better-supabase 0.8.0 → 0.9.0

package/dist/read-set-DAeWhqPf.js

@@ -1,314 +0,0 @@
-import { n as dbError } from "./errors-2M6CKMP4.js";
-import { i as tableMeta, t as builderFor } from "./build-meLuYGri.js";
-import { n as touchedTables } from "./tables-Cb-3_VWc.js";
-//#region src/core/spec.ts
-const READ_METHODS = [
-	"findMany",
-	"findFirst",
-	"findOnly",
-	"findUnique",
-	"findById",
-	"count",
-	"aggregate",
-	"exists",
-	"paginate"
-];
-function createSpecs(meta) {
-	const specs = {};
-	for (const table of Object.keys(meta.tables)) {
-		const methods = {};
-		for (const method of READ_METHODS) methods[method] = (...args) => ({
-			v: 1,
-			table,
-			method,
-			args: trimUndefined(args)
-		});
-		specs[table] = methods;
-	}
-	return specs;
-}
-function trimUndefined(args) {
-	const out = [...args];
-	while (out.length > 0 && out.at(-1) === void 0) out.pop();
-	return out;
-}
-function isQuerySpec(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const spec = value;
-	return spec.v === 1 && typeof spec.table === "string" && READ_METHODS.includes(spec.method) && Array.isArray(spec.args);
-}
-/** The argument object of a spec's method (`findById` takes it second). */
-function specOptions(spec) {
-	const value = spec.method === "findById" ? spec.args[1] : spec.args[0];
-	return typeof value === "object" && value !== null ? value : void 0;
-}
-/**
-* App keys of every table a spec reads: its table, included relations and
-* relations used in `where`. Queries keyed by a spec go stale when any of
-* them changes. Invalid arguments yield just the spec's table; running the
-* spec reports the error.
-*/
-function specTables(meta, spec) {
-	const table = meta.tables[spec.table];
-	const args = specOptions(spec);
-	if (table && args?.["include"] === void 0 && !touchesRelations(table, args?.["where"])) return [spec.table];
-	const key = specKey(spec);
-	let byKey = tablesByMeta.get(meta);
-	if (!byKey) {
-		byKey = /* @__PURE__ */ new Map();
-		tablesByMeta.set(meta, byKey);
-	}
-	const known = key === void 0 ? void 0 : byKey.get(key);
-	if (known) return [...known];
-	let tables;
-	try {
-		tables = readTables(meta, spec);
-	} catch {
-		tables = [spec.table];
-	}
-	if (key !== void 0) {
-		if (byKey.size >= SPEC_CACHE_SIZE) byKey.clear();
-		byKey.set(key, tables);
-	}
-	return [...tables];
-}
-const SPEC_CACHE_SIZE = 500;
-const tablesByMeta = /* @__PURE__ */ new WeakMap();
-/** A text key for the spec, or `undefined` when its arguments do not serialize. */
-function specKey(spec) {
-	try {
-		return JSON.stringify([
-			spec.table,
-			spec.method,
-			spec.args
-		], (_key, value) => typeof value === "bigint" ? `${value}n` : value);
-	} catch {
-		return;
-	}
-}
-function touchesRelations(table, where) {
-	if (typeof where !== "object" || where === null) return false;
-	if (Array.isArray(where)) return where.some((item) => touchesRelations(table, item));
-	for (const [key, value] of Object.entries(where)) {
-		if (key in table.relations) return true;
-		if ((key === "AND" || key === "OR" || key === "NOT") && touchesRelations(table, value)) return true;
-	}
-	return false;
-}
-function readTables(meta, spec) {
-	const builder = builderFor(meta);
-	const table = tableMeta(meta, spec.table);
-	const args = specOptions(spec);
-	const counts = spec.method === "count" || spec.method === "exists" || spec.method === "aggregate";
-	return touchedTables({
-		kind: "select",
-		table,
-		selection: counts ? {
-			columns: [],
-			includes: []
-		} : builder.selection(table, args?.["select"], args?.["include"]),
-		where: builder.where(table, args?.["where"]),
-		orderBy: [],
-		limit: void 0,
-		offset: void 0,
-		count: void 0,
-		head: counts,
-		single: void 0
-	});
-}
-//#endregion
-//#region src/core/read-set.ts
-const NAME = /^[a-z][a-z0-9_]{0,59}$/;
-const PARAM = /^[a-z_][a-z0-9_]*$/i;
-const TYPE = /^(?:[a-z_][a-z0-9_]*\.)?[a-z_][a-z0-9_]*(?:\[\])?$/;
-/** `jsonb_build_object` takes at most 100 arguments. */
-const MAX_ENTRIES = 50;
-/**
-* Placeholders are `NUL bs:<name> NUL`: no real parameter value holds a NUL.
