@supabase/auth-js 2.80.1-canary.1 → 2.80.1-canary.3

package/dist/module/GoTrueClient.js

@@ -2,7 +2,7 @@ import GoTrueAdminApi from './GoTrueAdminApi';
 import { AUTO_REFRESH_TICK_DURATION_MS, AUTO_REFRESH_TICK_THRESHOLD, DEFAULT_HEADERS, EXPIRY_MARGIN_MS, GOTRUE_URL, JWKS_TTL, STORAGE_KEY, } from './lib/constants';
 import { AuthImplicitGrantRedirectError, AuthInvalidCredentialsError, AuthInvalidJwtError, AuthInvalidTokenResponseError, AuthPKCEGrantCodeExchangeError, AuthSessionMissingError, AuthUnknownError, isAuthApiError, isAuthError, isAuthImplicitGrantRedirectError, isAuthRetryableFetchError, isAuthSessionMissingError, } from './lib/errors';
 import { _request, _sessionResponse, _sessionResponsePassword, _ssoResponse, _userResponse, } from './lib/fetch';
-import { decodeJWT, deepClone, Deferred, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, isBrowser, parseParametersFromURL, removeItemAsync, resolveFetch, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, uuid, validateExp, } from './lib/helpers';
+import { decodeJWT, deepClone, Deferred, getAlgorithm, getCodeChallengeAndMethod, getItemAsync, insecureUserWarningProxy, isBrowser, parseParametersFromURL, removeItemAsync, resolveFetch, retryable, setItemAsync, sleep, supportsLocalStorage, userNotAvailableProxy, uuid, validateExp, } from './lib/helpers';
 import { memoryLocalStorageAdapter } from './lib/local-storage';
 import { LockAcquireTimeoutError, navigatorLock } from './lib/locks';
 import { polyfillGlobalThis } from './lib/polyfills';
@@ -21,6 +21,7 @@ const DEFAULT_OPTIONS = {
     flowType: 'implicit',
     debug: false,
     hasCustomAuthorizationHeader: false,
+    throwOnError: false,
 };
 async function lockNoOp(name, acquireTimeout, fn) {
     return await fn();
@@ -56,7 +57,7 @@ class GoTrueClient {
      * Create a new client for use in the browser.
      */
     constructor(options) {
-        var _a, _b;
+        var _a, _b, _c;
         /**
          * @experimental
          */
@@ -83,18 +84,22 @@ class GoTrueClient {
          */
         this.broadcastChannel = null;
         this.logger = console.log;
-        this.instanceID = GoTrueClient.nextInstanceID;
-        GoTrueClient.nextInstanceID += 1;
-        if (this.instanceID > 0 && isBrowser()) {
-            console.warn('Multiple GoTrueClient instances detected in the same browser context. It is not an error, but this should be avoided as it may produce undefined behavior when used concurrently under the same storage key.');
-        }
         const settings = Object.assign(Object.assign({}, DEFAULT_OPTIONS), options);
+        this.storageKey = settings.storageKey;
+        this.instanceID = (_a = GoTrueClient.nextInstanceID[this.storageKey]) !== null && _a !== void 0 ? _a : 0;
+        GoTrueClient.nextInstanceID[this.storageKey] = this.instanceID + 1;
         this.logDebugMessages = !!settings.debug;
         if (typeof settings.debug === 'function') {
             this.logger = settings.debug;
         }
+        if (this.instanceID > 0 && isBrowser()) {
+            const message = `${this._logPrefix()} Multiple GoTrueClient instances detected in the same browser context. It is not an error, but this should be avoided as it may produce undefined behavior when used concurrently under the same storage key.`;
+            console.warn(message);
+            if (this.logDebugMessages) {
+                console.trace(message);
+            }
+        }
         this.persistSession = settings.persistSession;
-        this.storageKey = settings.storageKey;
         this.autoRefreshToken = settings.autoRefreshToken;
         this.admin = new GoTrueAdminApi({
             url: settings.url,
@@ -108,10 +113,11 @@ class GoTrueClient {
         this.detectSessionInUrl = settings.detectSessionInUrl;
         this.flowType = settings.flowType;
         this.hasCustomAuthorizationHeader = settings.hasCustomAuthorizationHeader;
+        this.throwOnError = settings.throwOnError;
         if (settings.lock) {
             this.lock = settings.lock;
         }
-        else if (isBrowser() && ((_a = globalThis === null || globalThis === void 0 ? void 0 : globalThis.navigator) === null || _a === void 0 ? void 0 : _a.locks)) {
+        else if (isBrowser() && ((_b = globalThis === null || globalThis === void 0 ? void 0 : globalThis.navigator) === null || _b === void 0 ? void 0 : _b.locks)) {
             this.lock = navigatorLock;
         }
         else {
@@ -131,6 +137,11 @@ class GoTrueClient {
             getAuthenticatorAssuranceLevel: this._getAuthenticatorAssuranceLevel.bind(this),
             webauthn: new WebAuthnApi(this),
         };
+        this.oauth = {
+            getAuthorizationDetails: this._getAuthorizationDetails.bind(this),
+            approveAuthorization: this._approveAuthorization.bind(this),
+            denyAuthorization: this._denyAuthorization.bind(this),
+        };
         if (this.persistSession) {
             if (settings.storage) {
                 this.storage = settings.storage;
@@ -159,16 +170,37 @@ class GoTrueClient {
             catch (e) {
                 console.error('Failed to create a new BroadcastChannel, multi-tab state changes will not be available', e);
             }
-            (_b = this.broadcastChannel) === null || _b === void 0 ? void 0 : _b.addEventListener('message', async (event) => {
+            (_c = this.broadcastChannel) === null || _c === void 0 ? void 0 : _c.addEventListener('message', async (event) => {
                 this._debug('received broadcast notification from other tab or client', event);
