@holo-js/auth-workos 0.2.5 → 0.3.0

package/dist/index.d.ts

@@ -1,5 +1,4 @@
-import { AuthResult, AuthenticatedAuthUser, AuthEstablishedSession, AuthFieldErrors, AuthLogoutResult, authRuntimeInternals } from '@holo-js/auth';
-import { NormalizedAuthWorkosProviderConfig } from '@holo-js/config';
+import { NormalizedAuthWorkosProviderConfig, AuthResult, AuthenticatedAuthUser, AuthEstablishedSession, AuthFieldErrors, AuthLogoutResult, authRuntimeInternals } from '@holo-js/auth';
 
 type WorkosJsonValue = string | number | boolean | null | readonly WorkosJsonValue[] | {
     readonly [key: string]: WorkosJsonValue;

package/dist/index.mjs

@@ -113,6 +113,7 @@ async function verifyWorkosSessionToken(token, config) {
   if ((typeof parsed.payload.sid !== "string" || !parsed.payload.sid.trim()) && (typeof parsed.payload.session_id !== "string" || !parsed.payload.session_id.trim())) {
     throw new Error("[@holo-js/auth-workos] WorkOS token did not include a session id.");
   }
+  const sessionId = typeof parsed.payload.sid === "string" && parsed.payload.sid.trim() ? parsed.payload.sid.trim() : parsed.payload.session_id.trim();
   const audience = parsed.payload.aud;
   const audiences = Array.isArray(audience) ? audience.filter((value) => typeof value === "string") : typeof audience === "string" ? [audience] : [];
   if (!audiences.includes(clientId)) {
@@ -122,7 +123,12 @@ async function verifyWorkosSessionToken(token, config) {
   if (typeof nbf === "number" && nbf * 1e3 > Date.now()) {
     throw new Error("[@holo-js/auth-workos] WorkOS token is not valid yet.");
   }
-  return parsed.payload;
+  return Object.freeze({
+    ...parsed.payload,
+    exp,
+    sessionId,
+    sub: parsed.payload.sub.trim()
+  });
 }
 function toWorkosJsonValue(value) {
   if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
@@ -192,17 +198,12 @@ function createDefaultProviderRuntime(providerName, config) {
   const runtime = Object.freeze({
     async verifySession({ token }) {
       const claims = await verifyWorkosSessionToken(token, config);
-      const userId = typeof claims.sub === "string" ? claims.sub : "";
-      if (!userId) {
-        throw new Error("[@holo-js/auth-workos] WorkOS token did not include a subject.");
-      }
-      const profile = await fetchWorkosUserProfile(userId, config);
-      const sessionId = typeof claims.sid === "string" ? claims.sid : typeof claims.session_id === "string" ? claims.session_id : token;
+      const profile = await fetchWorkosUserProfile(claims.sub, config);
       return Object.freeze({
-        sessionId,
+        sessionId: claims.sessionId,
         identity: profile,
         accessToken: token,
-        expiresAt: typeof claims.exp === "number" ? new Date(claims.exp * 1e3) : void 0,
+        expiresAt: new Date(claims.exp * 1e3),
         raw: Object.freeze({
           claims,
           user: profile.raw
@@ -222,7 +223,7 @@ function resolveConfiguredProviderName(provider) {
   if (configuredDefaultProvider) {
     return configuredDefaultProvider;
   }
-  const configuredProviders = Object.entries(bindings.config.workos).flatMap(([name, value]) => name !== "provider" && name !== "identityStore" && isNormalizedWorkosProviderConfig(value) ? [name] : []);
+  const configuredProviders = Object.entries(bindings.config.workos).flatMap(([name]) => name !== "provider" && name !== "identityStore" ? [name] : []);
   if (configuredProviders.length === 0) {
     return "default";
   }
@@ -347,7 +348,7 @@ function createWorkosErrorResponse(error, code) {
     code,
     message: getErrorMessage(error)
   }, {
-    status: error instanceof WorkosAuthConflictError ? 409 : 422
+    status: 422
   });
 }
 function resolveGuardAndProvider(provider) {
@@ -355,9 +356,6 @@ function resolveGuardAndProvider(provider) {
   const providerConfig = getConfiguredProviderConfig(provider);
   const guardName = providerConfig.guard ?? authBindings.config.defaults.guard;
   const guard = authBindings.config.guards[guardName];
-  if (!guard) {
-    throw new Error(`[@holo-js/auth-workos] Guard "${guardName}" is not configured for WorkOS provider "${providerConfig.name}".`);
