@supabase/gotrue-js 2.40.0 → 2.41.0

package/dist/module/GoTrueClient.js

@@ -2,7 +2,7 @@ import GoTrueAdminApi from './GoTrueAdminApi';
 import { DEFAULT_HEADERS, EXPIRY_MARGIN, GOTRUE_URL, STORAGE_KEY } from './lib/constants';
 import { AuthImplicitGrantRedirectError, AuthPKCEGrantCodeExchangeError, AuthInvalidCredentialsError, AuthSessionMissingError, AuthInvalidTokenResponseError, AuthUnknownError, isAuthApiError, isAuthError, isAuthRetryableFetchError, } from './lib/errors';
 import { _request, _sessionResponse, _userResponse, _ssoResponse } from './lib/fetch';
-import { decodeJWTPayload, Deferred, getItemAsync, getParameterByName, isBrowser, removeItemAsync, resolveFetch, setItemAsync, uuid, retryable, sleep, generatePKCEVerifier, generatePKCEChallenge, supportsLocalStorage, } from './lib/helpers';
+import { decodeJWTPayload, Deferred, getItemAsync, getParameterByName, isBrowser, removeItemAsync, resolveFetch, setItemAsync, uuid, retryable, sleep, generatePKCEVerifier, generatePKCEChallenge, supportsLocalStorage, stackGuard, isInStackGuard, } from './lib/helpers';
 import localStorageAdapter from './lib/local-storage';
 import { polyfillGlobalThis } from './lib/polyfills';
 polyfillGlobalThis(); // Make "globalThis" available
@@ -133,7 +133,6 @@ export default class GoTrueClient {
                 }
                 const { session, redirectType } = data;
                 this._debug('#_initialize()', 'detected session in URL', session, 'redirect type', redirectType);
-                await this._saveSession(session);
                 setTimeout(async () => {
                     if (redirectType === 'recovery') {
                         await this._notifyAllSubscribers('PASSWORD_RECOVERY', session);
@@ -521,16 +520,18 @@ export default class GoTrueClient {
      */
     async reauthenticate() {
         try {
-            const { data: { session }, error: sessionError, } = await this.getSession();
-            if (sessionError)
-                throw sessionError;
-            if (!session)
-                throw new AuthSessionMissingError();
-            const { error } = await _request(this.fetch, 'GET', `${this.url}/reauthenticate`, {
-                headers: this.headers,
-                jwt: session.access_token,
+            return await this._useSession(async (result) => {
+                const { data: { session }, error: sessionError, } = result;
+                if (sessionError)
+                    throw sessionError;
+                if (!session)
+                    throw new AuthSessionMissingError();
+                const { error } = await _request(this.fetch, 'GET', `${this.url}/reauthenticate`, {
+                    headers: this.headers,
+                    jwt: session.access_token,
+                });
+                return { data: { user: null, session: null }, error };
             });
-            return { data: { user: null, session: null }, error };
         }
         catch (error) {
             if (isAuthError(error)) {
@@ -587,10 +588,36 @@ export default class GoTrueClient {
      * The session returned can be null if the session is not detected which can happen in the event a user is not signed-in or has logged out.
      */
     async getSession() {
+        return this._useSession(async (result) => {
+            return result;
+        });
+    }
+    /**
+     * Use instead of {@link #getSession} inside the library. It is
+     * semantically usually what you want, as getting a session involves some
+     * processing afterwards that requires only one client operating on the
+     * session at once across multiple tabs or processes.
+     */
+    async _useSession(fn) {
+        return await stackGuard('_useSession', async () => {
+            // the use of __loadSession here is the only correct use of the function!
+            const result = await this.__loadSession();
+            return await fn(result);
+        });
+    }
+    /**
+     * NEVER USE DIRECTLY!
+     *
+     * Always use {@link #_useSession}.
