@ttt-productions/auth-core 0.3.5 → 0.4.1

package/dist/server/assertAuth.d.ts

@@ -0,0 +1,3 @@
+import type { AssertAuthConfig, AssertAuthFn } from "./types.js";
+export declare function createAssertAuth<TUser, TProject>(config: AssertAuthConfig<TUser, TProject>): AssertAuthFn<TUser, TProject>;
+//# sourceMappingURL=assertAuth.d.ts.map

package/dist/server/assertAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertAuth.d.ts","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EAGb,MAAM,YAAY,CAAC;AAEpB,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAC9C,MAAM,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,GACxC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAwH/B"}

package/dist/server/assertAuth.js

@@ -0,0 +1,108 @@
+// packages/auth-core/src/server/assertAuth.ts
+//
+// Factory that produces an assertAuth function bound to a consuming app's
+// Firestore paths, user/project shapes, and admin check.
+//
+// Every Cloud Functions callable in the consuming app should invoke the
+// returned assertAuth as its first executable line. The check order is:
+//   1. Authentication
+//   2. Email verification
+//   3. Parallel Firestore reads (user doc + project doc, as needed)
+//   4. Status check (banned / disabled)
+//   5. Creator check
+//   6. Project membership check
+//   7. Admin check (delegated to config.requireAdmin)
+import { HttpsError } from "firebase-functions/v2/https";
+export function createAssertAuth(config) {
+    return async function assertAuth(request, requirements = {}) {
+        // 1. Authentication check (always first)
+        if (!request.auth) {
+            throw new HttpsError("unauthenticated", "You must be authenticated");
+        }
+        const uid = request.auth.uid;
+        const token = request.auth.token;
+        // 2. Email verification check
+        if (requirements.emailVerified === true &&
+            requirements.allowUnverified !== true) {
+            if (token.email_verified !== true) {
+                throw new HttpsError("failed-precondition", "Email must be verified");
+            }
+        }
+        // 3. Determine which Firestore reads are needed
+        const needsUserDoc = requirements.creator === true || requirements.allowAnyStatus !== true;
+        const needsProject = requirements.projectMembership !== undefined;
+        const db = config.firestore();
+        const [userSnap, projectSnap] = await Promise.all([
+            needsUserDoc
+                ? db.doc(config.userProfilePath(uid)).get()
+                : Promise.resolve(null),
+            needsProject
+                ? db.doc(config.projectPath(requirements.projectMembership.projectId)).get()
+                : Promise.resolve(null),
+        ]);
+        let userDoc;
+        // 4. Status check (default: block banned + disabled; skipped if allowAnyStatus)
+        if (requirements.allowAnyStatus !== true) {
+            if (!userSnap || !userSnap.exists) {
+                throw new HttpsError("not-found", "User profile not found");
+            }
+            const userData = userSnap.data();
+            const status = config.getUserStatus(userData);
+            if (status === "disabled") {
+                throw new HttpsError("permission-denied", "Account is not in good standing");
+            }
+            if (status === "banned" && requirements.allowBanned !== true) {
+                throw new HttpsError("permission-denied", "Account is not in good standing");
+            }
+            userDoc = userData;
+        }
+        // 5. Creator check
+        if (requirements.creator === true) {
+            if (!userDoc) {
+                // allowAnyStatus is true — user doc was still fetched, validate now
+                if (!userSnap || !userSnap.exists) {
+                    throw new HttpsError("not-found", "User profile not found");
+                }
+                userDoc = userSnap.data();
+            }
+            if (!config.isUserCreator(userDoc)) {
+                throw new HttpsError("failed-precondition", "Creator status required");
+            }
+        }
+        // 6. Project membership check
+        let projectContext;
+        if (requirements.projectMembership !== undefined) {
+            if (!projectSnap || !projectSnap.exists) {
+                throw new HttpsError("not-found", "Project not found");
+            }
+            const projectData = projectSnap.data();
+            const isOwner = config.isProjectOwner(projectData, uid);
+            const isMember = isOwner || config.isProjectMember(projectData, uid);
+            if (requirements.projectMembership.role === "owner") {
+                if (!isOwner) {
+                    throw new HttpsError("permission-denied", "Project owner access required");
+                }
+            }
+            else {
+                if (!isMember) {
+                    throw new HttpsError("permission-denied", "Not a member of this project");
+                }
+            }
+            projectContext = { data: projectData, isOwner, isMember };
+        }
+        // 7. Admin check (delegates to config.requireAdmin)
+        if (requirements.admin !== undefined) {
+            await config.requireAdmin(uid, token, requirements.admin);
+        }
+        // 8. Return context with whatever docs were fetched
+        const ctx = { uid, token };
+        if (userDoc !== undefined) {
+            ctx.userDoc = userDoc;
+        }
+        if (projectContext !== undefined) {
+            ctx.project = projectContext;
+        }
+        return ctx;
+    };
+}
+//# sourceMappingURL=assertAuth.js.map

