better-supabase 0.8.0 → 0.9.0

package/dist/resolve-MxXVWyhd.d.ts

@@ -1,173 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { b as DbError } from "./result-BchM1XZn.js";
-import { l as RefreshEvent } from "./events-D1BOCll8.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as StandardSchemaV1 } from "./standard-lmkbOtPB.js";
-import { t as BetterSupabaseEnv } from "./index-BUK7jUzR.js";
-import { a as CookieWrite, n as CookieOptions, r as CookieRecord, s as SessionEncoding } from "./session-ChiXDZdZ.js";
-import { JWTClaims, SupabaseEnv, UserClaims } from "@supabase/server";
-//#region src/auth/resolve.d.ts
-/**
- * Who is calling. `C` is the claims type from `betterSupabase.claims(schema)`; the
- * verified payload keeps every JWT claim and adds the schema's output. `P`
- * is the `user_metadata` type from `betterSupabase.userMetadata(schema)`.
- */
-type AuthState<C = unknown, P = unknown> = {
-  readonly kind: "user";
-  readonly token: string;
-  readonly claims: JWTClaims & C;
-  readonly user: UserClaims;
-  readonly source: "bearer" | "cookie" | (string & {});
-  /** Seconds since epoch, from the token's `exp`. */
-  readonly expiresAt: number | null;
-  /**
-   * `user_metadata` parsed by `betterSupabase.userMetadata(schema)`; `undefined`
-   * without a schema or when the metadata fails it. Users can write this
-   * data themselves: use it for display, never for access.
-   */
-  readonly profile?: P;
-} | {
-  readonly kind: "service";
-  readonly keyName: string;
-} | {
-  readonly kind: "apiKey";
-  readonly keyId: string;
-  readonly name: string;
-  readonly organizationId?: string;
-  readonly userId?: string;
-  readonly scopes: readonly string[];
-  /** When the key was created. */
-  readonly createdAt?: Temporal.Instant;
-  /** The user who created the key, when the row records one. */
-  readonly createdBy?: string;
-  /** `sub` (the user, or the key for an organization key), `role: authenticated` and `api_key`. */
-  readonly claims: JWTClaims;
-} | {
-  readonly kind: "anon";
-  /** `expired`: the cookie session needs a refresh that was not allowed here (run the proxy). */
-  readonly reason: "none" | "expired" | "signed_out" | "refresh_failed";
-} | {
-  readonly kind: "invalid";
-  readonly reason: InvalidReason;
-  readonly error: DbError;
-};
-type InvalidReason = "token" | "claims" | "actor";
-/**
- * What an `AuthResolver` returns. `reason` may be left out of an `invalid`
- * state; it then counts as `token`.
- */
-type ResolvedState = Exclude<AuthState, {
-  kind: "invalid";
-}> | {
-  readonly kind: "invalid";
-  readonly reason?: InvalidReason;
-  readonly error: DbError;
-};
-/**
- * Extension point for other credentials (API keys, third-party auth, custom
- * tokens). Return `undefined` when the request carries nothing this resolver
- * understands; the built-in Bearer and cookie resolution runs next.
- */
-interface AuthResolver {
-  readonly name: string;
-  resolve(request: Request): Promise<ResolvedState | undefined> | ResolvedState | undefined;
-}
-interface ResolveAuthOptions {
-  readonly env: BetterSupabaseEnv;
-  /** Allow refreshing an expiring cookie session. Only where cookies can be written (proxy). */
-  readonly refresh?: boolean;
-  /**
-   * With `refresh`, refresh when the token expires within this many seconds.
-   * Defaults to 60. Without `refresh` a token stays valid until its `exp`.
-   */
-  readonly leeway?: number;
-  /** Milliseconds before a refresh counts as a network failure. Defaults to 5000. */
-  readonly refreshTimeoutMs?: number;
-  readonly checkSession?: boolean;
-  /**
-   * Accept `sb_secret_` keys (`apikey` header) as service callers: `true` for
-   * any configured key, or the key names allowed (`['cron']`). Defaults to false.
