cync-cli 0.3.0__py3-none-any.whl

cync/config.py

@@ -0,0 +1,108 @@
+"""Configuration for the cync server and client + per-machine project links."""
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass
+class ServerConfig:
+    """Server-side config, read from environment (see .env.example)."""
+
+    r2_endpoint: str
+    r2_access_key: str
+    r2_secret_key: str
+    r2_bucket: str
+    token: str
+    supabase_url: str
+    supabase_anon_key: str
+
+    @classmethod
+    def from_env(cls) -> "ServerConfig":
+        account = os.environ.get("R2_ACCOUNT_ID", "")
+        endpoint = os.environ.get("R2_ENDPOINT") or (
+            f"https://{account}.r2.cloudflarestorage.com" if account else ""
+        )
+        return cls(
+            r2_endpoint=endpoint,
+            r2_access_key=os.environ.get("R2_ACCESS_KEY_ID", ""),
+            r2_secret_key=os.environ.get("R2_SECRET_ACCESS_KEY", ""),
+            r2_bucket=os.environ.get("R2_BUCKET", "cync"),
+            token=os.environ.get("CYNC_TOKEN", ""),
+            supabase_url=os.environ.get("SUPABASE_URL", "").rstrip("/"),
+            supabase_anon_key=os.environ.get("SUPABASE_ANON_KEY", ""),
+        )
+
+
+# The default hosted cync server. Users need no config — `pipx install cync`
+# then `cync login` just works. Override with CYNC_SERVER_URL or config.toml
+# (e.g. to self-host).
+DEFAULT_SERVER_URL = "https://cync-486860272818.asia-northeast1.run.app"
+
+
+@dataclass
+class ClientConfig:
+    """Client-side config: the cync server URL (auth is via `cync login`)."""
+
+    server_url: str
+
+    @classmethod
+    def load(cls) -> "ClientConfig":
+        url = os.environ.get("CYNC_SERVER_URL")
+        cfg_path = Path.home() / ".config" / "cync" / "config.toml"
+        if not url and cfg_path.exists():
+            import tomllib
+
+            url = tomllib.loads(cfg_path.read_text()).get("server_url")
+        if not url:
+            url = DEFAULT_SERVER_URL  # hosted server; override via env/config.toml
+        url = url.rstrip("/")
+        from urllib.parse import urlparse
+
+        host = urlparse(url).hostname or ""
+        if not url.startswith("https://") and host not in ("127.0.0.1", "localhost", "::1"):
+            raise SystemExit(
+                f"refusing non-HTTPS cync server URL {url!r} — use https:// "
+                "(http is allowed only for localhost)."
+            )
+        return cls(server_url=url)
+
+
+# ---- repo -> project links (per machine, ~/.config/cync/links.json) ----
+
+
+def _links_path() -> Path:
+    return Path.home() / ".config" / "cync" / "links.json"
+
+
+def load_links() -> dict:
+    p = _links_path()
+    if p.exists():
+        try:
+            return json.loads(p.read_text())
+        except Exception:
+            return {}
+    return {}
+
+
+def get_link(repo_root: str) -> str | None:
+    return load_links().get(repo_root)
+
+
+def set_link(repo_root: str, project_id: str) -> None:
+    p = _links_path()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    links = load_links()
+    links[repo_root] = project_id
+    p.write_text(json.dumps(links, indent=2))
+
+
+def remove_link(repo_root: str) -> bool:
+    links = load_links()
+    if repo_root in links:
+        del links[repo_root]
+        _links_path().write_text(json.dumps(links, indent=2))
+        return True
+    return False

cync/server.py

@@ -0,0 +1,261 @@
+"""cync server (v0.3) — FastAPI: Supabase GitHub-JWT auth, Postgres metadata, R2 blobs.
+
+Auth: clients send a Supabase user JWT as ``Authorization: Bearer <jwt>``. The
+server validates it (one call to Supabase ``/auth/v1/user``), gets the user id,
+and scopes every project/conversation to that owner. Metadata lives in Supabase
+Postgres; blobs live in R2 keyed by the project uuid.
