https://lesslikely.com/js/account-auth.js

8// node_modules/gotrue-js/lib/index.js
9var HTTPError = class extends Error {
10  constructor(response) {
11    super(response.statusText);
12    this.name = "HTTPError";
13    this.status = response.status;
14  }
15};
16var TextHTTPError = class extends HTTPError {
17  constructor(response, data) {
18    super(response);
19    this.name = "TextHTTPError";
20    this.data = data;
21  }
22};
23var JSONHTTPError = class extends HTTPError {
24  constructor(response, json) {
25    super(response);
26    this.name = "JSONHTTPError";
27    this.json = json;
28  }
29};
30var API = class _API {
31  constructor(apiURL, options) {
32    this.apiURL = apiURL || "";
33    this._sameOrigin = /^\/(?!\/)/.test(this.apiURL);
34    this.defaultHeaders = options?.defaultHeaders || {};
35  }
36  headers(headers = {}) {
37    return {
38      ...this.defaultHeaders,
39      "Content-Type": "application/json",
40      ...headers
41    };
42  }
43  static async parseJsonResponse(response) {
44    const json = await response.json();
45    if (!response.ok) {
46      throw new JSONHTTPError(response, json);
47    }
48    return json;
49  }
50  async request(path, options = {}) {
51    const headers = this.headers(options.headers || {});
52    if (!options.body) {
53      delete headers["Content-Type"];
54    }
55    const fetchOptions = {
56      ...options,
57      headers
58    };
59    if (this._sameOrigin) {
60      fetchOptions.credentials = options.credentials || "same-origin";
61    }
62    const response = await fetch(this.apiURL + path, fetchOptions);
63    const contentType = response.headers.get("Content-Type");
64    if (contentType?.includes("json")) {
65      return _API.parseJsonResponse(response);
66    }
67    const data = await response.text();
68    if (!response.ok) {
69      throw new TextHTTPError(response, data);
70    }
71    return data;
72  }
73};
74var Admin = class {
75  constructor(user) {
76    this.user = user;
77  }
78  listUsers(aud) {
79    return this.user._request("/admin/users", {
80      method: "GET",
81      audience: aud
82    });
83  }
84  getUser(user) {
85    return this.user._request(`/admin/users/${user.id}`);
86  }
87  updateUser(user, attributes = {}) {
88    return this.user._request(`/admin/users/${user.id}`, {
89      method: "PUT",
90      body: JSON.stringify(attributes)
91    });
92  }
93  createUser(email2, password2, attributes = {}) {
94    attributes.email = email2;
95    attributes.password = password2;
96    return this.user._request("/admin/users", {
97      method: "POST",
98      body: JSON.stringify(attributes)
99    });
100  }
101  deleteUser(user) {
102    return this.user._request(`/admin/users/${user.id}`, {
103      method: "DELETE"
104    });
105  }
106};
107var ExpiryMargin = 60 * 1e3;
108var storageKey = "gotrue.user";
109var refreshPromises = {};
110var currentUser = null;
111var forbiddenUpdateAttributes = { api: 1, token: 1, audience: 1, url: 1 };
112var forbiddenSaveAttributes = { api: 1 };
113var isBrowser = () => typeof window !== "undefined";
114var storageListenerActive = false;
115function ensureStorageListener() {
116  if (!storageListenerActive && isBrowser()) {
117    storageListenerActive = true;
118    window.addEventListener("storage", (event) => {
119      if (event.key === storageKey) {
120        currentUser = null;
121      }
122    });
123  }
124}
125var User = class _User {
126  constructor(api, tokenResponse, audience) {
127    this.token = null;
128    this.api = api;
129    this.url = api.apiURL;
130    this.audience = audience;
131    this._processTokenResponse(tokenResponse);
132    currentUser = this;
133    ensureStorageListener();
134  }
135  static removeSavedSession() {
136    isBrowser() && localStorage.removeItem(storageKey);
137  }
138  static recoverSession(apiInstance) {
139    ensureStorageListener();
140    if (currentUser) {
141      return currentUser;
142    }
143    const json = isBrowser() && localStorage.getItem(storageKey);
144    if (json) {
145      try {
146        const data = JSON.parse(json);
147        const { url, token, audience } = data;
148        if (!url || !token) {
149          return null;
150        }
151        const api = apiInstance || new API(url, {});
152        return new _User(api, token, audience)._saveUserData(data, true);
153      } catch (error) {
154        console.error(new Error(`Gotrue-js: Error recovering session: ${error}`));
155        return null;
156      }
157    }
158    return null;
159  }
160  get admin() {
161    return new Admin(this);
162  }
163  async update(attributes) {
164    const response = await this._request("/user", {
165      method: "PUT",
166      body: JSON.stringify(attributes)
167    });
168    return this._saveUserData(response)._refreshSavedSession();
169  }
170  jwt(forceRefresh) {
171    const token = this.tokenDetails();
172    if (token === null || token === void 0) {
173      return Promise.reject(new Error(`Gotrue-js: failed getting jwt access token`));
174    }
175    const { expires_at, refresh_token, access_token } = token;
