@netlify/identity 0.1.0-alpha.8 → 0.1.0

package/README.md

@@ -1,15 +1,170 @@
 # @netlify/identity
 
-Add authentication to your Netlify site with a few lines of code.
+A lightweight, no-config headless authentication library for projects using Netlify Identity for browser and server. Uses [gotrue-js](https://github.com/netlify/gotrue-js) under the hood.
 
 > **Status:** Beta. The API may change before 1.0.
 
+For a pre-built login widget, see [netlify-identity-widget](https://github.com/netlify/netlify-identity-widget).
+
+**Prerequisites:**
+
+- [Netlify Identity](https://docs.netlify.com/security/secure-access-to-sites/identity/) must be enabled on your Netlify project
+- For local development, use [`netlify dev`](https://docs.netlify.com/cli/local-development/) so the Identity endpoint is available
+
 ## Installation
 
 ```bash
 npm install @netlify/identity
 ```
 
+## Quick start
+
+### Browser
+
+```ts
+import { getUser } from '@netlify/identity'
+
+const user = getUser()
+if (user) {
+  console.log(`Hello, ${user.name}`)
+}
+```
+
+### Netlify Function
+
+```ts
+import { getUser } from '@netlify/identity'
+import type { Context } from '@netlify/functions'
+
+export default async (req: Request, context: Context) => {
+  const user = getUser()
+  if (!user) return new Response('Unauthorized', { status: 401 })
+  return Response.json({ id: user.id, email: user.email })
+}
+```
+
+### Edge Function
+
+```ts
+import { getUser } from '@netlify/identity'
+import type { Context } from '@netlify/edge-functions'
+
+export default async (req: Request, context: Context) => {
+  const user = getUser()
+  if (!user) return new Response('Unauthorized', { status: 401 })
+  return Response.json({ id: user.id, email: user.email })
+}
+```
+
+## API
+
+### Functions
+
+#### `getUser`
+
+```ts
+getUser(): User | null
+```
+
+Returns the current authenticated user, or `null` if not logged in. Synchronous, never throws.
+
+#### `isAuthenticated`
+
+```ts
+isAuthenticated(): boolean
+```
+
+Returns `true` if a user is currently authenticated. Equivalent to `getUser() !== null`.
+
+#### `getIdentityConfig`
+
+```ts
+getIdentityConfig(): IdentityConfig | null
+```
+
+Returns the Identity endpoint URL (and operator token on the server), or `null` if Identity is not available. Never throws.
+
+#### `getSettings`
+
+```ts
+getSettings(): Promise<Settings>
+```
+
+Fetches your project's Identity settings (enabled providers, autoconfirm, signup disabled). Throws `MissingIdentityError` if not configured; throws `AuthError` if the endpoint is unreachable.
+
+### Types
+
+#### `User`
+
+```ts
+interface User {
+  id: string
+  email?: string
+  emailVerified?: boolean
+  createdAt?: string
+  updatedAt?: string
+  provider?: AuthProvider
+  name?: string
+  pictureUrl?: string
+  metadata?: Record<string, unknown>
+  rawGoTrueData?: Record<string, unknown>
+}
+```
+
+#### `Settings`
+
+```ts
+interface Settings {
+  autoconfirm: boolean
+  disableSignup: boolean
+  providers: Record<AuthProvider, boolean>
+}
+```
+
+#### `IdentityConfig`
+
+```ts
+interface IdentityConfig {
+  url: string
+  token?: string
+}
+```
+
+#### `AuthProvider`
+
+```ts
+type AuthProvider = 'google' | 'github' | 'gitlab' | 'bitbucket' | 'facebook' | 'saml' | 'email'
+```
+
+#### `AppMetadata`
+
+```ts
+interface AppMetadata {
+  provider: AuthProvider
+  roles?: string[]
+  [key: string]: unknown
+}
+```
+
+### Errors
+
+#### `AuthError`
+
+```ts
+class AuthError extends Error {
+  status?: number
+  cause?: unknown
+}
+```
+
+#### `MissingIdentityError`
+
+```ts
+class MissingIdentityError extends Error {}
+```
+
+Thrown when Identity is not configured in the current environment.
+
 ## License
 
