@depup/supabase__auth-js 2.103.0-depup.0 → 2.110.8-depup.0

package/src/lib/constants.ts

@@ -12,6 +12,15 @@ export const AUTO_REFRESH_TICK_THRESHOLD = 3
  */
 export const EXPIRY_MARGIN_MS = AUTO_REFRESH_TICK_THRESHOLD * AUTO_REFRESH_TICK_DURATION_MS
 
+/**
+ * After a refresh fails, serial callers (including the next auto-refresh
+ * tick) within this window receive the cached failure instead of firing
+ * another /token request. Two ticks: each outage burns at most one /token
+ * call per cooldown window. Cleared on any successful refresh (locally or
+ * via BroadcastChannel from another tab) and on `_removeSession`.
+ */
+export const REFRESH_FAILURE_COOLDOWN_MS = 2 * AUTO_REFRESH_TICK_DURATION_MS
+
 export const GOTRUE_URL = 'http://localhost:9999'
 export const STORAGE_KEY = 'supabase.auth.token'
 export const AUDIENCE = ''

package/src/lib/errors.ts

@@ -16,7 +16,7 @@ export class AuthError extends Error {
    * Error code associated with the error. Most errors coming from
    * HTTP responses will have a code, though some errors that occur
    * before a response is received will not have one present. In that
-   * case {@link #status} will also be undefined.
+   * case {@link AuthError.status} will also be undefined.
    */
   code: ErrorCode | (string & {}) | undefined
 
@@ -31,6 +31,20 @@ export class AuthError extends Error {
     this.status = status
     this.code = code
   }
+
+  toJSON(): {
+    name: string
+    message: string
+    status: number | undefined
+    code: ErrorCode | (string & {}) | undefined
+  } {
+    return {
+      name: this.name,
+      message: this.message,
+      status: this.status,
+      code: this.code,
+    }
+  }
 }
 
 export function isAuthError(error: unknown): error is AuthError {
@@ -179,11 +193,15 @@ export class AuthImplicitGrantRedirectError extends CustomAuthError {
     this.details = details
   }
 
-  toJSON() {
+  toJSON(): {
+    name: string
+    message: string
+    status: number | undefined
+    code: ErrorCode | (string & {}) | undefined
+    details: { error: string; code: string } | null
+  } {
     return {
-      name: this.name,
-      message: this.message,
-      status: this.status,
+      ...super.toJSON(),
       details: this.details,
     }
   }
@@ -213,11 +231,15 @@ export class AuthPKCEGrantCodeExchangeError extends CustomAuthError {
     this.details = details
   }
 
-  toJSON() {
+  toJSON(): {
+    name: string
+    message: string
+    status: number | undefined
+    code: ErrorCode | (string & {}) | undefined
+    details: { error: string; code: string } | null
+  } {
     return {
-      name: this.name,
-      message: this.message,
-      status: this.status,
+      ...super.toJSON(),
       details: this.details,
     }
   }
@@ -275,6 +297,38 @@ export function isAuthRetryableFetchError(error: unknown): error is AuthRetryabl
   return isAuthError(error) && error.name === 'AuthRetryableFetchError'
 }
 
+/**
+ * Returned when the server rotated a refresh token successfully but the
+ * client chose not to persist the rotated tokens because the local session
+ * changed mid-flight. Usually means a concurrent `signOut` cleared storage
+ * between when the refresh started and when it came back.
+ *
+ * Set on the `error` field of the refresh result so callers can tell "we
+ * got rotated tokens but threw them away" apart from "the refresh failed."
+ * The rotated session on the server will be picked up on the next refresh
+ * via GoTrue's parent-of-active path.
+ *
+ * @example
+ * ```ts
+ * import { isAuthRefreshDiscardedError } from '@supabase/auth-js'
+ *
+ * if (isAuthRefreshDiscardedError(error)) {
+ *   // Concurrent signOut/sign-in raced our refresh. Treat as a no-op.
+ * }
+ * ```
+ */
+export class AuthRefreshDiscardedError extends CustomAuthError {
+  constructor(
+    message = 'Refresh result discarded: session state changed mid-flight (e.g., concurrent signOut)'
+  ) {
+    super(message, 'AuthRefreshDiscardedError', 409, undefined)
+  }
+}
+
+export function isAuthRefreshDiscardedError(error: unknown): error is AuthRefreshDiscardedError {
+  return isAuthError(error) && error.name === 'AuthRefreshDiscardedError'
+}
+
 /**
  * This error is thrown on certain methods when the password used is deemed
  * weak. Inspect the reasons to identify what password strength rules are
@@ -301,6 +355,19 @@ export class AuthWeakPasswordError extends CustomAuthError {
 