                 await this._notifyAllSubscribers(event.data.event, event.data.session, false); // broadcast = false so we don't get an endless loop of messages
             });
         }
         this.initialize();
     }
+    /**
+     * Returns whether error throwing mode is enabled for this client.
+     */
+    isThrowOnErrorEnabled() {
+        return this.throwOnError;
+    }
+    /**
+     * Centralizes return handling with optional error throwing. When `throwOnError` is enabled
+     * and the provided result contains a non-nullish error, the error is thrown instead of
+     * being returned. This ensures consistent behavior across all public API methods.
+     */
+    _returnResult(result) {
+        if (this.throwOnError && result && result.error) {
+            throw result.error;
+        }
+        return result;
+    }
+    _logPrefix() {
+        return ('GoTrueClient@' +
+            `${this.storageKey}:${this.instanceID} (${version}) ${new Date().toISOString()}`);
+    }
     _debug(...args) {
         if (this.logDebugMessages) {
-            this.logger(`GoTrueClient@${this.instanceID} (${version}) ${new Date().toISOString()}`, ...args);
+            this.logger(this._logPrefix(), ...args);
         }
         return this;
     }
@@ -197,13 +229,16 @@ class GoTrueClient {
     async _initialize() {
         var _a;
         try {
-            const params = parseParametersFromURL(window.location.href);
+            let params = {};
             let callbackUrlType = 'none';
-            if (this._isImplicitGrantCallback(params)) {
-                callbackUrlType = 'implicit';
-            }
-            else if (await this._isPKCECallback(params)) {
-                callbackUrlType = 'pkce';
+            if (isBrowser()) {
+                params = parseParametersFromURL(window.location.href);
+                if (this._isImplicitGrantCallback(params)) {
+                    callbackUrlType = 'implicit';
+                }
+                else if (await this._isPKCECallback(params)) {
+                    callbackUrlType = 'pkce';
+                }
             }
             /**
              * Attempt to get the session from the URL only if these conditions are fulfilled
@@ -247,11 +282,11 @@ class GoTrueClient {
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { error };
+                return this._returnResult({ error });
             }
-            return {
+            return this._returnResult({
                 error: new AuthUnknownError('Unexpected error during initialization', error),
-            };
+            });
         }
         finally {
             await this._handleVisibilityChange();
@@ -276,7 +311,7 @@ class GoTrueClient {
             });
             const { data, error } = res;
             if (error || !data) {
-                return { data: { user: null, session: null }, error: error };
+                return this._returnResult({ data: { user: null, session: null }, error: error });
             }
             const session = data.session;
             const user = data.user;
@@ -284,11 +319,11 @@ class GoTrueClient {
                 await this._saveSession(data.session);
                 await this._notifyAllSubscribers('SIGNED_IN', session);
             }
-            return { data: { user, session }, error: null };
+            return this._returnResult({ data: { user, session }, error: null });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -348,7 +383,7 @@ class GoTrueClient {
             }
             const { data, error } = res;
             if (error || !data) {
-                return { data: { user: null, session: null }, error: error };
+                return this._returnResult({ data: { user: null, session: null }, error: error });
             }
             const session = data.session;
             const user = data.user;
@@ -356,11 +391,11 @@ class GoTrueClient {
                 await this._saveSession(data.session);
                 await this._notifyAllSubscribers('SIGNED_IN', session);
             }
-            return { data: { user, session }, error: null };
+            return this._returnResult({ data: { user, session }, error: null });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -405,23 +440,24 @@ class GoTrueClient {
             }
             const { data, error } = res;
             if (error) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             else if (!data || !data.session || !data.user) {
-                return { data: { user: null, session: null }, error: new AuthInvalidTokenResponseError() };
+                const invalidTokenError = new AuthInvalidTokenResponseError();
+                return this._returnResult({ data: { user: null, session: null }, error: invalidTokenError });
             }
             if (data.session) {
                 await this._saveSession(data.session);
                 await this._notifyAllSubscribers('SIGNED_IN', data.session);
             }
-            return {
+            return this._returnResult({
                 data: Object.assign({ user: data.user, session: data.session }, (data.weak_password ? { weakPassword: data.weak_password } : null)),
                 error,
-            };
+            });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -553,20 +589,18 @@ class GoTrueClient {
                 throw error;
             }
             if (!data || !data.session || !data.user) {
-                return {
-                    data: { user: null, session: null },
