@supabase/gotrue-js 2.42.0 → 2.43.0

package/src/GoTrueClient.ts

@@ -29,6 +29,8 @@ import {
   generatePKCEVerifier,
   generatePKCEChallenge,
   supportsLocalStorage,
+  stackGuard,
+  isInStackGuard,
 } from './lib/helpers'
 import localStorageAdapter from './lib/local-storage'
 import { polyfillGlobalThis } from './lib/polyfills'
@@ -235,11 +237,11 @@ export default class GoTrueClient {
    * manually when checking for an error from an auth redirect (oauth, magiclink, password recovery, etc).
    */
   initialize(): Promise<InitializeResult> {
-    if (!this.initializePromise) {
-      this.initializePromise = this._initialize()
+    if (this.initializePromise) {
+      return this.initializePromise
     }
 
-    return this.initializePromise
+    return this._initialize()
   }
 
   /**
@@ -250,63 +252,66 @@ export default class GoTrueClient {
    */
   private async _initialize(): Promise<InitializeResult> {
     if (this.initializePromise) {
-      return this.initializePromise
+      throw new Error('Double call of #_initialize()')
     }
 
-    try {
-      const isPKCEFlow = isBrowser() ? await this._isPKCEFlow() : false
-      this._debug('#_initialize()', 'begin', 'is PKCE flow', isPKCEFlow)
+    this.initializePromise = stackGuard('_initialize', async () => {
+      try {
+        const isPKCEFlow = isBrowser() ? await this._isPKCEFlow() : false
+        this._debug('#_initialize()', 'begin', 'is PKCE flow', isPKCEFlow)
 
-      if (isPKCEFlow || (this.detectSessionInUrl && this._isImplicitGrantFlow())) {
-        const { data, error } = await this._getSessionFromUrl(isPKCEFlow)
-        if (error) {
-          this._debug('#_initialize()', 'error detecting session from URL', error)
+        if (isPKCEFlow || (this.detectSessionInUrl && this._isImplicitGrantFlow())) {
+          const { data, error } = await this._getSessionFromUrl(isPKCEFlow)
+          if (error) {
+            this._debug('#_initialize()', 'error detecting session from URL', error)
 
-          // failed login attempt via url,
-          // remove old session as in verifyOtp, signUp and signInWith*
-          await this._removeSession()
+            // failed login attempt via url,
+            // remove old session as in verifyOtp, signUp and signInWith*
+            await this._removeSession()
 
-          return { error }
-        }
+            return { error }
+          }
 
-        const { session, redirectType } = data
+          const { session, redirectType } = data
 
-        this._debug(
-          '#_initialize()',
-          'detected session in URL',
-          session,
-          'redirect type',
-          redirectType
-        )
+          this._debug(
+            '#_initialize()',
+            'detected session in URL',
+            session,
+            'redirect type',
+            redirectType
+          )
 
-        await this._saveSession(session)
+          await this._saveSession(session)
 
-        setTimeout(async () => {
-          if (redirectType === 'recovery') {
-            await this._notifyAllSubscribers('PASSWORD_RECOVERY', session)
-          } else {
-            await this._notifyAllSubscribers('SIGNED_IN', session)
-          }
-        }, 0)
+          setTimeout(async () => {
+            if (redirectType === 'recovery') {
+              await this._notifyAllSubscribers('PASSWORD_RECOVERY', session)
+            } else {
+              await this._notifyAllSubscribers('SIGNED_IN', session)
+            }
+          }, 0)
 
+          return { error: null }
+        }
+        // no login attempt via callback url try to recover session from storage
+        await this._recoverAndRefresh()
         return { error: null }
-      }
+      } catch (error) {
+        if (isAuthError(error)) {
+          return { error }
+        }
 
-      // no login attempt via callback url try to recover session from storage
-      await this._recoverAndRefresh()
-      return { error: null }
-    } catch (error) {
-      if (isAuthError(error)) {
-        return { error }
+        return {
+          error: new AuthUnknownError('Unexpected error during initialization', error),
+        }
+      } finally {
+        await this._handleVisibilityChange()
+        this._debug('#_initialize()', 'end')
       }
+    })
 