-   */
-  readonly secret?: boolean | readonly string[];
-  readonly audience?: string | string[];
-  readonly issuer?: string | string[];
-  readonly cookie?: {
-    readonly name?: string;
-    readonly options?: CookieOptions;
-    /**
-     * The shape refreshed sessions are written in, `cookies.encode` in
-     * `@supabase/ssr`. Use the browser client's value. Defaults to
-     * `user-and-tokens`.
-     */
-    readonly encode?: SessionEncoding;
-  };
-  /**
-   * Read the session cookie. Defaults to true. `false` suits endpoints only
-   * bearer clients call (MCP): a browser's cookie then can't authorize a
-   * request another site makes it send.
-   */
-  readonly cookies?: boolean;
-  /** Inline JWKS instead of fetching `env.jwksUrl` (tests, air-gapped). */
-  readonly jwks?: SupabaseEnv["jwks"];
-  /**
-   * Verify HS256 tokens without a `kid` locally with this shared secret, the
-   * tokens Supabase Lite issues (`auth.jwt_secret`). Tokens with a `kid`
-   * still verify against the JWKS. `createServer` sets it from
-   * `SUPABASE_JWT_SECRET` with `backend: "lite"`.
-   */
-  readonly jwtSecret?: string;
-  /**
-   * Validates the verified claims (`betterSupabase.claims(schema)` sets it). A failure
-   * resolves to `{ kind: 'invalid', reason: 'claims' }`.
-   */
-  readonly claims?: StandardSchemaV1;
-  /**
-   * Parses `user_metadata` into `profile` (`betterSupabase.userMetadata(schema)` sets
-   * it). A failure leaves `profile` undefined and warns once; the session
-   * stays valid.
-   */
-  readonly userMetadata?: StandardSchemaV1;
-  /** Receives the `userMetadata` warning. Defaults to `console`. */
-  readonly logger?: Logger;
-  readonly resolvers?: readonly AuthResolver[];
-  /**
-   * The caller's IP, sent to Auth as `Sb-Forwarded-For` on refreshes so its
-   * per-IP rate limit counts users, not your server. Only with a secret key
-   * (`env.secretKey`), which Auth requires for the header. Defaults to
-   * `clientIp` (the first `x-forwarded-for` hop); `false` turns it off.
-   */
-  readonly clientIp?: ((request: Request) => string | undefined) | false;
-  /** Called after every refresh attempt (metrics, logging). */
-  readonly onRefresh?: (event: RefreshEvent) => void;
-  readonly fetch?: typeof fetch;
-  /** Epoch milliseconds, the unit JWT `exp` and `iat` math needs. */
-  readonly now?: () => number;
-}
-interface AuthResolution<C = unknown, P = unknown> {
-  readonly auth: AuthState<C, P>;
-  /** Cookie writes for the response. Empty unless the session was refreshed or cleared. */
-  readonly cookies: readonly CookieWrite[];
-  /** No-store headers, set whenever `cookies` is not empty. */
-  readonly headers: Readonly<Record<string, string>>;
-  /** Cookies the rest of this request should see, including a refreshed session. */
-  readonly requestCookies: readonly CookieRecord[];
-  /** Adds `cookies` and `headers` to a response. */
-  apply(response: Response): Response;
-  /** The session was ended server-side (revoked, deleted or banned); the cookies are cleared. */
-  readonly sessionEnded?: boolean;
-  /** Why `sessionEnded` is set: `banned` when Auth rejected the user as banned. */
-  readonly sessionEndedReason?: "ended" | "banned";
-}
-/** The first `x-forwarded-for` hop, the client as your edge saw it. */
-declare function clientIp(request: Request): string | undefined;
-/**
- * Resolves who is calling: custom resolvers, then `Authorization: Bearer`
- * (APIs, MCP, mobile), then the `@supabase/ssr` session cookie (browsers).
- *
- * A valid token costs no network call: it is verified locally against the
- * cached JWKS. An expiring cookie session is refreshed only when `refresh` is
- * set, through a single-flight request, and only then are cookies written.
