@holo-js/auth-clerk 0.2.6 → 0.3.0

package/dist/index.d.ts

@@ -1,5 +1,4 @@
-import { AuthResult, AuthenticatedAuthUser, AuthEstablishedSession, AuthFieldErrors, AuthLogoutResult, authRuntimeInternals } from '@holo-js/auth';
-import { AuthClerkProviderConfig, NormalizedAuthClerkProviderConfig } from '@holo-js/config';
+import { AuthClerkProviderConfig, AuthResult, AuthenticatedAuthUser, AuthEstablishedSession, AuthFieldErrors, AuthLogoutResult, NormalizedAuthClerkProviderConfig, authRuntimeInternals } from '@holo-js/auth';
 
 interface ClerkEmailAddress {
     readonly id?: string;

package/dist/index.mjs

@@ -114,6 +114,7 @@ async function verifyClerkSessionToken(token, config, authorizedParties = []) {
   if ((typeof parsed.payload.sid !== "string" || !parsed.payload.sid.trim()) && (typeof parsed.payload.session_id !== "string" || !parsed.payload.session_id.trim())) {
     throw new Error("[@holo-js/auth-clerk] Clerk token did not include a session id.");
   }
+  const sessionId = typeof parsed.payload.sid === "string" && parsed.payload.sid.trim() ? parsed.payload.sid.trim() : parsed.payload.session_id.trim();
   const nbf = typeof parsed.payload.nbf === "number" ? parsed.payload.nbf : void 0;
   if (typeof nbf === "number" && nbf * 1e3 > Date.now()) {
     throw new Error("[@holo-js/auth-clerk] Clerk token is not valid yet.");
@@ -126,7 +127,12 @@ async function verifyClerkSessionToken(token, config, authorizedParties = []) {
   if (azp && allowedAuthorizedParties.length > 0 && !allowedAuthorizedParties.includes(azp)) {
     throw new Error(`[@holo-js/auth-clerk] Clerk token authorized party "${azp}" is not allowed.`);
   }
-  return parsed.payload;
+  return Object.freeze({
+    ...parsed.payload,
+    exp,
+    sessionId,
+    sub: parsed.payload.sub.trim()
+  });
 }
 function normalizeClerkEmailAddress(value) {
   const verification = value.verification && typeof value.verification === "object" ? value.verification : void 0;
@@ -181,7 +187,7 @@ function createDefaultProviderRuntime(providerName, config) {
     config.apiUrl ?? "",
     config.frontendApi ?? "",
     config.secretKey ?? "",
-    [...config.authorizedParties ?? []].sort()
+    [...config.authorizedParties].sort()
   ]);
   const existing = clerkDefaultProviderRuntimeCache.get(cacheKey);
   if (existing) {
@@ -190,14 +196,9 @@ function createDefaultProviderRuntime(providerName, config) {
   const runtime = Object.freeze({
     async verifySession({ token }) {
       const claims = await verifyClerkSessionToken(token, config, config.authorizedParties);
-      const userId = typeof claims.sub === "string" ? claims.sub : "";
-      if (!userId) {
-        throw new Error("[@holo-js/auth-clerk] Clerk token did not include a subject.");
-      }
-      const profile = await fetchClerkUserProfile(userId, config);
-      const sessionId = typeof claims.sid === "string" ? claims.sid : typeof claims.session_id === "string" ? claims.session_id : token;
+      const profile = await fetchClerkUserProfile(claims.sub, config);
       return Object.freeze({
-        sessionId,
+        sessionId: claims.sessionId,
         user: profile,
         accessToken: token,
         raw: Object.freeze({
@@ -219,7 +220,7 @@ function resolveConfiguredProviderName(provider) {
   if (configuredDefaultProvider) {
     return configuredDefaultProvider;
   }
-  const configuredProviders = Object.entries(bindings.config.clerk).flatMap(([name, value]) => name !== "provider" && name !== "identityStore" && isNormalizedClerkProviderConfig(value) ? [name] : []);
+  const configuredProviders = Object.entries(bindings.config.clerk).flatMap(([name]) => name !== "provider" && name !== "identityStore" ? [name] : []);
   if (configuredProviders.length === 0) {
     return "default";
   }
@@ -249,7 +250,7 @@ function getConfiguredProviderConfig(provider) {
     frontendApi: configured.frontendApi,
     redirectUri: configured.redirectUri,
     sessionCookie: configured.sessionCookie,
-    authorizedParties: configured.authorizedParties ?? [],
+    authorizedParties: configured.authorizedParties,
     guard: configured.guard,
     mapToProvider: configured.mapToProvider
   };
@@ -322,7 +323,7 @@ function createClerkErrorResponse(error, code) {
     code,
     message: getErrorMessage(error)
   }, {
-    status: error instanceof ClerkAuthConflictError ? 409 : 422
+    status: 422
   });
 }
 function resolveGuardAndProvider(provider) {
@@ -330,9 +331,6 @@ function resolveGuardAndProvider(provider) {
   const providerConfig = getConfiguredProviderConfig(provider);
   const guardName = providerConfig.guard ?? authBindings.config.defaults.guard;
   const guard = authBindings.config.guards[guardName];
-  if (!guard) {
-    throw new Error(`[@holo-js/auth-clerk] Guard "${guardName}" is not configured for Clerk provider "${providerConfig.name}".`);
-  }
   if (guard.driver !== "session") {
     throw new Error(`[@holo-js/auth-clerk] Clerk sign-in requires auth guard "${guardName}" to use the session driver.`);
   }
