@faable/auth-js 1.2.0

package/dist/FaableAuthClient.js

@@ -0,0 +1,1073 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FaableAuthClient = void 0;
+const utils_1 = require("./utils");
+const jwt_1 = require("./lib/jwt");
+const helpers_1 = require("./lib/helpers");
+const constants_1 = require("./lib/constants");
+const local_storage_1 = require("./lib/local-storage");
+const errors_1 = require("./lib/errors");
+const storage_helpers_1 = require("./lib/storage_helpers");
+const FaableAuthApi_1 = __importDefault(require("./FaableAuthApi"));
+const locks_1 = require("./lock/locks");
+const fetch_1 = require("./lib/fetch");
+const Base_1 = require("./Base");
+const Lock_1 = require("./lock/Lock");
+/** Current session will be checked for refresh at this interval. */
+const AUTO_REFRESH_TICK_DURATION = 30 * 1000;
+/**
+ * A token refresh will be attempted this many ticks before the current session expires. */
+const AUTO_REFRESH_TICK_THRESHOLD = 3;
+class FaableAuthClient extends Base_1.Base {
+    constructor(config) {
+        var _a;
+        super({ debug: config.debug });
+        this.initializePromise = null;
+        this.detectSessionInUrl = true;
+        this.autoRefreshTicker = null;
+        this.visibilityChangedCallback = null;
+        this.refreshingDeferred = null;
+        /**
+         * Used to broadcast state change events to other tabs listening.
+         */
+        this.broadcastChannel = null;
+        this.stateChangeEmitters = new Map();
+        this.sessionCheckExpiryDays = 1;
+        this.redirect_uri = config.redirect_uri || "";
+        this.domainUrl = (0, utils_1.getDomain)(config.domain);
+        this.tokenIssuer = (0, utils_1.getTokenIssuer)("", this.domainUrl);
+        this.clientId = config.clientId;
+        this.api = new FaableAuthApi_1.default(this.domainUrl, { debug: config.debug });
+        this.storageKey = config.storageKey || constants_1.STORAGE_KEY;
+        this.flowType = config.flowType || "implicit";
+        this.storage = config.storage || local_storage_1.localStorageAdapter;
+        this.lock = new Lock_1.Lock({
+            lock: config.lock,
+            storageKey: this.storageKey,
+            debug: config.debug,
+        });
+        if ((0, helpers_1.isBrowser)() &&
+            globalThis.BroadcastChannel &&
+            // this.persistSession &&
+            this.storageKey) {
+            try {
+                this.broadcastChannel = new globalThis.BroadcastChannel(this.storageKey);
+            }
+            catch (e) {
+                console.error("Failed to create a new BroadcastChannel, multi-tab state changes will not be available", e);
+            }
+            (_a = this.broadcastChannel) === null || _a === void 0 ? void 0 : _a.addEventListener("message", (event) => __awaiter(this, void 0, void 0, function* () {
+                this._debug("received broadcast notification from other tab or client", event);
+                yield this._notifyAllSubscribers(event.data.event, event.data.session, false); // broadcast = false so we don't get an endless loop of messages
+            }));
+        }
+        this.autoRefreshToken = true;
+        this.initialize();
+    }
+    /**
+     * Initializes the client session either from the url or from storage.
+     * This method is automatically called when instantiating the client, but should also be called
+     * manually when checking for an error from an auth redirect (oauth, magiclink, password recovery, etc).
+     */
+    initialize() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.initializePromise) {
+                return yield this.initializePromise;
+            }
+            this.initializePromise = (() => __awaiter(this, void 0, void 0, function* () {
+                return yield this.lock._acquireLock(-1, () => __awaiter(this, void 0, void 0, function* () {
+                    return yield this._initialize();
+                }));
+            }))();
+            return yield this.initializePromise;
+        });
+    }
+    /**
+     * IMPORTANT:
+     * 1. Never throw in this method, as it is called from the constructor
+     * 2. Never return a session from this method as it would be cached over
+     *    the whole lifetime of the client
+     */
+    _initialize() {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const isPKCEFlow = (0, helpers_1.isBrowser)() ? yield this._isPKCEFlow() : false;
+                this._debug("#_initialize()", "begin", "is PKCE flow", isPKCEFlow);
+                if (isPKCEFlow ||
+                    (this.detectSessionInUrl && this._isImplicitGrantFlow())) {
+                    const { data, error } = yield this._getSessionFromURL(isPKCEFlow);
+                    if (error) {
+                        this._debug("#_initialize()", "error detecting session from URL", error);
+                        // hacky workaround to keep the existing session if there's an error returned from identity linking
+                        // TODO: once error codes are ready, we should match against it instead of the message
+                        if ((error === null || error === void 0 ? void 0 : error.message) === "Identity is already linked" ||
+                            (error === null || error === void 0 ? void 0 : error.message) === "Identity is already linked to another user") {
+                            return { error };
+                        }
+                        // failed login attempt via url,
+                        // remove old session as in verifyOtp, signUp and signInWith*
+                        yield this._removeSession();
+                        return { error };
+                    }
+                    const { session, redirectType } = data;
+                    this._debug("#_initialize()", "detected session in URL", session, "redirect type", redirectType);
+                    yield this._saveSession(session);
+                    setTimeout(() => __awaiter(this, void 0, void 0, function* () {
+                        if (redirectType === "recovery") {
+                            yield this._notifyAllSubscribers("PASSWORD_RECOVERY", session);
+                        }
+                        else {
+                            yield this._notifyAllSubscribers("SIGNED_IN", session);
+                        }
+                    }), 0);
+                    return { error: null };
+                }
+                // no login attempt via callback url try to recover session from storage
+                yield this._recoverAndRefresh();
+                return { error: null };
+            }
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { error };
+                }
+                return {
+                    error: new errors_1.AuthUnknownError("Unexpected error during initialization", error),