- */
-declare function resolveAuth(request: Request, options: ResolveAuthOptions): Promise<AuthResolution>;
-//#endregion
-export { ResolveAuthOptions as a, resolveAuth as c, InvalidReason as i, AuthResolver as n, ResolvedState as o, AuthState as r, clientIp as s, AuthResolution as t };

package/dist/resource--vTrBe6I.d.ts

@@ -1,103 +0,0 @@
-import { R as TableMeta } from "./types-CoE5Zwy4.js";
-import { D as SecurityRequirement, E as ResourceOperation, r as JsonObject } from "./model-OgBxvk3N.js";
-//#region src/spec/schemas.d.ts
-/** A Standard Schema, or anything else that might carry `~standard`. */
-interface StandardLike {
-  readonly "~standard": object;
-}
-//#endregion
-//#region src/spec/resource.d.ts
-type ResourcePagination = "offset" | "cursor";
-type ActionMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-/** A custom endpoint on a resource, documented next to its CRUD operations. */
-interface ResourceActionSpec<Ref = string> {
-  readonly method: ActionMethod;
-  /**
-   * Relative to the collection: `/{id}/send` acts on one row (the key
-   * parameter is the table's primary key), `/export` on the table.
-   */
-  readonly path: string;
-  /** The JSON body. */
-  readonly input?: StandardLike;
-  /** The query parameters, as an object schema. */
-  readonly query?: StandardLike;
-  /** The JSON response. Without it the action answers 204. */
-  readonly output?: StandardLike;
-  /** Success status. Defaults to 200 with an output, 204 without. */
-  readonly status?: number;
-  readonly summary?: string;
-  readonly description?: string;
-  readonly deprecated?: boolean;
-  readonly permission?: Ref;
-  /** Names of the events the action emits, for AsyncAPI. */
-  readonly emits?: readonly string[];
-}
-/** One shared error response: its component name, status and description. */
-interface ErrorResponse {
-  readonly name: string;
-  readonly status: number;
-  readonly description: string;
-}
-/**
- * What a resource serves and documents. `defineResource` and `defineApi`
- * read the same object, so the routes and the spec cannot drift.
- */
-interface ResourceDescription<Ref = string> {
-  /** Defaults to every operation for tables, `list` and `get` for views. */
-  readonly operations?: readonly ResourceOperation[];
-  /** Filters, search and sorts for `list`, from `defineListQuery`. */
-  readonly list?: {
-    readonly openapi: readonly unknown[];
-    readonly pagination?: ResourcePagination;
-  };
-  /** Paging of the default list. Defaults to `offset`. */
-  readonly pagination?: ResourcePagination;
-  /** Largest page of the default list. Defaults to 200. */
-  readonly maxPageSize?: number;
-  /** Path of the collection in the spec. Defaults to `/<table>`. */
-  readonly path?: string;
-  readonly tag?: string;
-  readonly description?: string;
-  /** Validates request bodies; their JSON Schema replaces the table's in the spec. */
-  readonly input?: {
-    readonly create?: StandardLike;
-    readonly update?: StandardLike;
-  };
-  /** The response shape of an operation whose hooks change it. */
-  readonly output?: Partial<Readonly<Record<ResourceOperation, StandardLike>>>;
-  readonly actions?: Readonly<Record<string, ResourceActionSpec<Ref>>>;
-  /**
-   * The permission of each operation. `true` asks the authorizer
-   * (`forOperation`) for every enabled operation.
