@motherbase/client 1.5.0 → 1.5.2

package/dist/auth.js

@@ -0,0 +1,884 @@
+import { BackendError, toError } from './http.js';
+import { normalizeUser } from './compat.js';
+import { MfaClient } from './mfa.js';
+import { AuthAdminClient } from './admin.js';
+import { codeChallengeFor, generateCodeVerifier, verifierStore, withCodeChallenge } from './pkce.js';
+import { OrganizationClient } from './organization.js';
+import { PasskeyClient, authenticateWithPasskey } from './passkey.js';
+import { SsoClient } from './sso.js';
+import { HTTP_ROUTES } from '@motherbase/contracts';
+function asIsoString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value instanceof Date)
+        return value.toISOString();
+    return null;
+}
+/**
+ * Read a JWT's payload without verifying it. Base64url, so `-`/`_` are mapped
+ * back and the padding is restored before decoding. Returns null for anything
+ * that is not a three-part token with a JSON object payload.
+ */
+function decodeJwtPayload(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+        // `atob` is global in every runtime this SDK supports (browsers, Node 16+,
+        // Deno, workers). Its output is latin1, so the percent-escape round trip is
+        // what turns a multi-byte claim value back into correct UTF-8.
+        const json = decodeURIComponent(Array.from(atob(padded), c => `%${c.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''));
+        const parsed = JSON.parse(json);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The header the server's captcha plugin reads the widget token from. */
+function captchaHeaders(options) {
+    return options?.captchaToken ? { 'x-captcha-response': options.captchaToken } : undefined;
+}
+/** Build a clean Session from the Better Auth auth payload. */
+function toSession(payload) {
+    return { accessToken: payload.token, user: payload.user };
+}
+/**
+ * Read the token an OAuth callback left in the URL fragment and return the URL
+ * with it removed, so a reload or a shared link cannot replay it.
+ *
+ * The provider callback cannot answer the SDK with a JSON body: it is a browser
+ * redirect. The backend therefore appends `#access_token=…` to the redirect it
+ * issues, the same implicit flow supabase-js reads. Exported for testing.
+ */
+export function readAccessTokenFromUrl(href) {
+    const hash = href.indexOf('#');
+    if (hash === -1)
+        return null;
+    const params = new URLSearchParams(href.slice(hash + 1));
+    const accessToken = params.get('access_token');
+    if (!accessToken)
+        return null;
+    params.delete('access_token');
+    params.delete('token_type');
+    const rest = params.toString();
+    return { accessToken, cleanedHref: `${href.slice(0, hash)}${rest ? `#${rest}` : ''}` };
+}
+const EVENT_MAP = {
+    signIn: 'SIGNED_IN',
+    signOut: 'SIGNED_OUT',
+    tokenRefreshed: 'TOKEN_REFRESHED',
+    userUpdated: 'USER_UPDATED',
+    mfaVerified: 'MFA_CHALLENGE_VERIFIED',
+};
+/**
+ * Supabase-compatible auth client. Maps supabase-js method names onto the
+ * Motherbase auth endpoints and reuses the existing token/refresh/session-store
+ * machinery. Returns `{ data, error }` and never throws for expected failures.
+ */
+export class AuthClient {
+    constructor(http, store, options = {}) {
+        this.http = http;
+        this.store = store;
+        this.autoRefreshTimer = null;
+        this.flowType = options.flowType ?? 'implicit';
+        this.verifiers = options.verifiers ?? verifierStore('motherbase.session');
+        this.mfa = new MfaClient(http, async (payload) => {
+            await this.store.set(toSession(payload), this.store.get() ? 'mfaVerified' : 'signIn');
+        });
+        this.admin = new AuthAdminClient(http);
+        this.organization = new OrganizationClient(http);
+        this.passkey = new PasskeyClient(http);
+        this.sso = new SsoClient(http);
+    }
+    async signUp(credentials) {
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSignUp, {
+                method: 'POST',
+                body: {
+                    email: credentials.email,
+                    password: credentials.password,
+                    name: credentials.username ?? credentials.email,
+                    ...(credentials.options?.emailRedirectTo ? { callbackURL: credentials.options.emailRedirectTo } : {}),
+                },
+                headers: captchaHeaders(credentials.options),
+                anonymous: true,
+                raw: true,
+            });
+            if (!payload?.token)
+                return { data: { user: payload?.user ?? null, session: null }, error: null };
+            if (!payload.user)
+                throw new Error('Sign-up response did not include a user.');
+            const session = await this.persist({ token: payload.token, user: payload.user });
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    async signInWithPassword(credentials) {
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSignIn, {
+                method: 'POST',
+                body: { email: credentials.email, password: credentials.password },
+                headers: captchaHeaders(credentials.options),
+                anonymous: true,
+                // Better Auth scopes the follow-up verification to a short-lived cookie.
