@aurabase/auth 0.4.0

package/dist/index.js

@@ -0,0 +1,1170 @@
+import { BaseService, isTokenExpired, AuraError, refreshOnce, emitAuraEvent } from '@aurabase/core';
+
+// src/AuthService.ts
+
+// src/SessionManager.ts
+var SessionManager = class {
+  opts;
+  _interval = null;
+  _channel = null;
+  _active = false;
+  _visHandler = null;
+  constructor(opts) {
+    this.opts = { tickMs: 3e4, ...opts };
+  }
+  get isActive() {
+    return this._active;
+  }
+  start() {
+    if (!this.opts.enabled) return;
+    if (typeof BroadcastChannel !== "undefined" && !this._channel) {
+      this._channel = new BroadcastChannel(this.opts.channelName);
+      this._channel.onmessage = (e) => this.opts.onRemoteMessage(e.data);
+    }
+    if (typeof document !== "undefined" && !this._visHandler) {
+      this._visHandler = () => {
+        if (document.hidden) {
+          this._stopInterval();
+        } else if (this._active) {
+          this._startInterval();
+          if (this.opts.isRefreshDue()) this.opts.onTick();
+        }
+      };
+      document.addEventListener("visibilitychange", this._visHandler);
+    }
+  }
+  setActive(active) {
+    this._active = active;
+    if (!this.opts.enabled) return;
+    const hidden = typeof document !== "undefined" && document.hidden;
+    if (active && !hidden) this._startInterval();
+    else this._stopInterval();
+  }
+  broadcast(data) {
+    this._channel?.postMessage(data);
+  }
+  stop() {
+    this._stopInterval();
+    this._active = false;
+    if (this._channel) {
+      try {
+        this._channel.close();
+      } catch {
+      }
+      this._channel = null;
+    }
+    if (this._visHandler && typeof document !== "undefined") {
+      document.removeEventListener("visibilitychange", this._visHandler);
+      this._visHandler = null;
+    }
+  }
+  _startInterval() {
+    if (this._interval) return;
+    this._interval = setInterval(() => {
+      if (this.opts.isRefreshDue()) this.opts.onTick();
+    }, this.opts.tickMs);
+    this._interval.unref?.();
+  }
+  _stopInterval() {
+    if (this._interval) {
+      clearInterval(this._interval);
+      this._interval = null;
+    }
+  }
+};
+
+// src/jwks.ts
+var MAX_AGE_CAP_MS = 864e5;
+var FORCED_REFETCH_COOLDOWN_MS = 3e4;
+var NEGATIVE_CACHE_TTL_MS = 1e4;
+var DEFAULT_MAX_AGE_MS = 6e5;
+var clientStates = /* @__PURE__ */ new WeakMap();
+function stateFor(scope) {
+  let s = clientStates.get(scope);
+  if (!s) {
+    s = {
+      cache: /* @__PURE__ */ new Map(),
+      inflight: /* @__PURE__ */ new Map(),
+      lastFailedAt: /* @__PURE__ */ new Map(),
+      lastForcedFetchAt: /* @__PURE__ */ new Map()
+    };
+    clientStates.set(scope, s);
+  }
+  return s;
+}
+function b64urlToBytes(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4);
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function decodeJwt(jwt) {
+  const [h, p, s] = jwt.split(".");
+  if (!h || !p || !s) throw new Error("malformed jwt");
+  const dec = new TextDecoder();
+  return {
+    header: JSON.parse(dec.decode(b64urlToBytes(h))),
+    payload: JSON.parse(dec.decode(b64urlToBytes(p))),
+    signingInput: `${h}.${p}`,
+    signature: b64urlToBytes(s)
+  };
+}
+function parseMaxAge(cc) {
+  const m = cc?.match(/max-age=(\d+)/);
+  return m ? Number(m[1]) * 1e3 : null;
+}
+function fetchJwksDeduped(state, fetchFn, baseUrl) {
+  const existing = state.inflight.get(baseUrl);
+  if (existing) return existing;
+  const p = (async () => {
+    try {
+      const res = await fetchFn(`${baseUrl}/.well-known/jwks.json`);
+      if (!res.ok) throw new Error("jwks_fetch_failed");
+      const body = await res.json();
+      const parsed = parseMaxAge(res.headers.get("Cache-Control")) ?? DEFAULT_MAX_AGE_MS;
+      const maxAge = Math.min(parsed, MAX_AGE_CAP_MS);
+      const keys = body.keys ?? [];
+      state.cache.set(baseUrl, { keys, fetchedAt: Date.now(), maxAgeMs: maxAge });
+      state.lastFailedAt.delete(baseUrl);
+      return keys;
+    } catch {
+      state.lastFailedAt.set(baseUrl, Date.now());
+      throw new Error("jwks_fetch_failed");
+    }
+  })().finally(() => state.inflight.delete(baseUrl));
+  state.inflight.set(baseUrl, p);
+  return p;
+}
+async function loadJwks(state, fetchFn, baseUrl) {
+  const now = Date.now();
+  const c = state.cache.get(baseUrl);
+  if (c && now - c.fetchedAt < c.maxAgeMs) return c.keys;
+  const failedAt = state.lastFailedAt.get(baseUrl);
+  if (failedAt !== void 0 && now - failedAt < NEGATIVE_CACHE_TTL_MS) {
+    throw new Error("jwks_fetch_failed");
+  }
+  return fetchJwksDeduped(state, fetchFn, baseUrl);
+}
+async function forcedRefetchJwks(state, fetchFn, baseUrl) {
+  const now = Date.now();
+  const last = state.lastForcedFetchAt.get(baseUrl);
+  if (last !== void 0 && now - last < FORCED_REFETCH_COOLDOWN_MS) return null;
+  state.lastForcedFetchAt.set(baseUrl, now);
+  const failedAt = state.lastFailedAt.get(baseUrl);
+  if (failedAt !== void 0 && now - failedAt < NEGATIVE_CACHE_TTL_MS) {
+    throw new Error("jwks_fetch_failed");
+  }
