@ttt-productions/auth-core 1.6.15 → 1.6.17

package/dist/claims.d.ts

@@ -1,38 +0,0 @@
-import type { Auth, User, IdTokenResult } from "firebase/auth";
-export type IdTokenClaims = IdTokenResult["claims"];
-export type ParsedClaims = {
-    roles: string[];
-    raw: IdTokenClaims;
-};
-/**
- * Get the current user's ID token claims.
- * Returns null if no current user.
- *
- * STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is
- * verified but the cached token claim still says it is not, force-mint a fresh
- * token and return ITS claims. Firebase ID tokens live for up to an hour and a
- * backend-side `emailVerified` flip (verification link applied elsewhere, or an
- * Admin SDK update) never invalidates them — without this, the UI (account
- * state) believes the user is verified while every backend call (token claim)
- * rejects with "Email must be verified" until the token happens to rotate.
- * One forced mint converges the two (the fresh token carries
- * `email_verified: true`); the check is directional, so an already-consistent
- * user never pays a forced refresh.
- */
-export declare function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null>;
-/**
- * Forces refresh of ID token + claims.
- * Returns null if no current user.
- */
-export declare function refreshClaims(user: User | null): Promise<IdTokenClaims | null>;
-/**
- * Convenience helper when you only have Auth.
- */
-export declare function refreshClaimsFromAuth(auth: Auth): Promise<IdTokenClaims | null>;
-/**
- * Keep parsing intentionally minimal and generic:
- * - normalize "roles" into string[]
- * - keep raw claims attached
- */
-export declare function parseClaims(claims: IdTokenClaims | null | undefined): ParsedClaims;
-//# sourceMappingURL=claims.d.ts.map

package/dist/claims.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE/D,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IAEzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,GAAG,EAAE,aAAa,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAQvF;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAIpF;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAErF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAUlF"}

package/dist/claims.js

@@ -1,55 +0,0 @@
-/**
- * Get the current user's ID token claims.
- * Returns null if no current user.
- *
- * STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is
- * verified but the cached token claim still says it is not, force-mint a fresh
- * token and return ITS claims. Firebase ID tokens live for up to an hour and a
- * backend-side `emailVerified` flip (verification link applied elsewhere, or an
- * Admin SDK update) never invalidates them — without this, the UI (account
- * state) believes the user is verified while every backend call (token claim)
- * rejects with "Email must be verified" until the token happens to rotate.
- * One forced mint converges the two (the fresh token carries
- * `email_verified: true`); the check is directional, so an already-consistent
- * user never pays a forced refresh.
- */
-export async function getIdTokenClaims(user) {
-    if (!user)
-        return null;
-    const res = await user.getIdTokenResult(false);
-    if (user.emailVerified === true && res.claims.email_verified !== true) {
-        const fresh = await user.getIdTokenResult(true);
-        return fresh.claims;
-    }
-    return res.claims;
-}
-/**
- * Forces refresh of ID token + claims.
- * Returns null if no current user.
- */
-export async function refreshClaims(user) {
-    if (!user)
-        return null;
-    const res = await user.getIdTokenResult(true);
-    return res.claims;
-}
-/**
- * Convenience helper when you only have Auth.
- */
-export async function refreshClaimsFromAuth(auth) {
-    return refreshClaims(auth.currentUser);
-}
-/**
- * Keep parsing intentionally minimal and generic:
- * - normalize "roles" into string[]
- * - keep raw claims attached
- */
-export function parseClaims(claims) {
-    const raw = (claims ?? {});
-    const rolesValue = raw.roles;
-    const roles = Array.isArray(rolesValue) ? rolesValue.filter((x) => typeof x === "string") :
-        typeof rolesValue === "string" ? [rolesValue] :
-            [];
-    return { roles, raw };
-}
-//# sourceMappingURL=claims.js.map

package/dist/claims.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAiB;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAiB;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAU;IACpD,OAAO,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAwC;IAClE,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAkB,CAAC;IAE5C,MAAM,UAAU,GAAI,GAAW,CAAC,KAAK,CAAC;IACtC,MAAM,KAAK,GACT,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;QAC7E,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/C,EAAE,CAAC;IAEL,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import type { Auth, User, IdTokenResult } from \"firebase/auth\";\n\nexport type IdTokenClaims = IdTokenResult[\"claims\"];\n\nexport type ParsedClaims = {\n  // common defaults (kept generic)\n  roles: string[];\n  // raw claims for app-level decisions\n  raw: IdTokenClaims;\n};\n\n/**\n * Get the current user's ID token claims.\n * Returns null if no current user.\n *\n * STALE-VERIFICATION RECONCILIATION: when the ACCOUNT says the email is\n * verified but the cached token claim still says it is not, force-mint a fresh\n * token and return ITS claims. Firebase ID tokens live for up to an hour and a\n * backend-side `emailVerified` flip (verification link applied elsewhere, or an\n * Admin SDK update) never invalidates them — without this, the UI (account\n * state) believes the user is verified while every backend call (token claim)\n * rejects with \"Email must be verified\" until the token happens to rotate.\n * One forced mint converges the two (the fresh token carries\n * `email_verified: true`); the check is directional, so an already-consistent\n * user never pays a forced refresh.\n */\nexport async function getIdTokenClaims(user: User | null): Promise<IdTokenClaims | null> {\n  if (!user) return null;\n  const res = await user.getIdTokenResult(false);\n  if (user.emailVerified === true && res.claims.email_verified !== true) {\n    const fresh = await user.getIdTokenResult(true);\n    return fresh.claims;\n  }\n  return res.claims;\n}\n\n/**\n * Forces refresh of ID token + claims.\n * Returns null if no current user.\n */\nexport async function refreshClaims(user: User | null): Promise<IdTokenClaims | null> {\n  if (!user) return null;\n  const res = await user.getIdTokenResult(true);\n  return res.claims;\n}\n\n/**\n * Convenience helper when you only have Auth.\n */\nexport async function refreshClaimsFromAuth(auth: Auth): Promise<IdTokenClaims | null> {\n  return refreshClaims(auth.currentUser);\n}\n\n/**\n * Keep parsing intentionally minimal and generic:\n * - normalize \"roles\" into string[]\n * - keep raw claims attached\n */\nexport function parseClaims(claims: IdTokenClaims | null | undefined): ParsedClaims {\n  const raw = (claims ?? {}) as IdTokenClaims;\n\n  const rolesValue = (raw as any).roles;\n  const roles =\n    Array.isArray(rolesValue) ? rolesValue.filter((x) => typeof x === \"string\") :\n    typeof rolesValue === \"string\" ? [rolesValue] :\n    [];\n\n  return { roles, raw };\n}\n"]}

package/dist/client.d.ts

@@ -1,2 +0,0 @@
-export * from "./auth.js";
-//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,cAAc,WAAW,CAAC"}

package/dist/client.js

@@ -1,5 +0,0 @@
-// Firebase *client* auth runtime. Importing this subpath pulls firebase/auth
-// at runtime (e.g. onAuthStateChanged), so it is intentionally kept off the
-// pure root. The pure root exposes only contracts/config/errors.
-export * from "./auth.js";
-//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,iEAAiE;AACjE,cAAc,WAAW,CAAC","sourcesContent":["// Firebase *client* auth runtime. Importing this subpath pulls firebase/auth\n// at runtime (e.g. onAuthStateChanged), so it is intentionally kept off the\n// pure root. The pure root exposes only contracts/config/errors.\nexport * from \"./auth.js\";\n"]}