@abyss-project/commons-front-core 3.3.2 → 4.0.0

package/dist/auth/client/auth-bridge.d.ts

@@ -0,0 +1,51 @@
+import { IWebAuthnAuthenticationCredential, IWebAuthnCreationOptions, IWebAuthnRegistrationCredential, IWebAuthnRequestOptions, SessionPlatform } from '@abyss-project/main';
+/**
+ * What a platform does on the device during a sign-in: passkeys, the Google and Apple buttons.
+ * Two implementations: the web one (`createWebBridge`: WebAuthn, Google Identity Services,
+ * Sign in with Apple JS) and the native one (`createCapacitorBridge`, entry
+ * `@abyss-project/commons-front-core/auth-native`: the `@abyss-project/capacitor-auth` plugin).
+ *
+ * Passkey options and credentials are the JSON abyss-main hands out and expects back (every binary
+ * field base64url), forwarded untouched.
+ */
+export interface AuthBridge {
+    /** The platform the session opened through this bridge lives on (`platform` of every sign-in). */
+    readonly platform: SessionPlatform;
+    passkeySupported(): Promise<boolean>;
+    /**
+     * `conditional` = passkeys offered by the email field autofill (web) / only when one is already
+     * on the device, without the "use another device" fallback (native).
+     */
+    getPasskey(options: IWebAuthnRequestOptions, conditional?: boolean): Promise<IWebAuthnAuthenticationCredential>;
+    createPasskey(options: IWebAuthnCreationOptions): Promise<IWebAuthnRegistrationCredential>;
+    /**
+     * `nonce` is the raw single-use value abyss-main issued (`auth.createIdTokenNonce`), copied as is into
+     * the id_token.
+     */
+    google(nonce: string): Promise<{
+        idToken: string;
+    }>;
+    /** `nonce` is the raw issued value; Apple receives its SHA-256 (hex), as abyss-main checks it. */
+    apple(nonce: string): Promise<{
+        idToken: string;
+        givenName?: string;
+        familyName?: string;
+    }>;
+}
+/** Same values as the native plugin's `AbyssAuthErrorCode`, so both bridges fail alike. */
+export declare enum AuthBridgeErrorCode {
+    /** The user closed the sheet, the popup or the prompt: not an error to show. */
+    CANCELLED = "cancelled",
+    /** This device or browser cannot do it (no WebAuthn, Google on iOS, Apple on Android…). */
+    UNSUPPORTED = "unsupported",
+    /** No passkey of this relying party on the device. */
+    NO_CREDENTIAL = "no_credential",
+    FAILED = "failed"
+}
+export declare class AuthBridgeError extends Error {
+    readonly code: AuthBridgeErrorCode;
+    readonly cause?: unknown;
+    constructor(code: AuthBridgeErrorCode, message: string, cause?: unknown);
+}
+/** SHA-256 of the UTF-8 value, lowercase hex: what Apple carries in its id_token `nonce`. */
+export declare const sha256Hex: (value: string) => Promise<string>;