176    if (forceRefresh || expires_at - ExpiryMargin < Date.now()) {
177      return this._refreshToken(refresh_token);
178    }
179    return Promise.resolve(access_token);
180  }
181  logout() {
182    return this._request("/logout", { method: "POST" }).then(this.clearSession.bind(this)).catch(this.clearSession.bind(this));
183  }
184  _refreshToken(refresh_token) {
185    const existingPromise = refreshPromises[refresh_token];
186    if (existingPromise) {
187      return existingPromise;
188    }
189    const refreshRequest = this.api.request("/token", {
190      method: "POST",
191      headers: { "Content-Type": "application/x-www-form-urlencoded" },
192      body: `grant_type=refresh_token&refresh_token=${refresh_token}`
193    });
194    const timeoutPromise = new Promise((_resolve, reject) => {
195      setTimeout(() => reject(new Error("Token refresh timeout")), 3e4);
196    });
197    const promise = Promise.race([refreshRequest, timeoutPromise]).then((response) => {
198      delete refreshPromises[refresh_token];
199      this._processTokenResponse(response);
200      this._refreshSavedSession();
201      if (!this.token) {
202        throw new Error("Gotrue-js: Token not set after refresh");
203      }
204      return this.token.access_token;
205    }).catch((error) => {
206      delete refreshPromises[refresh_token];
207      this.clearSession();
208      throw error;
209    });
210    refreshPromises[refresh_token] = promise;
211    return promise;
212  }
213  async _request(path, options = {}) {
214    options.headers = options.headers || {};
215    const aud = options.audience || this.audience;
216    if (aud) {
217      options.headers["X-JWT-AUD"] = aud;
218    }
219    try {
220      const token = await this.jwt();
221      return await this.api.request(path, {
222        headers: Object.assign(options.headers, {
223          Authorization: `Bearer ${token}`
224        }),
225        ...options
226      });
227    } catch (error) {
228      if (error instanceof JSONHTTPError && error.json) {
229        if (error.json.msg) {
230          error.message = error.json.msg;
231        } else if (error.json.error) {
232          error.message = `${error.json.error}: ${error.json.error_description}`;
233        }
234      }
235      throw error;
236    }
237  }
238  async getUserData() {
239    const response = await this._request("/user");
240    return this._saveUserData(response)._refreshSavedSession();
241  }
242  _saveUserData(attributes, fromStorage) {
243    for (const key in attributes) {
244      if (key in _User.prototype || key in forbiddenUpdateAttributes) {
245        continue;
246      }
247      this[key] = attributes[key];
248    }
249    if (fromStorage) {
250      this._fromStorage = true;
251    }
252    return this;
253  }
254  _processTokenResponse(tokenResponse) {
255    this.token = tokenResponse;
256    try {
257      const claims = JSON.parse(urlBase64Decode(tokenResponse.access_token.split(".")[1]));
258      this.token.expires_at = claims.exp * 1e3;
259    } catch (error) {
260      console.error(new Error(`Gotrue-js: Failed to parse tokenResponse claims: ${error}`));
261    }
262  }
263  _refreshSavedSession() {
264    if (isBrowser() && localStorage.getItem(storageKey)) {
265      this._saveSession();
266    }
267    return this;
268  }
269  get _details() {
270    const userCopy = {};
271    for (const key in this) {
272      if (key in _User.prototype || key in forbiddenSaveAttributes) {
273        continue;
274      }
275      userCopy[key] = this[key];
276    }
277    return userCopy;
278  }
279  _saveSession() {
280    isBrowser() && localStorage.setItem(storageKey, JSON.stringify(this._details));
281    return this;
282  }
283  tokenDetails() {
284    return this.token;
285  }
286  clearSession() {
287    _User.removeSavedSession();
288    this.token = null;
289    currentUser = null;
290  }
291};
292function base64Decode(base64) {
293  if (typeof atob === "function") {
294    return atob(base64);
295  }
296  return Buffer.from(base64, "base64").toString("binary");
297}
298function urlBase64Decode(str) {
299  let output = str.replace(/-/g, "+").replace(/_/g, "/");
300  switch (output.length % 4) {
301    case 0:
302      break;
303    case 2:
304      output += "==";
305      break;
306    case 3:
307      output += "=";
308      break;
309    default:
310      throw new Error("Illegal base64url string!");
311  }
312  const binaryString = base64Decode(output);
313  try {
314    const bytes = Uint8Array.from(binaryString, (char) => char.codePointAt(0) ?? 0);
315    return new TextDecoder().decode(bytes);
316  } catch {
317    return binaryString;
318  }
319}
320var HTTPRegexp = /^http:\/\//;
321var defaultApiURL = `/.netlify/identity`;
322var GoTrue = class {
323  constructor({
324    APIUrl = defaultApiURL,
325    audience = "",
326    setCookie = false,
327    clientName = "gotrue-js"
328  } = {}) {
329    if (HTTPRegexp.test(APIUrl)) {
330      console.warn(
331        "Warning:\n\nDO NOT USE HTTP IN PRODUCTION FOR GOTRUE EVER!\nGoTrue REQUIRES HTTPS to work securely."