+  return fetchJwksDeduped(state, fetchFn, baseUrl);
+}
+function algParams(alg) {
+  if (alg === "RS256") {
+    return {
+      importAlg: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+      verifyAlg: { name: "RSASSA-PKCS1-v1_5" }
+    };
+  }
+  if (alg === "ES256") {
+    return {
+      importAlg: { name: "ECDSA", namedCurve: "P-256" },
+      verifyAlg: { name: "ECDSA", hash: "SHA-256" }
+    };
+  }
+  return null;
+}
+async function verifyJwtLocal(scope, fetchFn, baseUrl, jwt, opts = {}) {
+  let d;
+  try {
+    d = decodeJwt(jwt);
+  } catch {
+    return { ok: false, code: "invalid_jwt" };
+  }
+  const params = algParams(d.header.alg);
+  if (!params) return { ok: false, code: "unsupported_alg" };
+  const state = stateFor(scope);
+  const matchesAlg = (k) => d.header.alg === "RS256" ? k.kty === "RSA" : k.kty === "EC";
+  const candidateKeys = (keys2) => d.header.kid ? keys2.filter((k) => k.kid === d.header.kid && matchesAlg(k)) : keys2.filter((k) => matchesAlg(k));
+  let keys;
+  try {
+    keys = await loadJwks(state, fetchFn, baseUrl);
+  } catch {
+    try {
+      opts.onEvent?.(baseUrl);
+    } catch {
+    }
+    return { ok: false, code: "jwks_fetch_failed" };
+  }
+  let candidates = candidateKeys(keys);
+  if (candidates.length === 0 && d.header.kid) {
+    let refetched;
+    try {
+      refetched = await forcedRefetchJwks(state, fetchFn, baseUrl);
+    } catch {
+      try {
+        opts.onEvent?.(baseUrl);
+      } catch {
+      }
+      return { ok: false, code: "jwks_fetch_failed" };
+    }
+    if (refetched) {
+      keys = refetched;
+      candidates = candidateKeys(keys);
+    }
+  }
+  if (candidates.length === 0) return { ok: false, code: "no_matching_key" };
+  const signingBytes = new TextEncoder().encode(d.signingInput);
+  let valid = false;
+  for (const jwk of candidates) {
+    try {
+      const key = await crypto.subtle.importKey("jwk", jwk, params.importAlg, false, ["verify"]);
+      if (await crypto.subtle.verify(
+        params.verifyAlg,
+        key,
+        d.signature,
+        signingBytes
+      )) {
+        valid = true;
+        break;
+      }
+    } catch {
+    }
+  }
+  if (!valid) return { ok: false, code: "signature_invalid" };
+  const now = Math.floor(Date.now() / 1e3);
+  if (!opts.allowExpired && typeof d.payload.exp === "number" && d.payload.exp < now) {
+    return { ok: false, code: "token_expired" };
+  }
+  if (typeof d.payload.nbf === "number" && d.payload.nbf > now + 60) {
+    return { ok: false, code: "token_not_yet_valid" };
+  }
+  return {
+    ok: true,
+    claims: d.payload,
+    header: {
+      alg: d.header.alg,
+      kid: d.header.kid,
+      typ: d.header.typ
+    }
+  };
+}
+
+// src/pkce.ts
+function b64url(bytes) {
+  let s = "";
+  for (const b of bytes) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function generateCodeVerifier() {
+  const bytes = new Uint8Array(64);
+  crypto.getRandomValues(bytes);
+  return b64url(bytes);
+}
+async function codeChallengeS256(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return b64url(new Uint8Array(digest));
+}
+
+// src/AuthService.ts
+function isMfaChallenge(v) {
+  return typeof v === "object" && v !== null && v.mfa_required === true;
+}
+var AuthService = class extends BaseService {
+  _stateListeners = /* @__PURE__ */ new Set();
+  _sessionManager;
+  _applyingRemote = false;
+  _unsubStore = null;
+  _disposed = false;
+  constructor(client, options) {
+    super(client);
+    const browser = typeof window !== "undefined";
+    const enabled = !!options?.forceEnabled || (options?.autoRefresh ?? true) && browser && (options?.persistSession ?? true);
+    this._sessionManager = new SessionManager({
+      channelName: `aura-${client.projectId}-auth`,
+      enabled,
+      onTick: () => {
+        void this.refreshSession();
+      },
+      isRefreshDue: () => {
+        const t = this.client.authStore.token;
+        return !!t && !!this.client.authStore.refreshToken && isTokenExpired(t, 60);
+      },
+      onRemoteMessage: (data) => this._applyRemoteState(data)
+    });
+    this._sessionManager.start();
+    this._unsubStore = this.client.authStore.onChange((token) => {
+      this._sessionManager.setActive(!!token);
+      if (!this._applyingRemote) {
+        const state = this._broadcastState();
+        if (!token || state !== null) {
+          this._sessionManager.broadcast(state);
+        }
+      }
+    });
+    if (this.client.authStore.token) this._sessionManager.setActive(true);
+    const detect = options?.detectSessionInUrl ?? browser;
+    if (detect && browser) {
+      void this._detectSessionInUrl();
+    }
+  }
+  /**
+   * Détecte et consomme une session présente dans l'URL courante au boot (callback
+   * OAuth), à l'image de `detectSessionInUrl` de supabase-js :
+   *  - fragment `#access_token=…&refresh_token=…` (flux implicit) → `setSession`.
+   *  - query `?token=…&type=recovery` (lien de récupération de mot de passe) → émet
+   *    `PASSWORD_RECOVERY` avec `recoveryToken` (AUCUNE session posée, PAS de `SIGNED_IN`).