-* Auth placeholders start with `@`, which no parameter name can.
-*/
-const NUL = "\0";
-const SENTINEL = new RegExp(`${NUL}bs:(@?[a-z_][a-z0-9_]*)${NUL}`, "gi");
-const EXACT = new RegExp(`^${NUL}bs:(@?[a-z_][a-z0-9_]*)${NUL}$`, "i");
-function sentinel(name) {
-	return `${NUL}bs:${name}${NUL}`;
-}
-const AUTH = { uid: sentinel("@uid") };
-function tagged(name, array) {
-	if (!name.startsWith("@")) return {
-		kind: "param",
-		name,
-		array
-	};
-	return name === "@uid" ? {
-		kind: "auth",
-		name: "uid",
-		array
-	} : void 0;
-}
-/**
-* Registers reads that run as one round trip:
-*
-* ```ts
-* export const appChrome = defineReadSet(
-*   betterSupabase,
-*   'app_chrome',
-*   { params: { userId: 'uuid' } },
-*   (s, p) => ({
-*     unread: s.notifications.count({ where: { userId: p.userId, readAt: null } }),
-*     me: s.profiles.findFirst({ where: { id: p.userId } }),
-*   }),
-* );
-* ```
-*
-* `p` holds placeholders, not values: pass them straight into `where` (or
-* `in`), where the function reads them from its `p jsonb` argument.
-*/
-function defineReadSet(betterSupabase, name, options, build) {
-	if (!NAME.test(name)) throw new TypeError(`better-supabase: read set name "${name}" must be snake_case and at most 60 characters`);
-	const params = options.params ?? {};
-	const placeholders = {};
-	for (const [key, type] of Object.entries(params)) {
-		if (!PARAM.test(key)) throw new TypeError(`better-supabase: read set "${name}" has an invalid parameter name "${key}"`);
-		if (!TYPE.test(type)) throw new TypeError(`better-supabase: read set "${name}" parameter "${key}" has an invalid type "${type}"`);
-		placeholders[key] = type.endsWith("[]") ? [sentinel(key)] : sentinel(key);
-	}
-	const specs = build(betterSupabase.spec, placeholders, AUTH);
-	const entries = Object.entries(specs);
-	if (entries.length === 0 || entries.length > MAX_ENTRIES) throw new TypeError(`better-supabase: read set "${name}" needs between 1 and ${MAX_ENTRIES} reads`);
-	for (const [key, spec] of entries) if (!isQuerySpec(spec)) throw new TypeError(`better-supabase: read set "${name}" entry "${key}" is not a spec from betterSupabase.spec`);
-	warnUnscopedReads(betterSupabase, name, specs);
-	return {
-		kind: "read-set",
-		name,
-		functionName: `rs_${name}`,
-		params,
-		roles: options.roles ?? ["authenticated"],
-		specs,
-		definition: betterSupabase
-	};
-}
-/**
-* The generated function runs the reads as compiled at `gen` time, without
-* the runtime's `transformQuery` plugins, so tenant and soft-delete filters
-* that only those plugins add never reach it.