package/dist/server/assertAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertAuth.js","sourceRoot":"","sources":["../../src/server/assertAuth.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,0EAA0E;AAC1E,yDAAyD;AACzD,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,sBAAsB;AACtB,0BAA0B;AAC1B,oEAAoE;AACpE,wCAAwC;AACxC,qBAAqB;AACrB,gCAAgC;AAChC,sDAAsD;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AASzD,MAAM,UAAU,gBAAgB,CAC9B,MAAyC;IAEzC,OAAO,KAAK,UAAU,UAAU,CAC9B,OAAwB,EACxB,eAAiC,EAAE;QAEnC,yCAAyC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAEjC,8BAA8B;QAC9B,IACE,YAAY,CAAC,aAAa,KAAK,IAAI;YACnC,YAAY,CAAC,eAAe,KAAK,IAAI,EACrC,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,wBAAwB,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,MAAM,YAAY,GAChB,YAAY,CAAC,OAAO,KAAK,IAAI,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,CAAC;QACxE,MAAM,YAAY,GAAG,YAAY,CAAC,iBAAiB,KAAK,SAAS,CAAC;QAElE,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,YAAY;gBACV,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC3C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACzB,YAAY;gBACV,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,iBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC7E,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;QAEH,IAAI,OAA0B,CAAC;QAE/B,gFAAgF;QAChF,IAAI,YAAY,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAW,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,MAAM,IAAI,UAAU,CAClB,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,IAAI,YAAY,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC7D,MAAM,IAAI,UAAU,CAClB,mBAAmB,EACnB,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,QAAQ,CAAC;QACrB,CAAC;QAED,mBAAmB;QACnB,IAAI,YAAY,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,oEAAoE;gBACpE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAClC,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;gBAC9D,CAAC;gBACD,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAW,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,cAAuD,CAAC;QAC5D,IAAI,YAAY,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,EAAc,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,OAAO,IAAI,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAErE,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACpD,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,UAAU,CAClB,mBAAmB,EACnB,+BAA+B,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,UAAU,CAClB,mBAAmB,EACnB,8BAA8B,CAC/B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,cAAc,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC5D,CAAC;QAED,oDAAoD;QACpD,IAAI,YAAY,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;QAED,oDAAoD;QACpD,MAAM,GAAG,GAAiC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,GAAG,CAAC,OAAO,GAAG,cAAc,CAAC;QAC/B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/assertAuth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=assertAuth.test.d.ts.map

package/dist/server/assertAuth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertAuth.test.d.ts","sourceRoot":"","sources":["../../src/server/assertAuth.test.ts"],"names":[],"mappings":""}

