@fayz-ai/auth 0.47.0 → 0.48.0

package/dist/index.js

@@ -1,575 +1,8 @@
-import { createClient } from '@supabase/supabase-js';
-import { isImpersonating } from '@fayz-ai/core';
-import { create } from 'zustand';
-import { createContext, useRef, useEffect, useContext } from 'react';
-import { jsx } from 'react/jsx-runtime';
-
-// src/adapters/supabase.ts
-
-// src/lib/url-intent.ts
-var AUTH_INTENT_PARAM = "fayz_auth";
-var RESET_PATH = "/auth/reset-password";
-function snapshot() {
-  const loc = typeof window === "undefined" ? void 0 : window.location;
-  if (!loc) return null;
-  return {
-    pathname: loc.pathname ?? "",
-    search: loc.search ?? "",
-    hash: loc.hash ?? ""
-  };
-}
-var initialUrl = snapshot();
-function hashParams(hash) {
-  const raw = hash.replace(/^#/, "");
-  if (!raw || !raw.includes("=")) return new URLSearchParams();
-  return new URLSearchParams(raw);
-}
-function readAuthUrlIntent(url) {
-  const loc = url ?? initialUrl;
-  if (!loc) return null;
-  const query = new URLSearchParams(loc.search);
-  const hash = hashParams(loc.hash);
-  const param = (key) => hash.get(key) ?? query.get(key);
-  const errorCode = param("error_code") ?? param("error");
-  const errorDescription = param("error_description")?.replace(/\+/g, " ");
-  if (errorCode && /otp|expired|link/i.test(`${errorCode} ${errorDescription ?? ""}`)) {
-    return { kind: "expired", message: errorDescription ?? void 0 };
-  }
-  const marker = query.get(AUTH_INTENT_PARAM);
-  const type = param("type");
-  if (type === "recovery" || marker === "recovery") return { kind: "recovery" };
-  const path = loc.pathname.replace(/\/+$/, "");
-  if (path.endsWith(RESET_PATH)) return { kind: "recovery" };
-  return null;
-}
-var APP_HANDOFF_PARAM = "handoff";
-var APP_HANDOFF_REFRESH_PARAM = "handoff_r";
-var APP_HANDOFF_TENANT_PARAM = "account";
-function readAppHandoff(url) {
-  const loc = url ?? initialUrl;
-  if (!loc) return null;
-  const hash = hashParams(loc.hash);
-  const accessToken = hash.get(APP_HANDOFF_PARAM);
-  const refreshToken = hash.get(APP_HANDOFF_REFRESH_PARAM);
-  if (!accessToken || !refreshToken) return null;
-  return {
-    accessToken,
-    refreshToken,
-    tenantId: hash.get(APP_HANDOFF_TENANT_PARAM) || null
-  };
-}
-function buildAppHandoffUrl(appUrl, session, tenantId) {
-  if (!session.accessToken || !session.refreshToken) return appUrl;
-  const params = new URLSearchParams();
-  params.set(APP_HANDOFF_PARAM, session.accessToken);
-  params.set(APP_HANDOFF_REFRESH_PARAM, session.refreshToken);
-  if (tenantId) params.set(APP_HANDOFF_TENANT_PARAM, tenantId);
-  const base = appUrl.split("#")[0];
-  return `${base}#${params.toString()}`;
-}
-function clearAuthUrlTokens() {
-  if (typeof window === "undefined") return;
-  const url = new URL(window.location.href);
-  url.searchParams.delete(AUTH_INTENT_PARAM);
-  if (url.hash.includes("=")) url.hash = "";
-  window.history.replaceState(window.history.state, "", url.toString());
-}
-function withAuthIntent(url, intent) {
-  const base = typeof window === "undefined" ? "http://localhost" : window.location.origin;
-  const parsed = new URL(url, base);
-  parsed.searchParams.set(AUTH_INTENT_PARAM, intent);
-  return /^https?:\/\//i.test(url) ? parsed.toString() : `${parsed.pathname}${parsed.search}${parsed.hash}`;
-}
-var NOTHING = { reason: null, expired: false, checking: false };
-function decidePasswordSetup(input) {
-  const { intent, isLoading, isAuthenticated, mustSetPassword } = input;
-  if (intent?.kind === "expired") return { reason: "recovery", expired: true, checking: false };
-  if (intent?.kind === "recovery") {
-    if (isLoading) return { reason: "recovery", expired: false, checking: true };
-    return { reason: "recovery", expired: !isAuthenticated, checking: false };
-  }
-  if (!isLoading && isAuthenticated && mustSetPassword) {
-    return { reason: "invite", expired: false, checking: false };
-  }
-  return NOTHING;
-}
-
-// src/adapters/supabase.ts
-var MUST_SET_PASSWORD_FLAG = "fayz_must_set_password";
-function mapSupabaseUser(supabaseUser) {
-  return {
-    id: supabaseUser.id,
-    email: supabaseUser.email ?? "",
-    fullName: supabaseUser.user_metadata?.["full_name"] ?? supabaseUser.user_metadata?.["name"] ?? "",
-    avatarUrl: supabaseUser.user_metadata?.["avatar_url"],
-    // An admin viewing as this person must not be pushed into choosing THEIR password.