-*/
-function warnUnscopedReads(betterSupabase, name, specs) {
-	const filtering = betterSupabase.plugins.filter((plugin) => plugin.transformQuery !== void 0 && plugin.scopes?.length !== 0);
-	if (filtering.length === 0) return;
-	const { meta } = betterSupabase;
-	const filters = (plugin, key) => {
-		const flags = meta.tables[key]?.flags;
-		return plugin.scopes === void 0 || plugin.scopes.some((flag) => flags?.[flag] !== void 0);
-	};
-	const tables = [...new Set(Object.values(specs).flatMap((spec) => specTables(meta, spec)))].filter((key) => filtering.some((plugin) => filters(plugin, key)));
-	if (tables.length === 0) return;
-	const scoping = filtering.filter((plugin) => tables.some((key) => filters(plugin, key))).map((plugin) => plugin.name);
-	betterSupabase.events.logger.warn(`read set "${name}" reads ${tables.join(", ")}, which ${scoping.join(", ")} scope at runtime; its generated function only sees those filters when the specs spell them out (or RLS enforces them)`, {
-		readSet: name,
-		tables,
-		plugins: scoping
-	});
-}
-function isReadSet(value) {
-	return typeof value === "object" && value !== null && value.kind === "read-set" && typeof value.name === "string";
-}
-/** The placeholder a string or array carries, if it is exactly one. */
-function placeholderOf(value) {
-	if (typeof value === "string") {
-		const match = EXACT.exec(value);
-		return match ? tagged(match[1], false) : void 0;
-	}
-	if (Array.isArray(value) && value.length === 1) {
-		const inner = placeholderOf(value[0]);
-		return inner && !inner.array ? {
-			...inner,
-			array: true
-		} : inner;
-	}
-}
-/** Splits a string around the placeholders inside it. */
-function splitPlaceholders(value) {
-	const parts = [];
-	let last = 0;
-	for (const match of value.matchAll(SENTINEL)) {
-		if (match.index > last) parts.push({ text: value.slice(last, match.index) });
-		const placeholder = tagged(match[1], false);
-		parts.push(placeholder ?? { text: match[0] });
-		last = match.index + match[0].length;
-	}
-	if (last < value.length) parts.push({ text: value.slice(last) });
-	return parts;
-}
-function hasPlaceholder(value) {
-	return value.includes(`${NUL}bs:`);
-}
-/** Whether any string inside `value` is (or holds) a placeholder. */
-function containsPlaceholder(value) {
-	if (typeof value === "string") return hasPlaceholder(value);
-	if (Array.isArray(value)) return value.some(containsPlaceholder);
-	if (typeof value === "object" && value !== null) return Object.values(value).some(containsPlaceholder);
-	return false;
-}
-/** Whether the set's specs read the caller's identity. */
-function readSetUsesAuth(set) {
-	return Object.values(set.specs).some((spec) => usesAuth(spec.args));
-}
-function usesAuth(value) {
-	if (typeof value === "string") return [...value.matchAll(SENTINEL)].some((match) => match[1].startsWith("@"));
-	if (Array.isArray(value)) return value.some(usesAuth);
-	if (typeof value === "object" && value !== null) return Object.values(value).some(usesAuth);
-	return false;
-}
-/** Missing or wrongly typed parameters, as messages. */
-function checkParams(set, values) {
-	const problems = [];
-	for (const [key, type] of Object.entries(set.params)) {
-		const value = values?.[key];
-		if (value === void 0 || value === null) problems.push(`missing parameter "${key}"`);
-		else if (type.endsWith("[]") !== Array.isArray(value)) problems.push(`parameter "${key}" must be ${type.endsWith("[]") ? "an array" : "a single value"}`);
-	}
-	return problems;
-}
-/**
-* The specs with every placeholder replaced by its value; `auth.uid` takes
-* the `sub` claim, which must be verified. `noCaller` is set when the set
-* reads `auth.uid` and there is no `sub`: the specs then match no user, and
-* only the function, which reads `auth.uid()` itself, can run the set.
-*/
-function bindParams(set, values, context) {
-	const sub = context.claims?.["sub"];
-	const uid = typeof sub === "string" && sub !== "" ? sub : null;
-	const valueOf = (placeholder) => placeholder.kind === "auth" ? uid : values?.[placeholder.name];
-	const bind = (value) => {
-		const placeholder = placeholderOf(value);
-		if (placeholder) {
-			const bound = valueOf(placeholder);
-			return placeholder.kind === "auth" && placeholder.array ? [bound] : bound;
-		}
-		if (typeof value === "string") {