+                credentials: 'include',
+                raw: true,
+            });
+            if (!payload)
+                throw new Error('Sign-in response was empty.');
+            if ('twoFactorRedirect' in payload) {
+                // A previous user's bearer must not turn the follow-up into a step-up
+                // request for that user instead of completing this sign-in.
+                if (this.store.get())
+                    await this.store.set(null, 'signOut');
+                return {
+                    data: {
+                        user: null,
+                        session: null,
+                        twoFactorRequired: true,
+                        twoFactorMethods: payload.twoFactorMethods ?? [],
+                    },
+                    error: null,
+                };
+            }
+            if (!payload.token || !payload.user)
+                throw new Error('Sign-in response did not include a session.');
+            const session = await this.persist(payload);
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Sign in as a new guest, supabase-js style. The project must allow
+     * anonymous sign-ins (Studio → Authentication → Sign In / Providers).
+     *
+     * The guest is a real user whose `is_anonymous` is true, and RLS sees the
+     * same flag as the `is_anonymous` claim. Make it permanent without changing
+     * its id with `updateUser({ email })` or `linkIdentity()`.
+     */
+    async signInAnonymously(credentials = {}) {
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSignInAnonymous, {
+                method: 'POST',
+                body: {},
+                headers: captchaHeaders(credentials.options),
+                anonymous: true,
+                raw: true,
+            });
+            await this.persist(payload);
+            const data = credentials.options?.data;
+            if (data && Object.keys(data).length > 0) {
+                // Better Auth creates the guest with no profile, so the metadata is
+                // written straight after, as the guest itself.
+                const updated = await this.updateUser({ data });
+                if (updated.error)
+                    return { data: { user: null, session: null }, error: updated.error };
+            }
+            const session = this.store.get();
+            return { data: { user: session?.user ?? null, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Email the signed-in user a one-time nonce, then pass it to
+     * `updateUser({ password, nonce })`. GoTrue's "secure password change".
+     */
+    async reauthenticate() {
+        try {
+            await this.http.request(HTTP_ROUTES.authReauthenticate, { method: 'POST', body: {}, raw: true });
+            return { data: { user: null, session: null }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Request a password-reset OTP by email. Always resolves successfully
+     * (whether or not the email is registered) to avoid leaking account
+     * existence; check `error` only for transport/server failures.
+     */
+    async resetPasswordForEmail(email, options) {
+        try {
+            await this.http.request(HTTP_ROUTES.authRequestPasswordReset, {
+                method: 'POST',
+                body: { email },
+                headers: captchaHeaders(options),
+                anonymous: true,
+                raw: true,
+            });
+            return { error: null };
+        }
+        catch (err) {
+            return { error: toError(err) };
+        }
+    }
+    /** Complete a password reset using the OTP sent to the user's email. */
+    async resetPassword(args) {
+        try {
+            await this.http.request(HTTP_ROUTES.authResetPassword, {
+                method: 'POST',
+                body: { email: args.email, otp: args.otp, password: args.password },
+                anonymous: true,
+                raw: true,
+            });
+            return { error: null };
+        }
+        catch (err) {
+            return { error: toError(err) };
+        }
+    }
+    /**
+     * Send a one-time sign-in code, by email or by SMS. Pair with `verifyOtp` to
+     * complete the sign-in.