 MIT

package/dist/index.cjs

@@ -35,8 +35,7 @@ __export(index_exports, {
   getIdentityConfig: () => getIdentityConfig,
   getSettings: () => getSettings,
   getUser: () => getUser,
-  isAuthenticated: () => isAuthenticated,
-  toUser: () => toUser
+  isAuthenticated: () => isAuthenticated
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -194,7 +193,6 @@ var getSettings = async () => {
   getIdentityConfig,
   getSettings,
   getUser,
-  isAuthenticated,
-  toUser
+  isAuthenticated
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/environment.ts","../src/user.ts","../src/errors.ts","../src/config.ts"],"sourcesContent":["export type { User } from './user.js'\nexport { toUser, getUser, isAuthenticated } from './user.js'\nexport { getIdentityConfig, getSettings } from './config.js'\nexport type { JWTClaims } from './auth.js'\nexport { AuthError, MissingIdentityError } from './errors.js'\nexport type { AppMetadata, AuthProvider, IdentityConfig, Settings } from './types.js'\n","export const AUTH_PROVIDERS = ['google', 'github', 'gitlab', 'bitbucket', 'facebook', 'saml', 'email'] as const\nexport type AuthProvider = (typeof AUTH_PROVIDERS)[number]\n\nexport interface AppMetadata {\n  provider: AuthProvider\n  roles?: string[]\n  [key: string]: unknown\n}\n\nexport interface IdentityConfig {\n  url: string\n  token?: string // this is an operator token, only available on the server\n}\n\nexport interface Settings {\n  autoconfirm: boolean\n  disableSignup: boolean\n  providers: Record<AuthProvider, boolean>\n}\n","import GoTrue from 'gotrue-js'\n\nimport type { IdentityConfig } from './types.js'\n\nlet goTrueClient: GoTrue | null = null\nlet cachedApiUrl: string | null | undefined\nlet warnedMissingUrl = false\n\nexport const isBrowser = (): boolean => typeof window !== 'undefined' && typeof window.location !== 'undefined'\n\n/**\n * Discovers and caches the GoTrue API URL.\n *\n * Browser: uses `window.location.origin` + `/.netlify/identity`.\n * Server: reads from `globalThis.netlifyIdentityContext`.\n */\nconst discoverApiUrl = (): string | null => {\n  if (cachedApiUrl !== undefined) return cachedApiUrl\n\n  if (isBrowser()) {\n    cachedApiUrl = `${window.location.origin}/.netlify/identity`\n  } else {\n    const identityContext = getIdentityContext()\n    if (identityContext?.url) {\n      cachedApiUrl = identityContext.url\n    } else if (globalThis.Netlify?.context?.url) {\n      cachedApiUrl = new URL('/.netlify/identity', globalThis.Netlify.context.url).href\n    }\n  }\n\n  return cachedApiUrl ?? null\n}\n\n/**\n * Returns (and lazily creates) a singleton gotrue-js client.\n * Returns `null` and logs a warning if no identity URL can be discovered.\n */\nexport const getGoTrueClient = (): GoTrue | null => {\n  if (goTrueClient) return goTrueClient\n\n  const apiUrl = discoverApiUrl()\n  if (!apiUrl) {\n    if (!warnedMissingUrl) {\n      console.warn(\n        '@netlify/identity: Could not determine the Identity endpoint URL. ' +\n          'Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`.',\n      )\n      warnedMissingUrl = true\n    }\n    return null\n  }\n\n  goTrueClient = new GoTrue({ APIUrl: apiUrl, setCookie: isBrowser() })\n  return goTrueClient\n}\n\n/**\n * Reads the server-side identity context set by the Netlify bootstrap.\n * Returns `null` outside the Netlify serverless environment.\n */\nexport const getIdentityContext = (): IdentityConfig | null => {\n  // TODO(kh): After Stargate deploys EX-1764, netlifyIdentityContext will have\n  // typed `url` and `token` fields. Remove the typeof guards and use direct access.