@blackcode_sa/metaestetics-api 1.12.16 → 1.12.17

package/dist/index.js

@@ -10352,6 +10352,34 @@ var AuthService = class extends BaseService {
   async signInWithGoogleIdToken(idToken, initialRole = "patient" /* PATIENT */) {
     try {
       console.log("[AUTH] Signing in with Google ID Token");
+      let email;
+      try {
+        const payloadBase64 = idToken.split(".")[1];
+        const payloadJson = globalThis.atob ? globalThis.atob(payloadBase64) : Buffer.from(payloadBase64, "base64").toString("utf8");
+        const payload = JSON.parse(payloadJson);
+        email = payload.email;
+      } catch (decodeError) {
+        console.warn("[AUTH] Failed to decode email from Google ID token:", decodeError);
+      }
+      if (!email) {
+        throw new AuthError(
+          "Unable to read email from Google token. Please try again or use another sign-in method.",
+          "AUTH/INVALID_GOOGLE_TOKEN",
+          400
+        );
+      }
+      const methods = await (0, import_auth7.fetchSignInMethodsForEmail)(this.auth, email);
+      console.log("[AUTH] Fetch sign in methods for email:", email, methods);
+      const hasGoogleMethod = methods.includes(import_auth7.GoogleAuthProvider.GOOGLE_SIGN_IN_METHOD);
+      console.log("[AUTH] Has Google method:", hasGoogleMethod);
+      if (!hasGoogleMethod) {
+        console.log("[AUTH] No existing Google credential for email, aborting login:", email);
+        throw new AuthError(
+          "No account found for this Google user. Please complete registration first.",
+          "AUTH/USER_NOT_FOUND",
+          404
+        );
+      }
       const credential = import_auth7.GoogleAuthProvider.credential(idToken);
       const { user: firebaseUser } = await (0, import_auth7.signInWithCredential)(this.auth, credential);
       console.log("[AUTH] Firebase user signed in:", firebaseUser.uid);
@@ -10360,7 +10388,7 @@ var AuthService = class extends BaseService {
         console.log("[AUTH] Existing user found, returning profile:", existingUser.uid);
         return existingUser;
       }
-      console.log("[AUTH] No existing user found for Google account:", firebaseUser.email);
+      console.log("[AUTH] No existing MetaEstetics user for Google account \u2013 signing out.");
       await (0, import_auth7.signOut)(this.auth);
       throw new AuthError(
         'No account found. Please complete registration by starting with "Get Started".',

package/dist/index.mjs

@@ -1798,6 +1798,7 @@ import {
   sendPasswordResetEmail,
   verifyPasswordResetCode,
   confirmPasswordReset,
+  fetchSignInMethodsForEmail as fetchSignInMethodsForEmail2,
   signInWithCredential
 } from "firebase/auth";
 import {
@@ -10456,6 +10457,34 @@ var AuthService = class extends BaseService {
   async signInWithGoogleIdToken(idToken, initialRole = "patient" /* PATIENT */) {
     try {
       console.log("[AUTH] Signing in with Google ID Token");
+      let email;
+      try {
+        const payloadBase64 = idToken.split(".")[1];
+        const payloadJson = globalThis.atob ? globalThis.atob(payloadBase64) : Buffer.from(payloadBase64, "base64").toString("utf8");
+        const payload = JSON.parse(payloadJson);
+        email = payload.email;
+      } catch (decodeError) {
+        console.warn("[AUTH] Failed to decode email from Google ID token:", decodeError);
+      }
+      if (!email) {
+        throw new AuthError(
+          "Unable to read email from Google token. Please try again or use another sign-in method.",
+          "AUTH/INVALID_GOOGLE_TOKEN",
+          400
+        );
+      }
+      const methods = await fetchSignInMethodsForEmail2(this.auth, email);
+      console.log("[AUTH] Fetch sign in methods for email:", email, methods);
+      const hasGoogleMethod = methods.includes(GoogleAuthProvider.GOOGLE_SIGN_IN_METHOD);
+      console.log("[AUTH] Has Google method:", hasGoogleMethod);
+      if (!hasGoogleMethod) {
+        console.log("[AUTH] No existing Google credential for email, aborting login:", email);
+        throw new AuthError(
+          "No account found for this Google user. Please complete registration first.",
+          "AUTH/USER_NOT_FOUND",
+          404
+        );
+      }
       const credential = GoogleAuthProvider.credential(idToken);
       const { user: firebaseUser } = await signInWithCredential(this.auth, credential);
       console.log("[AUTH] Firebase user signed in:", firebaseUser.uid);
@@ -10464,7 +10493,7 @@ var AuthService = class extends BaseService {
         console.log("[AUTH] Existing user found, returning profile:", existingUser.uid);
         return existingUser;
       }
-      console.log("[AUTH] No existing user found for Google account:", firebaseUser.email);
+      console.log("[AUTH] No existing MetaEstetics user for Google account \u2013 signing out.");
       await firebaseSignOut(this.auth);
       throw new AuthError(
         'No account found. Please complete registration by starting with "Get Started".',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@blackcode_sa/metaestetics-api",
   "private": false,
-  "version": "1.12.16",
+  "version": "1.12.17",
   "description": "Firebase authentication service with anonymous upgrade support",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/src/services/auth/auth.service.ts