+     *
+     * `{ phone }` routes to the phone-number plugin, which the project has to
+     * have enabled with an SMS sender configured; without one the call resolves
+     * with the backend's error rather than pretending a code was sent.
+     */
+    async signInWithOtp(credentials) {
+        if (!credentials.email && !credentials.phone) {
+            return { data: {}, error: { message: 'signInWithOtp needs either `email` or `phone`.' } };
+        }
+        try {
+            if (credentials.phone) {
+                await this.http.request(HTTP_ROUTES.authSendPhoneOtp, {
+                    method: 'POST',
+                    body: { phoneNumber: credentials.phone },
+                    headers: captchaHeaders(credentials.options),
+                    anonymous: true,
+                    raw: true,
+                });
+                return { data: {}, error: null };
+            }
+            await this.http.request(HTTP_ROUTES.authSendOtp, {
+                method: 'POST',
+                body: { email: credentials.email, type: 'sign-in' },
+                headers: captchaHeaders(credentials.options),
+                anonymous: true,
+                raw: true,
+            });
+            return { data: {}, error: null };
+        }
+        catch (err) {
+            return { data: {}, error: toError(err) };
+        }
+    }
+    /**
+     * Send the one-time code again, supabase-js style.
+     *
+     * supabase-js names the flows `signup` (confirm a new address), `email_change`
+     * and `recovery`; Better Auth names them `email-verification` and
+     * `forget-password`. The mapping lives here so ported code keeps working.
+     * `sms` and `phone_change` re-send an SMS code through the phone-number flow.
+     */
+    async resend(params) {
+        if (params.type === 'sms' || params.type === 'phone_change') {
+            if (!params.phone)
+                return { data: {}, error: { message: '`phone` is required.' } };
+            return this.signInWithOtp({ phone: params.phone });
+        }
+        const OTP_TYPE = {
+            signup: 'email-verification',
+            email_change: 'email-verification',
+            recovery: 'forget-password',
+        };
+        const type = OTP_TYPE[params.type];
+        if (!type) {
+            return { data: {}, error: { message: `resend({ type: '${params.type}' }) is not supported.` } };
+        }
+        if (!params.email) {
+            return { data: {}, error: { message: '`email` is required.' } };
+        }
+        try {
+            await this.http.request(HTTP_ROUTES.authSendOtp, {
+                method: 'POST',
+                body: { email: params.email, type },
+                anonymous: true,
+                raw: true,
+            });
+            return { data: {}, error: null };
+        }
+        catch (err) {
+            return { data: {}, error: toError(err) };
+        }
+    }
+    /**
+     * Complete a `signInWithOtp` sign-in with the code that was sent.
+     *
+     * The channel follows the identifier, as in supabase-js: `{ phone }` verifies
+     * an SMS code, `{ email }` an email one. `type` is accepted for signature
+     * parity and only disambiguates when both are somehow present.
+     */
+    async verifyOtp(params) {
+        if (!params.email && !params.phone) {
+            return { data: { user: null, session: null }, error: { message: 'verifyOtp needs either `email` or `phone`.' } };
+        }
+        try {
+            const bySms = Boolean(params.phone) && params.type !== 'email';
+            const payload = await this.http.request(bySms ? HTTP_ROUTES.authVerifyPhoneOtp : HTTP_ROUTES.authSignInEmailOtp, {
+                method: 'POST',
+                body: bySms
+                    ? { phoneNumber: params.phone, code: params.token }
+                    : { email: params.email, otp: params.token },
+                anonymous: true,
+                raw: true,
+            });
+            if (!payload?.token) {
+                return { data: { user: null, session: null }, error: { message: 'The code did not produce a session.' } };
+            }
+            const session = await this.persist(payload);
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Start an OAuth sign-in with a configured social provider. Resolves with the
+     * provider's authorize URL and, in a browser, redirects to it immediately
+     * unless `options.skipBrowserRedirect` is set.
