{"version":3,"file":"beta-authorize-user-through-oauth.mjs","names":[],"sources":["../../src/actions/beta-authorize-user-through-oauth.ts"],"sourcesContent":["import type { AppAction } from \"@keystrokehq/keystroke/app\";\nimport { z } from \"zod\";\n\nimport { action } from \"../action\";\nimport { supabase } from \"../app\";\n\nexport const SupabaseBetaAuthorizeUserThroughOauthInput = z.object({\n  scope: z.string().describe(\"Space-separated list of OAuth scopes for requested permissions on user resources (e.g., 'email profile', 'storage.objects.read').\").optional(),\n  state: z.string().describe(\"Opaque value to maintain state between request and callback; returned unmodified to aid CSRF prevention.\").optional(),\n  client_id: z.string().describe(\"Unique identifier for the OAuth client application, registered with Supabase. Must be a valid client_id from a registered OAuth application.\"),\n  redirect_uri: z.string().describe(\"URI where Supabase redirects the user after authorization; must exactly match a registered URI for the client application.\"),\n  response_mode: z.string().describe(\"Specifies how authorization response parameters are returned (e.g., 'query', 'fragment', 'form_post'). Default is determined by `response_type` if not specified.\").optional(),\n  response_type: z.enum([\"code\", \"id_token token\", \"token\"]).describe(\"Specifies the authorization flow type: 'code' for Authorization Code Grant; 'token' for Implicit Grant (access token); 'id_token token' for OIDC hybrid flows (ID and access tokens).\"),\n  code_challenge: z.string().describe(\"PKCE code challenge to secure authorization code grants, typically a BASE64URL-encoded SHA256 hash of `code_verifier`.\").optional(),\n  code_challenge_method: z.enum([\"S256\", \"plain\", \"sha256\"]).describe(\"Method to derive `code_challenge` for PKCE: 'S256'/'sha256' for SHA256 hashing; 'plain' sends verifier as is (not for production if hashing possible). Required if `code_challenge` is provided.\").optional(),\n}).describe(\"Defines parameters for initiating the Supabase OAuth 2.0 authorization flow.\\n\\nIMPORTANT: This action requires a valid OAuth client_id that has been pre-registered\\nwith Supabase through the Supabase dashboard. Without a registered OAuth application,\\nthis endpoint will return a 400 Bad Request error.\");\nexport const SupabaseBetaAuthorizeUserThroughOauthOutput = z.object({\n  error: z.string().describe(\"Error message if the request failed (e.g., invalid client_id).\").nullable().optional(),\n  status_code: z.number().int().describe(\"HTTP status code. 303 on success (redirect), 400 for invalid parameters.\").nullable(),\n  redirect_url: z.string().describe(\"The OAuth authorization URL that the user should be redirected to (from Location header on 303 response).\").nullable().optional(),\n  error_description: z.string().describe(\"Detailed description of the error.\").nullable().optional(),\n}).passthrough().describe(\"Response from Supabase OAuth authorize endpoint.\\n\\nOn success with a valid client_id, this endpoint performs an HTTP 303 redirect\\nto the OAuth login page and does not return a response body.\\n\\nOn failure (invalid client_id, invalid redirect_uri, etc.), it returns an error response.\");\n\nexport const supabaseBetaAuthorizeUserThroughOauth: AppAction<\n  typeof SupabaseBetaAuthorizeUserThroughOauthInput,\n  typeof SupabaseBetaAuthorizeUserThroughOauthOutput,\n  typeof supabase.credential\n> = action(\"SUPABASE_BETA_AUTHORIZE_USER_THROUGH_OAUTH\", {\n  slug: \"supabase-beta-authorize-user-through-oauth\",\n  name: \"Authorize user through OAuth\",\n  description: \"Generates a Supabase OAuth 2.0 authorization URL for user redirection. IMPORTANT: This action requires a pre-registered OAuth client_id and a redirect_uri that matches one of the pre-registered URIs for that OAuth application. Without a valid registered OAuth application, this endpoint will return a 400 error. To use this action: 1. Register an OAuth application in the Supabase dashboard 2. Use the client_id from the registered application 3. Ensure redirect_uri matches one of the registered callback URLs\",\n  input: SupabaseBetaAuthorizeUserThroughOauthInput,\n  output: SupabaseBetaAuthorizeUserThroughOauthOutput,\n});\n"],"mappings":";;;AAuBA,MAAa,wCAIT,OAAO,8CAA8C;CACvD,MAAM;CACN,MAAM;CACN,aAAa;CACb,OAzBwD,EAAE,OAAO;EACjE,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,mIAAmI,CAAC,CAAC,SAAS;EACzK,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,0GAA0G,CAAC,CAAC,SAAS;EAChJ,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,8IAA8I;EAC7K,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS,4HAA4H;EAC9J,eAAe,EAAE,OAAO,CAAC,CAAC,SAAS,mKAAmK,CAAC,CAAC,SAAS;EACjN,eAAe,EAAE,KAAK;GAAC;GAAQ;GAAkB;EAAO,CAAC,CAAC,CAAC,SAAS,uLAAuL;EAC3P,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS,wHAAwH,CAAC,CAAC,SAAS;EACvK,uBAAuB,EAAE,KAAK;GAAC;GAAQ;GAAS;EAAQ,CAAC,CAAC,CAAC,SAAS,kMAAkM,CAAC,CAAC,SAAS;CACnR,CAAC,CAAC,CAAC,SAAS,iTAgBH;CACP,QAhByD,EAAE,OAAO;EAClE,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,gEAAgE,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACjH,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,0EAA0E,CAAC,CAAC,SAAS;EAC5H,cAAc,EAAE,OAAO,CAAC,CAAC,SAAS,2GAA2G,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;EACnK,mBAAmB,EAAE,OAAO,CAAC,CAAC,SAAS,oCAAoC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACnG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,+RAWhB;AACV,CAAC"}