-                    error: new AuthInvalidTokenResponseError(),
-                };
+                const invalidTokenError = new AuthInvalidTokenResponseError();
+                return this._returnResult({ data: { user: null, session: null }, error: invalidTokenError });
             }
             if (data.session) {
                 await this._saveSession(data.session);
                 await this._notifyAllSubscribers('SIGNED_IN', data.session);
             }
-            return { data: Object.assign({}, data), error };
+            return this._returnResult({ data: Object.assign({}, data), error });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -693,20 +727,18 @@ class GoTrueClient {
                 throw error;
             }
             if (!data || !data.session || !data.user) {
-                return {
-                    data: { user: null, session: null },
-                    error: new AuthInvalidTokenResponseError(),
-                };
+                const invalidTokenError = new AuthInvalidTokenResponseError();
+                return this._returnResult({ data: { user: null, session: null }, error: invalidTokenError });
             }
             if (data.session) {
                 await this._saveSession(data.session);
                 await this._notifyAllSubscribers('SIGNED_IN', data.session);
             }
-            return { data: Object.assign({}, data), error };
+            return this._returnResult({ data: Object.assign({}, data), error });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -728,20 +760,24 @@ class GoTrueClient {
                 throw error;
             }
             if (!data || !data.session || !data.user) {
-                return {
+                const invalidTokenError = new AuthInvalidTokenResponseError();
+                return this._returnResult({
                     data: { user: null, session: null, redirectType: null },
-                    error: new AuthInvalidTokenResponseError(),
-                };
+                    error: invalidTokenError,
+                });
             }
             if (data.session) {
                 await this._saveSession(data.session);
                 await this._notifyAllSubscribers('SIGNED_IN', data.session);
             }
-            return { data: Object.assign(Object.assign({}, data), { redirectType: redirectType !== null && redirectType !== void 0 ? redirectType : null }), error };
+            return this._returnResult({ data: Object.assign(Object.assign({}, data), { redirectType: redirectType !== null && redirectType !== void 0 ? redirectType : null }), error });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null, redirectType: null }, error };
+                return this._returnResult({
+                    data: { user: null, session: null, redirectType: null },
+                    error,
+                });
             }
             throw error;
         }
@@ -766,23 +802,21 @@ class GoTrueClient {
             });
             const { data, error } = res;
             if (error) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             else if (!data || !data.session || !data.user) {
-                return {
-                    data: { user: null, session: null },
-                    error: new AuthInvalidTokenResponseError(),
-                };
+                const invalidTokenError = new AuthInvalidTokenResponseError();
+                return this._returnResult({ data: { user: null, session: null }, error: invalidTokenError });
             }
             if (data.session) {
                 await this._saveSession(data.session);
                 await this._notifyAllSubscribers('SIGNED_IN', data.session);
             }
-            return { data, error };
+            return this._returnResult({ data, error });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -827,7 +861,7 @@ class GoTrueClient {
                     },
                     redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
                 });
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             if ('phone' in credentials) {
                 const { phone, options } = credentials;
@@ -841,13 +875,16 @@ class GoTrueClient {
                         channel: (_e = options === null || options === void 0 ? void 0 : options.channel) !== null && _e !== void 0 ? _e : 'sms',
                     },
                 });
-                return { data: { user: null, session: null, messageId: data === null || data === void 0 ? void 0 : data.message_id }, error };
+                return this._returnResult({
+                    data: { user: null, session: null, messageId: data === null || data === void 0 ? void 0 : data.message_id },
+                    error,
+                });
             }
             throw new AuthInvalidCredentialsError('You must provide either an email or phone number.');
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -874,7 +911,8 @@ class GoTrueClient {
                 throw error;
             }
             if (!data) {
-                throw new Error('An error occurred on token verification.');
+                const tokenVerificationError = new Error('An error occurred on token verification.');
+                throw tokenVerificationError;
             }
             const session = data.session;
             const user = data.user;
@@ -882,11 +920,11 @@ class GoTrueClient {
                 await this._saveSession(session);
                 await this._notifyAllSubscribers(params.type == 'recovery' ? 'PASSWORD_RECOVERY' : 'SIGNED_IN', session);
