@versini/auth0-auth-js-stub 1.0.0 → 1.2.0

package/README.md

@@ -7,9 +7,16 @@ first-paint weight) and powers only the **MFA / Passkey / MyAccount / DPoP** API
 your app uses only basic Auth0 login (`loginWithRedirect`, `getAccessTokenSilently`,
 `logout`, `isAuthenticated`, `user`), that weight is dead code.
 
-This stub satisfies the symbols `@auth0/auth0-spa-js` imports at runtime. `AuthClient`
-constructs without throwing (it runs on every login), and any MFA/Passkey method call
-throws a clear, actionable error.
+This stub satisfies the symbols `@auth0/auth0-spa-js` imports or re-exports at runtime.
+`AuthClient` constructs without throwing (it runs on every login). Any MFA, Passkey, or
+anonymous-session method call throws a clear, actionable error, and `isFederatedDomain`
+returns a promise that rejects with one. The exception is `anonymous.mintTransferToken`:
+it resolves `null`. spa-js 2.28 calls it at login whenever a stored anonymous session token
+exists (one left by an earlier non-thin deployment), and the stub never has a session to link.
+
+> ⚠️ Do not set `createAnonymousSessionOnFailedSilentAuth` with this stub. spa-js 2.27
+> calls the anonymous client from `checkSession` when that option is on and swallows the
+> stub's error in a `try/catch`, so the fallback silently does nothing.
 
 ## Usage
 

package/index.cjs

@@ -7,20 +7,38 @@ const notSupported = feature => () => {
   );
 };
 
-const throwingClient = label =>
+// `methods` are the few sub-client calls spa-js makes on a core path; every
+// other property is a throwing function.
+const throwingClient = (label, methods = {}) =>
   new Proxy(
     {},
-    { get: (_t, prop) => notSupported(`${label}.${String(prop)}`) }
+    {
+      get: (_t, prop) =>
+        Object.prototype.hasOwnProperty.call(methods, prop)
+          ? methods[prop]
+          : notSupported(`${label}.${String(prop)}`)
+    }
   );
 
 class AuthClient {
   constructor(_options) {
     this.mfa = throwingClient('mfa');
     this.passkey = throwingClient('passkey');
+    // On every login spa-js 2.28 asks its anonymous wrapper for a transfer token,
+    // and the wrapper calls this whenever a stored anonymous session token exists
+    // (one left by an earlier non-thin deployment). This stub can never create
+    // such a session, so there is nothing to link: resolve null, never throw.
+    this.anonymous = throwingClient('anonymous', { mintTransferToken: async () => null });
   }
 }
 
 class MfaClient {}
+class AnonymousSessionClient {}
+
+// Enterprise Connect domain discovery. spa-js wraps it in its own exported
+// isFederatedDomain, which only the app calls. Async upstream, so reject
+// rather than throw.
+const isFederatedDomain = async (..._args) => notSupported('isFederatedDomain')();
 
 class StubError extends Error {
   constructor(code, message) {
@@ -65,14 +83,23 @@ class PasskeyGetTokenError extends StubError {
     this.name = 'PasskeyGetTokenError';
   }
 }
+class AnonymousSessionError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'AnonymousSessionError';
+  }
+}
 
 module.exports = {
   AuthClient,
   MfaClient,
+  AnonymousSessionClient,
+  isFederatedDomain,
   MfaListAuthenticatorsError,
   MfaEnrollmentError,
   MfaChallengeError,
   PasskeyRegisterError,
   PasskeyChallengeError,
-  PasskeyGetTokenError
+  PasskeyGetTokenError,
+  AnonymousSessionError
 };

package/index.d.ts

@@ -1,14 +1,23 @@
 // Type stub for @auth0/auth0-auth-js — permissive shapes for the symbols the
-// @auth0/auth0-spa-js typings reference. MFA/Passkey are not used in this app.
+// @auth0/auth0-spa-js typings reference. MFA/Passkey/anonymous sessions and
+// Enterprise Connect domain discovery are not used in this app.
 
