fix: use DateProvider in EmailVerificationClaim

CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [unreleased]
 
+## [0.9.0] - 2024-01-18
+
+## Breaking Changes
+
+-   The default `DateProvider` implementation relies on `localStorage`. If your environment lacks support for `localStorage`, you must provide custom implementations for either the `DateProvider` or `localStorage`.
+
+### Changes
+
+-   `EmailVerificationClaim` now uses `DateProvider` to account for clock skew.
+-   Exporting the `DateProvider` from supertokens-website, that both built-in and custom validators can use instead of `Date.now` to get an estimate of the server clock.
+-   Added the `dateProvider` prop to the configuration that can be used to customize the built-in `DateProvider`.
+-   Added `getClockSkewInMillis` as an overrideable function to the Session recipe that estimates the time difference between the backend and the client.
+
 ## [0.8.0] - 2023-09-25
 
 ### Overview

lib/ts/dateProvider/index.ts

@@ -0,0 +1,16 @@
+/* Copyright (c) 2024, VRAI Labs and/or its affiliates. All rights reserved.
+ *
+ * This software is licensed under the Apache License, Version 2.0 (the
+ * "License") as published by the Apache Software Foundation.
+ *
+ * You may not use this file except in compliance with the License. You may
+ * obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { DateProviderReference } from "supertokens-website/utils/dateProvider";

lib/ts/dateProvider/types.ts

@@ -0,0 +1,16 @@
+/* Copyright (c) 2024, VRAI Labs and/or its affiliates. All rights reserved.
+ *
+ * This software is licensed under the Apache License, Version 2.0 (the
+ * "License") as published by the Apache Software Foundation.
+ *
+ * You may not use this file except in compliance with the License. You may
+ * obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+export { DateProviderInput, DateProviderInterface } from "supertokens-website/utils/dateProvider/types";

lib/ts/recipe/emailverification/emailVerificationClaim.ts

@@ -1,3 +1,4 @@
+import { DateProviderReference } from "supertokens-website/utils/dateProvider";
 import { SessionClaimValidator, BooleanClaim } from "../session";
 import { RecipeInterface } from "./types";
 
@@ -21,13 +22,14 @@ export class EmailVerificationClaimClass extends BooleanClaim {
                 id: this.id,
                 refresh: this.refresh,
                 shouldRefresh: (payload, userContext) => {
+                    const DateProvider = DateProviderReference.getReferenceOrThrow().dateProvider;
                     const value = this.getValueFromPayload(payload, userContext);
                     return (
                         value === undefined ||
-                        this.getLastFetchedTime(payload, userContext)! < Date.now() - maxAgeInSeconds * 1000 ||
+                        this.getLastFetchedTime(payload, userContext)! < DateProvider.now() - maxAgeInSeconds * 1000 ||
                         (value === false &&
                             this.getLastFetchedTime(payload, userContext)! <
-                                Date.now() - refetchTimeOnFalseInSeconds * 1000)
+                                DateProvider.now() - refetchTimeOnFalseInSeconds * 1000)
                     );
                 },
                 validate: async (payload, userContext) => {

lib/ts/supertokens.ts

@@ -20,6 +20,7 @@ import { CookieHandlerReference } from "./cookieHandler";
 import { WindowHandlerReference } from "./windowHandler";
 import { PostSuperTokensInitCallbacks } from "./postSuperTokensInitCallbacks";
 import { Recipe as MultitenancyRecipe } from "./recipe/multitenancy/recipe";
+import { DateProviderReference } from "./dateProvider";
 
 export default class SuperTokens {
     /*
@@ -71,6 +72,7 @@ export default class SuperTokens {
     static init(config: SuperTokensConfig): void {
         CookieHandlerReference.init(config.cookieHandler);
         WindowHandlerReference.init(config.windowHandler);
+        DateProviderReference.init(config.dateProvider);
 
         if (SuperTokens.instance !== undefined) {
             console.warn("SuperTokens was already initialized");

lib/ts/types.ts

@@ -18,6 +18,7 @@ import NormalisedURLDomain from "./normalisedURLDomain";
 import { NormalisedRecipeConfig } from "./recipe/recipeModule/types";
 import { CookieHandlerInput } from "./cookieHandler/types";
 import { WindowHandlerInput } from "./windowHandler/types";
+import { DateProviderInput } from "./dateProvider/types";
 
 /**
  * The configuration object to be passed when calling SuperTokens.init
@@ -63,6 +64,17 @@ export type SuperTokensConfig = {
      * of the SDK may rely on using the sync versions instead.
      */
     windowHandler?: WindowHandlerInput;
+
+    /**
+     * Custom provider for SDK timing calculations relative to server time.
+     *
+     * The default implementation automatically adjusts for client-server time deviation.
+     *
+     * Typically, you won't need to provide these. If provided, the SDK uses
+     * your implementation instead of the default one.
+     */
+    dateProvider?: DateProviderInput;
+
     /**
      * Enabled logging for the SuperTokens SDK. The SDK will log information in different stages.
      */

lib/ts/version.ts

@@ -12,6 +12,6 @@
  * License for the specific language governing permissions and limitations
  * under the License.
  */
-export const package_version = "0.8.0";
+export const package_version = "0.9.0";
 
 export const supported_fdi = ["1.17", "1.18"];