             }
-            return { data: { user, session }, error: null };
+            return this._returnResult({ data: { user, session }, error: null });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -914,17 +952,18 @@ class GoTrueClient {
                 ;
                 [codeChallenge, codeChallengeMethod] = await getCodeChallengeAndMethod(this.storage, this.storageKey);
             }
-            return await _request(this.fetch, 'POST', `${this.url}/sso`, {
+            const result = await _request(this.fetch, 'POST', `${this.url}/sso`, {
                 body: Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({}, ('providerId' in params ? { provider_id: params.providerId } : null)), ('domain' in params ? { domain: params.domain } : null)), { redirect_to: (_b = (_a = params.options) === null || _a === void 0 ? void 0 : _a.redirectTo) !== null && _b !== void 0 ? _b : undefined }), (((_c = params === null || params === void 0 ? void 0 : params.options) === null || _c === void 0 ? void 0 : _c.captchaToken)
                     ? { gotrue_meta_security: { captcha_token: params.options.captchaToken } }
                     : null)), { skip_http_redirect: true, code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod }),
                 headers: this.headers,
                 xform: _ssoResponse,
             });
+            return this._returnResult(result);
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: null, error };
+                return this._returnResult({ data: null, error });
             }
             throw error;
         }
@@ -951,12 +990,12 @@ class GoTrueClient {
                     headers: this.headers,
                     jwt: session.access_token,
                 });
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -978,7 +1017,7 @@ class GoTrueClient {
                     },
                     redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
                 });
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             else if ('phone' in credentials) {
                 const { phone, type, options } = credentials;
@@ -990,13 +1029,16 @@ class GoTrueClient {
                         gotrue_meta_security: { captcha_token: options === null || options === void 0 ? void 0 : options.captchaToken },
                     },
                 });
-                return { data: { user: null, session: null, messageId: data === null || data === void 0 ? void 0 : data.message_id }, error };
+                return this._returnResult({
+                    data: { user: null, session: null, messageId: data === null || data === void 0 ? void 0 : data.message_id },
+                    error,
+                });
             }
             throw new AuthInvalidCredentialsError('You must provide either an email or phone number and a type');
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -1139,28 +1181,25 @@ class GoTrueClient {
                         currentSession.user = userNotAvailableProxy();
                     }
                 }
-                if (this.storage.isServer && currentSession.user) {
-                    let suppressWarning = this.suppressGetSessionWarning;
-                    const proxySession = new Proxy(currentSession, {
-                        get: (target, prop, receiver) => {
-                            if (!suppressWarning && prop === 'user') {
-                                // only show warning when the user object is being accessed from the server
-                                console.warn('Using the user object as returned from supabase.auth.getSession() or from some supabase.auth.onAuthStateChange() events could be insecure! This value comes directly from the storage medium (usually cookies on the server) and may not be authentic. Use supabase.auth.getUser() instead which authenticates the data by contacting the Supabase Auth server.');
-                                suppressWarning = true; // keeps this proxy instance from logging additional warnings
-                                this.suppressGetSessionWarning = true; // keeps this client's future proxy instances from warning
-                            }
-                            return Reflect.get(target, prop, receiver);
-                        },
-                    });
-                    currentSession = proxySession;
+                // Wrap the user object with a warning proxy on the server
+                // This warns when properties of the user are accessed, not when session.user itself is accessed
+                if (this.storage.isServer &&
+                    currentSession.user &&
+                    !currentSession.user.__isUserNotAvailableProxy) {
+                    const suppressWarningRef = { value: this.suppressGetSessionWarning };
+                    currentSession.user = insecureUserWarningProxy(currentSession.user, suppressWarningRef);
+                    // Update the client-level suppression flag when the proxy suppresses the warning
+                    if (suppressWarningRef.value) {
+                        this.suppressGetSessionWarning = true;
+                    }
                 }
                 return { data: { session: currentSession }, error: null };
             }
             const { data: session, error } = await this._callRefreshToken(currentSession.refresh_token);
             if (error) {
-                return { data: { session: null }, error };
+                return this._returnResult({ data: { session: null }, error });
