@feelflow/ffid-sdk 5.17.0 → 5.18.0

package/dist/server/index.js

@@ -1,6 +1,6 @@
 import { DEFAULT_API_BASE_URL } from '../chunk-JEVK2XUM.js';
 export { DEFAULT_API_BASE_URL, DEFAULT_OAUTH_SCOPES } from '../chunk-JEVK2XUM.js';
-import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { createRemoteJWKSet, jwtVerify, errors } from 'jose';
 
 // src/auth/token-store.ts
 var STORAGE_KEY = "ffid_tokens";
@@ -111,10 +111,13 @@ function hasOwnKey(value, key) {
 function normalizeUserinfo(raw) {
   const hasOrganizationId = hasOwnKey(raw, "organization_id");
   const hasOrganizationName = hasOwnKey(raw, "organization_name");
-  const organizationFields = hasOrganizationId ? {
-    organizationId: raw.organization_id ?? null,
-    organizationName: hasOrganizationName ? raw.organization_name ?? null : null
-  } : hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {};
+  const hasOrganizationMemberRole = hasOwnKey(raw, "organization_member_role");
+  const organizationMemberRole = hasOrganizationMemberRole ? raw.organization_member_role ?? null : raw.subscription ? raw.subscription.member_role ?? null : void 0;
+  const organizationFields = {
+    ...hasOrganizationId ? { organizationId: raw.organization_id ?? null } : {},
+    ...hasOrganizationId || hasOrganizationName ? { organizationName: raw.organization_name ?? null } : {},
+    ...organizationMemberRole !== void 0 ? { organizationMemberRole } : {}
+  };
   return {
     sub: raw.sub,
     email: raw.email,
@@ -221,10 +224,29 @@ function createJwtVerifier(deps) {
       return { data: userInfo };
     } catch (error) {
       const message = error instanceof Error ? error.message : "JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F";
-      logger.error("JWT verification failed:", message);
+      if (error instanceof errors.JWTExpired) {
+        logger.debug("JWT verification failed (token expired):", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_EXPIRED,
+            "\u30A2\u30AF\u30BB\u30B9\u30C8\u30FC\u30AF\u30F3\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u3066\u3044\u307E\u3059"
+          )
+        };
+      }
+      const isTokenLevelError = error instanceof errors.JWTClaimValidationFailed || error instanceof errors.JWTInvalid || error instanceof errors.JWSInvalid || error instanceof errors.JWSSignatureVerificationFailed || error instanceof errors.JOSEAlgNotAllowed || error instanceof errors.JOSENotSupported || error instanceof errors.JWKSNoMatchingKey || error instanceof errors.JWKSMultipleMatchingKeys;
+      if (isTokenLevelError) {
+        logger.warn("JWT verification failed:", message);
+        return {
+          error: createError(
+            errorCodes.TOKEN_VERIFICATION_ERROR,
+            `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
+          )
+        };
+      }
+      logger.error("JWT verification failed (JWKS fetch):", message);
       return {
         error: createError(
-          errorCodes.TOKEN_VERIFICATION_ERROR,
+          errorCodes.NETWORK_ERROR,
           `JWT\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F: ${message}`
         )
       };
@@ -249,7 +271,9 @@ function createVerifyAccessToken(deps) {
         serviceCode,
         logger,
         createError,
-        errorCodes: { TOKEN_VERIFICATION_ERROR: errorCodes.TOKEN_VERIFICATION_ERROR }
+        // structural superset of JwtVerifierDeps.errorCodes — passing it
+        // wholesale removes the hand-transcription drift point
+        errorCodes
       });
     }
     return jwtVerify2;
@@ -1089,7 +1113,7 @@ function createNonContractMethods(deps) {
 }
 
 // src/client/version-check.ts
-var SDK_VERSION = "5.17.0";
+var SDK_VERSION = "5.18.0";
 var SDK_USER_AGENT = `FFID-SDK/${SDK_VERSION} (TypeScript)`;
 var SDK_VERSION_HEADER = "X-FFID-SDK-Version";
 function sdkHeaders() {
@@ -2516,6 +2540,19 @@ var BLOCKING_EFFECTIVE_STATUSES = [
   "trial_expired"
 ];
 
+// src/client/error-codes.ts
+var FFID_ERROR_CODES = {
+  NETWORK_ERROR: "NETWORK_ERROR",
+  PARSE_ERROR: "PARSE_ERROR",
+  UNKNOWN_ERROR: "UNKNOWN_ERROR",
+  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
+  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
+  NO_TOKENS: "NO_TOKENS",
+  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
+  TOKEN_EXPIRED: "TOKEN_EXPIRED",
+  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
+};
+
 // src/client/ffid-client.ts
 var UNAUTHORIZED_STATUS2 = 401;
 var SDK_LOG_PREFIX = "[FFID SDK]";
@@ -2524,8 +2561,10 @@ var noopLogger = {
   },
   info: () => {
   },
-  warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
-  error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
+  warn: () => {
+  },
+  error: () => {
+  }
 };
 var consoleLogger = {
   debug: (...args) => console.debug(SDK_LOG_PREFIX, ...args),
@@ -2533,16 +2572,6 @@ var consoleLogger = {
   warn: (...args) => console.warn(SDK_LOG_PREFIX, ...args),
   error: (...args) => console.error(SDK_LOG_PREFIX, ...args)
 };
-var FFID_ERROR_CODES = {
-  NETWORK_ERROR: "NETWORK_ERROR",
-  PARSE_ERROR: "PARSE_ERROR",
-  UNKNOWN_ERROR: "UNKNOWN_ERROR",
-  TOKEN_EXCHANGE_ERROR: "TOKEN_EXCHANGE_ERROR",
-  TOKEN_REFRESH_ERROR: "TOKEN_REFRESH_ERROR",
-  NO_TOKENS: "NO_TOKENS",
-  TOKEN_VERIFICATION_ERROR: "TOKEN_VERIFICATION_ERROR",
-  STATE_MISMATCH_ERROR: "STATE_MISMATCH_ERROR"
-};
 var EXT_CHECK_ENDPOINT = "/api/v1/subscriptions/ext/check";
 var DEFAULT_ALLOW_GRACE = true;
 var DEFAULT_SERVICE_ACCESS_FAIL_POLICY = "failClosed";
@@ -3212,4 +3241,4 @@ function getFFIDConsentFromCookieHeader(cookieHeader) {
   return decodeConsentCookie(decodeURIComponent(value));
 }
 
-export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };
+export { ALL_DENIED_EXCEPT_NECESSARY, CONSENT_COOKIE_NAME, COOKIE_VERSION, FFID_ERROR_CODES, createFFIDClient, createKVCacheAdapter, createMemoryCacheAdapter, createTokenStore, createVerifyAccessToken, decodeConsentCookie, encodeConsentCookie, getFFIDConsentFromCookieHeader, getFFIDConsentFromCookies };

package/dist/server/test/index.d.cts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-DZEK3tkP.cjs';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-Cwk6cG3b.cjs';
 import '../../types-BeVl-z12.cjs';
 
 /**

package/dist/server/test/index.d.ts

@@ -1,4 +1,4 @@
-import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-BtS84epg.js';
+import { k as FFIDClient, e as FFIDOAuthUserInfo } from '../../ffid-client-w8Twi5lD.js';
 import '../../types-BeVl-z12.js';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feelflow/ffid-sdk",
-  "version": "5.17.0",
+  "version": "5.18.0",
   "description": "FeelFlow ID Platform SDK for React/Next.js applications",
   "keywords": [
     "feelflow",