+     */
+    async __loadSession() {
+        if (this.logDebugMessages && !isInStackGuard('_useSession')) {
+            throw new Error('Please use #_useSession()');
+        }
         // make sure we've read the session from the url if there is one
         // save to just await, as long we make sure _initialize() never throws
         await this.initializePromise;
-        this._debug('#getSession()', 'begin');
+        this._debug('#__loadSession()', 'begin');
         try {
             let currentSession = null;
             if (this.persistSession) {
@@ -616,7 +643,7 @@ export default class GoTrueClient {
             const hasExpired = currentSession.expires_at
                 ? currentSession.expires_at <= Date.now() / 1000
                 : false;
-            this._debug('#getSession()', `session has${hasExpired ? '' : ' not'} expired`, 'expires_at', currentSession.expires_at);
+            this._debug('#__loadSession()', `session has${hasExpired ? '' : ' not'} expired`, 'expires_at', currentSession.expires_at);
             if (!hasExpired) {
                 return { data: { session: currentSession }, error: null };
             }
@@ -627,7 +654,7 @@ export default class GoTrueClient {
             return { data: { session }, error: null };
         }
         finally {
-            this._debug('#getSession()', 'end');
+            this._debug('#__loadSession()', 'end');
         }
     }
     /**
@@ -635,20 +662,22 @@ export default class GoTrueClient {
      * @param jwt Takes in an optional access token jwt. If no jwt is provided, getUser() will attempt to get the jwt from the current session.
      */
     async getUser(jwt) {
-        var _a, _b;
         try {
-            if (!jwt) {
-                const { data, error } = await this.getSession();
-                if (error) {
-                    throw error;
+            return await this._useSession(async (result) => {
+                var _a, _b;
+                if (!jwt) {
+                    const { data, error } = result;
+                    if (error) {
+                        throw error;
+                    }
+                    // Default to Authorization header if there is no existing session
+                    jwt = (_b = (_a = data.session) === null || _a === void 0 ? void 0 : _a.access_token) !== null && _b !== void 0 ? _b : undefined;
                 }
-                // Default to Authorization header if there is no existing session
-                jwt = (_b = (_a = data.session) === null || _a === void 0 ? void 0 : _a.access_token) !== null && _b !== void 0 ? _b : undefined;
-            }
-            return await _request(this.fetch, 'GET', `${this.url}/user`, {
-                headers: this.headers,
-                jwt: jwt,
-                xform: _userResponse,
+                return await _request(this.fetch, 'GET', `${this.url}/user`, {
+                    headers: this.headers,
+                    jwt: jwt,
+                    xform: _userResponse,
+                });
             });
         }
         catch (error) {
@@ -663,27 +692,29 @@ export default class GoTrueClient {
      */
     async updateUser(attributes, options = {}) {
         try {
-            const { data: sessionData, error: sessionError } = await this.getSession();
-            if (sessionError) {
-                throw sessionError;
-            }
-            if (!sessionData.session) {
-                throw new AuthSessionMissingError();
-            }
-            const session = sessionData.session;
-            const { data, error: userError } = await _request(this.fetch, 'PUT', `${this.url}/user`, {
-                headers: this.headers,
-                redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
-                body: attributes,
-                jwt: session.access_token,
-                xform: _userResponse,
+            return await this._useSession(async (result) => {
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    throw sessionError;
+                }
+                if (!sessionData.session) {
+                    throw new AuthSessionMissingError();
+                }
+                const session = sessionData.session;
+                const { data, error: userError } = await _request(this.fetch, 'PUT', `${this.url}/user`, {
+                    headers: this.headers,
+                    redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                    body: attributes,
+                    jwt: session.access_token,
+                    xform: _userResponse,
+                });
+                if (userError)
+                    throw userError;
+                session.user = data.user;
+                await this._saveSession(session);
+                await this._notifyAllSubscribers('USER_UPDATED', session);
+                return { data: { user: session.user }, error: null };
             });
-            if (userError)
-                throw userError;
-            session.user = data.user;
-            await this._saveSession(session);
-            await this._notifyAllSubscribers('USER_UPDATED', session);
-            return { data: { user: session.user }, error: null };
         }
         catch (error) {
             if (isAuthError(error)) {
@@ -759,26 +790,28 @@ export default class GoTrueClient {
      * @param currentSession The current session. If passed in, it must contain a refresh token.