+                };
+            }
+            finally {
+                yield this._handleVisibilityChange();
+                this._debug("#_initialize()", "end");
+            }
+        });
+    }
+    /**
+     * Gets the session data from a URL string
+     */
+    _getSessionFromURL(isPKCEFlow) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                if (!(0, helpers_1.isBrowser)())
+                    throw new errors_1.AuthImplicitGrantRedirectError("No browser detected.");
+                if (this.flowType === "implicit" && !this._isImplicitGrantFlow()) {
+                    throw new errors_1.AuthImplicitGrantRedirectError("Not a valid implicit grant flow url.");
+                }
+                else if (this.flowType == "pkce" && !isPKCEFlow) {
+                    throw new errors_1.AuthPKCEGrantCodeExchangeError("Not a valid PKCE flow url.");
+                }
+                const params = (0, helpers_1.parseParametersFromURL)(window.location.href);
+                if (isPKCEFlow) {
+                    if (!params.code)
+                        throw new errors_1.AuthPKCEGrantCodeExchangeError("No code detected.");
+                    const { data, error } = yield this._exchangeCodeForSession(params.code);
+                    if (error)
+                        throw error;
+                    const url = new URL(window.location.href);
+                    url.searchParams.delete("code");
+                    window.history.replaceState(window.history.state, "", url.toString());
+                    return {
+                        data: { session: data.session, redirectType: null },
+                        error: null,
+                    };
+                }
+                if (params.error || params.error_description || params.error_code) {
+                    throw new errors_1.AuthImplicitGrantRedirectError(params.error_description ||
+                        "Error in URL with unspecified error_description", {
+                        error: params.error || "unspecified_error",
+                        code: params.error_code || "unspecified_code",
+                    });
+                }
+                const { provider_token, provider_refresh_token, access_token, refresh_token, expires_in, expires_at, token_type, } = params;
+                if (!access_token || !expires_in || !refresh_token || !token_type) {
+                    throw new errors_1.AuthImplicitGrantRedirectError("No session defined in URL");
+                }
+                const timeNow = Math.round(Date.now() / 1000);
+                const expiresIn = parseInt(expires_in);
+                let expiresAt = timeNow + expiresIn;
+                if (expires_at) {
+                    expiresAt = parseInt(expires_at);
+                }
+                const actuallyExpiresIn = expiresAt - timeNow;
+                if (actuallyExpiresIn * 1000 <= AUTO_REFRESH_TICK_DURATION) {
+                    console.warn(`@supabase/gotrue-js: Session as retrieved from URL expires in ${actuallyExpiresIn}s, should have been closer to ${expiresIn}s`);
+                }
+                const issuedAt = expiresAt - expiresIn;
+                if (timeNow - issuedAt >= 120) {
+                    console.warn("@supabase/gotrue-js: Session as retrieved from URL was issued over 120s ago, URL could be stale", issuedAt, expiresAt, timeNow);
+                }
+                else if (timeNow - issuedAt < 0) {
+                    console.warn("@supabase/gotrue-js: Session as retrieved from URL was issued in the future? Check the device clok for skew", issuedAt, expiresAt, timeNow);
+                }
+                const { data, error } = yield this._getUser(access_token);
+                if (error)
+                    throw error;
+                const session = {
+                    provider_token,
+                    provider_refresh_token,
+                    access_token,
+                    expires_in: expiresIn,
+                    expires_at: expiresAt,
+                    refresh_token,
+                    token_type,
+                    user: data.user,
+                };
+                // Remove tokens from URL
+                window.location.hash = "";
+                this._debug("#_getSessionFromURL()", "clearing window.location.hash");
+                return { data: { session, redirectType: params.type }, error: null };
+            }
+            catch (error) {
+                this._debug(error);
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { data: { session: null, redirectType: null }, error };
+                }
+                throw error;
+            }
+        });
+    }
+    _exchangeCodeForSession(authCode) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const storageItem = yield (0, storage_helpers_1.getItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            const [codeVerifier, redirectType] = (storageItem !== null && storageItem !== void 0 ? storageItem : "").split("/");
+            const { data, error } = yield (0, fetch_1._post)(`${this.domainUrl}/oauth/token`, {
+                client_id: this.clientId,
+                grant_type: "authorization_code",
+                code: authCode,
+                code_verifier: codeVerifier,
+            }, { transform: helpers_1._sessionResponse });
+            yield (0, storage_helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            if (error) {
+                return { data: { user: null, session: null, redirectType: null }, error };
+            }
+            else if (!data || !data.session || !data.user) {
+                return {
+                    data: { user: null, session: null, redirectType: null },
+                    error: new errors_1.AuthInvalidTokenResponseError(),
+                };
+            }
+            let session = data.session;
+            if (session) {
+                const { data: userdata, error } = yield this._getUser(session.access_token);
+                if (error) {
+                    throw error;
+                }
+                session = Object.assign(Object.assign({}, session), { user: userdata.user });
+                data.session = session;
+                yield this._saveSession(session);
+                yield this._notifyAllSubscribers("SIGNED_IN", session);
+            }
+            return {
+                data: Object.assign(Object.assign({}, data), { redirectType: redirectType !== null && redirectType !== void 0 ? redirectType : null }),
+                error,
+            };
+        });
+    }
+    /**
+     * Registers callbacks on the browser / platform, which in-turn run
+     * algorithms when the browser window/tab are in foreground. On non-browser
+     * platforms it assumes always foreground.