+"""
+from __future__ import annotations
+
+import base64
+import gzip
+import os
+from functools import lru_cache
+
+from dotenv import load_dotenv
+
+load_dotenv()
+
+from fastapi import Depends, FastAPI, Header, HTTPException, Request  # noqa: E402
+from fastapi.responses import JSONResponse  # noqa: E402
+from pydantic import BaseModel  # noqa: E402
+
+from . import common  # noqa: E402
+from .config import ServerConfig  # noqa: E402
+from .storage import make_storage  # noqa: E402
+from .supabase_store import SupabaseStore  # noqa: E402
+
+cfg = ServerConfig.from_env()
+app = FastAPI(title="cync", version="0.3.0")
+
+MAX_BODY_BYTES = int(os.environ.get("CYNC_MAX_BODY_BYTES", str(64 * 1024 * 1024)))
+# Per-user quotas for the hosted (public) service. Generous defaults; tune via env.
+MAX_PROJECTS = int(os.environ.get("CYNC_MAX_PROJECTS", "20"))
+MAX_BYTES_PER_USER = int(os.environ.get("CYNC_MAX_BYTES_PER_USER", str(500 * 1024 * 1024)))
+
+
+@lru_cache(maxsize=1)
+def get_storage():
+    """R2 (or local) blob store — lazy so import never crashes on bad config."""
+    return make_storage(cfg)
+
+
+@lru_cache(maxsize=1)
+def get_meta():
+    """Supabase Postgres metadata store — lazy."""
+    return SupabaseStore.from_env()
+
+
+@app.middleware("http")
+async def _limit_body_size(request: Request, call_next):
+    cl = request.headers.get("content-length")
+    if cl is not None:
+        try:
+            if int(cl) > MAX_BODY_BYTES:
+                return JSONResponse(status_code=413, content={"detail": "request body too large"})
+        except ValueError:
+            pass
+    # Enforce the cap against the actual bytes too (chunked / lying Content-Length):
+    # read+count the stream, then hand the buffered body to the route.
+    if request.method in ("POST", "PUT", "PATCH"):
+        body = b""
+        async for chunk in request.stream():
+            body += chunk
+            if len(body) > MAX_BODY_BYTES:
+                return JSONResponse(status_code=413, content={"detail": "request body too large"})
+        request._body = body  # cache so the handler re-uses it
+    return await call_next(request)
+
+
+def _allowlist() -> set[str]:
+    """Emails/GitHub usernames allowed to use this server (CYNC_ALLOWLIST,
+    comma-separated). Empty/unset = open to any authenticated GitHub user."""
+    raw = os.environ.get("CYNC_ALLOWLIST", "")
+    return {x.strip().lower() for x in raw.split(",") if x.strip()}
+
+
+def require_user(authorization: str = Header(default="")) -> str:
+    """Validate the Supabase JWT, enforce the allowlist, return the user's id."""
+    scheme, _, token = authorization.partition(" ")
+    if scheme != "Bearer" or not token:
+        raise HTTPException(status_code=401, detail="missing bearer token")
+    try:
+        user = get_meta().get_user(token)
+    except Exception:  # auth backend unreachable -> fail closed, but as 503 not 500
+        raise HTTPException(status_code=503, detail="auth backend unavailable")
+    if not user or not user.get("id"):
+        raise HTTPException(status_code=401, detail="invalid or expired token")
+    allow = _allowlist()
+    if allow:
+        email = (user.get("email") or "").lower()
+        uname = ((user.get("user_metadata") or {}).get("user_name") or "").lower()
+        if email not in allow and uname not in allow:
+            raise HTTPException(
+                status_code=403,
+                detail="not authorized — ask the admin to add you to the allowlist",
+            )
+    return user["id"]
+
+
+def _seg(value: str) -> str:
+    if not common.is_safe_segment(value):
+        raise HTTPException(status_code=400, detail="invalid id")
+    return value
+
+
+def _own_project(owner: str, pid: str) -> dict:
+    """Ensure the user owns project `pid` (also validates it as a path segment)."""
+    _seg(pid)
+    proj = get_meta().get_project_by_id(owner, pid)
+    if not proj:
+        raise HTTPException(status_code=404, detail="project not found")
+    return proj
+
+
+class PushBody(BaseModel):
+    project_id: str
+    origin_path: str = ""
+    title: str = ""
+    mtime: float = 0.0
+    content_b64: str
+
+
+class CreateProjectBody(BaseModel):
+    name: str
+
+
+@app.get("/health")
+def health() -> dict:
+    return {"ok": True, "service": "cync"}
+
+
+@app.get("/config")
+def public_config() -> dict:
+    """Public Supabase params for the CLI/web login flow (the anon key is public)."""