+     */
+    async signInWithOAuth(credentials) {
+        const redirectTo = await this.redirectForFlow(credentials.options?.redirectTo);
+        if (redirectTo instanceof Error)
+            return { data: { provider: credentials.provider, url: null }, error: { message: redirectTo.message } };
+        credentials = { ...credentials, options: { ...credentials.options, redirectTo } };
+        // In a browser, hand the whole handshake to a top-level navigation. Starting
+        // it with a fetch makes the OAuth state cookie a cross-site write, which
+        // Safari and Firefox drop outright and Chrome drops in incognito, and the
+        // callback then fails with state_mismatch. Navigating to the backend's own
+        // origin makes that cookie first-party, so a plain SameSite=Lax cookie
+        // survives everywhere. The backend redirects on from there.
+        if (typeof window !== 'undefined' && !credentials.options?.skipBrowserRedirect) {
+            const params = new URLSearchParams();
+            if (credentials.options?.redirectTo)
+                params.set('callbackURL', credentials.options.redirectTo);
+            const query = params.toString();
+            const url = this.http.url(`${HTTP_ROUTES.authSignInSocial}/${encodeURIComponent(credentials.provider)}${query ? `?${query}` : ''}`);
+            window.location.href = url;
+            return { data: { provider: credentials.provider, url }, error: null };
+        }
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSignInSocial, {
+                method: 'POST',
+                body: {
+                    provider: credentials.provider,
+                    callbackURL: credentials.options?.redirectTo,
+                    scopes: credentials.options?.scopes ? credentials.options.scopes.split(' ') : undefined,
+                    disableRedirect: true,
+                },
+                anonymous: true,
+                raw: true,
+                // The server answers with a signed OAuth state cookie it checks again on
+                // the provider callback. Without 'include' the browser drops that cookie
+                // on a cross-origin call and every callback fails with state_mismatch.
+                credentials: 'include',
+            });
+            const url = payload?.url ?? null;
+            if (url && !credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {
+                window.location.href = url;
+            }
+            return { data: { provider: credentials.provider, url }, error: null };
+        }
+        catch (err) {
+            return { data: { provider: credentials.provider, url: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Sign in with a passkey saved on this device or a synced one. Opens the
+     * browser's passkey prompt; dismissing it resolves with an error, not a throw.
+     * Needs Auth · Passkey on and a browser (see `auth.passkey`).
+     */
+    async signInWithPasskey() {
+        const result = await authenticateWithPasskey(this.http);
+        if (result.error)
+            return { data: { user: null, session: null }, error: result.error };
+        const session = await this.persist(result.data);
+        return { data: { user: session.user, session }, error: null };
+    }
+    /**
+     * Start an enterprise SSO sign-in. Identify the provider by the user's email
+     * domain, by an explicit `domain`, or by `providerId` when you already know
+     * which one to use.
+     *
+     * Resolves with the identity provider's URL and, in a browser, redirects to it
+     * unless `options.skipBrowserRedirect` is set. The project must have the SSO
+     * plugin enabled and at least one provider registered (Studio →
+     * Authentication → Organizations & SSO).
+     */
+    async signInWithSSO(params) {
+        if (!params.domain && !params.email && !params.providerId && !params.organizationSlug) {
+            return { data: { url: null }, error: { message: 'signInWithSSO needs a domain, email, providerId or organizationSlug' } };
+        }
+        const redirectTo = await this.redirectForFlow(params.options?.redirectTo);
+        if (redirectTo instanceof Error)
+            return { data: { url: null }, error: { message: redirectTo.message } };
+        params = { ...params, options: { ...params.options, redirectTo } };
+        try {
+            const payload = await this.http.request('/api/auth/sign-in/sso', {
+                method: 'POST',
+                body: {
+                    ...(params.domain ? { domain: params.domain } : {}),
+                    ...(params.email ? { email: params.email } : {}),
+                    ...(params.providerId ? { providerId: params.providerId } : {}),
+                    ...(params.organizationSlug ? { organizationSlug: params.organizationSlug } : {}),
+                    callbackURL: params.options?.redirectTo,
+                },
+                anonymous: true,
+                raw: true,
+                credentials: 'include', // Same OAuth state cookie as signInWithOAuth.
