@bufinance/web3-signin

Headless, cross-app Web3 wallet sign-in for BUFI. One source of truth, consumed by both desk-v1 and defi-web-app so the login surface stays DRY.

It wraps three things:

1. EIP-6963 wallet discovery — lists the browser wallets the user actually has (MetaMask, Coinbase Wallet, Brave, …). Each wallet ships its own name + icon; nothing is hardcoded.
2. Supabase Web3 auth — signInWithWeb3 (EIP-4361 "Sign in with Ethereum"). Supabase builds the SIWE message, the wallet signs, GoTrue verifies server-side and mints the session. No custom SIWE backend.
3. Turnstile CAPTCHA (wallet logins only) — renders the Cloudflare Turnstile widget and hands the token to signInWithWeb3 as captchaToken. No siteverify Worker — Supabase verifies the token with the secret set in its dashboard.

Install (public npm)

bun add @bufinance/web3-signin

The package ships TypeScript source; consuming Next.js apps add it to transpilePackages.

Headless core

import { subscribeWallets, getWallets, signInWithWallet } from "@bufinance/web3-signin";

React

import { useWeb3SignIn, Turnstile } from "@bufinance/web3-signin/react";

function WalletButtons({ supabase }) {
  const [token, setToken] = useState<string>();
  const { wallets, signIn, status, error, pendingRdns } = useWeb3SignIn({
    supabase,
    statement: "I accept the BUFI Terms of Service at https://bu.finance/terms",
    onSignedIn: () => location.assign("/"),
  });

  return (
    <>
      <Turnstile sitekey={process.env.NEXT_PUBLIC_TURNSTILE_SITEKEY!} onToken={setToken} />
      {wallets.map((w) => (
        <button key={w.info.rdns} disabled={!token || pendingRdns === w.info.rdns}
                onClick={() => signIn(w, token)}>
          <img src={w.info.icon} width={20} height={20} alt="" /> {w.info.name}
        </button>
      ))}
      {error && <p>{error}</p>}
    </>
  );
}

One-time project setup

• Supabase dashboard → Authentication → Providers → Web3 Wallet → enable Ethereum.
• Supabase dashboard → Auth → Bot & Abuse Protection → enable CAPTCHA → Turnstile → paste the Secret key.
• Cloudflare → create a Turnstile widget for bu.finance (+ localhost); put the Sitekey in NEXT_PUBLIC_TURNSTILE_SITEKEY and the Secret in Supabase (above).
• Both apps must point at the same Supabase project (cmrpdkvogpxyneidmtnu in prod).

Releasing

This repo is the home. Bump version, commit, tag, and publish to GitHub Packages (npm publish). Both apps pick it up via their lockfile.