package/dist/server/assertAuth.test.js

@@ -0,0 +1,407 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+vi.mock("firebase-functions/v2/https", () => {
+    class HttpsError extends Error {
+        code;
+        constructor(code, message) {
+            super(message);
+            this.code = code;
+            this.name = "HttpsError";
+        }
+    }
+    return { HttpsError };
+});
+import { createAssertAuth } from "./assertAuth.js";
+function makeRequest(opts) {
+    const uid = opts?.uid ?? "uid-123";
+    return {
+        data: {},
+        rawRequest: {},
+        auth: {
+            uid,
+            token: { uid, email_verified: opts?.emailVerified ?? true },
+        },
+    };
+}
+function makeUnauthRequest() {
+    return { data: {}, rawRequest: {}, auth: undefined };
+}
+const activeUserDoc = {
+    uid: "uid-123",
+    displayName: "Test User",
+    status: "active",
+};
+const creatorUserDoc = {
+    ...activeUserDoc,
+    creator: "creator-12345",
+};
+function memberProjectDoc(callerUid) {
+    return {
+        projectId: "p1",
+        ownedBy: { uid: "owner-uid" },
+        activeUserIds: { [callerUid]: true },
+        activeUsers: [],
+    };
+}
+// --- harness ---------------------------------------------------------------
+let mockUserGet;
+let mockProjectGet;
+let mockRequireAdmin;
+let mockDbDoc;
+let assertAuth;
+beforeEach(() => {
+    mockUserGet = vi.fn().mockResolvedValue({ exists: true, data: () => activeUserDoc });
+    mockProjectGet = vi.fn().mockResolvedValue({
+        exists: true,
+        data: () => memberProjectDoc("uid-123"),
+    });
+    mockRequireAdmin = vi.fn().mockResolvedValue(undefined);
+    const userDocRef = { get: mockUserGet };
+    const projectDocRef = { get: mockProjectGet };
+    mockDbDoc = vi.fn((path) => {
+        if (path.startsWith("allProjects/"))
+            return projectDocRef;
+        return userDocRef;
+    });
+    const fakeDb = { doc: mockDbDoc };
+    const config = {
+        firestore: () => fakeDb,
+        userProfilePath: (uid) => `userProfiles/${uid}`,
+        projectPath: (projectId) => `allProjects/${projectId}`,
+        getUserStatus: (user) => {
+            if (user.status === "disabled")
+                return "disabled";
+            if (user.status === "banned")
+                return "banned";
+            return "ok";
+        },
+        isUserCreator: (user) => Boolean(user.creator),
+        isProjectOwner: (project, uid) => project.ownedBy?.uid === uid,
+        isProjectMember: (project, uid) => project.ownedBy?.uid === uid ||
+            project.activeUserIds?.[uid] === true ||
+            (project.activeUsers || []).some((u) => u.uid === uid),
+        requireAdmin: mockRequireAdmin,
+    };
+    assertAuth = createAssertAuth(config);
+});
+// --- tests -----------------------------------------------------------------
+describe("Authentication", () => {
+    it("throws unauthenticated when request.auth is absent", async () => {
+        await expect(assertAuth(makeUnauthRequest())).rejects.toMatchObject({
+            code: "unauthenticated",
+        });
+    });
+    it("succeeds with no Firestore reads when only allowAnyStatus is set", async () => {
+        const ctx = await assertAuth(makeRequest(), { allowAnyStatus: true });
+        expect(ctx.uid).toBe("uid-123");
+        expect(ctx.userDoc).toBeUndefined();
+        expect(ctx.project).toBeUndefined();
+        expect(mockDbDoc).not.toHaveBeenCalled();
+    });
+});
+describe("Email verification", () => {
+    it("throws failed-precondition when emailVerified required and token email_verified is false", async () => {
+        await expect(assertAuth(makeRequest({ emailVerified: false }), {
+            emailVerified: true,
+            allowAnyStatus: true,
+        })).rejects.toMatchObject({ code: "failed-precondition" });
+    });
+    it("succeeds when emailVerified required and token email_verified is true", async () => {
+        await expect(assertAuth(makeRequest({ emailVerified: true }), {
+            emailVerified: true,
+            allowAnyStatus: true,
+        })).resolves.toMatchObject({ uid: "uid-123" });
+    });
+    it("succeeds when allowUnverified is true even if email_verified is false", async () => {
+        await expect(assertAuth(makeRequest({ emailVerified: false }), {
+            emailVerified: true,
+            allowUnverified: true,
+            allowAnyStatus: true,
+        })).resolves.toMatchObject({ uid: "uid-123" });
+    });
+});
+describe("Not-banned check (default behavior)", () => {
+    it("throws permission-denied when user status is banned", async () => {
+        mockUserGet.mockResolvedValue({
+            exists: true,
+            data: () => ({ ...activeUserDoc, status: "banned" }),
+        });
+        await expect(assertAuth(makeRequest())).rejects.toMatchObject({
+            code: "permission-denied",
+        });
+    });
+    it("throws permission-denied when user status is disabled", async () => {
+        mockUserGet.mockResolvedValue({
+            exists: true,
+            data: () => ({ ...activeUserDoc, status: "disabled" }),
+        });
+        await expect(assertAuth(makeRequest())).rejects.toMatchObject({
+            code: "permission-denied",
+        });
+    });
+    it("throws not-found when user doc does not exist", async () => {
+        mockUserGet.mockResolvedValue({ exists: false, data: () => null });
+        await expect(assertAuth(makeRequest())).rejects.toMatchObject({
+            code: "not-found",
+        });
+    });
+    it("succeeds when user doc has no status field", async () => {