+            });
+            const url = payload?.url ?? null;
+            if (url && !params.options?.skipBrowserRedirect && typeof window !== 'undefined') {
+                window.location.href = url;
+            }
+            return { data: { url }, error: null };
+        }
+        catch (err) {
+            return { data: { url: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Update the signed-in user's profile fields and/or password. Password
+     * changes require `currentPassword` (a Better Auth requirement. There is no
+     * blind password overwrite from an authenticated session).
+     */
+    async updateUser(attributes) {
+        try {
+            if (attributes.data && Object.keys(attributes.data).length > 0) {
+                await this.http.request(HTTP_ROUTES.authUpdateUser, { method: 'POST', body: attributes.data, raw: true });
+            }
+            if (attributes.password && attributes.currentPassword) {
+                await this.http.request(HTTP_ROUTES.authChangePassword, {
+                    method: 'POST',
+                    body: { newPassword: attributes.password, currentPassword: attributes.currentPassword },
+                    raw: true,
+                });
+            }
+            else if (attributes.email || attributes.password) {
+                // Email (a guest's upgrade) and a password set by nonce, or a first
+                // password, go through GoTrue's `PUT /user` equivalent.
+                await this.http.request(HTTP_ROUTES.authUpdateUserCredentials, {
+                    method: 'POST',
+                    body: {
+                        ...(attributes.email ? { email: attributes.email } : {}),
+                        ...(attributes.password ? { password: attributes.password } : {}),
+                        ...(attributes.nonce ? { nonce: attributes.nonce } : {}),
+                    },
+                    raw: true,
+                });
+            }
+            const result = await this.getUser();
+            // supabase-js emits USER_UPDATED here, and apps re-read the profile off
+            // that event rather than off the return value. Refresh the stored session
+            // so the user the listener receives is the updated one.
+            const current = this.store.get();
+            if (result.data?.user && current) {
+                await this.store.set({ ...current, user: result.data.user }, 'userUpdated');
+            }
+            return result;
+        }
+        catch (err) {
+            return { data: { user: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Permanently delete the signed-in user's account. Not part of the
+     * supabase-js client surface (there it's admin-only). Kept here because
+     * self-service account deletion is a real product need. Requires the
+     * backend's `delete-user` flow to be enabled; clears the local session on
+     * success.
+     */
+    async deleteUser(attributes = {}) {
+        try {
+            await this.http.request(HTTP_ROUTES.authDeleteUser, {
+                method: 'POST',
+                body: attributes,
+                raw: true,
+            });
+            await this.store.set(null, 'signOut');
+            return { error: null };
+        }
+        catch (err) {
+            return { error: toError(err) };
+        }
+    }
+    /**
+     * Adopt an externally-obtained access token as the current session (e.g. one
+     * captured from an OAuth redirect). Validates it against the server before
+     * persisting. `refresh_token` is accepted for supabase-js signature parity
+     * and unused: Better Auth bearer sessions have none.
+     */
+    async setSession(currentSession) {
+        await this.store.set({ accessToken: currentSession.access_token, user: { id: '', email: '' } }, 'signIn');
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true });
+            if (!payload?.user) {
+                await this.store.set(null, 'signOut');
+                return { data: { user: null, session: null }, error: { message: 'Invalid session' } };
+            }
+            const session = { accessToken: currentSession.access_token, user: payload.user };
+            await this.store.set(session, 'signIn');
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            await this.store.set(null, 'signOut');
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    async signOut() {
+        try {
+            await this.http.request(HTTP_ROUTES.authSignOut, { method: 'POST', raw: true });
+        }
+        catch {
+            // best-effort; clear locally regardless
+        }
+        await this.store.set(null, 'signOut');
+        return { error: null };
+    }
+    /**
+     * Finish an OAuth / SSO sign-in after the provider redirected back.
