SIWX 与 Supabase 深度集成：基于 RLS 行级安全的去中心化鉴权

Wallet ──signs CAIP-122──▶ POST /api/siwx/verify ──▶ session cookieBrowser ──cookie──▶ GET /api/siwx/token ──▶ JWT (ES256, role: authenticated, 10 minutes)supabase-js ──Authorization: Bearer <JWT>──▶ SupabaseSupabase ──keys of /api/siwx/jwks──▶ checks the signature ──▶ Postgres role `authenticated`RLS policies ──auth.jwt() ->> 'sub'──▶ rows of this wallet only

pnpm add @supabase/supabase-js

curl -X POST "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth/third-party-auth" \  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \  -H "Content-Type: application/json" \  -d '{ "jwks_url": "https://<your app>/api/siwx/jwks" }'

curl "https://api.supabase.com/v1/projects/$PROJECT_REF/config/auth/third-party-auth" \  -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN"

create table public.notes (  id bigint generated always as identity primary key,  wallet text not null default (auth.jwt() ->> 'sub'),  body text not null check (char_length(body) <= 500),  created_at timestamptz not null default now()); create index notes_wallet_idx on public.notes (wallet); alter table public.notes enable row level security; -- New Supabase tables are not exposed to the Data API until you grant them.grant select, insert, update, delete on public.notes to authenticated; create policy "Wallets read their notes" on public.notes  for select to authenticated  using (wallet = (select auth.jwt() ->> 'sub')); create policy "Wallets add their notes" on public.notes  for insert to authenticated  with check (wallet = (select auth.jwt() ->> 'sub')); create policy "Wallets edit their notes" on public.notes  for update to authenticated  using (wallet = (select auth.jwt() ->> 'sub'))  with check (wallet = (select auth.jwt() ->> 'sub')); create policy "Wallets delete their notes" on public.notes  for delete to authenticated  using (wallet = (select auth.jwt() ->> 'sub'));

import { createClient } from '@supabase/supabase-js'; type SiwxToken = { token: string; expiresAt: number }; // Realtime asks for the token on every heartbeat (25 seconds), so refresh a minute before it expires.const REFRESH_BEFORE_MS = 60_000; let current: SiwxToken | null = null;let pending: Promise<SiwxToken | null> | null = null; async function fetchSiwxToken(): Promise<SiwxToken | null> {  const res = await fetch('/api/siwx/token', { cache: 'no-store' });  return res.ok ? ((await res.json()) as SiwxToken) : null;} /** The SIWX JWT of the signed-in wallet, or `null` without a sign-in (Supabase then uses the `anon` role). */export async function getSiwxAccessToken(): Promise<string | null> {  if (current && current.expiresAt - Date.now() > REFRESH_BEFORE_MS) return current.token;  pending ??= fetchSiwxToken().finally(() => {    pending = null;  });  current = await pending;  return current?.token ?? null;} /** Drops the cached token: call it when the wallet signs out or another wallet signs in. */export function forgetSiwxAccessToken(): void {  current = null;} export const supabase = createClient(  process.env.NEXT_PUBLIC_SUPABASE_URL!,  process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,  { accessToken: getSiwxAccessToken },);

'use client'; import { useSiwxSession } from '@tuwaio/sdk/siwx';import { type FormEvent, useCallback, useEffect, useState } from 'react'; import { forgetSiwxAccessToken, supabase } from '@/lib/supabase'; type Note = { id: number; body: string; created_at: string }; export function WalletNotes() {  const { isAuthenticated, session } = useSiwxSession();  const [notes, setNotes] = useState<Note[]>([]);   const loadNotes = useCallback(async () => {    const { data, error } = await supabase      .from('notes')      .select('id, body, created_at')      .order('created_at', { ascending: false });    if (error) throw error;    setNotes(data);  }, []);   // A sign-out or another wallet needs a new token and its own rows.  useEffect(() => {    forgetSiwxAccessToken();    if (isAuthenticated) void loadNotes();  }, [isAuthenticated, session?.address, loadNotes]);   async function addNote(event: FormEvent<HTMLFormElement>) {    event.preventDefault();    const form = event.currentTarget;    const body = String(new FormData(form).get('body') ?? '').trim();    if (!body) return;     // `wallet` is filled in by the database from the token.    const { error } = await supabase.from('notes').insert({ body });    if (error) throw error;    form.reset();    await loadNotes();  }   if (!isAuthenticated) return <p>Sign in with your wallet to see your notes.</p>;   return (    <section>      <form onSubmit={addNote}>        <input name="body" placeholder="A note only this wallet can read" maxLength={500} />        <button type="submit">Save</button>      </form>      <ul>        {notes.map((note) => (          <li key={note.id}>{note.body}</li>        ))}      </ul>    </section>  );}

'use server'; import { createClient } from '@supabase/supabase-js';import { getSiwxServerSession, importSiwxJwtKey, signSiwxJwt } from '@tuwaio/sdk/siwx/server';import { cookies } from 'next/headers'; import { sessionStore } from '@/lib/authStores'; const appUrl = new URL(process.env.NEXT_PUBLIC_APP_URL ?? 'http://localhost:3000');const signingKey = importSiwxJwtKey({ privateKey: process.env.SIWX_JWT_PRIVATE_KEY ?? '' }); /** A Supabase client that acts as the wallet signed in on this request, under the same RLS policies. */async function supabaseForSession() {  const session = await getSiwxServerSession({ cookieSource: await cookies(), sessionStore });  if (!session) throw new Error('Unauthorized');   const { token } = await signSiwxJwt({    session,    key: await signingKey,    issuer: appUrl.origin,    audience: 'authenticated',    claims: { role: 'authenticated' },  });  return createClient(process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!, {    accessToken: async () => token,  });} export async function countMyNotes(): Promise<number> {  const supabase = await supabaseForSession();  const { count, error } = await supabase.from('notes').select('*', { count: 'exact', head: true });  if (error) throw error;  return count ?? 0;}