+        mockUserGet.mockResolvedValue({
+            exists: true,
+            data: () => ({ uid: "uid-123", displayName: "Test" }),
+        });
+        const ctx = await assertAuth(makeRequest());
+        expect(ctx.uid).toBe("uid-123");
+        expect(ctx.userDoc).toBeDefined();
+    });
+    it("succeeds when user status is active", async () => {
+        const ctx = await assertAuth(makeRequest());
+        expect(ctx.uid).toBe("uid-123");
+        expect(ctx.userDoc).toMatchObject({ status: "active" });
+    });
+    it("skips user doc read entirely when allowAnyStatus is true", async () => {
+        await assertAuth(makeRequest(), { allowAnyStatus: true });
+        expect(mockUserGet).not.toHaveBeenCalled();
+    });
+});
+describe("allowBanned opt-in", () => {
+    it("allows a banned user when allowBanned is true", async () => {
+        mockUserGet.mockResolvedValue({
+            exists: true,
+            data: () => ({ ...activeUserDoc, status: "banned" }),
+        });
+        const ctx = await assertAuth(makeRequest(), { allowBanned: true });
+        expect(ctx.uid).toBe("uid-123");
+        expect(ctx.userDoc).toMatchObject({ status: "banned" });
+    });
+    it("still blocks a disabled user even when allowBanned is true", async () => {
+        mockUserGet.mockResolvedValue({
+            exists: true,
+            data: () => ({ ...activeUserDoc, status: "disabled" }),
+        });
+        await expect(assertAuth(makeRequest(), { allowBanned: true })).rejects.toMatchObject({ code: "permission-denied" });
+    });
+    it("still requires the user doc to exist when allowBanned is true", async () => {
+        mockUserGet.mockResolvedValue({ exists: false, data: () => null });
+        await expect(assertAuth(makeRequest(), { allowBanned: true })).rejects.toMatchObject({ code: "not-found" });
+    });
+});
+describe("Creator check", () => {
+    it("throws failed-precondition when user has no creator field", async () => {
+        mockUserGet.mockResolvedValue({
+            exists: true,
+            data: () => ({ ...activeUserDoc }),
+        });
+        await expect(assertAuth(makeRequest(), { creator: true, allowAnyStatus: true })).rejects.toMatchObject({ code: "failed-precondition" });
+    });
+    it("succeeds when user has a truthy creator string", async () => {
+        mockUserGet.mockResolvedValue({
+            exists: true,
+            data: () => creatorUserDoc,
+        });
+        const ctx = await assertAuth(makeRequest(), {
+            creator: true,
+            allowAnyStatus: true,
+        });
+        expect(ctx.userDoc).toMatchObject({ creator: "creator-12345" });
+    });
+    it("throws not-found when user doc is missing and creator check runs", async () => {
+        mockUserGet.mockResolvedValue({ exists: false, data: () => null });
+        await expect(assertAuth(makeRequest(), { creator: true, allowAnyStatus: true })).rejects.toMatchObject({ code: "not-found" });
+    });
+    it("throws permission-denied (not failed-precondition) when user is banned and creator=true", async () => {
+        mockUserGet.mockResolvedValue({
+            exists: true,
+            data: () => ({ ...creatorUserDoc, status: "banned" }),
+        });
+        // banned check in step 4 fires before creator check in step 5
+        await expect(assertAuth(makeRequest(), { creator: true })).rejects.toMatchObject({ code: "permission-denied" });
+    });
+});
+describe("Project membership", () => {
+    it("throws not-found when project doc does not exist", async () => {
+        mockProjectGet.mockResolvedValue({ exists: false, data: () => null });
+        await expect(assertAuth(makeRequest(), {
+            projectMembership: { projectId: "p1" },
+            allowAnyStatus: true,
+        })).rejects.toMatchObject({ code: "not-found" });
+    });
+    it("throws permission-denied when caller is not in any membership field", async () => {
+        mockProjectGet.mockResolvedValue({
+            exists: true,
+            data: () => ({
+                projectId: "p1",
+                ownedBy: { uid: "other-uid" },
+                activeUserIds: { "another-uid": true },
+                activeUsers: [{ uid: "yet-another-uid" }],
+            }),
+        });
+        await expect(assertAuth(makeRequest(), {
+            projectMembership: { projectId: "p1" },
+            allowAnyStatus: true,
+        })).rejects.toMatchObject({ code: "permission-denied" });
+    });
+    it("succeeds and sets isMember=true, isOwner=false when caller is in activeUserIds", async () => {
+        mockProjectGet.mockResolvedValue({
+            exists: true,
+            data: () => ({
+                projectId: "p1",
+                ownedBy: { uid: "owner-uid" },
+                activeUserIds: { "uid-123": true },
+                activeUsers: [],
+            }),
+        });
+        const ctx = await assertAuth(makeRequest(), {
+            projectMembership: { projectId: "p1" },
+            allowAnyStatus: true,
+        });
+        expect(ctx.project?.isMember).toBe(true);
+        expect(ctx.project?.isOwner).toBe(false);
+    });
+    it("succeeds when caller is in activeUsers array but not in activeUserIds", async () => {
+        mockProjectGet.mockResolvedValue({
+            exists: true,
+            data: () => ({
+                projectId: "p1",
+                ownedBy: { uid: "owner-uid" },
+                activeUserIds: {},
+                activeUsers: [{ uid: "uid-123" }],
+            }),
+        });
+        const ctx = await assertAuth(makeRequest(), {
