@ttt-productions/auth-core 1.6.4 → 1.6.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/errors.d.ts +1 -1
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +11 -0
- package/dist/errors.js.map +1 -1
- package/dist/server/authError.d.ts +1 -1
- package/dist/server/authError.js.map +1 -1
- package/package.json +1 -1
package/dist/errors.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export type AuthErrorCode = "AUTH_UNKNOWN" | "AUTH_NETWORK_ERROR" | "AUTH_TOO_MANY_REQUESTS" | "AUTH_POPUP_CLOSED" | "AUTH_POPUP_BLOCKED" | "AUTH_CANCELLED" | "AUTH_USER_DISABLED" | "AUTH_USER_NOT_FOUND" | "AUTH_WRONG_PASSWORD" | "AUTH_INVALID_EMAIL" | "AUTH_EMAIL_ALREADY_IN_USE" | "AUTH_WEAK_PASSWORD" | "AUTH_REQUIRES_RECENT_LOGIN" | "AUTH_INVALID_CREDENTIAL" | "AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL" | "AUTH_PROVIDER_ALREADY_LINKED" | "AUTH_CREDENTIAL_ALREADY_IN_USE";
|
|
1
|
+
export type AuthErrorCode = "AUTH_UNKNOWN" | "AUTH_NETWORK_ERROR" | "AUTH_TOO_MANY_REQUESTS" | "AUTH_POPUP_CLOSED" | "AUTH_POPUP_BLOCKED" | "AUTH_CANCELLED" | "AUTH_USER_DISABLED" | "AUTH_USER_NOT_FOUND" | "AUTH_WRONG_PASSWORD" | "AUTH_INVALID_EMAIL" | "AUTH_EMAIL_ALREADY_IN_USE" | "AUTH_WEAK_PASSWORD" | "AUTH_REQUIRES_RECENT_LOGIN" | "AUTH_INVALID_CREDENTIAL" | "AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL" | "AUTH_PROVIDER_ALREADY_LINKED" | "AUTH_CREDENTIAL_ALREADY_IN_USE" | "AUTH_EXPIRED_ACTION_CODE" | "AUTH_INVALID_ACTION_CODE";
|
|
2
2
|
export type NormalizedAuthError = {
|
|
3
3
|
code: AuthErrorCode;
|
|
4
4
|
message: string;
|
package/dist/errors.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,oBAAoB,GACpB,wBAAwB,GACxB,mBAAmB,GACnB,oBAAoB,GACpB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,+CAA+C,GAC/C,8BAA8B,GAC9B,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,oBAAoB,GACpB,wBAAwB,GACxB,mBAAmB,GACnB,oBAAoB,GACpB,gBAAgB,GAChB,oBAAoB,GACpB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,+CAA+C,GAC/C,8BAA8B,GAC9B,gCAAgC,GAChC,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAwFF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,mBAAmB,CAyBvG;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}
|
package/dist/errors.js
CHANGED
|
@@ -69,6 +69,17 @@ const MAP = {
|
|
|
69
69
|
"auth/credential-already-in-use": {
|
|
70
70
|
code: "AUTH_CREDENTIAL_ALREADY_IN_USE",
|
|
71
71
|
message: "Those credentials are already associated with another account."
|
|
72
|
+
},
|
|
73
|
+
// Email-action (oobCode) links — password reset, email verification, email recovery.
|
|
74
|
+
// The copy is deliberately generic: it never reveals whether an account exists, and it
|
|
75
|
+
// always points at the one recovery affordance (request a fresh link).
|
|
76
|
+
"auth/expired-action-code": {
|
|
77
|
+
code: "AUTH_EXPIRED_ACTION_CODE",
|
|
78
|
+
message: "This email action link has expired. Request a new link and try again."
|
|
79
|
+
},
|
|
80
|
+
"auth/invalid-action-code": {
|
|
81
|
+
code: "AUTH_INVALID_ACTION_CODE",
|
|
82
|
+
message: "This email action link is invalid or has already been used. Request a new link and try again."