             }
-            return { data: { session }, error: null };
+            return this._returnResult({ data: { session }, error: null });
         }
         finally {
             this._debug('#__loadSession()', 'end');
@@ -1217,7 +1256,7 @@ class GoTrueClient {
                     await this._removeSession();
                     await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
                 }
-                return { data: { user: null }, error };
+                return this._returnResult({ data: { user: null }, error });
             }
             throw error;
         }
@@ -1255,17 +1294,18 @@ class GoTrueClient {
                     jwt: session.access_token,
                     xform: _userResponse,
                 });
-                if (userError)
+                if (userError) {
                     throw userError;
+                }
                 session.user = data.user;
                 await this._saveSession(session);
                 await this._notifyAllSubscribers('USER_UPDATED', session);
-                return { data: { user: session.user }, error: null };
+                return this._returnResult({ data: { user: session.user }, error: null });
             });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null }, error };
+                return this._returnResult({ data: { user: null }, error });
             }
             throw error;
         }
@@ -1298,7 +1338,7 @@ class GoTrueClient {
             if (hasExpired) {
                 const { data: refreshedSession, error } = await this._callRefreshToken(currentSession.refresh_token);
                 if (error) {
-                    return { data: { user: null, session: null }, error: error };
+                    return this._returnResult({ data: { user: null, session: null }, error: error });
                 }
                 if (!refreshedSession) {
                     return { data: { user: null, session: null }, error: null };
@@ -1321,11 +1361,11 @@ class GoTrueClient {
                 await this._saveSession(session);
                 await this._notifyAllSubscribers('SIGNED_IN', session);
             }
-            return { data: { user: session.user, session }, error: null };
+            return this._returnResult({ data: { user: session.user, session }, error: null });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { session: null, user: null }, error };
+                return this._returnResult({ data: { session: null, user: null }, error });
             }
             throw error;
         }
@@ -1358,17 +1398,17 @@ class GoTrueClient {
                 }
                 const { data: session, error } = await this._callRefreshToken(currentSession.refresh_token);
                 if (error) {
-                    return { data: { user: null, session: null }, error: error };
+                    return this._returnResult({ data: { user: null, session: null }, error: error });
                 }
                 if (!session) {
-                    return { data: { user: null, session: null }, error: null };
+                    return this._returnResult({ data: { user: null, session: null }, error: null });
                 }
-                return { data: { user: session.user, session }, error: null };
+                return this._returnResult({ data: { user: session.user, session }, error: null });
             });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { user: null, session: null }, error };
+                return this._returnResult({ data: { user: null, session: null }, error });
             }
             throw error;
         }
@@ -1454,11 +1494,11 @@ class GoTrueClient {
             // Remove tokens from URL
             window.location.hash = '';
             this._debug('#_getSessionFromURL()', 'clearing window.location.hash');
-            return { data: { session, redirectType: params.type }, error: null };
+            return this._returnResult({ data: { session, redirectType: params.type }, error: null });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { session: null, redirectType: null }, error };
+                return this._returnResult({ data: { session: null, redirectType: null }, error });
             }
             throw error;
         }
@@ -1495,7 +1535,7 @@ class GoTrueClient {
             var _a;
             const { data, error: sessionError } = result;
             if (sessionError) {
-                return { error: sessionError };
+                return this._returnResult({ error: sessionError });
             }
             const accessToken = (_a = data.session) === null || _a === void 0 ? void 0 : _a.access_token;
             if (accessToken) {
@@ -1505,7 +1545,7 @@ class GoTrueClient {
                     // ignore 401s since an invalid or expired JWT should sign out the current session
                     if (!(isAuthApiError(error) &&
                         (error.status === 404 || error.status === 401 || error.status === 403))) {
-                        return { error };
+                        return this._returnResult({ error });
                     }
                 }
             }
@@ -1513,13 +1553,9 @@ class GoTrueClient {
                 await this._removeSession();
                 await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
             }
-            return { error: null };
+            return this._returnResult({ error: null });
         });
     }
-    /**
-     * Receive a notification every time an auth event happens.