+   *  - query `?code=…` (flux PKCE) → `exchangeCodeForSession` (relit le verifier).
+   * Puis nettoie l'URL via `history.replaceState` (retire tokens/code de la barre
+   * d'adresse et de l'historique). Idempotent, no-op si aucun token/code n'est
+   * présent, no-op hors navigateur. NE THROW JAMAIS (best-effort au boot).
+   */
+  async _detectSessionInUrl() {
+    if (typeof window === "undefined") return;
+    try {
+      const loc = window.location;
+      if (!loc) return;
+      const hash = typeof loc.hash === "string" ? loc.hash : "";
+      const search = typeof loc.search === "string" ? loc.search : "";
+      if (hash.includes("access_token")) {
+        const initiatedKey = this._oauthInitiatedKey;
+        const initiated = this.client.authStore.getItem(initiatedKey);
+        if (!initiated) return;
+        this.client.authStore.removeItem(initiatedKey);
+        const frag = new URLSearchParams(hash.replace(/^#/, ""));
+        const accessToken = frag.get("access_token");
+        const refreshToken = frag.get("refresh_token");
+        if (accessToken && refreshToken) {
+          await this.setSession(accessToken, refreshToken);
+          this._cleanAuthParamsFromUrl();
+        }
+        return;
+      }
+      {
+        const qs = new URLSearchParams(search.replace(/^\?/, ""));
+        const recoveryToken = qs.get("token");
+        if (qs.get("type") === "recovery" && recoveryToken) {
+          this._emitEvent("PASSWORD_RECOVERY", null, null, { recoveryToken });
+          this._cleanAuthParamsFromUrl();
+          return;
+        }
+      }
+      if (/[?&]code=/.test(search)) {
+        const qs = new URLSearchParams(search.replace(/^\?/, ""));
+        const code = qs.get("code");
+        if (code) {
+          await this.exchangeCodeForSession(code);
+          this._cleanAuthParamsFromUrl();
+        }
+        return;
+      }
+    } catch {
+    }
+  }
+  /**
+   * Retire de l'URL courante les paramètres d'auth du callback OAuth : le fragment
+   * entier (flux implicit) et les query params `code`/`state` (flux PKCE), tout en
+   * préservant les autres query params. Via `history.replaceState` (pas de nouvelle
+   * entrée d'historique). Best-effort, ne throw jamais.
+   */
+  _cleanAuthParamsFromUrl() {
+    try {
+      if (typeof window === "undefined") return;
+      const h = window.history;
+      const loc = window.location;
+      if (!h || typeof h.replaceState !== "function" || !loc) return;
+      const qs = new URLSearchParams(
+        typeof loc.search === "string" ? loc.search.replace(/^\?/, "") : ""
+      );
+      qs.delete("code");
+      qs.delete("state");
+      qs.delete("token");
+      qs.delete("project_id");
+      qs.delete("type");
+      const remaining = qs.toString();
+      const path = loc.pathname ?? "/";
+      const clean = path + (remaining ? `?${remaining}` : "");
+      h.replaceState(null, "", clean || "/");
+    } catch {
+    }
+  }
+  _broadcastState() {
+    const s = this.client.authStore;
+    if (!s.token || !s.refreshToken || !s.user || typeof s.user !== "object" || !("id" in s.user) || !s.user.id) {
+      return null;
+    }
+    return { token: s.token, refreshToken: s.refreshToken, user: s.user };
+  }
+  _applyRemoteState(data) {
+    if (data !== null) {
+      const d = data;
+      if (typeof d.token !== "string" || typeof d.refreshToken !== "string" || !d.user || typeof d.user !== "object") {
+        return;
+      }
+    }
+    this._applyingRemote = true;
+    try {
+      const store = this.client.authStore;
+      const prevToken = store.token;
+      if (!data) {
+        store.clear();
+        this._emitEvent("SIGNED_OUT", null, null);
+      } else {
+        const s = data;
+        store.save(s.token, s.refreshToken, s.user);
+        const event = !prevToken ? "SIGNED_IN" : s.token !== prevToken ? "TOKEN_REFRESHED" : "USER_UPDATED";
+        this._emitEvent(event, s.user, s.token);
+      }
+    } finally {
+      this._applyingRemote = false;
+    }
+  }
+  /** Démonte le cycle de vie proactif : ticker, visibilité, BroadcastChannel, listeners. */
+  dispose() {
+    if (this._disposed) return;
+    this._disposed = true;
+    this._sessionManager.stop();
+    this._unsubStore?.();
+    this._unsubStore = null;
+    this._stateListeners.clear();
+  }
+  get prefix() {
+    return `/v1/auth/${this.client.projectId}`;
+  }
+  /** Clé project-scoped du `code_verifier` PKCE (anti-collision multi-projets). */
+  get _pkceVerifierKey() {
+    return `aura-${this.client.projectId}-pkce-code-verifier`;
+  }
+  /**
+   * Clé project-scoped du MARQUEUR d'initiation du flux OAuth implicit (SEC-F3).
+   * Posé par `signInWithOAuth` (flux implicit) avant le redirect ; vérifié + purgé
+   * par `_detectSessionInUrl` au retour. Un fragment `#access_token` forgé/injecté
+   * par un attaquant (login-CSRF / session fixation) n'aura PAS ce marqueur → il ne
+   * sera jamais adopté.
