@aurabase/aurabase-js 0.6.2 → 0.7.0

package/README.md

@@ -25,8 +25,10 @@ bun add @aurabase/aurabase-js
 Ce package ne réimplémente aucune logique de service : il compose `AuthService`, `DatabaseService`, `StorageService`, `RealtimeService`, `FunctionsService`, `AiService` et `NotificationsService` (chacun dans son propre package `@aurabase/*`) derrière un seul client.
 
 - `createClient(projectUrl, apiKey, options?)` — client applicatif standard. **L'URL est le projet** : chaque projet est servi sur son propre sous-domaine (`https://<slug>.aurabase.cloud`) et la passerelle injecte elle-même le `project_id` dans le chemin. Aucun identifiant de projet dans le code client.
-- `createAdminClient(projectUrl, serviceRoleKey, options?)` — client serveur avec `authAdmin` (clé `service_role`, jamais côté navigateur).
-- `@aurabase/aurabase-js/ssr` — `createServerClient`/`createBrowserClient` pour Next.js et frameworks SSR (cookies, session partagée serveur/navigateur).
+- `createAdminClient(projectUrl, serviceRoleKey, options?)` — client serveur avec `authAdmin` (clé `service_role`, jamais côté navigateur : gestion des utilisateurs, impersonation RFC 8693, import d'utilisateurs bcrypt/Argon2id).
+- `@aurabase/aurabase-js/ssr` — `createServerClient`/`createBrowserClient` pour Next.js et frameworks SSR (cookies légers, session partagée serveur/navigateur).
+- `@aurabase/aurabase-js/react` — Hooks React (`useAuraSession`, `useAuraUser`) et contexte pour applications React / Next.js Client Components.
+- `@aurabase/aurabase-js/nextjs` — Helpers pour Next.js App Router (Middleware de rafraîchissement de session, Server Actions).
 
 ## Quick Start
 

package/dist/{AuraClient-BWdcX_k0.d.cts → AuraClient-B1OOZCSX.d.cts}

@@ -65,6 +65,7 @@ declare class AuraClient<Database = any, Schema extends GenericSchema = Database
     private readonly _persistSession;
     private readonly _autoRefresh;
     private readonly _detectSessionInUrl;
+    private readonly _flowType;
     /**
      * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
      * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).

package/dist/{AuraClient-BWdcX_k0.d.ts → AuraClient-B1OOZCSX.d.ts}

@@ -65,6 +65,7 @@ declare class AuraClient<Database = any, Schema extends GenericSchema = Database
     private readonly _persistSession;
     private readonly _autoRefresh;
     private readonly _detectSessionInUrl;
+    private readonly _flowType;
     /**
      * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
      * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).

package/dist/index.cjs

@@ -56,6 +56,7 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
@@ -87,17 +88,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -122,6 +124,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -146,7 +149,8 @@ var AuraClient = class {
       this._auth = new auth.AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -167,7 +171,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new auth.AuthAdminService(this);
@@ -270,7 +274,7 @@ function createClient(baseUrl, apiKey, options) {
 function createAdminClient(baseUrl, serviceRoleKey, options) {
   if (isBrowserContext()) {
     throw new Error(
-      "[aurabase] createAdminClient() ne doit jamais \xEAtre appel\xE9 c\xF4t\xE9 navigateur : la cl\xE9 service_role serait expos\xE9e dans le bundle. \xC0 utiliser uniquement c\xF4t\xE9 serveur."
+      "[aurabase] createAdminClient() must never be called in a browser: the service_role key would be exposed in the bundle. Use it on the server only."
     );
   }
   return new AuraClient(baseUrl, serviceRoleKey, options);
@@ -348,6 +352,10 @@ Object.defineProperty(exports, "RealtimeService", {
   enumerable: true,
   get: function () { return realtime.RealtimeService; }
 });
+Object.defineProperty(exports, "StorageBucketClient", {
+  enumerable: true,
+  get: function () { return storage.StorageBucketClient; }
+});
 Object.defineProperty(exports, "StorageService", {
   enumerable: true,
   get: function () { return storage.StorageService; }

package/dist/index.d.cts

@@ -7,7 +7,7 @@ export { FunctionsHttpError, FunctionsRelayError, FunctionsResponseType, Functio
 export { NotificationsAdminService, NotificationsService } from '@aurabase/notifications';
 export { AuraChannel, RealtimeService } from '@aurabase/realtime';
 export { StorageBucketClient, StorageService } from '@aurabase/storage';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.cjs';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.cjs';
 
