ultimate-jekyll-manager 1.3.6 → 1.3.8

package/CHANGELOG.md

@@ -14,6 +14,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+---
+## [1.3.8] - 2026-05-24
+
+### Fixed
+
+- **Reverse-signup now keeps the user on `/signin` so they actually see the inline error.** v1.3.7 fixed `isNewUser` detection, but a follow-on race appeared: when Firebase's `getRedirectResult()` returns a fresh-signup user, the auth-state-change listener in `core/auth.js` fires `state.user = <about-to-be-deleted>` BEFORE `reverseAccidentalSignup`'s `await newUser.delete() → signOut()` chain completes. The listener's `policy === 'unauthenticated'` branch then redirects to `/account` (or `authReturnUrl`), and by the time the inline `showError()` call fires, the user is already off the page. Fixed with a `window.__UJM_REVERSING_SIGNUP` flag set synchronously before the delete + cleared after signOut's followup state-change. The listener checks the flag at the top and short-circuits the entire callback — no redirect, no metadata POST, no consent guard, nothing — until the reversal completes and the user lands on `user = null` with the inline error visible on `/signin`.
+
+---
+## [1.3.7] - 2026-05-24
+
+### Fixed
+
+- **Reverse-signup detection on `/signin` was completely broken.** The reverse-signup-on-/signin flow in `src/assets/js/libs/auth.js` (lines 289 and 664) was reading `result.additionalUserInfo?.isNewUser` directly off the `UserCredential` returned by `getRedirectResult()` and `signInWithPopup()`. That property does NOT exist on the v9+ modular SDK — verified against `@firebase/auth`'s `auth-public.d.ts`, which declares `UserCredential` as exactly `{ user, providerId, operationType }`. The legacy compat SDK exposed `additionalUserInfo` as a direct property, hence the v9 migration footgun. On the modular SDK you must call the standalone helper `getAdditionalUserInfo(userCredential): AdditionalUserInfo | null` to access `isNewUser`. Result: `isNewUser` was always `undefined` → always falsy → the `if (isNewUser && !isSignupPage)` reverse gate at line 296 never fired in production. New Google accounts on `/signin` got signed in straight to `/account` with no consent on record, despite the reverse-signup code existing in the bundle since multiple versions ago. Confirmed live on Somiibo (Test 4 of `TODO-CONSENT-LIVETEST.md` failed 3× in a row with `operationType: 'signIn'` and no `[Auth] Reversing accidental signup` log line). Now both sites import `getAdditionalUserInfo` and call it on the result. Added two `console.warn` diagnostic logs (one per site) so future regressions surface immediately — can be removed once we're confident the fix sticks.
+
 ---
 ## [1.3.6] - 2026-05-24
 

package/dist/assets/js/core/auth.js

@@ -51,6 +51,16 @@ export default function () {
       // Log
       console.log('[Auth] state changed:', state);
 
+      // Short-circuit if a reverse-signup is in progress (libs/auth.js#reverseAccidentalSignup
+      // sets this synchronously before .delete() + signOut()). Without this, the brief
+      // window where Firebase shows user=<about-to-be-deleted-account> would trigger the
+      // policy-based redirect to /account (or authReturnUrl) BEFORE the user sees the
+      // inline error on /signin. Flag is cleared at the end of reverseAccidentalSignup.
+      if (window.__UJM_REVERSING_SIGNUP) {
+        console.warn('[Auth] Skipping state-change processing — reverse-signup in progress');
+        return;
+      }
+
       // Set user ID for analytics tracking
       setAnalyticsUserId(user);
 

package/dist/assets/js/libs/auth.js

@@ -125,6 +125,16 @@ export default function () {
   async function reverseAccidentalSignup(newUser) {
     console.warn('[Auth] Reversing accidental signup from /signin (new Google account created with no consent on record)');
 