-     * @param callback A callback function to be invoked when an auth event happens.
-     */
     onAuthStateChange(callback) {
         const id = uuid();
         const subscription = {
@@ -1586,7 +1622,7 @@ class GoTrueClient {
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: null, error };
+                return this._returnResult({ data: null, error });
             }
             throw error;
         }
@@ -1600,11 +1636,11 @@ class GoTrueClient {
             const { data, error } = await this.getUser();
             if (error)
                 throw error;
-            return { data: { identities: (_a = data.user.identities) !== null && _a !== void 0 ? _a : [] }, error: null };
+            return this._returnResult({ data: { identities: (_a = data.user.identities) !== null && _a !== void 0 ? _a : [] }, error: null });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: null, error };
+                return this._returnResult({ data: null, error });
             }
             throw error;
         }
@@ -1639,11 +1675,14 @@ class GoTrueClient {
             if (isBrowser() && !((_a = credentials.options) === null || _a === void 0 ? void 0 : _a.skipBrowserRedirect)) {
                 window.location.assign(data === null || data === void 0 ? void 0 : data.url);
             }
-            return { data: { provider: credentials.provider, url: data === null || data === void 0 ? void 0 : data.url }, error: null };
+            return this._returnResult({
+                data: { provider: credentials.provider, url: data === null || data === void 0 ? void 0 : data.url },
+                error: null,
+            });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: { provider: credentials.provider, url: null }, error };
+                return this._returnResult({ data: { provider: credentials.provider, url: null }, error });
             }
             throw error;
         }
@@ -1671,23 +1710,23 @@ class GoTrueClient {
                 });
                 const { data, error } = res;
                 if (error) {
-                    return { data: { user: null, session: null }, error };
+                    return this._returnResult({ data: { user: null, session: null }, error });
                 }
                 else if (!data || !data.session || !data.user) {
-                    return {
+                    return this._returnResult({
                         data: { user: null, session: null },
                         error: new AuthInvalidTokenResponseError(),
-                    };
+                    });
                 }
                 if (data.session) {
                     await this._saveSession(data.session);
                     await this._notifyAllSubscribers('USER_UPDATED', data.session);
                 }
-                return { data, error };
+                return this._returnResult({ data, error });
             }
             catch (error) {
                 if (isAuthError(error)) {
-                    return { data: { user: null, session: null }, error };
+                    return this._returnResult({ data: { user: null, session: null }, error });
                 }
                 throw error;
             }
@@ -1712,7 +1751,7 @@ class GoTrueClient {
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: null, error };
+                return this._returnResult({ data: null, error });
             }
             throw error;
         }
@@ -1748,7 +1787,7 @@ class GoTrueClient {
         catch (error) {
             this._debug(debugName, 'error', error);
             if (isAuthError(error)) {
-                return { data: { session: null, user: null }, error };
+                return this._returnResult({ data: { session: null, user: null }, error });
             }
             throw error;
         }
@@ -2233,7 +2272,7 @@ class GoTrueClient {
                 var _a;
                 const { data: sessionData, error: sessionError } = result;
                 if (sessionError) {
-                    return { data: null, error: sessionError };
+                    return this._returnResult({ data: null, error: sessionError });
                 }
                 return await _request(this.fetch, 'DELETE', `${this.url}/factors/${params.factorId}`, {
                     headers: this.headers,
@@ -2243,7 +2282,7 @@ class GoTrueClient {
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: null, error };
+                return this._returnResult({ data: null, error });
             }
             throw error;
         }
@@ -2254,7 +2293,7 @@ class GoTrueClient {
                 var _a, _b;
                 const { data: sessionData, error: sessionError } = result;
                 if (sessionError) {
-                    return { data: null, error: sessionError };
+                    return this._returnResult({ data: null, error: sessionError });
                 }
                 const body = Object.assign({ friendly_name: params.friendlyName, factor_type: params.factorType }, (params.factorType === 'phone'