      */
     async refreshSession(currentSession) {
-        var _a;
         try {
-            if (!currentSession) {
-                const { data, error } = await this.getSession();
+            return await this._useSession(async (result) => {
+                var _a;
+                if (!currentSession) {
+                    const { data, error } = result;
+                    if (error) {
+                        throw error;
+                    }
+                    currentSession = (_a = data.session) !== null && _a !== void 0 ? _a : undefined;
+                }
+                if (!(currentSession === null || currentSession === void 0 ? void 0 : currentSession.refresh_token)) {
+                    throw new AuthSessionMissingError();
+                }
+                const { session, error } = await this._callRefreshToken(currentSession.refresh_token);
                 if (error) {
-                    throw error;
+                    return { data: { user: null, session: null }, error: error };
                 }
-                currentSession = (_a = data.session) !== null && _a !== void 0 ? _a : undefined;
-            }
-            if (!(currentSession === null || currentSession === void 0 ? void 0 : currentSession.refresh_token)) {
-                throw new AuthSessionMissingError();
-            }
-            const { session, error } = await this._callRefreshToken(currentSession.refresh_token);
-            if (error) {
-                return { data: { user: null, session: null }, error: error };
-            }
-            if (!session) {
-                return { data: { user: null, session: null }, error: null };
-            }
-            return { data: { user: session.user, session }, error: null };
+                if (!session) {
+                    return { data: { user: null, session: null }, error: null };
+                }
+                return { data: { user: session.user, session }, error: null };
+            });
         }
         catch (error) {
             if (isAuthError(error)) {
@@ -892,28 +925,30 @@ export default class GoTrueClient {
      * If using others scope, no `SIGNED_OUT` event is fired!
      */
     async signOut({ scope } = { scope: 'global' }) {
-        var _a;
-        const { data, error: sessionError } = await this.getSession();
-        if (sessionError) {
-            return { error: sessionError };
-        }
-        const accessToken = (_a = data.session) === null || _a === void 0 ? void 0 : _a.access_token;
-        if (accessToken) {
-            const { error } = await this.admin.signOut(accessToken, scope);
-            if (error) {
-                // ignore 404s since user might not exist anymore
-                // ignore 401s since an invalid or expired JWT should sign out the current session
-                if (!(isAuthApiError(error) && (error.status === 404 || error.status === 401))) {
-                    return { error };
+        return await this._useSession(async (result) => {
+            var _a;
+            const { data, error: sessionError } = result;
+            if (sessionError) {
+                return { error: sessionError };
+            }
+            const accessToken = (_a = data.session) === null || _a === void 0 ? void 0 : _a.access_token;
+            if (accessToken) {
+                const { error } = await this.admin.signOut(accessToken, scope);
+                if (error) {
+                    // ignore 404s since user might not exist anymore
+                    // ignore 401s since an invalid or expired JWT should sign out the current session
+                    if (!(isAuthApiError(error) && (error.status === 404 || error.status === 401))) {
+                        return { error };
+                    }
                 }
             }
-        }
-        if (scope !== 'others') {
-            await this._removeSession();
-            await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
-            await this._notifyAllSubscribers('SIGNED_OUT', null);
-        }
-        return { error: null };
+            if (scope !== 'others') {
+                await this._removeSession();
+                await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`);
+                await this._notifyAllSubscribers('SIGNED_OUT', null);
+            }
+            return { error: null };
+        });
     }
     /**
      * Receive a notification every time an auth event happens.
@@ -935,19 +970,21 @@ export default class GoTrueClient {
         return { data: { subscription } };
     }
     async _emitInitialSession(id) {
-        var _a, _b;
-        try {
-            const { data: { session }, error, } = await this.getSession();
-            if (error)
-                throw error;
-            await ((_a = this.stateChangeEmitters.get(id)) === null || _a === void 0 ? void 0 : _a.callback('INITIAL_SESSION', session));
-            this._debug('INITIAL_SESSION', 'callback id', id, 'session', session);
-        }
-        catch (err) {
-            await ((_b = this.stateChangeEmitters.get(id)) === null || _b === void 0 ? void 0 : _b.callback('INITIAL_SESSION', null));
-            this._debug('INITIAL_SESSION', 'callback id', id, 'error', err);
-            console.error(err);
-        }
+        return await this._useSession(async (result) => {
+            var _a, _b;
+            try {
+                const { data: { session }, error, } = result;
+                if (error)
+                    throw error;
+                await ((_a = this.stateChangeEmitters.get(id)) === null || _a === void 0 ? void 0 : _a.callback('INITIAL_SESSION', session));
+                this._debug('INITIAL_SESSION', 'callback id', id, 'session', session);
+            }
+            catch (err) {
+                await ((_b = this.stateChangeEmitters.get(id)) === null || _b === void 0 ? void 0 : _b.callback('INITIAL_SESSION', null));
+                this._debug('INITIAL_SESSION', 'callback id', id, 'error', err);
+                console.error(err);
+            }
+        });
     }
     /**
      * Sends a password reset request to an email address.