332      );
333    }
334    if (audience) {
335      this.audience = audience;
336    }
337    this.setCookie = setCookie;
338    this.api = new API(APIUrl, { defaultHeaders: { "X-Nf-Client": clientName } });
339  }
340  async _request(path, options = {}) {
341    options.headers = options.headers || {};
342    const aud = options.audience || this.audience;
343    if (aud) {
344      options.headers["X-JWT-AUD"] = aud;
345    }
346    try {
347      return await this.api.request(path, options);
348    } catch (error) {
349      if (error instanceof JSONHTTPError && error.json) {
350        if (error.json.msg) {
351          error.message = error.json.msg;
352        } else if (error.json.error) {
353          error.message = `${error.json.error}: ${error.json.error_description}`;
354        }
355      }
356      throw error;
357    }
358  }
359  settings() {
360    return this._request("/settings");
361  }
362  signup(email2, password2, data) {
363    return this._request("/signup", {
364      method: "POST",
365      body: JSON.stringify({ email: email2, password: password2, data })
366    });
367  }
368  login(email2, password2, remember) {
369    this._setRememberHeaders(remember);
370    return this._request("/token", {
371      method: "POST",
372      headers: { "Content-Type": "application/x-www-form-urlencoded" },
373      body: `grant_type=password&username=${encodeURIComponent(
374        email2
375      )}&password=${encodeURIComponent(password2)}`
376    }).then((response) => {
377      User.removeSavedSession();
378      return this.createUser(response, remember);
379    });
380  }
381  loginExternalUrl(provider) {
382    return `${this.api.apiURL}/authorize?provider=${provider}`;
383  }
384  confirm(token, remember) {
385    this._setRememberHeaders(remember);
386    return this.verify("signup", token, remember);
387  }
388  requestPasswordRecovery(email2) {
389    return this._request("/recover", {
390      method: "POST",
391      body: JSON.stringify({ email: email2 })
392    });
393  }
394  recover(token, remember) {
395    this._setRememberHeaders(remember);
396    return this.verify("recovery", token, remember);
397  }
398  acceptInvite(token, password2, remember) {
399    this._setRememberHeaders(remember);
400    return this._request("/verify", {
401      method: "POST",
402      body: JSON.stringify({ token, password: password2, type: "signup" })
403    }).then((response) => this.createUser(response, remember));
404  }
405  acceptInviteExternalUrl(provider, token) {
406    return `${this.api.apiURL}/authorize?provider=${provider}&invite_token=${token}`;
407  }
408  createUser(tokenResponse, remember = false) {
409    this._setRememberHeaders(remember);
410    const user = new User(this.api, tokenResponse, this.audience || "");
411    return user.getUserData().then((userData) => {
412      if (remember) {
413        userData._saveSession();
414      }
415      return userData;
416    });
417  }
418  currentUser() {
419    const user = User.recoverSession(this.api);
420    user && this._setRememberHeaders(user._fromStorage);
421    return user;
422  }
423  async validateCurrentSession() {
424    const user = this.currentUser();
425    if (!user) {
426      return null;
427    }
428    try {
429      return await user.getUserData();
430    } catch {
431      user.clearSession();
432      return null;
433    }
434  }
435  verify(type, token, remember) {
436    this._setRememberHeaders(remember);
437    return this._request("/verify", {
438      method: "POST",
439      body: JSON.stringify({ token, type })
440    }).then((response) => this.createUser(response, remember));
441  }
442  _setRememberHeaders(remember) {
443    if (this.setCookie) {
444      this.api.defaultHeaders = this.api.defaultHeaders || {};
445      this.api.defaultHeaders["X-Use-Cookie"] = remember ? "1" : "session";
446    }
447  }
448};
449if (typeof window !== "undefined") {
450  window.GoTrue = GoTrue;
451}
452

453// node_modules/@netlify/identity/dist/main.js
454var __require2 = /* @__PURE__ */ ((x) => typeof __require !== "undefined" ? __require : typeof Proxy !== "undefined" ? new Proxy(x, {
455  get: (a, b) => (typeof __require !== "undefined" ? __require : a)[b]
456}) : x)(function(x) {
457  if (typeof __require !== "undefined") return __require.apply(this, arguments);
458  throw Error('Dynamic require of "' + x + '" is not supported');
459});
460var AUTH_PROVIDERS = ["google", "github", "gitlab", "bitbucket", "facebook", "email"];
461var AuthError = class _AuthError extends Error {
462  constructor(message, status2, options) {
463    super(message);
464    this.name = "AuthError";
465    this.status = status2;
466    if (options && "cause" in options) {
467      this.cause = options.cause;
468    }
469  }
470  static from(error) {
471    if (error instanceof _AuthError) return error;
472    const message = error instanceof Error ? error.message : String(error);
473    return new _AuthError(message, void 0, { cause: error });
474  }
475};
476var MissingIdentityError = class extends Error {
477  constructor(message = "Netlify Identity is not available.") {
478    super(message);
479    this.name = "MissingIdentityError";
480  }
481};
482var IDENTITY_PATH = "/.netlify/identity";
483var goTrueClient = null;
484var cachedApiUrl;
485var warnedMissingUrl = false;
486var isBrowser2 = () => typeof window !== "undefined" && typeof window.location !== "undefined";
487var discoverApiUrl = () => {
488  if (cachedApiUrl !== void 0) return cachedApiUrl;
489  if (isBrowser2()) {
490    cachedApiUrl = `${window.location.origin}${IDENTITY_PATH}`;
491  } else {
492    const identityContext = getIdentityContext();
493    if (identityContext?.url) {
494      cachedApiUrl = identityContext.url;
495    } else if (globalThis.Netlify?.context?.url) {
496      cachedApiUrl = new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href;
497    } else if (typeof process !== "undefined" && process.env?.URL) {
498      cachedApiUrl = new URL(IDENTITY_PATH, process.env.URL).href;
499    }
500  }
501  return cachedApiUrl ?? null;
502};
503var getGoTrueClient = () => {
504  if (goTrueClient) return goTrueClient;
505  const apiUrl = discoverApiUrl();
506  if (!apiUrl) {
507    if (!warnedMissingUrl) {
508      console.warn(
509        "@netlify/identity: Could not determine the Identity endpoint URL. Make sure your site has Netlify Identity enabled, or run your app with `netlify dev`."
