@gusnips/react 0.9.4 → 0.9.5

package/README.md

@@ -75,6 +75,10 @@ anywhere that decision is made; the sentence you show is a separate question, an
 — "check your connection" is true of a request that never landed and false of a 502, which is
 ours. auth-js marks "nothing came back", and only that, with status 0.
 
+It is safe to hand it the `error` from a `{ data, error }` result without checking it first:
+`null` answers false. That is worth stating because `null` is the SUCCESS value of every
+supabase-js auth call, so the obvious `if (isAuthOutage(error))` is written against it constantly.
+
 Supabase email links have two complete patterns. Keep either one, never half of each:
 
 - A link carrying `token_hash` needs one explicit `verifyOtp` call. Guard it against React

package/dist/supabase-session.d.ts

@@ -40,7 +40,8 @@ export interface SupabaseSessionAuth {
  * heading per RESOLVED version; `node_modules` keeps copies the resolver does not serve.
  *
  * Anything that is not an auth error at all answers true: a failure from outside auth-js is not
- * a verdict on the credential either.
+ * a verdict on the credential either. Nothing at all answers false — `null` is what every
+ * supabase-js auth call returns on success, and success is not an outage.
  */
 export declare function isAuthOutage(error: unknown): boolean;
 /**

package/dist/supabase-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supabase-session.d.ts","sourceRoot":"","sources":["../src/supabase-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,UAAU,qBAAqB;IAC7B,IAAI,EAAE;QAAE,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,UAAU,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7C,cAAc,IAAI,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxC;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGpD;AAaD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAsBtF"}
+{"version":3,"file":"supabase-session.d.ts","sourceRoot":"","sources":["../src/supabase-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,UAAU,qBAAqB;IAC7B,IAAI,EAAE;QAAE,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,UAAU,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7C,cAAc,IAAI,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxC;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CASpD;AAaD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAsBtF"}

package/dist/supabase-session.js

@@ -23,9 +23,17 @@ import { isAuthError, isAuthRetryableFetchError } from "@supabase/supabase-js";
  * heading per RESOLVED version; `node_modules` keeps copies the resolver does not serve.
  *
  * Anything that is not an auth error at all answers true: a failure from outside auth-js is not
- * a verdict on the credential either.
+ * a verdict on the credential either. Nothing at all answers false — `null` is what every
+ * supabase-js auth call returns on success, and success is not an outage.
  */
 export function isAuthOutage(error) {
+    // Nothing thrown is not an outage, and this clause exists because the function is exported.
+    // `null` is the SUCCESS value of every supabase-js auth call, so the obvious
+    // `if (isAuthOutage(error))` around a `getUser()` result has to be safe; without this it read
+    // every success as auth being down. An adopter had already written that guard at its own call
+    // site, which is what a check missing from in here looks like from the outside.
+    if (error == null)
+        return false;
     if (!isAuthError(error))
         return true;
     return isAuthRetryableFetchError(error) || (error.status ?? 0) >= 500;

package/dist/supabase-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"supabase-session.js","sourceRoot":"","sources":["../src/supabase-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAuB,MAAM,uBAAuB,CAAC;AAmBpG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,0FAA0F;IAC1F,uFAAuF;IACvF,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,8FAA8F;IAC9F,8FAA8F;IAC9F,OAAO,KAAK,CAAC,IAAI,KAAK,2BAA2B,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAyB;IACpE,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpD,OAAO;oBACL,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;oBACzC,WAAW,EAAE,KAAK,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC;iBAClD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"supabase-session.js","sourceRoot":"","sources":["../src/supabase-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAuB,MAAM,uBAAuB,CAAC;AAmBpG;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,4FAA4F;IAC5F,6EAA6E;IAC7E,8FAA8F;IAC9F,8FAA8F;IAC9F,gFAAgF;IAChF,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;AACxE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,0FAA0F;IAC1F,uFAAuF;IACvF,kFAAkF;IAClF,8EAA8E;IAC9E,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,8FAA8F;IAC9F,8FAA8F;IAC9F,OAAO,KAAK,CAAC,IAAI,KAAK,2BAA2B,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAyB;IACpE,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpD,OAAO;oBACL,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;oBACzC,WAAW,EAAE,KAAK,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC;iBAClD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gusnips/react",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "The headless runtime under a Vite + React SPA: typed fetch client with single-flight refresh, auth store, query defaults, route guards, error boundary, stale-tab recovery, i18n bootstrap.",
   "type": "module",
   "license": "MIT",

package/src/supabase-session.test.ts

@@ -2,6 +2,7 @@ import {
   AuthApiError,
   AuthRefreshDiscardedError,
   AuthRetryableFetchError,
+  AuthUnknownError,
 } from "@supabase/supabase-js";
 import { describe, expect, it, vi } from "vitest";
 import {
@@ -130,4 +131,26 @@ describe("isAuthOutage", () => {
     expect(isAuthOutage(new AuthApiError("Insufficient Storage", 507, undefined))).toBe(true);
     expect(isAuthOutage(new AuthApiError("Network Connect Timeout", 599, undefined))).toBe(true);
   });
+
+  it("reads nothing-went-wrong as nothing went wrong", () => {
+    // `null` is the SUCCESS value of every supabase-js auth call, and this function is
+    // exported, so the obvious `if (isAuthOutage(error))` around a `getUser()` result has to
+    // be safe. Before this, it answered true and put an outage on screen over every success.
+    // One adopter had already written the guard at its own call site, which is what a missing
+    // check in here looks like from the outside.
+    expect(isAuthOutage(null)).toBe(false);
+    expect(isAuthOutage(undefined)).toBe(false);
+  });
+
+  it("stays narrow for an error auth-js could not read", () => {
+    // AuthUnknownError is raised whenever the body does not parse as JSON, at ANY status, and
+    // it never fills one in — but `status` is still PRESENT, because the base class declares
+    // it, so `"status" in error` answers true and says nothing. That makes a 507 behind an
+    // HTML-answering proxy indistinguishable from a malformed 400, and the narrow answer is
+    // the right one: widening by class name would call the malformed 400 an outage too, and a
+    // dead session read as retryable is the same failure from the other side.
+    const unreadable = new AuthUnknownError("Unexpected token < in JSON", new Error("parse"));
+    expect(unreadable.status).toBeUndefined();
+    expect(isAuthOutage(unreadable)).toBe(false);
+  });
 });

package/src/supabase-session.ts

@@ -41,9 +41,16 @@ type _SupabaseAuthFitsAdapter = Satisfied<
  * heading per RESOLVED version; `node_modules` keeps copies the resolver does not serve.
  *
  * Anything that is not an auth error at all answers true: a failure from outside auth-js is not
- * a verdict on the credential either.
+ * a verdict on the credential either. Nothing at all answers false — `null` is what every
+ * supabase-js auth call returns on success, and success is not an outage.
  */
 export function isAuthOutage(error: unknown): boolean {
+  // Nothing thrown is not an outage, and this clause exists because the function is exported.
+  // `null` is the SUCCESS value of every supabase-js auth call, so the obvious
+  // `if (isAuthOutage(error))` around a `getUser()` result has to be safe; without this it read
+  // every success as auth being down. An adopter had already written that guard at its own call
+  // site, which is what a check missing from in here looks like from the outside.
+  if (error == null) return false;
   if (!isAuthError(error)) return true;
   return isAuthRetryableFetchError(error) || (error.status ?? 0) >= 500;
 }