+            projectMembership: { projectId: "p1" },
+            allowAnyStatus: true,
+        });
+        expect(ctx.project?.isMember).toBe(true);
+        expect(ctx.project?.isOwner).toBe(false);
+    });
+    it("succeeds and sets isOwner=true, isMember=true when caller is ownedBy.uid", async () => {
+        mockProjectGet.mockResolvedValue({
+            exists: true,
+            data: () => ({
+                projectId: "p1",
+                ownedBy: { uid: "uid-123" },
+                activeUserIds: {},
+                activeUsers: [],
+            }),
+        });
+        const ctx = await assertAuth(makeRequest(), {
+            projectMembership: { projectId: "p1" },
+            allowAnyStatus: true,
+        });
+        expect(ctx.project?.isOwner).toBe(true);
+        expect(ctx.project?.isMember).toBe(true);
+    });
+    it("throws permission-denied when role is owner but caller is only a member", async () => {
+        mockProjectGet.mockResolvedValue({
+            exists: true,
+            data: () => ({
+                projectId: "p1",
+                ownedBy: { uid: "owner-uid" },
+                activeUserIds: { "uid-123": true },
+                activeUsers: [],
+            }),
+        });
+        await expect(assertAuth(makeRequest(), {
+            projectMembership: { projectId: "p1", role: "owner" },
+            allowAnyStatus: true,
+        })).rejects.toMatchObject({ code: "permission-denied" });
+    });
+    it("succeeds when role is owner and caller is the owner", async () => {
+        mockProjectGet.mockResolvedValue({
+            exists: true,
+            data: () => ({
+                projectId: "p1",
+                ownedBy: { uid: "uid-123" },
+                activeUserIds: {},
+                activeUsers: [],
+            }),
+        });
+        const ctx = await assertAuth(makeRequest(), {
+            projectMembership: { projectId: "p1", role: "owner" },
+            allowAnyStatus: true,
+        });
+        expect(ctx.project?.isOwner).toBe(true);
+    });
+});
+describe("Admin check", () => {
+    it("propagates the error when requireAdmin throws", async () => {
+        mockRequireAdmin.mockRejectedValue(Object.assign(new Error("Administrator access required"), {
+            code: "permission-denied",
+        }));
+        await expect(assertAuth(makeRequest(), {
+            admin: { allowJrAdmin: false },
+            allowAnyStatus: true,
+        })).rejects.toMatchObject({ code: "permission-denied" });
+    });
+    it("succeeds and returns ctx when requireAdmin resolves", async () => {
+        mockRequireAdmin.mockResolvedValue(undefined);
+        const ctx = await assertAuth(makeRequest(), {
+            admin: { allowJrAdmin: true },
+            allowAnyStatus: true,
+        });
+        expect(ctx.uid).toBe("uid-123");
+        expect(mockRequireAdmin).toHaveBeenCalledWith("uid-123", expect.any(Object), { allowJrAdmin: true });
+    });
+});
+describe("Combined checks", () => {
+    it("fails on email check first when emailVerified and creator are both required but email is unverified", async () => {
+        await expect(assertAuth(makeRequest({ emailVerified: false }), {
+            emailVerified: true,
+            creator: true,
+        })).rejects.toMatchObject({
+            code: "failed-precondition",
+            message: expect.stringContaining("Email"),
+        });
+    });
+    it("fails with creator error when email is verified but user lacks creator status", async () => {
+        mockUserGet.mockResolvedValue({ exists: true, data: () => activeUserDoc });
+        await expect(assertAuth(makeRequest({ emailVerified: true }), {
+            emailVerified: true,
+            creator: true,
+        })).rejects.toMatchObject({
+            code: "failed-precondition",
+            message: expect.stringContaining("Creator"),
+        });
+    });
+    it("returns fully populated ctx when all checks pass", async () => {
+        mockUserGet.mockResolvedValue({ exists: true, data: () => creatorUserDoc });
+        mockProjectGet.mockResolvedValue({
+            exists: true,
+            data: () => ({
+                projectId: "p1",
+                ownedBy: { uid: "uid-123" },
+                activeUserIds: {},
+                activeUsers: [],
+            }),
+        });
+        mockRequireAdmin.mockResolvedValue(undefined);
+        const ctx = await assertAuth(makeRequest({ emailVerified: true }), {
+            emailVerified: true,
+            creator: true,
+            projectMembership: { projectId: "p1" },
+            admin: { allowJrAdmin: true },
+        });
+        expect(ctx.uid).toBe("uid-123");
+        expect(ctx.userDoc).toMatchObject({ creator: "creator-12345" });
+        expect(ctx.project?.isOwner).toBe(true);
+        expect(ctx.project?.isMember).toBe(true);
+        expect(mockRequireAdmin).toHaveBeenCalled();
+    });
+});
+describe("Parallelization", () => {
+    it("calls both user-doc and project-doc get() when both are needed", async () => {
+        mockUserGet.mockResolvedValue({ exists: true, data: () => creatorUserDoc });
+        mockProjectGet.mockResolvedValue({
+            exists: true,
+            data: () => memberProjectDoc("uid-123"),
+        });
+        await assertAuth(makeRequest(), {
+            creator: true,
+            projectMembership: { projectId: "p1" },
+            allowAnyStatus: true,
+        });
+        expect(mockUserGet).toHaveBeenCalledOnce();
+        expect(mockProjectGet).toHaveBeenCalledOnce();
+    });
+});
+//# sourceMappingURL=assertAuth.test.js.map