 /**
  * Create a new Aurabase client instance.

package/dist/index.d.ts

@@ -7,7 +7,7 @@ export { FunctionsHttpError, FunctionsRelayError, FunctionsResponseType, Functio
 export { NotificationsAdminService, NotificationsService } from '@aurabase/notifications';
 export { AuraChannel, RealtimeService } from '@aurabase/realtime';
 export { StorageBucketClient, StorageService } from '@aurabase/storage';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.js';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.js';
 
 /**
  * Create a new Aurabase client instance.

package/dist/index.js

@@ -13,7 +13,7 @@ export { NotificationsAdminService, NotificationsService } from '@aurabase/notif
 import { RealtimeService } from '@aurabase/realtime';
 export { AuraChannel, RealtimeService } from '@aurabase/realtime';
 import { StorageService } from '@aurabase/storage';
-export { StorageService } from '@aurabase/storage';
+export { StorageBucketClient, StorageService } from '@aurabase/storage';
 
 // src/index.ts
 function isBrowserContext() {
@@ -62,6 +62,7 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
@@ -93,17 +94,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -128,6 +130,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -152,7 +155,8 @@ var AuraClient = class {
       this._auth = new AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -173,7 +177,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new AuthAdminService(this);
@@ -276,7 +280,7 @@ function createClient(baseUrl, apiKey, options) {
 function createAdminClient(baseUrl, serviceRoleKey, options) {
   if (isBrowserContext()) {
     throw new Error(
-      "[aurabase] createAdminClient() ne doit jamais \xEAtre appel\xE9 c\xF4t\xE9 navigateur : la cl\xE9 service_role serait expos\xE9e dans le bundle. \xC0 utiliser uniquement c\xF4t\xE9 serveur."
+      "[aurabase] createAdminClient() must never be called in a browser: the service_role key would be exposed in the bundle. Use it on the server only."
     );
   }
   return new AuraClient(baseUrl, serviceRoleKey, options);

package/dist/nextjs.cjs

@@ -56,6 +56,7 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
@@ -87,17 +88,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -122,6 +124,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -146,7 +149,8 @@ var AuraClient = class {
       this._auth = new auth$1.AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -167,7 +171,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new auth$1.AuthAdminService(this);
@@ -263,6 +267,7 @@ var AuraClient = class {
   }
 };
 var MAX_CHUNK_SIZE = 3600;
+var WARN_COOKIE_BYTES = 8 * 1024;
 function createServerClient(baseUrl, apiKey, options) {
   const cookieName = `aura-${core.clientScope(baseUrl)}-auth`;
   const store = new core.LocalAuthStore(cookieName);
@@ -284,6 +289,7 @@ function createServerClient(baseUrl, apiKey, options) {
     // 30 days
     ...options.cookieOptions
   };
+  let tailleAvertie = false;
   store.onChange(() => {
     const toSet = [];
     const used = /* @__PURE__ */ new Set();
@@ -308,15 +314,46 @@ function createServerClient(baseUrl, apiKey, options) {
         }
       }
     }
+    const total = toSet.filter((c) => used.has(c.name)).reduce((n, c) => n + c.name.length + encodeURIComponent(c.value).length, 0);
+    if (total > WARN_COOKIE_BYTES && !tailleAvertie) {
+      tailleAvertie = true;
+      console.warn(
+        `[aurabase] The session cookie is ${total} bytes (more than 8 KB): servers and proxies often reject requests above that size (431). The access token carries user_metadata: store less in user_metadata and keep large data in your own tables.`
+      );
+    }
     const expireOpts = { ...defaultCookieOpts, maxAge: 0 };
     for (const name of initialNames) {
       if (!used.has(name)) toSet.push({ name, value: "", options: expireOpts });
     }
     if (toSet.length > 0) options.cookies.setAll(toSet);
   });
-  return new AuraClient(baseUrl, apiKey, {
+  const client = new AuraClient(baseUrl, apiKey, {
     auth: { persistSession: false, storage: store }
   });
+  const getUser = client.auth.getUser.bind(client.auth);
+  const getSession = client.auth.getSession.bind(client.auth);
+  let verifie = null;
+  let averti = false;
+  client.auth.getUser = (async (...args) => {
+    const r = await getUser(...args);
+    verifie = !r.error && r.data ? r.data : null;
+    return r;
+  });
+  client.auth.getSession = (async () => {
+    const r = await getSession();
+    if (verifie) {
+      if (r.data.session) r.data.session = { ...r.data.session, user: verifie };
+      return { ...r, user: r.data.session ? verifie : null };
+    }
+    if (!averti) {
+      averti = true;
+      console.warn(
+        "[aurabase] getSession() on the server returns the session read from the cookie without verifying it: never use it to authorize a request. Call auth.getUser() (verified by the server) first."
+      );
+    }
+    return r;
+  });
+  return client;
 }
 