                     ? { phone: params.phone }
@@ -2267,17 +2306,17 @@ class GoTrueClient {
                     jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
                 }));
                 if (error) {
-                    return { data: null, error };
+                    return this._returnResult({ data: null, error });
                 }
                 if (params.factorType === 'totp' && data.type === 'totp' && ((_b = data === null || data === void 0 ? void 0 : data.totp) === null || _b === void 0 ? void 0 : _b.qr_code)) {
                     data.totp.qr_code = `data:image/svg+xml;utf-8,${data.totp.qr_code}`;
                 }
-                return { data, error: null };
+                return this._returnResult({ data, error: null });
             });
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: null, error };
+                return this._returnResult({ data: null, error });
             }
             throw error;
         }
@@ -2289,7 +2328,7 @@ class GoTrueClient {
                     var _a;
                     const { data: sessionData, error: sessionError } = result;
                     if (sessionError) {
-                        return { data: null, error: sessionError };
+                        return this._returnResult({ data: null, error: sessionError });
                     }
                     const body = Object.assign({ challenge_id: params.challengeId }, ('webauthn' in params
                         ? {
@@ -2304,16 +2343,16 @@ class GoTrueClient {
                         jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
                     });
                     if (error) {
-                        return { data: null, error };
+                        return this._returnResult({ data: null, error });
                     }
                     await this._saveSession(Object.assign({ expires_at: Math.round(Date.now() / 1000) + data.expires_in }, data));
                     await this._notifyAllSubscribers('MFA_CHALLENGE_VERIFIED', data);
-                    return { data, error };
+                    return this._returnResult({ data, error });
                 });
             }
             catch (error) {
                 if (isAuthError(error)) {
-                    return { data: null, error };
+                    return this._returnResult({ data: null, error });
                 }
                 throw error;
             }
@@ -2326,7 +2365,7 @@ class GoTrueClient {
                     var _a;
                     const { data: sessionData, error: sessionError } = result;
                     if (sessionError) {
-                        return { data: null, error: sessionError };
+                        return this._returnResult({ data: null, error: sessionError });
                     }
                     const response = (await _request(this.fetch, 'POST', `${this.url}/factors/${params.factorId}/challenge`, {
                         body: params,
@@ -2356,7 +2395,7 @@ class GoTrueClient {
             }
             catch (error) {
                 if (isAuthError(error)) {
-                    return { data: null, error };
+                    return this._returnResult({ data: null, error });
                 }
                 throw error;
             }
@@ -2372,7 +2411,7 @@ class GoTrueClient {
             factorId: params.factorId,
         });
         if (challengeError) {
-            return { data: null, error: challengeError };
+            return this._returnResult({ data: null, error: challengeError });
         }
         return await this._verify({
             factorId: params.factorId,
@@ -2413,33 +2452,133 @@ class GoTrueClient {
      * {@see GoTrueMFAApi#getAuthenticatorAssuranceLevel}
      */
     async _getAuthenticatorAssuranceLevel() {
-        return this._acquireLock(-1, async () => {
+        var _a, _b;
+        const { data: { session }, error: sessionError, } = await this.getSession();
+        if (sessionError) {
+            return this._returnResult({ data: null, error: sessionError });
+        }
+        if (!session) {
+            return {
+                data: { currentLevel: null, nextLevel: null, currentAuthenticationMethods: [] },
+                error: null,
+            };
+        }
+        const { payload } = decodeJWT(session.access_token);
+        let currentLevel = null;
+        if (payload.aal) {
+            currentLevel = payload.aal;
+        }
+        let nextLevel = currentLevel;
+        const verifiedFactors = (_b = (_a = session.user.factors) === null || _a === void 0 ? void 0 : _a.filter((factor) => factor.status === 'verified')) !== null && _b !== void 0 ? _b : [];
+        if (verifiedFactors.length > 0) {
+            nextLevel = 'aal2';
+        }
+        const currentAuthenticationMethods = payload.amr || [];
+        return { data: { currentLevel, nextLevel, currentAuthenticationMethods }, error: null };
+    }
+    /**
+     * Retrieves details about an OAuth authorization request.