+     */
+    _handleVisibilityChange() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this._debug("#_handleVisibilityChange()");
+            if (!(0, helpers_1.isBrowser)() || !(window === null || window === void 0 ? void 0 : window.addEventListener)) {
+                if (this.autoRefreshToken) {
+                    // in non-browser environments the refresh token ticker runs always
+                    this.startAutoRefresh();
+                }
+                return false;
+            }
+            try {
+                this.visibilityChangedCallback = () => __awaiter(this, void 0, void 0, function* () { return yield this._onVisibilityChanged(false); });
+                window === null || window === void 0 ? void 0 : window.addEventListener("visibilitychange", this.visibilityChangedCallback);
+                // now immediately call the visbility changed callback to setup with the
+                // current visbility state
+                yield this._onVisibilityChanged(true); // initial call
+            }
+            catch (error) {
+                console.error("_handleVisibilityChange", error);
+            }
+        });
+    }
+    /**
+     * Callback registered with `window.addEventListener('visibilitychange')`.
+     */
+    _onVisibilityChanged(calledFromInitialize) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const methodName = `#_onVisibilityChanged(${calledFromInitialize})`;
+            this._debug(methodName, "visibilityState", document.visibilityState);
+            if (document.visibilityState === "visible") {
+                if (this.autoRefreshToken) {
+                    // in browser environments the refresh token ticker runs only on focused tabs
+                    // which prevents race conditions
+                    this._startAutoRefresh();
+                }
+                if (!calledFromInitialize) {
+                    // called when the visibility has changed, i.e. the browser
+                    // transitioned from hidden -> visible so we need to see if the session
+                    // should be recovered immediately... but to do that we need to acquire
+                    // the lock first asynchronously
+                    yield this.initializePromise;
+                    yield this.lock._acquireLock(-1, () => __awaiter(this, void 0, void 0, function* () {
+                        if (document.visibilityState !== "visible") {
+                            this._debug(methodName, "acquired the lock to recover the session, but the browser visibilityState is no longer visible, aborting");
+                            // visibility has changed while waiting for the lock, abort
+                            return;
+                        }
+                        // recover the session
+                        yield this._recoverAndRefresh();
+                    }));
+                }
+            }
+            else if (document.visibilityState === "hidden") {
+                if (this.autoRefreshToken) {
+                    this._stopAutoRefresh();
+                }
+            }
+        });
+    }
+    /**
+     * Recovers the session from LocalStorage and refreshes
+     * Note: this method is async to accommodate for AsyncStorage e.g. in React native.
+     */
+    _recoverAndRefresh() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const debugName = "#_recoverAndRefresh()";
+            this._debug(debugName, "begin");
+            try {
+                const currentSession = yield (0, storage_helpers_1.getItemAsync)(this.storage, this.storageKey);
+                this._debug(debugName, "session from storage", currentSession);
+                if (!this._isValidSession(currentSession)) {
+                    this._debug(debugName, "session is not valid");
+                    if (currentSession !== null) {
+                        yield this._removeSession();
+                    }
+                    return;
+                }
+                const timeNow = Math.round(Date.now() / 1000);
+                const expiresWithMargin = ((_a = currentSession.expires_at) !== null && _a !== void 0 ? _a : Infinity) < timeNow + constants_1.EXPIRY_MARGIN;
+                this._debug(debugName, `session has${expiresWithMargin ? "" : " not"} expired with margin of ${constants_1.EXPIRY_MARGIN}s`);
+                if (expiresWithMargin) {
+                    if (this.autoRefreshToken && currentSession.refresh_token) {
+                        const { error } = yield this._callRefreshToken(currentSession.refresh_token);
+                        if (error) {
+                            console.error(error);
+                            if (!(0, errors_1.isAuthRetryableFetchError)(error)) {
+                                this._debug(debugName, "refresh failed with a non-retryable error, removing the session", error);
+                                yield this._removeSession();
+                            }
+                        }
+                    }
+                }
+                else {
+                    // no need to persist currentSession again, as we just loaded it from
+                    // local storage; persisting it again may overwrite a value saved by
+                    // another client with access to the same local storage
+                    yield this._notifyAllSubscribers("SIGNED_IN", currentSession);
+                }
+            }
+            catch (err) {
+                this._debug(debugName, "error", err);
+                console.error(err);
+                return;
+            }
+            finally {
+                this._debug(debugName, "end");
+            }
+        });
+    }
+    /**
+     * Removes any registered visibilitychange callback.