+    // SYNCHRONOUSLY flag the reversal so the auth-state-change listener in
+    // core/auth.js short-circuits its policy-based redirect for this user.
+    // Without this, Firebase's redirect-result-success path triggers an auth
+    // state change with user=<the-about-to-be-deleted-account> BEFORE we
+    // finish .delete() + signOut(), and the listener redirects to /account
+    // (or authReturnUrl) before the user ever sees the inline error.
+    // Cleared in the finally block after signOut() has fired the followup
+    // auth-state-change with user=null.
+    window.__UJM_REVERSING_SIGNUP = true;
+
     try {
       await newUser.delete();
     } catch (e) {
@@ -152,6 +162,11 @@ export default function () {
       formManager.showError(`This account doesn't exist. Try signing up first or use a different account.`);
       formManager.ready();
     }
+
+    // Clear the flag now that signOut() has fired its auth-state-change
+    // with user=null. Future state changes (e.g. user re-clicks Continue
+    // with Google after seeing the error) get normal listener processing.
+    window.__UJM_REVERSING_SIGNUP = false;
   }
 
   // Validate that the user has agreed to the legal terms. Instead of highlighting the
@@ -266,7 +281,7 @@ export default function () {
   async function handleRedirectResult() {
     try {
       // Import Firebase auth functions
-      const { getAuth, getRedirectResult } = await import('@firebase/auth');
+      const { getAuth, getRedirectResult, getAdditionalUserInfo } = await import('@firebase/auth');
       const auth = getAuth();
 
       // Check for redirect result
@@ -285,10 +300,17 @@ export default function () {
       // Determine the provider from the result
       const providerId = result.providerId || result.user.providerData?.[0]?.providerId || 'unknown';
 
-      // Track based on whether this is a new user
-      const isNewUser = result.additionalUserInfo?.isNewUser;
+      // Track based on whether this is a new user. Firebase Auth v9+ modular SDK
+      // does NOT expose additionalUserInfo as a direct property on UserCredential —
+      // you must call getAdditionalUserInfo(result) to get it. The legacy compat SDK
+      // exposed it as a direct property, hence the v9 migration footgun. Verified
+      // against @firebase/auth's auth-public.d.ts: UserCredential only declares
+      // { user, providerId, operationType }.
+      const additionalUserInfo = getAdditionalUserInfo(result);
+      const isNewUser = additionalUserInfo?.isNewUser;
       const pagePath = document.documentElement.getAttribute('data-page-path');
       const isSignupPage = pagePath === '/signup';
+      console.warn('[Auth] redirect additionalUserInfo:', additionalUserInfo, 'isNewUser:', isNewUser, 'pagePath:', pagePath, 'isSignupPage:', isSignupPage, 'operationType:', result.operationType);
 
       // Google quirk: if a new account was auto-created during a signin attempt
       // (user came back from OAuth via the redirect path on /signin, not /signup),
@@ -598,6 +620,7 @@ export default function () {
         getAuth,
         signInWithPopup,
         signInWithRedirect,
+        getAdditionalUserInfo,
         GoogleAuthProvider,
         FacebookAuthProvider,
         TwitterAuthProvider,
@@ -660,8 +683,12 @@ export default function () {
           const result = await signInWithPopup(auth, provider);
           console.log('[Auth] Successfully authenticated via popup:', result.user.email);
 
-          // Track based on whether this is a new user
-          const isNewUser = result.additionalUserInfo?.isNewUser;
+          // Track based on whether this is a new user. v9 modular SDK requires
+          // getAdditionalUserInfo(result) — the legacy `result.additionalUserInfo`
+          // direct property does NOT exist on UserCredential in v9+.
+          const additionalUserInfoPopup = getAdditionalUserInfo(result);
+          const isNewUser = additionalUserInfoPopup?.isNewUser;
+          console.warn('[Auth] popup additionalUserInfo:', additionalUserInfoPopup, 'isNewUser:', isNewUser, 'action:', action);
 
           // Google quirk: signInWithPopup auto-creates accounts. If a brand-new visitor
           // clicks "Sign in with Google" on the SIGNIN page (not signup), reverse the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultimate-jekyll-manager",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "description": "Ultimate Jekyll dependency manager",
   "main": "dist/index.js",
   "exports": {