@holo-js/auth-clerk 0.1.5 → 0.1.7

package/dist/index.mjs

@@ -231,19 +231,29 @@ async function verifyClerkSessionToken(token, config, authorizedParties = []) {
     throw new Error("[@holo-js/auth-clerk] Clerk token signature verification failed.");
   }
   const exp = typeof parsed.payload.exp === "number" ? parsed.payload.exp : void 0;
-  if (typeof exp === "number" && exp * 1e3 <= Date.now()) {
+  if (typeof exp !== "number") {
+    throw new Error("[@holo-js/auth-clerk] Clerk token did not include an expiration.");
+  }
+  if (exp * 1e3 <= Date.now()) {
     throw new Error("[@holo-js/auth-clerk] Clerk token has expired.");
   }
+  if (typeof parsed.payload.sub !== "string" || !parsed.payload.sub.trim()) {
+    throw new Error("[@holo-js/auth-clerk] Clerk token did not include a subject.");
+  }
+  if ((typeof parsed.payload.sid !== "string" || !parsed.payload.sid.trim()) && (typeof parsed.payload.session_id !== "string" || !parsed.payload.session_id.trim())) {
+    throw new Error("[@holo-js/auth-clerk] Clerk token did not include a session id.");
+  }
   const nbf = typeof parsed.payload.nbf === "number" ? parsed.payload.nbf : void 0;
   if (typeof nbf === "number" && nbf * 1e3 > Date.now()) {
     throw new Error("[@holo-js/auth-clerk] Clerk token is not valid yet.");
   }
   const azp = typeof parsed.payload.azp === "string" ? parsed.payload.azp.trim() : "";
-  if (azp) {
-    const allowedAuthorizedParties = authorizedParties.map((value) => value.trim()).filter(Boolean);
-    if (allowedAuthorizedParties.length > 0 && !allowedAuthorizedParties.includes(azp)) {
-      throw new Error(`[@holo-js/auth-clerk] Clerk token authorized party "${azp}" is not allowed.`);
-    }
+  const allowedAuthorizedParties = authorizedParties.map((value) => value.trim()).filter(Boolean);
+  if (allowedAuthorizedParties.length > 0 && !azp) {
+    throw new Error("[@holo-js/auth-clerk] Clerk token did not include an authorized party.");
+  }
+  if (azp && allowedAuthorizedParties.length > 0 && !allowedAuthorizedParties.includes(azp)) {
+    throw new Error(`[@holo-js/auth-clerk] Clerk token authorized party "${azp}" is not allowed.`);
   }
   return parsed.payload;
 }
@@ -670,21 +680,6 @@ async function ensureNoUnexpectedEmailCollision(adapter, providerName, profile,
     });
   }
 }
-async function assertUserLinkAvailable(providerName, authProvider, adapter, user, clerkUserId) {
-  const existing = await getBindings().identityStore.findByUserId(
-    providerName,
-    authProvider,
-    requireUserId(adapter, user, "[@holo-js/auth-clerk] Linked users must expose a serializable id.")
-  );
-  if (existing && existing.providerUserId !== clerkUserId) {
-    throw new ClerkAuthConflictError({
-      provider: providerName,
-      clerkUserId,
-      email: existing.email,
-      message: `[@holo-js/auth-clerk] Local user is already linked to Clerk identity "${existing.providerUserId}".`
-    });
-  }
-}
 function isEmailVerificationRequired() {
   return authRuntimeInternals.getRuntimeBindings().config.emailVerification.required === true;
 }
@@ -967,16 +962,19 @@ async function syncIdentity(session, provider, options = {}) {
       const existingLinkedUser = await adapter.findById(existingIdentity.userId);
       let linkedUser = existingLinkedUser ? requireUserRecord(existingLinkedUser, "[@holo-js/auth-clerk] Auth provider lookups must return object users.") : null;
       if (!linkedUser) {
-        linkedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
-        if (linkedUser) {
-          await assertUserLinkAvailable(providerName, authProvider, adapter, linkedUser, profile.id);
-        }
-        if (!linkedUser) {
-          linkedUser = requireUserRecord(
-            await adapter.create(resolveCreateUserInput(profile, options.user)),
-            "[@holo-js/auth-clerk] Auth provider create() must return an object user."
-          );
+        const emailMatchedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
+        if (emailMatchedUser) {
+          throw new ClerkAuthConflictError({
+            provider: providerName,
+            clerkUserId: profile.id,
+            email: verifiedEmail,
+            message: `[@holo-js/auth-clerk] Clerk email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
+          });
         }
+        linkedUser = requireUserRecord(
+          await adapter.create(resolveCreateUserInput(profile, options.user)),
+          "[@holo-js/auth-clerk] Auth provider create() must return an object user."
+        );
         const relinked = await updateLocalUser(adapter, linkedUser, resolveUpdateUserInput(profile, options.user));
         const relinkedUser = relinked.user;
         const identity3 = createIdentityRecord({
@@ -1038,32 +1036,11 @@ async function syncIdentity(session, provider, options = {}) {
     }
     let localUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
     if (localUser) {
-      await assertUserLinkAvailable(providerName, authProvider, adapter, localUser, profile.id);
-      const linked = await updateLocalUser(adapter, localUser, resolveUpdateUserInput(profile, options.user));
-      const identity2 = createIdentityRecord({
-        provider: providerName,
-        guard,
-        authProvider,
-        userId: requireUserId(
-          adapter,
-          linked.user,
-          "[@holo-js/auth-clerk] Linked local users must expose a serializable id."
-        ),
-        profile
-      });
-      const claimedIdentity2 = await claimNewIdentity(identityStore, identity2);
-      const claimedUser2 = await resolveClaimedIdentityUser(adapter, claimedIdentity2, {
-        user: linked.user,
-        userId: identity2.userId
-      });
-      return Object.freeze({
+      throw new ClerkAuthConflictError({
         provider: providerName,
-        guard,
-        authProvider,
-        status: "linked",
-        user: serializeLocalUser(adapter, claimedUser2, authProvider),
-        identity: claimedIdentity2,
-        session
+        clerkUserId: profile.id,
+        email: verifiedEmail,
+        message: `[@holo-js/auth-clerk] Clerk email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
       });
     }
     localUser = requireUserRecord(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/auth-clerk",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Holo-JS Framework - Clerk auth integration contracts",
   "type": "module",
   "license": "MIT",
@@ -24,9 +24,9 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.4.7",
-    "@holo-js/auth": "^0.1.5",
-    "@holo-js/config": "^0.1.5",
-    "@holo-js/session": "^0.1.5"
+    "@holo-js/auth": "^0.1.7",
+    "@holo-js/config": "^0.1.7",
+    "@holo-js/session": "^0.1.7"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",