510      );
511      warnedMissingUrl = true;
512    }
513    return null;
514  }
515  goTrueClient = new GoTrue({ APIUrl: apiUrl, setCookie: false });
516  return goTrueClient;
517};
518var getClient = () => {
519  const client = getGoTrueClient();
520  if (!client) throw new MissingIdentityError();
521  return client;
522};
523var getIdentityContext = () => {
524  const identityContext = globalThis.netlifyIdentityContext;
525  if (identityContext?.url) {
526    return {
527      url: identityContext.url,
528      token: identityContext.token
529    };
530  }
531  if (globalThis.Netlify?.context?.url) {
532    return { url: new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href };
533  }
534  const siteUrl = typeof process !== "undefined" ? process.env?.URL : void 0;
535  if (siteUrl) {
536    return { url: new URL(IDENTITY_PATH, siteUrl).href };
537  }
538  return null;
539};
540var NF_JWT_COOKIE = "nf_jwt";
541var NF_REFRESH_COOKIE = "nf_refresh";
542var getCookie = (name2) => {
543  if (typeof document === "undefined") return null;
544  const match = new RegExp(`(?:^|; )${name2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=([^;]*)`).exec(document.cookie);
545  if (!match) return null;
546  try {
547    return decodeURIComponent(match[1]);
548  } catch {
549    return match[1];
550  }
551};
552var setAuthCookies = (cookies, accessToken, refreshToken) => {
553  cookies.set({
554    name: NF_JWT_COOKIE,
555    value: accessToken,
556    httpOnly: false,
557    secure: true,
558    path: "/",
559    sameSite: "Lax"
560  });
561  if (refreshToken) {
562    cookies.set({
563      name: NF_REFRESH_COOKIE,
564      value: refreshToken,
565      httpOnly: false,
566      secure: true,
567      path: "/",
568      sameSite: "Lax"
569    });
570  }
571};
572var deleteAuthCookies = (cookies) => {
573  cookies.delete(NF_JWT_COOKIE);
574  cookies.delete(NF_REFRESH_COOKIE);
575};
576var setBrowserAuthCookies = (accessToken, refreshToken) => {
577  if (typeof document === "undefined") return;
578  document.cookie = `${NF_JWT_COOKIE}=${encodeURIComponent(accessToken)}; path=/; secure; samesite=lax`;
579  if (refreshToken) {
580    document.cookie = `${NF_REFRESH_COOKIE}=${encodeURIComponent(refreshToken)}; path=/; secure; samesite=lax`;
581  }
582};
583var deleteBrowserAuthCookies = () => {
584  if (typeof document === "undefined") return;
585  document.cookie = `${NF_JWT_COOKIE}=; path=/; secure; samesite=lax; expires=Thu, 01 Jan 1970 00:00:00 GMT`;
586  document.cookie = `${NF_REFRESH_COOKIE}=; path=/; secure; samesite=lax; expires=Thu, 01 Jan 1970 00:00:00 GMT`;
587};
588var getServerCookie = (name2) => {
589  const cookies = globalThis.Netlify?.context?.cookies;
590  if (!cookies || typeof cookies.get !== "function") return null;
591  return cookies.get(name2) ?? null;
592};
593var nextHeadersFn;
594var triggerNextjsDynamic = () => {
595  if (nextHeadersFn === null) return;
596  if (nextHeadersFn === void 0) {
597    try {
598      if (typeof __require2 === "undefined") {
599        nextHeadersFn = null;
600        return;
601      }
602      const mod = __require2("next/headers");
603      nextHeadersFn = mod.headers;
604    } catch {
605      nextHeadersFn = null;
606      return;
607    }
608  }
609  const fn = nextHeadersFn;
610  if (!fn) return;
611  try {
612    fn();
613  } catch (e) {
614    if (e instanceof Error && ("digest" in e || /bail\s*out.*prerende/i.test(e.message))) {
615      throw e;
616    }
617  }
618};
619var DEFAULT_TIMEOUT_MS = 5e3;
620var fetchWithTimeout = async (url, options = {}, timeoutMs = DEFAULT_TIMEOUT_MS) => {
621  const controller = new AbortController();
622  const timer = setTimeout(() => {
623    controller.abort();
624  }, timeoutMs);
625  try {
626    return await fetch(url, { ...options, signal: controller.signal });
627  } catch (error) {
628    if (error instanceof Error && error.name === "AbortError") {
629      const pathname = new URL(url).pathname;
630      throw new AuthError(`Identity request to ${pathname} timed out after ${String(timeoutMs)}ms`);
631    }
632    throw error;
633  } finally {
634    clearTimeout(timer);
635  }
636};
637var AUTH_EVENTS = {
638  LOGIN: "login",
639  LOGOUT: "logout",
640  TOKEN_REFRESH: "token_refresh",
641  USER_UPDATED: "user_updated",
642  RECOVERY: "recovery"
643};
644var GOTRUE_STORAGE_KEY = "gotrue.user";
645var listeners = /* @__PURE__ */ new Set();
646var emitAuthEvent = (event, user) => {
647  for (const listener of listeners) {
648    try {
649      listener(event, user);
650    } catch {
651    }
652  }
653};
654var storageListenerAttached = false;
655var attachStorageListener = () => {
656  if (storageListenerAttached || !isBrowser2()) return;
657  storageListenerAttached = true;
658  window.addEventListener("storage", (event) => {