package/dist/auth/client/auth-client.d.ts

@@ -0,0 +1,125 @@
+import { IAuthResult, IUser } from '@abyss-project/main';
+import { AuthBridge } from './auth-bridge';
+import { TokenStorage } from './token-storage';
+export declare enum AuthStatus {
+    /** `bootstrap()` has not settled yet. */
+    LOADING = "loading",
+    ANONYMOUS = "anonymous",
+    AUTHENTICATED = "authenticated"
+}
+/** How a signed-in user proves again who they are (re-authentication, 5.3). */
+export declare enum ReauthMethod {
+    PASSKEY = "passkey",
+    TOTP = "totp",
+    PASSWORD = "password",
+    EMAIL_CODE = "email-code"
+}
+/** What a 403 `reauth_required` asks for. */
+export interface ReauthRequest {
+    /**
+     * The only methods the server accepts for this action — a second factor, when an enrolled
+     * account touches its factors (`IReauthRequiredErrorParams.methods` of the error). Absent: any
+     * method.
+     */
+    methods?: ReauthMethod[];
+}
+export interface AuthState {
+    status: AuthStatus;
+    user?: IUser;
+    /** An administrator without a second factor: admin access waits for its set-up. */
+    mfaEnrollmentRequired?: boolean;
+    /** abyss-main could not be reached: the session is kept and refreshed when it comes back. */
+    offline?: boolean;
+}
+export interface AuthClientConfig {
+    bridge: AuthBridge;
+    storage: TokenStorage;
+    /**
+     * Puts the access token on every SDK core of the app (main + its own satellite core); `null`
+     * removes it (sign-out). The token stays in memory: never in `localStorage`.
+     */
+    applyToken: (accessToken: string | null) => void;
+    /** Defaults to `navigator.onLine`. */
+    isOnline?: () => boolean;
+    /**
+     * Keeps the signed-in user in the app's own storage, for an offline start; `null` on sign-out.
+     * The user only: no token.
+     */
+    onPersistUser?: (user: IUser | null) => void;
+    /** The user `onPersistUser` kept, read once by `bootstrap()`. */
+    restoreUser?: () => IUser | null | Promise<IUser | null>;
+}
+export interface AuthClient {
+    readonly bridge: AuthBridge;
+    state(): AuthState;
+    /** Called on every state change (not with the current state). Returns the unsubscribe. */
+    subscribe(listener: (state: AuthState) => void): () => void;
+    /** The access token in use, `null` when signed out. */
+    accessToken(): string | null;
+    /**
+     * Called at once with the current access token, then with each new one (`null` on sign-out):
+     * for a process that holds its own copy, such as the Memories background runner (ruling R4).
+     */
+    subscribeToken(listener: (accessToken: string | null) => void): () => void;
+    /**
+     * Restores the session at launch (idempotent). Offline or abyss-main unreachable: the persisted
+     * user stays signed in with `offline: true`, and a single refresh runs when the network is back.
+     * Only an explicit refusal (401) signs out.
+     */
+    bootstrap(): Promise<void>;
+    /** `AUTHENTICATED`: stores the refresh token, applies the access token, schedules the refresh. */
+    handleResult(result: IAuthResult): Promise<IAuthResult>;
+    /**
+     * Rotates the refresh token, one rotation at a time (in-process shared promise, plus the
+     * `abyss-auth-refresh` Web Lock across the tabs of a web origin). Settles once the state says
+     * the outcome; rejects only if an app callback (`applyToken`, `onPersistUser`, storage) throws.
+     */
+    refresh(): Promise<void>;
+    /**
+     * Runs an API call; on 401 `Token Expired`, one refresh and one replay. On 403
+     * `reauth_required`, awaits the `onReauthRequired` handler and replays once if it proved.
+     */
+    withAuthRetry<T>(call: () => Promise<T>): Promise<T>;
+    /**
+     * The UI's re-authentication dialog: resolves `true` once the user proved again (and the new
+     * session went through `handleResult`), `false` if cancelled. Receives the methods the server
+     * restricted the proof to. One handler; returns the removal.
+     */
+    onReauthRequired(handler: (request: ReauthRequest) => Promise<boolean>): () => void;
+    /** Revokes the session server-side, then forgets it locally (even if the call failed). */
+    logout(): Promise<void>;
+    /** Stops the timers and listeners (tests, hot reload). */
+    dispose(): void;
+}
+/** Refresh a minute before the access token expires. */
+export declare const REFRESH_MARGIN_MS = 60000;
+/**
+ * abyss-main answers the same token pair again to a refresh token replayed less than 30 s after
+ * its rotation (ADR-0153); past that, the replay counts as a reuse and revokes the session.
+ */
+export declare const REFRESH_REPLAY_GRACE_MS = 30000;
+/**
+ * No answer to a refresh (network error, 5xx) while the device is online: the request may have
+ * reached abyss-main and rotated the token, only the response being lost. The refresh is replayed
+ * at once: three more attempts after these delays (3.5 s in all).
+ */
+export declare const LOST_RESPONSE_RETRY_DELAYS_MS: readonly number[];
+/**
+ * Still no answer after those replays: later attempts, timed from the first unanswered call (the
+ * rotation, if it happened, came after it), all inside the grace. The last one leaves 3 s for the
+ * request to travel. Coming back online or to the foreground replays at once as well.
+ */
+export declare const LOST_RESPONSE_LATE_RETRIES_AT_MS: readonly number[];
+/**
+ * abyss-main still unreachable once that grace is over, or the device offline: next attempt,
+ * unless the network or the app comes back first.
+ */
+export declare const UNREACHABLE_RETRY_MS = 30000;
+/**
+ * One refresh attempt is given up after this long (its request aborted) and counts as unanswered:
+ * a connection frozen after the request reached abyss-main would otherwise hold the replays, and
+ * the reconnect and foreground replays, past the grace.
+ */
+export declare const REFRESH_ATTEMPT_TIMEOUT_MS = 5000;
+export declare const REFRESH_LOCK_NAME = "abyss-auth-refresh";
+export declare const createAuthClient: (config: AuthClientConfig) => AuthClient;

package/dist/auth/client/auth-client.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/client/capacitor-bridge.d.ts