 // src/nextjs.ts
@@ -336,7 +373,7 @@ function createAuthMiddleware(options = {}) {
     const nextServer = await loadNextModule("next/server");
     if (!nextServer?.NextResponse) {
       throw new Error(
-        "[@aurabase/nextjs] Next.js n'est pas install\xE9. createAuthMiddleware n\xE9cessite next/server."
+        "[@aurabase/nextjs] Next.js is not installed. createAuthMiddleware requires next/server."
       );
     }
     const { NextResponse } = nextServer;
@@ -344,7 +381,7 @@ function createAuthMiddleware(options = {}) {
     const anonKey = options.anonKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? "";
     if (!projectUrl || !anonKey) {
       console.warn(
-        "[@aurabase/nextjs] Variables d'environnement manquantes : NEXT_PUBLIC_AURABASE_URL ou NEXT_PUBLIC_AURABASE_ANON_KEY non d\xE9finies."
+        "[@aurabase/nextjs] Missing environment variables: NEXT_PUBLIC_AURABASE_URL or NEXT_PUBLIC_AURABASE_ANON_KEY is not set."
       );
       return NextResponse.next({ request });
     }
@@ -361,9 +398,9 @@ function createAuthMiddleware(options = {}) {
     const client = createServerClient(projectUrl, anonKey, {
       cookies: cookieHandler
     });
-    const { data: sessionData } = await client.auth.getSession();
-    const session = sessionData?.session ?? null;
-    const user = session?.user ?? null;
+    const { data: verifiedUser } = await client.auth.getUser();
+    const user = verifiedUser ?? null;
+    const session = user ? (await client.auth.getSession()).data?.session ?? null : null;
     const pathname = request.nextUrl.pathname;
     const publicPatterns = options.publicRoutes ?? ["/", "/login", "/signup", "/auth/callback"];
     const isPublic = publicPatterns.some((pattern) => {
@@ -412,13 +449,13 @@ function createClientForServerAction(cookieStore, projectUrl, apiKey) {
 async function auth(options) {
   const nextHeaders = await loadNextModule("next/headers");
   if (!nextHeaders?.cookies) {
-    throw new Error("[@aurabase/nextjs] auth() ne peut \xEAtre appel\xE9 que dans un environnement Next.js App Router.");
+    throw new Error("[@aurabase/nextjs] auth() can only be called in a Next.js App Router environment.");
   }
   const cookieStore = await nextHeaders.cookies();
   const client = createClientForServerComponent(cookieStore, options?.projectUrl, options?.apiKey);
-  const { data } = await client.auth.getSession();
-  const session = data?.session ?? null;
-  const user = session?.user ?? null;
+  const { data: verifiedUser } = await client.auth.getUser();
+  const user = verifiedUser ?? null;
+  const session = user ? (await client.auth.getSession()).data?.session ?? null : null;
   return {
     userId: user?.id ?? null,
     user,