+     *
+     * {@see #startAutoRefresh}
+     * {@see #stopAutoRefresh}
+     */
+    _removeVisibilityChangedCallback() {
+        this._debug("#_removeVisibilityChangedCallback()");
+        const callback = this.visibilityChangedCallback;
+        this.visibilityChangedCallback = null;
+        try {
+            if (callback && (0, helpers_1.isBrowser)() && (window === null || window === void 0 ? void 0 : window.removeEventListener)) {
+                window.removeEventListener("visibilitychange", callback);
+            }
+        }
+        catch (e) {
+            console.error("removing visibilitychange callback failed", e);
+        }
+    }
+    /**
+     * Starts an auto-refresh process in the background. The session is checked
+     * every few seconds. Close to the time of expiration a process is started to
+     * refresh the session. If refreshing fails it will be retried for as long as
+     * necessary.
+     *
+     * If you set the {@link GoTrueClientOptions#autoRefreshToken} you don't need
+     * to call this function, it will be called for you.
+     *
+     * On browsers the refresh process works only when the tab/window is in the
+     * foreground to conserve resources as well as prevent race conditions and
+     * flooding auth with requests. If you call this method any managed
+     * visibility change callback will be removed and you must manage visibility
+     * changes on your own.
+     *
+     * On non-browser platforms the refresh process works *continuously* in the
+     * background, which may not be desirable. You should hook into your
+     * platform's foreground indication mechanism and call these methods
+     * appropriately to conserve resources.
+     *
+     * {@see #stopAutoRefresh}
+     */
+    startAutoRefresh() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this._removeVisibilityChangedCallback();
+            yield this._startAutoRefresh();
+        });
+    }
+    /**
+     * This is the private implementation of {@link #startAutoRefresh}. Use this
+     * within the library.
+     */
+    _startAutoRefresh() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this._stopAutoRefresh();
+            this._debug("#_startAutoRefresh()");
+            const ticker = setInterval(() => this._autoRefreshTokenTick(), AUTO_REFRESH_TICK_DURATION);
+            this.autoRefreshTicker = ticker;
+            if (ticker &&
+                typeof ticker === "object" &&
+                typeof ticker.unref === "function") {
+                // ticker is a NodeJS Timeout object that has an `unref` method
+                // https://nodejs.org/api/timers.html#timeoutunref
+                // When auto refresh is used in NodeJS (like for testing) the
+                // `setInterval` is preventing the process from being marked as
+                // finished and tests run endlessly. This can be prevented by calling
+                // `unref()` on the returned object.
+                ticker.unref();
+                // @ts-ignore
+            }
+            else if (typeof globalThis.Deno !== "undefined" &&
+                typeof globalThis.Deno.unrefTimer === "function") {
+                // similar like for NodeJS, but with the Deno API
+                // https://deno.land/api@latest?unstable&s=Deno.unrefTimer
+                // @ts-ignore
+                Deno.unrefTimer(ticker);
+            }
+            // run the tick immediately, but in the next pass of the event loop so that
+            // #_initialize can be allowed to complete without recursively waiting on
+            // itself
+            setTimeout(() => __awaiter(this, void 0, void 0, function* () {
+                yield this.initializePromise;
+                yield this._autoRefreshTokenTick();
+            }), 0);
+        });
+    }
+    /**
+     * This is the private implementation of {@link #stopAutoRefresh}. Use this
+     * within the library.
+     */
+    _stopAutoRefresh() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this._debug("#_stopAutoRefresh()");
+            const ticker = this.autoRefreshTicker;
+            this.autoRefreshTicker = null;
+            if (ticker) {
+                clearInterval(ticker);
+            }
+        });
+    }
+    /**
+     * Runs the auto refresh token tick.
