@netlify/identity 0.3.0-alpha.2 → 0.3.0-alpha.4

package/README.md

@@ -9,7 +9,7 @@ A lightweight, no-config headless authentication library for projects using Netl
 - [Netlify Identity](https://docs.netlify.com/security/secure-access-to-sites/identity/) must be enabled on your Netlify project
 - For local development, use [`netlify dev`](https://docs.netlify.com/cli/local-development/) so the Identity endpoint is available
 
-### How this library relates to other Netlify auth packages
+## How this library relates to other Netlify auth packages
 
 | Package                                                                         | What it is                                     | When to use it                                                                             |
 | ------------------------------------------------------------------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------ |
@@ -26,7 +26,7 @@ This library wraps `gotrue-js` in the browser and calls the GoTrue HTTP API dire
 - [API](#api)
   - [Functions](#functions) -- `getUser`, `login`, `signup`, `logout`, `oauthLogin`, `handleAuthCallback`, `onAuthChange`, `hydrateSession`, and more
   - [Admin Operations](#admin-operations) -- `admin.listUsers`, `admin.getUser`, `admin.createUser`, `admin.updateUser`, `admin.deleteUser`
-  - [Types](#types) -- `User`, `AuthEvent`, `CallbackResult`, `Settings`, etc.
+  - [Types](#types) -- `User`, `AuthEvent`, `CallbackResult`, `Settings`, `Admin`, `ListUsersOptions`, `CreateUserParams`, etc.
   - [Errors](#errors) -- `AuthError`, `MissingIdentityError`
 - [Framework integration](#framework-integration) -- Next.js, Remix, TanStack Start, Astro, SvelteKit
 - [Guides](#guides)
@@ -312,7 +312,7 @@ export default async (req: Request, context: Context) => {
 #### `admin.listUsers`
 
 ```ts
-admin.listUsers(options?: { page?: number; perPage?: number }): Promise<User[]>
+admin.listUsers(options?: ListUsersOptions): Promise<User[]>
 ```
 
 Lists all users. Pagination options are supported on the server; they are ignored in the browser (gotrue-js does not support pagination for this method).
@@ -332,7 +332,7 @@ Gets a single user by ID.
 #### `admin.createUser`
 
 ```ts
-admin.createUser(params: { email: string; password: string; data?: Record<string, unknown> }): Promise<User>
+admin.createUser(params: CreateUserParams): Promise<User>
 ```
 
 Creates a new user. The user is auto-confirmed. Optional `data` is spread into the request body as additional attributes.
@@ -450,6 +450,43 @@ interface AppMetadata {
 }
 ```
 
+#### `ListUsersOptions`
+
+```ts
+interface ListUsersOptions {
+  page?: number
+  perPage?: number
+}
+```
+
+Pagination options for `admin.listUsers()`. Only used on the server; pagination is ignored in the browser (gotrue-js limitation).
+
+#### `CreateUserParams`
+
+```ts
+interface CreateUserParams {
+  email: string
+  password: string
+  data?: Record<string, unknown>
+}
+```
+
+Parameters for `admin.createUser()`. Optional `data` is spread into the GoTrue request body as top-level attributes (use it to set `app_metadata`, `user_metadata`, `role`, etc.).
+
+#### `Admin`
+
+```ts
+interface Admin {
+  listUsers: (options?: ListUsersOptions) => Promise<User[]>
+  getUser: (userId: string) => Promise<User>
+  createUser: (params: CreateUserParams) => Promise<User>
+  updateUser: (userId: string, attributes: AdminUserUpdates) => Promise<User>
+  deleteUser: (userId: string) => Promise<void>
+}
+```
+
+The type of the `admin` export. Useful for passing the admin namespace as a dependency.
+
 #### `AUTH_EVENTS`
 
 ```ts
@@ -464,6 +501,14 @@ const AUTH_EVENTS: {
 
 Constants for auth event names. Use these instead of string literals for type safety and autocomplete.
 