\n  // https://linear.app/netlify/issue/EX-1764/identity-stargate-needs-to-set-identity-url-and-providertoken\n  const identityContext = globalThis.netlifyIdentityContext\n  if (identityContext?.url && typeof identityContext.url === 'string') {\n    return {\n      url: identityContext.url,\n      token: typeof identityContext.token === 'string' ? identityContext.token : undefined,\n    }\n  }\n\n  if (globalThis.Netlify?.context?.url) {\n    return { url: new URL('/.netlify/identity', globalThis.Netlify.context.url).href }\n  }\n\n  return null\n}\n\n/** Reset cached state for tests. */\nexport const resetTestGoTrueClient = (): void => {\n  goTrueClient = null\n  cachedApiUrl = undefined\n  warnedMissingUrl = false\n}\n","import type { UserData } from 'gotrue-js'\nimport { AUTH_PROVIDERS, type AuthProvider } from './types.js'\nimport { getGoTrueClient, isBrowser } from './environment.js'\n\nconst toAuthProvider = (value: unknown): AuthProvider | undefined =>\n  typeof value === 'string' && (AUTH_PROVIDERS as readonly string[]).includes(value)\n    ? (value as AuthProvider)\n    : undefined\n\nexport interface User {\n  id: string\n  email?: string\n  emailVerified?: boolean\n  createdAt?: string\n  updatedAt?: string\n  provider?: AuthProvider\n  name?: string\n  pictureUrl?: string\n  metadata?: Record<string, unknown>\n  rawGoTrueData?: Record<string, unknown>\n}\n\nexport const toUser = (userData: UserData): User => {\n  const userMeta = userData.user_metadata ?? {}\n  const appMeta = userData.app_metadata ?? {}\n  const name = userMeta.full_name || userMeta.name\n  const pictureUrl = userMeta.avatar_url\n\n  return {\n    id: userData.id,\n    email: userData.email,\n    emailVerified: !!userData.confirmed_at,\n    createdAt: userData.created_at,\n    updatedAt: userData.updated_at,\n    provider: toAuthProvider(appMeta.provider),\n    name: typeof name === 'string' ? name : undefined,\n    pictureUrl: typeof pictureUrl === 'string' ? pictureUrl : undefined,\n    metadata: userMeta,\n    rawGoTrueData: { ...userData },\n  }\n}\n\n/**\n * Converts raw JWT claims from the identity header into a User.\n * JWT claims use a different shape than the gotrue-js UserData class.\n */\nconst claimsToUser = (claims: Record<string, unknown>): User => {\n  const appMeta = (claims.app_metadata ?? {}) as Record<string, unknown>\n  const userMeta = (claims.user_metadata ?? {}) as Record<string, unknown>\n  const name = userMeta.full_name || userMeta.name\n\n  return {\n    id: typeof claims.sub === 'string' ? claims.sub : '',\n    email: typeof claims.email === 'string' ? claims.email : undefined,\n    provider: toAuthProvider(appMeta.provider),\n    name: typeof name === 'string' ? name : undefined,\n    metadata: userMeta,\n  }\n}\n\n/**\n * Returns the currently authenticated user, or `null` if not logged in.\n * Synchronous. Never throws.\n */\nexport const getUser = (): User | null => {\n  if (isBrowser()) {\n    const client = getGoTrueClient()\n    const currentUser = client?.currentUser() ?? null\n    if (!currentUser) return null\n    return toUser(currentUser)\n  }\n\n  const identityContext = globalThis.netlifyIdentityContext\n  if (!identityContext) return null\n\n  const claims = identityContext.user ?? (identityContext.sub ? identityContext : null)\n  if (!claims) return null\n  return claimsToUser(claims as Record<string, unknown>)\n}\n\n/**\n * Returns `true` if a user is currently authenticated.\n */\nexport const isAuthenticated = (): boolean => getUser() !== null\n","export class AuthError extends Error {\n  override name = 'AuthError'\n  status?: number\n  declare cause?: unknown\n\n  constructor(message: string, status?: number, options?: { cause?: unknown }) {\n    super(message)\n    this.status = status\n    if (options && 'cause' in options) {\n      this.cause = options.cause\n    }\n  }\n}\n\nexport class MissingIdentityError extends Error {\n  override name = 'MissingIdentityError'\n\n  constructor(message = 'Identity is not available in this environment') {\n    super(message)\n  }\n}\n","import type { AuthProvider, IdentityConfig, Settings } from './types.js'\nimport { AuthError, MissingIdentityError } from './errors.js'\nimport { getGoTrueClient, getIdentityContext, isBrowser } from './environment.js'\n\n/**\n * Returns the identity configuration for the current environment.\n * Browser: always returns `{ url }` derived from `window.location.origin`.\n * Server: returns `{ url, token }` from the identity context, or `null` if unavailable.\n * Never throws.\n */\nexport const getIdentityConfig = (): IdentityConfig | null => {\n  if (isBrowser()) {\n    return { url: `${window.location.origin}/.netlify/identity` }\n  }\n\n  return getIdentityContext()\n}\n\n/**\n * Fetches the GoTrue `/settings` endpoint.