@supabase/auth-js 2.110.0-canary.0 → 2.110.1-canary.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/auth-js",
-  "version": "2.110.0-canary.0",
+  "version": "2.110.1-canary.0",
   "private": false,
   "description": "Official SDK for Supabase Auth",
   "keywords": [
@@ -51,7 +51,7 @@
     "build": "npm run build:main && npm run build:module",
     "build:main": "tsc -p tsconfig.json",
     "build:module": "tsc -p tsconfig.module.json",
-    "docs": "typedoc src/index.ts --out docs/v2 --excludePrivate --excludeProtected",
-    "docs:json": "typedoc --json docs/v2/spec.json --excludeExternals --excludePrivate --excludeProtected src/index.ts"
+    "docs": "typedoc --options ../../../typedoc.base.mjs src/index.ts --out docs/v2 --excludePrivate --excludeProtected",
+    "docs:json": "typedoc --options ../../../typedoc.base.mjs --json docs/v2/spec.json --excludeExternals --excludePrivate --excludeProtected src/index.ts"
   }
 }

package/src/GoTrueAdminApi.ts

@@ -257,10 +257,7 @@ export default class GoTrueAdminApi {
 
   /**
    * Generates email links and OTPs to be sent via a custom email provider.
-   * @param email The user's email.
-   * @param options.password User password. For signup only.
-   * @param options.data Optional user metadata. For signup only.
-   * @param options.redirectTo The redirect url which should be appended to the generated link
+   * @param params The parameters for generating the link, including the link `type`, the user's `email`, and type-specific options such as `password`, `data`, and `redirectTo`.
    *
    * @category Auth
    * @subcategory Auth Admin

package/src/GoTrueClient.ts

@@ -323,6 +323,23 @@ export default class GoTrueClient {
    * Keep extra care to never reject or throw uncaught errors
    */
   protected initializePromise: Promise<InitializeResult> | null = null
+  /**
+   * Non-null only while `initialize()` is running. While open,
+   * `_notifyAllSubscribers` enqueues init-chain notifications (those fired with
+   * `broadcast = true`, i.e. from `_recoverAndRefresh`) into this array instead
+   * of firing directly, so that `initializePromise` is guaranteed to be
+   * resolved before any subscriber callback runs. Callbacks that call
+   * `getSession()` / `getUser()` etc. would otherwise deadlock because those
+   * methods await `initializePromise`. Notifications from the incoming
+   * BroadcastChannel handler (`broadcast = false`) are not enqueued — they fire
+   * immediately. Flushed (in order) by `initialize()` after `initializePromise`
+   * settles.
+   */
+  private _pendingInitNotifications: Array<{
+    event: AuthChangeEvent
+    session: Session | null
+    broadcast: boolean
+  }> | null = null
   protected detectSessionInUrl:
     | boolean
     | ((url: URL, params: { [parameter: string]: string }) => boolean) = true
@@ -584,6 +601,16 @@ export default class GoTrueClient {
       return await this.initializePromise
     }
 
+    // Open the notification queue before _initialize() runs so that every
+    // _notifyAllSubscribers call inside the init chain enqueues instead of
+    // firing. Without this, a callback receiving SIGNED_IN (or TOKEN_REFRESHED
+    // / SIGNED_OUT) during _recoverAndRefresh would deadlock if it called
+    // getSession() / getUser() — those methods await initializePromise, which
+    // can only resolve after the callback returns, which can only return after
+    // getSession() resolves. The queue is flushed below after initializePromise
+    // has settled, so callbacks run with a fully resolved initializePromise.
+    this._pendingInitNotifications = []
+
     this.initializePromise = (async () => {
       if (this.lock != null) {
         // TODO(v3): remove legacy lock path
@@ -594,7 +621,17 @@ export default class GoTrueClient {
       return await this._initialize()
     })()
 
-    return await this.initializePromise
+    const result = await this.initializePromise
+
+    // initializePromise is now resolved — flush queued notifications in order.
+    // Callbacks can safely call getSession() / getUser() / signOut() etc.
+    const queue = this._pendingInitNotifications ?? []
+    this._pendingInitNotifications = null
+    for (const n of queue) {
+      await this._notifyAllSubscribers(n.event, n.session, n.broadcast)
+    }
+
+    return result
   }
 