+     *
+     * `signInWithOAuth` only starts the flow; the session is created during the
+     * redirect the browser makes to the backend callback, so the SDK has to pick
+     * it up from the URL the browser landed on. Call this once on the page you
+     * pointed `redirectTo` at (or on app start, which is where supabase-js does
+     * the equivalent). Without it the user is signed in on the backend and signed
+     * out in your app.
+     *
+     * Resolves with a null session and no error when there is nothing to read, so
+     * it is safe to call on every page load.
+     */
+    async getSessionFromUrl(href) {
+        const url = href ?? (typeof window !== 'undefined' ? window.location.href : undefined);
+        const found = url ? readAccessTokenFromUrl(url) : null;
+        if (!found)
+            return { data: { user: null, session: null }, error: null };
+        // Strip the token before the network call: a failed lookup must not leave a
+        // usable token sitting in the address bar or in the back/forward history.
+        if (!href && typeof window !== 'undefined') {
+            window.history?.replaceState?.(window.history.state, '', found.cleanedHref);
+        }
+        try {
+            // Resolve the user with the token explicitly rather than storing it first:
+            // a rejected token must not emit a SIGNED_IN event carrying a null user.
+            const payload = await this.http.request(HTTP_ROUTES.authSession, {
+                raw: true,
+                anonymous: true,
+                headers: { Authorization: `Bearer ${found.accessToken}` },
+            });
+            if (!payload?.user) {
+                return { data: { user: null, session: null }, error: { message: 'OAuth session is no longer valid' } };
+            }
+            const session = await this.persist({ token: found.accessToken, user: payload.user });
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Finish a PKCE sign-in: trade the `?code=` the provider redirect came back
+     * with for the session. Needs the verifier `signInWithOAuth` stored, so it
+     * works once, in the browser that started the flow.
+     */
+    async exchangeCodeForSession(authCode) {
+        const verifier = await this.verifiers.get();
+        if (!verifier) {
+            return { data: { user: null, session: null }, error: { message: 'No PKCE code verifier found: start the flow with flowType: "pkce" in this browser.' } };
+        }
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authExchangeCode, {
+                method: 'POST',
+                body: { auth_code: authCode, code_verifier: verifier },
+                anonymous: true,
+                raw: true,
+            });
+            await this.verifiers.clear();
+            const session = await this.persist(payload);
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * The redirect a flow should use. Implicit: as given. PKCE: with a fresh
+     * challenge on it, the verifier stored for `exchangeCodeForSession`; the
+     * challenge rides on the redirect URL, so PKCE needs one, and in a browser
+     * the current page stands in when none is given.
+     */
+    async redirectForFlow(redirectTo) {
+        if (this.flowType !== 'pkce')
+            return redirectTo;
+        const target = redirectTo ?? (typeof window !== 'undefined' ? window.location.href.split('#')[0] : undefined);
+        if (!target)
+            return new Error('flowType "pkce" needs options.redirectTo outside a browser.');
+        const verifier = generateCodeVerifier();
+        await this.verifiers.set(verifier);
+        return withCodeChallenge(target, await codeChallengeFor(verifier));
+    }
+    /** Fetch the current user from Better Auth (requires a valid session). */
+    async getUser() {
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true });
+            return { data: { user: normalizeUser(payload?.user) }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null }, error: toError(err) };
+        }
+    }
+    /**
+     * NEVER USE FOR AN AUTHORIZATION DECISION. Use {@link getUser} instead.
+     *
+     * The locally-held session, if any (no network call). It is whatever the
+     * caller's cookie or storage said, parsed: unsigned JSON the browser sent,
+     * which anyone can set by hand. `session.user.id`, `.email` and `.role` are
+     * therefore attacker-controlled, and an admin allowlist checked against
+     * them is checked against nothing.
+     *
+     * Reads and writes through `from()` are unaffected: they carry the access
+     * token to the backend, which verifies it under RLS. It is the decisions
+     * your own app takes from `session.user` that are forgeable.
