@coreiam/auth 1.0.6 → 1.0.8

package/dist/nextjs/actions.js

@@ -8,7 +8,24 @@ exports.logoutActionSdk = logoutActionSdk;
 const react_1 = require("react");
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
-const iam = new core_1.CoreIAM();
+// FIX: lazy singleton instead of `const iam = new CoreIAM();` at module
+// scope. The constructor throws if COREIAM_API_KEY/COREIAM_API_URL are
+// missing — fine on the server, where those env vars exist — but a
+// module-level throw happens the instant the module is evaluated, before
+// any function in it is even called. If this module's 'use server'
+// boundary is ever not recognized correctly by the bundler (see the note
+// on the browser error below), the real module gets included in the client
+// bundle instead of being swapped for action-reference stubs, and that
+// throw fires in the browser instead, where those env vars are never
+// defined. Making this lazy doesn't fix a lost 'use server' boundary by
+// itself, but it does mean import alone can never crash — only an actual
+// invocation can, which is strictly better either way.
+let _iam = null;
+function getIam() {
+    if (!_iam)
+        _iam = new core_1.CoreIAM();
+    return _iam;
+}
 async function syncCookiesToNext(response) {
     const cookieStore = await (0, headers_1.cookies)();
     const setCookies = response.headers.getSetCookie();
@@ -76,7 +93,7 @@ async function syncCookiesToNext(response) {
 // bug to work around.
 exports.getSession = (0, react_1.cache)(async () => {
     const reqHeaders = await (0, headers_1.headers)();
-    const response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
+    const response = await getIam().proxy('/auth/profile', { method: 'GET' }, reqHeaders);
     if (!response.ok)
         return null;
     const coreIamIdentity = await response.json();
@@ -87,7 +104,7 @@ exports.getSession = (0, react_1.cache)(async () => {
 async function loginActionSdk(identifier, password) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
-        const response = await iam.loginWithCsrfProtection(identifier, password, reqHeaders);
+        const response = await getIam().loginWithCsrfProtection(identifier, password, reqHeaders);
         await syncCookiesToNext(response);
         return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
     }
@@ -98,7 +115,7 @@ async function loginActionSdk(identifier, password) {
 async function registerActionSdk(userData) {
     const reqHeaders = await (0, headers_1.headers)();
     try {
-        const response = await iam.registerWithCsrfProtection(userData, reqHeaders);
+        const response = await getIam().registerWithCsrfProtection(userData, reqHeaders);
         await syncCookiesToNext(response);
         return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
     }
@@ -109,7 +126,7 @@ async function registerActionSdk(userData) {
 async function logoutActionSdk() {
     const reqHeaders = await (0, headers_1.headers)();
     try {
-        const response = await iam.logout(reqHeaders);
+        const response = await getIam().logout(reqHeaders);
         await syncCookiesToNext(response);
         return { ok: response.ok, status: response.status, data: await response.json().catch(() => ({})) };
     }

package/dist/nextjs/provider.js

@@ -16,9 +16,9 @@ const AuthContext = (0, react_1.createContext)({
     register: async () => ({ error: 'CoreIAMProvider is not mounted' }),
     refetchIdentity: async () => { },
 });
-function CoreIAMProvider({ children, initialIdentity = null, redirects = {}, }) {
-    const [identity, setIdentity] = (0, react_1.useState)(initialIdentity);
-    const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === null);
+function CoreIAMProvider({ children, initialIdentity, redirects = {}, }) {
+    const [identity, setIdentity] = (0, react_1.useState)(initialIdentity ?? null);
+    const [isLoading, setIsLoading] = (0, react_1.useState)(initialIdentity === undefined);
     const router = (0, navigation_1.useRouter)();
     const refetchIdentity = async () => {
         try {
@@ -33,7 +33,16 @@ function CoreIAMProvider({ children, initialIdentity = null, redirects = {}, })
         }
     };
     (0, react_1.useEffect)(() => {
-        if (initialIdentity === null) {
+        // FIX: was `initialIdentity === null`, which can't tell "SSR ran and
+        // confirmed you're logged out" (a correct, final null) apart from "no
+        // SSR value was ever provided" (a real undefined). Since layout.tsx
+        // always calls getSession() and passes its result — even when that
+        // result legitimately is null — every logged-out page view was
+        // treated as "no SSR value, fetch again," firing a second, wholly
+        // redundant /auth/profile call for something SSR had already
+        // determined. undefined (the prop genuinely omitted) is the only case
+        // that should trigger this fallback fetch.
+        if (initialIdentity === undefined) {
             refetchIdentity();
         }
         else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {