@ai-matrx/auth 0.1.3 → 0.2.0

package/dist/index.d.ts

@@ -1,57 +1,10 @@
-export { A as AuthClient, S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './session-DhRO4euL.js';
+export { A as AuthClient, S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './session-DdQiStp6.js';
+import { S as SessionStorage } from './storage-Dqnye4KF.js';
+export { C as ChromeStorageAreaLike, a as StorageUnavailableError, b as browserStorage, e as extensionStorage, k as keyValueStorage, m as memoryStorage } from './storage-Dqnye4KF.js';
 import { SupabaseClient } from '@supabase/supabase-js';
 export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
 export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.js';
-
-/**
- * Session storage per platform — where a Supabase session lives between runs.
- *
- * supabase-js takes any `{ getItem, setItem, removeItem }` (sync or async). These are the ones
- * every Matrx client needs, written once:
- *
- *   browser   — `browserStorage("local")` (supabase-js's own default; `"session"` = this tab only)
- *   Next.js   — the cookie-backed clients in `@ai-matrx/auth/next` (the domain-wide auth cookie)
- *   extension — `extensionStorage()` over `chrome.storage.local` (shared by popup, side panel and
- *               service worker; `localStorage` does not exist in a service worker)
- *   desktop   — `keyValueStorage({ get, set, remove })` over the host's store (Tauri store, keychain)
- *   Node      — `fileStorage(path)` in `@ai-matrx/auth/node`, or `memoryStorage()` for a one-shot run
- *
- * None of these is ever silently swapped for another: a storage the platform does not have throws
- * a named error at creation, never a quiet in-memory fallback that signs the person out on reload.
- */
-/** The storage contract supabase-js reads (sync or async methods). */
-interface SessionStorage {
-    getItem(key: string): string | null | Promise<string | null>;
-    setItem(key: string, value: string): void | Promise<void>;
-    removeItem(key: string): void | Promise<void>;
-}
-declare class StorageUnavailableError extends Error {
-    readonly storage: string;
-    constructor(storage: string, reason: string);
-}
-/** In memory only: the session ends with the process (one-shot scripts, tests, server renders). */
-declare function memoryStorage(): SessionStorage & {
-    readonly size: () => number;
-};
-/** The browser's `localStorage` (shared by every tab of the origin) or `sessionStorage` (this tab). */
-declare function browserStorage(kind?: "local" | "session"): SessionStorage;
-/** The structural slice of `chrome.storage.<area>` read here (MV3 promise API). */
-interface ChromeStorageAreaLike {
-    get(keys: string): Promise<Record<string, unknown>>;
-    set(items: Record<string, unknown>): Promise<void>;
-    remove(keys: string): Promise<void>;
-}
-/**
- * A browser extension's `chrome.storage` area (default `local`): one session for the popup, side
- * panel, content scripts' relay and the service worker. Pass `area` to inject one (tests, Firefox).
- */
-declare function extensionStorage(area?: ChromeStorageAreaLike): SessionStorage;
-/** Any async key-value store the host owns (a desktop app's Tauri store or keychain). */
-declare function keyValueStorage(store: {
-    get(key: string): Promise<string | null | undefined>;
-    set(key: string, value: string): Promise<void>;
-    remove(key: string): Promise<void>;
-}): SessionStorage;
+export { A as ApiClaimsUser, C as ClaimsCacheOptions, a as ClaimsCapableClient, b as ClaimsResult, P as PROJECT_SIGNING_KEYS, c as PROJECT_SIGNING_KEY_AUTHORITIES, d as accountFlagsFor, e as confirmUnverifiableSession, f as createClaimsCache, g as getClaimsUser, i as isAuthTransportFailure, h as isSignedOutError, j as isUnverifiableTokenError, k as isUnverifiableTokenRefusal, p as pinnedSigningKeysFor, u as userFromClaims } from './claims-DXdbe3cW.js';
 
 /**
  * `createAuthClient` — the one Supabase client factory OUTSIDE Next.js (Next apps use
@@ -83,4 +36,4 @@ declare class SecretKeyRefusedError extends Error {
 }
 declare function createAuthClient<Database = any>(options: CreateAuthClientOptions): SupabaseClient<Database>;
 
-export { type ChromeStorageAreaLike, type CreateAuthClientOptions, SecretKeyRefusedError, type SessionStorage, StorageUnavailableError, browserStorage, createAuthClient, extensionStorage, keyValueStorage, memoryStorage };
+export { type CreateAuthClientOptions, SecretKeyRefusedError, SessionStorage, createAuthClient };