\n * Throws `MissingIdentityError` if Identity is not configured.\n * Throws `AuthError` if the endpoint is unreachable.\n */\nexport const getSettings = async (): Promise<Settings> => {\n  const client = getGoTrueClient()\n  if (!client) throw new MissingIdentityError()\n\n  try {\n    const raw = await client.settings()\n    const external: Partial<Record<AuthProvider, boolean>> = raw.external ?? {}\n    return {\n      autoconfirm: raw.autoconfirm,\n      disableSignup: raw.disable_signup,\n      providers: {\n        google: external.google ?? false,\n        github: external.github ?? false,\n        gitlab: external.gitlab ?? false,\n        bitbucket: external.bitbucket ?? false,\n        facebook: external.facebook ?? false,\n        email: external.email ?? false,\n        saml: external.saml ?? false,\n      },\n    }\n  } catch (err) {\n    throw new AuthError(err instanceof Error ? err.message : 'Failed to fetch identity settings', 502, { cause: err })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,iBAAiB,CAAC,UAAU,UAAU,UAAU,aAAa,YAAY,QAAQ,OAAO;;;ACArG,uBAAmB;AAInB,IAAI,eAA8B;AAClC,IAAI;AACJ,IAAI,mBAAmB;AAEhB,IAAM,YAAY,MAAe,OAAO,WAAW,eAAe,OAAO,OAAO,aAAa;AAQpG,IAAM,iBAAiB,MAAqB;AAC1C,MAAI,iBAAiB,OAAW,QAAO;AAEvC,MAAI,UAAU,GAAG;AACf,mBAAe,GAAG,OAAO,SAAS,MAAM;AAAA,EAC1C,OAAO;AACL,UAAM,kBAAkB,mBAAmB;AAC3C,QAAI,iBAAiB,KAAK;AACxB,qBAAe,gBAAgB;AAAA,IACjC,WAAW,WAAW,SAAS,SAAS,KAAK;AAC3C,qBAAe,IAAI,IAAI,sBAAsB,WAAW,QAAQ,QAAQ,GAAG,EAAE;AAAA,IAC/E;AAAA,EACF;AAEA,SAAO,gBAAgB;AACzB;AAMO,IAAM,kBAAkB,MAAqB;AAClD,MAAI,aAAc,QAAO;AAEzB,QAAM,SAAS,eAAe;AAC9B,MAAI,CAAC,QAAQ;AACX,QAAI,CAAC,kBAAkB;AACrB,cAAQ;AAAA,QACN;AAAA,MAEF;AACA,yBAAmB;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,IAAI,iBAAAA,QAAO,EAAE,QAAQ,QAAQ,WAAW,UAAU,EAAE,CAAC;AACpE,SAAO;AACT;AAMO,IAAM,qBAAqB,MAA6B;AAI7D,QAAM,kBAAkB,WAAW;AACnC,MAAI,iBAAiB,OAAO,OAAO,gBAAgB,QAAQ,UAAU;AACnE,WAAO;AAAA,MACL,KAAK,gBAAgB;AAAA,MACrB,OAAO,OAAO,gBAAgB,UAAU,WAAW,gBAAgB,QAAQ;AAAA,IAC7E;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,SAAS,KAAK;AACpC,WAAO,EAAE,KAAK,IAAI,IAAI,sBAAsB,WAAW,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,EACnF;AAEA,SAAO;AACT;;;ACzEA,IAAM,iBAAiB,CAAC,UACtB,OAAO,UAAU,YAAa,eAAqC,SAAS,KAAK,IAC5E,QACD;AAeC,IAAM,SAAS,CAAC,aAA6B;AAClD,QAAM,WAAW,SAAS,iBAAiB,CAAC;AAC5C,QAAM,UAAU,SAAS,gBAAgB,CAAC;AAC1C,QAAM,OAAO,SAAS,aAAa,SAAS;AAC5C,QAAM,aAAa,SAAS;AAE5B,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,OAAO,SAAS;AAAA,IAChB,eAAe,CAAC,CAAC,SAAS;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,WAAW,SAAS;AAAA,IACpB,UAAU,eAAe,QAAQ,QAAQ;AAAA,IACzC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,YAAY,OAAO,eAAe,WAAW,aAAa;AAAA,IAC1D,UAAU;AAAA,IACV,eAAe,EAAE,GAAG,SAAS;AAAA,EAC/B;AACF;AAMA,IAAM,eAAe,CAAC,WAA0C;AAC9D,QAAM,UAAW,OAAO,gBAAgB,CAAC;AACzC,QAAM,WAAY,OAAO,iBAAiB,CAAC;AAC3C,QAAM,OAAO,SAAS,aAAa,SAAS;AAE5C,SAAO;AAAA,IACL,IAAI,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAAA,IAClD,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAAA,IACzD,UAAU,eAAe,QAAQ,QAAQ;AAAA,IACzC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,UAAU;AAAA,EACZ;AACF;AAMO,IAAM,UAAU,MAAmB;AACxC,MAAI,UAAU,GAAG;AACf,UAAM,SAAS,gBAAgB;AAC/B,UAAM,cAAc,QAAQ,YAAY,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO;AACzB,WAAO,OAAO,WAAW;AAAA,EAC3B;AAEA,QAAM,kBAAkB,WAAW;AACnC,MAAI,CAAC,gBAAiB,QAAO;AAE7B,QAAM,SAAS,gBAAgB,SAAS,gBAAgB,MAAM,kBAAkB;AAChF,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAiC;AACvD;AAKO,IAAM,kBAAkB,MAAe,QAAQ,MAAM;;;ACnFrD,IAAM,YAAN,cAAwB,MAAM;AAAA,EAKnC,YAAY,SAAiB,QAAiB,SAA+B;AAC3E,UAAM,OAAO;AALf,SAAS,OAAO;AAMd,SAAK,SAAS;AACd,QAAI,WAAW,WAAW,SAAS;AACjC,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,UAAU,iDAAiD;AACrE,UAAM,OAAO;AAHf,SAAS,OAAO;AAAA,EAIhB;AACF;;;ACVO,IAAM,oBAAoB,MAA6B;AAC5D,MAAI,UAAU,GAAG;AACf,WAAO,EAAE,KAAK,GAAG,OAAO,SAAS,MAAM,qBAAqB;AAAA,EAC9D;AAEA,SAAO,mBAAmB;AAC5B;AAOO,IAAM,cAAc,YAA+B;AACxD,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,OAAQ,OAAM,IAAI,qBAAqB;AAE5C,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,SAAS;AAClC,UAAM,WAAmD,IAAI,YAAY,CAAC;AAC1E,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,eAAe,IAAI;AAAA,MACnB,WAAW;AAAA,QACT,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,WAAW,SAAS,aAAa;AAAA,QACjC,UAAU,SAAS,YAAY;AAAA,QAC/B,OAAO,SAAS,SAAS;AAAA,QACzB,MAAM,SAAS,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI,UAAU,eAAe,QAAQ,IAAI,UAAU,qCAAqC,KAAK,EAAE,OAAO,IAAI,CAAC;AAAA,EACnH;AACF;","names":["GoTrue"]}