@@ -0,0 +1,16 @@
+import { AuthBridge } from './auth-bridge';
+import { TokenStorage } from './token-storage';
+export interface CapacitorBridgeConfig {
+    /** The Google OAuth client id of the web application type (Credential Manager audience). */
+    googleServerClientId: string;
+    /**
+     * Offer passkeys in the app. Off by default: a native passkey only works once abyss-project.fr
+     * serves the app's domain association files (AASA, assetlinks). Off, the bridge reports passkeys
+     * unsupported and no screen offers them.
+     */
+    nativePasskeys?: boolean;
+}
+/** The bridge of the iOS and Android apps. Throws on the web: use `createWebBridge` there. */
+export declare const createCapacitorBridge: (config: CapacitorBridgeConfig) => AuthBridge;
+/** The refresh token in the Keychain (iOS) / Keystore (Android). */
+export declare const createCapacitorTokenStorage: () => TokenStorage;

package/dist/auth/client/index.d.ts

@@ -0,0 +1,6 @@
+export * from './auth-bridge';
+export * from './auth-client';
+export * from './token-storage';
+export * from './web-bridge';
+export * from '../react/AuthProvider.component';
+export * from '../react/use-auth.hook';

package/dist/auth/client/native-bridge.d.ts

@@ -0,0 +1,53 @@
+import { SessionPlatform } from '@abyss-project/main';
+import { AuthBridge } from './auth-bridge';
+/**
+ * The calls the native bridge makes on `@abyss-project/capacitor-auth` (its `AbyssAuthPlugin`).
+ * Declared here so this file never imports the plugin: only `capacitor-bridge.ts` does, and the
+ * plugin's own type is checked against this one there.
+ */
+export interface NativeAuthPlugin {
+    isPasskeySupported(): Promise<{
+        supported: boolean;
+    }>;
+    createPasskey(options: {
+        optionsJson: string;
+    }): Promise<{
+        responseJson: string;
+    }>;
+    getPasskey(options: {
+        optionsJson: string;
+        preferImmediatelyAvailable?: boolean;
+    }): Promise<{
+        responseJson: string;
+    }>;
+    signInWithGoogle(options: {
+        serverClientId: string;
+        nonce: string;
+    }): Promise<{
+        idToken: string;
+    }>;
+    signInWithApple(options: {
+        nonce: string;
+    }): Promise<{
+        idToken: string;
+        givenName?: string;
+        familyName?: string;
+    }>;
+}
+export interface NativeBridgeConfig {
+    platform: SessionPlatform.IOS | SessionPlatform.ANDROID;
+    /** The Google OAuth client id of the web application type, the audience of the id_token. */
+    googleServerClientId: string;
+    /**
+     * Whether the app may use passkeys. They need the domain association files (`apple-app-site-
+     * association`, `assetlinks.json`) served for the app: until then the bridge reports passkeys
+     * unsupported, and every screen hides them.
+     */
+    passkeys: boolean;
+    loadPlugin: () => Promise<NativeAuthPlugin>;
+}
+/**
+ * The bridge over the native plugin. The webview (origin `localhost`) cannot use WebAuthn itself:
+ * Credential Manager / ASAuthorization do it, the options and the credential crossing as JSON.
+ */
+export declare const createNativeBridge: (config: NativeBridgeConfig) => AuthBridge;

