@depup/supabase__auth-js 2.115.0-depup.0 → 2.117.0-depup.0

package/dist/module/GoTrueClient.js

@@ -2,7 +2,7 @@ import GoTrueAdminApi from './GoTrueAdminApi';
 import { AUTO_REFRESH_TICK_DURATION_MS, AUTO_REFRESH_TICK_THRESHOLD, DEFAULT_HEADERS, EXPIRY_MARGIN_MS, GOTRUE_URL, JWKS_TTL, PKCE_FLOW_ID_PARAM, REFRESH_FAILURE_COOLDOWN_MS, STORAGE_KEY, } from './lib/constants';
 import { AuthImplicitGrantRedirectError, AuthInvalidCredentialsError, AuthInvalidJwtError, AuthInvalidTokenResponseError, AuthPKCECodeVerifierMissingError, AuthPKCEGrantCodeExchangeError, AuthRefreshDiscardedError, AuthSessionMissingError, AuthUnknownError, isAuthApiError, isAuthError, isAuthImplicitGrantRedirectError, isAuthRefreshDiscardedError, isAuthRetryableFetchError, isAuthSessionMissingError, } from './lib/errors';
 import { _request, _sessionResponse, _sessionResponsePassword, _ssoResponse, _userResponse, } from './lib/fetch';
-import { appendFlowIdToRedirectTo, assertPasskeyExperimentalEnabled, decodeJWT, deepClone, Deferred, generateCallbackId, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, pkceVerifierSlotKey, removeAllPKCEVerifiers, removeItemAsync, removePKCEVerifier, resolveFetch, retrievePKCEVerifier, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, validateExp, validatePKCEFlowId, } from './lib/helpers';
+import { appendFlowIdToRedirectTo, assertRecoveryCodesExperimentalEnabled, decodeJWT, deepClone, Deferred, expiresAt, generateCallbackId, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, pkceVerifierSlotKey, removeAllPKCEVerifiers, removeItemAsync, removePKCEVerifier, resolveFetch, retrievePKCEVerifier, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, validateExp, validatePKCEFlowId, } from './lib/helpers';
 import { memoryLocalStorageAdapter } from './lib/local-storage';
 import { LockAcquireTimeoutError } from './lib/locks';
 import { polyfillGlobalThis } from './lib/polyfills';
@@ -219,6 +219,13 @@ class GoTrueClient {
             challengeAndVerify: this._challengeAndVerify.bind(this),
             getAuthenticatorAssuranceLevel: this._getAuthenticatorAssuranceLevel.bind(this),
             webauthn: new WebAuthnApi(this),
+            recoveryCodes: {
+                getStatus: this._getRecoveryCodesStatus.bind(this),
+                generate: this._generateRecoveryCodes.bind(this),
+                verify: this._verifyRecoveryCode.bind(this),
+                regenerate: this._regenerateRecoveryCodes.bind(this),
+                unenroll: this._unenrollRecoveryCodes.bind(this),
+            },
         };
         this.oauth = {
             getAuthorizationDetails: this._getAuthorizationDetails.bind(this),
@@ -3657,6 +3664,12 @@ class GoTrueClient {
             catch (err) {
                 await ((_b = this.stateChangeEmitters.get(id)) === null || _b === void 0 ? void 0 : _b.callback('INITIAL_SESSION', null));
                 this._debug('INITIAL_SESSION', 'callback id', id, 'error', err);
+                if (isAuthRefreshDiscardedError(err)) {
+                    // Same successful no-op _recoverAndRefresh treats as debug-only: the
+                    // commit guard discarded a refresh because a concurrent signOut
+                    // changed session state mid-flight.
+                    return;
+                }
                 if (isAuthSessionMissingError(err) ||
                     isAuthRetryableFetchError(err) ||
                     (isAuthApiError(err) &&
@@ -5002,11 +5015,15 @@ class GoTrueClient {
             phone: [],
             totp: [],
             webauthn: [],
+            recovery_code: [],
         };
         // loop over the factors ONCE
         for (const factor of (_a = user === null || user === void 0 ? void 0 : user.factors) !== null && _a !== void 0 ? _a : []) {
             data.all.push(factor);
-            if (factor.status === 'verified') {
+            // Types that are not recognized are pushed to `all` bucket.