-			if (!hasPlaceholder(value)) return value;
-			return splitPlaceholders(value).map((part) => "text" in part ? part.text : String(valueOf(part) ?? "")).join("");
-		}
-		if (Array.isArray(value)) return value.map(bind);
-		if (typeof value === "object" && value !== null) {
-			if (Object.getPrototypeOf(value) !== Object.prototype) return value;
-			return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, bind(entry)]));
-		}
-		return value;
-	};
-	return {
-		specs: Object.fromEntries(Object.entries(set.specs).map(([key, spec]) => [key, {
-			...spec,
-			args: spec.args.map(bind)
-		}])),
-		noCaller: uid === null && readSetUsesAuth(set) ? dbError("invalid_request", `db.$many(${set.name}): the read set reads auth.uid, but this connection has no user claims. Connect with the user's verified claims ({ claims: { sub } }), or call it over PostgREST, where the function reads auth.uid().`) : void 0
-	};
-}
-/** App keys of every table the set reads. */
-function readSetTables(set, meta) {
-	const schema = meta ?? set.definition.meta;
-	return [...new Set(Object.values(set.specs).flatMap((spec) => specTables(schema, spec)))];
-}
-//#endregion
-export { hasPlaceholder as a, readSetTables as c, isQuerySpec as d, specTables as f, defineReadSet as i, splitPlaceholders as l, checkParams as n, isReadSet as o, containsPlaceholder as r, placeholderOf as s, bindParams as t, createSpecs as u };

package/dist/refusal-CFI8-5nf.d.ts

@@ -1,18 +0,0 @@
-import { t as AnyAuthorizer } from "./authorizer-eiOjo-3l.js";
-import { s as BlockRequireOptions } from "./kit-W99LCPBS.js";
-//#region src/server/refusal.d.ts
-/** Where refused callers go instead of a Problem Details response. */
-interface RefusalRedirects {
-  /** Sign-in page for callers without a session; gets `?next=<path>`. */
-  readonly signIn?: string;
-  /** Second-factor page for users below the route's `aal`; gets `?next=<path>`. */
-  readonly mfa?: string;
-}
-interface RouteGuardOptions<C = unknown, P = unknown> extends BlockRequireOptions<C, P>, RefusalRedirects {
-  /** Include internal error messages in Problem Details. Defaults to development only. */
-  readonly expose?: boolean;
-  /** Decides `permission`; without one, a route with a `permission` refuses every caller. */
-  readonly authorizer?: AnyAuthorizer;
-}
-//#endregion
-export { RouteGuardOptions as n, RefusalRedirects as t };

package/dist/refusal-K78A1Vmq.js

@@ -1,61 +0,0 @@
-import { r as dbErrorOf } from "./errors-2M6CKMP4.js";
-import { o as problemResponse } from "./problem-CJvFeGu7.js";
-import { t as defaultExpose } from "./respond-volM3ByS.js";
-import { i as requireCaller } from "./kit-BhHr9T9v.js";
-//#region src/server/refusal.ts
-function isAalRefusal(error) {
-	return error.kind === "forbidden" && "required" in error && error.required === "aal2";
-}
-/** The page a refused caller is sent to, with `?next=`, when one is configured. */
-function refusalTarget(error, request, redirects) {
-	const page = error.kind === "unauthorized" ? redirects.signIn : isAalRefusal(error) ? redirects.mfa : void 0;
-	if (page === void 0) return void 0;
-	const url = new URL(request.url);
-	const target = new URL(page, url);
-	if (target.pathname === url.pathname) return void 0;
-	target.searchParams.set("next", `${url.pathname}${url.search}`);
-	return target;
-}
-/** A refusal as a redirect to `signIn` or `mfa`, else Problem Details. */
-function refusalResponse(error, request, redirects, expose) {
-	const target = refusalTarget(error, request, redirects);
-	if (target) return new Response(null, {
-		status: 303,
-		headers: { location: target.href }
-	});
-	return problemResponse(error, {
-		instance: new URL(request.url).pathname,
-		expose
-	});
-}
-/** The refusal for a caller `options` refuses, or `undefined` to let it through. */
-async function routeRefusal(locals, request, options) {
-	const caller = await requireCaller(locals.bs.auth, options, locals.tenant, options.authorizer);
-	if (!("kind" in caller)) return void 0;
-	return refusalResponse(caller, request, options, options.expose ?? defaultExpose());
-}
-/**
-* An `onError` mapper: a thrown `DbException` (or an error caused by a
-* `DbError`) becomes Problem Details; anything else is `undefined`, so the
-* framework's own handling stays.