package/dist/auth/client/native-bridge.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/client/token-storage.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Where the refresh token lives between two launches. Never `localStorage`: on the web the browser
+ * keeps it in the `HttpOnly` cookie `abyss_refresh` (JavaScript never sees it), on native apps the
+ * Keychain / Keystore holds it.
+ */
+export interface TokenStorage {
+    getRefreshToken(): Promise<string | null>;
+    /** `null` forgets it (sign-out, revoked session). */
+    setRefreshToken(token: string | null): Promise<void>;
+}
+/** The native secure store, as `@abyss-project/capacitor-auth` exposes it. */
+export interface SecureStore {
+    secureGet(options: {
+        key: string;
+    }): Promise<{
+        value: string | null;
+    }>;
+    secureSet(options: {
+        key: string;
+        value: string;
+    }): Promise<void>;
+    secureRemove(options: {
+        key: string;
+    }): Promise<void>;
+}
+/** Each app has its own Keychain / Keystore, so one key name serves them all. */
+export declare const REFRESH_TOKEN_STORAGE_KEY = "abyss_refresh_token";
+/** Web: nothing to keep, the cookie travels with every `auth/refresh` call (`withCredentials`). */
+export declare const createWebTokenStorage: () => TokenStorage;
+/** Native: the refresh token in the secure store `loadStore` resolves to. */
+export declare const createSecureTokenStorage: (loadStore: () => Promise<SecureStore>) => TokenStorage;

package/dist/auth/client/web-bridge.d.ts

@@ -0,0 +1,13 @@
+import { AuthBridge } from './auth-bridge';
+export declare const GOOGLE_IDENTITY_SCRIPT_URL = "https://accounts.google.com/gsi/client";
+export declare const APPLE_ID_SCRIPT_URL = "https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1.0/en_US/appleid.auth.js";
+export interface WebBridgeConfig {
+    /** Google OAuth client id (web application type). */
+    googleClientId: string;
+    /** Apple Services ID of the site. */
+    appleServiceId: string;
+    /** Return URL declared on the Services ID; required by Apple JS even in popup mode. */
+    appleRedirectUri: string;
+}
+/** The bridge of every web front: WebAuthn, Google Identity Services, Sign in with Apple JS. */
+export declare const createWebBridge: (config: WebBridgeConfig) => AuthBridge;

package/dist/auth/client/web-bridge.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/components/AuthFlow/AuthFlow.component.d.ts

@@ -0,0 +1,30 @@
+import { IAuthResult } from '@abyss-project/main';
+import { AuthFlowProviders } from '../AuthProviderButtons/AuthProviderButtons.component';
+import { AuthFlowContext, AuthFlowLegal, AuthFlowResult } from './auth-flow.types';
+export type AuthFlowProps = {
+    initialEmail?: string;
+    /**
+     * A result the host already obtained outside this flow (its own OAuth callback page, which
+     * calls `sdk.auth.oauth` / `signInWithIdToken` itself): the flow starts at the step it calls
+     * for instead of the e-mail step. `AUTHENTICATED` applies the session and either finishes or
+     * opens the mandatory enrolment step (`session.mfaEnrollmentRequired`); `MFA_REQUIRED` opens
+     * the second-factor step with that challenge; `SIGNUP_REQUIRED` opens the sign-up step with
+     * that token (the e-mail shown is never an editable field, there or here).
+     */
+    initialResult?: IAuthResult;
+    context: AuthFlowContext;
+    providers: AuthFlowProviders;
+    /**
+     * The user is signed in (session applied through the auth client): the host navigates to the
+     * page that was asked for, in its own front (CA8).
+     */
+    onAuthenticated: (result: AuthFlowResult) => void;
+    legal: AuthFlowLegal;
+};
+/**
+ * The single sign-in / sign-up flow of every Abyss front (5.1): e-mail first, then passkey, e-mail
+ * code or password; Google and Apple; an account created by the same code; second factor;
+ * mandatory MFA set-up for an administrator; passkey proposal. Must be rendered inside
+ * `<AuthProvider>`: every session goes through its client.
+ */
+export declare const AuthFlow: ({ initialEmail, initialResult, context, providers, onAuthenticated, legal, }: AuthFlowProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/AuthFlow/AuthFlow.component.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/components/AuthFlow/auth-flow.types.d.ts