+            if (factor.status === 'verified' &&
+                factor.factor_type in data &&
+                Array.isArray(data[factor.factor_type])) {
                 ;
                 data[factor.factor_type].push(factor);
             }
@@ -5070,6 +5087,164 @@ class GoTrueClient {
         const currentAuthenticationMethods = payload.amr || [];
         return { data: { currentLevel, nextLevel, currentAuthenticationMethods }, error: null };
     }
+    /**
+     * {@link AuthMFARecoveryCodesApi#getStatus}
+     */
+    async _getRecoveryCodesStatus() {
+        assertRecoveryCodesExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                var _a;
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                const { data, error } = await _request(this.fetch, 'GET', `${this.url}/factors/recovery-codes`, {
+                    headers: this.headers,
+                    jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * {@link AuthMFARecoveryCodesApi#generate}
+     */
+    async _generateRecoveryCodes(params) {
+        assertRecoveryCodesExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                var _a;
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors/recovery-codes`, {
+                    // The body is optional server-side; only send one when a name was given.
+                    body: (params === null || params === void 0 ? void 0 : params.friendlyName) ? { friendly_name: params.friendlyName } : undefined,
+                    headers: this.headers,
+                    jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * {@link AuthMFARecoveryCodesApi#verify}
+     */
+    async _verifyRecoveryCode(params) {
+        assertRecoveryCodesExperimentalEnabled(this.experimental);
+        const run = async () => {
+            try {
+                return await this._useSession(async (result) => {
+                    var _a;
+                    const { data: sessionData, error: sessionError } = result;
+                    if (sessionError) {
+                        return this._returnResult({ data: null, error: sessionError });
+                    }
+                    const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors/recovery-codes/verify`, {
+                        body: { code: params.code },
+                        headers: this.headers,
+                        jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                    });
+                    if (error) {
+                        return this._returnResult({ data: null, error });
+                    }
+                    // A server-provided expires_at takes precedence over the computed one.
+                    const session = Object.assign({ expires_at: expiresAt(data.expires_in) }, data);
+                    await this._saveSession(session);
+                    await this._notifyAllSubscribers('MFA_CHALLENGE_VERIFIED', session);
+                    return this._returnResult({ data, error: null });
+                });
+            }
+            catch (error) {
+                if (isAuthError(error)) {
+                    return this._returnResult({ data: null, error });
+                }
+                throw error;
+            }
+        };
+        if (this.lock != null) {
+            return this._acquireLock(this.lockAcquireTimeout, run);
+        }
+        return run();
+    }
+    /**
+     * {@link AuthMFARecoveryCodesApi#regenerate}
+     */
+    async _regenerateRecoveryCodes() {
+        assertRecoveryCodesExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                var _a;
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors/recovery-codes/regenerate`, {
+                    headers: this.headers,
+                    jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * {@link AuthMFARecoveryCodesApi#unenroll}
+     */
+    async _unenrollRecoveryCodes() {
+        assertRecoveryCodesExperimentalEnabled(this.experimental);
+        try {
+            return await this._useSession(async (result) => {
+                var _a;
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                const { data, error } = await _request(this.fetch, 'DELETE', `${this.url}/factors/recovery-codes`, {
+                    headers: this.headers,
+                    jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                });
+                if (error) {
+                    return this._returnResult({ data: null, error });
+                }
+                return this._returnResult({ data, error: null });
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
     /**
      * Retrieves details about an OAuth authorization request.
      * Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
@@ -5406,13 +5581,35 @@ class GoTrueClient {
      * 2. Prompts user via navigator.credentials.get()
      * 3. Verifies credential with server and creates session
      *
-     * Requires `auth.experimental.passkey: true`.
+     * Pass `options.mediation: 'conditional'` to use WebAuthn Conditional UI
+     * (passkey autofill) instead of the modal picker; the value is forwarded to
+     * `navigator.credentials.get()` unchanged.
+     *
+     * The challenge fetched in step 1 expires after the server's
+     * GOTRUE_WEBAUTHN_CHALLENGE_EXPIRY_DURATION (5 minutes by default). With
+     * `mediation: 'conditional'` the autofill prompt can stay pending for longer
+     * than that: the browser ceremony then still succeeds, but verification fails
+     * with `error_code: "webauthn_challenge_expired"`. Recover by calling
+     * `signInWithPasskey()` again. It fetches a fresh challenge and, unless you
+     * passed your own `options.signal`, cancels the pending ceremony first, so
+     * the browser never sees two concurrent WebAuthn requests; the earlier call
+     * resolves with a `WebAuthnError` whose code is `ERROR_CEREMONY_ABORTED`. If
+     * you pass your own `signal`, abort it before retrying.
