[dominicwild]

Since #77, user.deleted records the id in deletedUsers, and then returns early without calling the app's onEvent handler if the component has no stored user for that id.

That's fine for apps that create their users only from the component's user.created callback. It loses the deletion for apps that also create their own user records some other way, for example at sign-in. WorkOS doesn't guarantee delivery order (docs). So when user.deleted arrives before user.created, such an app's account is never deleted. The later user.created is then skipped too, so the app never hears about the user again.

This change passes the deletion on to the app handler in that case, with the event data as received. Everything else stays the same: event deduplication, the deletedUsers record, filling in the callback data from a stored user when one exists, and skipping later create and update events for a deleted id.

• src/component/lib.test.ts: the handler is called once for a deletion with no stored user (full payload and id-only payload), and later create and update events are still skipped.
• example/convex/auth.test.ts: an app user that exists without a component user is removed by user.deleted.
• README: notes that in this case only id is guaranteed in event.data.

npm run build, test, lint and typecheck pass.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@convex-dev/workos-authkit@82

commit: b926101

[ianmacartney]

@cubic review

[cubic-dev-ai]

@cubic review

@ianmacartney I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}