+     */
+    _autoRefreshTokenTick() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this._debug("#_autoRefreshTokenTick()", "begin");
+            try {
+                yield this.lock._acquireLock(0, () => __awaiter(this, void 0, void 0, function* () {
+                    try {
+                        const now = Date.now();
+                        try {
+                            return yield this._useSession((result) => __awaiter(this, void 0, void 0, function* () {
+                                const { data: { session }, } = result;
+                                if (!session || !session.refresh_token || !session.expires_at) {
+                                    this._debug("#_autoRefreshTokenTick()", "no session");
+                                    return;
+                                }
+                                // session will expire in this many ticks (or has already expired if <= 0)
+                                const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / AUTO_REFRESH_TICK_DURATION);
+                                this._debug("#_autoRefreshTokenTick()", `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`);
+                                if (expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD) {
+                                    yield this._callRefreshToken(session.refresh_token);
+                                }
+                            }));
+                        }
+                        catch (e) {
+                            console.error("Auto refresh tick failed with error. This is likely a transient error.", e);
+                        }
+                    }
+                    finally {
+                        this._debug("#_autoRefreshTokenTick()", "end");
+                    }
+                }));
+            }
+            catch (e) {
+                if (e.isAcquireTimeout || e instanceof locks_1.LockAcquireTimeoutError) {
+                    this._debug("auto refresh token tick lock not available");
+                }
+                else {
+                    throw e;
+                }
+            }
+        });
+    }
+    /**
+     * Checks if the current URL and backing storage contain parameters given by a PKCE flow
+     */
+    _isPKCEFlow() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const params = (0, helpers_1.parseParametersFromURL)(window.location.href);
+            const currentStorageContent = yield (0, storage_helpers_1.getItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+            return !!(params.code && currentStorageContent);
+        });
+    }
+    /**
+     * Checks if the current URL contains parameters given by an implicit oauth grant flow (https://www.rfc-editor.org/rfc/rfc6749.html#section-4.2)
+     */
+    _isImplicitGrantFlow() {
+        const params = (0, helpers_1.parseParametersFromURL)(window.location.href);
+        return !!((0, helpers_1.isBrowser)() && (params.access_token || params.error_description));
+    }
+    _scope() {
+        return this.scope || "openid profile email";
+    }
+    _getUrlForConnection(url, params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let urlParams = params.queryParams || {};
+            const authorize_params = {
+                client_id: this.clientId,
+                response_type: params.response_type,
+                redirect_uri: params.redirectTo || this.redirect_uri || window.location.origin,
+                scope: params.scopes || this._scope(),
+            };
+            if (this.flowType === "pkce") {
+                const [codeChallenge, codeChallengeMethod] = yield (0, helpers_1.getCodeChallengeAndMethod)(this.storage, this.storageKey);
+                urlParams = Object.assign(Object.assign({}, urlParams), { code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod });
+            }
+            // Set connection if specified
+            if (params.connection) {
+                authorize_params.connection = params.connection;
+            }
+            // Merge authorize params with urlParams
+            return `${url}?${new URLSearchParams(Object.assign(Object.assign({}, urlParams), authorize_params))}`;
+        });
+    }
+    signInWithOauthConnection(credentials) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this._handleConnectionSignIn({
+                connection: credentials.connection,
+                redirectTo: credentials === null || credentials === void 0 ? void 0 : credentials.redirectTo,
+                scopes: credentials === null || credentials === void 0 ? void 0 : credentials.scopes,
+                queryParams: credentials.queryParams,
+                skipBrowserRedirect: credentials.skipBrowserRedirect,
+            });
+        });
+    }
+    _handleConnectionSignIn(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const url = yield this._getUrlForConnection(`${this.domainUrl}/authorize`, {
+                response_type: (0, helpers_1.isBrowser)() ? "code" : "token",
+                connection: options.connection,
+                redirectTo: options.redirectTo,
+                scopes: options.scopes,
+                queryParams: options.queryParams,
+            });
+            this._debug("#_handleProviderSignIn()", "options", options, "url", url);
+            // try to open on the browser
+            if ((0, helpers_1.isBrowser)() && !options.skipBrowserRedirect) {
+                window.location.assign(url);
+            }
+            return { data: { url }, error: null };
+        });
+    }
+    /**
+     * Sets the session data from the current session. If the current session is expired, setSession will take care of refreshing it to obtain a new session.
+     * If the refresh token or access token in the current session is invalid, an error will be thrown.
+     * @param currentSession The current session that minimally contains an access token and refresh token.
+     */
+    setSession(currentSession) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.initializePromise;
+            return yield this.lock._acquireLock(-1, () => __awaiter(this, void 0, void 0, function* () {
+                return yield this._setSession(currentSession);
+            }));
+        });
+    }
+    /**
+     * Returns the session, refreshing it if necessary.
+     *
+     * The session returned can be null if the session is not detected which can happen in the event a user is not signed-in or has logged out.
+     *
+     * **IMPORTANT:** This method loads values directly from the storage attached
+     * to the client. If that storage is based on request cookies for example,
+     * the values in it may not be authentic and therefore it's strongly advised
+     * against using this method and its results in such circumstances. A warning
+     * will be emitted if this is detected. Use {@link #getUser()} instead.
+     */
+    getSession() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.initializePromise;
+            const result = yield this.lock._acquireLock(-1, () => __awaiter(this, void 0, void 0, function* () {
+                return this._useSession((result) => __awaiter(this, void 0, void 0, function* () {
+                    return result;
+                }));
+            }));
+            return result;
+        });
+    }
+    /**
+     * Use instead of {@link #getSession} inside the library. It is
+     * semantically usually what you want, as getting a session involves some
+     * processing afterwards that requires only one client operating on the
+     * session at once across multiple tabs or processes.
+     */
+    _useSession(fn) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this._debug("#_useSession", "begin");
+            try {
+                // the use of __loadSession here is the only correct use of the function!
