@ttt-productions/auth-core 0.0.0

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@ttt-productions/auth-core",
+  "version": "0.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ttt-productions/ttt-packages.git",
+    "directory": "packages/auth-core"
+  },
+  "sideEffects": false,
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "import": "./dist/react/index.js",
+      "require": "./dist/react/index.cjs"
+    }
+  },
+  "peerDependencies": {
+    "firebase": "^10.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react": { "optional": true }
+  }
+}

package/src/auth.ts

@@ -0,0 +1,21 @@
+import type { Auth, User } from "firebase/auth";
+import { onAuthStateChanged as fbOnAuthStateChanged } from "firebase/auth";
+
+export type Unsubscribe = () => void;
+
+export function getAuthUser(auth: Auth): User | null {
+  return auth.currentUser;
+}
+
+/**
+ * Thin wrapper around Firebase onAuthStateChanged.
+ * - always returns the unsubscribe function
+ * - preserves Firebase callback signature
+ */
+export function onAuthStateChanged(
+  auth: Auth,
+  cb: (user: User | null) => void,
+  onError?: (error: unknown) => void
+): Unsubscribe {
+  return fbOnAuthStateChanged(auth, cb, onError);
+}

package/src/claims.ts

@@ -0,0 +1,54 @@
+import type { Auth, User, IdTokenResult } from "firebase/auth";
+
+export type IdTokenClaims = IdTokenResult["claims"];
+
+export type ParsedClaims = {
+  // common defaults (kept generic)
+  roles: string[];
+  // raw claims for app-level decisions
+  raw: IdTokenClaims;
+};
+
+/**
+ * Get the current user's ID token claims.
+ * Returns null if no current user.
+ */
+export async function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null> {
+  if (!user) return null;
+  const res = await user.getIdTokenResult(false);
+  return res.claims;
+}
+
+/**
+ * Forces refresh of ID token + claims.
+ * Returns null if no current user.
+ */
+export async function refreshClaims(user: User | null): Promise<IdTokenClaims | null> {
+  if (!user) return null;
+  const res = await user.getIdTokenResult(true);
+  return res.claims;
+}
+
+/**
+ * Convenience helper when you only have Auth.
+ */
+export async function refreshClaimsFromAuth(auth: Auth): Promise<IdTokenClaims | null> {
+  return refreshClaims(auth.currentUser);
+}
+
+/**
+ * Keep parsing intentionally minimal and generic:
+ * - normalize "roles" into string[]
+ * - keep raw claims attached
+ */
+export function parseClaims(claims: IdTokenClaims | null | undefined): ParsedClaims {
+  const raw = (claims ?? {}) as IdTokenClaims;
+
+  const rolesValue = (raw as any).roles;
+  const roles =
+    Array.isArray(rolesValue) ? rolesValue.filter((x) => typeof x === "string") :
+    typeof rolesValue === "string" ? [rolesValue] :
+    [];
+
+  return { roles, raw };
+}