package/dist/nextjs.d.cts

@@ -1,4 +1,4 @@
-import { A as AuraClient } from './AuraClient-BWdcX_k0.cjs';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.cjs';
 import { User, Session } from '@aurabase/core';
 import '@aurabase/ai';
 import '@aurabase/auth';
@@ -53,9 +53,9 @@ interface AuthContextParam {
     request: NextRequestLike;
 }
 interface AuthMiddlewareOptions {
-    /** Project URL (defaults to process.env.NEXT_PUBLIC_AURABASE_URL — J1-004 : seul nom reconnu). */
+    /** Project URL (defaults to process.env.NEXT_PUBLIC_AURABASE_URL, the only variable name read). */
     projectUrl?: string;
-    /** Anon API Key (defaults to process.env.NEXT_PUBLIC_AURABASE_ANON_KEY — J1-004 : seul nom reconnu). */
+    /** Anon API Key (defaults to process.env.NEXT_PUBLIC_AURABASE_ANON_KEY, the only variable name read). */
     anonKey?: string;
     /** List of route patterns that do not require authentication (e.g. ['/', '/login', '/signup', '/auth/*']). */
     publicRoutes?: string[];

package/dist/nextjs.d.ts

@@ -1,4 +1,4 @@
-import { A as AuraClient } from './AuraClient-BWdcX_k0.js';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.js';
 import { User, Session } from '@aurabase/core';
 import '@aurabase/ai';
 import '@aurabase/auth';
@@ -53,9 +53,9 @@ interface AuthContextParam {
     request: NextRequestLike;
 }
 interface AuthMiddlewareOptions {
-    /** Project URL (defaults to process.env.NEXT_PUBLIC_AURABASE_URL — J1-004 : seul nom reconnu). */
+    /** Project URL (defaults to process.env.NEXT_PUBLIC_AURABASE_URL, the only variable name read). */
     projectUrl?: string;
-    /** Anon API Key (defaults to process.env.NEXT_PUBLIC_AURABASE_ANON_KEY — J1-004 : seul nom reconnu). */
+    /** Anon API Key (defaults to process.env.NEXT_PUBLIC_AURABASE_ANON_KEY, the only variable name read). */
     anonKey?: string;
     /** List of route patterns that do not require authentication (e.g. ['/', '/login', '/signup', '/auth/*']). */
     publicRoutes?: string[];

package/dist/nextjs.js

@@ -54,6 +54,7 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
@@ -85,17 +86,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -120,6 +122,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -144,7 +147,8 @@ var AuraClient = class {
       this._auth = new AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -165,7 +169,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new AuthAdminService(this);
@@ -261,6 +265,7 @@ var AuraClient = class {
   }
 };
 var MAX_CHUNK_SIZE = 3600;
+var WARN_COOKIE_BYTES = 8 * 1024;
 function createServerClient(baseUrl, apiKey, options) {
   const cookieName = `aura-${clientScope(baseUrl)}-auth`;
   const store = new LocalAuthStore(cookieName);
@@ -282,6 +287,7 @@ function createServerClient(baseUrl, apiKey, options) {
     // 30 days
     ...options.cookieOptions
   };
+  let tailleAvertie = false;
   store.onChange(() => {
     const toSet = [];
     const used = /* @__PURE__ */ new Set();
@@ -306,15 +312,46 @@ function createServerClient(baseUrl, apiKey, options) {
         }
       }
     }
+    const total = toSet.filter((c) => used.has(c.name)).reduce((n, c) => n + c.name.length + encodeURIComponent(c.value).length, 0);
+    if (total > WARN_COOKIE_BYTES && !tailleAvertie) {
+      tailleAvertie = true;
+      console.warn(
+        `[aurabase] The session cookie is ${total} bytes (more than 8 KB): servers and proxies often reject requests above that size (431). The access token carries user_metadata: store less in user_metadata and keep large data in your own tables.`
+      );
+    }
     const expireOpts = { ...defaultCookieOpts, maxAge: 0 };
     for (const name of initialNames) {
       if (!used.has(name)) toSet.push({ name, value: "", options: expireOpts });
     }
     if (toSet.length > 0) options.cookies.setAll(toSet);
   });
-  return new AuraClient(baseUrl, apiKey, {
+  const client = new AuraClient(baseUrl, apiKey, {
     auth: { persistSession: false, storage: store }
   });
+  const getUser = client.auth.getUser.bind(client.auth);
+  const getSession = client.auth.getSession.bind(client.auth);
+  let verifie = null;
+  let averti = false;
+  client.auth.getUser = (async (...args) => {
+    const r = await getUser(...args);
+    verifie = !r.error && r.data ? r.data : null;
+    return r;
+  });
+  client.auth.getSession = (async () => {
+    const r = await getSession();
+    if (verifie) {
+      if (r.data.session) r.data.session = { ...r.data.session, user: verifie };
+      return { ...r, user: r.data.session ? verifie : null };
+    }
+    if (!averti) {
+      averti = true;
+      console.warn(
+        "[aurabase] getSession() on the server returns the session read from the cookie without verifying it: never use it to authorize a request. Call auth.getUser() (verified by the server) first."
+      );
+    }
+    return r;
+  });
+  return client;
 }
 