package/dist/server/assertAuth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertAuth.test.js","sourceRoot":"","sources":["../../src/server/assertAuth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,EAAE,CAAC,IAAI,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC1C,MAAM,UAAW,SAAQ,KAAK;QAC5B,IAAI,CAAS;QACb,YAAY,IAAY,EAAE,OAAe;YACvC,KAAK,CAAC,OAAO,CAAC,CAAC;YACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QAC3B,CAAC;KACF;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAiBnD,SAAS,WAAW,CAAC,IAAgD;IACnE,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,SAAS,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,EAAE;QACR,UAAU,EAAE,EAAE;QACd,IAAI,EAAE;YACJ,GAAG;YACH,KAAK,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,IAAI,IAAI,EAAE;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,aAAa,GAAa;IAC9B,GAAG,EAAE,SAAS;IACd,WAAW,EAAE,WAAW;IACxB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF,MAAM,cAAc,GAAa;IAC/B,GAAG,aAAa;IAChB,OAAO,EAAE,eAAe;CACzB,CAAC;AAEF,SAAS,gBAAgB,CAAC,SAAiB;IACzC,OAAO;QACL,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;QAC7B,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE;QACpC,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,IAAI,WAAqC,CAAC;AAC1C,IAAI,cAAwC,CAAC;AAC7C,IAAI,gBAA0C,CAAC;AAC/C,IAAI,SAAmC,CAAC;AACxC,IAAI,UAAsE,CAAC;AAE3E,UAAU,CAAC,GAAG,EAAE;IACd,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;IACrF,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;QACzC,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;KACxC,CAAC,CAAC;IACH,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IAE9C,SAAS,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,IAAY,EAAE,EAAE;QACjC,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,OAAO,aAAa,CAAC;QAC1D,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,SAAS,EAAS,CAAC;IAEzC,MAAM,MAAM,GAA4C;QACtD,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,GAAG,EAAE;QAC/C,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,SAAS,EAAE;QACtD,aAAa,EAAE,CAAC,IAAI,EAAc,EAAE;YAClC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9C,cAAc,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,GAAG;QAC9D,eAAe,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAChC,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,GAAG;YAC5B,OAAO,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI;YACrC,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;QACxD,YAAY,EAAE,gBAAuB;KACtC,CAAC;IAEF,UAAU,GAAG,gBAAgB,CAAwB,MAAM,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAE9E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAClE,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;YAChD,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE;YAC/C,aAAa,EAAE,IAAI;YACnB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;YAChD,aAAa,EAAE,IAAI;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5D,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACjD,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACjD,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc;SAC3B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE;YAC1C,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,WAAW,CAAC,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,8DAA8D;QAC9D,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,cAAc,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE;YACxB,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YACtC,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,cAAc,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;gBAC7B,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;gBACtC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;aAC1C,CAAC;SACH,CAAC,CAAC;QACH,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE;YACxB,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YACtC,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,cAAc,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;gBAC7B,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAClC,WAAW,EAAE,EAAE;aAChB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE;YAC1C,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YACtC,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,cAAc,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;gBAC7B,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAClC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE;YAC1C,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YACtC,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,cAAc,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;gBAC3B,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,EAAE;aAChB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE;YAC1C,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YACtC,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,cAAc,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE;gBAC7B,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAClC,WAAW,EAAE,EAAE;aAChB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE;YACxB,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;YACrD,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,cAAc,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;gBAC3B,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,EAAE;aAChB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE;YAC1C,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE;YACrD,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,gBAAgB,CAAC,iBAAiB,CAChC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;YACxD,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CACH,CAAC;QACF,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,EAAE,EAAE;YACxB,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE;YAC9B,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE;YAC1C,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;YAC7B,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,SAAS,EACT,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAClB,EAAE,YAAY,EAAE,IAAI,EAAE,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;YAChD,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,IAAI;SACd,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC3E,MAAM,MAAM,CACV,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE;YAC/C,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,IAAI;SACd,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5E,cAAc,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACX,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;gBAC3B,aAAa,EAAE,EAAE;gBACjB,WAAW,EAAE,EAAE;aAChB,CAAC;SACH,CAAC,CAAC;QACH,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE;YACjE,aAAa,EAAE,IAAI;YACnB,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YACtC,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC9B,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,WAAW,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5E,cAAc,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;SACxC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE;YAC9B,OAAO,EAAE,IAAI;YACb,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YACtC,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QAEH,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/index.d.ts