package/src/errors.ts

@@ -0,0 +1,126 @@
+export type AuthErrorCode =
+  | "AUTH_UNKNOWN"
+  | "AUTH_NETWORK_ERROR"
+  | "AUTH_TOO_MANY_REQUESTS"
+  | "AUTH_POPUP_CLOSED"
+  | "AUTH_POPUP_BLOCKED"
+  | "AUTH_CANCELLED"
+  | "AUTH_USER_DISABLED"
+  | "AUTH_USER_NOT_FOUND"
+  | "AUTH_WRONG_PASSWORD"
+  | "AUTH_INVALID_EMAIL"
+  | "AUTH_EMAIL_ALREADY_IN_USE"
+  | "AUTH_WEAK_PASSWORD"
+  | "AUTH_REQUIRES_RECENT_LOGIN"
+  | "AUTH_INVALID_CREDENTIAL"
+  | "AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL"
+  | "AUTH_PROVIDER_ALREADY_LINKED"
+  | "AUTH_CREDENTIAL_ALREADY_IN_USE";
+
+export type NormalizedAuthError = {
+  code: AuthErrorCode;
+  message: string;
+  firebaseCode?: string;
+  details?: Record<string, unknown>;
+};
+
+function pickFirebaseCode(err: unknown): string | undefined {
+  if (!err || typeof err !== "object") return undefined;
+  const anyErr = err as any;
+  const c = anyErr.code;
+  return typeof c === "string" ? c : undefined;
+}
+
+const MAP: Record<string, { code: AuthErrorCode; message: string }> = {
+  "auth/network-request-failed": {
+    code: "AUTH_NETWORK_ERROR",
+    message: "Network error. Please check your connection and try again."
+  },
+  "auth/too-many-requests": {
+    code: "AUTH_TOO_MANY_REQUESTS",
+    message: "Too many attempts. Please wait a moment and try again."
+  },
+  "auth/popup-closed-by-user": {
+    code: "AUTH_POPUP_CLOSED",
+    message: "Sign-in popup was closed."
+  },
+  "auth/popup-blocked": {
+    code: "AUTH_POPUP_BLOCKED",
+    message: "Sign-in popup was blocked by the browser."
+  },
+  "auth/cancelled-popup-request": {
+    code: "AUTH_CANCELLED",
+    message: "Sign-in was cancelled."
+  },
+  "auth/user-disabled": {
+    code: "AUTH_USER_DISABLED",
+    message: "This account has been disabled."
+  },
+  "auth/user-not-found": {
+    code: "AUTH_USER_NOT_FOUND",
+    message: "No account found with that email."
+  },
+  "auth/wrong-password": {
+    code: "AUTH_WRONG_PASSWORD",
+    message: "Incorrect password."
+  },
+  "auth/invalid-email": {
+    code: "AUTH_INVALID_EMAIL",
+    message: "Invalid email address."
+  },
+  "auth/email-already-in-use": {
+    code: "AUTH_EMAIL_ALREADY_IN_USE",
+    message: "That email is already in use."
+  },
+  "auth/weak-password": {
+    code: "AUTH_WEAK_PASSWORD",
+    message: "Password is too weak."
+  },
+  "auth/requires-recent-login": {
+    code: "AUTH_REQUIRES_RECENT_LOGIN",
+    message: "Please re-authenticate and try again."
+  },
+  "auth/invalid-credential": {
+    code: "AUTH_INVALID_CREDENTIAL",
+    message: "Invalid credentials. Please try again."
+  },
+  "auth/account-exists-with-different-credential": {
+    code: "AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL",
+    message: "An account already exists with a different sign-in method."
+  },
+  "auth/provider-already-linked": {
+    code: "AUTH_PROVIDER_ALREADY_LINKED",
+    message: "That provider is already linked to this account."
+  },
+  "auth/credential-already-in-use": {
+    code: "AUTH_CREDENTIAL_ALREADY_IN_USE",
+    message: "Those credentials are already associated with another account."
+  }
+};
+
+export function normalizeAuthError(err: unknown, details?: Record<string, unknown>): NormalizedAuthError {
+  const firebaseCode = pickFirebaseCode(err);
+
+  const mapped = firebaseCode ? MAP[firebaseCode] : undefined;
+  if (mapped) {
+    return {
+      code: mapped.code,
+      message: mapped.message,
+      firebaseCode,
+      details
+    };
+  }
+
+  // best-effort message (don’t leak weird objects)
+  const msg =
+    typeof (err as any)?.message === "string"
+      ? (err as any).message
+      : "Authentication error. Please try again.";
+
+  return {
+    code: "AUTH_UNKNOWN",
+    message: msg,
+    firebaseCode,
+    details
+  };
+}

package/src/index.ts

@@ -0,0 +1,3 @@
+export * from "./auth";
+export * from "./claims";
+export * from "./errors";

package/src/react/index.ts

@@ -0,0 +1 @@
+export * from "./useAuthState";

package/src/react/useAuthState.ts

@@ -0,0 +1,34 @@
+import { useEffect, useState } from "react";
+import type { Auth, User } from "firebase/auth";
+import { onAuthStateChanged } from "../auth";
+
+export type AuthState = {
+  user: User | null;
+  loading: boolean;
+  error: unknown | null;
+};
+
+export function useAuthState(auth: Auth): AuthState {
+  const [user, setUser] = useState<User | null>(() => auth.currentUser);
+  const [loading, setLoading] = useState<boolean>(true);
+  const [error, setError] = useState<unknown | null>(null);
+
+  useEffect(() => {
+    setLoading(true);
+    const unsub = onAuthStateChanged(
+      auth,
+      (u) => {
+        setUser(u);
+        setError(null);
+        setLoading(false);
+      },
+      (e) => {
+        setError(e);
+        setLoading(false);
+      }
+    );
+    return unsub;
+  }, [auth]);
+
+  return { user, loading, error };
+}

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}