@versini/auth0-auth-js-stub

@versini/auth0-auth-js-stub

A featherweight, no-op stub of @auth0/auth0-auth-js.

The real package pulls in openid-client + oauth4webapi + jose (~26 KB gzip of first-paint weight) and powers only the MFA / Passkey / MyAccount / DPoP APIs. If your app uses only basic Auth0 login (loginWithRedirect, getAccessTokenSilently, logout, isAuthenticated, user), that weight is dead code.

This stub satisfies the symbols @auth0/auth0-spa-js imports or re-exports at runtime. AuthClient constructs without throwing (it runs on every login). Any MFA, Passkey, or anonymous-session method call throws a clear, actionable error, and isFederatedDomain returns a promise that rejects with one. The exception is anonymous.mintTransferToken: it resolves null. spa-js 2.28 calls it at login whenever a stored anonymous session token exists (one left by an earlier non-thin deployment), and the stub never has a session to link.

Do not set createAnonymousSessionOnFailedSilentAuth with this stub. spa-js 2.27 calls the anonymous client from checkSession when that option is on and swallows the stub's error in a try/catch, so the fallback silently does nothing.

Usage

Don't depend on this directly. It is installed in place of @auth0/auth0-auth-js via a pnpm npm: alias override, together with the slimmed @auth0/auth0-react and @auth0/auth0-spa-js forks. See @versini/auth0-thin for the full setup and the CI verifier.

# pnpm-workspace.yaml
overrides:
  "@auth0/auth0-react":   "npm:@versini/auth0-react-thin@<version>"
  "@auth0/auth0-spa-js":  "npm:@versini/auth0-spa-js-no-authjs@<version>"
  "@auth0/auth0-auth-js": "npm:@versini/auth0-auth-js-stub@<version>"

Only safe if your app never uses Auth0 MFA, Passkey, MyAccount, or DPoP. Run npx auth0-thin verify in CI to enforce that the assumption still holds.

License

MIT. This stub is original code; it contains no Auth0 source.