@@ -1287,17 +1324,19 @@ export default class GoTrueClient {
         try {
             const now = Date.now();
             try {
-                const { data: { session }, } = await this.getSession();
-                if (!session || !session.refresh_token || !session.expires_at) {
-                    this._debug('#_autoRefreshTokenTick()', 'no session');
-                    return;
-                }
-                // session will expire in this many ticks (or has already expired if <= 0)
-                const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / AUTO_REFRESH_TICK_DURATION);
-                this._debug('#_autoRefreshTokenTick()', `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`);
-                if (expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD) {
-                    await this._callRefreshToken(session.refresh_token);
-                }
+                return await this._useSession(async (result) => {
+                    const { data: { session }, } = result;
+                    if (!session || !session.refresh_token || !session.expires_at) {
+                        this._debug('#_autoRefreshTokenTick()', 'no session');
+                        return;
+                    }
+                    // session will expire in this many ticks (or has already expired if <= 0)
+                    const expiresInTicks = Math.floor((session.expires_at * 1000 - now) / AUTO_REFRESH_TICK_DURATION);
+                    this._debug('#_autoRefreshTokenTick()', `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`);
+                    if (expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD) {
+                        await this._callRefreshToken(session.refresh_token);
+                    }
+                });
             }
             catch (e) {
                 console.error('Auto refresh tick failed with error. This is likely a transient error.', e);
@@ -1389,15 +1428,17 @@ export default class GoTrueClient {
         return `${this.url}/authorize?${urlParams.join('&')}`;
     }
     async _unenroll(params) {
-        var _a;
         try {
-            const { data: sessionData, error: sessionError } = await this.getSession();
-            if (sessionError) {
-                return { data: null, error: sessionError };
-            }
-            return await _request(this.fetch, 'DELETE', `${this.url}/factors/${params.factorId}`, {
-                headers: this.headers,
-                jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+            return await this._useSession(async (result) => {
+                var _a;
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    return { data: null, error: sessionError };
+                }
+                return await _request(this.fetch, 'DELETE', `${this.url}/factors/${params.factorId}`, {
+                    headers: this.headers,
+                    jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                });
             });
         }
         catch (error) {
@@ -1411,28 +1452,30 @@ export default class GoTrueClient {
      * {@see GoTrueMFAApi#enroll}
      */
     async _enroll(params) {
-        var _a, _b;
         try {
-            const { data: sessionData, error: sessionError } = await this.getSession();
-            if (sessionError) {
-                return { data: null, error: sessionError };
-            }
-            const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors`, {
-                body: {
-                    friendly_name: params.friendlyName,
-                    factor_type: params.factorType,
-                    issuer: params.issuer,
-                },
-                headers: this.headers,
-                jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+            return await this._useSession(async (result) => {
+                var _a, _b;
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    return { data: null, error: sessionError };
+                }
+                const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors`, {
+                    body: {
+                        friendly_name: params.friendlyName,
+                        factor_type: params.factorType,
+                        issuer: params.issuer,
+                    },
+                    headers: this.headers,
+                    jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                });
+                if (error) {
+                    return { data: null, error };
+                }
+                if ((_b = data === null || data === void 0 ? void 0 : data.totp) === null || _b === void 0 ? void 0 : _b.qr_code) {
+                    data.totp.qr_code = `data:image/svg+xml;utf-8,${data.totp.qr_code}`;
+                }
+                return { data, error: null };
             });
-            if (error) {
-                return { data: null, error };
-            }
-            if ((_b = data === null || data === void 0 ? void 0 : data.totp) === null || _b === void 0 ? void 0 : _b.qr_code) {
-                data.totp.qr_code = `data:image/svg+xml;utf-8,${data.totp.qr_code}`;
-            }
-            return { data, error: null };
         }
         catch (error) {
             if (isAuthError(error)) {
@@ -1445,23 +1488,25 @@ export default class GoTrueClient {
      * {@see GoTrueMFAApi#verify}
      */
     async _verify(params) {
-        var _a;
         try {
-            const { data: sessionData, error: sessionError } = await this.getSession();