-      return {
-        error: new AuthUnknownError('Unexpected error during initialization', error),
-      }
-    } finally {
-      await this._handleVisibilityChange()
-      this._debug('#_initialize()', 'end')
-    }
+    return await this.initializePromise
   }
 
   /**
@@ -699,18 +704,20 @@ export default class GoTrueClient {
    */
   async reauthenticate(): Promise<AuthResponse> {
     try {
-      const {
-        data: { session },
-        error: sessionError,
-      } = await this.getSession()
-      if (sessionError) throw sessionError
-      if (!session) throw new AuthSessionMissingError()
+      return await this._useSession(async (result) => {
+        const {
+          data: { session },
+          error: sessionError,
+        } = result
+        if (sessionError) throw sessionError
+        if (!session) throw new AuthSessionMissingError()
 
-      const { error } = await _request(this.fetch, 'GET', `${this.url}/reauthenticate`, {
-        headers: this.headers,
-        jwt: session.access_token,
+        const { error } = await _request(this.fetch, 'GET', `${this.url}/reauthenticate`, {
+          headers: this.headers,
+          jwt: session.access_token,
+        })
+        return { data: { user: null, session: null }, error }
       })
-      return { data: { user: null, session: null }, error }
     } catch (error) {
       if (isAuthError(error)) {
         return { data: { user: null, session: null }, error }
@@ -768,7 +775,55 @@ export default class GoTrueClient {
    * Returns the session, refreshing it if necessary.
    * The session returned can be null if the session is not detected which can happen in the event a user is not signed-in or has logged out.
    */
-  async getSession(): Promise<
+  async getSession() {
+    return this._useSession(async (result) => {
+      return result
+    })
+  }
+
+  /**
+   * Use instead of {@link #getSession} inside the library. It is
+   * semantically usually what you want, as getting a session involves some
+   * processing afterwards that requires only one client operating on the
+   * session at once across multiple tabs or processes.
+   */
+  private async _useSession<R>(
+    fn: (
+      result:
+        | {
+            data: {
+              session: Session
+            }
+            error: null
+          }
+        | {
+            data: {
+              session: null
+            }
+            error: AuthError
+          }
+        | {
+            data: {
+              session: null
+            }
+            error: null
+          }
+    ) => Promise<R>
+  ): Promise<R> {
+    return await stackGuard('_useSession', async () => {
+      // the use of __loadSession here is the only correct use of the function!
+      const result = await this.__loadSession()
+
+      return await fn(result)
+    })
+  }
+
+  /**
+   * NEVER USE DIRECTLY!
+   *
+   * Always use {@link #_useSession}.
+   */
+  private async __loadSession(): Promise<
     | {
         data: {
           session: Session
@@ -788,11 +843,21 @@ export default class GoTrueClient {
         error: null
       }
   > {
+    this._debug('#__loadSession()', 'begin')
+
+    if (this.logDebugMessages && !isInStackGuard('_useSession')) {
+      throw new Error('Please use #_useSession()')
+    }
+
     // make sure we've read the session from the url if there is one
     // save to just await, as long we make sure _initialize() never throws
-    await this.initializePromise
-
-    this._debug('#getSession()', 'begin')
+    if (!isInStackGuard('_initialize')) {
+      // only wait when not called from within #_initialize() since it's
+      // waiting for itself. one such pathway is #_initialize() ->
+      // #_handleVisibilityChange() -> #_onVisbilityChanged() ->
+      // #_loadSession().
+      await this.initializePromise
+    }
 
     try {
       let currentSession: Session | null = null
@@ -824,7 +889,7 @@ export default class GoTrueClient {
         : false
 
       this._debug(
-        '#getSession()',
+        '#__loadSession()',
         `session has${hasExpired ? '' : ' not'} expired`,
         'expires_at',
         currentSession.expires_at
@@ -841,7 +906,7 @@ export default class GoTrueClient {
 
       return { data: { session }, error: null }
     } finally {
-      this._debug('#getSession()', 'end')
+      this._debug('#__loadSession()', 'end')
     }
   }
 
@@ -851,20 +916,22 @@ export default class GoTrueClient {
    */
   async getUser(jwt?: string): Promise<UserResponse> {
     try {
-      if (!jwt) {
-        const { data, error } = await this.getSession()
-        if (error) {
-          throw error
-        }
+      return await this._useSession(async (result) => {
+        if (!jwt) {
+          const { data, error } = result
+          if (error) {
+            throw error
+          }
 