     this.reasons = reasons
   }
+
+  toJSON(): {
+    name: string
+    message: string
+    status: number | undefined
+    code: ErrorCode | (string & {}) | undefined
+    reasons: WeakPasswordReasons[]
+  } {
+    return {
+      ...super.toJSON(),
+      reasons: this.reasons,
+    }
+  }
 }
 
 export function isAuthWeakPasswordError(error: unknown): error is AuthWeakPasswordError {

package/src/lib/fetch.ts

@@ -3,11 +3,13 @@ import { expiresAt, looksLikeFetchResponse, parseResponseAPIVersion } from './he
 import {
   AuthResponse,
   AuthResponsePassword,
+  Session,
   SSOResponse,
   GenerateLinkProperties,
   GenerateLinkResponse,
   User,
   UserResponse,
+  WeakPassword,
 } from './types'
 import {
   AuthApiError,
@@ -19,6 +21,30 @@ import {
 
 export type Fetch = typeof fetch
 
+/** Raw session data from GoTrue server response. */
+interface GoTrueSessionData {
+  access_token?: string
+  refresh_token?: string
+  expires_in?: number
+  expires_at?: number
+  user?: User
+  [key: string]: any // server returns additional fields (token_type, provider_token, etc.) copied into Session
+}
+
+/** Raw session data that includes weak password info (password sign-in endpoints). */
+interface GoTrueSessionPasswordData extends GoTrueSessionData {
+  weak_password?: WeakPassword
+}
+
+/** Raw user data — either `{ user: User }` or the User object itself. */
+interface GoTrueUserData {
+  user?: User
+  [key: string]: any // data may BE the User directly (fallback path)
+}
+
+/** Raw generate-link data — link properties + User fields flattened into one object. */
+type GoTrueGenerateLinkData = GenerateLinkProperties & Record<string, any>
+
 export interface FetchOptions {
   headers?: {
     [key: string]: string
@@ -30,12 +56,25 @@ export interface FetchParameters {
   signal?: AbortSignal
 }
 
-export type RequestMethodType = 'GET' | 'POST' | 'PUT' | 'DELETE'
+export type RequestMethodType = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
 
-const _getErrorMessage = (err: any): string =>
-  err.msg || err.message || err.error_description || err.error || JSON.stringify(err)
+const _getErrorMessage = (err: unknown): string => {
+  if (typeof err === 'object' && err !== null) {
+    const e = err as Record<string, unknown>
+    if (typeof e.msg === 'string') return e.msg
+    if (typeof e.message === 'string') return e.message
+    if (typeof e.error_description === 'string') return e.error_description
+    if (typeof e.error === 'string') return e.error
+  }
+  return JSON.stringify(err)
+}
 
-const NETWORK_ERROR_CODES = [502, 503, 504]
+// 500, 501, 502, 503, 504: Standard server/gateway errors
+// 520-529, 530: Cloudflare-specific error codes (web server down, connection timed out, etc.)
+// These are infrastructure errors and should not cause session invalidation.
+const NETWORK_ERROR_CODES = [
+  500, 501, 502, 503, 504, 520, 521, 522, 523, 524, 525, 526, 527, 528, 529, 530,
+]
 
 export async function handleError(error: unknown) {
   if (!looksLikeFetchResponse(error)) {
@@ -50,7 +89,7 @@ export async function handleError(error: unknown) {
   let data: any
   try {
     data = await error.json()
-  } catch (e: any) {
+  } catch (e) {
     throw new AuthUnknownError(_getErrorMessage(e), e)
   }
 
@@ -178,16 +217,17 @@ async function _handleRequest(
 ): Promise<any> {
   const requestParams = _getRequestParams(method, options, parameters, body)
 
-  let result: any
+  let result: Response
 
   try {
     result = await fetcher(url, {
       ...requestParams,
     })
   } catch (e) {
-    console.error(e)
-
-    // fetch failed, likely due to a network or CORS error
+    // fetch failed (network / CORS / aborted request) — surfaced to the
+    // caller as a retryable error below. Deliberately not logged here: an
+    // aborted in-flight request (e.g. a superseded page navigation) is a
+    // transient condition, and logging the raw error pollutes the console.
     throw new AuthRetryableFetchError(_getErrorMessage(e), 0)
   }
 