 export declare class AuthClient {
   constructor(options?: unknown);
   mfa: any;
   passkey: any;
+  anonymous: any;
 }
 
 export declare class MfaClient {}
 export declare class PasskeyClient {}
+export declare class AnonymousSessionClient {}
+
+export declare function isFederatedDomain(
+  auth0Domain: string,
+  emailDomain: string,
+  options?: unknown
+): Promise<boolean>;
 
 export declare class MfaListAuthenticatorsError extends Error {
   code?: string;
@@ -28,6 +37,9 @@ export declare class PasskeyChallengeError extends Error {
 export declare class PasskeyGetTokenError extends Error {
   code?: string;
 }
+export declare class AnonymousSessionError extends Error {
+  code?: string;
+}
 
 export type MfaApiErrorResponse = any;
 export type PasskeyCreationOptions = any;
@@ -37,3 +49,9 @@ export type PasskeyLoginChallengeResponse = any;
 export type PasskeyRequestOptions = any;
 export type PasskeySignupChallengeOptions = any;
 export type PasskeySignupChallengeResponse = any;
+export type AnonymousSession = any;
+export type AnonymousSessionClaims = any;
+export type AnonymousSessionErrorCode = any;
+export type CreateAnonymousSessionOptions = any;
+export type GetAnonymousAccessTokenOptions = any;
+export type IsFederatedDomainOptions = any;

package/index.js

@@ -1,13 +1,15 @@
 // Featherweight stub of @auth0/auth0-auth-js (ESM).
 //
-// This app does not use Auth0 MFA or Passkey flows. The real package pulls in
+// This app does not use Auth0 MFA, Passkey, anonymous-session or Enterprise
+// Connect domain-discovery flows. The real package pulls in
 // openid-client + oauth4webapi + jose (~26KB gzip of first-paint weight). It is
 // swapped for this stub via pnpm overrides so that weight never ships.
 //
 // The forked @auth0/auth0-spa-js build (external: ['@auth0/auth0-auth-js'])
-// statically imports exactly these symbols; this stub satisfies them at runtime.
+// statically imports or re-exports exactly these symbols; this stub satisfies
+// them at runtime.
 // `new AuthClient()` runs on every Auth0Client construction, so it must not throw
-// — only the (unused) MFA/Passkey method calls do.
+// — only the (unused) MFA/Passkey/anonymous-session method calls do.
 
 const notSupported = feature => () => {
   throw new Error(
@@ -16,20 +18,38 @@ const notSupported = feature => () => {
   );
 };
 
-const throwingClient = label =>
+// `methods` are the few sub-client calls spa-js makes on a core path; every
+// other property is a throwing function.
+const throwingClient = (label, methods = {}) =>
   new Proxy(
     {},
-    { get: (_t, prop) => notSupported(`${label}.${String(prop)}`) }
+    {
+      get: (_t, prop) =>
+        Object.prototype.hasOwnProperty.call(methods, prop)
+          ? methods[prop]
+          : notSupported(`${label}.${String(prop)}`)
+    }
   );
 
 export class AuthClient {
   constructor(_options) {
     this.mfa = throwingClient('mfa');
     this.passkey = throwingClient('passkey');
+    // On every login spa-js 2.28 asks its anonymous wrapper for a transfer token,
+    // and the wrapper calls this whenever a stored anonymous session token exists
+    // (one left by an earlier non-thin deployment). This stub can never create
+    // such a session, so there is nothing to link: resolve null, never throw.
+    this.anonymous = throwingClient('anonymous', { mintTransferToken: async () => null });
   }
 }
 
 export class MfaClient {}
+export class AnonymousSessionClient {}
+
+// Enterprise Connect domain discovery. spa-js wraps it in its own exported
+// isFederatedDomain, which only the app calls. Async upstream, so reject
+// rather than throw.
+export const isFederatedDomain = async (..._args) => notSupported('isFederatedDomain')();
 
 class StubError extends Error {
   constructor(code, message) {
@@ -74,3 +94,9 @@ export class PasskeyGetTokenError extends StubError {
     this.name = 'PasskeyGetTokenError';
   }
 }
+export class AnonymousSessionError extends StubError {
+  constructor(c, m) {
+    super(c, m);
+    this.name = 'AnonymousSessionError';
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@versini/auth0-auth-js-stub",
-  "version": "1.0.0",
-  "description": "Featherweight no-op stub of @auth0/auth0-auth-js for apps that use only basic Auth0 login (no MFA/Passkey/MyAccount/DPoP). Consumed via a pnpm `npm:` alias override to drop ~26KB gzip (openid-client + oauth4webapi + jose) from first paint. See @versini/auth0-thin.",
+  "version": "1.2.0",
+  "description": "Featherweight no-op stub of @auth0/auth0-auth-js for apps that use only basic Auth0 login (no MFA/Passkey/anonymous sessions/MyAccount/DPoP). Consumed via a pnpm `npm:` alias override to drop ~26KB gzip (openid-client + oauth4webapi + jose) from first paint. See @versini/auth0-thin.",
   "type": "module",
   "main": "./index.cjs",
   "module": "./index.js",