@supabase/auth-js 2.117.0 → 2.117.1

package/migrations/lockless-coordination.md

@@ -8,8 +8,8 @@
 ## What changed
 
 - **Default coordination is lockless.** A client constructed without a `lock` option no longer acquires `navigator.locks` or any in-process lock. In-tab concurrent refreshes are deduplicated via the pre-existing single-flight (`refreshingDeferred`); cross-tab refresh races are resolved by GoTrue's server-side parent-of-active mechanism on the v1 refresh-token path.
-- **Commit guard inside `_callRefreshToken`.** The client snapshots storage before the rotated-token fetch and re-reads after. If a non-null pre-fetch snapshot was cleared between the two reads (typical case: a concurrent `signOut` ran `_removeSession`), the rotated tokens are discarded instead of being written back over the cleared storage. The discarded result resolves with `{ data: null, error: new AuthRefreshDiscardedError() }`.
-- **New `AuthRefreshDiscardedError`** (with `isAuthRefreshDiscardedError` type guard). Surfaces through `refreshSession()` and `getSession()` results when the commit guard fires. Distinct from `AuthRetryableFetchError` (transient network) and `AuthApiError` (server rejection).
+- **Commit guard inside `_callRefreshToken`.** The client snapshots storage before the rotated-token fetch and re-reads after. If a non-null pre-fetch snapshot was cleared or replaced between the two reads (a concurrent `signOut` ran `_removeSession`, or another tab's refresh rotated first), the rotated tokens are discarded instead of being written back over storage. The discarded result resolves with `{ data: null, error: new AuthRefreshDiscardedError() }`.
+- **New `AuthRefreshDiscardedError`** (with `isAuthRefreshDiscardedError` type guard). Surfaces through `refreshSession()` and `setSession()` results when the commit guard fires. `getSession()` surfaces it only when storage was cleared mid-flight; when another caller's rotation replaced storage, `getSession()` returns the session now in storage instead. Distinct from `AuthRetryableFetchError` (transient network) and `AuthApiError` (server rejection).
 - **New `client.auth.dispose()`.** Tears down the auto-refresh interval, the `visibilitychange` listener, the `BroadcastChannel`, and registered `onAuthStateChange` subscribers. Idempotent. Designed for React Strict Mode and HMR cleanup hooks. In-flight `fetch` calls are not aborted — they run to completion.
 - **`lock` and `lockAcquireTimeout` options.** Accepted and honored when supplied (legacy opt-in path); both are `@deprecated` and will be removed in v3.
 