-        // Default to Authorization header if there is no existing session
-        jwt = data.session?.access_token ?? undefined
-      }
+          // Default to Authorization header if there is no existing session
+          jwt = data.session?.access_token ?? undefined
+        }
 
-      return await _request(this.fetch, 'GET', `${this.url}/user`, {
-        headers: this.headers,
-        jwt: jwt,
-        xform: _userResponse,
+        return await _request(this.fetch, 'GET', `${this.url}/user`, {
+          headers: this.headers,
+          jwt: jwt,
+          xform: _userResponse,
+        })
       })
     } catch (error) {
       if (isAuthError(error)) {
@@ -885,27 +952,29 @@ export default class GoTrueClient {
     } = {}
   ): Promise<UserResponse> {
     try {
-      const { data: sessionData, error: sessionError } = await this.getSession()
-      if (sessionError) {
-        throw sessionError
-      }
-      if (!sessionData.session) {
-        throw new AuthSessionMissingError()
-      }
-      const session: Session = sessionData.session
-      const { data, error: userError } = await _request(this.fetch, 'PUT', `${this.url}/user`, {
-        headers: this.headers,
-        redirectTo: options?.emailRedirectTo,
-        body: attributes,
-        jwt: session.access_token,
-        xform: _userResponse,
-      })
-      if (userError) throw userError
-      session.user = data.user as User
-      await this._saveSession(session)
-      await this._notifyAllSubscribers('USER_UPDATED', session)
+      return await this._useSession(async (result) => {
+        const { data: sessionData, error: sessionError } = result
+        if (sessionError) {
+          throw sessionError
+        }
+        if (!sessionData.session) {
+          throw new AuthSessionMissingError()
+        }
+        const session: Session = sessionData.session
+        const { data, error: userError } = await _request(this.fetch, 'PUT', `${this.url}/user`, {
+          headers: this.headers,
+          redirectTo: options?.emailRedirectTo,
+          body: attributes,
+          jwt: session.access_token,
+          xform: _userResponse,
+        })
+        if (userError) throw userError
+        session.user = data.user as User
+        await this._saveSession(session)
+        await this._notifyAllSubscribers('USER_UPDATED', session)
 
-      return { data: { user: session.user }, error: null }
+        return { data: { user: session.user }, error: null }
+      })
     } catch (error) {
       if (isAuthError(error)) {
         return { data: { user: null }, error }
@@ -997,29 +1066,31 @@ export default class GoTrueClient {
    */
   async refreshSession(currentSession?: { refresh_token: string }): Promise<AuthResponse> {
     try {
-      if (!currentSession) {
-        const { data, error } = await this.getSession()
-        if (error) {
-          throw error
-        }
+      return await this._useSession(async (result) => {
+        if (!currentSession) {
+          const { data, error } = result
+          if (error) {
+            throw error
+          }
 
-        currentSession = data.session ?? undefined
-      }
+          currentSession = data.session ?? undefined
+        }
 
-      if (!currentSession?.refresh_token) {
-        throw new AuthSessionMissingError()
-      }
+        if (!currentSession?.refresh_token) {
+          throw new AuthSessionMissingError()
+        }
 
-      const { session, error } = await this._callRefreshToken(currentSession.refresh_token)
-      if (error) {
-        return { data: { user: null, session: null }, error: error }
-      }
+        const { session, error } = await this._callRefreshToken(currentSession.refresh_token)
+        if (error) {
+          return { data: { user: null, session: null }, error: error }
+        }
 
-      if (!session) {
-        return { data: { user: null, session: null }, error: null }
-      }
+        if (!session) {
+          return { data: { user: null, session: null }, error: null }
+        }
 