-    mustSetPassword: supabaseUser.user_metadata?.[MUST_SET_PASSWORD_FLAG] === true && !isImpersonating()
-  };
-}
-function mapSupabaseSession(session) {
-  return {
-    accessToken: session.access_token,
-    refreshToken: session.refresh_token,
-    expiresAt: session.expires_at ?? Math.floor(Date.now() / 1e3) + (session.expires_in ?? 3600),
-    user: mapSupabaseUser(session.user)
-  };
-}
-function createSupabaseAuthAdapter(config) {
-  const supabase = config.supabaseClient ?? createClient(config.supabaseUrl, config.supabaseAnonKey);
-  return {
-    async getSession() {
-      const {
-        data: { session }
-      } = await supabase.auth.getSession();
-      if (!session) return null;
-      const mapped = mapSupabaseSession(session);
-      return { user: mapped.user, session: mapped };
-    },
-    onAuthStateChange(cb) {
-      const {
-        data: { subscription }
-      } = supabase.auth.onAuthStateChange((_event, session) => {
-        cb(session ? mapSupabaseUser(session.user) : null);
-      });
-      return () => subscription.unsubscribe();
-    },
-    async signIn(email, password) {
-      const { data, error } = await supabase.auth.signInWithPassword({ email, password });
-      if (error) throw error;
-      return mapSupabaseSession(data.session);
-    },
-    /**
-     * Adopt a session handed over by a sibling application (see url-intent).
-     *
-     * `setSession` is the verification, not a formality: GoTrue validates the
-     * tokens and rotates the refresh token, so a forged or replayed fragment
-     * fails here rather than being trusted because it looked well-formed.
-     */
-    async adoptSession(accessToken, refreshToken) {
-      const { data, error } = await supabase.auth.setSession({
-        access_token: accessToken,
-        refresh_token: refreshToken
-      });
-      if (error || !data.session) return null;
-      return mapSupabaseSession(data.session);
-    },
-    async signUp(email, password, fullName) {
-      const { data, error } = await supabase.auth.signUp({
-        email,
-        password,
-        options: { data: { full_name: fullName } }
-      });
-      if (error) throw error;
-      if (!data.session) {
-        if (!data.user) throw new Error("Signup failed: no user returned");
-        return {
-          accessToken: "",
-          refreshToken: "",
-          expiresAt: 0,
-          user: mapSupabaseUser(data.user)
-        };
-      }
-      return mapSupabaseSession(data.session);
-    },
-    async resendConfirmation(email, options) {
-      const { error } = await supabase.auth.resend({
-        type: "signup",
-        email,
-        options: {
-          emailRedirectTo: options?.redirectTo ?? config.callbackUrl ?? (typeof window !== "undefined" ? window.location.origin : void 0)
-        }
-      });
-      if (error) throw error;
-    },
-    async signOut() {
-      const { error } = await supabase.auth.signOut();
-      if (error) throw error;
-    },
-    async signInWithOAuth(provider) {
-      const { error } = await supabase.auth.signInWithOAuth({
-        provider,
-        options: {
-          redirectTo: config.callbackUrl ?? (typeof window !== "undefined" ? `${window.location.origin}/auth/callback` : void 0)
-        }
-      });
-      if (error) throw error;
-    },
-    async resetPassword(email, options) {
-      const explicit = options?.redirectTo ?? config.resetPasswordUrl;
-      const { error } = await supabase.auth.resetPasswordForEmail(email, {
-        redirectTo: explicit ? withAuthIntent(explicit, "recovery") : typeof window !== "undefined" ? `${window.location.origin}/` : void 0
-      });
-      if (error) throw error;
-    },
-    async updatePassword(password) {
-      const { data, error } = await supabase.auth.updateUser({
-        password,