-  }
   if (guard.driver !== "session") {
     throw new Error(`[@holo-js/auth-workos] WorkOS sign-in requires auth guard "${guardName}" to use the session driver.`);
   }
@@ -373,9 +371,6 @@ function resolveGuardAndProvider(provider) {
   };
 }
 function requireUserId(adapter, user, message) {
-  if (!user || typeof user !== "object") {
-    throw new Error(message);
-  }
   const userId = adapter.getId(user);
   if (typeof userId !== "string" && typeof userId !== "number") {
     throw new Error(message);
@@ -388,17 +383,8 @@ function requireUserRecord(user, message) {
   }
   return user;
 }
-function requireSerializedUser(user, message) {
-  if (typeof user.id === "string" || typeof user.id === "number") {
-    return user;
-  }
-  throw new Error(message);
-}
 function createWorkosSessionPayload(authenticated, session) {
-  const user = requireSerializedUser(
-    authenticated.user,
-    "[@holo-js/auth-workos] WorkOS-authenticated local users must expose a serializable id."
-  );
+  const user = authenticated.user;
   return Object.freeze({
     guard: authenticated.guard,
     provider: authenticated.authProvider,
@@ -441,7 +427,7 @@ function serializeLocalUser(adapter, user, providerName) {
     configurable: true
   });
   Object.defineProperty(result, "can", {
-    value: () => false,
+    value: async () => false,
     enumerable: false,
     configurable: true
   });
@@ -462,7 +448,7 @@ function resolveDisplayNameForUpdate(profile) {
   return fullName || void 0;
 }
 function resolveEmailForCreation(profile) {
-  const normalized = typeof profile.email === "string" ? profile.email.trim() : "";
+  const normalized = profile.email.trim();
   if (normalized) {
     return normalized;
   }
@@ -490,7 +476,7 @@ function resolveCreateUserInput(profile, mapper) {
 }
 function resolveUpdateUserInput(profile, mapper) {
   return toAdapterInput({
-    email: typeof profile.email === "string" ? profile.email.trim() || void 0 : void 0,
+    email: profile.email.trim() || void 0,
     name: resolveDisplayNameForUpdate(profile),
     avatar: profile.profilePictureUrl,
     email_verified_at: profile.emailVerified ? /* @__PURE__ */ new Date() : void 0,
@@ -511,9 +497,6 @@ function normalizeHostedProfile(profile) {
   });
 }
 async function findUserByEmail(adapter, email) {
-  if (!email?.trim()) {
-    return null;
-  }
   const user = await adapter.findByCredentials({ email: email.trim() });
   return user ? requireUserRecord(user, "[@holo-js/auth-workos] Auth provider lookups must return object users.") : null;
 }
@@ -542,7 +525,7 @@ async function updateLocalUser(adapter, user, input) {
   );
 }
 async function ensureNoUnexpectedEmailCollision(adapter, providerName, profile, currentUserId) {
-  const email = typeof profile.email === "string" ? profile.email.trim() : "";
+  const email = profile.email.trim();
   if (!email) {
     return;
   }
@@ -722,7 +705,7 @@ async function syncIdentity(session, provider, options = {}) {
   const profile = session.identity;
   const { guard, authProvider, adapter } = resolveGuardAndProvider(providerName);
   const verificationRequired = isEmailVerificationRequired();
-  const profileEmail = typeof profile.email === "string" ? profile.email.trim() : "";
+  const profileEmail = profile.email.trim();
   const verifiedEmail = profile.emailVerified === true && profileEmail ? profileEmail : void 0;
   if (verificationRequired && !verifiedEmail) {
     throw new Error(`[@holo-js/auth-workos] WorkOS identity "${profile.id}" must provide a verified email address.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/auth-workos",
-  "version": "0.2.5",
+  "version": "0.3.0",
   "description": "Holo-JS Framework - WorkOS auth integration contracts",
   "type": "module",
   "license": "MIT",
@@ -23,9 +23,8 @@
     "test": "vitest --run"
   },
   "dependencies": {
-    "@holo-js/auth": "^0.2.5",
-    "@holo-js/config": "^0.2.5",
-    "@holo-js/session": "^0.2.5"
+    "@holo-js/auth": "^0.3.0",
+    "@holo-js/session": "^0.3.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",