@@ -39,7 +39,7 @@ useEffect(() => {
 
 ### `AuthRefreshDiscardedError`
 
-Returned from `refreshSession()` / `getSession()` when the commit guard discards a successfully-rotated session.
+Returned from `refreshSession()` / `setSession()` when the commit guard discards a successfully-rotated session. `getSession()` returns it only when storage was cleared mid-flight (concurrent `signOut`); when another tab's refresh replaced storage, `getSession()` hands back that session instead.
 
 ```ts
 import { isAuthRefreshDiscardedError } from '@supabase/auth-js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/auth-js",
-  "version": "2.117.0",
+  "version": "2.117.1",
   "private": false,
   "description": "Official SDK for Supabase Auth",
   "keywords": [

package/src/GoTrueClient.ts

@@ -3075,60 +3075,36 @@ export default class GoTrueClient {
       )
 
       if (!hasExpired) {
-        if (this.userStorage) {
-          const maybeUser: { user?: User | null } | null = (await getItemAsync(
-            this.userStorage,
-            this.storageKey + '-user'
-          )) as any
-
-          if (maybeUser?.user) {
-            currentSession.user = maybeUser.user
-          } else {
-            currentSession.user = userNotAvailableProxy()
-          }
-        }
-
-        // Wrap the user object with a warning proxy on the server
-        // This warns when properties of the user are accessed, not when session.user itself is accessed
-        if (
-          this.storage.isServer &&
-          currentSession.user &&
-          !(currentSession.user as any).__isUserNotAvailableProxy
-        ) {
-          const suppressWarningRef = { value: this.suppressGetSessionWarning }
-          currentSession.user = insecureUserWarningProxy(currentSession.user, suppressWarningRef)
-
-          // Update the client-level suppression flag when the proxy suppresses the warning
-          if (suppressWarningRef.value) {
-            this.suppressGetSessionWarning = true
-          }
-        }
-
-        return { data: { session: currentSession }, error: null }
+        return { data: { session: await this._hydrateSessionUser(currentSession) }, error: null }
       }
 
       const { data: session, error } = await this._callRefreshToken(currentSession.refresh_token)
       if (error) {
-        // Proactive-preserve mirror: `_callRefreshToken` keeps the session
-        // in storage when refresh fails non-retryably but the access token
-        // is still inside its real expiry window. Hand the caller the
-        // still-valid session instead of translating the refresh error
-        // into `session: null`. If the access token has actually expired,
-        // the session is genuinely dead and the error stands. Explicit
-        // refresh entry points (`refreshSession`, `setSession`)
-        // intentionally bypass this fallback — they want to know the
-        // refresh failed.
-        const accessTokenStillValid = !!(
-          currentSession.expires_at && currentSession.expires_at * 1000 > Date.now()
-        )
-        if (accessTokenStillValid) {
-          // Race guard: a concurrent `signOut` may have cleared storage
-          // during the refresh attempt. Don't hand back a session that no
-          // longer exists on disk.
-          const stillStored = (await getItemAsync(this.storage, this.storageKey)) as Session | null
-          if (stillStored && stillStored.refresh_token === currentSession.refresh_token) {
-            return this._returnResult({ data: { session: currentSession }, error: null })
-          }
+        // A failed refresh does not mean there is no session. Storage is the
+        // source of truth at this point, because either:
+        //  - `_callRefreshToken` kept the original session in storage since
+        //    the access token is still inside its real expiry window (a
+        //    proactive refresh that failed non-retryably), or
+        //  - another caller, in this tab or a different one, committed its
+        //    own rotated session while this refresh was in flight, so this
+        //    one was discarded by the commit guard or rejected by the server
+        //    as already used.
+        // Empty storage (concurrent `signOut`) or an expired stored session
+        // means the session is genuinely gone and the error stands. Callers
+        // that pass an explicit token (`setSession`,
+        // `refreshSession({ refresh_token })`) call `_callRefreshToken`
+        // directly and surface the failure instead.
+        const stored = (await getItemAsync(this.storage, this.storageKey)) as Session | null
+        if (
+          stored &&
+          this._isValidSession(stored) &&
+          stored.expires_at &&
+          stored.expires_at * 1000 > Date.now()
+        ) {
+          return this._returnResult({
+            data: { session: await this._hydrateSessionUser(stored) },
+            error: null,
+          })
         }
         return this._returnResult({ data: { session: null }, error })
       }
@@ -3139,6 +3115,35 @@ export default class GoTrueClient {
     }
   }
 
+  /**
+   * Completes a session read back from storage so it matches what callers of
+   * `getSession()` expect: fills in `session.user` from `userStorage` when the
+   * client keeps the user in split storage, and wraps the user in the
+   * insecure-access warning proxy on the server.
+   */
+  private async _hydrateSessionUser(session: Session): Promise<Session> {
+    if (this.userStorage) {
+      const maybeUser: { user?: User | null } | null = (await getItemAsync(
+        this.userStorage,
+        this.storageKey + '-user'
+      )) as any
+
+      session.user = maybeUser?.user ? maybeUser.user : userNotAvailableProxy()
+    }
+
+    // Warns when properties of the user are accessed, not when session.user itself is accessed.
+    if (this.storage.isServer && session.user && !(session.user as any).__isUserNotAvailableProxy) {
+      const suppressWarningRef = { value: this.suppressGetSessionWarning }
+      session.user = insecureUserWarningProxy(session.user, suppressWarningRef)
+
+      if (suppressWarningRef.value) {
+        this.suppressGetSessionWarning = true
+      }
+    }
+
+    return session
+  }
+
   /**
    * Gets the current user details if there is an existing session. This method
    * performs a network request to the Supabase Auth server, so the returned

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.117.0'
+export const version = '2.117.1'