+   */
+  get _oauthInitiatedKey() {
+    return `aura-${this.client.projectId}-oauth-implicit-initiated`;
+  }
+  // -- Auth state change ------------------------------------------------------
+  onAuthStateChange(callback) {
+    if (this._disposed) return { unsubscribe: () => {
+    } };
+    this._stateListeners.add(callback);
+    const store = this.client.authStore;
+    queueMicrotask(() => {
+      if (this._stateListeners.has(callback)) {
+        callback({ event: "INITIAL_SESSION", user: store.user, accessToken: store.token });
+      }
+    });
+    return {
+      unsubscribe: () => {
+        this._stateListeners.delete(callback);
+      }
+    };
+  }
+  _emitEvent(event, user, accessToken, extra) {
+    for (const cb of this._stateListeners) {
+      try {
+        cb({ event, user, accessToken, ...extra });
+      } catch {
+      }
+    }
+  }
+  // -- Sign up / sign in / sign out -------------------------------------------
+  async signUp(req) {
+    const res = await this.request("POST", `${this.prefix}/register`, req);
+    if (res.data && !isMfaChallenge(res.data)) {
+      const tp = res.data;
+      this.client.authStore.save(tp.access_token, tp.refresh_token, tp.user);
+      this._emitEvent("SIGNED_IN", tp.user, tp.access_token);
+    }
+    if (res.data && isMfaChallenge(res.data)) {
+      const mfa = res.data;
+      this._emitEvent("MFA_CHALLENGE", null, null, {
+        mfaToken: mfa.mfa_token,
+        mfaSetupRequired: mfa.mfa_setup_required
+      });
+    }
+    return res;
+  }
+  async signInWithPassword(req) {
+    const res = await this.request("POST", `${this.prefix}/login`, req);
+    if (res.data && !isMfaChallenge(res.data)) {
+      const tp = res.data;
+      this.client.authStore.save(tp.access_token, tp.refresh_token, tp.user);
+      this._emitEvent("SIGNED_IN", tp.user, tp.access_token);
+    }
+    if (res.data && isMfaChallenge(res.data)) {
+      const mfa = res.data;
+      this._emitEvent("MFA_CHALLENGE", null, null, {
+        mfaToken: mfa.mfa_token,
+        mfaSetupRequired: mfa.mfa_setup_required
+      });
+    }
+    return res;
+  }
+  async signInWithOAuth(provider, options) {
+    const params = new URLSearchParams();
+    params.set("project_id", this.client.projectId);
+    if (options?.redirectTo) params.set("redirect_uri", options.redirectTo);
+    if (options?.scopes) params.set("scopes", options.scopes);
+    if (options?.queryParams) {
+      for (const [k, v] of Object.entries(options.queryParams)) {
+        params.set(k, v);
+      }
+    }
+    if (options?.flowType === "pkce") {
+      if (typeof window !== "undefined" && !this.client.authStore.persistent) {
+        console.warn(
+          `[aurabase] PKCE (flowType:"pkce") requiert un store persistant (LocalAuthStore) pour que le code_verifier survive au redirect OAuth ; le store courant est en m\xE9moire \u2014 l'\xE9change \xE9chouera au retour.`
+        );
+      }
+      try {
+        const verifier = generateCodeVerifier();
+        const challenge = await codeChallengeS256(verifier);
+        this.client.authStore.setItem(this._pkceVerifierKey, verifier);
+        params.set("code_challenge", challenge);
+        params.set("code_challenge_method", "S256");
+      } catch {
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "pkce_generation_failed",
+              message: "PKCE: g\xE9n\xE9ration du code_verifier/challenge impossible (WebCrypto indisponible)"
+            }
+          })
+        };
+      }
+    } else {
+      if (typeof window !== "undefined" && !this.client.authStore.persistent) {
+        console.warn(
+          '[aurabase] S\xC9CURIT\xC9 : signInWithOAuth en flux implicit avec un store NON persistant (m\xE9moire) \u2014 le marqueur anti session-fixation ne survivra pas au redirect OAuth et la session ne sera pas adopt\xE9e au retour. Utilisez un LocalAuthStore, et pr\xE9f\xE9rez flowType:"pkce" (recommand\xE9, immunis\xE9 contre la session fixation).'
+        );
+      }
+      try {
+        this.client.authStore.setItem(this._oauthInitiatedKey, "1");
+      } catch {
+      }
+    }
+    const url = `${this.client.baseUrl}/v1/auth/oauth/${encodeURIComponent(provider)}/start?${params.toString()}`;
+    if (typeof window !== "undefined") {
+      window.location.href = url;
+    }
+    return { data: { url }, error: null };
+  }
+  async signInWithMagicLink(req) {
+    return this.request("POST", `${this.prefix}/magic-link`, req);
+  }
+  async signInAnonymously() {
+    const res = await this.request("POST", `${this.prefix}/anonymous`);
+    if (res.data) {
+      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
+      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
+    }
+    return res;
+  }
+  async signOut() {
+    const refreshToken = this.client.authStore.refreshToken;
+    if (!refreshToken) {
+      this.client.authStore.clear();
+      this._emitEvent("SIGNED_OUT", null, null);
+      return { data: null, error: null };
+    }
+    const res = await this.request("POST", `${this.prefix}/logout`, {
+      refresh_token: refreshToken
+    }, { skipAuthRefresh: true });
+    this.client.authStore.clear();
+    this._emitEvent("SIGNED_OUT", null, null);
+    return res;
+  }
+  // -- Session management -----------------------------------------------------
+  async refreshSession() {
+    const res = await refreshOnce(this.client);
+    if (res.data) {
+      this._emitEvent("TOKEN_REFRESHED", res.data.user, res.data.access_token);
+    }
+    return res;
+  }
+  /**
+   * Session courante lue depuis le store (synchrone en pratique, pas d'appel réseau).
+   *
+   * ÉCART DE FORME AVEC SUPABASE (LOT 3, 3.5, documenté — pas de breaking change) :
+   * `supabase-js` renvoie `AuraResponse`-like `{data:{session: Session|null}, error}`
+   * où `Session` regroupe `access_token`/`refresh_token`/`expires_at`/`user`. Ici,
+   * `getSession()` renvoie directement `{accessToken, user}` (pas d'enveloppe
+   * `{data, error}`, pas de `refreshToken`/`expiresAt`). Ce choix est délibéré :
+   * cette méthode ne fait aucune requête réseau et ne peut donc jamais échouer
+   * (`error` serait toujours `null`) — l'envelopper aurait été un contrat menteur.