@@ -201,26 +241,28 @@ async function _handleRequest(
 
   try {
     return await result.json()
-  } catch (e: any) {
+  } catch (e) {
     await handleError(e)
   }
 }
 
-export function _sessionResponse(data: any): AuthResponse {
+export function _sessionResponse(data: GoTrueSessionData): AuthResponse {
   let session = null
   if (hasSession(data)) {
-    session = { ...data }
+    session = { ...data } as Session
 
     if (!data.expires_at) {
-      session.expires_at = expiresAt(data.expires_in)
+      session.expires_at = expiresAt(data.expires_in!)
     }
   }
 
-  const user: User = data.user ?? (data as User)
+  // Some /verify responses (e.g. secure email_change first-confirmation) return
+  // only `{ msg, code }` with no user and no session. Treat those as null user.
+  const user: User | null = data.user ?? (typeof data?.id === 'string' ? (data as User) : null)
   return { data: { session, user }, error: null }
 }
 
-export function _sessionResponsePassword(data: any): AuthResponsePassword {
+export function _sessionResponsePassword(data: GoTrueSessionPasswordData): AuthResponsePassword {
   const response = _sessionResponse(data) as AuthResponsePassword
 
   if (
@@ -231,7 +273,7 @@ export function _sessionResponsePassword(data: any): AuthResponsePassword {
     data.weak_password.reasons.length &&
     data.weak_password.message &&
     typeof data.weak_password.message === 'string' &&
-    data.weak_password.reasons.reduce((a: boolean, i: any) => a && typeof i === 'string', true)
+    data.weak_password.reasons.reduce((a: boolean, i: unknown) => a && typeof i === 'string', true)
   ) {
     response.data.weak_password = data.weak_password
   }
@@ -239,16 +281,16 @@ export function _sessionResponsePassword(data: any): AuthResponsePassword {
   return response
 }
 
-export function _userResponse(data: any): UserResponse {
+export function _userResponse(data: GoTrueUserData): UserResponse {
   const user: User = data.user ?? (data as User)
   return { data: { user }, error: null }
 }
 
-export function _ssoResponse(data: any): SSOResponse {
-  return { data, error: null }
+export function _ssoResponse(data: Record<string, any>): SSOResponse {
+  return { data, error: null } as SSOResponse
 }
 
-export function _generateLinkResponse(data: any): GenerateLinkResponse {
+export function _generateLinkResponse(data: GoTrueGenerateLinkData): GenerateLinkResponse {
   const { action_link, email_otp, hashed_token, redirect_to, verification_type, ...rest } = data
 
   const properties: GenerateLinkProperties = {
@@ -259,7 +301,7 @@ export function _generateLinkResponse(data: any): GenerateLinkResponse {
     verification_type,
   }
 
-  const user: User = { ...rest }
+  const user = { ...rest } as User
   return {
     data: {
       properties,
@@ -269,7 +311,7 @@ export function _generateLinkResponse(data: any): GenerateLinkResponse {
   }
 }
 
-export function _noResolveJsonResponse(data: any): Response {
+export function _noResolveJsonResponse(data: Response): Response {
   return data
 }
 
@@ -278,6 +320,6 @@ export function _noResolveJsonResponse(data: any): Response {
  * @param data A response object
  * @returns true if a session is in the response
  */
-function hasSession(data: any): boolean {
-  return data.access_token && data.refresh_token && data.expires_in
+function hasSession(data: GoTrueSessionData): boolean {
+  return !!data.access_token && !!data.refresh_token && !!data.expires_in
 }

package/src/lib/helpers.ts

@@ -87,7 +87,7 @@ export function parseParametersFromURL(href: string) {
       hashSearchParams.forEach((value, key) => {
         result[key] = value
       })
-    } catch (e: any) {
+    } catch (_e) {
       // hash is not a query string
     }
   }
@@ -139,7 +139,12 @@ export const getItemAsync = async (storage: SupportedStorage, key: string): Prom
   try {
     return JSON.parse(value)
   } catch {
-    return value
+    // Storage values are always written as JSON via setItemAsync. A non-JSON
+    // value means the entry is corrupted (e.g. mismatched chunked cookies in
+    // SSR contexts). Treat as absent so callers do not mutate or re-save the
+    // garbage, which would otherwise trigger a TypeError downstream and
+    // leak the raw value into error logs.
+    return null
   }
 }
 