package/dist/index.js

@@ -19,10 +19,43 @@ async function getSession(client) {
   const { data, error } = await client.auth.getSession();
   return check("getSession", data, error).session;
 }
+var personCache = /* @__PURE__ */ new WeakMap();
+function personEntry(client) {
+  let entry = personCache.get(client);
+  if (!entry) {
+    const fresh = { read: null, epoch: 0 };
+    entry = fresh;
+    personCache.set(client, fresh);
+    const subscribe = client.auth?.onAuthStateChange;
+    if (typeof subscribe === "function") {
+      subscribe.call(client.auth, async (event) => {
+        if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "USER_UPDATED") invalidatePerson(client);
+      });
+    }
+  }
+  return entry;
+}
+function invalidatePerson(client) {
+  const entry = personCache.get(client);
+  if (!entry) return;
+  entry.epoch += 1;
+  entry.read = null;
+}
 async function getPerson(client) {
-  const { data, error } = await client.auth.getUser();
-  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
-  return check("getPerson", data, error).user;
+  const entry = personEntry(client);
+  if (entry.read) return entry.read;
+  const epoch = entry.epoch;
+  const read = (async () => {
+    const { data, error } = await client.auth.getUser();
+    if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+    return check("getPerson", data, error).user;
+  })();
+  entry.read = read;
+  const settle = (keep) => {
+    if (entry.epoch === epoch && entry.read === read && !keep) entry.read = null;
+  };
+  read.then((user) => settle(user !== null), () => settle(false));
+  return read;
 }
 function onSessionChange(client, cb) {
   const { data } = client.auth.onAuthStateChange(cb);
@@ -30,6 +63,7 @@ function onSessionChange(client, cb) {
 }
 async function signInWithPassword(client, credentials) {
   const { data, error } = await client.auth.signInWithPassword(credentials);
+  invalidatePerson(client);
   const ok = check("signInWithPassword", data, error);
   return { session: ok.session, person: ok.user };
 }
@@ -41,10 +75,12 @@ async function signInWithOAuth(client, options) {
 }
 async function signOut(client, scope = "global") {
   const { error } = await client.auth.signOut({ scope });
+  invalidatePerson(client);
   check("signOut", null, error);
 }
 async function updatePerson(client, attributes) {
   const { data, error } = await client.auth.updateUser(attributes);
+  invalidatePerson(client);
   return check("updatePerson", data, error).user;
 }
 function sessionCredentials(client) {
@@ -144,23 +180,161 @@ function createAuthClient(options) {
   if (options.detectSessionInUrl !== void 0) auth["detectSessionInUrl"] = options.detectSessionInUrl;
   return createClient(options.url, options.key, { auth });
 }
+
+// src/claims.ts
+import {
+  AuthError,
+  AuthSessionMissingError
+} from "@supabase/supabase-js";
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+function isUnverifiableTokenRefusal(result) {
+  if (result.status !== 401) return false;
+  if (result.error?.code !== "PGRST301") return false;
+  return !/expired/i.test(result.error?.message ?? "");
+}
+function isUnverifiableTokenError(error) {
+  if (!error) return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return false;
+  if (name === "AuthSessionMissingError" || error.code === "session_not_found") return false;
+  const status = error.status;
+  if (status === 0 || status === 408 || status === 503 || status === 504) return false;
+  if (/expired/i.test(error.message ?? "")) return false;
+  return error.code === "bad_jwt" || name === "AuthInvalidJwtError";
+}
+async function confirmUnverifiableSession(auth, supabaseUrl) {
+  try {
+    const { error } = await auth.getClaims(void 0, { jwks: { keys: pinnedSigningKeysFor(supabaseUrl) } });
+    return isUnverifiableTokenError(error);
+  } catch {
+    return false;
+  }
+}
+function createClaimsCache(client, options) {
+  const ttl = options.ttlMs ?? 2e3;
+  let cached = null;
+  let inflight = null;
+  let listening = false;
+  return () => {
+    if (!listening) {
+      listening = true;
+      client.auth.onAuthStateChange((event) => {
+        if (event === "SIGNED_OUT" || event === "SIGNED_IN" || event === "TOKEN_REFRESHED" || event === "USER_UPDATED") {
+          cached = null;
+        }
+      });
+    }
+    if (cached && cached.expiresAt > Date.now()) return Promise.resolve(cached.value);
+    if (inflight) return inflight;
+    inflight = getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } }).then((result) => {
+      if (isUnverifiableTokenError(result.error)) options.onUnverifiable?.();
+      cached = { value: result, expiresAt: Date.now() + ttl };
+      return result;
+    }).finally(() => {
+      inflight = null;
+    });
+    return inflight;
+  };
+}
 export {
+  PROJECT_SIGNING_KEYS,
+  PROJECT_SIGNING_KEY_AUTHORITIES,
   SecretKeyRefusedError,
   SignInError,
   StorageUnavailableError,
+  accountFlagsFor,
   browserStorage,
+  confirmUnverifiableSession,
   createAuthClient,
+  createClaimsCache,
   extensionStorage,
+  getClaimsUser,
   getPerson,
   getSession,
+  invalidatePerson,
+  isAuthTransportFailure,
+  isSignedOutError,
+  isUnverifiableTokenError,
+  isUnverifiableTokenRefusal,
   keyValueStorage,
   memoryStorage,
   onSessionChange,
+  pinnedSigningKeysFor,
   refreshSession,
   sessionCredentials,
   signInWithOAuth,
   signInWithPassword,
   signOut,
   updatePerson,
-  userCredentials
+  userCredentials,
+  userFromClaims
 };