+     * Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
+     *
+     * Returns authorization details including client info, scopes, and user information.
+     * If the API returns a redirect_uri, it means consent was already given - the caller
+     * should handle the redirect manually if needed.
+     */
+    async _getAuthorizationDetails(authorizationId) {
+        try {
             return await this._useSession(async (result) => {
-                var _a, _b;
                 const { data: { session }, error: sessionError, } = result;
                 if (sessionError) {
-                    return { data: null, error: sessionError };
+                    return this._returnResult({ data: null, error: sessionError });
                 }
                 if (!session) {
-                    return {
-                        data: { currentLevel: null, nextLevel: null, currentAuthenticationMethods: [] },
-                        error: null,
-                    };
-                }
-                const { payload } = decodeJWT(session.access_token);
-                let currentLevel = null;
-                if (payload.aal) {
-                    currentLevel = payload.aal;
-                }
-                let nextLevel = currentLevel;
-                const verifiedFactors = (_b = (_a = session.user.factors) === null || _a === void 0 ? void 0 : _a.filter((factor) => factor.status === 'verified')) !== null && _b !== void 0 ? _b : [];
-                if (verifiedFactors.length > 0) {
-                    nextLevel = 'aal2';
-                }
-                const currentAuthenticationMethods = payload.amr || [];
-                return { data: { currentLevel, nextLevel, currentAuthenticationMethods }, error: null };
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                return await _request(this.fetch, 'GET', `${this.url}/oauth/authorizations/${authorizationId}`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    xform: (data) => ({ data, error: null }),
+                });
             });
-        });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Approves an OAuth authorization request.
+     * Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
+     */
+    async _approveAuthorization(authorizationId, options) {
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const response = await _request(this.fetch, 'POST', `${this.url}/oauth/authorizations/${authorizationId}/consent`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    body: { action: 'approve' },
+                    xform: (data) => ({ data, error: null }),
+                });
+                if (response.data && response.data.redirect_url) {
+                    // Automatically redirect in browser unless skipBrowserRedirect is true
+                    if (isBrowser() && !(options === null || options === void 0 ? void 0 : options.skipBrowserRedirect)) {
+                        window.location.assign(response.data.redirect_url);
+                    }
+                }
+                return response;
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Denies an OAuth authorization request.
+     * Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
+     */
+    async _denyAuthorization(authorizationId, options) {
+        try {
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError) {
+                    return this._returnResult({ data: null, error: sessionError });
+                }
+                if (!session) {
+                    return this._returnResult({ data: null, error: new AuthSessionMissingError() });
+                }
+                const response = await _request(this.fetch, 'POST', `${this.url}/oauth/authorizations/${authorizationId}/consent`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                    body: { action: 'deny' },
+                    xform: (data) => ({ data, error: null }),
+                });
+                if (response.data && response.data.redirect_url) {
+                    // Automatically redirect in browser unless skipBrowserRedirect is true
+                    if (isBrowser() && !(options === null || options === void 0 ? void 0 : options.skipBrowserRedirect)) {
+                        window.location.assign(response.data.redirect_url);
+                    }
+                }
+                return response;
+            });
+        }
+        catch (error) {
+            if (isAuthError(error)) {
+                return this._returnResult({ data: null, error });
+            }
+            throw error;
+        }
     }
     async fetchJwk(kid, jwks = { keys: [] }) {
         // try fetching from the supplied jwks
@@ -2495,7 +2634,7 @@ class GoTrueClient {
             if (!token) {
                 const { data, error } = await this.getSession();
                 if (error || !data.session) {
-                    return { data: null, error };
+                    return this._returnResult({ data: null, error });
                 }
                 token = data.session.access_token;
             }
@@ -2548,12 +2687,12 @@ class GoTrueClient {
         }
         catch (error) {
             if (isAuthError(error)) {
-                return { data: null, error };
+                return this._returnResult({ data: null, error });
             }
             throw error;
         }
     }
 }
-GoTrueClient.nextInstanceID = 0;
+GoTrueClient.nextInstanceID = {};
 export default GoTrueClient;
 //# sourceMappingURL=GoTrueClient.js.map