@@ -235,7 +240,7 @@ export function retryable<T>(
             accept(result)
             return
           }
-        } catch (e: any) {
+        } catch (e) {
           if (!isRetryable(attempt, e)) {
             reject(e)
             return
@@ -304,7 +309,7 @@ export async function getCodeChallengeAndMethod(
   const codeVerifier = generatePKCEVerifier()
   let storedCodeVerifier = codeVerifier
   if (isPasswordRecovery) {
-    storedCodeVerifier += '/PASSWORD_RECOVERY'
+    storedCodeVerifier += '/recovery'
   }
   await setItemAsync(storage, `${storageKey}-code-verifier`, storedCodeVerifier)
   const codeChallenge = await generatePKCEChallenge(codeVerifier)
@@ -329,7 +334,7 @@ export function parseResponseAPIVersion(response: Response) {
   try {
     const date = new Date(`${apiVersion}T00:00:00.0Z`)
     return date
-  } catch (e: any) {
+  } catch (_e) {
     return null
   }
 }
@@ -345,7 +350,7 @@ export function validateExp(exp: number) {
 }
 
 export function getAlgorithm(
-  alg: 'HS256' | 'RS256' | 'ES256'
+  alg: 'HS256' | 'RS256' | 'ES256' | (string & {})
 ): RsaHashedImportParams | EcKeyImportParams {
   switch (alg) {
     case 'RS256':
@@ -372,6 +377,14 @@ export function validateUUID(str: string) {
   }
 }
 
+export function assertPasskeyExperimentalEnabled(experimental: { passkey?: boolean }): void {
+  if (!experimental.passkey) {
+    throw new Error(
+      '@supabase/auth-js: the passkey API is experimental and disabled by default. Enable it by passing `auth: { experimental: { passkey: true } }` to createClient (or to the GoTrueClient constructor).'
+    )
+  }
+}
+
 export function userNotAvailableProxy(): User {
   const proxyTarget = {} as User
 

package/src/lib/locks.ts

@@ -1,6 +1,17 @@
+/**
+ * Lock primitives retained for backwards-compatible imports. The auth client
+ * coordinates refreshes itself (deduping in-instance callers onto a shared
+ * in-flight promise) and lets the GoTrue server resolve cross-instance races,
+ * so it does not invoke any primitive from this module. The functions still
+ * work for direct callers that need a navigator.locks-backed or in-process
+ * exclusive lock of their own.
+ */
+
 import { supportsLocalStorage } from './helpers'
 
 /**
+ * @deprecated Debug flag for `navigatorLock` / `processLock`. The auth
+ * client ignores both, so this has no client-side effect.
  * @experimental
  */
 export const internals = {
@@ -18,18 +29,9 @@ export const internals = {
 /**
  * An error thrown when a lock cannot be acquired after some amount of time.
  *
- * Use the {@link #isAcquireTimeout} property instead of checking with `instanceof`.
- *
- * @example
- * ```ts
- * import { LockAcquireTimeoutError } from '@supabase/auth-js'
- *
- * class CustomLockError extends LockAcquireTimeoutError {
- *   constructor() {
- *     super('Lock timed out')
- *   }
- * }
- * ```
+ * @deprecated The auth client doesn't acquire locks around auth operations,
+ * so this error never originates from `supabase.auth.*` calls. Direct callers
+ * of `navigatorLock` / `processLock` still receive it on acquire timeout.
  */
 export abstract class LockAcquireTimeoutError extends Error {
   public readonly isAcquireTimeout = true
@@ -40,25 +42,15 @@ export abstract class LockAcquireTimeoutError extends Error {
 }
 
 /**
- * Error thrown when the browser Navigator Lock API fails to acquire a lock.
- *
- * @example
- * ```ts
- * import { NavigatorLockAcquireTimeoutError } from '@supabase/auth-js'
- *
- * throw new NavigatorLockAcquireTimeoutError('Lock timed out')
- * ```
+ * @deprecated The auth client doesn't call `navigator.locks`, so this error
+ * never originates from `supabase.auth.*` calls. Direct callers of
+ * `navigatorLock` still receive it on acquire timeout.
  */
 export class NavigatorLockAcquireTimeoutError extends LockAcquireTimeoutError {}
 /**
- * Error thrown when the process-level lock helper cannot acquire a lock.
- *
- * @example
- * ```ts
- * import { ProcessLockAcquireTimeoutError } from '@supabase/auth-js'
- *
- * throw new ProcessLockAcquireTimeoutError('Lock timed out')
- * ```
+ * @deprecated The auth client doesn't run `processLock`, so this error
+ * never originates from `supabase.auth.*` calls. Direct callers of
+ * `processLock` still receive it on acquire timeout.
  */
 export class ProcessLockAcquireTimeoutError extends LockAcquireTimeoutError {}
 