@@ -348,9 +346,6 @@ function resolveGuardAndProvider(provider) {
   };
 }
 function requireUserId(adapter, user, message) {
-  if (!user || typeof user !== "object") {
-    throw new Error(message);
-  }
   const userId = adapter.getId(user);
   if (typeof userId !== "string" && typeof userId !== "number") {
     throw new Error(message);
@@ -363,17 +358,8 @@ function requireUserRecord(user, message) {
   }
   return user;
 }
-function requireSerializedUser(user, message) {
-  if (typeof user.id === "string" || typeof user.id === "number") {
-    return user;
-  }
-  throw new Error(message);
-}
 function createClerkSessionPayload(authenticated, session) {
-  const user = requireSerializedUser(
-    authenticated.user,
-    "[@holo-js/auth-clerk] Clerk-authenticated local users must expose a serializable id."
-  );
+  const user = authenticated.user;
   return Object.freeze({
     guard: authenticated.guard,
     provider: authenticated.authProvider,
@@ -416,7 +402,7 @@ function serializeLocalUser(adapter, user, providerName) {
     configurable: true
   });
   Object.defineProperty(result, "can", {
-    value: () => false,
+    value: async () => false,
     enumerable: false,
     configurable: true
   });
@@ -499,9 +485,6 @@ function normalizeHostedProfile(profile) {
   });
 }
 async function findUserByEmail(adapter, email) {
-  if (!email?.trim()) {
-    return null;
-  }
   const user = await adapter.findByCredentials({ email: email.trim() });
   return user ? requireUserRecord(user, "[@holo-js/auth-clerk] Auth provider lookups must return object users.") : null;
 }
@@ -572,11 +555,11 @@ function createIdentityRecord(input) {
 }
 async function withIdentitySyncLock(key, callback) {
   const previous = clerkIdentitySyncLocks.get(key) ?? Promise.resolve();
-  let release = () => {
-  };
-  const current = previous.then(() => new Promise((resolve) => {
+  let release;
+  const gate = new Promise((resolve) => {
     release = resolve;
-  }));
+  });
+  const current = previous.then(() => gate);
   clerkIdentitySyncLocks.set(key, current);
   await previous;
   try {
@@ -606,7 +589,7 @@ async function resolveClaimedIdentityUser(adapter, identity, fallback) {
     await adapter.findById(identity.userId),
     "[@holo-js/auth-clerk] Claimed Clerk identities must reference an existing local user."
   );
-  if (fallback.deleteOnMismatch && adapter.delete) {
+  if (adapter.delete) {
     await adapter.delete(fallback.userId);
   }
   return claimedUser;
@@ -640,13 +623,9 @@ function isConfiguredClerkRedirectRequest(request, config) {
   if (!redirectUri) {
     return hasClerkCallbackState(request);
   }
-  try {
-    const requestUrl = new URL(request.url);
-    const configuredUrl = new URL(redirectUri, requestUrl.origin);
-    return requestUrl.origin === configuredUrl.origin && requestUrl.pathname === configuredUrl.pathname;
-  } catch {
-    return false;
-  }
+  const requestUrl = new URL(request.url);
+  const configuredUrl = new URL(redirectUri, requestUrl.origin);
+  return requestUrl.origin === configuredUrl.origin && requestUrl.pathname === configuredUrl.pathname;
 }
 function splitSetCookieHeader(value) {
   return value.split(/,(?=\s*[^;,=\s]+=)/g).map((cookie) => cookie.trim()).filter(Boolean);
@@ -721,7 +700,7 @@ async function verifySession(token, provider) {
 function resolveRequestAuthorizedParties(config, request) {
   return Object.freeze([
     .../* @__PURE__ */ new Set([
-      ...config.authorizedParties ?? [],
+      ...config.authorizedParties,
       new URL(request.url).origin
     ])
   ]);
@@ -732,9 +711,6 @@ async function verifyDefaultSessionToken(token, providerConfig, authorizedPartie
     authorizedParties
   };
   const defaultRuntime = createDefaultProviderRuntime(providerConfig.name, config);
-  if (!defaultRuntime.verifySession) {
-    throw new Error(`[@holo-js/auth-clerk] Clerk provider runtime "${providerConfig.name}" does not implement verifySession().`);
-  }
   return defaultRuntime.verifySession({
     provider: providerConfig.name,
     token,
@@ -932,8 +908,7 @@ async function syncIdentity(session, provider, options = {}) {
     const claimedIdentity = await claimNewIdentity(identityStore, identity);
     const claimedUser = await resolveClaimedIdentityUser(adapter, claimedIdentity, {
       user: localUser,
-      userId: identity.userId,
-      deleteOnMismatch: true
+      userId: identity.userId
     });
     const claimedStatus = sameUserId(claimedIdentity.userId, identity.userId) ? "created" : "linked";
     return Object.freeze({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/auth-clerk",
-  "version": "0.2.6",
+  "version": "0.3.0",
   "description": "Holo-JS Framework - Clerk auth integration contracts",
   "type": "module",
   "license": "MIT",
@@ -24,9 +24,8 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.4.7",
-    "@holo-js/auth": "^0.2.6",
-    "@holo-js/config": "^0.2.6",
-    "@holo-js/session": "^0.2.6"
+    "@holo-js/auth": "^0.3.0",
+    "@holo-js/session": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",