659    if (event.key !== GOTRUE_STORAGE_KEY) return;
660    if (event.newValue) {
661      const client = getGoTrueClient();
662      const currentUser2 = client?.currentUser();
663      emitAuthEvent(AUTH_EVENTS.LOGIN, currentUser2 ? toUser(currentUser2) : null);
664    } else {
665      emitAuthEvent(AUTH_EVENTS.LOGOUT, null);
666    }
667  });
668};
669var onAuthChange = (callback) => {
670  if (!isBrowser2()) {
671    return () => {
672    };
673  }
674  listeners.add(callback);
675  attachStorageListener();
676  return () => {
677    listeners.delete(callback);
678  };
679};
680var REFRESH_MARGIN_S = 60;
681var refreshTimer = null;
682var startTokenRefresh = () => {
683  if (!isBrowser2()) return;
684  stopTokenRefresh();
685  const client = getGoTrueClient();
686  const user = client?.currentUser();
687  if (!user) return;
688  const token = user.tokenDetails();
689  if (!token?.expires_at) return;
690  const nowS = Math.floor(Date.now() / 1e3);
691  const expiresAtS = typeof token.expires_at === "number" && token.expires_at > 1e12 ? Math.floor(token.expires_at / 1e3) : token.expires_at;
692  const delayMs = Math.max(0, expiresAtS - nowS - REFRESH_MARGIN_S) * 1e3;
693  refreshTimer = setTimeout(() => {
694    void (async () => {
695      try {
696        const freshJwt = await user.jwt(true);
697        const freshDetails = user.tokenDetails();
698        setBrowserAuthCookies(freshJwt, freshDetails?.refresh_token);
699        emitAuthEvent(AUTH_EVENTS.TOKEN_REFRESH, toUser(user));
700        startTokenRefresh();
701      } catch {
702        stopTokenRefresh();
703      }
704    })();
705  }, delayMs);
706};
707var stopTokenRefresh = () => {
708  if (refreshTimer !== null) {
709    clearTimeout(refreshTimer);
710    refreshTimer = null;
711  }
712};
713var getCookies = () => {
714  const cookies = globalThis.Netlify?.context?.cookies;
715  if (!cookies) {
716    throw new AuthError("Server-side auth requires Netlify Functions runtime");
717  }
718  return cookies;
719};
720var getServerIdentityUrl = () => {
721  const ctx = getIdentityContext();
722  if (!ctx?.url) {
723    throw new AuthError("Could not determine the Identity endpoint URL on the server");
724  }
725  return ctx.url;
726};
727var persistSession = true;
728var login = async (email2, password2) => {
729  if (!isBrowser2()) {
730    const identityUrl = getServerIdentityUrl();
731    const cookies = getCookies();
732    const body = new URLSearchParams({
733      grant_type: "password",
734      username: email2,
735      password: password2
736    });
737    let res;
738    try {
739      res = await fetchWithTimeout(`${identityUrl}/token`, {
740        method: "POST",
741        headers: { "Content-Type": "application/x-www-form-urlencoded" },
742        body: body.toString()
743      });
744    } catch (error) {
745      throw AuthError.from(error);
746    }
747    if (!res.ok) {
748      const errorBody = await res.json().catch(() => ({}));
749      throw new AuthError(
750        errorBody.msg ?? errorBody.error_description ?? `Login failed (${String(res.status)})`,
751        res.status
752      );
753    }
754    const data = await res.json();
755    const accessToken = data.access_token;
756    let userRes;
757    try {
758      userRes = await fetchWithTimeout(`${identityUrl}/user`, {
759        headers: { Authorization: `Bearer ${accessToken}` }
760      });
761    } catch (error) {
762      throw AuthError.from(error);
763    }
764    if (!userRes.ok) {
765      const errorBody = await userRes.json().catch(() => ({}));
766      throw new AuthError(errorBody.msg ?? `Failed to fetch user data (${String(userRes.status)})`, userRes.status);
767    }
768    const userData = await userRes.json();
769    const user = toUser(userData);
770    setAuthCookies(cookies, accessToken, data.refresh_token);
771    return user;
772  }
773  const client = getClient();
774  try {
775    const gotrueUser = await client.login(email2, password2, persistSession);
776    const jwt = await gotrueUser.jwt();
777    setBrowserAuthCookies(jwt, gotrueUser.tokenDetails()?.refresh_token);
778    const user = toUser(gotrueUser);
779    startTokenRefresh();
780    emitAuthEvent(AUTH_EVENTS.LOGIN, user);
781    return user;
782  } catch (error) {
783    throw AuthError.from(error);
784  }
785};
786var signup = async (email2, password2, data) => {
787  if (!isBrowser2()) {
788    const identityUrl = getServerIdentityUrl();
789    const cookies = getCookies();
790    let res;
791    try {
792      res = await fetchWithTimeout(`${identityUrl}/signup`, {
793        method: "POST",
794        headers: { "Content-Type": "application/json" },
795        body: JSON.stringify({ email: email2, password: password2, data })
796      });
797    } catch (error) {