+| Event           | When it fires                                                                                                                                                                                                                                                                         |
+| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `LOGIN`         | `login()`, `signup()` (with autoconfirm), `recoverPassword()`, `handleAuthCallback()` (OAuth/confirmation), `hydrateSession()`                                                                                                                                                        |
+| `LOGOUT`        | `logout()`                                                                                                                                                                                                                                                                            |
+| `TOKEN_REFRESH` | gotrue-js refreshes an expiring access token in the background                                                                                                                                                                                                                        |
+| `USER_UPDATED`  | `updateUser()`, `verifyEmailChange()`, `handleAuthCallback()` (email change)                                                                                                                                                                                                          |
+| `RECOVERY`      | `handleAuthCallback()` (recovery token only). The user is authenticated but has **not** set a new password yet. Listen for this to redirect to a password reset form. `recoverPassword()` emits `LOGIN` instead because it completes both steps (token redemption + password change). |
+
 #### `AuthEvent`
 
 ```ts

package/dist/index.cjs

@@ -61,7 +61,7 @@ var AUTH_PROVIDERS = ["google", "github", "gitlab", "bitbucket", "facebook", "sa
 var import_gotrue_js = __toESM(require("gotrue-js"), 1);
 
 // src/errors.ts
-var AuthError = class extends Error {
+var AuthError = class _AuthError extends Error {
   constructor(message, status, options) {
     super(message);
     this.name = "AuthError";
@@ -70,6 +70,10 @@ var AuthError = class extends Error {
       this.cause = options.cause;
     }
   }
+  static from(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return new _AuthError(message, void 0, { cause: error });
+  }
 };
 var MissingIdentityError = class extends Error {
   constructor(message = "Netlify Identity is not available.") {
@@ -94,7 +98,7 @@ var discoverApiUrl = () => {
       cachedApiUrl = identityContext.url;
     } else if (globalThis.Netlify?.context?.url) {
       cachedApiUrl = new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href;
-    } else if (process.env.URL) {
+    } else if (typeof process !== "undefined" && process.env?.URL) {
       cachedApiUrl = new URL(IDENTITY_PATH, process.env.URL).href;
     }
   }
@@ -131,7 +135,7 @@ var getIdentityContext = () => {
   if (globalThis.Netlify?.context?.url) {
     return { url: new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href };
   }
-  const siteUrl = process.env.URL;
+  const siteUrl = typeof process !== "undefined" ? process.env?.URL : void 0;
   if (siteUrl) {
     return { url: new URL(IDENTITY_PATH, siteUrl).href };
   }
@@ -143,7 +147,12 @@ var NF_JWT_COOKIE = "nf_jwt";
 var NF_REFRESH_COOKIE = "nf_refresh";
 var getCookie = (name) => {
   const match = document.cookie.match(new RegExp(`(?:^|; )${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=([^;]*)`));
-  return match ? decodeURIComponent(match[1]) : null;
+  if (!match) return null;
+  try {
+    return decodeURIComponent(match[1]);
+  } catch {
+    return match[1];
+  }
 };
 var setAuthCookies = (cookies, accessToken, refreshToken) => {
   cookies.set({
@@ -428,7 +437,7 @@ var login = async (email, password) => {
         body: body.toString()
       });
     } catch (error) {
-      throw new AuthError(error.message, void 0, { cause: error });
+      throw AuthError.from(error);
     }
     if (!res.ok) {
       const errorBody = await res.json().catch(() => ({}));
@@ -442,7 +451,7 @@ var login = async (email, password) => {
