@versini/auth0-auth-js-stub 1.1.0 → 1.2.0

package/README.md

@@ -10,7 +10,9 @@ your app uses only basic Auth0 login (`loginWithRedirect`, `getAccessTokenSilent
 This stub satisfies the symbols `@auth0/auth0-spa-js` imports or re-exports at runtime.
 `AuthClient` constructs without throwing (it runs on every login). Any MFA, Passkey, or
 anonymous-session method call throws a clear, actionable error, and `isFederatedDomain`
-returns a promise that rejects with one.
+returns a promise that rejects with one. The exception is `anonymous.mintTransferToken`:
+it resolves `null`. spa-js 2.28 calls it at login whenever a stored anonymous session token
+exists (one left by an earlier non-thin deployment), and the stub never has a session to link.
 
 > ⚠️ Do not set `createAnonymousSessionOnFailedSilentAuth` with this stub. spa-js 2.27
 > calls the anonymous client from `checkSession` when that option is on and swallows the

package/index.cjs

@@ -7,17 +7,28 @@ const notSupported = feature => () => {
   );
 };
 
-const throwingClient = label =>
+// `methods` are the few sub-client calls spa-js makes on a core path; every
+// other property is a throwing function.
+const throwingClient = (label, methods = {}) =>
   new Proxy(
     {},
-    { get: (_t, prop) => notSupported(`${label}.${String(prop)}`) }
+    {
+      get: (_t, prop) =>
+        Object.prototype.hasOwnProperty.call(methods, prop)
+          ? methods[prop]
+          : notSupported(`${label}.${String(prop)}`)
+    }
   );
 
 class AuthClient {
   constructor(_options) {
     this.mfa = throwingClient('mfa');
     this.passkey = throwingClient('passkey');
-    this.anonymous = throwingClient('anonymous');
+    // On every login spa-js 2.28 asks its anonymous wrapper for a transfer token,
+    // and the wrapper calls this whenever a stored anonymous session token exists
+    // (one left by an earlier non-thin deployment). This stub can never create
+    // such a session, so there is nothing to link: resolve null, never throw.
+    this.anonymous = throwingClient('anonymous', { mintTransferToken: async () => null });
   }
 }
 

package/index.js

@@ -18,17 +18,28 @@ const notSupported = feature => () => {
   );
 };
 
-const throwingClient = label =>
+// `methods` are the few sub-client calls spa-js makes on a core path; every
+// other property is a throwing function.
+const throwingClient = (label, methods = {}) =>
   new Proxy(
     {},
-    { get: (_t, prop) => notSupported(`${label}.${String(prop)}`) }
+    {
+      get: (_t, prop) =>
+        Object.prototype.hasOwnProperty.call(methods, prop)
+          ? methods[prop]
+          : notSupported(`${label}.${String(prop)}`)
+    }
   );
 
 export class AuthClient {
   constructor(_options) {
     this.mfa = throwingClient('mfa');
     this.passkey = throwingClient('passkey');
-    this.anonymous = throwingClient('anonymous');
+    // On every login spa-js 2.28 asks its anonymous wrapper for a transfer token,
+    // and the wrapper calls this whenever a stored anonymous session token exists
+    // (one left by an earlier non-thin deployment). This stub can never create
+    // such a session, so there is nothing to link: resolve null, never throw.
+    this.anonymous = throwingClient('anonymous', { mintTransferToken: async () => null });
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@versini/auth0-auth-js-stub",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Featherweight no-op stub of @auth0/auth0-auth-js for apps that use only basic Auth0 login (no MFA/Passkey/anonymous sessions/MyAccount/DPoP). Consumed via a pnpm `npm:` alias override to drop ~26KB gzip (openid-client + oauth4webapi + jose) from first paint. See @versini/auth0-thin.",
   "type": "module",
   "main": "./index.cjs",