+    return {"supabase_url": cfg.supabase_url, "supabase_anon_key": cfg.supabase_anon_key}
+
+
+# ---- projects ----
+
+
+@app.post("/projects")
+def create_project(body: CreateProjectBody, owner: str = Depends(require_user)) -> dict:
+    slug = common.slugify_project(body.name)
+    if not slug or not common.is_safe_segment(slug):
+        raise HTTPException(status_code=400, detail="invalid project name")
+    meta = get_meta()
+    if meta.get_project(owner, slug) is not None:
+        raise HTTPException(status_code=409, detail=f"project '{slug}' already exists")
+    if len(meta.list_projects(owner)) >= MAX_PROJECTS:
+        raise HTTPException(status_code=403, detail=f"project limit reached ({MAX_PROJECTS})")
+    return meta.create_project(owner, slug, body.name)
+
+
+@app.get("/projects")
+def list_projects(owner: str = Depends(require_user)) -> list[dict]:
+    return get_meta().list_projects(owner)
+
+
+@app.get("/projects/{pid}")
+def get_project(pid: str, owner: str = Depends(require_user)) -> dict:
+    return _own_project(owner, pid)
+
+
+@app.delete("/projects/{pid}")
+def delete_project(pid: str, owner: str = Depends(require_user)) -> dict:
+    _own_project(owner, pid)
+    # blobs first (R2 delete is idempotent), then metadata — so a storage
+    # failure leaves the rows intact and the delete is safely retryable.
+    get_storage().delete_project(pid)       # delete R2 blobs
+    get_meta().delete_project(owner, pid)   # then metadata (cascades rows)
+    return {"deleted": pid}
+
+
+# ---- conversations ----
+
+
+@app.put("/conversations/{cid}")
+def put_conversation(cid: str, body: PushBody, owner: str = Depends(require_user)) -> dict:
+    _seg(cid)
+    _own_project(owner, body.project_id)
+    try:
+        raw = base64.b64decode(body.content_b64)
+    except Exception:
+        raise HTTPException(status_code=400, detail="invalid base64 content")
+    usage = get_meta().user_usage(owner)
+    old = usage["sizes"].get(f"{body.project_id}/{cid}", 0)
+    if usage["bytes"] - old + len(raw) > MAX_BYTES_PER_USER:
+        raise HTTPException(
+            status_code=413,
+            detail=f"storage quota exceeded ({MAX_BYTES_PER_USER // (1024 * 1024)} MB per user)",
+        )
+    get_storage().put(body.project_id, cid, gzip.compress(raw))
+    meta = {
+        "title": body.title or common.extract_title(raw.decode("utf-8", "ignore")),
+        "size": len(raw),
+        "mtime": body.mtime,
+        "origin_path": body.origin_path,
+        "updated_at": common.now_iso(),
+    }
+    return get_meta().upsert_conversation(body.project_id, cid, meta)
+
+
+@app.get("/conversations")
+def list_conversations(project_id: str, owner: str = Depends(require_user)) -> list[dict]:
+    _own_project(owner, project_id)
+    return get_meta().list_conversations(project_id)
+
+
+@app.get("/conversations/{cid}")
+def get_conversation(cid: str, project_id: str, owner: str = Depends(require_user)) -> dict:
+    _seg(cid)
+    _own_project(owner, project_id)
+    return _load(project_id, cid)
+
+
+@app.delete("/conversations/{cid}")
+def delete_conversation(cid: str, project_id: str, owner: str = Depends(require_user)) -> dict:
+    _seg(cid)
+    _own_project(owner, project_id)
+    get_storage().delete(project_id, cid)
+    get_meta().delete_conversation(project_id, cid)
+    return {"deleted": cid}
+
+
+# ---- browse endpoints (web viewer; keyed by project uuid) ----
+
+
+@app.get("/projects/{pid}/conversations")
+def browse_conversations(pid: str, owner: str = Depends(require_user)) -> list[dict]:
+    _own_project(owner, pid)
+    return get_meta().list_conversations(pid)
+
+
+@app.get("/projects/{pid}/conversations/{cid}")
+def browse_conversation(pid: str, cid: str, owner: str = Depends(require_user)) -> dict:
+    _seg(cid)
+    _own_project(owner, pid)
+    return _load(pid, cid)
+
+
+def _load(pid: str, cid: str) -> dict:
+    meta = get_meta().get_conversation(pid, cid)
+    if not meta:
+        raise HTTPException(status_code=404, detail="conversation not found")
+    try:
+        gz = get_storage().get(pid, cid)
+    except Exception:
+        raise HTTPException(status_code=404, detail="conversation blob not found")
+    raw = gzip.decompress(gz)
+    return {**meta, "content_b64": base64.b64encode(raw).decode()}
+
+
+def run() -> None:
+    import uvicorn
+
+    uvicorn.run(
+        "cync.server:app",
+        host=os.environ.get("CYNC_HOST", "127.0.0.1"),
+        port=int(os.environ.get("CYNC_PORT", "8787")),
+        reload=False,
+    )

cync/storage.py

@@ -0,0 +1,98 @@
+"""Blob storage for cync (v0.3): conversation .jsonl.gz blobs only.