+     *
+     * `getUser()` costs one round trip and returns the user the backend
+     * confirms, in the same `{ data, error }` shape. Prefer it everywhere but a
+     * cosmetic "am I probably signed in" check.
+     */
+    async getSession() {
+        await this.store.hydrate();
+        return { data: { session: this.store.get() }, error: null };
+    }
+    /**
+     * Revalidate the current session against the server. Better Auth bearer
+     * sessions have no refresh token: if the session is still valid the user is
+     * refreshed; otherwise the local session is cleared.
+     */
+    async refreshSession() {
+        await this.store.hydrate();
+        const current = this.store.get();
+        if (!current?.accessToken) {
+            return { data: { user: null, session: null }, error: { message: 'Auth session missing!' } };
+        }
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSession, { raw: true, _retry: true });
+            if (!payload?.user) {
+                await this.store.set(null, 'signOut');
+                return { data: { user: null, session: null }, error: { message: 'Session expired' } };
+            }
+            const session = { accessToken: current.accessToken, user: payload.user };
+            await this.store.set(session, 'tokenRefreshed');
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            // Only a rejected token clears the session. A network failure or a 5xx
+            // must leave it intact: middleware runs this on every navigation, so
+            // one backend hiccup would otherwise sign the user out.
+            const status = err instanceof BackendError ? err.httpStatus : 0;
+            if (status === 401 || status === 403)
+                await this.store.set(null, 'signOut');
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Subscribe to auth changes, supabase-js style.
+     *
+     * The callback fires once with `INITIAL_SESSION` as soon as the stored
+     * session has been read, before any later event. That first call is not a
+     * nicety: the standard Supabase bootstrap is
+     * `if (event === 'INITIAL_SESSION') setLoading(false)`, and without it the
+     * app renders its loading state forever for a signed-out visitor, who never
+     * produces any other event.
+     *
+     * It is delivered asynchronously (after hydration), so unsubscribing
+     * synchronously suppresses it, exactly as in supabase-js.
+     */
+    /**
+     * The providers linked to the signed-in user, in the supabase-js identity
+     * shape. Backed by Better Auth's `list-accounts`, which is why `email` shows
+     * up as an identity for a password account: it is a real linked credential,
+     * exactly as in Supabase.
+     */
+    async getUserIdentities() {
+        try {
+            const accounts = await this.http.request(HTTP_ROUTES.authListAccounts, { raw: true });
+            const userId = this.store.get()?.user?.id ?? '';
+            const identities = (accounts ?? []).map(account => ({
+                id: account.accountId ?? account.id,
+                identity_id: account.id,
+                user_id: userId,
+                provider: account.providerId,
+                identity_data: { sub: account.accountId, ...(account.scopes ? { scopes: account.scopes } : {}) },
+                created_at: asIsoString(account.createdAt),
+                updated_at: asIsoString(account.updatedAt),
+                last_sign_in_at: asIsoString(account.updatedAt),
+            }));
+            return { data: { identities }, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    /**
+     * Link another provider to the signed-in user. Like `signInWithOAuth`, this
+     * only starts the flow: the browser is sent to the provider and comes back
+     * through the callback.
+     */
+    async linkIdentity(credentials) {
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authLinkSocial, {
+                method: 'POST',
+                body: {
+                    provider: credentials.provider,
+                    callbackURL: credentials.options?.redirectTo,
+                    scopes: credentials.options?.scopes?.split(/\s+/).filter(Boolean),
+                },
+                credentials: 'include',
+                raw: true,
+            });
+            const url = payload?.url ?? null;
+            if (url && !credentials.options?.skipBrowserRedirect && typeof window !== 'undefined') {
+                window.location.assign(url);
+            }
+            return { data: { provider: credentials.provider, url }, error: null };
+        }
+        catch (err) {
+            return { data: { provider: credentials.provider, url: null }, error: toError(err) };
+        }
+    }
+    /** Unlink a provider from the signed-in user. */
+    async unlinkIdentity(identity) {
+        try {
+            await this.http.request(HTTP_ROUTES.authUnlinkAccount, {
+                method: 'POST',
+                body: { providerId: identity.provider, accountId: identity.id },
+                raw: true,
+            });
+            return { data: {}, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    /**
+     * Native mobile sign-in with a provider id token (Sign in with Apple, Google
+     * One Tap), routed to Better Auth's social sign-in with an `idToken`.