@@ -0,0 +1,3 @@
+export { createAssertAuth } from "./assertAuth.js";
+export type { AssertAuthConfig, AssertAuthFn, AuthContext, AuthRequirements, AdminCheckOptions, UserStatus, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,GACX,MAAM,YAAY,CAAC"}

package/dist/server/index.js

@@ -0,0 +1,5 @@
+// packages/auth-core/src/server/index.ts
+//
+// Public surface of @ttt-productions/auth-core/server.
+export { createAssertAuth } from "./assertAuth.js";
+//# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,uDAAuD;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/server/types.d.ts

@@ -0,0 +1,141 @@
+import type { CallableRequest } from "firebase-functions/v2/https";
+import type { DecodedIdToken } from "firebase-admin/auth";
+import type { Firestore } from "firebase-admin/firestore";
+/**
+ * Per-callable requirements passed at every assertAuth call site.
+ * These are application-agnostic.
+ */
+export interface AuthRequirements {
+    /**
+     * Allow unverified email. Default: false.
+     * If true, the emailVerified check is skipped entirely.
+     * Special-case for system flows (e.g. user registration).
+     */
+    allowUnverified?: boolean;
+    /**
+     * Require email_verified=true on the auth token.
+     * Default: false. Skipped when allowUnverified=true.
+     */
+    emailVerified?: boolean;
+    /**
+     * Require the user has creator status (config.isUserCreator(user) returns true).
+     * Default: false. Implies a Firestore read of the user doc.
+     */
+    creator?: boolean;
+    /**
+     * Require user status is not 'banned' or 'disabled'.
+     * Default: true (always enforced unless allowAnyStatus=true).
+     */
+    notBanned?: boolean;
+    /**
+     * Skip the not-banned check entirely. Special-case for flows where the
+     * user doc may not exist yet (e.g. user registration).
+     * Default: false.
+     */
+    allowAnyStatus?: boolean;
+    /**
+     * Allow banned users to pass the status check. Disabled users still fail.
+     * Use ONLY for callables that are a banned user's last recourse
+     * (e.g. admin-support chat).
+     * Default: false. Does NOT skip the existence check.
+     */
+    allowBanned?: boolean;
+    /**
+     * Require the caller is a member (or owner) of a given project.
+     * Reads the project doc via config.projectPath(projectId).
+     */
+    projectMembership?: {
+        projectId: string;
+        role?: "member" | "owner";
+    };
+    /**
+     * Require admin status. Delegates to config.requireAdmin().
+     * The shape of this object is forwarded verbatim to the consumer's
+     * requireAdmin callback — the package does not interpret it.
+     */
+    admin?: AdminCheckOptions;
+}
+/**
+ * Options forwarded to the consumer's requireAdmin callback. Generic shape.
+ * Consuming apps may add their own fields; the package does not validate.
+ */
+export interface AdminCheckOptions {
+    allowJrAdmin?: boolean;
+    useFastCheck?: boolean;
+    errorMessage?: string;
+    [key: string]: unknown;
+}
+/**
+ * Return value from assertAuth. Generic over the consuming app's user and
+ * project document types.
+ */
+export interface AuthContext<TUser = unknown, TProject = unknown> {
+    uid: string;
+    token: DecodedIdToken;
+    /** Populated when the user doc was read (creator OR default not-banned check). */
+    userDoc?: TUser;
+    /** Populated when projectMembership was checked. */
+    project?: {
+        data: TProject;
+        isOwner: boolean;
+        isMember: boolean;
+    };
+}
+/**
+ * Status the consuming app reports for a user doc. The package only
+ * interprets these three values.
+ */
+export type UserStatus = "ok" | "banned" | "disabled";
+/**
+ * Configuration for createAssertAuth. The consuming app supplies every
+ * TTT-specific (or Q-Sports-specific) operation as a callback.
+ */
+export interface AssertAuthConfig<TUser, TProject> {
+    /**
+     * Returns the admin Firestore instance. Called every assertAuth invocation
+     * that needs a Firestore read. Implementations typically return
+     * `admin.firestore()` from a memoized handle.
+     */
+    firestore: () => Firestore;
+    /**
+     * Returns the Firestore document path for a user profile, given a uid.
+     * Example (TTT): `userProfiles/${uid}`
+     */
+    userProfilePath: (uid: string) => string;
+    /**
+     * Returns the Firestore document path for a project, given a projectId.
+     * Example (TTT): `allProjects/${projectId}`
+     */
+    projectPath: (projectId: string) => string;
+    /**
+     * Returns the user's status given the user doc data. The package only
+     * acts on 'ok' | 'banned' | 'disabled'. Apps may store status in any
+     * field; this callback interprets it.
+     */
+    getUserStatus: (user: TUser) => UserStatus;
+    /**
+     * Returns true if the user is a creator. Called only when
+     * AuthRequirements.creator === true.
+     */
+    isUserCreator: (user: TUser) => boolean;
+    /**
+     * Returns true if the given uid is the owner of the project.
+     */
+    isProjectOwner: (project: TProject, uid: string) => boolean;
+    /**
+     * Returns true if the given uid is a member of the project. Owners are
+     * typically also members — the callback should reflect that.
+     */
+    isProjectMember: (project: TProject, uid: string) => boolean;
+    /**
+     * Admin check. Called only when AuthRequirements.admin is set. The
+     * package forwards uid, token, and the admin options verbatim. The
+     * callback throws (typically HttpsError) on failure.
+     */
+    requireAdmin: (uid: string, token: DecodedIdToken, options: AdminCheckOptions) => Promise<void>;
+}
+/**
+ * The function returned by createAssertAuth.
+ */
+export type AssertAuthFn<TUser, TProject> = (request: CallableRequest, requirements?: AuthRequirements) => Promise<AuthContext<TUser, TProject>>;
+//# sourceMappingURL=types.d.ts.map