@@ -0,0 +1,62 @@
+import { AuthMethod, IUser, MfaFactorType, UserLanguage } from '@abyss-project/main';
+/** What the arrival link carried, applied to an account created during this flow (D4). */
+export interface AuthFlowContext {
+    sponsorId?: string;
+    invitationTokenId?: string;
+    /** Pre-selected language of a new account (the interface language). */
+    language: UserLanguage;
+    /**
+     * Query forwarded to the Discord / Slack connect URL (web code flow), relayed back to the host's
+     * OAuth callback page: typically its redirect path and target service. `sponsorId` and
+     * `invitationTokenId` are added by the flow itself.
+     */
+    oauthQuery?: Record<string, string>;
+}
+/** Links of the terms checkbox of the sign-up step. */
+export interface AuthFlowLegal {
+    termsUrl: string;
+    privacyUrl: string;
+}
+export interface AuthFlowResult {
+    user: IUser;
+    /** Always `false` once the flow ends: an enrolment it required was completed inside it. */
+    mfaEnrollmentRequired: boolean;
+}
+export declare enum AuthFlowStepKind {
+    EMAIL = "email",
+    CODE = "code",
+    PASSWORD = "password",
+    SIGNUP = "signup",
+    MFA = "mfa",
+    ENROLLMENT = "enrollment",
+    NUDGE = "nudge"
+}
+export type AuthFlowStep = {
+    kind: AuthFlowStepKind.EMAIL;
+} | {
+    kind: AuthFlowStepKind.CODE;
+} | {
+    kind: AuthFlowStepKind.PASSWORD;
+} | {
+    kind: AuthFlowStepKind.SIGNUP;
+    signupToken: string;
+    email: string;
+    /** How the address was proven (e-mail code, Google, Apple). */
+    method: AuthMethod;
+} | {
+    kind: AuthFlowStepKind.MFA;
+    challengeToken: string;
+    factors: MfaFactorType[];
+} | {
+    kind: AuthFlowStepKind.ENROLLMENT;
+    user: IUser;
+} | {
+    kind: AuthFlowStepKind.NUDGE;
+    user: IUser;
+};
+/** A confirmation a step shows in its live region. */
+export declare enum AuthFlowNotice {
+    CODE_RESENT = "code-resent",
+    RESET_SENT = "reset-sent",
+    PASSKEY_CANCELLED = "passkey-cancelled"
+}

package/dist/auth/components/AuthFlow/steps/CodeStep.component.d.ts

@@ -0,0 +1,17 @@
+import { AuthErrorKind } from '../../shared/auth-errors';
+export type CodeStepProps = {
+    email: string;
+    busy: boolean;
+    error: AuthErrorKind | null;
+    /** A new code was sent: the previous one no longer works. */
+    resent: boolean;
+    onSubmit: (code: string) => void;
+    onResend: () => void;
+    onUsePassword: () => void;
+    onChangeEmail: () => void;
+};
+/**
+ * The 6-digit code sent by e-mail (10 min, 5 tries, one live code per address). A complete code is
+ * submitted at once — typed, pasted or filled in by the platform.
+ */
+export declare const CodeStep: ({ email, busy, error, resent, onSubmit, onResend, onUsePassword, onChangeEmail, }: CodeStepProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/AuthFlow/steps/EmailStep.component.d.ts

@@ -0,0 +1,22 @@
+import { ReactNode } from 'react';
+import { AuthErrorKind } from '../../shared/auth-errors';
+export declare const isEmailLike: (value: string) => boolean;
+export type EmailStepProps = {
+    email: string;
+    onEmailChange: (email: string) => void;
+    onSubmit: () => void;
+    busy: boolean;
+    error: AuthErrorKind | null;
+    /**
+     * Resolved support of passkeys on this device. When `true`, `onStartConditionalPasskey` runs
+     * at mount: the passkeys of the device show in the e-mail field's suggestions (web) or in the
+     * system sheet (native).
+     */
+    passkeySupported: boolean;
+    onStartConditionalPasskey: () => void;
+    /** The modal passkey ceremony, offered as a secondary button while `passkeySupported`. */
+    onPasskey: () => void;
+    /** Google / Apple (and Discord / Slack on the web) above the form. */
+    providers?: ReactNode;
+};
+export declare const EmailStep: ({ email, onEmailChange, onSubmit, busy, error, passkeySupported, onStartConditionalPasskey, onPasskey, providers, }: EmailStepProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/AuthFlow/steps/MfaEnrollmentStep.component.d.ts

@@ -0,0 +1,13 @@
+export type MfaEnrollmentStepProps = {
+    passkeySupported: boolean;
+    /** The factor is set up and the session re-proven with it: admin access is open. */
+    onEnrolled: () => void;
+    /** The only way out besides enrolling. */
+    onSignOut: () => void;
+};
+/**
+ * Mandatory set-up of a second factor (an administrator without one, Q6): no skip. Once the factor
+ * exists, the session is re-proven with it — a session only counts as MFA once a second factor was
+ * presented on it — so the admin token is granted right after this step, without signing in again.
+ */
+export declare const MfaEnrollmentStep: ({ passkeySupported, onEnrolled, onSignOut, }: MfaEnrollmentStepProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/AuthFlow/steps/MfaStep.component.d.ts