798      throw AuthError.from(error);
799    }
800    if (!res.ok) {
801      const errorBody = await res.json().catch(() => ({}));
802      throw new AuthError(errorBody.msg ?? `Signup failed (${String(res.status)})`, res.status);
803    }
804    const responseData = await res.json();
805    const user = toUser(responseData);
806    if (responseData.confirmed_at) {
807      const accessToken = responseData.access_token;
808      if (accessToken) {
809        setAuthCookies(cookies, accessToken, responseData.refresh_token);
810      }
811    }
812    return user;
813  }
814  const client = getClient();
815  try {
816    const response = await client.signup(email2, password2, data);
817    const user = toUser(response);
818    if (response.confirmed_at) {
819      const jwt = await response.jwt?.();
820      if (jwt) {
821        const refreshToken = response.tokenDetails?.()?.refresh_token;
822        setBrowserAuthCookies(jwt, refreshToken);
823      }
824      startTokenRefresh();
825      emitAuthEvent(AUTH_EVENTS.LOGIN, user);
826    }
827    return user;
828  } catch (error) {
829    throw AuthError.from(error);
830  }
831};
832var logout = async () => {
833  if (!isBrowser2()) {
834    const identityUrl = getServerIdentityUrl();
835    const cookies = getCookies();
836    const jwt = cookies.get(NF_JWT_COOKIE);
837    if (jwt) {
838      try {
839        await fetchWithTimeout(`${identityUrl}/logout`, {
840          method: "POST",
841          headers: { Authorization: `Bearer ${jwt}` }
842        });
843      } catch {
844      }
845    }
846    deleteAuthCookies(cookies);
847    return;
848  }
849  const client = getClient();
850  try {
851    const currentUser2 = client.currentUser();
852    if (currentUser2) {
853      await currentUser2.logout();
854    }
855    deleteBrowserAuthCookies();
856    stopTokenRefresh();
857    emitAuthEvent(AUTH_EVENTS.LOGOUT, null);
858  } catch (error) {
859    throw AuthError.from(error);
860  }
861};
862var oauthLogin = (provider) => {
863  if (!isBrowser2()) {
864    throw new AuthError("oauthLogin() is only available in the browser");
865  }
866  const client = getClient();
867  window.location.href = client.loginExternalUrl(provider);
868  throw new AuthError("Redirecting to OAuth provider");
869};
870var handleAuthCallback = async () => {
871  if (!isBrowser2()) return null;
872  const hash = window.location.hash.substring(1);
873  if (!hash) return null;
874  const client = getClient();
875  const params = new URLSearchParams(hash);
876  try {
877    const accessToken = params.get("access_token");
878    if (accessToken) return await handleOAuthCallback(client, params, accessToken);
879    const confirmationToken = params.get("confirmation_token");
880    if (confirmationToken) return await handleConfirmationCallback(client, confirmationToken);
881    const recoveryToken = params.get("recovery_token");
882    if (recoveryToken) return await handleRecoveryCallback(client, recoveryToken);
883    const inviteToken2 = params.get("invite_token");
884    if (inviteToken2) return handleInviteCallback(inviteToken2);
885    const emailChangeToken = params.get("email_change_token");
886    if (emailChangeToken) return await handleEmailChangeCallback(client, emailChangeToken);
887    return null;
888  } catch (error) {
889    if (error instanceof AuthError) throw error;
890    throw AuthError.from(error);
891  }
892};
893var handleOAuthCallback = async (client, params, accessToken) => {
894  const refreshToken = params.get("refresh_token") ?? "";
895  const expiresIn = parseInt(params.get("expires_in") ?? "", 10);
896  const expiresAt = parseInt(params.get("expires_at") ?? "", 10);
897  const gotrueUser = await client.createUser(
898    {
899      access_token: accessToken,
900      token_type: params.get("token_type") ?? "bearer",
901      expires_in: isFinite(expiresIn) ? expiresIn : 3600,
902      expires_at: isFinite(expiresAt) ? expiresAt : Math.floor(Date.now() / 1e3) + 3600,
903      refresh_token: refreshToken
904    },
905    persistSession
906  );
907  setBrowserAuthCookies(accessToken, refreshToken || void 0);
908  const user = toUser(gotrueUser);
909  startTokenRefresh();
910  clearHash();
911  emitAuthEvent(AUTH_EVENTS.LOGIN, user);
912  return { type: "oauth", user };
913};
914var handleConfirmationCallback = async (client, token) => {
915  const gotrueUser = await client.confirm(token, persistSession);
916  const jwt = await gotrueUser.jwt();
917  setBrowserAuthCookies(jwt, gotrueUser.tokenDetails()?.refresh_token);
918  const user = toUser(gotrueUser);
919  startTokenRefresh();
920  clearHash();
921  emitAuthEvent(AUTH_EVENTS.LOGIN, user);
922  return { type: "confirmation", user };
923};
924var handleRecoveryCallback = async (client, token) => {
925  const gotrueUser = await client.recover(token, persistSession);