@@ -883,23 +883,58 @@ export class AuthService extends BaseService {
   ): Promise<User> {
     try {
       console.log('[AUTH] Signing in with Google ID Token');
+
+      // 1) Extract the email claim from the raw JWT so we can check Auth records *before* sign-in
+      let email: string | undefined;
+      try {
+        const payloadBase64 = idToken.split('.')[1];
+        const payloadJson = globalThis.atob
+          ? globalThis.atob(payloadBase64)
+          : Buffer.from(payloadBase64, 'base64').toString('utf8');
+        const payload = JSON.parse(payloadJson);
+        email = payload.email as string | undefined;
+      } catch (decodeError) {
+        console.warn('[AUTH] Failed to decode email from Google ID token:', decodeError);
+      }
+
+      if (!email) {
+        throw new AuthError(
+          'Unable to read email from Google token. Please try again or use another sign-in method.',
+          'AUTH/INVALID_GOOGLE_TOKEN',
+          400,
+        );
+      }
+
+      // 2) Check if this email already has a Google credential in Firebase Auth.
+      //    If not, abort early so we *never* create an unwanted Auth user.
+      const methods = await fetchSignInMethodsForEmail(this.auth, email);
+      console.log('[AUTH] Fetch sign in methods for email:', email, methods);
+      const hasGoogleMethod = methods.includes(GoogleAuthProvider.GOOGLE_SIGN_IN_METHOD);
+      console.log('[AUTH] Has Google method:', hasGoogleMethod);
+      if (!hasGoogleMethod) {
+        console.log('[AUTH] No existing Google credential for email, aborting login:', email);
+        throw new AuthError(
+          'No account found for this Google user. Please complete registration first.',
+          'AUTH/USER_NOT_FOUND',
+          404,
+        );
+      }
+
+      // 3) Safe to sign-in – we know the credential belongs to an existing Auth account.
       const credential = GoogleAuthProvider.credential(idToken);
       const { user: firebaseUser } = await signInWithCredential(this.auth, credential);
       console.log('[AUTH] Firebase user signed in:', firebaseUser.uid);
 
-      // Check if the user already has a profile in our database
+      // 4) Load our domain user document.
       const existingUser = await this.userService.getUserById(firebaseUser.uid);
       if (existingUser) {
         console.log('[AUTH] Existing user found, returning profile:', existingUser.uid);
         return existingUser;
       }
 
-      // If no profile exists, reject the login - user must complete onboarding first
-      console.log('[AUTH] No existing user found for Google account:', firebaseUser.email);
-
-      // Sign out the Firebase user since we don't allow auto-registration
+      // 5) If no profile exists we sign out immediately and error – but crucially no phantom user was created.
+      console.log('[AUTH] No existing MetaEstetics user for Google account – signing out.');
       await firebaseSignOut(this.auth);
-
       throw new AuthError(
         'No account found. Please complete registration by starting with "Get Started".',
         'AUTH/USER_NOT_FOUND',