|
|
72
83
|
}
|
|
73
84
|
};
|
|
74
85
|
export function normalizeAuthError(err, details) {
|
package/dist/errors.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA4BA,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,MAAM,GAAG,GAAU,CAAC;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,GAAG,GAA6D;IACpE,6BAA6B,EAAE;QAC7B,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,4DAA4D;KACtE;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EAAE,wDAAwD;KAClE;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,2BAA2B;KACrC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,2CAA2C;KACrD;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,wBAAwB;KAClC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,iCAAiC;KAC3C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,mCAAmC;KAC7C;IACD,qBAAqB,EAAE;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,qBAAqB;KAC/B;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,wBAAwB;KAClC;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+BAA+B;KACzC;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,uBAAuB;KACjC;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uCAAuC;KACjD;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,wCAAwC;KAClD;IACD,+CAA+C,EAAE;QAC/C,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,4DAA4D;KACtE;IACD,8BAA8B,EAAE;QAC9B,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,kDAAkD;KAC5D;IACD,gCAAgC,EAAE;QAChC,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,gEAAgE;KAC1E;IACD,qFAAqF;IACrF,uFAAuF;IACvF,uEAAuE;IACvE,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,uEAAuE;KACjF;IACD,0BAA0B,EAAE;QAC1B,IAAI,EAAE,0BAA0B;QAChC,OAAO,EACL,+FAA+F;KAClG;CACF,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,OAAiC;IAChF,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY;YACZ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,MAAM,GAAG,GACP,OAAQ,GAAW,EAAE,OAAO,KAAK,QAAQ;QACvC,CAAC,CAAE,GAAW,CAAC,OAAO;QACtB,CAAC,CAAC,yCAAyC,CAAC;IAEhD,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,GAAG;QACZ,YAAY;QACZ,OAAO;KACR,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC","sourcesContent":["export type AuthErrorCode =\n | \"AUTH_UNKNOWN\"\n | \"AUTH_NETWORK_ERROR\"\n | \"AUTH_TOO_MANY_REQUESTS\"\n | \"AUTH_POPUP_CLOSED\"\n | \"AUTH_POPUP_BLOCKED\"\n | \"AUTH_CANCELLED\"\n | \"AUTH_USER_DISABLED\"\n | \"AUTH_USER_NOT_FOUND\"\n | \"AUTH_WRONG_PASSWORD\"\n | \"AUTH_INVALID_EMAIL\"\n | \"AUTH_EMAIL_ALREADY_IN_USE\"\n | \"AUTH_WEAK_PASSWORD\"\n | \"AUTH_REQUIRES_RECENT_LOGIN\"\n | \"AUTH_INVALID_CREDENTIAL\"\n | \"AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL\"\n | \"AUTH_PROVIDER_ALREADY_LINKED\"\n | \"AUTH_CREDENTIAL_ALREADY_IN_USE\"\n | \"AUTH_EXPIRED_ACTION_CODE\"\n | \"AUTH_INVALID_ACTION_CODE\";\n\nexport type NormalizedAuthError = {\n code: AuthErrorCode;\n message: string;\n firebaseCode?: string;\n details?: Record<string, unknown>;\n};\n\nfunction pickFirebaseCode(err: unknown): string | undefined {\n if (!err || typeof err !== \"object\") return undefined;\n const anyErr = err as any;\n const c = anyErr.code;\n return typeof c === \"string\" ? c : undefined;\n}\n\nconst MAP: Record<string, { code: AuthErrorCode; message: string }> = {\n \"auth/network-request-failed\": {\n code: \"AUTH_NETWORK_ERROR\",\n message: \"Network error. Please check your connection and try again.\"\n },\n \"auth/too-many-requests\": {\n code: \"AUTH_TOO_MANY_REQUESTS\",\n message: \"Too many attempts. Please wait a moment and try again.\"\n },\n \"auth/popup-closed-by-user\": {\n code: \"AUTH_POPUP_CLOSED\",\n message: \"Sign-in popup was closed.