+                const result = yield this.__loadSession();
+                return yield fn(result);
+            }
+            finally {
+                this._debug("#_useSession", "end");
+            }
+        });
+    }
+    /**
+     * NEVER USE DIRECTLY!
+     *
+     * Always use {@link #_useSession}.
+     */
+    __loadSession() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this._debug("#__loadSession()", "begin");
+            if (!this.lock.lockAcquired) {
+                this._debug("#__loadSession()", "used outside of an acquired lock!", new Error().stack);
+            }
+            try {
+                let currentSession = null;
+                const maybeSession = yield (0, storage_helpers_1.getItemAsync)(this.storage, this.storageKey);
+                this._debug("#getSession()", "session from storage", maybeSession);
+                if (maybeSession !== null) {
+                    if (this._isValidSession(maybeSession)) {
+                        currentSession = maybeSession;
+                    }
+                    else {
+                        this._debug("#getSession()", "session from storage is not valid");
+                        yield this._removeSession();
+                    }
+                }
+                if (!currentSession) {
+                    return { data: { session: null }, error: null };
+                }
+                const hasExpired = currentSession.expires_at
+                    ? currentSession.expires_at <= Date.now() / 1000
+                    : false;
+                this._debug("#__loadSession()", `session has${hasExpired ? "" : " not"} expired`, "expires_at", currentSession.expires_at);
+                if (!hasExpired) {
+                    if (this.storage.isServer) {
+                        const proxySession = new Proxy(currentSession, {
+                            get(target, prop, receiver) {
+                                if (prop === "user") {
+                                    // only show warning when the user object is being accessed from the server
+                                    console.warn("Using the user object as returned from supabase.auth.getSession() or from some supabase.auth.onAuthStateChange() events could be insecure! This value comes directly from the storage medium (usually cookies on the server) and many not be authentic. Use supabase.auth.getUser() instead which authenticates the data by contacting the Supabase Auth server.");
+                                }
+                                return Reflect.get(target, prop, receiver);
+                            },
+                        });
+                        currentSession = proxySession;
+                    }
+                    return { data: { session: currentSession }, error: null };
+                }
+                const { session, error } = yield this._callRefreshToken(currentSession.refresh_token);
+                if (error) {
+                    return { data: { session: null }, error };
+                }
+                return { data: { session }, error: null };
+            }
+            finally {
+                this._debug("#__loadSession()", "end");
+            }
+        });
+    }
+    _removeSession() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this._debug("#_removeSession()");
+            yield (0, storage_helpers_1.removeItemAsync)(this.storage, this.storageKey);
+        });
+    }
+    _isValidSession(maybeSession) {
+        const isValidSession = typeof maybeSession === "object" &&
+            maybeSession !== null &&
+            "access_token" in maybeSession &&
+            "refresh_token" in maybeSession &&
+            "expires_at" in maybeSession;
+        return isValidSession;
+    }
+    _setSession(currentSession) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                if (!currentSession.access_token || !currentSession.refresh_token) {
+                    throw new errors_1.AuthSessionMissingError();
+                }
+                const timeNow = Date.now() / 1000;
+                let expiresAt = timeNow;
+                let hasExpired = true;
+                let session = null;
+                const payload = (0, jwt_1.decodeJWTPayload)(currentSession.access_token);
+                if (payload.exp) {
+                    expiresAt = payload.exp;
+                    hasExpired = expiresAt <= timeNow;
+                }
+                if (hasExpired) {
+                    const { session: refreshedSession, error } = yield this._callRefreshToken(currentSession.refresh_token);
+                    if (error) {
+                        return { data: { user: null, session: null }, error: error };
+                    }
+                    if (!refreshedSession) {
+                        return { data: { user: null, session: null }, error: null };
+                    }
+                    session = refreshedSession;
+                }
+                else {
+                    const { data, error } = yield this._getUser(currentSession.access_token);
+                    if (error) {
+                        throw error;
+                    }
+                    session = {
+                        access_token: currentSession.access_token,
+                        refresh_token: currentSession.refresh_token,
+                        user: data.user,
+                        token_type: "bearer",
+                        expires_in: expiresAt - timeNow,
+                        expires_at: expiresAt,
+                    };
+                    yield this._saveSession(session);
+                    yield this._notifyAllSubscribers("SIGNED_IN", session);
+                }
+                return { data: { user: session.user, session }, error: null };
+            }
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { data: { session: null, user: null }, error };
+                }
+                throw error;
+            }
+        });
+    }
+    /**
+     * set currentSession and currentUser
+     * process to _startAutoRefreshToken if possible
+     */
+    _saveSession(session) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this._debug("#_saveSession()", session);
+            yield (0, storage_helpers_1.setItemAsync)(this.storage, this.storageKey, session);
+        });
+    }
+    _getUser(access_token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!access_token)
+                throw new Error("Cannot fetch user without token");
+            this._debug("#_getUser() begin");
+            const res = yield (0, fetch_1._get)(`${this.domainUrl}/me`, {