+{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/environment.ts","../src/user.ts","../src/errors.ts","../src/config.ts"],"sourcesContent":["export type { User } from './user.js'\nexport { getUser, isAuthenticated } from './user.js'\nexport { getIdentityConfig, getSettings } from './config.js'\nexport { AuthError, MissingIdentityError } from './errors.js'\nexport type { AppMetadata, AuthProvider, IdentityConfig, Settings } from './types.js'\n","export const AUTH_PROVIDERS = ['google', 'github', 'gitlab', 'bitbucket', 'facebook', 'saml', 'email'] as const\nexport type AuthProvider = (typeof AUTH_PROVIDERS)[number]\n\nexport interface AppMetadata {\n  provider: AuthProvider\n  roles?: string[]\n  [key: string]: unknown\n}\n\nexport interface IdentityConfig {\n  url: string\n  token?: string // this is an operator token, only available on the server\n}\n\nexport interface Settings {\n  autoconfirm: boolean\n  disableSignup: boolean\n  providers: Record<AuthProvider, boolean>\n}\n","import GoTrue from 'gotrue-js'\n\nimport type { IdentityConfig } from './types.js'\n\nlet goTrueClient: GoTrue | null = null\nlet cachedApiUrl: string | null | undefined\nlet warnedMissingUrl = false\n\nexport const isBrowser = (): boolean => typeof window !== 'undefined' && typeof window.location !== 'undefined'\n\n/**\n * Discovers and caches the GoTrue API URL.\n *\n * Browser: uses `window.location.origin` + `/.netlify/identity`.\n * Server: reads from `globalThis.netlifyIdentityContext`.\n */\nconst discoverApiUrl = (): string | null => {\n  if (cachedApiUrl !== undefined) return cachedApiUrl\n\n  if (isBrowser()) {\n    cachedApiUrl = `${window.location.origin}/.netlify/identity`\n  } else {\n    const identityContext = getIdentityContext()\n    if (identityContext?.url) {\n      cachedApiUrl = identityContext.url\n    } else if (globalThis.Netlify?.context?.url) {\n      cachedApiUrl = new URL('/.netlify/identity', globalThis.Netlify.context.url).href\n    }\n  }\n\n  return cachedApiUrl ?? null\n}\n\n/**\n * Returns (and lazily creates) a singleton gotrue-js client.\n * Returns `null` and logs a warning if no identity URL can be discovered.\n */\nexport const getGoTrueClient = (): GoTrue | null => {\n  if (goTrueClient) return goTrueClient\n\n  const apiUrl = discoverApiUrl()\n  if (!apiUrl) {\n    if (!warnedMissingUrl) {\n      console.warn(\n        '@netlify/identity: Could not determine the Identity endpoint URL. ' +\n          'Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`.',\n      )\n      warnedMissingUrl = true\n    }\n    return null\n  }\n\n  goTrueClient = new GoTrue({ APIUrl: apiUrl, setCookie: isBrowser() })\n  return goTrueClient\n}\n\n/**\n * Reads the server-side identity context set by the Netlify bootstrap.\n * Returns `null` outside the Netlify serverless environment.\n */\nexport const getIdentityContext = (): IdentityConfig | null => {\n  // TODO(kh): After Stargate deploys EX-1764, netlifyIdentityContext will have\n  // typed `url` and `token` fields. Remove the typeof guards and use direct access.\n  // https://linear.app/netlify/issue/EX-1764/identity-stargate-needs-to-set-identity-url-and-providertoken\n  const identityContext = globalThis.netlifyIdentityContext\n  if (identityContext?.url && typeof identityContext.url === 'string') {\n    return {\n      url: identityContext.url,\n      token: typeof identityContext.token === 'string' ? identityContext.token : undefined,\n    }\n  }\n\n  if (globalThis.Netlify?.context?.url) {\n    return { url: new URL('/.netlify/identity', globalThis.Netlify.context.url).href }\n  }\n\n  return null\n}\n\n/** Reset cached state for tests. */\nexport const resetTestGoTrueClient = (): void => {\n  goTrueClient = null\n  cachedApiUrl = undefined\n  warnedMissingUrl = false\n}\n","import type { UserData } from 'gotrue-js'\nimport { AUTH_PROVIDERS, type AuthProvider } from './types.js'\nimport { getGoTrueClient, isBrowser } from './environment.js'\n\nconst toAuthProvider = (value: unknown): AuthProvider | undefined =>\n  typeof value === 'string' && (AUTH_PROVIDERS as readonly string[]).includes(value)\n    ? (value as AuthProvider)\n    : undefined\n\nexport interface User {\n  id: string\n  email?: string\n  emailVerified?: boolean\n  createdAt?: string\n  updatedAt?: string\n  provider?: AuthProvider\n  name?: string\n  pictureUrl?: string\n  metadata?: Record<string, unknown>\n  rawGoTrueData?: Record<string, unknown>\n}\n\nexport const toUser = (userData: UserData): User => {\n  const userMeta = userData.user_metadata ?? {}\n  const appMeta = userData.app_metadata ?? {}\n  const name = userMeta.full_name || userMeta.name\n  const pictureUrl = userMeta.avatar_url\n\n  return {\n    id: userData.id,\n    email: userData.email,\n    emailVerified: !!userData.confirmed_at,\n    createdAt: userData.created_at,\n    updatedAt: userData.updated_at,\n    provider: toAuthProvider(appMeta.provider),\n    name: typeof name === 'string' ? name : undefined,\n    pictureUrl: typeof pictureUrl === 'string' ? pictureUrl : undefined,\n    metadata: userMeta,\n    rawGoTrueData: { ...userData },\n  }\n}\n\n/**\n * Converts raw JWT claims from the identity header into a User.\n * JWT claims use a different shape than the gotrue-js UserData class.\n */\nconst claimsToUser = (claims: Record<string, unknown>): User => {\n  const appMeta = (claims.app_metadata ?? {}) as Record<string, unknown>\n  const userMeta = (claims.user_metadata ?? {}) as Record<string, unknown>\n  const name = userMeta.full_name || userMeta.name\n\n  return {\n    id: typeof claims.sub === 'string' ? claims.sub : '',\n    email: typeof claims.email === 'string' ? claims.email : undefined,\n    provider: toAuthProvider(appMeta.provider),\n    name: typeof name === 'string' ? name : undefined,\n    metadata: userMeta,\n  }\n}\n\n/**\n * Returns the currently authenticated user, or `null` if not logged in.\n * Synchronous. Never throws.\n */\nexport const getUser = (): User | null => {\n  if (isBrowser()) {\n    const client = getGoTrueClient()\n    const currentUser = client?.currentUser() ?? null\n    if (!currentUser) return null\n    return toUser(currentUser)\n  }\n\n  const identityContext = globalThis.netlifyIdentityContext\n  if (!identityContext) return null\n\n  const claims = identityContext.user ?? (identityContext.sub ? identityContext : null)\n  if (!claims) return null\n  return claimsToUser(claims as Record<string, unknown>)\n}\n\n/**\n * Returns `true` if a user is currently authenticated.\n */\nexport const isAuthenticated = (): boolean => getUser() !== null\n","export class AuthError extends Error {\n  override name = 'AuthError'\n  status?: number\n  declare cause?: unknown\n\n  constructor(message: string, status?: number, options?: { cause?: unknown }) {\n    super(message)\n    this.status = status\n    if (options && 'cause' in options) {\n      this.cause = options.cause\n    }\n  }\n}\n\nexport class MissingIdentityError extends Error {\n  override name = 'MissingIdentityError'\n\n  constructor(message = 'Identity is not available in this environment') {\n    super(message)\n  }\n}\n","import type { AuthProvider, IdentityConfig, Settings } from './types.js'\nimport { AuthError, MissingIdentityError } from './errors.js'\nimport { getGoTrueClient, getIdentityContext, isBrowser } from './environment.js'\n\n/**\n * Returns the identity configuration for the current environment.\n * Browser: always returns `{ url }` derived from `window.location.origin`.\n * Server: returns `{ url, token }` from the identity context, or `null` if unavailable.\n * Never throws.\n */\nexport const getIdentityConfig = (): IdentityConfig | null => {\n  if (isBrowser()) {\n    return { url: `${window.location.origin}/.netlify/identity` }\n  }\n\n  return getIdentityContext()\n}\n\n/**\n * Fetches the GoTrue `/settings` endpoint.\n * Throws `MissingIdentityError` if Identity is not configured.\n * Throws `AuthError` if the endpoint is unreachable.