+
+Project/conversation *metadata* lives in Supabase Postgres (see
+supabase_store.py). This layer stores just the gzipped transcripts, keyed by:
+    <project_id>/<conv_id>.jsonl.gz   (project_id is the Postgres project uuid)
+"""
+from __future__ import annotations
+
+import os
+import shutil
+from pathlib import Path
+
+from .config import ServerConfig
+
+
+def make_storage(cfg: ServerConfig):
+    """Pick a blob backend from CYNC_STORAGE (default: r2)."""
+    backend = os.environ.get("CYNC_STORAGE", "r2").lower()
+    if backend == "local":
+        base = os.environ.get("CYNC_LOCAL_DIR") or str(Path.home() / ".cync-store")
+        return LocalStorage(base)
+    if not (cfg.r2_endpoint and cfg.r2_access_key and cfg.r2_secret_key):
+        raise RuntimeError(
+            "R2 storage is not configured: set R2_ACCOUNT_ID (or R2_ENDPOINT) and "
+            "R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY, or use CYNC_STORAGE=local."
+        )
+    return R2Storage(cfg)
+
+
+class LocalStorage:
+    """Filesystem blob backend — for testing / single-machine use."""
+
+    def __init__(self, base_dir: str) -> None:
+        self.base = Path(base_dir)
+
+    def _resolve(self, pid: str, name: str) -> Path:
+        base = self.base.resolve()
+        p = (base / pid / name).resolve()
+        if not p.is_relative_to(base):
+            raise ValueError("path escapes store root")
+        return p
+
+    def put(self, pid: str, cid: str, data_gz: bytes) -> None:
+        self._resolve(pid, "").mkdir(parents=True, exist_ok=True)
+        self._resolve(pid, f"{cid}.jsonl.gz").write_bytes(data_gz)
+
+    def get(self, pid: str, cid: str) -> bytes:
+        return self._resolve(pid, f"{cid}.jsonl.gz").read_bytes()
+
+    def delete(self, pid: str, cid: str) -> None:
+        p = self._resolve(pid, f"{cid}.jsonl.gz")
+        if p.exists():
+            p.unlink()
+
+    def delete_project(self, pid: str) -> None:
+        d = self._resolve(pid, "")
+        if d.is_dir():
+            shutil.rmtree(d)
+
+
+class R2Storage:
+    """Cloudflare R2 (S3-compatible) blob backend."""
+
+    def __init__(self, cfg: ServerConfig) -> None:
+        import boto3
+        from botocore.config import Config
+
+        self.bucket = cfg.r2_bucket
+        self.s3 = boto3.client(
+            "s3",
+            endpoint_url=cfg.r2_endpoint,
+            aws_access_key_id=cfg.r2_access_key,
+            aws_secret_access_key=cfg.r2_secret_key,
+            config=Config(signature_version="s3v4"),
+            region_name="auto",
+        )
+
+    @staticmethod
+    def _key(pid: str, cid: str) -> str:
+        return f"{pid}/{cid}.jsonl.gz"
+
+    def put(self, pid: str, cid: str, data_gz: bytes) -> None:
+        self.s3.put_object(
+            Bucket=self.bucket, Key=self._key(pid, cid),
+            Body=data_gz, ContentType="application/gzip",
+        )
+
+    def get(self, pid: str, cid: str) -> bytes:
+        return self.s3.get_object(Bucket=self.bucket, Key=self._key(pid, cid))["Body"].read()
+
+    def delete(self, pid: str, cid: str) -> None:
+        self.s3.delete_object(Bucket=self.bucket, Key=self._key(pid, cid))
+
+    def delete_project(self, pid: str) -> None:
+        paginator = self.s3.get_paginator("list_objects_v2")
+        for page in paginator.paginate(Bucket=self.bucket, Prefix=f"{pid}/"):
+            for obj in page.get("Contents", []):
+                self.s3.delete_object(Bucket=self.bucket, Key=obj["Key"])

cync/supabase_store.py

@@ -0,0 +1,199 @@
+"""Supabase Postgres metadata store (via PostgREST, service role) + auth helper.