 // src/nextjs.ts
@@ -334,7 +371,7 @@ function createAuthMiddleware(options = {}) {
     const nextServer = await loadNextModule("next/server");
     if (!nextServer?.NextResponse) {
       throw new Error(
-        "[@aurabase/nextjs] Next.js n'est pas install\xE9. createAuthMiddleware n\xE9cessite next/server."
+        "[@aurabase/nextjs] Next.js is not installed. createAuthMiddleware requires next/server."
       );
     }
     const { NextResponse } = nextServer;
@@ -342,7 +379,7 @@ function createAuthMiddleware(options = {}) {
     const anonKey = options.anonKey ?? process.env.NEXT_PUBLIC_AURABASE_ANON_KEY ?? "";
     if (!projectUrl || !anonKey) {
       console.warn(
-        "[@aurabase/nextjs] Variables d'environnement manquantes : NEXT_PUBLIC_AURABASE_URL ou NEXT_PUBLIC_AURABASE_ANON_KEY non d\xE9finies."
+        "[@aurabase/nextjs] Missing environment variables: NEXT_PUBLIC_AURABASE_URL or NEXT_PUBLIC_AURABASE_ANON_KEY is not set."
       );
       return NextResponse.next({ request });
     }
@@ -359,9 +396,9 @@ function createAuthMiddleware(options = {}) {
     const client = createServerClient(projectUrl, anonKey, {
       cookies: cookieHandler
     });
-    const { data: sessionData } = await client.auth.getSession();
-    const session = sessionData?.session ?? null;
-    const user = session?.user ?? null;
+    const { data: verifiedUser } = await client.auth.getUser();
+    const user = verifiedUser ?? null;
+    const session = user ? (await client.auth.getSession()).data?.session ?? null : null;
     const pathname = request.nextUrl.pathname;
     const publicPatterns = options.publicRoutes ?? ["/", "/login", "/signup", "/auth/callback"];
     const isPublic = publicPatterns.some((pattern) => {
@@ -410,13 +447,13 @@ function createClientForServerAction(cookieStore, projectUrl, apiKey) {
 async function auth(options) {
   const nextHeaders = await loadNextModule("next/headers");
   if (!nextHeaders?.cookies) {
-    throw new Error("[@aurabase/nextjs] auth() ne peut \xEAtre appel\xE9 que dans un environnement Next.js App Router.");
+    throw new Error("[@aurabase/nextjs] auth() can only be called in a Next.js App Router environment.");
   }
   const cookieStore = await nextHeaders.cookies();
   const client = createClientForServerComponent(cookieStore, options?.projectUrl, options?.apiKey);
-  const { data } = await client.auth.getSession();
-  const session = data?.session ?? null;
-  const user = session?.user ?? null;
+  const { data: verifiedUser } = await client.auth.getUser();
+  const user = verifiedUser ?? null;
+  const session = user ? (await client.auth.getSession()).data?.session ?? null : null;
   return {
     userId: user?.id ?? null,
     user,

package/dist/react.d.cts

@@ -1,5 +1,5 @@
 import { User, Session } from '@aurabase/core';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.cjs';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.cjs';
 import '@aurabase/ai';
 import '@aurabase/auth';
 import '@aurabase/db';

package/dist/react.d.ts

@@ -1,5 +1,5 @@
 import { User, Session } from '@aurabase/core';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.js';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.js';
 import '@aurabase/ai';
 import '@aurabase/auth';
 import '@aurabase/db';

