Moheeb ZaraandClaude Opus 4.8
b1edb5c460
Per-file type-only fixes surfaced after the Supabase client was correctly typed. All fixes preserve runtime behavior; no any/ts-ignore/ts-expect-error. - lib/supabase/client.ts: annotate the browser client as SupabaseClient<Database> (same ssr/js drift as server.ts; fixes it centrally for all callers). - Supabase embedded-select joins whose FK metadata is missing from the generated types are bridged with `as unknown as <target>` + a TODO to remove after regenerating types/database.ts. - setState optimistic-update variance and raw <select> enum values cast to the precise element/union type; .insert payload fields (Json, enums) given the precise column type via satisfies/field casts. - Added narrowing guards where a value was legitimately nullable (comms channel, public form page) without changing the intended path. The 14 remaining errors are confined to the four files fixed in Phase B (real bugs + the tautological actions.test rewrite). 639 tests still green. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
94 lines
2.8 KiB
TypeScript
94 lines
2.8 KiB
TypeScript
// Server-only helpers (NOT a 'use server' module — these take a Supabase
|
|
// admin client and are imported by server actions + the webhook route).
|
|
// Per-space Stripe config lives in integrations.config; the secret key and
|
|
// webhook signing secret live in the AES-256-GCM secrets vault, referenced
|
|
// by id from config.
|
|
import type { createAdminClient } from '@/lib/supabase/admin'
|
|
import type { TablesInsert } from '@/types/database'
|
|
import { encryptSecret, decryptSecret, encryptionAvailable } from '@/lib/secrets/crypto'
|
|
|
|
type Admin = ReturnType<typeof createAdminClient>
|
|
|
|
export type StripeConfig = {
|
|
mode?: 'test' | 'live'
|
|
publishable_key?: string
|
|
secret_key_ref?: string
|
|
webhook_secret_ref?: string
|
|
grace_days?: number
|
|
prices?: Record<string, string>
|
|
}
|
|
|
|
// Store a Stripe credential in the encrypted secrets vault (same layout the
|
|
// door subsystem uses). Returns the secret row id to keep in config.
|
|
export async function storeStripeSecret(
|
|
admin: Admin,
|
|
spaceId: string,
|
|
title: string,
|
|
value: string,
|
|
createdBy: string | null,
|
|
): Promise<string | null> {
|
|
const row: Record<string, unknown> = {
|
|
space_id: spaceId,
|
|
title,
|
|
label: title,
|
|
category: 'integration',
|
|
created_by: createdBy,
|
|
}
|
|
if (encryptionAvailable()) {
|
|
const { ciphertext, version } = encryptSecret(value)
|
|
row.encrypted_value = ciphertext
|
|
row.encryption_version = version
|
|
row.value = ''
|
|
} else {
|
|
row.value = value
|
|
row.encryption_version = 0
|
|
}
|
|
const { data, error } = await admin
|
|
.from('secrets')
|
|
.insert(row as TablesInsert<'secrets'>)
|
|
.select('id')
|
|
.single()
|
|
if (error || !data) return null
|
|
return data.id as string
|
|
}
|
|
|
|
// Read + decrypt a stored Stripe credential. Server-only; never returned to
|
|
// a client.
|
|
export async function readStripeSecret(
|
|
admin: Admin,
|
|
spaceId: string,
|
|
secretRef: string | null | undefined,
|
|
): Promise<string | null> {
|
|
if (!secretRef) return null
|
|
const { data } = await admin
|
|
.from('secrets')
|
|
.select('encryption_version, encrypted_value, value')
|
|
.eq('id', secretRef)
|
|
.eq('space_id', spaceId)
|
|
.maybeSingle()
|
|
if (!data) return null
|
|
if (data.encryption_version === 1 && data.encrypted_value) {
|
|
const raw = data.encrypted_value as unknown
|
|
const buf =
|
|
typeof raw === 'string'
|
|
? Buffer.from((raw as string).replace(/^\\x/, ''), 'hex')
|
|
: Buffer.from(raw as Uint8Array)
|
|
try {
|
|
return decryptSecret(buf, 1)
|
|
} catch {
|
|
return null
|
|
}
|
|
}
|
|
return (data.value as string | null) ?? null
|
|
}
|
|
|
|
export async function getStripeConfig(admin: Admin, spaceId: string): Promise<StripeConfig | null> {
|
|
const { data } = await admin
|
|
.from('integrations')
|
|
.select('config')
|
|
.eq('space_id', spaceId)
|
|
.eq('platform', 'stripe')
|
|
.maybeSingle()
|
|
return (data?.config as StripeConfig | null) ?? null
|
|
}
|