   /**
@@ -2692,7 +2729,7 @@ export default class GoTrueClient {
    * to the client. If that storage is based on request cookies for example,
    * the values in it may not be authentic and therefore it's strongly advised
    * against using this method and its results in such circumstances. A warning
-   * will be emitted if this is detected. Use {@link #getUser()} instead.
+   * will be emitted if this is detected. Use {@link GoTrueClient.getUser} instead.
    *
    * @category Auth
    *
@@ -2861,7 +2898,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * Use instead of {@link #getSession} inside the library. Loads the session
+   * Use instead of {@link GoTrueClient.getSession} inside the library. Loads the session
    * via `__loadSession` (which may trigger a refresh if the access token is
    * within the expiry margin) and runs `fn` with the result.
    */
@@ -2906,7 +2943,7 @@ export default class GoTrueClient {
   /**
    * NEVER USE DIRECTLY!
    *
-   * Always use {@link #_useSession}.
+   * Always use `_useSession`.
    */
   private async __loadSession(): Promise<
     | {
@@ -5011,6 +5048,20 @@ export default class GoTrueClient {
     session: Session | null,
     broadcast = true
   ) {
+    if (this._pendingInitNotifications !== null && broadcast) {
+      // We're inside initialize() before initializePromise has resolved, and
+      // this notification originates from the init chain (_recoverAndRefresh),
+      // which always fires with broadcast = true. Enqueue instead of firing so
+      // that callbacks can safely call getSession() / getUser() without
+      // deadlocking on initializePromise.
+      //
+      // Notifications with broadcast = false come from the incoming
+      // BroadcastChannel handler (a cross-tab event), not the init chain, so
+      // they are fired immediately to preserve multi-tab ordering.
+      this._pendingInitNotifications.push({ event, session, broadcast })
+      return
+    }
+
     const debugName = `#_notifyAllSubscribers(${event})`
     this._debug(debugName, 'begin', session, `broadcast = ${broadcast}`)
 
@@ -5114,8 +5165,8 @@ export default class GoTrueClient {
   /**
    * Removes any registered visibilitychange callback.
    *
-   * {@see #startAutoRefresh}
-   * {@see #stopAutoRefresh}
+   * {@link GoTrueClient.startAutoRefresh}
+   * {@link GoTrueClient.stopAutoRefresh}
    */
   private _removeVisibilityChangedCallback() {
     this._debug('#_removeVisibilityChangedCallback()')
@@ -5133,7 +5184,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * This is the private implementation of {@link #startAutoRefresh}. Use this
+   * This is the private implementation of {@link GoTrueClient.startAutoRefresh}. Use this
    * within the library.
    */
   private async _startAutoRefresh() {
@@ -5179,7 +5230,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * This is the private implementation of {@link #stopAutoRefresh}. Use this
+   * This is the private implementation of {@link GoTrueClient.stopAutoRefresh}. Use this
    * within the library.
    */
   private async _stopAutoRefresh() {
@@ -5220,7 +5271,7 @@ export default class GoTrueClient {
    * platform's foreground indication mechanism and call these methods
    * appropriately to conserve resources.
    *
-   * {@see #stopAutoRefresh}
+   * {@link GoTrueClient.stopAutoRefresh}
    *
    * @category Auth
    *
@@ -5255,7 +5306,7 @@ export default class GoTrueClient {
    * If you call this method any managed visibility change callback will be
    * removed and you must manage visibility changes on your own.
    *
-   * See {@link #startAutoRefresh} for more details.
+   * See {@link GoTrueClient.startAutoRefresh} for more details.
    *
    * @category Auth
    *
@@ -5577,7 +5628,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * {@see GoTrueMFAApi#enroll}
+   * {@link GoTrueMFAApi#enroll}
    */
   private async _enroll(params: MFAEnrollTOTPParams): Promise<AuthMFAEnrollTOTPResponse>
   private async _enroll(params: MFAEnrollPhoneParams): Promise<AuthMFAEnrollPhoneResponse>
@@ -5624,7 +5675,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * {@see GoTrueMFAApi#verify}
+   * {@link GoTrueMFAApi#verify}
    */
   private async _verify(params: MFAVerifyTOTPParams): Promise<AuthMFAVerifyResponse>
   private async _verify(params: MFAVerifyPhoneParams): Promise<AuthMFAVerifyResponse>
@@ -5713,7 +5764,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * {@see GoTrueMFAApi#challenge}
+   * {@link GoTrueMFAApi#challenge}
    */
   private async _challenge(
     params: MFAChallengeTOTPParams
@@ -5808,7 +5859,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * {@see GoTrueMFAApi#challengeAndVerify}
+   * {@link GoTrueMFAApi#challengeAndVerify}
    */
   private async _challengeAndVerify(
     params: MFAChallengeAndVerifyParams
@@ -5828,7 +5879,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * {@see GoTrueMFAApi#listFactors}
+   * {@link GoTrueMFAApi#listFactors}
    */
   private async _listFactors(): Promise<AuthMFAListFactorsResponse> {
     const {
@@ -5861,7 +5912,7 @@ export default class GoTrueClient {
   }
 