package/dist/ssr.cjs

@@ -56,6 +56,7 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
@@ -87,17 +88,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -122,6 +124,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -146,7 +149,8 @@ var AuraClient = class {
       this._auth = new auth.AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -167,7 +171,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new auth.AuthAdminService(this);
@@ -263,6 +267,7 @@ var AuraClient = class {
   }
 };
 var MAX_CHUNK_SIZE = 3600;
+var WARN_COOKIE_BYTES = 8 * 1024;
 function createServerClient(baseUrl, apiKey, options) {
   const cookieName = `aura-${core.clientScope(baseUrl)}-auth`;
   const store = new core.LocalAuthStore(cookieName);
@@ -284,6 +289,7 @@ function createServerClient(baseUrl, apiKey, options) {
     // 30 days
     ...options.cookieOptions
   };
+  let tailleAvertie = false;
   store.onChange(() => {
     const toSet = [];
     const used = /* @__PURE__ */ new Set();
@@ -308,15 +314,46 @@ function createServerClient(baseUrl, apiKey, options) {
         }
       }
     }
+    const total = toSet.filter((c) => used.has(c.name)).reduce((n, c) => n + c.name.length + encodeURIComponent(c.value).length, 0);
+    if (total > WARN_COOKIE_BYTES && !tailleAvertie) {
+      tailleAvertie = true;
+      console.warn(
+        `[aurabase] The session cookie is ${total} bytes (more than 8 KB): servers and proxies often reject requests above that size (431). The access token carries user_metadata: store less in user_metadata and keep large data in your own tables.`
+      );
+    }
     const expireOpts = { ...defaultCookieOpts, maxAge: 0 };
     for (const name of initialNames) {
       if (!used.has(name)) toSet.push({ name, value: "", options: expireOpts });
     }
     if (toSet.length > 0) options.cookies.setAll(toSet);
   });
-  return new AuraClient(baseUrl, apiKey, {
+  const client = new AuraClient(baseUrl, apiKey, {
     auth: { persistSession: false, storage: store }
   });
+  const getUser = client.auth.getUser.bind(client.auth);
+  const getSession = client.auth.getSession.bind(client.auth);
+  let verifie = null;
+  let averti = false;
+  client.auth.getUser = (async (...args) => {
+    const r = await getUser(...args);
+    verifie = !r.error && r.data ? r.data : null;
+    return r;
+  });
+  client.auth.getSession = (async () => {
+    const r = await getSession();
+    if (verifie) {
+      if (r.data.session) r.data.session = { ...r.data.session, user: verifie };
+      return { ...r, user: r.data.session ? verifie : null };
+    }
+    if (!averti) {
+      averti = true;
+      console.warn(
+        "[aurabase] getSession() on the server returns the session read from the cookie without verifying it: never use it to authorize a request. Call auth.getUser() (verified by the server) first."
+      );
+    }
+    return r;
+  });
+  return client;
 }
 function createBrowserClient(baseUrl, apiKey, options) {
   return new AuraClient(baseUrl, apiKey, options);

package/dist/ssr.d.cts

@@ -1,6 +1,6 @@
 import { SerializeCookieOptions, AuraClientOptions } from '@aurabase/core';
 export { SerializeCookieOptions, parseCookieHeader, serializeCookieHeader } from '@aurabase/core';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.cjs';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.cjs';
 import '@aurabase/ai';
 import '@aurabase/auth';
 import '@aurabase/db';
@@ -29,7 +29,9 @@ import '@aurabase/storage';
  *       },
  *     },
  *   })
- *   await client.auth.getSession()
+ *   // getUser() renouvelle les jetons ET fait vérifier l'utilisateur par le serveur.
+ *   // Ne jamais autoriser avec getSession() côté serveur : elle lit le cookie sans le vérifier.
+ *   const { data: user } = await client.auth.getUser()
  *   return response
  * }
  * ```

package/dist/ssr.d.ts

@@ -1,6 +1,6 @@
 import { SerializeCookieOptions, AuraClientOptions } from '@aurabase/core';
 export { SerializeCookieOptions, parseCookieHeader, serializeCookieHeader } from '@aurabase/core';
-import { A as AuraClient } from './AuraClient-BWdcX_k0.js';
+import { A as AuraClient } from './AuraClient-B1OOZCSX.js';
 import '@aurabase/ai';
 import '@aurabase/auth';
 import '@aurabase/db';
@@ -29,7 +29,9 @@ import '@aurabase/storage';
  *       },
  *     },
  *   })
- *   await client.auth.getSession()
+ *   // getUser() renouvelle les jetons ET fait vérifier l'utilisateur par le serveur.
+ *   // Ne jamais autoriser avec getSession() côté serveur : elle lit le cookie sans le vérifier.
+ *   const { data: user } = await client.auth.getUser()
  *   return response
  * }
  * ```