-   */
-  readonly permissions?: true | Partial<Readonly<Record<ResourceOperation, Ref>>>;
-  /** Overrides the model's security for this resource; `[]` makes it public. */
-  readonly security?: readonly SecurityRequirement[];
-  /** The shared error responses. Defaults to the API's `errors`. */
-  readonly errors?: readonly ErrorResponse[];
-  /** Deep-merged into the lowered operation, by operation or action name (`*` for all). */
-  readonly extend?: Readonly<Record<string, JsonObject>>;
-}
-interface PlannedAction<Ref = string> extends ResourceActionSpec<Ref> {
-  readonly name: string;
-  /** The `{name}` segments of `path`. */
-  readonly params: readonly string[];
-  /** The path split into segments; `{name}` segments are params. */
-  readonly segments: readonly string[];
-}
-/** A resolved `ResourceDescription`. */
-interface ResourcePlan<Ref = string> {
-  readonly table: string;
-  readonly meta: TableMeta;
-  readonly operations: readonly ResourceOperation[];
-  /** Name of the key parameter, or `undefined` for tables without a single-column key. */
-  readonly keyParam: string | undefined;
-  readonly pagination: ResourcePagination;
-  readonly maxPageSize: number;
-  readonly description: ResourceDescription<Ref>;
-  readonly actions: readonly PlannedAction<Ref>[];
-  /** The permission reference of each operation and action that has one. */
-  readonly permissions: Readonly<Record<string, Ref>>;
-}
-//#endregion
-export { ResourcePlan as a, ResourcePagination as i, ResourceActionSpec as n, StandardLike as o, ResourceDescription as r, ErrorResponse as t };

package/dist/resource-BqNqlYg9.js

@@ -1,91 +0,0 @@
-//#region src/spec/resource.ts
-const ACTION_NAME = /^[A-Za-z][A-Za-z0-9_]*$/u;
-const RESERVED = /* @__PURE__ */ new Set([
-	"list",
-	"get",
-	"create",
-	"update",
-	"delete"
-]);
-function planAction(table, name, action, keyParam) {
-	if (!ACTION_NAME.test(name) || RESERVED.has(name)) throw new TypeError(`${table}.actions.${name}: use a name of letters, digits and "_" that is not an operation`);
-	if (!action.path.startsWith("/") || action.path === "/") throw new TypeError(`${table}.actions.${name}: the path must start with "/" and name a segment, e.g. "/{id}/send"`);
-	const segments = action.path.slice(1).split("/");
-	const params = [];
-	for (const segment of segments) {
-		const match = /^\{(\w+)\}$/u.exec(segment);
-		if (match) params.push(match[1]);
-		else if (segment === "" || /[{}]/u.test(segment)) throw new TypeError(`${table}.actions.${name}: "${action.path}" has an invalid segment`);
-	}
-	if (params.some((param) => param !== keyParam)) throw new TypeError(`${table}.actions.${name}: the only path parameter is the key ${keyParam ? `"{${keyParam}}"` : "(this table has none)"}`);
-	return {
-		...action,
-		name,
-		params,
-		segments
-	};
-}
-/**
-* Resolves what a resource serves: the operations, the key, paging,
-* actions and permissions. Shared by `defineResource` and the API model.
-*/
-function planResource(schema, table, description = {}, authorizer) {
-	const meta = schema.tables[table];
-	if (!meta) throw new TypeError(`Unknown table "${table}"`);
-	const operations = description.operations ?? (meta.kind === "view" ? ["list", "get"] : [
-		"list",
-		"get",
-		"create",
-		"update",
-		"delete"
-	]);
-	const keyParam = meta.primaryKey.length === 1 ? meta.primaryKey[0] : void 0;
-	const pagination = description.list ? description.list.pagination ?? "offset" : description.pagination ?? "offset";
-	const actions = Object.entries(description.actions ?? {}).map(([name, action]) => planAction(table, name, action, keyParam));
-	const permissions = {};
-	if (description.permissions === true) {
-		if (!authorizer?.forOperation) throw new TypeError(`${table}: permissions: true needs an authorizer with forOperation()`);
-		for (const operation of operations) {
-			const ref = authorizer.forOperation(table, operation);
-			if (ref !== void 0) permissions[operation] = ref;
-		}
-	} else if (description.permissions) {
-		for (const [operation, ref] of Object.entries(description.permissions)) if (ref !== void 0) permissions[operation] = ref;
-	}
-	for (const action of actions) if (action.permission !== void 0) permissions[action.name] = action.permission;
-	return {
-		table,
-		meta,
-		operations,
-		keyParam,
-		pagination,
-		maxPageSize: description.maxPageSize ?? 200,
-		description,
-		actions,
-		permissions
-	};
-}
-/** The action whose method and segments match, with its params. */
-function matchAction(plan, method, segments) {
-	let wrongMethod = false;
-	for (const action of plan.actions) {
-		if (action.segments.length !== segments.length) continue;
-		const params = {};
-		if (!action.segments.every((segment, index) => {
-			const value = segments[index];
-			if (segment.startsWith("{")) {
-				params[segment.slice(1, -1)] = value;
-				return value !== "";
-			}
-			return segment === value;
-		})) continue;
-		if (action.method === method) return {
-			action,
-			params
-		};
-		wrongMethod = true;
-	}
-	return wrongMethod ? "method" : void 0;
-}
-//#endregion
-export { planResource as n, matchAction as t };