      *
      * @category Auth
+     *
+     * @example Sign in with Conditional UI (passkey autofill)
+     * ```js
+     * // <input autocomplete="username webauthn" /> somewhere on the page
+     * const { data, error } = await supabase.auth.signInWithPasskey({
+     *   options: {
+     *     mediation: 'conditional'
+     *   }
+     * });
+     * ```
      */
     async signInWithPasskey(credentials) {
-        var _a, _b, _c;
-        assertPasskeyExperimentalEnabled(this.experimental);
+        var _a, _b, _c, _d;
         try {
             if (!browserSupportsWebAuthn()) {
                 return this._returnResult({
@@ -5433,6 +5630,7 @@ class GoTrueClient {
             const { data: credential, error: credentialError } = await getCredential({
                 publicKey: publicKeyOptions,
                 signal,
+                mediation: (_d = credentials === null || credentials === void 0 ? void 0 : credentials.options) === null || _d === void 0 ? void 0 : _d.mediation,
             });
             if (credentialError || !credential) {
                 return this._returnResult({
@@ -5460,13 +5658,12 @@ class GoTrueClient {
      * 2. Prompts user via navigator.credentials.create()
      * 3. Verifies credential with server
      *
-     * Requires an active session. Requires `auth.experimental.passkey: true`.
+     * Requires an active session.
      *
      * @category Auth
      */
     async registerPasskey(credentials) {
         var _a, _b;
-        assertPasskeyExperimentalEnabled(this.experimental);
         try {
             if (!browserSupportsWebAuthn()) {
                 return this._returnResult({
@@ -5511,7 +5708,6 @@ class GoTrueClient {
      * Returns WebAuthn credential creation options to pass to navigator.credentials.create().
      */
     async _startPasskeyRegistration() {
-        assertPasskeyExperimentalEnabled(this.experimental);
         try {
             return await this._useSession(async (result) => {
                 const { data: { session }, error: sessionError, } = result;
@@ -5544,7 +5740,6 @@ class GoTrueClient {
      * The credentialResponse should be the serialized output of navigator.credentials.create().
      */
     async _verifyPasskeyRegistration(params) {
-        assertPasskeyExperimentalEnabled(this.experimental);
         try {
             return await this._useSession(async (result) => {
                 const { data: { session }, error: sessionError, } = result;
@@ -5581,7 +5776,6 @@ class GoTrueClient {
      */
     async _startPasskeyAuthentication(params) {
         var _a;
-        assertPasskeyExperimentalEnabled(this.experimental);
         try {
             const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/authentication/options`, {
                 headers: this.headers,
@@ -5606,7 +5800,6 @@ class GoTrueClient {
      * The credential should be the serialized output of navigator.credentials.get().
      */
     async _verifyPasskeyAuthentication(params) {
-        assertPasskeyExperimentalEnabled(this.experimental);
         try {
             const { data, error } = await _request(this.fetch, 'POST', `${this.url}/passkeys/authentication/verify`, {
                 headers: this.headers,
@@ -5636,7 +5829,6 @@ class GoTrueClient {
      * List all passkeys for the current user.
      */
     async _listPasskeys() {
-        assertPasskeyExperimentalEnabled(this.experimental);
         try {
             return await this._useSession(async (result) => {
                 const { data: { session }, error: sessionError, } = result;
@@ -5668,7 +5860,6 @@ class GoTrueClient {
      * Update a passkey.
      */
     async _updatePasskey(params) {
-        assertPasskeyExperimentalEnabled(this.experimental);
         try {
             return await this._useSession(async (result) => {
                 const { data: { session }, error: sessionError, } = result;
@@ -5700,7 +5891,6 @@ class GoTrueClient {
      * Delete a passkey.
      */
     async _deletePasskey(params) {
-        assertPasskeyExperimentalEnabled(this.experimental);
         try {
             return await this._useSession(async (result) => {
                 const { data: { session }, error: sessionError, } = result;