+   * Le `refreshToken` n'est pas exposé pour éviter qu'un consommateur le manipule
+   * hors du store (contrairement à `accessToken`, souvent nécessaire pour des appels
+   * `fetch` manuels côté app). Pour la session complète, lire `client.authStore`
+   * directement (`.token`, `.refreshToken`, `.user`, `.isValid`).
+   */
+  async getSession() {
+    return {
+      accessToken: this.client.authStore.token,
+      user: this.client.authStore.user
+    };
+  }
+  async setSession(accessToken, refreshToken) {
+    const store = this.client.authStore;
+    const prev = { token: store.token, refreshToken: store.refreshToken, user: store.user };
+    const hadValidPrev = !!(prev.token && prev.refreshToken && prev.user && prev.user.id);
+    const restore = () => {
+      if (hadValidPrev) {
+        store.save(prev.token, prev.refreshToken, prev.user);
+      } else {
+        store.clear();
+      }
+    };
+    if (isTokenExpired(accessToken, 0)) {
+      store.save(accessToken, refreshToken, {});
+      const refreshed = await refreshOnce(this.client);
+      if (refreshed.data) {
+        this._emitEvent("SIGNED_IN", refreshed.data.user, refreshed.data.access_token);
+        return { data: refreshed.data.user, error: null };
+      }
+      restore();
+      return { data: null, error: refreshed.error };
+    }
+    store.save(accessToken, refreshToken, {});
+    const res = await this.request("GET", `${this.prefix}/user`);
+    if (res.data) {
+      store.save(accessToken, refreshToken, res.data);
+      this._emitEvent("SIGNED_IN", res.data, accessToken);
+      return res;
+    }
+    restore();
+    return res;
+  }
+  async exchangeCodeForSession(authCode, codeVerifier) {
+    return this._exchangeCode(authCode, codeVerifier, "SIGNED_IN");
+  }
+  /**
+   * Cœur de l'échange PKCE. `successEvent` détermine l'événement émis en cas de
+   * succès : `SIGNED_IN` (connexion normale) ou `PASSWORD_RECOVERY` (callback de
+   * récupération de mot de passe, `?code=…&type=recovery` — voir `_detectSessionInUrl`).
+   */
+  async _exchangeCode(authCode, codeVerifier, successEvent) {
+    const verifierKey = this._pkceVerifierKey;
+    const verifier = codeVerifier ?? this.client.authStore.getItem(verifierKey);
+    if (!verifier) {
+      return {
+        data: null,
+        error: new AuraError(0, {
+          error: { code: "no_code_verifier", message: "No PKCE code_verifier available (not provided and none stored)" }
+        })
+      };
+    }
+    try {
+      const res = await this.request("POST", `${this.prefix}/oauth/pkce`, {
+        auth_code: authCode,
+        code_verifier: verifier
+      });
+      if (res.data) {
+        this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
+        this._emitEvent(successEvent, res.data.user, res.data.access_token);
+      }
+      return res;
+    } finally {
+      this.client.authStore.removeItem(verifierKey);
+    }
+  }
+  async listSessions() {
+    const store = this.client.authStore;
+    if (store.token && store.refreshToken && !store.isValid) {
+      const refreshed = await this.refreshSession();
+      if (refreshed.error) {
+        return { data: null, error: refreshed.error };
+      }
+    }
+    const refreshToken = store.refreshToken;
+    return this.request("GET", `${this.prefix}/sessions`, void 0, {
+      headers: refreshToken ? { "x-refresh-token": refreshToken } : void 0
+    });
+  }
+  async revokeSession(sessionId) {
+    return this.request("DELETE", `${this.prefix}/sessions/${sessionId}`);
+  }
+  async revokeAllSessions() {
+    const rt = this.client.authStore.refreshToken;
+    if (!rt) {
+      return {
+        data: null,
+        error: new AuraError(0, { error: { code: "no_session", message: "No refresh token available" } })
+      };
+    }
+    const res = await this.request(
+      "POST",
+      `${this.prefix}/logout`,
+      { refresh_token: rt, scope: "global" },
+      { skipAuthRefresh: true }
+    );
+    if (!res.error) {
+      this.client.authStore.clear();
+      this._emitEvent("SIGNED_OUT", null, null);
+    }
+    return res;
+  }
+  // -- User management --------------------------------------------------------
+  /**
+   * Récupère l'utilisateur validé côté serveur.
+   *
+   * Sans argument : valide le token de la SESSION courante (`store.token`),
+   * avec refresh proactif — comportement historique.
+   *
+   * Avec `jwt` (LOT D) : valide le token ARBITRAIRE passé, via l'override
+   * `authToken` (`Authorization: Bearer <jwt>`), SANS toucher la session
+   * (`skipAuthRefresh`, aucun refresh ni retry-401 sur le store). Le backend
+   * applique l'isolation projet native : un token d'un AUTRE projet → 403.
+   */
+  async getUser(jwt) {
+    if (jwt !== void 0) {
+      return this.request("GET", `${this.prefix}/user`, void 0, {
+        authToken: jwt,
+        skipAuthRefresh: true
+      });
+    }
+    return this.request("GET", `${this.prefix}/user`);
+  }
+  /**
+   * Vérifie et décode les claims d'un JWT.
+   *
+   * Chemin nominal : vérification LOCALE via JWKS + WebCrypto, uniquement pour
+   * `alg ∈ {RS256, ES256}` (anti-alg-confusion : jamais de vérif locale HS256).
+   * Chemin fallback : `getUser()` (validation serveur) quand la vérif locale
+   * n'est pas applicable — `alg` non supporté (HS256), JWKS vide, aucune clé
+   * correspondante, ou fetch JWKS en échec. C'est le chemin nominal sur les
+   * déploiements HS256 (JWKS `{"keys":[]}`).