-      return { data: { user: session.user, session }, error: null }
+        return { data: { user: session.user, session }, error: null }
+      })
     } catch (error) {
       if (isAuthError(error)) {
         return { data: { user: null, session: null }, error }
@@ -1142,27 +1213,29 @@ export default class GoTrueClient {
    * If using others scope, no `SIGNED_OUT` event is fired!
    */
   async signOut({ scope }: SignOut = { scope: 'global' }): Promise<{ error: AuthError | null }> {
-    const { data, error: sessionError } = await this.getSession()
-    if (sessionError) {
-      return { error: sessionError }
-    }
-    const accessToken = data.session?.access_token
-    if (accessToken) {
-      const { error } = await this.admin.signOut(accessToken, scope)
-      if (error) {
-        // ignore 404s since user might not exist anymore
-        // ignore 401s since an invalid or expired JWT should sign out the current session
-        if (!(isAuthApiError(error) && (error.status === 404 || error.status === 401))) {
-          return { error }
+    return await this._useSession(async (result) => {
+      const { data, error: sessionError } = result
+      if (sessionError) {
+        return { error: sessionError }
+      }
+      const accessToken = data.session?.access_token
+      if (accessToken) {
+        const { error } = await this.admin.signOut(accessToken, scope)
+        if (error) {
+          // ignore 404s since user might not exist anymore
+          // ignore 401s since an invalid or expired JWT should sign out the current session
+          if (!(isAuthApiError(error) && (error.status === 404 || error.status === 401))) {
+            return { error }
+          }
         }
       }
-    }
-    if (scope !== 'others') {
-      await this._removeSession()
-      await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`)
-      await this._notifyAllSubscribers('SIGNED_OUT', null)
-    }
-    return { error: null }
+      if (scope !== 'others') {
+        await this._removeSession()
+        await removeItemAsync(this.storage, `${this.storageKey}-code-verifier`)
+        await this._notifyAllSubscribers('SIGNED_OUT', null)
+      }
+      return { error: null }
+    })
   }
 
   /**
@@ -1195,20 +1268,22 @@ export default class GoTrueClient {
   }
 
   private async _emitInitialSession(id: string): Promise<void> {
-    try {
-      const {
-        data: { session },
-        error,
-      } = await this.getSession()
-      if (error) throw error
+    return await this._useSession(async (result) => {
+      try {
+        const {
+          data: { session },
+          error,
+        } = result
+        if (error) throw error
 
-      await this.stateChangeEmitters.get(id)?.callback('INITIAL_SESSION', session)
-      this._debug('INITIAL_SESSION', 'callback id', id, 'session', session)
-    } catch (err) {
-      await this.stateChangeEmitters.get(id)?.callback('INITIAL_SESSION', null)
-      this._debug('INITIAL_SESSION', 'callback id', id, 'error', err)
-      console.error(err)
-    }
+        await this.stateChangeEmitters.get(id)?.callback('INITIAL_SESSION', session)
+        this._debug('INITIAL_SESSION', 'callback id', id, 'session', session)
+      } catch (err) {
+        await this.stateChangeEmitters.get(id)?.callback('INITIAL_SESSION', null)
+        this._debug('INITIAL_SESSION', 'callback id', id, 'error', err)
+        console.error(err)
+      }
+    })
   }
 
   /**
@@ -1634,28 +1709,30 @@ export default class GoTrueClient {
       const now = Date.now()
 
       try {
-        const {
-          data: { session },
-        } = await this.getSession()
-
-        if (!session || !session.refresh_token || !session.expires_at) {
-          this._debug('#_autoRefreshTokenTick()', 'no session')
-          return
-        }
+        return await this._useSession(async (result) => {
+          const {
+            data: { session },
+          } = result
+
+          if (!session || !session.refresh_token || !session.expires_at) {
+            this._debug('#_autoRefreshTokenTick()', 'no session')
+            return
+          }
 
-        // session will expire in this many ticks (or has already expired if <= 0)
-        const expiresInTicks = Math.floor(
-          (session.expires_at * 1000 - now) / AUTO_REFRESH_TICK_DURATION
-        )
+          // session will expire in this many ticks (or has already expired if <= 0)
+          const expiresInTicks = Math.floor(
+            (session.expires_at * 1000 - now) / AUTO_REFRESH_TICK_DURATION
+          )
 
-        this._debug(
-          '#_autoRefreshTokenTick()',
-          `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`
-        )
+          this._debug(
+            '#_autoRefreshTokenTick()',
+            `access token expires in ${expiresInTicks} ticks, a tick lasts ${AUTO_REFRESH_TICK_DURATION}ms, refresh threshold is ${AUTO_REFRESH_TICK_THRESHOLD} ticks`
+          )
 