@@ -0,0 +1,20 @@
+import { MfaFactorType } from '@abyss-project/main';
+import { AuthErrorKind } from '../../shared/auth-errors';
+export type MfaStepProps = {
+    /** The factors the account has, from the `MFA_REQUIRED` challenge. */
+    factors: MfaFactorType[];
+    passkeySupported: boolean;
+    busy: boolean;
+    error: AuthErrorKind | null;
+    /** The passkey sheet was dismissed: the user may try again or pick another factor. */
+    passkeyCancelled: boolean;
+    onSubmitCode: (factor: MfaFactorType.TOTP | MfaFactorType.RECOVERY_CODE, code: string) => void;
+    onPasskey: () => void;
+    /** The challenge expired (5 min): back to the e-mail step. */
+    onRestart: () => void;
+};
+/**
+ * Second factor of a sign-in proven by password, e-mail code, Google or Apple (D6): authenticator
+ * code, passkey, or one of the recovery codes (each usable once).
+ */
+export declare const MfaStep: ({ factors, passkeySupported, busy, error, passkeyCancelled, onSubmitCode, onPasskey, onRestart, }: MfaStepProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/AuthFlow/steps/PasskeyNudgeStep.component.d.ts

@@ -0,0 +1,11 @@
+import { IUser } from '@abyss-project/main';
+export type PasskeyNudgeStepProps = {
+    user: IUser;
+    /** Created, or declined: the sign-in goes on to the page that was asked for. */
+    onDone: () => void;
+};
+/**
+ * After a sign-in without passkey, on a device that can hold one (5.1, 7): a proposal to create
+ * one, never a requirement. "Later" is remembered for this user on this device.
+ */
+export declare const PasskeyNudgeStep: ({ user, onDone }: PasskeyNudgeStepProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/AuthFlow/steps/PasswordStep.component.d.ts

@@ -0,0 +1,17 @@
+import { AuthErrorKind } from '../../shared/auth-errors';
+export type PasswordStepProps = {
+    email: string;
+    busy: boolean;
+    error: AuthErrorKind | null;
+    /** The reset e-mail was requested (same answer whether the account exists or not). */
+    resetSent: boolean;
+    onSubmit: (password: string) => void;
+    onForgotPassword: () => void;
+    onUseCode: () => void;
+    onChangeEmail: () => void;
+};
+/**
+ * Password sign-in. The address travels in a hidden `username` field of the same form, so a
+ * password manager files the password under the right account and offers it back.
+ */
+export declare const PasswordStep: ({ email, busy, error, resetSent, onSubmit, onForgotPassword, onUseCode, onChangeEmail, }: PasswordStepProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/AuthFlow/steps/SignupStep.component.d.ts

@@ -0,0 +1,24 @@
+import { UserLanguage } from '@abyss-project/main';
+import { AuthErrorKind } from '../../shared/auth-errors';
+import { AuthFlowLegal } from '../auth-flow.types';
+/** Mirrors the `alias` floor of the API sign-up validator (as the current web sign-up does). */
+export declare const ALIAS_MIN_LENGTH = 3;
+export type SignupStepProps = {
+    email: string;
+    defaultLanguage: UserLanguage;
+    legal: AuthFlowLegal;
+    busy: boolean;
+    error: AuthErrorKind | null;
+    onSubmit: (values: {
+        alias: string;
+        language: UserLanguage;
+    }) => void;
+    /** The sign-up token expired (30 min): back to the e-mail step. */
+    onRestart: () => void;
+};
+/**
+ * Completes an account for an address no account matches: the fields of the current web sign-up
+ * (alias pre-filled from the e-mail local part, language, mandatory terms). Sponsorship and
+ * invitation come from the flow's context, not from this form.
+ */
+export declare const SignupStep: ({ email, defaultLanguage, legal, busy, error, onSubmit, onRestart, }: SignupStepProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/AuthFlow/steps/steps.autocomplete.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/components/AuthProviderButtons/AuthProviderButtons.component.d.ts