-*/
-function errorResponse(cause, request, options = {}) {
-	const found = dbErrorOf(cause);
-	if (!found) return void 0;
-	return problemResponse(found, {
-		instance: new URL(request.url).pathname,
-		expose: options.expose ?? defaultExpose()
-	});
-}
-/** Reads the guard's view of a request's contributions; throws without `withBetterSupabase`. */
-function guardedLocals(contributions) {
-	const bs = "bs" in contributions ? contributions.bs : void 0;
-	if (typeof bs !== "object" || bs === null || !("auth" in bs)) throw new Error("better-supabase: the route guard needs withBetterSupabase(server) in the entries");
-	const tenant = "tenant" in contributions ? contributions.tenant : void 0;
-	return {
-		bs,
-		tenant: typeof tenant === "string" ? tenant : void 0
-	};
-}
-//#endregion
-export { routeRefusal as a, refusalTarget as i, guardedLocals as n, refusalResponse as r, errorResponse as t };

package/dist/replicas-CwrYp5Zj.js

@@ -1,94 +0,0 @@
-import { parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
-//#region src/server/replicas.ts
-/** Cookie holding the epoch ms until which reads stay on the primary. */
-const PRIMARY_COOKIE = "bs-primary-until";
-/** Default time reads stay on the primary after a write. */
-const DEFAULT_PIN_MS = 5e3;
-function replicaState(pinnedUntil = 0, now = Date.now()) {
-	let wrote = false;
-	const inherited = pinnedUntil > now;
-	return {
-		get pinned() {
-			return wrote || inherited;
-		},
-		get wrote() {
-			return wrote;
-		},
-		pin() {
-			wrote = true;
-		}
-	};
-}
-/** `bs-primary-until` from a `cookie` header or parsed cookies, or 0. */
-function pinnedUntil(cookies) {
-	if (!cookies) return 0;
-	const value = (typeof cookies === "string" ? parseCookieHeader(cookies) : cookies).find((cookie) => cookie.name === PRIMARY_COOKIE)?.value;
-	const until = Number(value);
-	return value !== void 0 && Number.isFinite(until) ? until : 0;
-}
-/** Options of the `bs-primary-until` cookie. */
-function primaryCookieOptions(pinMs) {
-	return {
-		path: "/",
-		maxAge: Math.max(1, Math.ceil(pinMs / 1e3)),
-		httpOnly: true,
-		sameSite: "lax"
-	};
-}
-/** The `bs-primary-until` cookie write after a write, for cookie-jar APIs. */
-function primaryCookieWrite(replica, pinMs, now = Date.now()) {
-	if (!replica?.wrote) return void 0;
-	return {
-		name: PRIMARY_COOKIE,
-		value: String(now + pinMs),
-		options: primaryCookieOptions(pinMs)
-	};
-}
-/** A `Set-Cookie` value keeping the next requests on the primary for `pinMs`. */
-function primaryCookie(pinMs, now = Date.now()) {
-	return serializeCookieHeader(PRIMARY_COOKIE, String(now + pinMs), primaryCookieOptions(pinMs));
-}
-/**
-* `response` with the `bs-primary-until` cookie when the request wrote, so the
-* caller's next requests read their own writes. A response with immutable
-* headers is copied.
-*/
-function withPrimaryPin(response, replica, pinMs) {
-	if (!replica?.wrote) return response;
-	const cookie = primaryCookie(pinMs);
-	try {
-		response.headers.append("set-cookie", cookie);
-		return response;
-	} catch {
-		const copy = new Response(response.body, response);
-		copy.headers.append("set-cookie", cookie);
-		return copy;
-	}
-}
-/**
-* Reads go to `replica` until the context is pinned; writes, and every read
-* after a successful write, go to `primary`.
-*/
-function routedExecutor(primary, replica, state) {
-	const batch = primary.batch?.bind(primary);
-	const replicaBatch = replica.batch?.bind(replica);
-	return {
-		name: primary.name,
-		...primary.functionSources && replica.functionSources ? { functionSources: true } : {},
-		async execute(op, context) {
-			if (op.kind === "select" && !state.pinned) return replica.execute(op, context);
-			const result = await primary.execute(op, context);
-			if (op.kind !== "select" && result.ok) state.pin();
-			return result;
-		},
-		...primary.rpc ? { async rpc(name, args, context) {
-			if (context.get && !state.pinned && replica.rpc) return replica.rpc(name, args, context);
-			const result = await primary.rpc(name, args, context);
-			if (!context.get && result.ok) state.pin();
-			return result;
-		} } : {},
-		...batch ? { batch: (ops, context) => !state.pinned && replicaBatch ? replicaBatch(ops, context) : batch(ops, context) } : {}
-	};
-}
-//#endregion
-export { replicaState as a, primaryCookieWrite as i, PRIMARY_COOKIE as n, routedExecutor as o, pinnedUntil as r, withPrimaryPin as s, DEFAULT_PIN_MS as t };