926  const jwt = await gotrueUser.jwt();
927  setBrowserAuthCookies(jwt, gotrueUser.tokenDetails()?.refresh_token);
928  const user = toUser(gotrueUser);
929  startTokenRefresh();
930  clearHash();
931  emitAuthEvent(AUTH_EVENTS.RECOVERY, user);
932  return { type: "recovery", user };
933};
934var handleInviteCallback = (token) => {
935  clearHash();
936  return { type: "invite", user: null, token };
937};
938var handleEmailChangeCallback = async (client, emailChangeToken) => {
939  const currentUser2 = client.currentUser();
940  if (!currentUser2) {
941    throw new AuthError("Email change verification requires an active browser session");
942  }
943  const jwt = await currentUser2.jwt();
944  const identityUrl = `${window.location.origin}${IDENTITY_PATH}`;
945  const emailChangeRes = await fetch(`${identityUrl}/user`, {
946    method: "PUT",
947    headers: {
948      "Content-Type": "application/json",
949      Authorization: `Bearer ${jwt}`
950    },
951    body: JSON.stringify({ email_change_token: emailChangeToken })
952  });
953  if (!emailChangeRes.ok) {
954    const errorBody = await emailChangeRes.json().catch(() => ({}));
955    throw new AuthError(
956      errorBody.msg ?? `Email change verification failed (${String(emailChangeRes.status)})`,
957      emailChangeRes.status
958    );
959  }
960  const emailChangeData = await emailChangeRes.json();
961  const user = toUser(emailChangeData);
962  clearHash();
963  emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user);
964  return { type: "email_change", user };
965};
966var clearHash = () => {
967  history.replaceState(null, "", window.location.pathname + window.location.search);
968};
969var hydrateSession = async () => {
970  if (!isBrowser2()) return null;
971  const client = getClient();
972  const currentUser2 = client.currentUser();
973  if (currentUser2) {
974    startTokenRefresh();
975    return toUser(currentUser2);
976  }
977  const accessToken = getCookie(NF_JWT_COOKIE);
978  if (!accessToken) return null;
979  const refreshToken = getCookie(NF_REFRESH_COOKIE) ?? "";
980  const decoded = decodeJwtPayload(accessToken);
981  const expiresAt = decoded?.exp ?? Math.floor(Date.now() / 1e3) + 3600;
982  const expiresIn = Math.max(0, expiresAt - Math.floor(Date.now() / 1e3));
983  let gotrueUser;
984  try {
985    gotrueUser = await client.createUser(
986      {
987        access_token: accessToken,
988        token_type: "bearer",
989        expires_in: expiresIn,
990        expires_at: expiresAt,
991        refresh_token: refreshToken
992      },
993      persistSession
994    );
995  } catch {
996    deleteBrowserAuthCookies();
997    return null;
998  }
999  const user = toUser(gotrueUser);
1000  startTokenRefresh();
1001  emitAuthEvent(AUTH_EVENTS.LOGIN, user);
1002  return user;
1003};
1004var toAuthProvider = (value) => typeof value === "string" && AUTH_PROVIDERS.includes(value) ? value : void 0;
1005var toOptionalString = (value) => typeof value === "string" && value !== "" ? value : void 0;
1006var toRoles = (appMeta) => {
1007  const roles = appMeta.roles;
1008  if (Array.isArray(roles) && roles.every((r) => typeof r === "string")) {
1009    return roles;
1010  }
1011  return void 0;
1012};
1013var toUser = (userData) => {
1014  const userMeta = userData.user_metadata ?? {};
1015  const appMeta = userData.app_metadata ?? {};
1016  const name2 = userMeta.full_name ?? userMeta.name;
1017  const pictureUrl = userMeta.avatar_url;
1018  return {
1019    id: userData.id,
1020    email: userData.email,
1021    confirmedAt: toOptionalString(userData.confirmed_at),
1022    createdAt: userData.created_at,
1023    updatedAt: userData.updated_at,
1024    role: toOptionalString(userData.role),
1025    provider: toAuthProvider(appMeta.provider),
1026    name: typeof name2 === "string" ? name2 : void 0,
1027    pictureUrl: typeof pictureUrl === "string" ? pictureUrl : void 0,
1028    roles: toRoles(appMeta),
1029    invitedAt: toOptionalString(userData.invited_at),
1030    confirmationSentAt: toOptionalString(userData.confirmation_sent_at),
1031    recoverySentAt: toOptionalString(userData.recovery_sent_at),
1032    pendingEmail: toOptionalString(userData.new_email),
1033    emailChangeSentAt: toOptionalString(userData.email_change_sent_at),
1034    lastSignInAt: toOptionalString(userData.last_sign_in_at),
1035    userMetadata: userMeta,
1036    appMetadata: appMeta
1037  };
1038};
1039var claimsToUser = (claims) => {
1040  const appMeta = claims.app_metadata ?? {};
1041  const userMeta = claims.user_metadata ?? {};
1042  const name2 = userMeta.full_name ?? userMeta.name;
1043  const pictureUrl = userMeta.avatar_url;
1044  return {
1045    id: claims.sub ?? "",
1046    email: claims.email,
1047    provider: toAuthProvider(appMeta.provider),