+   *
+   * FOREIGN-TOKEN (LOT D) : le fallback getUser valide le token RÉELLEMENT visé.
+   * Pour le token de session (no-arg, ou `jwt === authStore.token`), c'est
+   * `getUser()` (validation du token du store). Pour un `jwt` ÉTRANGER, c'est
+   * `getUser(jwt)` qui présente CE token en `Authorization` (override `authToken`,
+   * jamais celui du store) : le backend le valide et renvoie SON identité. Aucune
+   * misattribution possible — on présente exactement le token à vérifier — et
+   * l'isolation projet est native côté gateway (token d'un autre projet → 403,
+   * remonté en AuraError, jamais fabriqué).
+   *
+   * NOTE (fallback) : les claims renvoyées par le chemin fallback sont dérivées
+   * de `getUser()` (identité validée serveur) et NE contiennent PAS `exp`/`iat`
+   * (ni les autres champs temporels du JWT) — un consommateur ne doit pas se
+   * fier à `claims.exp` / `claims.iat` après un fallback. Seul le chemin de
+   * vérification locale RS256/ES256 renvoie les claims JWT complètes.
+   */
+  async getClaims(jwt, options) {
+    const token = jwt ?? this.client.authStore.token;
+    const usingStoreToken = jwt === void 0 || jwt === this.client.authStore.token;
+    if (!token) {
+      return {
+        data: null,
+        error: new AuraError(0, { error: { code: "no_session", message: "No JWT available" } })
+      };
+    }
+    const r = await verifyJwtLocal(this.client, this.client.fetchFn, this.client.baseUrl, token, {
+      allowExpired: options?.allowExpired,
+      // LOT 3 (I8) : relie le callback générique de jwks.ts au hook d'observabilité
+      // du client (onEvent/debug). jwks.ts reste sans dépendance vers @aurabase/core.
+      onEvent: (baseUrl) => emitAuraEvent(this.client.onEvent, this.client.debug, { kind: "jwks-fetch-failed", baseUrl })
+    });
+    const checkIssAud = (c) => {
+      if (options?.issuer !== void 0 && c.iss !== options.issuer) {
+        return new AuraError(0, {
+          error: { code: "invalid_issuer", message: `getClaims: issuer mismatch` }
+        });
+      }
+      if (options?.audience !== void 0) {
+        const aud = c.aud;
+        const audList = Array.isArray(aud) ? aud : aud !== void 0 ? [aud] : [];
+        if (!audList.includes(options.audience)) {
+          return new AuraError(0, {
+            error: { code: "invalid_audience", message: `getClaims: audience mismatch` }
+          });
+        }
+      }
+      return null;
+    };
+    if (r.ok) {
+      const claims = r.claims;
+      const issAudErr = checkIssAud(claims);
+      if (issAudErr) return { data: null, error: issAudErr };
+      const claimProject = claims.project_id;
+      if (typeof claimProject === "string" && claimProject !== this.client.projectId) {
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "project_isolation_violation",
+              message: `getClaims: token project mismatch (isolation)`
+            }
+          })
+        };
+      }
+      return { data: { claims, header: r.header }, error: null };
+    }
+    if (r.code === "unsupported_alg" || r.code === "no_matching_key" || r.code === "jwks_fetch_failed") {
+      let localPayload = {};
+      try {
+        localPayload = decodeJwt(token).payload;
+      } catch {
+      }
+      const issAudErr = checkIssAud(localPayload);
+      if (issAudErr) return { data: null, error: issAudErr };
+      if (options?.allowExpired && typeof localPayload.exp === "number" && localPayload.exp < Math.floor(Date.now() / 1e3)) {
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "allow_expired_unsupported_on_fallback",
+              message: "getClaims: allowExpired ne peut pas \xEAtre honor\xE9 sur le chemin de validation serveur (fallback HS256/JWKS)"
+            }
+          })
+        };
+      }
+      const u = usingStoreToken ? await this.getUser() : await this.getUser(token);
+      if (u.data) {
+        let realAlg = "unknown";
+        try {
+          realAlg = decodeJwt(token).header.alg ?? "unknown";
+        } catch {
+        }
+        return {
+          data: {
+            // Claims dérivées de getUser : PAS de `exp`/`iat` (voir JwtClaims/JSDoc).
+            // `exp`/`iat` étant optionnels, plus de `as unknown as` masquant l'absence.
