Spaces:
Running
Running
| import { createClient, type User } from "@supabase/supabase-js"; | |
| import bcrypt from "bcryptjs"; | |
| import { randomBytes } from "node:crypto"; | |
| import type { Request, Response } from "express"; | |
| import { env, isProduction } from "./config.js"; | |
| import { timedFetch, timedAuthFetch } from "./request-timing.js"; | |
| // Bind Google's PKCE verifier to the initiating browser, not a shared client's | |
| // in-memory store (which concurrent logins can overwrite or a restart can lose). | |
| export function oauthClient(req: Request, res: Response) { | |
| const cookieName = "sp_oauth_verifier"; | |
| const options = { httpOnly: true, secure: isProduction, sameSite: "lax" as const, path: "/api/auth" }; | |
| return createClient(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, { | |
| global: { fetch: timedAuthFetch }, | |
| auth: { | |
| autoRefreshToken: false, persistSession: true, detectSessionInUrl: false, flowType: "pkce", | |
| storage: { | |
| getItem: (key) => key.endsWith("-code-verifier") ? req.cookies?.[cookieName] ?? null : null, | |
| setItem: (key, value) => { | |
| if (key.endsWith("-code-verifier")) res.cookie(cookieName, value, { ...options, maxAge: 10 * 60 * 1000 }); | |
| }, | |
| removeItem: (key) => { | |
| if (key.endsWith("-code-verifier")) res.clearCookie(cookieName, options); | |
| }, | |
| }, | |
| }, | |
| }); | |
| } | |
| export const supabaseAuth = createClient(env.SUPABASE_URL, env.SUPABASE_ANON_KEY, { | |
| global: { fetch: timedAuthFetch }, | |
| // OAuth returns a one-time code for the backend callback to exchange, rather | |
| // than placing session tokens in the browser URL fragment. | |
| auth: { autoRefreshToken: false, persistSession: false, detectSessionInUrl: false, flowType: "pkce" }, | |
| }); | |
| export const supabaseAdmin = createClient(env.SUPABASE_URL, env.SUPABASE_SERVICE_ROLE_KEY, { | |
| global: { fetch: timedFetch }, | |
| auth: { autoRefreshToken: false, persistSession: false, detectSessionInUrl: false }, | |
| }); | |
| export async function hashPassword(password: string) { | |
| return bcrypt.hash(password, 12); | |
| } | |
| export function userHasPassword(user: User) { | |
| return user.app_metadata?.has_password === true || Boolean(user.identities?.some((identity) => identity.provider === "email")); | |
| } | |
| async function randomPasswordHash() { | |
| return bcrypt.hash(randomBytes(32).toString("hex"), 12); | |
| } | |
| export async function syncProfile(user: User, profile?: { fname?: string; lname?: string; academy?: string | null; role?: string | null; passwordHash?: string }) { | |
| const metadata = user.user_metadata ?? {}; | |
| const { data: existing, error: readError } = await supabaseAdmin.from("users").select("user_id,email").eq("user_id", user.id).maybeSingle(); | |
| if (readError) throw new Error(`Unable to read user profile: ${readError.message}`); | |
| if (existing) { | |
| if (existing.email === user.email) return; | |
| // The profile table is the canonical source for editable profile fields. | |
| // Auth callbacks should only keep the email in sync, never reset user edits. | |
| const { error } = await supabaseAdmin.from("users").update({ email: user.email }).eq("user_id", user.id); | |
| if (error) throw new Error(`Unable to update user profile: ${error.message}`); | |
| return; | |
| } | |
| const fields = { | |
| user_id: user.id, | |
| fname: profile?.fname ?? metadata.fname ?? metadata.full_name?.split(" ")[0] ?? "User", | |
| lname: profile?.lname ?? metadata.lname ?? metadata.full_name?.split(" ").slice(1).join(" ") ?? "User", | |
| email: user.email, | |
| academy: profile?.academy ?? metadata.academy ?? null, | |
| role: profile?.role ?? metadata.role ?? null, | |
| account_role: "user", | |
| }; | |
| const { error } = await supabaseAdmin.from("users").insert({ ...fields, password_hash: profile?.passwordHash ?? await randomPasswordHash() }); | |
| if (error?.code === "23505") { | |
| // Two OAuth callbacks or sign-in requests can race after both observe that | |
| // the profile is missing. Re-read the user ID before treating the conflict | |
| // as a harmless concurrent insert; an email conflict for another user must | |
| // still fail. | |
| const { data: racedProfile, error: racedReadError } = await supabaseAdmin.from("users") | |
| .select("user_id").eq("user_id", user.id).maybeSingle(); | |
| if (racedReadError) throw new Error(`Unable to verify user profile: ${racedReadError.message}`); | |
| if (racedProfile) { | |
| const { error: syncError } = await supabaseAdmin.from("users").update({ email: user.email }).eq("user_id", user.id); | |
| if (syncError) throw new Error(`Unable to update user profile: ${syncError.message}`); | |
| return; | |
| } | |
| } | |
| if (error) throw new Error(`Unable to create user profile: ${error.message}`); | |
| } | |
| export function userPayload(user: User, accountRole = "user") { | |
| return { id: user.id, email: user.email, emailVerified: Boolean(user.email_confirmed_at), accountRole, metadata: user.user_metadata ?? {} }; | |
| } | |