\"\n },\n \"auth/popup-blocked\": {\n code: \"AUTH_POPUP_BLOCKED\",\n message: \"Sign-in popup was blocked by the browser.\"\n },\n \"auth/cancelled-popup-request\": {\n code: \"AUTH_CANCELLED\",\n message: \"Sign-in was cancelled.\"\n },\n \"auth/user-disabled\": {\n code: \"AUTH_USER_DISABLED\",\n message: \"This account has been disabled.\"\n },\n \"auth/user-not-found\": {\n code: \"AUTH_USER_NOT_FOUND\",\n message: \"No account found with that email.\"\n },\n \"auth/wrong-password\": {\n code: \"AUTH_WRONG_PASSWORD\",\n message: \"Incorrect password.\"\n },\n \"auth/invalid-email\": {\n code: \"AUTH_INVALID_EMAIL\",\n message: \"Invalid email address.\"\n },\n \"auth/email-already-in-use\": {\n code: \"AUTH_EMAIL_ALREADY_IN_USE\",\n message: \"That email is already in use.\"\n },\n \"auth/weak-password\": {\n code: \"AUTH_WEAK_PASSWORD\",\n message: \"Password is too weak.\"\n },\n \"auth/requires-recent-login\": {\n code: \"AUTH_REQUIRES_RECENT_LOGIN\",\n message: \"Please re-authenticate and try again.\"\n },\n \"auth/invalid-credential\": {\n code: \"AUTH_INVALID_CREDENTIAL\",\n message: \"Invalid credentials. Please try again.\"\n },\n \"auth/account-exists-with-different-credential\": {\n code: \"AUTH_ACCOUNT_EXISTS_WITH_DIFFERENT_CREDENTIAL\",\n message: \"An account already exists with a different sign-in method.\"\n },\n \"auth/provider-already-linked\": {\n code: \"AUTH_PROVIDER_ALREADY_LINKED\",\n message: \"That provider is already linked to this account.\"\n },\n \"auth/credential-already-in-use\": {\n code: \"AUTH_CREDENTIAL_ALREADY_IN_USE\",\n message: \"Those credentials are already associated with another account.\"\n },\n // Email-action (oobCode) links — password reset, email verification, email recovery.\n // The copy is deliberately generic: it never reveals whether an account exists, and it\n // always points at the one recovery affordance (request a fresh link).\n \"auth/expired-action-code\": {\n code: \"AUTH_EXPIRED_ACTION_CODE\",\n message: \"This email action link has expired. Request a new link and try again.\"\n },\n \"auth/invalid-action-code\": {\n code: \"AUTH_INVALID_ACTION_CODE\",\n message:\n \"This email action link is invalid or has already been used. Request a new link and try again.\"\n }\n};\n\nexport function normalizeAuthError(err: unknown, details?: Record<string, unknown>): NormalizedAuthError {\n const firebaseCode = pickFirebaseCode(err);\n\n const mapped = firebaseCode ? MAP[firebaseCode] : undefined;\n if (mapped) {\n return {\n code: mapped.code,\n message: mapped.message,\n firebaseCode,\n details\n };\n }\n\n // best-effort message (don’t leak weird objects)\n const msg =\n typeof (err as any)?.message === \"string\"\n ? (err as any).message\n : \"Authentication error. Please try again.\";\n\n return {\n code: \"AUTH_UNKNOWN\",\n message: msg,\n firebaseCode,\n details\n };\n}\n\n/** Convenience: returns just the user-facing message string */\nexport function getErrorMessage(error: unknown): string {\n return normalizeAuthError(error).message;\n}\n"]}
|
|
@@ -30,7 +30,7 @@
|
|
|
30
30
|
* APP module space fixes the identity permanently and cannot regress when
|
|
31
31
|
* firebase-functions repackages.
|
|
32
32
|
*
|
|
33
|
-
* This also brings auth-core in line with
|
|
33
|
+
* This also brings auth-core in line with engineering-rules QUALITY-102 (generic
|
|
34
34
|
* packages stay framework-agnostic; the TTT-side adapter binds the framework) and
|
|
35
35
|
* mirrors `report-core`'s `ReportCoreTaskError`, which already works this way.