-        if (expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD) {
-          await this._callRefreshToken(session.refresh_token)
-        }
+          if (expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD) {
+            await this._callRefreshToken(session.refresh_token)
+          }
+        })
       } catch (e: any) {
         console.error('Auto refresh tick failed with error. This is likely a transient error.', e)
       }
@@ -1777,14 +1854,16 @@ export default class GoTrueClient {
 
   private async _unenroll(params: MFAUnenrollParams): Promise<AuthMFAUnenrollResponse> {
     try {
-      const { data: sessionData, error: sessionError } = await this.getSession()
-      if (sessionError) {
-        return { data: null, error: sessionError }
-      }
+      return await this._useSession(async (result) => {
+        const { data: sessionData, error: sessionError } = result
+        if (sessionError) {
+          return { data: null, error: sessionError }
+        }
 
-      return await _request(this.fetch, 'DELETE', `${this.url}/factors/${params.factorId}`, {
-        headers: this.headers,
-        jwt: sessionData?.session?.access_token,
+        return await _request(this.fetch, 'DELETE', `${this.url}/factors/${params.factorId}`, {
+          headers: this.headers,
+          jwt: sessionData?.session?.access_token,
+        })
       })
     } catch (error) {
       if (isAuthError(error)) {
@@ -1799,30 +1878,32 @@ export default class GoTrueClient {
    */
   private async _enroll(params: MFAEnrollParams): Promise<AuthMFAEnrollResponse> {
     try {
-      const { data: sessionData, error: sessionError } = await this.getSession()
-      if (sessionError) {
-        return { data: null, error: sessionError }
-      }
+      return await this._useSession(async (result) => {
+        const { data: sessionData, error: sessionError } = result
+        if (sessionError) {
+          return { data: null, error: sessionError }
+        }
 
-      const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors`, {
-        body: {
-          friendly_name: params.friendlyName,
-          factor_type: params.factorType,
-          issuer: params.issuer,
-        },
-        headers: this.headers,
-        jwt: sessionData?.session?.access_token,
-      })
+        const { data, error } = await _request(this.fetch, 'POST', `${this.url}/factors`, {
+          body: {
+            friendly_name: params.friendlyName,
+            factor_type: params.factorType,
+            issuer: params.issuer,
+          },
+          headers: this.headers,
+          jwt: sessionData?.session?.access_token,
+        })
 
-      if (error) {
-        return { data: null, error }
-      }
+        if (error) {
+          return { data: null, error }
+        }
 
-      if (data?.totp?.qr_code) {
-        data.totp.qr_code = `data:image/svg+xml;utf-8,${data.totp.qr_code}`
-      }
+        if (data?.totp?.qr_code) {
+          data.totp.qr_code = `data:image/svg+xml;utf-8,${data.totp.qr_code}`
+        }
 
-      return { data, error: null }
+        return { data, error: null }
+      })
     } catch (error) {
       if (isAuthError(error)) {
         return { data: null, error }
@@ -1836,32 +1917,34 @@ export default class GoTrueClient {
    */
   private async _verify(params: MFAVerifyParams): Promise<AuthMFAVerifyResponse> {
     try {
-      const { data: sessionData, error: sessionError } = await this.getSession()
-      if (sessionError) {
-        return { data: null, error: sessionError }
-      }
+      return await this._useSession(async (result) => {
+        const { data: sessionData, error: sessionError } = result
+        if (sessionError) {
+          return { data: null, error: sessionError }
+        }
 
-      const { data, error } = await _request(
-        this.fetch,
-        'POST',
-        `${this.url}/factors/${params.factorId}/verify`,
-        {
-          body: { code: params.code, challenge_id: params.challengeId },
-          headers: this.headers,
-          jwt: sessionData?.session?.access_token,
+        const { data, error } = await _request(
+          this.fetch,
+          'POST',
+          `${this.url}/factors/${params.factorId}/verify`,
+          {
+            body: { code: params.code, challenge_id: params.challengeId },
+            headers: this.headers,
+            jwt: sessionData?.session?.access_token,
+          }
+        )
+        if (error) {
+          return { data: null, error }
         }
-      )
-      if (error) {
-        return { data: null, error }
-      }
 