package/dist/ssr.js

@@ -55,6 +55,7 @@ var AuraClient = class {
   _persistSession;
   _autoRefresh;
   _detectSessionInUrl;
+  _flowType;
   /**
    * @param baseUrl URL du projet (`https://<slug>.aurabase.cloud`).
    * @param apiKey  Clé API du projet (`aura_anon_…`, `aura_auth_…`, `aura_sk_…`).
@@ -86,17 +87,18 @@ var AuraClient = class {
     this.debug = resolvedOptions?.debug;
     if (!this.apiKey && typeof console !== "undefined") {
       console.warn(
-        "[aurabase] No API key provided. Most operations require an API key (apikey header). Only public auth routes (register, login, refresh) will work without one."
+        // AUTH-041 — la passerelle refuse TOUTE requête sans clé (401), y compris register/login.
+        "[aurabase] No API key provided: every request will be refused (401). Pass the anon key shown in Studio \u203A Settings \u203A Connection."
       );
     }
     if (typeof console !== "undefined" && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/.test(this.baseUrl)) {
       console.warn(
-        "[aurabase] Attention : en local, l'URL du projet doit inclure le sous-domaine (ex: http://<slug>.localhost:8080) pour permettre la r\xE9solution automatique du projet par la passerelle."
+        "[aurabase] Warning: locally, the project URL must include the sub-domain (e.g. http://<slug>.localhost:8080) so that the gateway can resolve the project automatically."
       );
     }
     if (this.apiKey?.startsWith(SERVICE_ROLE_KEY_PREFIX) && isBrowserContext()) {
       const refuse = resolvedOptions?.refuseServiceRoleInBrowser ?? true;
-      const message = "[aurabase] S\xC9CURIT\xC9 : une cl\xE9 service_role (aura_sk_\u2026) est fournie \xE0 createClient() dans un contexte navigateur. Cette cl\xE9 \xE0 privil\xE8ges \xE9lev\xE9s NE DOIT JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez une cl\xE9 anon (aura_anon_\u2026) c\xF4t\xE9 client, et createAdminClient() c\xF4t\xE9 serveur pour les op\xE9rations d'administration.";
+      const message = "[aurabase] SECURITY: a service_role key (aura_sk_\u2026) is passed to createClient() in a browser context. This high-privilege key MUST NEVER be exposed client-side (it would leak into the bundle). Use an anon key (aura_anon_\u2026) on the client, and createAdminClient() on the server for administration operations.";
       if (refuse) {
         throw new Error(message);
       } else if (typeof console !== "undefined") {
@@ -121,6 +123,7 @@ var AuraClient = class {
     this._persistSession = resolvedOptions?.auth?.persistSession !== false;
     this._autoRefresh = resolvedOptions?.auth?.autoRefresh ?? true;
     this._detectSessionInUrl = resolvedOptions?.auth?.detectSessionInUrl;
+    this._flowType = resolvedOptions?.auth?.flowType;
     if (this._autoRefresh && this._persistSession && typeof window !== "undefined") {
       void this.auth;
     }
@@ -145,7 +148,8 @@ var AuraClient = class {
       this._auth = new AuthService(this, {
         autoRefresh: this._autoRefresh,
         persistSession: this._persistSession,
-        detectSessionInUrl: this._detectSessionInUrl
+        detectSessionInUrl: this._detectSessionInUrl,
+        flowType: this._flowType
       });
       this._auth.onAuthStateChange(({ event, accessToken }) => {
         if (this._realtime) {
@@ -166,7 +170,7 @@ var AuraClient = class {
   get authAdmin() {
     if (isBrowserContext()) {
       throw new Error(
-        "[aurabase] S\xC9CURIT\xC9 : authAdmin est inaccessible dans un contexte navigateur. L'API admin requiert une cl\xE9 service_role qui ne doit JAMAIS \xEAtre expos\xE9e c\xF4t\xE9 client (elle fuiterait dans le bundle). Utilisez createAdminClient() c\xF4t\xE9 serveur uniquement."
+        "[aurabase] SECURITY: authAdmin is not available in a browser context. The admin API requires a service_role key, which must NEVER be exposed client-side (it would leak into the bundle). Use createAdminClient() on the server only."
