@frank/auth (0.2.0)

Published 2026-09-26 22:30:50 +10:00 by steve

Setup this registry in your project .npmrc file:

@frank:registry=

To install the package using npm, run the following command:

npm install @frank/auth@0.2.0

or add it to the package.json file:

"@frank/auth": "0.2.0"

For more information on the npm registry, see the documentation.

@frank/auth

Workspace auth for Frank products: one request context loader, API and page guards that fail closed, Supabase client factories, the provider token vault, audit writes and workspace status helpers. Ported from Blockwise (src/lib/auth, supabase, workspace, token-crypto); behaviour and safety are unchanged. No side effects on import.

Entry points

Import from the entry that matches where the code runs, so a bundle only loads what it uses:

Entry	What	Where it may be imported
`@frank/auth`	config, access, context loader, credentials, service client, audit, token vault, workspace helpers	any server code, plain Node included
`@frank/auth/server`	`createSupabaseServerClient`, `createRequireApiWorkspace`, `featureDisabledResponse`, `refreshSupabaseSession`	Next server code (route handlers, server components, the proxy)
`@frank/auth/pages`	`createRequirePageSurfaceAccess`	Next pages and layouts only; it imports `next/navigation`, which Next cannot bundle into a route handler
`@frank/auth/browser`	`createSupabaseBrowserClient`, `configFromEnv`	client components
`@frank/auth/access`	surface rules only	anywhere, client components included

Public API

configFromEnv(env?): the only env reader; type AuthConfig
Access and context: canAccessSurface, canManageProviderConnections, BLOCKWISE_SURFACE_RULES, loadAuthContext, requireWorkspaceAccess, requireWorkspaceAccessFromContext, createContextLoader, resolveRequestedWorkspaceAccess, hasOperatorAccessFromRows, BLOCKWISE_AUTH_TABLES
Guards: createRequireApiWorkspace, featureDisabledResponse, createRequirePageSurfaceAccess
Supabase: client factories, refreshSupabaseSession, accessTokenExpirySeconds, credential helpers, recordAuditLog
Token vault: encryptToken, decryptToken, bytea converters, safeEqual (byte-compatible with Blockwise stored tokens)
Workspace: createWorkspacePostcodeSchema, seedMissingWorkspacePostcode, advanceOnboardingStatus

Config needed (read only by configFromEnv)

NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY, SUPABASE_SECRET_KEY or SUPABASE_SERVICE_ROLE_KEY, TOKEN_ENCRYPTION_KEY; optional OPERATOR_MFA_REQUIRED, FRANK_SUPABASE_SERVER_URL (or the legacy BLOCKWISE_SUPABASE_SERVER_URL).

Usage

import { cache } from "react";
import { configFromEnv, createSupabaseServerClient, createContextLoader,
  BLOCKWISE_AUTH_TABLES, requireWorkspaceAccess } from "@frank/auth";
const config = configFromEnv();
export const getAuthContext = createContextLoader(cache,
  () => createSupabaseServerClient(config), BLOCKWISE_AUTH_TABLES);
const access = await requireWorkspaceAccess(await createSupabaseServerClient(config),
  { surface: "monitor" }, BLOCKWISE_AUTH_TABLES); // { ok } | { status, error }

Dependencies

ID	Version
@supabase/ssr	^0.6.1
@supabase/supabase-js	^2.49.8
ws	^8.21.0
zod	^3.25.76

Development dependencies

ID	Version
@types/ws	^8.18.1
next	16.3.3
react	^19.2.6

Peer dependencies

ID	Version
next	^16.0.0
react	^19.0.0

Details

npm

2026-09-26 22:30:50 +10:00

34 KiB

Assets (1)

auth-0.2.0.tgz 34 KiB

Versions (3) View all

0.2.1

2026-10-08

0.2.0

2026-09-26

0.1.0