pyric 0.1.0-alpha.21 → 0.1.0-alpha.24

package/src/auth/sandbox-backend-types.ts

@@ -21,35 +21,34 @@ import type { AuthObserver, User } from './types.js';
 export type Mutable<T> = { -readonly [K in keyof T]: T[K] };
 
 /** Seed record for `sandbox.seedUsers`. */
-/** Stand-in password for exported provider-flow identities that never had
- *  one — keeps `exportUsers` → `seedUsers` round-trips lossless without
- *  widening the `SeedUser` shape. Not a secret: sandbox-only. */
+/** Legacy passwordless-account marker, accepted on import only.
+ * New exports omit the password instead. Kept for older fixture readers. */
 export const NO_PASSWORD_SENTINEL = '__pyric_no_password__';
 
-export interface SeedUser {
-  uid: string;
-  email: string;
-  password: string;
-  displayName?: string;
-  customClaims?: Record<string, unknown>;
-  /** Originating provider for this identity (e.g. `'google.com'`).
-   *  Defaults to `'password'` — the natural provider for a record
-   *  seeded with an email + password. A host seeding popup-flow
-   *  identities passes the real provider so `listIdentities` /
-   *  `IdTokenResult.signInProvider` label them correctly. */
-  providerId?: string;
-}
+export type { SeedUser } from './seed-user.js';
 
 /**
  * Request for {@link SandboxBackend.mintDetachedSession} — one variant
- * per client sign-in shape, plus `uid` for existing identities
- * (session restore, provider-bridge accept).
+ * per client sign-in shape, plus `uid` for session restoration and
+ * `provider` for a provider sign-in to an existing linked identity.
+ * `custom` binds an identity already resolved from a custom token.
  */
-export type MintSessionRequest =
+export type MintSessionRequest = TenantScope & (
   | { kind: 'anonymous' }
   | { kind: 'password'; email: string; password: string }
   | { kind: 'createPassword'; email: string; password: string }
-  | { kind: 'uid'; uid: string };
+  | { kind: 'uid'; uid: string }
+  | { kind: 'provider'; uid: string; providerId: string }
+  | { kind: 'custom'; uid: string }
+);
+
+/** The tenant a minted session authenticates under. Carried on every
+ *  {@link MintSessionRequest} because a detached session has no `Auth` handle
+ *  to read `tenantId` from: the caller (the SharedWorker host, acting for one
+ *  port's `ClientAuth`) states it per request. Absent means untenanted. */
+export interface TenantScope {
+  tenantId?: string | null;
+}
 
 /** A minted per-connection session: the `User` plus the {@link AuthState}
  *  its data contexts should carry (`sandbox.withAuth(state)`). */
@@ -105,6 +104,9 @@ export interface SignInIdentitySpec {
   uid?: string;
   email: string;
   displayName?: string;
+  /** Profile photo for the identity, mirroring the stored record's
+   *  `photoUrl`. Omitted when the caller supplies none. */
+  photoUrl?: string;
   customClaims?: Record<string, unknown>;
 }
 
@@ -134,6 +136,11 @@ export interface StoredUser {
   /** ISO timestamp of the most recent sign-in, or null if this
    *  identity never signed in. */
   lastLoginAt: string | null;
+  /** Identity Platform tenant this identity last signed in under, or
+   *  `null` for the project-level (untenanted) pool. Written from
+   *  `Auth.tenantId` at sign-in and read back on session restore, so a
+   *  restored user keeps the tenant it authenticated with. */
+  tenantId: string | null;
 }
 
 /**
@@ -152,6 +159,10 @@ export interface AuthUserRecord {
   isAnonymous: boolean;
   disabled: boolean;
   emailVerified: boolean;
+  /** Identity Platform tenant the record belongs to, or `null` for the
+   *  project-level pool. Rules read the same value as
+   *  `request.auth.token.firebase.tenant` once the identity signs in. */
+  tenantId: string | null;
   /** ISO timestamp. */
   createdAt: string;
   /** ISO timestamp, or null if the identity never signed in. */