-      await this._saveSession({
-        expires_at: Math.round(Date.now() / 1000) + data.expires_in,
-        ...data,
-      })
-      await this._notifyAllSubscribers('MFA_CHALLENGE_VERIFIED', data)
+        await this._saveSession({
+          expires_at: Math.round(Date.now() / 1000) + data.expires_in,
+          ...data,
+        })
+        await this._notifyAllSubscribers('MFA_CHALLENGE_VERIFIED', data)
 
-      return { data, error }
+        return { data, error }
+      })
     } catch (error) {
       if (isAuthError(error)) {
         return { data: null, error }
@@ -1875,20 +1958,22 @@ export default class GoTrueClient {
    */
   private async _challenge(params: MFAChallengeParams): Promise<AuthMFAChallengeResponse> {
     try {
-      const { data: sessionData, error: sessionError } = await this.getSession()
-      if (sessionError) {
-        return { data: null, error: sessionError }
-      }
-
-      return await _request(
-        this.fetch,
-        'POST',
-        `${this.url}/factors/${params.factorId}/challenge`,
-        {
-          headers: this.headers,
-          jwt: sessionData?.session?.access_token,
+      return await this._useSession(async (result) => {
+        const { data: sessionData, error: sessionError } = result
+        if (sessionError) {
+          return { data: null, error: sessionError }
         }
-      )
+
+        return await _request(
+          this.fetch,
+          'POST',
+          `${this.url}/factors/${params.factorId}/challenge`,
+          {
+            headers: this.headers,
+            jwt: sessionData?.session?.access_token,
+          }
+        )
+      })
     } catch (error) {
       if (isAuthError(error)) {
         return { data: null, error }
@@ -1946,39 +2031,41 @@ export default class GoTrueClient {
    * {@see GoTrueMFAApi#getAuthenticatorAssuranceLevel}
    */
   private async _getAuthenticatorAssuranceLevel(): Promise<AuthMFAGetAuthenticatorAssuranceLevelResponse> {
-    const {
-      data: { session },
-      error: sessionError,
-    } = await this.getSession()
-    if (sessionError) {
-      return { data: null, error: sessionError }
-    }
-    if (!session) {
-      return {
-        data: { currentLevel: null, nextLevel: null, currentAuthenticationMethods: [] },
-        error: null,
+    return await this._useSession(async (result) => {
+      const {
+        data: { session },
+        error: sessionError,
+      } = result
+      if (sessionError) {
+        return { data: null, error: sessionError }
+      }
+      if (!session) {
+        return {
+          data: { currentLevel: null, nextLevel: null, currentAuthenticationMethods: [] },
+          error: null,
+        }
       }
-    }
 
-    const payload = this._decodeJWT(session.access_token)
+      const payload = this._decodeJWT(session.access_token)
 
-    let currentLevel: AuthenticatorAssuranceLevels | null = null
+      let currentLevel: AuthenticatorAssuranceLevels | null = null
 
-    if (payload.aal) {
-      currentLevel = payload.aal
-    }
+      if (payload.aal) {
+        currentLevel = payload.aal
+      }
 
-    let nextLevel: AuthenticatorAssuranceLevels | null = currentLevel
+      let nextLevel: AuthenticatorAssuranceLevels | null = currentLevel
 
-    const verifiedFactors =
-      session.user.factors?.filter((factor: Factor) => factor.status === 'verified') ?? []
+      const verifiedFactors =
+        session.user.factors?.filter((factor: Factor) => factor.status === 'verified') ?? []
 
-    if (verifiedFactors.length > 0) {
-      nextLevel = 'aal2'
-    }
+      if (verifiedFactors.length > 0) {
+        nextLevel = 'aal2'
+      }
 
-    const currentAuthenticationMethods = payload.amr || []
+      const currentAuthenticationMethods = payload.amr || []
 
-    return { data: { currentLevel, nextLevel, currentAuthenticationMethods }, error: null }
+      return { data: { currentLevel, nextLevel, currentAuthenticationMethods }, error: null }
+    })
   }
 }