1048    name: typeof name2 === "string" ? name2 : void 0,
1049    pictureUrl: typeof pictureUrl === "string" ? pictureUrl : void 0,
1050    roles: toRoles(appMeta),
1051    userMetadata: userMeta,
1052    appMetadata: appMeta
1053  };
1054};
1055var decodeJwtPayload = (token) => {
1056  try {
1057    const parts = token.split(".");
1058    if (parts.length !== 3) return null;
1059    const payload = atob(parts[1].replace(/-/g, "+").replace(/_/g, "/"));
1060    return JSON.parse(payload);
1061  } catch {
1062    return null;
1063  }
1064};
1065var fetchFullUser = async (identityUrl, jwt) => {
1066  try {
1067    const res = await fetchWithTimeout(`${identityUrl}/user`, {
1068      headers: { Authorization: `Bearer ${jwt}` }
1069    });
1070    if (!res.ok) return null;
1071    const userData = await res.json();
1072    return toUser(userData);
1073  } catch {
1074    return null;
1075  }
1076};
1077var resolveIdentityUrl = () => {
1078  const identityContext = getIdentityContext();
1079  if (identityContext?.url) return identityContext.url;
1080  if (globalThis.Netlify?.context?.url) {
1081    return new URL(IDENTITY_PATH, globalThis.Netlify.context.url).href;
1082  }
1083  const siteUrl = typeof process !== "undefined" ? process.env?.URL : void 0;
1084  if (siteUrl) {
1085    return new URL(IDENTITY_PATH, siteUrl).href;
1086  }
1087  return null;
1088};
1089var getUser = async () => {
1090  if (isBrowser2()) {
1091    const client = getGoTrueClient();
1092    const currentUser2 = client?.currentUser() ?? null;
1093    if (currentUser2) {
1094      const jwt2 = getCookie(NF_JWT_COOKIE);
1095      if (!jwt2) {
1096        try {
1097          currentUser2.clearSession();
1098        } catch {
1099        }
1100        return null;
1101      }
1102      startTokenRefresh();
1103      return toUser(currentUser2);
1104    }
1105    const jwt = getCookie(NF_JWT_COOKIE);
1106    if (!jwt) return null;
1107    const claims2 = decodeJwtPayload(jwt);
1108    if (!claims2) return null;
1109    const hydrated = await hydrateSession();
1110    return hydrated ?? null;
1111  }
1112  triggerNextjsDynamic();
1113  const identityContext = globalThis.netlifyIdentityContext;
1114  const serverJwt = identityContext?.token ?? getServerCookie(NF_JWT_COOKIE);
1115  if (serverJwt) {
1116    const identityUrl = resolveIdentityUrl();
1117    if (identityUrl) {
1118      const fullUser = await fetchFullUser(identityUrl, serverJwt);
1119      if (fullUser) return fullUser;
1120    }
1121  }
1122  const claims = identityContext?.user ?? null;
1123  return claims ? claimsToUser(claims) : null;
1124};
1125var getSettings = async () => {
1126  const client = getClient();
1127  try {
1128    const raw = await client.settings();
1129    const external = raw.external ?? {};
1130    return {
1131      autoconfirm: raw.autoconfirm,
1132      disableSignup: raw.disable_signup,
1133      providers: {
1134        google: external.google ?? false,
1135        github: external.github ?? false,
1136        gitlab: external.gitlab ?? false,
1137        bitbucket: external.bitbucket ?? false,
1138        facebook: external.facebook ?? false,
1139        email: external.email ?? false
1140      }
1141    };
1142  } catch (err) {
1143    throw new AuthError(err instanceof Error ? err.message : "Failed to fetch identity settings", 502, { cause: err });
1144  }
1145};
1146var resolveCurrentUser = async () => {
1147  const client = getClient();
1148  let currentUser2 = client.currentUser();
1149  if (!currentUser2 && isBrowser2()) {
1150    try {
1151      await hydrateSession();
1152    } catch {
1153    }
1154    currentUser2 = client.currentUser();
1155  }
1156  if (!currentUser2) throw new AuthError("No user is currently logged in");
1157  return currentUser2;
1158};
1159var requestPasswordRecovery = async (email2) => {
1160  const client = getClient();
1161  try {
1162    await client.requestPasswordRecovery(email2);
1163  } catch (error) {
1164    throw AuthError.from(error);
1165  }
1166};
1167var acceptInvite = async (token, password2) => {
1168  const client = getClient();
1169  try {
1170    const gotrueUser = await client.acceptInvite(token, password2, persistSession);
1171    const user = toUser(gotrueUser);
1172    startTokenRefresh();
1173    emitAuthEvent(AUTH_EVENTS.LOGIN, user);
1174    return user;
1175  } catch (error) {
1176    throw AuthError.from(error);
1177  }
1178};
1179var updateUser = async (updates) => {
1180  const currentUser2 = await resolveCurrentUser();
1181  try {
1182    const updatedUser = await currentUser2.update(updates);
1183    const user = toUser(updatedUser);
1184    emitAuthEvent(AUTH_EVENTS.USER_UPDATED, user);
1185    return user;
1186  } catch (error) {
1187    throw AuthError.from(error);
1188  }
1189};
1190