package/dist/server/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB;;;OAGG;IACH,iBAAiB,CAAC,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;KAC3B,CAAC;IAEF;;;;OAIG;IACH,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,KAAK,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,cAAc,CAAC;IACtB,kFAAkF;IAClF,OAAO,CAAC,EAAE,KAAK,CAAC;IAChB,oDAAoD;IACpD,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,QAAQ,CAAC;QACf,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,EAAE,QAAQ;IAC/C;;;;OAIG;IACH,SAAS,EAAE,MAAM,SAAS,CAAC;IAE3B;;;OAGG;IACH,eAAe,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAEzC;;;OAGG;IACH,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAE3C;;;;OAIG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,UAAU,CAAC;IAE3C;;;OAGG;IACH,aAAa,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC;IAExC;;OAEG;IACH,cAAc,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAE5D;;;OAGG;IACH,eAAe,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAE7D;;;;OAIG;IACH,YAAY,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,IAAI,CAC1C,OAAO,EAAE,eAAe,EACxB,YAAY,CAAC,EAAE,gBAAgB,KAC5B,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC"}

package/dist/server/types.js

@@ -0,0 +1,7 @@
+// packages/auth-core/src/server/types.ts
+//
+// Types for the createAssertAuth factory. Fully generic over the consuming
+// app's user and project document shapes. The package contains no TTT- or
+// Q-Sports-specific knowledge.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/server/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/server/types.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,+BAA+B"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@ttt-productions/auth-core",
-    "version": "0.3.5",
+    "version": "0.4.1",
     "description": "Shared Firebase authentication utilities and React hooks for TTT Productions apps",
     "repository": {
         "type": "git",
@@ -23,6 +23,10 @@
         "./react": {
             "types": "./dist/react/index.d.ts",
             "default": "./dist/react/index.js"
+        },
+        "./server": {
+            "types": "./dist/server/index.d.ts",
+            "default": "./dist/server/index.js"
         }
     },
     "scripts": {
@@ -33,10 +37,21 @@
     },
     "peerDependencies": {
         "firebase": ">=10.0.0",
+        "firebase-admin": ">=10.0.0",
+        "firebase-functions": ">=4.0.0",
         "react": ">=19.0.0",
         "react-dom": ">=19.0.0"
     },
     "peerDependenciesMeta": {
+        "firebase": {
+            "optional": true
+        },
+        "firebase-admin": {
+            "optional": true
+        },
+        "firebase-functions": {
+            "optional": true
+        },
         "react": {
             "optional": true
         },
@@ -48,6 +63,8 @@
         "@types/react": "^19.0.0",
         "@types/react-dom": "^19.0.0",
         "firebase": "^10.0.0",
+        "firebase-admin": "^12.0.0",
+        "firebase-functions": "^7.0.0",
         "react": "^19.2.0",
         "react-dom": "^19.2.0",
         "typescript": "^5.8.3"