Anonymous Auth with Upgrade Path

HOW IT IS WIRED

Real code from the GAS template

The code below is drawn from services/auth.ts in the gas-template repository. This is the code your generated app gets, not pseudocode, not a description of intent.

// services/auth.ts (anonymous -> permanent upgrade, condensed)
export async function upgradeAnonymousAccount(c: UpgradeCredentials): Promise<UpgradeResult> {
  const { data, error } = await supabase.auth.getUser();
  if (error || !data.user) throw new ServiceError('not_authenticated', 401, 'No user');
  if (!data.user.is_anonymous) throw new ServiceError('not_anonymous', 400, 'Not anonymous');
  const anonUserId = data.user.id;

  return retryWithBackoff(async () => {
    // Promote the SAME user: email/password via updateUser (shown), OAuth via linkIdentity.
    // The UUID is preserved; an existing email returns { migrated: 0, conflictWith }.
    const { data: updated } = await supabase.auth.updateUser({
      email: c.email,
      password: c.password,
    });
    const permanentUserId = updated.user!.id;

    // Re-point rows anon -> permanent across the allowlisted tables, server-side.
    const tables = gasConfig.features.anonymousAuth?.tables ?? [];
    const { table_rowcounts } = await callEdge<MigrateResponse>('migrate_anonymous_data', {
      anonUserId,
      permanentUserId,
      tables,
    });
    const migrated = Object.values(table_rowcounts ?? {}).reduce((s, n) => s + n, 0);
    return { migrated, perTableRowcounts: table_rowcounts };
  }, { shouldRetry: isTransientNon4xxError });
}

Source: goodspeed-apps/gas-template → services/auth.ts