+                token: access_token,
+            });
+            this._debug("#_getUser() end");
+            return { data: { user: res.data }, error: res.error };
+        });
+    }
+    _callRefreshToken(refreshToken) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            if (!refreshToken) {
+                throw new errors_1.AuthSessionMissingError();
+            }
+            // refreshing is already in progress
+            if (this.refreshingDeferred) {
+                return this.refreshingDeferred.promise;
+            }
+            const debugName = `#_callRefreshToken(${refreshToken.substring(0, 5)}...)`;
+            this._debug(debugName, "begin");
+            try {
+                this.refreshingDeferred = new helpers_1.Deferred();
+                const { data, error } = yield this._refreshAccessToken(refreshToken);
+                if (error)
+                    throw error;
+                if (!data.session)
+                    throw new errors_1.AuthSessionMissingError();
+                yield this._saveSession(data.session);
+                yield this._notifyAllSubscribers("TOKEN_REFRESHED", data.session);
+                const result = { session: data.session, error: null };
+                this.refreshingDeferred.resolve(result);
+                return result;
+            }
+            catch (error) {
+                this._debug(debugName, "error", error);
+                if ((0, errors_1.isAuthError)(error)) {
+                    const result = { session: null, error };
+                    if (!(0, errors_1.isAuthRetryableFetchError)(error)) {
+                        yield this._removeSession();
+                        yield this._notifyAllSubscribers("SIGNED_OUT", null);
+                    }
+                    (_a = this.refreshingDeferred) === null || _a === void 0 ? void 0 : _a.resolve(result);
+                    return result;
+                }
+                (_b = this.refreshingDeferred) === null || _b === void 0 ? void 0 : _b.reject(error);
+                throw error;
+            }
+            finally {
+                this.refreshingDeferred = null;
+                this._debug(debugName, "end");
+            }
+        });
+    }
+    /**
+     * Generates a new JWT.
+     * @param refreshToken A valid refresh token that was returned on login.
+     */
+    _refreshAccessToken(refreshToken) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const debugName = `#_refreshAccessToken(${refreshToken.substring(0, 5)}...)`;
+            this._debug(debugName, "begin");
+            try {
+                const startedAt = Date.now();
+                // will attempt to refresh the token with exponential backoff
+                return yield (0, helpers_1.retryable)((attempt) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    if (attempt > 0) {
+                        yield (0, helpers_1.sleep)(200 * Math.pow(2, attempt - 1)); // 200, 400, 800, ...
+                    }
+                    this._debug(debugName, "refreshing attempt", attempt);
+                    // return await _post(`${this.url}/token?grant_type=refresh_token`, {
+                    //   body: { refresh_token: refreshToken },
+                    //   headers: this.headers,
+                    //   xform: _sessionResponse,
+                    // });
+                    const session_res = yield (0, fetch_1._post)(`${this.domainUrl}/oauth/token`, {
+                        client_id: this.clientId,
+                        grant_type: "refresh_token",
+                        refresh_token: refreshToken,
+                    }, { transform: helpers_1._sessionResponse });
+                    const user_res = yield this._getUser((_a = session_res.data.session) === null || _a === void 0 ? void 0 : _a.access_token);
+                    const { user } = user_res.data;
+                    const x = {
+                        data: {
+                            session: Object.assign(Object.assign({}, session_res.data.session), { user }),
+                            user,
+                        },
+                        error: null,
+                    };
+                    // this._debug(x);
+                    return x;
+                }), (attempt, error) => {
+                    const nextBackOffInterval = 200 * Math.pow(2, attempt);
+                    return (error &&
+                        (0, errors_1.isAuthRetryableFetchError)(error) &&
+                        // retryable only if the request can be sent before the backoff overflows the tick duration
+                        Date.now() + nextBackOffInterval - startedAt <
+                            AUTO_REFRESH_TICK_DURATION);
+                });
+            }
+            catch (error) {
+                this._debug(debugName, "error", error);
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { data: { session: null, user: null }, error };
+                }
+                throw error;
+            }
+            finally {
+                this._debug(debugName, "end");
+            }
+        });
+    }
+    _notifyAllSubscribers(event_1, session_1) {
+        return __awaiter(this, arguments, void 0, function* (event, session, broadcast = true) {
+            const debugName = `#_notifyAllSubscribers(${event})`;
+            this._debug(debugName, "begin", session, `broadcast = ${broadcast}`);
+            try {
+                if (this.broadcastChannel && broadcast) {
+                    this.broadcastChannel.postMessage({ event, session });
+                }
+                const errors = [];
+                const promises = Array.from(this.stateChangeEmitters.values()).map((x) => __awaiter(this, void 0, void 0, function* () {
+                    try {
+                        yield x.callback(event, session);
+                    }
+                    catch (e) {
+                        errors.push(e);
+                    }
+                }));
+                yield Promise.all(promises);
+                if (errors.length > 0) {
+                    for (let i = 0; i < errors.length; i += 1) {
+                        console.error(errors[i]);
+                    }
+                    throw errors[0];
+                }
+            }
+            finally {
+                this._debug(debugName, "end");
+            }
+        });
+    }
+    /**
+     * Inside a browser context, `signOut()` will remove the logged in user from the browser session and log them out - removing all items from localstorage and then trigger a `"SIGNED_OUT"` event.