   /**
-   * {@see GoTrueMFAApi#getAuthenticatorAssuranceLevel}
+   * {@link GoTrueMFAApi#getAuthenticatorAssuranceLevel}
    */
   private async _getAuthenticatorAssuranceLevel(
     jwt?: string
@@ -6209,15 +6260,15 @@ export default class GoTrueClient {
    * Extracts the JWT claims present in the access token by first verifying the
    * JWT against the server's JSON Web Key Set endpoint
    * `/.well-known/jwks.json` which is often cached, resulting in significantly
-   * faster responses. Prefer this method over {@link #getUser} which always
+   * faster responses. Prefer this method over {@link GoTrueClient.getUser} which always
    * sends a request to the Auth server for each JWT.
    *
    * If the project is not using an asymmetric JWT signing key (like ECC or
-   * RSA) it always sends a request to the Auth server (similar to {@link
-   * #getUser}) to verify the JWT.
+   * RSA) it always sends a request to the Auth server (similar to
+   * {@link GoTrueClient.getUser}) to verify the JWT.
    *
    * @param jwt An optional specific JWT you wish to verify, not the one you
-   *            can obtain from {@link #getSession}.
+   *            can obtain from {@link GoTrueClient.getSession}.
    * @param options Various additional options that allow you to customize the
    *                behavior of this method.
    *

package/src/lib/errors.ts

@@ -16,7 +16,7 @@ export class AuthError extends Error {
    * Error code associated with the error. Most errors coming from
    * HTTP responses will have a code, though some errors that occur
    * before a response is received will not have one present. In that
-   * case {@link #status} will also be undefined.
+   * case {@link AuthError.status} will also be undefined.
    */
   code: ErrorCode | (string & {}) | undefined
 

package/src/lib/locks.ts

@@ -302,7 +302,7 @@ const PROCESS_LOCKS: { [name: string]: Promise<any> } = {}
  * Useful for environments like React Native or other non-browser
  * single-process (i.e. no concept of "tabs") environments.
  *
- * Use {@link #navigatorLock} in browser environments.
+ * Use {@link navigatorLock} in browser environments.
  *
  * @param name Name of the lock to be acquired.
  * @param acquireTimeout If negative, no timeout. If 0 an error is thrown if

package/src/lib/types.ts

@@ -228,7 +228,7 @@ export type RequestResult<T, ErrorType extends Error = AuthError> =
 
 /**
  * similar to RequestResult except it allows you to destructure the possible shape of the success response
- *  {@see RequestResult}
+ *  {@link RequestResult}
  */
 export type RequestResultSafeDestructure<T> =
   | { data: T; error: null }
@@ -251,7 +251,7 @@ export type AuthResponsePassword = RequestResultSafeDestructure<{
 /**
  * AuthOtpResponse is returned when OTP is used.
  *
- * {@see AuthResponse}
+ * {@link AuthResponse}
  */
 export type AuthOtpResponse = RequestResultSafeDestructure<{
   user: null
@@ -407,7 +407,7 @@ type FactorVerificationStatus = (typeof FactorVerificationStatuses)[number]
  *
  * @see {@link GoTrueMFAApi#enroll}
  * @see {@link GoTrueMFAApi#listFactors}
- * @see {@link GoTrueMFAAdminApi#listFactors}
+ * @see {@link GoTrueAdminMFAApi#listFactors}
  */
 export type Factor<
   Type extends FactorType = FactorType,
@@ -1691,14 +1691,14 @@ export interface GoTrueMFAApi {
 }
 
 /**
- * @expermental
+ * @experimental
  */
 export type AuthMFAAdminDeleteFactorResponse = RequestResult<{
   /** ID of the factor that was successfully deleted. */
   id: string
 }>
 /**
- * @expermental
+ * @experimental
  */
 export type AuthMFAAdminDeleteFactorParams = {
   /** ID of the MFA factor to delete. */
@@ -1709,7 +1709,7 @@ export type AuthMFAAdminDeleteFactorParams = {
 }
 
 /**
- * @expermental
+ * @experimental
  */
 export type AuthMFAAdminListFactorsResponse = RequestResult<{
   /** All factors attached to the user. */
@@ -1717,7 +1717,7 @@ export type AuthMFAAdminListFactorsResponse = RequestResult<{
 }>
 
 /**
- * @expermental
+ * @experimental
  */
 export type AuthMFAAdminListFactorsParams = {
   /** ID of the user. */
@@ -1727,7 +1727,7 @@ export type AuthMFAAdminListFactorsParams = {
 /**
  * Contains the full multi-factor authentication administration API.
  *
- * @expermental
+ * @experimental
  */
 export interface GoTrueAdminMFAApi {
   /**
@@ -1769,7 +1769,7 @@ export interface GoTrueAdminMFAApi {
    *
    * @see {@link GoTrueMFAApi#unenroll}
    *
-   * @expermental
+   * @experimental
    *
    * @category Auth
    * @subcategory Auth Admin

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.110.0-canary.0'
+export const version = '2.110.1-canary.0'