Jump to a page

@nightowlsdev/auth-supabase

Auth

Stateless Supabase AuthProvider that maps an already-verified Supabase session into a Night Owls AuthContext.

What it does

An AuthProvider for @nightowlsdev/core that resolves identity server-side at the request boundary (never from the request body). It uses the anon/publishable key only (never the service_role secret) and verifies tokens via supabase.auth.getUser(jwt), a network round-trip against Supabase, rather than local-only decoding. Identity is read from the server-controlled app_metadata (never user_metadata): tenantId from tenantClaim (default org_id, falling back to 'default'), userId from user.id, capabilities from rolesClaim (default roles) when an array. Header mode (default) reads Authorization: Bearer <jwt>; cookie mode (useCookies: true) lazily imports the optional @supabase/ssr peer to read Supabase SSR cookies. Construct with supabaseAuth({ url, anonKey, ... }) and pass to a runner via createNextjsRunner({ engine, auth, storage }). A verification error or missing user returns null, yielding a 401. Also exports nightOwlsPlugin, the CLI plugin manifest.

Install

pnpm add @nightowlsdev/auth-supabase

Key exports

supabaseAuth
nightOwlsPlugin
SupabaseAuthOpts (type)

Usage

auth-supabase.ts

import { supabaseAuth } from "@nightowlsdev/auth-supabase";
import { createNextjsRunner } from "@nightowlsdev/runner-nextjs";

const auth = supabaseAuth({ url: process.env.SUPABASE_URL!, anonKey: process.env.SUPABASE_ANON_KEY! });

const runner = createNextjsRunner({ engine, auth, storage });