@@ -0,0 +1,30 @@
+export declare enum AuthProviderKind {
+    GOOGLE = "google",
+    APPLE = "apple",
+    /** Code flow through the browser (redirect): web only (Q5). */
+    DISCORD = "discord",
+    /** Code flow through the browser (redirect): web only (Q5). */
+    SLACK = "slack"
+}
+/** Which sign-in providers the host offers. Discord and Slack are ignored outside the web. */
+export interface AuthFlowProviders {
+    google: boolean;
+    apple: boolean;
+    discord?: boolean;
+    slack?: boolean;
+}
+export type AuthProviderButtonsProps = {
+    providers: AuthFlowProviders;
+    /** `false` on native apps: Discord and Slack have no native SDK (Q5). */
+    allowCodeFlowProviders: boolean;
+    /** The provider whose sign-in is under way (spinner on its button). */
+    pending: AuthProviderKind | null;
+    disabled?: boolean;
+    onSelect: (provider: AuthProviderKind) => void;
+};
+/**
+ * "Continuer avec Google / Apple" (full width, one per line), then Discord and Slack side by side
+ * on the web when the host enables them, then the "or" separator above the e-mail form.
+ * Renders nothing when no provider is enabled.
+ */
+export declare const AuthProviderButtons: ({ providers, allowCodeFlowProviders, pending, disabled, onSelect, }: AuthProviderButtonsProps) => import("react/jsx-runtime").JSX.Element | null;

package/dist/auth/components/MfaRequirementBanner/MfaRequirementBanner.component.d.ts

@@ -0,0 +1,12 @@
+export type MfaRequirementBannerProps = {
+    /** Opens the host's Security page; without it, the banner informs without a button. */
+    onConfigure?: () => void;
+};
+/**
+ * Says why a second factor is required while the user has none (`GET /user/me/mfa`): an
+ * administrator account, or an organisation requiring it (Q1: 7 days of grace, then no access to
+ * its projects — the personal account stays intact). Disappears once a factor exists, including
+ * one added in this tab. Renders nothing for a signed-out user, while loading, or if the status
+ * cannot be read: the server enforces the requirement either way, the banner only announces it.
+ */
+export declare const MfaRequirementBanner: ({ onConfigure, }: MfaRequirementBannerProps) => import("react/jsx-runtime").JSX.Element | null;

package/dist/auth/components/MfaRequirementBanner/MfaRequirementBanner.component.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/components/ReauthDialog/AuthReauthHost.component.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Registers the re-authentication dialog with the auth client: a call answering 403
+ * `reauth_required` (through `withAuthRetry`) opens it, and is replayed once the user proved
+ * again. Calls that hit it while it is open wait for the same answer. A 403 that restricts the
+ * methods (a second factor only) opens the dialog with that restriction. Mount once, inside
+ * `<AuthProvider>` and the theme / intl providers.
+ */
+export declare const AuthReauthHost: () => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/ReauthDialog/ReauthDialog.component.d.ts

@@ -0,0 +1,22 @@
+import { ReauthMethod } from '../../client/auth-client';
+export type ReauthDialogProps = {
+    open: boolean;
+    /** Closed without proving: the action that asked for it is abandoned. */
+    onClose: () => void;
+    /** Proven: the new session is applied, the action can be replayed. */
+    onReauthenticated: () => void;
+    /**
+     * The only methods the server accepts for this action (the `methods` of its 403
+     * `reauth_required`): a second factor, for an enrolled account touching its factors. Absent:
+     * every method of the user.
+     */
+    allowedMethods?: ReauthMethod[];
+};
+/**
+ * Re-authentication (5.3, CA17): a proof of less than 5 minutes for a sensitive action, with the
+ * strongest method the user has — passkey, authenticator code, password — or a code by e-mail;
+ * only a second factor when the server says so (`allowedMethods`). The new session goes through
+ * the auth client before `onReauthenticated`. Opened by `<AuthReauthHost />` when an API call
+ * answers 403 `reauth_required`.
+ */
+export declare const ReauthDialog: ({ open, onClose, onReauthenticated, allowedMethods, }: ReauthDialogProps) => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/ReauthDialog/ReauthDialog.component.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/auth/components/SecuritySettings/SecuritySettings.component.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The Security page of every Abyss front (5.2, 5.3): connected devices, passkeys, authenticator
+ * app, recovery codes, e-mail address, password. Must be rendered inside `<AuthProvider>`;
+ * sensitive actions open the re-authentication dialog through the client (mount
+ * `<AuthReauthHost />` once).
+ */
+export declare const SecuritySettings: () => import("react/jsx-runtime").JSX.Element;

package/dist/auth/components/SecuritySettings/SecuritySettings.component.spec.d.ts

@@ -0,0 +1 @@
+export {};