feat(middleware): add postgres and claims middleware entrypoints

Graduate withPostgres and withClaims out of plugin-examples into
@supabase/server/middleware/*, so the PRFAQ's built-in middleware ship
from the package instead of example-local code (SDK-1163 item 5).

- withPostgres reads claims from ctx.jwtClaims (already populated by
  withSupabase), so `middleware: [withPostgres()]` works with no separate
  withClaims. Keeps the RLS role-clamp and tx-local request.jwt.claims
  injection. pg is an optional peer dep (Node/Deno only, not Workers).
- withClaims ships for the standalone agnostic pipeline() case
  (demo-only: no signature verification).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mandarini

jsr.json

@@ -8,17 +8,12 @@
     "./adapters/hono": "./src/adapters/hono/index.ts",
     "./adapters/h3": "./src/adapters/h3/index.ts",
     "./adapters/elysia": "./src/adapters/elysia/index.ts",
-    "./adapters/nestjs": "./src/adapters/nestjs/index.ts"
+    "./adapters/nestjs": "./src/adapters/nestjs/index.ts",
+    "./middleware/postgres": "./src/middleware/postgres/index.ts",
+    "./middleware/claims": "./src/middleware/claims/index.ts"
   },
   "publish": {
-    "include": [
-      "src/**/*.ts",
-      "README.md",
-      "LICENSE"
-    ],
-    "exclude": [
-      "src/**/*.test.ts",
-      "src/**/*.spec.ts"
-    ]
+    "include": ["src/**/*.ts", "README.md", "LICENSE"],
+    "exclude": ["src/**/*.test.ts", "src/**/*.spec.ts"]
   }
 }

package.json

@@ -89,6 +89,26 @@
         "default": "./dist/adapters/nestjs/index.cjs"
       }
     },
+    "./middleware/postgres": {
+      "import": {
+        "types": "./dist/middleware/postgres/index.d.mts",
+        "default": "./dist/middleware/postgres/index.mjs"
+      },
+      "require": {
+        "types": "./dist/middleware/postgres/index.d.cts",
+        "default": "./dist/middleware/postgres/index.cjs"
+      }
+    },
+    "./middleware/claims": {
+      "import": {
+        "types": "./dist/middleware/claims/index.d.mts",
+        "default": "./dist/middleware/claims/index.mjs"
+      },
+      "require": {
+        "types": "./dist/middleware/claims/index.d.cts",
+        "default": "./dist/middleware/claims/index.cjs"
+      }
+    },
     "./package.json": "./package.json"
   },
   "main": "./dist/index.cjs",
@@ -125,7 +145,8 @@
     "@supabase/supabase-js": "^2.0.0",
     "h3": "^2.0.0",
     "hono": "^4.0.0",
-    "elysia": "^1.4.0"
+    "elysia": "^1.4.0",
+    "pg": "^8.0.0"
   },
   "peerDependenciesMeta": {
     "@nestjs/common": {
@@ -139,6 +160,9 @@
     },
     "elysia": {
       "optional": true
+    },
+    "pg": {
+      "optional": true
     }
   },
   "devDependencies": {
@@ -151,6 +175,7 @@
     "@nestjs/testing": "^11.1.19",
     "@supabase/supabase-js": "^2.105.4",
     "@swc/core": "^1.15.33",
+    "@types/pg": "^8.11.0",
     "@types/supertest": "^7.2.0",
     "eslint": "^10.0.2",
     "elysia": "^1.4.0",

pnpm-lock.yaml

@@ -0,0 +1,67 @@
+import { describe, expect, it } from 'vitest'
+
+import { withClaims } from './index.js'
+
+function base64url(obj: unknown): string {
+  return Buffer.from(JSON.stringify(obj))
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '')
+}
+
+function tokenFor(claims: Record<string, unknown>): string {
+  return `header.${base64url(claims)}.sig`
+}
+
+const runtime = { name: 'node' as const, getEnv: () => undefined }
+
+describe('withClaims', () => {
+  it('decodes the Bearer token payload into ctx.jwtClaims', async () => {
+    let seen: unknown
+    const handler = withClaims(async (_req, ctx) => {
+      seen = ctx.jwtClaims
+      return Response.json({ ok: true })
+    })
+
+    await handler(
+      new Request('http://localhost', {
+        headers: {
+          Authorization: `Bearer ${tokenFor({ sub: 'u1', role: 'authenticated' })}`,
+        },
+      }),
+      { _runtime: runtime },
+    )
+
+    expect(seen).toEqual({ sub: 'u1', role: 'authenticated' })
+  })
+
+  it('contributes null when no Authorization header is present', async () => {
+    let seen: unknown = 'unset'
+    const handler = withClaims(async (_req, ctx) => {
+      seen = ctx.jwtClaims
+      return Response.json({ ok: true })
+    })
+
+    await handler(new Request('http://localhost'), { _runtime: runtime })
+
+    expect(seen).toBeNull()
+  })
+
+  it('contributes null for a malformed token', async () => {
+    let seen: unknown = 'unset'
+    const handler = withClaims(async (_req, ctx) => {
+      seen = ctx.jwtClaims
+      return Response.json({ ok: true })
+    })
+
+    await handler(
+      new Request('http://localhost', {
+        headers: { Authorization: 'Bearer not-a-jwt' },
+      }),
+      { _runtime: runtime },
+    )
+
+    expect(seen).toBeNull()
+  })
+})