+     *
+     * For server-side management, you can revoke all refresh tokens for a user by passing a user's JWT through to `auth.api.signOut(JWT: string)`.
+     * There is no way to revoke a user's access token jwt until it expires. It is recommended to set a shorter expiry on the jwt for this reason.
+     *
+     * If using `others` scope, no `SIGNED_OUT` event is fired!
+     */
+    signOut() {
+        return __awaiter(this, arguments, void 0, function* (options = { scope: "global" }) {
+            yield this.initializePromise;
+            return yield this.lock._acquireLock(-1, () => __awaiter(this, void 0, void 0, function* () {
+                return yield this._signOut(options);
+            }));
+        });
+    }
+    _signOut() {
+        return __awaiter(this, arguments, void 0, function* ({ scope } = { scope: "global" }) {
+            return yield this._useSession((result) => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                const { data, error: sessionError } = result;
+                if (sessionError) {
+                    return { error: sessionError };
+                }
+                const accessToken = (_a = data.session) === null || _a === void 0 ? void 0 : _a.access_token;
+                if (accessToken) {
+                    const { error } = yield this.api.signOut({ client_id: this.clientId });
+                    if (error) {
+                        // ignore 404s since user might not exist anymore
+                        // ignore 401s since an invalid or expired JWT should sign out the current session
+                        if (!((0, errors_1.isAuthApiError)(error) &&
+                            (error.status === 404 || error.status === 401))) {
+                            return { error };
+                        }
+                    }
+                }
+                if (scope !== "others") {
+                    yield this._removeSession();
+                    yield (0, storage_helpers_1.removeItemAsync)(this.storage, `${this.storageKey}-code-verifier`);
+                    yield this._notifyAllSubscribers("SIGNED_OUT", null);
+                }
+                return { error: null };
+            }));
+        });
+    }
+    /**
+     * Receive a notification every time an auth event happens.
+     * @param callback A callback function to be invoked when an auth event happens.
+     */
+    onAuthStateChange(callback) {
+        const id = (0, helpers_1.uuid)();
+        const subscription = {
+            id,
+            callback,
+            unsubscribe: () => {
+                this._debug("#unsubscribe()", "state change callback with id removed", id);
+                this.stateChangeEmitters.delete(id);
+            },
+        };
+        this._debug("#onAuthStateChange()", "registered callback with id", id);
+        this.stateChangeEmitters.set(id, subscription);
+        (() => __awaiter(this, void 0, void 0, function* () {
+            yield this.initializePromise;
+            yield this.lock._acquireLock(-1, () => __awaiter(this, void 0, void 0, function* () {
+                this._emitInitialSession(id);
+            }));
+        }))();
+        return { data: { subscription } };
+    }
+    _emitInitialSession(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this._useSession((result) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b;
+                try {
+                    const { data: { session }, error, } = result;
+                    if (error)
+                        throw error;
+                    yield ((_a = this.stateChangeEmitters
+                        .get(id)) === null || _a === void 0 ? void 0 : _a.callback("INITIAL_SESSION", session));
+                    this._debug("INITIAL_SESSION", "callback id", id, "session", session);
+                }
+                catch (err) {
+                    yield ((_b = this.stateChangeEmitters
+                        .get(id)) === null || _b === void 0 ? void 0 : _b.callback("INITIAL_SESSION", null));
+                    this._debug("INITIAL_SESSION", "callback id", id, "error", err);
+                    console.error(err);
+                }
+            }));
+        });
+    }
+    /**
+     * Returns a new session, regardless of expiry status.
+     * Takes in an optional current session. If not passed in, then refreshSession() will attempt to retrieve it from getSession().
+     * If the current session's refresh token is invalid, an error will be thrown.
+     * @param currentSession The current session. If passed in, it must contain a refresh token.
+     */
+    refreshSession(currentSession) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.initializePromise;
+            return yield this.lock._acquireLock(-1, () => __awaiter(this, void 0, void 0, function* () {
+                return yield this._refreshSession(currentSession);
+            }));
+        });
+    }
+    _refreshSession(currentSession) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield this._useSession((result) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    if (!currentSession) {
+                        const { data, error } = result;
+                        if (error) {
+                            throw error;
+                        }
+                        currentSession = (_a = data.session) !== null && _a !== void 0 ? _a : undefined;
+                    }
+                    if (!(currentSession === null || currentSession === void 0 ? void 0 : currentSession.refresh_token)) {
+                        throw new errors_1.AuthSessionMissingError();
+                    }
+                    const { session, error } = yield this._callRefreshToken(currentSession.refresh_token);
+                    if (error) {
+                        return { data: { user: null, session: null }, error: error };
+                    }
+                    if (!session) {
+                        return { data: { user: null, session: null }, error: null };
+                    }
+                    return { data: { user: session.user, session }, error: null };
+                }));
+            }
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { data: { user: null, session: null }, error };
+                }
+                throw error;
+            }
+        });
+    }
+}
+exports.FaableAuthClient = FaableAuthClient;