@ciridae/auth 0.1.2 → 0.3.0

package/dist/createCiridaeAuth.js

@@ -1,5 +1,5 @@
 import { getApps, initializeApp } from "firebase/app";
-import { getAuth, inMemoryPersistence, onAuthStateChanged, setPersistence, signInWithCustomToken, signOut as firebaseSignOut, } from "firebase/auth";
+import { getAuth, onAuthStateChanged, signInWithCustomToken, signOut as firebaseSignOut, } from "firebase/auth";
 import { AuthenticatedUserSchema } from "./authenticatedUser.js";
 import { buildCiridaeSignInUrl, buildCiridaeSignOutUrl, } from "./authServiceUrls.js";
 const FIREBASE_APP_NAME = "ciridae-browser-auth";
@@ -8,7 +8,8 @@ const LOCAL_DEVELOPMENT_USER = AuthenticatedUserSchema.parse({
     displayName: "Local Developer",
     email: "dev-only-auth-bypass@ciridae.dev",
     emailVerified: true,
-    photoURL: null,
+    // A fixture photo for local auth bypass, never used for Firebase sessions.
+    photoURL: "https://images.unsplash.com/photo-1472099645785-5658abf4ff4e?auto=format&fit=crop&w=96&h=96&q=80",
     uid: LOCAL_DEVELOPMENT_TOKEN,
 });
 export function createCiridaeAuth(configuration) {
@@ -84,9 +85,7 @@ function createFirebaseAuth(identityConfiguration, authServiceConfiguration) {
                 : null;
         },
         async subscribe(onAuthenticatedUser) {
-            const firebaseAuth = getFirebaseAuth();
-            await setPersistence(firebaseAuth, inMemoryPersistence);
-            return onAuthStateChanged(firebaseAuth, (user) => {
+            return onAuthStateChanged(getFirebaseAuth(), (user) => {
                 onAuthenticatedUser(user ? AuthenticatedUserSchema.parse(user) : null);
             });
         },

package/dist/entries/client.d.ts

@@ -2,3 +2,4 @@ export * from "../authenticatedUser.js";
 export { parseSameOriginPath } from "../authServiceUrls.js";
 export * from "../authSession.js";
 export * from "../createCiridaeAuth.js";
+export * from "../principal.js";

package/dist/entries/client.js

@@ -2,3 +2,4 @@ export * from "../authenticatedUser.js";
 export { parseSameOriginPath } from "../authServiceUrls.js";
 export * from "../authSession.js";
 export * from "../createCiridaeAuth.js";
+export * from "../principal.js";

package/dist/principal.d.ts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+/**
+ * The signed-in user's role and permissions as the app's own backend returns them.
+ * Matches `ciridae.auth.Principal`; use it to hide actions, never to authorize.
+ */
+export declare const PrincipalSchema: z.ZodObject<{
+    email: z.core.$ZodBranded<z.ZodEmail, "UserEmail", "out">;
+    metadata: z.ZodRecord<z.ZodString, z.ZodJSONSchema>;
+    name: z.ZodNullable<z.ZodString>;
+    picture_url: z.ZodNullable<z.ZodString>;
+    organization_id: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+    role: z.ZodString;
+    user_id: z.core.$ZodBranded<z.ZodString, "FirebaseUid", "out">;
+}, z.core.$strip>;
+export type Principal = z.infer<typeof PrincipalSchema>;
+/**
+ * Whether the principal's role carries a permission slug. Pass the project's
+ * generated `Permission` union as the type argument to type-check slugs:
+ * `can<Permission>(principal, "invoices:approve")`.
+ */
+export declare function can<Permission extends string = string>(principal: Principal, permission: NoInfer<Permission>): boolean;

package/dist/principal.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { FirebaseUidSchema, UserEmailSchema } from "./authenticatedUser.js";
+/**
+ * The signed-in user's role and permissions as the app's own backend returns them.
+ * Matches `ciridae.auth.Principal`; use it to hide actions, never to authorize.
+ */
+export const PrincipalSchema = z.object({
+    email: UserEmailSchema,
+    metadata: z.record(z.string(), z.json()),
+    name: z.string().nullable(),
+    picture_url: z.string().nullable(),
+    organization_id: z.string(),
+    permissions: z.array(z.string()),
+    role: z.string(),
+    user_id: FirebaseUidSchema,
+});
+/**
+ * Whether the principal's role carries a permission slug. Pass the project's
+ * generated `Permission` union as the type argument to type-check slugs:
+ * `can<Permission>(principal, "invoices:approve")`.
+ */
+export function can(principal, permission) {
+    return principal.permissions.includes(permission);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ciridae/auth",
-	"version": "0.1.2",
+	"version": "0.3.0",
 	"type": "module",
 	"private": false,
 	"engines": {