         headers: { Authorization: `Bearer ${accessToken}` }
       });
     } catch (error) {
-      throw new AuthError(error.message, void 0, { cause: error });
+      throw AuthError.from(error);
     }
     if (!userRes.ok) {
       const errorBody = await userRes.json().catch(() => ({}));
@@ -462,7 +471,7 @@ var login = async (email, password) => {
     emitAuthEvent(AUTH_EVENTS.LOGIN, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var signup = async (email, password, data) => {
@@ -477,7 +486,7 @@ var signup = async (email, password, data) => {
         body: JSON.stringify({ email, password, data })
       });
     } catch (error) {
-      throw new AuthError(error.message, void 0, { cause: error });
+      throw AuthError.from(error);
     }
     if (!res.ok) {
       const errorBody = await res.json().catch(() => ({}));
@@ -506,7 +515,7 @@ var signup = async (email, password, data) => {
     }
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var logout = async () => {
@@ -535,7 +544,7 @@ var logout = async () => {
     deleteBrowserAuthCookies();
     emitAuthEvent(AUTH_EVENTS.LOGOUT, null);
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var oauthLogin = (provider) => {
@@ -566,7 +575,7 @@ var handleAuthCallback = async () => {
     return null;
   } catch (error) {
     if (error instanceof AuthError) throw error;
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var handleOAuthCallback = async (client, params, accessToken) => {
@@ -651,16 +660,22 @@ var hydrateSession = async () => {
   const decoded = decodeJwtPayload(accessToken);
   const expiresAt = decoded?.exp ?? Math.floor(Date.now() / 1e3) + 3600;
   const expiresIn = Math.max(0, expiresAt - Math.floor(Date.now() / 1e3));
-  const gotrueUser = await client.createUser(
-    {
-      access_token: accessToken,
-      token_type: "bearer",
-      expires_in: expiresIn,
-      expires_at: expiresAt,
-      refresh_token: refreshToken
-    },
-    persistSession
-  );
+  let gotrueUser;
+  try {
+    gotrueUser = await client.createUser(
+      {
+        access_token: accessToken,
+        token_type: "bearer",
+        expires_in: expiresIn,
+        expires_at: expiresAt,
+        refresh_token: refreshToken
+      },
+      persistSession
+    );
+  } catch {
+    deleteBrowserAuthCookies();
+    return null;
+  }
   const user = toUser(gotrueUser);
   emitAuthEvent(AUTH_EVENTS.LOGIN, user);
   return user;
@@ -685,7 +700,7 @@ var requestPasswordRecovery = async (email) => {
   try {
     await client.requestPasswordRecovery(email);
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var recoverPassword = async (token, newPassword) => {
@@ -697,7 +712,7 @@ var recoverPassword = async (token, newPassword) => {
     emitAuthEvent(AUTH_EVENTS.LOGIN, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var confirmEmail = async (token) => {
@@ -708,7 +723,7 @@ var confirmEmail = async (token) => {
     emitAuthEvent(AUTH_EVENTS.LOGIN, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var acceptInvite = async (token, password) => {
@@ -719,15 +734,15 @@ var acceptInvite = async (token, password) => {
     emitAuthEvent(AUTH_EVENTS.LOGIN, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var verifyEmailChange = async (token) => {
   if (!isBrowser()) throw new AuthError("verifyEmailChange() is only available in the browser");
   const currentUser = await resolveCurrentUser();
-  const jwt = await currentUser.jwt();
-  const identityUrl = `${window.location.origin}${IDENTITY_PATH}`;
   try {
+    const jwt = await currentUser.jwt();
+    const identityUrl = `${window.location.origin}${IDENTITY_PATH}`;
     const res = await fetch(`${identityUrl}/user`, {
       method: "PUT",
       headers: {
@@ -746,7 +761,7 @@ var verifyEmailChange = async (token) => {
     return user;
   } catch (error) {
     if (error instanceof AuthError) throw error;
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };
 var updateUser = async (updates) => {
@@ -757,7 +772,7 @@ var updateUser = async (updates) => {
     emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user);
     return user;
   } catch (error) {
-    throw new AuthError(error.message, void 0, { cause: error });
+    throw AuthError.from(error);
   }
 };