\n */\nexport const getSettings = async (): Promise<Settings> => {\n  const client = getGoTrueClient()\n  if (!client) throw new MissingIdentityError()\n\n  try {\n    const raw = await client.settings()\n    const external: Partial<Record<AuthProvider, boolean>> = raw.external ?? {}\n    return {\n      autoconfirm: raw.autoconfirm,\n      disableSignup: raw.disable_signup,\n      providers: {\n        google: external.google ?? false,\n        github: external.github ?? false,\n        gitlab: external.gitlab ?? false,\n        bitbucket: external.bitbucket ?? false,\n        facebook: external.facebook ?? false,\n        email: external.email ?? false,\n        saml: external.saml ?? false,\n      },\n    }\n  } catch (err) {\n    throw new AuthError(err instanceof Error ? err.message : 'Failed to fetch identity settings', 502, { cause: err })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,iBAAiB,CAAC,UAAU,UAAU,UAAU,aAAa,YAAY,QAAQ,OAAO;;;ACArG,uBAAmB;AAInB,IAAI,eAA8B;AAClC,IAAI;AACJ,IAAI,mBAAmB;AAEhB,IAAM,YAAY,MAAe,OAAO,WAAW,eAAe,OAAO,OAAO,aAAa;AAQpG,IAAM,iBAAiB,MAAqB;AAC1C,MAAI,iBAAiB,OAAW,QAAO;AAEvC,MAAI,UAAU,GAAG;AACf,mBAAe,GAAG,OAAO,SAAS,MAAM;AAAA,EAC1C,OAAO;AACL,UAAM,kBAAkB,mBAAmB;AAC3C,QAAI,iBAAiB,KAAK;AACxB,qBAAe,gBAAgB;AAAA,IACjC,WAAW,WAAW,SAAS,SAAS,KAAK;AAC3C,qBAAe,IAAI,IAAI,sBAAsB,WAAW,QAAQ,QAAQ,GAAG,EAAE;AAAA,IAC/E;AAAA,EACF;AAEA,SAAO,gBAAgB;AACzB;AAMO,IAAM,kBAAkB,MAAqB;AAClD,MAAI,aAAc,QAAO;AAEzB,QAAM,SAAS,eAAe;AAC9B,MAAI,CAAC,QAAQ;AACX,QAAI,CAAC,kBAAkB;AACrB,cAAQ;AAAA,QACN;AAAA,MAEF;AACA,yBAAmB;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,IAAI,iBAAAA,QAAO,EAAE,QAAQ,QAAQ,WAAW,UAAU,EAAE,CAAC;AACpE,SAAO;AACT;AAMO,IAAM,qBAAqB,MAA6B;AAI7D,QAAM,kBAAkB,WAAW;AACnC,MAAI,iBAAiB,OAAO,OAAO,gBAAgB,QAAQ,UAAU;AACnE,WAAO;AAAA,MACL,KAAK,gBAAgB;AAAA,MACrB,OAAO,OAAO,gBAAgB,UAAU,WAAW,gBAAgB,QAAQ;AAAA,IAC7E;AAAA,EACF;AAEA,MAAI,WAAW,SAAS,SAAS,KAAK;AACpC,WAAO,EAAE,KAAK,IAAI,IAAI,sBAAsB,WAAW,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAAA,EACnF;AAEA,SAAO;AACT;;;ACzEA,IAAM,iBAAiB,CAAC,UACtB,OAAO,UAAU,YAAa,eAAqC,SAAS,KAAK,IAC5E,QACD;AAeC,IAAM,SAAS,CAAC,aAA6B;AAClD,QAAM,WAAW,SAAS,iBAAiB,CAAC;AAC5C,QAAM,UAAU,SAAS,gBAAgB,CAAC;AAC1C,QAAM,OAAO,SAAS,aAAa,SAAS;AAC5C,QAAM,aAAa,SAAS;AAE5B,SAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,OAAO,SAAS;AAAA,IAChB,eAAe,CAAC,CAAC,SAAS;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,WAAW,SAAS;AAAA,IACpB,UAAU,eAAe,QAAQ,QAAQ;AAAA,IACzC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,YAAY,OAAO,eAAe,WAAW,aAAa;AAAA,IAC1D,UAAU;AAAA,IACV,eAAe,EAAE,GAAG,SAAS;AAAA,EAC/B;AACF;AAMA,IAAM,eAAe,CAAC,WAA0C;AAC9D,QAAM,UAAW,OAAO,gBAAgB,CAAC;AACzC,QAAM,WAAY,OAAO,iBAAiB,CAAC;AAC3C,QAAM,OAAO,SAAS,aAAa,SAAS;AAE5C,SAAO;AAAA,IACL,IAAI,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAAA,IAClD,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAAA,IACzD,UAAU,eAAe,QAAQ,QAAQ;AAAA,IACzC,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,IACxC,UAAU;AAAA,EACZ;AACF;AAMO,IAAM,UAAU,MAAmB;AACxC,MAAI,UAAU,GAAG;AACf,UAAM,SAAS,gBAAgB;AAC/B,UAAM,cAAc,QAAQ,YAAY,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO;AACzB,WAAO,OAAO,WAAW;AAAA,EAC3B;AAEA,QAAM,kBAAkB,WAAW;AACnC,MAAI,CAAC,gBAAiB,QAAO;AAE7B,QAAM,SAAS,gBAAgB,SAAS,gBAAgB,MAAM,kBAAkB;AAChF,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,aAAa,MAAiC;AACvD;AAKO,IAAM,kBAAkB,MAAe,QAAQ,MAAM;;;ACnFrD,IAAM,YAAN,cAAwB,MAAM;AAAA,EAKnC,YAAY,SAAiB,QAAiB,SAA+B;AAC3E,UAAM,OAAO;AALf,SAAS,OAAO;AAMd,SAAK,SAAS;AACd,QAAI,WAAW,WAAW,SAAS;AACjC,WAAK,QAAQ,QAAQ;AAAA,IACvB;AAAA,EACF;AACF;AAEO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAG9C,YAAY,UAAU,iDAAiD;AACrE,UAAM,OAAO;AAHf,SAAS,OAAO;AAAA,EAIhB;AACF;;;ACVO,IAAM,oBAAoB,MAA6B;AAC5D,MAAI,UAAU,GAAG;AACf,WAAO,EAAE,KAAK,GAAG,OAAO,SAAS,MAAM,qBAAqB;AAAA,EAC9D;AAEA,SAAO,mBAAmB;AAC5B;AAOO,IAAM,cAAc,YAA+B;AACxD,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,OAAQ,OAAM,IAAI,qBAAqB;AAE5C,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,SAAS;AAClC,UAAM,WAAmD,IAAI,YAAY,CAAC;AAC1E,WAAO;AAAA,MACL,aAAa,IAAI;AAAA,MACjB,eAAe,IAAI;AAAA,MACnB,WAAW;AAAA,QACT,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,QAAQ,SAAS,UAAU;AAAA,QAC3B,WAAW,SAAS,aAAa;AAAA,QACjC,UAAU,SAAS,YAAY;AAAA,QAC/B,OAAO,SAAS,SAAS;AAAA,QACzB,MAAM,SAAS,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI,UAAU,eAAe,QAAQ,IAAI,UAAU,qCAAqC,KAAK,EAAE,OAAO,IAAI,CAAC;AAAA,EACnH;AACF;","names":["GoTrue"]}