-        data: { [MUST_SET_PASSWORD_FLAG]: false }
-      });
-      if (error) throw error;
-      const {
-        data: { session }
-      } = await supabase.auth.getSession();
-      if (session) return mapSupabaseSession(session);
-      if (!data.user) return void 0;
-      return {
-        accessToken: "",
-        refreshToken: "",
-        expiresAt: 0,
-        user: mapSupabaseUser(data.user)
-      };
-    },
-    async handleCallback(url) {
-      const target = url ?? (typeof window !== "undefined" ? window.location.href : "");
-      const parsed = new URL(target);
-      const fragment = new URLSearchParams(parsed.hash.replace(/^#/, ""));
-      const param = (key) => parsed.searchParams.get(key) ?? fragment.get(key);
-      const code = param("code");
-      if (code) {
-        const { data, error } = await supabase.auth.exchangeCodeForSession(code);
-        if (error) throw error;
-        return data.session ? mapSupabaseSession(data.session) : null;
-      }
-      const tokenHash = param("token_hash") ?? param("token");
-      const type = param("type");
-      if (tokenHash && type) {
-        const { data, error } = await supabase.auth.verifyOtp({
-          token_hash: tokenHash,
-          type
-        });
-        if (error) throw error;
-        return data.session ? mapSupabaseSession(data.session) : null;
-      }
-      const {
-        data: { session }
-      } = await supabase.auth.getSession();
-      return session ? mapSupabaseSession(session) : null;
-    },
-    async inviteUser(email, options) {
-      const { error } = await supabase.auth.signInWithOtp({
-        email,
-        options: {
-          shouldCreateUser: true,
-          emailRedirectTo: options?.redirectTo ?? (typeof window !== "undefined" ? `${window.location.origin}/` : void 0),
-          // `data` only lands on users the OTP actually creates, which is exactly
-          // who needs a password: the shell holds them on the set-password screen
-          // until they choose one, so they can sign in normally from then on.
-          data: { ...options?.data, [MUST_SET_PASSWORD_FLAG]: true }
-        }
-      });
-      if (error) throw error;
-    }
-  };
-}
-
-// src/adapters/mock.ts
-var DEFAULT_MOCK_USER = {
-  id: "mock-user-id",
-  email: "demo@fayz.dev",
-  fullName: "Demo User",
-  role: "admin"
-};
-var STORAGE_KEY = "fayz:mock-auth";
-function toAuthUser(mockUser) {
-  return {
-    id: mockUser.id,
-    email: mockUser.email,
-    fullName: mockUser.fullName
-  };
-}
-function createMockSession(user) {
-  return {
-    accessToken: `mock-token-${user.id}`,
-    refreshToken: `mock-refresh-${user.id}`,
-    expiresAt: Math.floor(Date.now() / 1e3) + 3600,
-    user
-  };
-}
-function getStored() {
-  try {
-    if (typeof localStorage === "undefined") return null;
-    const raw = localStorage.getItem(STORAGE_KEY);
-    if (!raw) return null;
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function setStored(data) {
-  try {
-    if (typeof localStorage === "undefined") return;
-    if (data) {
-      localStorage.setItem(STORAGE_KEY, JSON.stringify(data));
-    } else {
-      localStorage.removeItem(STORAGE_KEY);
-    }
-  } catch {
-  }
-}
-function createMockAuthAdapter(mockUser = DEFAULT_MOCK_USER) {
-  const listeners = /* @__PURE__ */ new Set();
-  function notifyListeners(user) {
-    for (const cb of listeners) cb(user);
-  }
-  return {
-    async getSession() {
-      return getStored();
-    },
-    onAuthStateChange(cb) {
-      listeners.add(cb);
-      return () => {
-        listeners.delete(cb);
-      };
-    },
-    async signIn(email, _password) {
-      const stored = getStored();
-      const user = stored && stored.user.email === email ? stored.user : {
-        id: email === mockUser.email ? mockUser.id : `mock-${email}`,