+
+Holds project + conversation *metadata*; the conversation blobs live in R2
+(see storage.py). The server uses the service-role key, which BYPASSES RLS, so
+every query here passes ``owner`` explicitly — RLS in schema.sql is a backstop
+for any direct PostgREST access with a user JWT.
+"""
+from __future__ import annotations
+
+import os
+
+import httpx
+
+
+class SupabaseError(RuntimeError):
+    pass
+
+
+def _norm_conv(row: dict) -> dict:
+    """Normalize a conversations row to the API shape (conv_id -> id)."""
+    return {
+        "id": row["conv_id"],
+        "project_id": row["project_id"],
+        "title": row.get("title", ""),
+        "size": row.get("size", 0),
+        "mtime": row.get("mtime", 0),
+        "origin_path": row.get("origin_path", ""),
+        "updated_at": row.get("updated_at"),
+    }
+
+
+class SupabaseStore:
+    def __init__(self, url: str, service_key: str) -> None:
+        base = url.rstrip("/")
+        self.rest = f"{base}/rest/v1"
+        self.auth = f"{base}/auth/v1"
+        self._key = service_key
+        self._h = {
+            "apikey": service_key,
+            "Authorization": f"Bearer {service_key}",
+            "Content-Type": "application/json",
+        }
+        self.client = httpx.Client(timeout=30.0)
+
+    @classmethod
+    def from_env(cls) -> "SupabaseStore":
+        url = os.environ.get("SUPABASE_URL", "")
+        key = os.environ.get("SUPABASE_SERVICE_ROLE_KEY", "")
+        if not url or not key:
+            raise SupabaseError(
+                "Supabase is not configured: set SUPABASE_URL and "
+                "SUPABASE_SERVICE_ROLE_KEY (see .env.example)."
+            )
+        return cls(url, key)
+
+    def _req(self, method: str, path: str, *, params=None, json=None, prefer=None):
+        headers = dict(self._h)
+        if prefer:
+            headers["Prefer"] = prefer
+        r = self.client.request(method, f"{self.rest}{path}", params=params, json=json, headers=headers)
+        if r.status_code >= 400:
+            raise SupabaseError(f"{method} {path} -> {r.status_code}: {r.text[:200]}")
+        return r
+
+    # ---- auth ----
+    def get_user(self, access_token: str) -> dict | None:
+        """Validate a user's JWT and return their auth.users record (or None)."""
+        r = self.client.get(
+            f"{self.auth}/user",
+            headers={"apikey": self._key, "Authorization": f"Bearer {access_token}"},
+        )
+        return r.json() if r.status_code == 200 else None
+
+    # ---- projects ----
+    def create_project(self, owner: str, slug: str, name: str) -> dict:
+        r = self._req(
+            "POST", "/projects",
+            json={"owner": owner, "slug": slug, "name": name},
+            prefer="return=representation",
+        )
+        return r.json()[0]
+
+    def get_project(self, owner: str, slug: str) -> dict | None:
+        r = self._req("GET", "/projects", params={
+            "owner": f"eq.{owner}", "slug": f"eq.{slug}", "select": "*", "limit": "1",
+        })
+        rows = r.json()
+        return rows[0] if rows else None
+
+    def get_project_by_id(self, owner: str, project_id: str) -> dict | None:
+        r = self._req("GET", "/projects", params={
+            "owner": f"eq.{owner}", "id": f"eq.{project_id}", "select": "*", "limit": "1",
+        })
+        rows = r.json()
+        return rows[0] if rows else None
+
+    def list_projects(self, owner: str) -> list[dict]:
+        r = self._req("GET", "/projects", params={
+            "owner": f"eq.{owner}",
+            "select": "id,slug,name,created_at,conversations(count)",
+            "order": "created_at.desc",
+        })
+        out = []
+        for row in r.json():
+            embedded = row.get("conversations") or []
+            count = embedded[0].get("count", 0) if embedded else 0
+            out.append({
+                "id": row["id"], "slug": row["slug"], "name": row["name"],
+                "created_at": row["created_at"], "count": count,
+            })
+        return out
+
+    def user_usage(self, owner: str) -> dict:
+        """Per-user quota accounting: project count, total stored bytes, and each
+        conversation's size keyed as 'project_id/conv_id'."""