package/dist/index.d.cts

@@ -1,5 +1,3 @@
-import { UserData } from 'gotrue-js';
-
 declare const AUTH_PROVIDERS: readonly ["google", "github", "gitlab", "bitbucket", "facebook", "saml", "email"];
 type AuthProvider = (typeof AUTH_PROVIDERS)[number];
 interface AppMetadata {
@@ -29,7 +27,6 @@ interface User {
     metadata?: Record<string, unknown>;
     rawGoTrueData?: Record<string, unknown>;
 }
-declare const toUser: (userData: UserData) => User;
 /**
  * Returns the currently authenticated user, or `null` if not logged in.
  * Synchronous. Never throws.
@@ -54,16 +51,6 @@ declare const getIdentityConfig: () => IdentityConfig | null;
  */
 declare const getSettings: () => Promise<Settings>;
 
-interface JWTClaims {
-    sub: string;
-    email: string;
-    exp: number;
-    iat: number;
-    aud: string;
-    app_metadata: AppMetadata;
-    user_metadata: Record<string, unknown>;
-}
-
 declare class AuthError extends Error {
     name: string;
     status?: number;
@@ -77,4 +64,4 @@ declare class MissingIdentityError extends Error {
     constructor(message?: string);
 }
 
-export { type AppMetadata, AuthError, type AuthProvider, type IdentityConfig, type JWTClaims, MissingIdentityError, type Settings, type User, getIdentityConfig, getSettings, getUser, isAuthenticated, toUser };
+export { type AppMetadata, AuthError, type AuthProvider, type IdentityConfig, MissingIdentityError, type Settings, type User, getIdentityConfig, getSettings, getUser, isAuthenticated };

package/dist/index.d.ts

@@ -1,5 +1,3 @@
-import { UserData } from 'gotrue-js';
-
 declare const AUTH_PROVIDERS: readonly ["google", "github", "gitlab", "bitbucket", "facebook", "saml", "email"];
 type AuthProvider = (typeof AUTH_PROVIDERS)[number];
 interface AppMetadata {
@@ -29,7 +27,6 @@ interface User {
     metadata?: Record<string, unknown>;
     rawGoTrueData?: Record<string, unknown>;
 }
-declare const toUser: (userData: UserData) => User;
 /**
  * Returns the currently authenticated user, or `null` if not logged in.
  * Synchronous. Never throws.
@@ -54,16 +51,6 @@ declare const getIdentityConfig: () => IdentityConfig | null;
  */
 declare const getSettings: () => Promise<Settings>;
 
-interface JWTClaims {
-    sub: string;
-    email: string;
-    exp: number;
-    iat: number;
-    aud: string;
-    app_metadata: AppMetadata;
-    user_metadata: Record<string, unknown>;
-}
-
 declare class AuthError extends Error {
     name: string;
     status?: number;
@@ -77,4 +64,4 @@ declare class MissingIdentityError extends Error {
     constructor(message?: string);
 }
 
-export { type AppMetadata, AuthError, type AuthProvider, type IdentityConfig, type JWTClaims, MissingIdentityError, type Settings, type User, getIdentityConfig, getSettings, getUser, isAuthenticated, toUser };
+export { type AppMetadata, AuthError, type AuthProvider, type IdentityConfig, MissingIdentityError, type Settings, type User, getIdentityConfig, getSettings, getUser, isAuthenticated };

package/dist/index.js

@@ -151,7 +151,6 @@ export {
   getIdentityConfig,
   getSettings,
   getUser,
-  isAuthenticated,
-  toUser
+  isAuthenticated
 };
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netlify/identity",
-  "version": "0.1.0-alpha.8",
+  "version": "0.1.0",
   "type": "module",
   "description": "Add authentication to your Netlify site with a few lines of code",
   "main": "./dist/index.cjs",