+     * The provider must be configured on the backend.
+     */
+    async signInWithIdToken(params) {
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authSignInSocial, {
+                method: 'POST',
+                body: {
+                    provider: params.provider,
+                    idToken: {
+                        token: params.token,
+                        ...(params.access_token ? { accessToken: params.access_token } : {}),
+                        ...(params.nonce ? { nonce: params.nonce } : {}),
+                    },
+                },
+                anonymous: true,
+                raw: true,
+            });
+            if (!payload?.token) {
+                return { data: { user: null, session: null }, error: { message: 'The provider did not return a session.' } };
+            }
+            const session = await this.persist(payload);
+            return { data: { user: session.user, session }, error: null };
+        }
+        catch (err) {
+            return { data: { user: null, session: null }, error: toError(err) };
+        }
+    }
+    /**
+     * Claims for the current session, as a JWT payload.
+     *
+     * supabase-js reads them out of the access token, which is itself a JWT.
+     * A Better Auth session token is an opaque bearer, so this asks the server's
+     * jwt plugin to mint one and decodes it. The decode is NOT a verification:
+     * the token came from the authenticated endpoint over TLS, and a client
+     * verifying a token it just asked for proves nothing. Verify server side,
+     * against `/api/auth/jwks`.
+     */
+    async getClaims() {
+        try {
+            const payload = await this.http.request(HTTP_ROUTES.authToken, { raw: true });
+            const token = payload?.token;
+            const claims = token ? decodeJwtPayload(token) : null;
+            if (!token || !claims) {
+                return { data: null, error: { message: 'No JWT is available for this session.' } };
+            }
+            return { data: { claims, token }, error: null };
+        }
+        catch (err) {
+            return { data: null, error: toError(err) };
+        }
+    }
+    /**
+     * Revalidate the session on a timer, the way supabase-js does while the tab
+     * is focused. Motherbase refreshes on a 401 already, so this is opt-in: it
+     * exists so a ported app that calls it keeps working, and so a long-lived
+     * screen notices a revoked session without waiting for its next request.
+     */
+    startAutoRefresh(intervalMs = 60000) {
+        this.stopAutoRefresh();
+        this.autoRefreshTimer = setInterval(() => {
+            if (this.store.get())
+                void this.refreshSession();
+        }, intervalMs);
+        // Node keeps the process alive for a pending timer; a background refresh
+        // must never be the reason a script does not exit.
+        this.autoRefreshTimer.unref?.();
+    }
+    /** Stop the timer started by `startAutoRefresh`. Safe to call when none runs. */
+    stopAutoRefresh() {
+        if (this.autoRefreshTimer !== null) {
+            clearInterval(this.autoRefreshTimer);
+            this.autoRefreshTimer = null;
+        }
+    }
+    onAuthStateChange(callback) {
+        let active = true;
+        const unsubscribeStore = this.store.subscribe((event, session) => {
+            if (active)
+                callback(EVENT_MAP[event], session);
+        });
+        void this.store.hydrate().then(session => {
+            if (active)
+                callback('INITIAL_SESSION', session);
+        });
+        return {
+            data: {
+                subscription: {
+                    unsubscribe: () => {
+                        active = false;
+                        unsubscribeStore();
+                    },
+                },
+            },
+        };
+    }
+    /**
+     * Internal: refresh used by the HttpClient's 401 path. Returns true on success.
+     * Not part of the public Supabase surface.
+     */
+    async _refresh() {
+        const result = await this.refreshSession();
+        return result.error === null;
+    }
+    async persist(payload) {
+        const session = toSession(payload);
+        await this.store.set(session, 'signIn');
+        return session;
+    }
+}
+//# sourceMappingURL=auth.js.map