+            claims: { ...u.data, sub: u.data.id },
+            header: { alg: realAlg }
+          },
+          error: null
+        };
+      }
+      return { data: null, error: u.error };
+    }
+    return {
+      data: null,
+      error: new AuraError(0, { error: { code: r.code, message: `getClaims: ${r.code}` } })
+    };
+  }
+  async deleteUser(password) {
+    const res = await this.request("DELETE", `${this.prefix}/user`, { password });
+    if (!res.error) {
+      this.client.authStore.clear();
+      this._emitEvent("SIGNED_OUT", null, null);
+    }
+    return res;
+  }
+  async updateUser(req) {
+    const res = await this.request("PUT", `${this.prefix}/user`, req);
+    if (res.data) {
+      const store = this.client.authStore;
+      if (store.token && store.refreshToken) {
+        store.save(store.token, store.refreshToken, res.data);
+      }
+      this._emitEvent("USER_UPDATED", res.data, this.client.authStore.token);
+    }
+    return res;
+  }
+  // -- Password recovery ------------------------------------------------------
+  async resetPasswordForEmail(req) {
+    return this.request("POST", `${this.prefix}/forgot-password`, req);
+  }
+  async updatePassword(newPassword, currentPassword) {
+    const res = await this.request("PUT", `${this.prefix}/user`, {
+      password: newPassword,
+      current_password: currentPassword
+    });
+    if (!res.error) {
+      this.client.authStore.clear();
+      this._emitEvent("SIGNED_OUT", null, null);
+    }
+    return res;
+  }
+  // -- MFA --------------------------------------------------------------------
+  async mfaEnroll() {
+    return this.request("POST", `${this.prefix}/mfa/setup`);
+  }
+  async mfaVerifySetup(code) {
+    return this.request("POST", `${this.prefix}/mfa/setup/verify`, { code });
+  }
+  async mfaVerify(req) {
+    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, req);
+    if (res.data) {
+      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
+      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
+    }
+    return res;
+  }
+  async mfaUnenroll(password) {
+    return this.request("POST", `${this.prefix}/mfa/disable`, { password });
+  }
+  async verifyOtp(params) {
+    switch (params.type) {
+      case "signup":
+        return this._verifyToTokenPair(`${this.prefix}/verify-email`, { token: params.token });
+      case "magiclink":
+        return this._verifyToTokenPair(`${this.prefix}/magic-link/verify`, { token: params.token });
+      case "email":
+        return this._verifyToTokenPair(`${this.prefix}/email-otp/verify`, {
+          email: params.email,
+          code: params.token
+        });
+      case "sms":
+        return this._verifyToTokenPair(`${this.prefix}/sms/verify`, {
+          phone: params.phone,
+          code: params.token
+        });
+      case "recovery": {
+        if (!params.password) {
+          return {
+            data: null,
+            error: new AuraError(0, {
+              error: {
+                code: "missing_password",
+                message: "verifyOtp({ type: 'recovery' }) exige `password` : le backend fusionne consommation du token et changement de mot de passe."
+              }
+            })
+          };
+        }
+        return this._verifyToTokenPair(`${this.prefix}/reset-password`, {
+          token: params.token,
+          password: params.password
+        });
+      }
+      case "email_change": {
+        const res = await this.request("POST", `${this.prefix}/user/confirm-email-change`, {
+          token: params.token
+        });
+        if (res.data) {
+          const store = this.client.authStore;
+          if (store.token && store.refreshToken) {
+            store.save(store.token, store.refreshToken, res.data);
+          }
+          this._emitEvent("USER_UPDATED", res.data, this.client.authStore.token);
+        }
+        return res;
+      }
+      case "invite":
+      case "phone_change":
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: {
+              code: "otp_type_unsupported",
+              message: `verifyOtp: le type '${params.type}' n'est pas support\xE9 (aucun endpoint backend).`
+            }
+          })
+        };
+      default:
+        return {
+          data: null,
+          error: new AuraError(0, {
+            error: { code: "otp_type_unsupported", message: "verifyOtp: type OTP inconnu." }
+          })
+        };
+    }
+  }
+  /**
+   * Helper commun aux vérifications OTP renvoyant une `TokenPair` : appelle
+   * l'endpoint, puis (succès) sauvegarde la session et émet `SIGNED_IN`.
+   */
+  async _verifyToTokenPair(path, body) {
+    const res = await this.request("POST", path, body);
+    if (res.data) {
+      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
+      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
+    }
+    return res;
+  }
+  // -- Email verification -----------------------------------------------------
+  /** Rétrocompat : délègue à `verifyOtp({ type: 'signup' })` (POST /verify-email). */
+  async verifyEmail(token) {
+    return this.verifyOtp({ type: "signup", token });
+  }
+  async resendVerificationEmail(email) {
+    const e = email ?? this.client.authStore.user?.email;
+    if (!e) {
+      return {
+        data: null,
+        error: new AuraError(0, { error: { code: "missing_email", message: "Email is required" } })
+      };
+    }
+    return this.request("POST", `${this.prefix}/resend-verification`, { email: e });
+  }
+  // -- Email OTP (Phase 2) --------------------------------------------------
+  async signInWithEmailOtp(email) {
+    return this.request("POST", `${this.prefix}/email-otp/send`, { email });
+  }
+  /** Rétrocompat : délègue à `verifyOtp({ type: 'email' })` (POST /email-otp/verify). */
+  async verifyEmailOtp(email, code) {
+    return this.verifyOtp({ type: "email", email, token: code });
+  }
+  // -- SMS OTP (Phase 2) ----------------------------------------------------
+  async signInWithSmsOtp(phone) {
+    return this.request("POST", `${this.prefix}/sms/send`, { phone });
+  }
+  /** Rétrocompat : délègue à `verifyOtp({ type: 'sms' })` (POST /sms/verify). */
+  async verifySmsOtp(phone, code) {
+    return this.verifyOtp({ type: "sms", phone, token: code });
+  }
+  // -- Identity linking (Phase 2) -------------------------------------------
+  async listIdentities() {
+    return this.request("GET", `${this.prefix}/user/identities`);
+  }
+  async linkIdentity(provider) {
+    return this.request("POST", `${this.prefix}/user/identities/link/${provider}`);
+  }
+  async unlinkIdentity(identityId) {
+    return this.request("DELETE", `${this.prefix}/user/identities/${identityId}`);
+  }
+  // -- Email change (Phase 2) -----------------------------------------------
+  /**
+   * Rétrocompat : délègue à `verifyOtp({ type: 'email_change' })`.
+   * CHANGEMENT ASSUMÉ (parité) : émet désormais `USER_UPDATED` (auparavant aucun
+   * événement) — voir CHANGELOG.
