(headers, "webhook-id") === null ? "svix" : "webhook";
+	const id = header(headers, `${prefix}-id`);
+	const timestamp = header(headers, `${prefix}-timestamp`);
+	const signatures = header(headers, `${prefix}-signature`);
+	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
+	const seconds = Number(timestamp);
+	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
+	const tolerance = options.tolerance ?? 300;
+	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
+	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
+	const body = input instanceof Request ? await input.text() : input.body;
+	const content = encoder.encode(`${id}.${timestamp}.${body}`);
+	const entries = signatures.split(" ").map((entry) => entry.split(","));
+	const offered = (version) => entries.filter(([name, value]) => name === version && value).flatMap(([, value]) => decodeSignature(value) ?? []);
+	const symmetric = offered("v1");
+	const asymmetric = offered("v1a");
+	let valid = false;
+	let malformed = false;
+	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
+		const isPublic = secret.startsWith(PUBLIC_KEY_PREFIX);
+		let key;
+		try {
+			key = await (isPublic ? publicKeyFor(secret) : keyFor(secret));
+		} catch {
+			malformed = true;
+			continue;
+		}
+		for (const candidate of isPublic ? asymmetric : symmetric) if (await crypto.subtle.verify(isPublic ? "Ed25519" : "HMAC", key, candidate, content)) valid = true;
+	}
+	if (!valid && malformed) return err(dbError("unexpected", "Webhook secret is not whsec_ or whpk_ followed by base64", { code: "WEBHOOK_INVALID_SECRET" }));
+	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
+	let payload;
+	try {
+		payload = JSON.parse(body);
+	} catch {
+		return err(dbError("invalid_request", "Webhook body is not JSON"));
+	}
+	const replay = await replayed(options, id, namespace.Instant.fromEpochMilliseconds((seconds + tolerance) * 1e3));
+	if (replay) return err(replay);
+	return ok({
+		id,
+		timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
+		payload,
+		body
+	});
+}
+/** Checks a shared-secret header (database webhooks), in constant time. */
+function verifySharedSecret(request, secret, headerName = "authorization") {
+	const token = (request.headers.get(headerName) ?? "").replace(/^Bearer\s+/i, "");
+	return timingSafeEqual(token, secret);
+}
+//#endregion
+export { unauthorized as a, signWebhook as i, header as n, verifySharedSecret as o, replayed as r, verifyWebhook as s, PUBLIC_KEY_PREFIX as t };

package/dist/signatures-BMdJ7neI.d.ts

@@ -0,0 +1,43 @@
+/// <reference lib="esnext.temporal" />
+import { f as Result } from "./result-Cj3yWhjH.js";
+//#region src/core/signatures.d.ts
+interface VerifiedWebhook<T = unknown> {
+  readonly id: string;
+  readonly timestamp: Temporal.Instant;
+  readonly payload: T;
+  readonly body: string;
+}
+interface VerifyOptions {
+  /** Allowed clock skew in seconds. Defaults to 300. */
+  readonly tolerance?: number;
+  readonly now?: () => Temporal.Instant;
+  /**
+   * Records a verified `webhook-id` and answers whether it was already
+   * recorded, atomically (a unique insert, Redis `SET NX`). A seen id is
+   * refused as a replay (`WEBHOOK_REPLAYED`, 409). `until` is when the
+   * timestamp leaves the tolerance window, so the store may forget the id
+   * after it. Runs only after the signature checks out, and a throw
+   * refuses the request.
+   */
+  readonly seen?: (id: string, until: Temporal.Instant) => boolean | Promise<boolean>;
+}
+type WebhookInput = Request | {
+  readonly headers: Headers | Readonly<Record<string, string>>;
+  readonly body: string;
+};
+/** Headers for a signed Standard Webhooks request. */
+declare function signWebhook(secret: string, message: {
+  readonly id: string;
+  readonly body: string;
+  readonly timestamp?: Temporal.Instant;
+}): Promise<Record<string, string>>;
+/**
+ * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+ * `webhook-signature`, or the `svix-` names Svix-based senders use) and
+ * parses the JSON body. Pass several secrets while rotating.
+ */
+declare function verifyWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
+/** Checks a shared-secret header (database webhooks), in constant time. */
+declare function verifySharedSecret(request: Request, secret: string, headerName?: string): boolean;
+//#endregion
+export { verifySharedSecret as a, signWebhook as i, VerifyOptions as n, verifyWebhook as o, WebhookInput as r, VerifiedWebhook as t };