@ttt-productions/auth-core 1.6.1 → 1.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/claims.d.ts +11 -0
- package/dist/claims.d.ts.map +1 -1
- package/dist/claims.js +15 -0
- package/dist/claims.js.map +1 -1
- package/package.json +1 -1
package/dist/claims.d.ts
CHANGED
|
@@ -7,6 +7,17 @@ export type ParsedClaims = {
|
|
|
7
7
|
/**
|
|
8
8
|
* Get the current user's ID token claims.
|
|
9
9
|
* Returns null if no current user.
|
|
10
|
+
*
|
|
11
|
+
* STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is
|
|
12
|
+
* verified but the cached token claim still says it is not, force-mint a fresh
|
|
13
|
+
* token and return ITS claims. Firebase ID tokens live for up to an hour and a
|
|
14
|
+
* backend-side `emailVerified` flip (verification link applied elsewhere, or an
|
|
15
|
+
* Admin SDK update) never invalidates them — without this, the UI (account
|
|
16
|
+
* state) believes the user is verified while every backend call (token claim)
|
|
17
|
+
* rejects with "Email must be verified" until the token happens to rotate.
|
|
18
|
+
* One forced mint converges the two (the fresh token carries
|
|
19
|
+
* `email_verified: true`); the check is directional, so an already-consistent
|
|
20
|
+
* user never pays a forced refresh.
|
|
10
21
|
*/
|
|
11
22
|
export declare function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null>;
|
|
12
23
|
/**
|
package/dist/claims.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE/D,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IAEzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,GAAG,EAAE,aAAa,CAAC;CACpB,CAAC;AAEF
|
|
1
|
+
{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE/D,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IAEzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,GAAG,EAAE,aAAa,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAQvF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAIpF;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAUlF"}
|
package/dist/claims.js
CHANGED
|
@@ -1,11 +1,26 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Get the current user's ID token claims.
|
|
3
3
|
* Returns null if no current user.
|
|
4
|
+
*
|
|
5
|
+
* STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is
|
|
6
|
+
* verified but the cached token claim still says it is not, force-mint a fresh
|
|
7
|
+
* token and return ITS claims. Firebase ID tokens live for up to an hour and a
|
|
8
|
+
* backend-side `emailVerified` flip (verification link applied elsewhere, or an
|
|
9
|
+
* Admin SDK update) never invalidates them — without this, the UI (account
|
|
10
|
+
* state) believes the user is verified while every backend call (token claim)
|
|
11
|
+
* rejects with "Email must be verified" until the token happens to rotate.
|
|
12
|
+
* One forced mint converges the two (the fresh token carries
|
|
13
|
+
* `email_verified: true`); the check is directional, so an already-consistent
|
|
14
|
+
* user never pays a forced refresh.
|
|
4
15
|
*/
|
|
5
16
|
export async function getIdTokenClaims(user) {
|
|
6
17
|
if (!user)
|
|
7
18
|
return null;
|
|
8
19
|
const res = await user.getIdTokenResult(false);
|
|
20
|
+
if (user.emailVerified === true && res.claims.email_verified !== true) {
|
|
21
|
+
const fresh = await user.getIdTokenResult(true);
|
|
22
|
+
return fresh.claims;
|
|
23
|
+
}
|
|
9
24
|
return res.claims;
|
|
10
25
|
}
|
|
11
26
|
/**
|
package/dist/claims.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAWA
|
|
1
|
+
{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAiB;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAU;IACpD,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAwC;IAClE,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAkB,CAAC;IAE5C,MAAM,UAAU,GAAI,GAAW,CAAC,KAAK,CAAC;IACtC,MAAM,KAAK,GACT,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;QAC7E,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/C,EAAE,CAAC;IAEL,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import type { Auth, User, IdTokenResult } from \"firebase/auth\";\n\nexport type IdTokenClaims = IdTokenResult[\"claims\"];\n\nexport type ParsedClaims = {\n // common defaults (kept generic)\n roles: string[];\n // raw claims for app-level decisions\n raw: IdTokenClaims;\n};\n\n/**\n * Get the current user's ID token claims.\n * Returns null if no current user.\n *\n * STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is\n * verified but the cached token claim still says it is not, force-mint a fresh\n * token and return ITS claims. Firebase ID tokens live for up to an hour and a\n * backend-side `emailVerified` flip (verification link applied elsewhere, or an\n * Admin SDK update) never invalidates them — without this, the UI (account\n * state) believes the user is verified while every backend call (token claim)\n * rejects with \"Email must be verified\" until the token happens to rotate.\n * One forced mint converges the two (the fresh token carries\n * `email_verified: true`); the check is directional, so an already-consistent\n * user never pays a forced refresh.\n */\nexport async function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null> {\n if (!user) return null;\n const res = await user.getIdTokenResult(false);\n if (user.emailVerified === true && res.claims.email_verified !== true) {\n const fresh = await user.getIdTokenResult(true);\n return fresh.claims;\n }\n return res.claims;\n}\n\n/**\n * Forces refresh of ID token + claims.\n * Returns null if no current user.\n */\nexport async function refreshClaims(user: User | null): Promise<IdTokenClaims | null> {\n if (!user) return null;\n const res = await user.getIdTokenResult(true);\n return res.claims;\n}\n\n/**\n * Convenience helper when you only have Auth.\n */\nexport async function refreshClaimsFromAuth(auth: Auth): Promise<IdTokenClaims | null> {\n return refreshClaims(auth.currentUser);\n}\n\n/**\n * Keep parsing intentionally minimal and generic:\n * - normalize \"roles\" into string[]\n * - keep raw claims attached\n */\nexport function parseClaims(claims: IdTokenClaims | null | undefined): ParsedClaims {\n const raw = (claims ?? {}) as IdTokenClaims;\n\n const rolesValue = (raw as any).roles;\n const roles =\n Array.isArray(rolesValue) ? rolesValue.filter((x) => typeof x === \"string\") :\n typeof rolesValue === \"string\" ? [rolesValue] :\n [];\n\n return { roles, raw };\n}\n"]}
|