+   */
+  async confirmEmailChange(token) {
+    return this.verifyOtp({ type: "email_change", token });
+  }
+  // -- MFA recovery codes (Phase 2) -----------------------------------------
+  async regenerateRecoveryCodes(code) {
+    return this.request("POST", `${this.prefix}/mfa/recovery-codes/regenerate`, { code });
+  }
+  // -- Native mobile OAuth (Phase 2) ----------------------------------------
+  async signInWithIdToken(provider, idToken, accessToken) {
+    const res = await this.request("POST", `${this.prefix}/token`, {
+      provider,
+      id_token: idToken,
+      access_token: accessToken
+    });
+    if (res.data) {
+      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
+      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
+    }
+    return res;
+  }
+  // -- Project settings / public config --------------------------------------
+  /** GoTrue parity : GET /settings — config publique du projet (pas d'auth requise). */
+  async getSettings() {
+    return this.request("GET", `${this.prefix}/settings`);
+  }
+  /** Clé publiable (anon key) du projet — GET /anon-key (public, à l'image du modèle Supabase). */
+  async getAnonKey() {
+    return this.request("GET", `${this.prefix}/anon-key`);
+  }
+  // -- Password recovery (token consumption) ----------------------------------
+  /**
+   * Consomme le token de récupération de mot de passe et applique le nouveau mot de passe.
+   * Body confirmé au handler (`ResetPasswordRequest` — services/aura-auth/src/handlers/auth.rs) :
+   * `{ token, password }`. Révoque les anciennes sessions et renvoie une nouvelle TokenPair.
+   */
+  async resetPassword(token, newPassword) {
+    return this.verifyOtp({ type: "recovery", token, password: newPassword });
+  }
+  // -- Anonymous promotion -----------------------------------------------------
+  /**
+   * Convertit l'utilisateur anonyme courant (JWT requis) en compte régulier email+password.
+   * Body confirmé au handler (`PromoteAnonymousRequest`) : `{ email, password }`.
+   */
+  async promoteAnonymous(credentials) {
+    const res = await this.request("POST", `${this.prefix}/anonymous/promote`, credentials);
+    if (res.data) {
+      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
+      this._emitEvent("USER_UPDATED", res.data.user, res.data.access_token);
+    }
+    return res;
+  }
+  // -- Magic link verification -------------------------------------------------
+  /**
+   * Consomme le token de magic link et renvoie une TokenPair.
+   * Body confirmé au handler (`VerifyMagicLinkRequest`) : `{ token }`.
+   */
+  async verifyMagicLink(token) {
+    return this.verifyOtp({ type: "magiclink", token });
+  }
+};
+var AuthAdminService = class extends BaseService {
+  get prefix() {
+    return `/v1/auth/${this.client.projectId}/admin`;
+  }
+  // -- Users ----------------------------------------------------------------
+  async listUsers(params) {
+    const query = new URLSearchParams();
+    if (params?.limit !== void 0) query.set("limit", String(params.limit));
+    if (params?.offset !== void 0) query.set("offset", String(params.offset));
+    if (params?.search) query.set("search", params.search);
+    const qs = query.toString();
+    return this.request("GET", `${this.prefix}/users${qs ? "?" + qs : ""}`);
+  }
+  async getUser(userId) {
+    return this.request("GET", `${this.prefix}/users/${userId}`);
+  }
+  async createUser(data) {
+    return this.request("POST", `${this.prefix}/users`, data);
+  }
+  async updateUser(userId, data) {
+    return this.request("PUT", `${this.prefix}/users/${userId}`, data);
+  }
+  async deleteUser(userId) {
+    return this.request("DELETE", `${this.prefix}/users/${userId}`);
+  }
+  async banUser(userId) {
+    return this.request("POST", `${this.prefix}/users/${userId}/ban`, {});
+  }
+  async unbanUser(userId) {
+    return this.request("POST", `${this.prefix}/users/${userId}/unban`, {});
+  }
+  async generateLink(userId, type) {
+    return this.request("POST", `${this.prefix}/users/${userId}/generate-link`, { type });
+  }
+  async getUserStats() {
+    return this.request("GET", `${this.prefix}/users/stats`);
+  }
+  async listUserIdentities(userId) {
+    return this.request("GET", `${this.prefix}/users/${userId}/identities`);
+  }
+  // -- Sessions ---------------------------------------------------------------
+  async listSessions(params) {
+    const query = new URLSearchParams();
+    if (params?.userId !== void 0) query.set("user_id", params.userId);
+    if (params?.limit !== void 0) query.set("limit", String(params.limit));
+    if (params?.offset !== void 0) query.set("offset", String(params.offset));
+    const qs = query.toString();
+    return this.request("GET", `${this.prefix}/sessions${qs ? "?" + qs : ""}`);
+  }
+  async revokeSession(sessionId) {
+    return this.request("DELETE", `${this.prefix}/sessions/${sessionId}`);
+  }
+  // -- Audit log ------------------------------------------------------------
+  async getAuditLog(params) {
+    const query = new URLSearchParams();
+    if (params?.userId !== void 0) query.set("user_id", params.userId);
+    if (params?.limit !== void 0) query.set("limit", String(params.limit));
+    if (params?.offset !== void 0) query.set("offset", String(params.offset));
+    const qs = query.toString();
+    return this.request("GET", `${this.prefix}/audit-log${qs ? "?" + qs : ""}`);
+  }
+  // -- Settings -------------------------------------------------------------
+  async getSettings() {
+    return this.request("GET", `${this.prefix}/settings`);
+  }
+  async updateSettings(data) {
+    return this.request("PUT", `${this.prefix}/settings`, data);
+  }
+  // -- Email templates ------------------------------------------------------
+  async listEmailTemplates() {
+    return this.request("GET", `${this.prefix}/email-templates`);
+  }
+  async getEmailTemplate(type) {
+    return this.request("GET", `${this.prefix}/email-templates/${type}`);
+  }
+  async updateEmailTemplate(type, data) {
+    return this.request("PUT", `${this.prefix}/email-templates/${type}`, data);
+  }
+  async deleteEmailTemplate(type) {
+    return this.request("DELETE", `${this.prefix}/email-templates/${type}`);
+  }
+  async testEmailTemplate(type, body) {
+    return this.request("POST", `${this.prefix}/email-templates/${type}/test`, body);
+  }
+};
+
+export { AuthAdminService, AuthService, SessionManager, isMfaChallenge };