|
|
36
36
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authError.js","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AA0CA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAEtC,YAAY,IAA4B,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF","sourcesContent":["/**\n * Typed failure channel for `createAssertAuth`.\n *\n * Every EXPECTED auth outcome (not signed in, email unverified, missing profile,\n * account not in good standing) throws an `AuthAssertionError` whose `code` is\n * deliberately the matching `HttpsError` code string, so a consuming Cloud\n * Function maps it 1:1 at the app boundary:\n *\n * catch (err) {\n * if (err instanceof AuthAssertionError) throw new HttpsError(err.code, err.message);\n * throw err;\n * }\n *\n * WHY THE PACKAGE MUST NOT BUILD THE HttpsError ITSELF (2026-07-20, live on hosted\n * dev): firebase-functions 7.2.5 ships TWO distinct `HttpsError` classes — the one\n * exported from the ESM entry `firebase-functions/v2/https`, and the one the CJS\n * callable runtime closes over and `instanceof`-checks at\n * `lib/common/providers/https.js`. An `HttpsError` constructed by this package's\n * ESM `dist` fails that identity check, so `onCall` logged \"Unhandled error\" and\n * replaced a correct 400 with `500 INTERNAL`. Measured:\n *\n * ESM class === CJS class ? false\n * esm-built error instanceof CJS class ? false\n * httpErrorCode.status: 400 (the error itself was correct)\n *\n * Because `assertAuth` is the first line of every callable, that turned EVERY auth\n * rejection — unauthenticated, unverified email, suspended, banned — into a generic\n * 500: users saw \"An Error Occurred\" instead of the verify-email dialog, and Sentry\n * filled with 500s that were really expected answers. Constructing the HttpsError in\n * APP module space fixes the identity permanently and cannot regress when\n * firebase-functions repackages.\n *\n * This also brings auth-core in line with
|
|
1
|
+
{"version":3,"file":"authError.js","sourceRoot":"","sources":["../../src/server/authError.ts"],"names":[],"mappings":"AA0CA,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAEtC,YAAY,IAA4B,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF","sourcesContent":["/**\n * Typed failure channel for `createAssertAuth`.\n *\n * Every EXPECTED auth outcome (not signed in, email unverified, missing profile,\n * account not in good standing) throws an `AuthAssertionError` whose `code` is\n * deliberately the matching `HttpsError` code string, so a consuming Cloud\n * Function maps it 1:1 at the app boundary:\n *\n * catch (err) {\n * if (err instanceof AuthAssertionError) throw new HttpsError(err.code, err.message);\n * throw err;\n * }\n *\n * WHY THE PACKAGE MUST NOT BUILD THE HttpsError ITSELF (2026-07-20, live on hosted\n * dev): firebase-functions 7.2.5 ships TWO distinct `HttpsError` classes — the one\n * exported from the ESM entry `firebase-functions/v2/https`, and the one the CJS\n * callable runtime closes over and `instanceof`-checks at\n * `lib/common/providers/https.js`. An `HttpsError` constructed by this package's\n * ESM `dist` fails that identity check, so `onCall` logged \"Unhandled error\" and\n * replaced a correct 400 with `500 INTERNAL`. Measured:\n *\n * ESM class === CJS class ? false\n * esm-built error instanceof CJS class ? false\n * httpErrorCode.status: 400 (the error itself was correct)\n *\n * Because `assertAuth` is the first line of every callable, that turned EVERY auth\n * rejection — unauthenticated, unverified email, suspended, banned — into a generic\n * 500: users saw \"An Error Occurred\" instead of the verify-email dialog, and Sentry\n * filled with 500s that were really expected answers. Constructing the HttpsError in\n * APP module space fixes the identity permanently and cannot regress when\n * firebase-functions repackages.\n *\n * This also brings auth-core in line with engineering-rules QUALITY-102 (generic\n * packages stay framework-agnostic; the TTT-side adapter binds the framework) and\n * mirrors `report-core`'s `ReportCoreTaskError`, which already works this way.\n */\nexport type AuthAssertionErrorCode =\n | \"unauthenticated\"\n | \"failed-precondition\"\n | \"not-found\"\n | \"permission-denied\";\n\nexport class AuthAssertionError extends Error {\n readonly code: AuthAssertionErrorCode;\n\n constructor(code: AuthAssertionErrorCode, message: string) {\n super(message);\n this.name = \"AuthAssertionError\";\n this.code = code;\n }\n}\n"]}
|