-        email,
-        fullName: email === mockUser.email ? mockUser.fullName : email.split("@")[0] ?? "Cliente"
-      };
-      const session = createMockSession(user);
-      setStored({ user, session });
-      notifyListeners(user);
-      return session;
-    },
-    async signUp(email, _password, fullName) {
-      const user = {
-        id: `mock-${email}`,
-        email,
-        fullName: fullName || (email.split("@")[0] ?? "Cliente")
-      };
-      const session = createMockSession(user);
-      setStored({ user, session });
-      notifyListeners(user);
-      return session;
-    },
-    async signOut() {
-      setStored(null);
-      notifyListeners(null);
-    },
-    async signInWithOAuth(_provider) {
-      const user = toAuthUser(mockUser);
-      const session = createMockSession(user);
-      setStored({ user, session });
-      notifyListeners(user);
-    },
-    async resetPassword(_email) {
-    },
-    async updatePassword(_password) {
-      const stored = getStored();
-      return stored?.session;
-    },
-    async handleCallback() {
-      return getStored()?.session ?? null;
-    },
-    async inviteUser(_email, _options) {
-    }
-  };
-}
-var initialState = {
-  user: null,
-  session: null,
-  isLoading: true,
-  isAuthenticated: false,
-  error: null,
-  pendingVerification: null
-};
-var useAuthStore = create((set) => ({
-  ...initialState,
-  setUser: (user) => set({ user, isAuthenticated: user !== null }),
-  setSession: (session) => set({
-    session,
-    user: session?.user ?? null,
-    isAuthenticated: session !== null,
-    // A real session arriving is the confirmation landing — the notice it
-    // would otherwise keep showing is now about an address already verified.
-    ...session ? { pendingVerification: null } : {}
-  }),
-  setLoading: (isLoading) => set({ isLoading }),
-  setError: (error) => set({ error }),
-  setPendingVerification: (pendingVerification) => set({ pendingVerification }),
-  reset: () => set(initialState)
-}));
-var AuthContext = createContext(null);
-function AuthProvider({ adapter, children }) {
-  const { setSession, setLoading, setError, setPendingVerification, reset } = useAuthStore();
-  const adapterRef = useRef(adapter);
-  adapterRef.current = adapter;
-  useEffect(() => {
-    let unsubscribe;
-    async function init() {
-      try {
-        setLoading(true);
-        const handoff = readAppHandoff();
-        const adopt = adapterRef.current.adoptSession;
-        let adopted = null;
-        if (handoff && typeof adopt === "function") {
-          adopted = await adopt.call(adapterRef.current, handoff.accessToken, handoff.refreshToken);
-          clearAuthUrlTokens();
-        }
-        const result = adopted ? { session: adopted } : await adapterRef.current.getSession();
-        setSession(result?.session ?? null);
-      } catch (err) {
-        setError(err instanceof Error ? err : new Error(String(err)));
-      } finally {
-        setLoading(false);
-      }
-      unsubscribe = adapterRef.current.onAuthStateChange((user) => {
-        if (!user) {
-          reset();
-          setLoading(false);
-          return;
-        }
-        void adapterRef.current.getSession().then((result) => setSession(result?.session ?? null)).catch(() => {
-        });
-      });
-    }
-    void init();
-    return () => {
-      unsubscribe?.();
-    };
-  }, []);
-  const value = {
-    async signIn(email, password) {
-      setError(null);
-      try {
-        const session = await adapterRef.current.signIn(email, password);
-        setSession(session);
-        return session;
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    async signUp(email, password, fullName) {
-      setError(null);
-      try {
-        const session = await adapterRef.current.signUp(email, password, fullName);