@@ -86,12 +78,10 @@ export class ProcessLockAcquireTimeoutError extends LockAcquireTimeoutError {}
  *                       will time out after so many milliseconds. An error is
  *                       a timeout if it has `isAcquireTimeout` set to true.
  * @param fn The operation to run once the lock is acquired.
- * @example
- * ```ts
- * await navigatorLock('sync-user', 1000, async () => {
- *   await refreshSession()
- * })
- * ```
+ *
+ * @deprecated The auth client coordinates refreshes itself and the server
+ * resolves concurrent refresh races, so passing `{ lock: navigatorLock }`
+ * to it has no effect. You can safely drop the import from your client setup.
  */
 export async function navigatorLock<R>(
   name: string,
@@ -176,7 +166,7 @@ export async function navigatorLock<R>(
                   '@supabase/gotrue-js: Navigator LockManager state',
                   JSON.stringify(result, null, '  ')
                 )
-              } catch (e: any) {
+              } catch (e) {
                 console.warn(
                   '@supabase/gotrue-js: Error when querying Navigator LockManager state',
                   e
@@ -198,14 +188,21 @@ export async function navigatorLock<R>(
         }
       }
     )
-  } catch (e: any) {
+  } catch (e) {
     // Always clear the acquire timeout once the request settles, so it cannot
     // fire later and incorrectly abort/log after a rejection.
     if (acquireTimeout > 0) {
       clearTimeout(acquireTimeoutTimer)
     }
 
-    if (e?.name === 'AbortError' && acquireTimeout > 0) {
+    // DOMException does not extend Error in Node.js, so use structural check
+    if (
+      e !== null &&
+      typeof e === 'object' &&
+      'name' in e &&
+      e.name === 'AbortError' &&
+      acquireTimeout > 0
+    ) {
       if (abortController.signal.aborted) {
         // OUR timeout fired — the lock is genuinely orphaned. Steal it.
         //
@@ -305,7 +302,7 @@ const PROCESS_LOCKS: { [name: string]: Promise<any> } = {}
  * Useful for environments like React Native or other non-browser
  * single-process (i.e. no concept of "tabs") environments.
  *
- * Use {@link #navigatorLock} in browser environments.
+ * Use {@link navigatorLock} in browser environments.
  *
  * @param name Name of the lock to be acquired.
  * @param acquireTimeout If negative, no timeout. If 0 an error is thrown if
@@ -313,6 +310,11 @@ const PROCESS_LOCKS: { [name: string]: Promise<any> } = {}
  *                       will time out after so many milliseconds. An error is
  *                       a timeout if it has `isAcquireTimeout` set to true.
  * @param fn The operation to run once the lock is acquired.
+ *
+ * @deprecated The auth client coordinates refreshes itself and the server
+ * resolves concurrent refresh races, so passing `{ lock: processLock }`
+ * to it has no effect. You can safely drop the import from your client setup.
+ *
  * @example
  * ```ts
  * await processLock('migrate', 5000, async () => {
@@ -370,14 +372,14 @@ export async function processLock<R>(
       if (timeoutId !== null) {
         clearTimeout(timeoutId)
       }
-    } catch (e: any) {
+    } catch (e) {
       // Clear the timeout on error path as well
       if (timeoutId !== null) {
         clearTimeout(timeoutId)
       }
 
       // Re-throw timeout errors, ignore others
-      if (e && e.isAcquireTimeout) {
+      if (e instanceof LockAcquireTimeoutError) {
         throw e
       }
       // Fall through to run fn() - previous operation finished with error
@@ -391,8 +393,8 @@ export async function processLock<R>(
   PROCESS_LOCKS[name] = (async () => {
     try {
       return await currentOperation
-    } catch (e: any) {
-      if (e && e.isAcquireTimeout) {
+    } catch (e) {
+      if (e instanceof LockAcquireTimeoutError) {
         // if the current operation timed out, it doesn't mean that the previous
         // operation finished, so we need continue waiting for it to finish
         try {