-            if (sessionError) {
-                return { data: null, error: sessionError };
-            }
-            const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors/${params.factorId}/verify`, {
-                body: { code: params.code, challenge_id: params.challengeId },
-                headers: this.headers,
-                jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+            return await this._useSession(async (result) => {
+                var _a;
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    return { data: null, error: sessionError };
+                }
+                const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors/${params.factorId}/verify`, {
+                    body: { code: params.code, challenge_id: params.challengeId },
+                    headers: this.headers,
+                    jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                });
+                if (error) {
+                    return { data: null, error };
+                }
+                await this._saveSession(Object.assign({ expires_at: Math.round(Date.now() / 1000) + data.expires_in }, data));
+                await this._notifyAllSubscribers('MFA_CHALLENGE_VERIFIED', data);
+                return { data, error };
             });
-            if (error) {
-                return { data: null, error };
-            }
-            await this._saveSession(Object.assign({ expires_at: Math.round(Date.now() / 1000) + data.expires_in }, data));
-            await this._notifyAllSubscribers('MFA_CHALLENGE_VERIFIED', data);
-            return { data, error };
         }
         catch (error) {
             if (isAuthError(error)) {
@@ -1474,15 +1519,17 @@ export default class GoTrueClient {
      * {@see GoTrueMFAApi#challenge}
      */
     async _challenge(params) {
-        var _a;
         try {
-            const { data: sessionData, error: sessionError } = await this.getSession();
-            if (sessionError) {
-                return { data: null, error: sessionError };
-            }
-            return await _request(this.fetch, 'POST', `${this.url}/factors/${params.factorId}/challenge`, {
-                headers: this.headers,
-                jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+            return await this._useSession(async (result) => {
+                var _a;
+                const { data: sessionData, error: sessionError } = result;
+                if (sessionError) {
+                    return { data: null, error: sessionError };
+                }
+                return await _request(this.fetch, 'POST', `${this.url}/factors/${params.factorId}/challenge`, {
+                    headers: this.headers,
+                    jwt: (_a = sessionData === null || sessionData === void 0 ? void 0 : sessionData.session) === null || _a === void 0 ? void 0 : _a.access_token,
+                });
             });
         }
         catch (error) {
@@ -1530,29 +1577,31 @@ export default class GoTrueClient {
      * {@see GoTrueMFAApi#getAuthenticatorAssuranceLevel}
      */
     async _getAuthenticatorAssuranceLevel() {
-        var _a, _b;
-        const { data: { session }, error: sessionError, } = await this.getSession();
-        if (sessionError) {
-            return { data: null, error: sessionError };
-        }
-        if (!session) {
-            return {
-                data: { currentLevel: null, nextLevel: null, currentAuthenticationMethods: [] },
-                error: null,
-            };
-        }
-        const payload = this._decodeJWT(session.access_token);
-        let currentLevel = null;
-        if (payload.aal) {
-            currentLevel = payload.aal;
-        }
-        let nextLevel = currentLevel;
-        const verifiedFactors = (_b = (_a = session.user.factors) === null || _a === void 0 ? void 0 : _a.filter((factor) => factor.status === 'verified')) !== null && _b !== void 0 ? _b : [];
-        if (verifiedFactors.length > 0) {
-            nextLevel = 'aal2';
-        }
-        const currentAuthenticationMethods = payload.amr || [];
-        return { data: { currentLevel, nextLevel, currentAuthenticationMethods }, error: null };
+        return await this._useSession(async (result) => {
+            var _a, _b;
+            const { data: { session }, error: sessionError, } = result;
+            if (sessionError) {
+                return { data: null, error: sessionError };
+            }
+            if (!session) {
+                return {
+                    data: { currentLevel: null, nextLevel: null, currentAuthenticationMethods: [] },
+                    error: null,
+                };
+            }
+            const payload = this._decodeJWT(session.access_token);
+            let currentLevel = null;
+            if (payload.aal) {
+                currentLevel = payload.aal;
+            }
+            let nextLevel = currentLevel;
+            const verifiedFactors = (_b = (_a = session.user.factors) === null || _a === void 0 ? void 0 : _a.filter((factor) => factor.status === 'verified')) !== null && _b !== void 0 ? _b : [];
+            if (verifiedFactors.length > 0) {
+                nextLevel = 'aal2';
+            }
+            const currentAuthenticationMethods = payload.amr || [];
+            return { data: { currentLevel, nextLevel, currentAuthenticationMethods }, error: null };
+        });
     }
 }
 GoTrueClient.nextInstanceID = 0;