-        if (!session.accessToken) {
-          setPendingVerification({ email });
-          return session;
-        }
-        setSession(session);
-        return session;
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    async signOut() {
-      setError(null);
-      try {
-        await adapterRef.current.signOut();
-        reset();
-        setLoading(false);
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    async signInWithOAuth(provider) {
-      setError(null);
-      try {
-        await adapterRef.current.signInWithOAuth(provider);
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    async resetPassword(email, options) {
-      setError(null);
-      try {
-        await adapterRef.current.resetPassword(email, options);
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    async updatePassword(password) {
-      setError(null);
-      try {
-        const session = await adapterRef.current.updatePassword?.(password);
-        if (session) setSession(session);
-        return session;
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    async handleCallback(url) {
-      setError(null);
-      try {
-        const session = await adapterRef.current.handleCallback?.(url) ?? null;
-        if (session) setSession(session);
-        return session;
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    async inviteUser(email, options) {
-      setError(null);
-      try {
-        await adapterRef.current.inviteUser?.(email, options);
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    async resendConfirmation(email, options) {
-      setError(null);
-      if (!adapterRef.current.resendConfirmation) return false;
-      try {
-        await adapterRef.current.resendConfirmation(email, options);
-        return true;
-      } catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        setError(error);
-        throw error;
-      }
-    },
-    clearPendingVerification() {
-      setPendingVerification(null);
-      setError(null);
-    }
-  };
-  return /* @__PURE__ */ jsx(AuthContext.Provider, { value, children });
-}
-function useAuth() {
-  const ctx = useContext(AuthContext);
-  if (!ctx) {
-    throw new Error("useAuth must be used inside <AuthProvider>");
-  }
-  const { user, session, isLoading, isAuthenticated, error, pendingVerification } = useAuthStore();
-  return {
-    user,
-    session,
-    isLoading,
-    isAuthenticated,
-    error,
-    pendingVerification,
-    signIn: ctx.signIn,
-    signUp: ctx.signUp,
-    signOut: ctx.signOut,
-    signInWithOAuth: ctx.signInWithOAuth,
-    resetPassword: ctx.resetPassword,
-    updatePassword: ctx.updatePassword,
-    handleCallback: ctx.handleCallback,
-    inviteUser: ctx.inviteUser,
-    resendConfirmation: ctx.resendConfirmation,
-    clearPendingVerification: ctx.clearPendingVerification
-  };
-}
-
-export { APP_HANDOFF_PARAM, APP_HANDOFF_REFRESH_PARAM, APP_HANDOFF_TENANT_PARAM, AUTH_INTENT_PARAM, AuthProvider, MUST_SET_PASSWORD_FLAG, buildAppHandoffUrl, clearAuthUrlTokens, createMockAuthAdapter, createSupabaseAuthAdapter, decidePasswordSetup, readAppHandoff, readAuthUrlIntent, useAuth, useAuthStore, withAuthIntent };
+export { decidePasswordSetup } from './chunk-2S7KVJQO.js';
+export { AuthProvider, useAuth } from './chunk-Q6DFI35B.js';
+export { useAuthStore } from './chunk-OI74ER2Z.js';
+export { createMockAuthAdapter } from './chunk-CV4LQYNX.js';
+export { MUST_SET_PASSWORD_FLAG, createSupabaseAuthAdapter } from './chunk-BGCCXJJA.js';
+export { APP_HANDOFF_PARAM, APP_HANDOFF_REFRESH_PARAM, APP_HANDOFF_TENANT_PARAM, AUTH_INTENT_PARAM, buildAppHandoffUrl, clearAuthUrlTokens, readAppHandoff, readAuthUrlIntent, withAuthIntent } from './chunk-2MO4QTQA.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map