+        projects = self.list_projects(owner)
+        pids = [p["id"] for p in projects]
+        sizes: dict[str, int] = {}
+        total = 0
+        if pids:
+            r = self._req("GET", "/conversations", params={
+                "project_id": f"in.({','.join(pids)})",
+                "select": "project_id,conv_id,size",
+            })
+            for row in r.json():
+                sz = int(row.get("size") or 0)
+                sizes[f"{row['project_id']}/{row['conv_id']}"] = sz
+                total += sz
+        return {"projects": len(projects), "bytes": total, "sizes": sizes}
+
+    def delete_project(self, owner: str, project_id: str) -> None:
+        self._req("DELETE", "/projects", params={
+            "owner": f"eq.{owner}", "id": f"eq.{project_id}",
+        })
+
+    # ---- conversations (metadata) ----
+    def upsert_conversation(self, project_id: str, conv_id: str, meta: dict) -> dict:
+        body = {
+            "project_id": project_id,
+            "conv_id": conv_id,
+            "title": meta.get("title", ""),
+            "size": meta.get("size", 0),
+            "mtime": meta.get("mtime", 0),
+            "origin_path": meta.get("origin_path", ""),
+        }
+        # Only send updated_at if we actually have one; otherwise omit the key so
+        # the column's NOT NULL `default now()` applies (legacy sidecars lack it).
+        if meta.get("updated_at") is not None:
+            body["updated_at"] = meta["updated_at"]
+        r = self._req(
+            "POST", "/conversations", json=body,
+            prefer="resolution=merge-duplicates,return=representation",
+        )
+        return _norm_conv(r.json()[0])
+
+    def list_conversations(self, project_id: str) -> list[dict]:
+        r = self._req("GET", "/conversations", params={
+            "project_id": f"eq.{project_id}", "select": "*", "order": "updated_at.desc",
+        })
+        return [_norm_conv(row) for row in r.json()]
+
+    def get_conversation(self, project_id: str, conv_id: str) -> dict | None:
+        r = self._req("GET", "/conversations", params={
+            "project_id": f"eq.{project_id}", "conv_id": f"eq.{conv_id}",
+            "select": "*", "limit": "1",
+        })
+        rows = r.json()
+        return _norm_conv(rows[0]) if rows else None
+
+    def delete_conversation(self, project_id: str, conv_id: str) -> None:
+        self._req("DELETE", "/conversations", params={
+            "project_id": f"eq.{project_id}", "conv_id": f"eq.{conv_id}",
+        })
+
+    # ---- admin (tests / seeding) ----
+    def admin_create_user(self, email: str, password: str | None = None) -> dict:
+        body = {"email": email, "email_confirm": True}
+        if password:
+            body["password"] = password
+        r = self.client.post(f"{self.auth}/admin/users", headers=self._h, json=body)
+        if r.status_code >= 400:
+            raise SupabaseError(f"create_user -> {r.status_code}: {r.text[:200]}")
+        return r.json()
+
+    def admin_delete_user(self, user_id: str) -> None:
+        r = self.client.delete(f"{self.auth}/admin/users/{user_id}", headers=self._h)
+        if r.status_code >= 400:
+            raise SupabaseError(f"delete_user -> {r.status_code}: {r.text[:200]}")
+
+    def password_token(self, email: str, password: str) -> str:
+        """Sign in with email+password and return an access token (for tests)."""
+        r = self.client.post(
+            f"{self.auth}/token", params={"grant_type": "password"},
+            headers={"apikey": self._key, "Content-Type": "application/json"},
+            json={"email": email, "password": password},
+        )
+        if r.status_code >= 400:
+            raise SupabaseError(f"password_token -> {r.status_code}: {r.text[:200]}")
+        return r.json()["access_token"]