       );
     }
     if (!this._authAdmin) this._authAdmin = new AuthAdminService(this);
@@ -262,6 +266,7 @@ var AuraClient = class {
   }
 };
 var MAX_CHUNK_SIZE = 3600;
+var WARN_COOKIE_BYTES = 8 * 1024;
 function createServerClient(baseUrl, apiKey, options) {
   const cookieName = `aura-${clientScope(baseUrl)}-auth`;
   const store = new LocalAuthStore(cookieName);
@@ -283,6 +288,7 @@ function createServerClient(baseUrl, apiKey, options) {
     // 30 days
     ...options.cookieOptions
   };
+  let tailleAvertie = false;
   store.onChange(() => {
     const toSet = [];
     const used = /* @__PURE__ */ new Set();
@@ -307,15 +313,46 @@ function createServerClient(baseUrl, apiKey, options) {
         }
       }
     }
+    const total = toSet.filter((c) => used.has(c.name)).reduce((n, c) => n + c.name.length + encodeURIComponent(c.value).length, 0);
+    if (total > WARN_COOKIE_BYTES && !tailleAvertie) {
+      tailleAvertie = true;
+      console.warn(
+        `[aurabase] The session cookie is ${total} bytes (more than 8 KB): servers and proxies often reject requests above that size (431). The access token carries user_metadata: store less in user_metadata and keep large data in your own tables.`
+      );
+    }
     const expireOpts = { ...defaultCookieOpts, maxAge: 0 };
     for (const name of initialNames) {
       if (!used.has(name)) toSet.push({ name, value: "", options: expireOpts });
     }
     if (toSet.length > 0) options.cookies.setAll(toSet);
   });
-  return new AuraClient(baseUrl, apiKey, {
+  const client = new AuraClient(baseUrl, apiKey, {
     auth: { persistSession: false, storage: store }
   });
+  const getUser = client.auth.getUser.bind(client.auth);
+  const getSession = client.auth.getSession.bind(client.auth);
+  let verifie = null;
+  let averti = false;
+  client.auth.getUser = (async (...args) => {
+    const r = await getUser(...args);
+    verifie = !r.error && r.data ? r.data : null;
+    return r;
+  });
+  client.auth.getSession = (async () => {
+    const r = await getSession();
+    if (verifie) {
+      if (r.data.session) r.data.session = { ...r.data.session, user: verifie };
+      return { ...r, user: r.data.session ? verifie : null };
+    }
+    if (!averti) {
+      averti = true;
+      console.warn(
+        "[aurabase] getSession() on the server returns the session read from the cookie without verifying it: never use it to authorize a request. Call auth.getUser() (verified by the server) first."
+      );
+    }
+    return r;
+  });
+  return client;
 }
 function createBrowserClient(baseUrl, apiKey, options) {
   return new AuraClient(baseUrl, apiKey, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/aurabase-js",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Official JavaScript/TypeScript client for Aurabase BaaS",
   "type": "module",
   "main": "dist/index.cjs",
@@ -37,6 +37,7 @@
         "default": "./dist/nextjs.cjs"
       }
     },
+    "./package.json": "./package.json",
     "./react": {
       "import": {
         "types": "./dist/react.d.ts",
@@ -76,14 +77,14 @@
     "client"
   ],
   "dependencies": {
-    "@aurabase/core": "0.6.2",
-    "@aurabase/auth": "0.6.2",
-    "@aurabase/db": "0.6.2",
-    "@aurabase/storage": "0.6.2",
-    "@aurabase/realtime": "0.6.2",
-    "@aurabase/functions": "0.6.2",
-    "@aurabase/ai": "0.6.2",
-    "@aurabase/notifications": "0.6.2"
+    "@aurabase/core": "0.7.0",
+    "@aurabase/auth": "0.7.0",
+    "@aurabase/storage": "0.7.0",
+    "@aurabase/ai": "0.7.0",
+    "@aurabase/functions": "0.7.0",
+    "@aurabase/notifications": "0.7.0",
+    "@aurabase/db": "0.7.0",
+    "@aurabase/realtime": "0.7.0"
   },
   "devDependencies": {
     "@types/node": "20.14.15",