@atlasauth/js 0.1.0

package/dist/fapi.js

@@ -0,0 +1,314 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initialFlow = exports.FapiClient = void 0;
+exports.getProviderToken = getProviderToken;
+exports.requestForStep = requestForStep;
+exports.flowFromPending = flowFromPending;
+exports.advance = advance;
+exports.startSignUp = startSignUp;
+exports.prepareFactor = prepareFactor;
+exports.pollAttempt = pollAttempt;
+exports.shouldKeepPolling = shouldKeepPolling;
+const attempt_1 = require("./attempt");
+class FapiClient {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async request(path, init = {}) {
+        const doFetch = this.options.fetchImpl ?? fetch;
+        let response;
+        try {
+            response = await doFetch(`${this.options.baseUrl ?? ''}${path}`, {
+                ...init,
+                // Cookies carry the session. A request without this is indistinguishable
+                // from being signed out, which is a maddening bug to chase.
+                credentials: 'include',
+                headers: {
+                    'x-publishable-key': this.options.publishableKey,
+                    ...(init.body ? { 'content-type': 'application/json' } : {}),
+                    ...init.headers,
+                },
+            });
+        }
+        catch {
+            /**
+             * A network failure is reported as a form-level error rather than thrown.
+             * A sign-in box that throws on a flaky connection unmounts itself and
+             * loses whatever the user had typed.
+             */
+            return {
+                ok: false,
+                status: 0,
+                data: null,
+                errors: [{ code: 'NETWORK', message: 'We could not reach the server.' }],
+            };
+        }
+        let body = null;
+        try {
+            body = await response.json();
+        }
+        catch {
+            // A 204, or an error page from a proxy. Neither should crash the parse.
+        }
+        return {
+            ok: response.ok,
+            status: response.status,
+            data: response.ok ? body : null,
+            // §9.1 messages are written for humans and surfaced verbatim.
+            errors: response.ok ? [] : (0, attempt_1.fieldErrors)(body),
+        };
+    }
+    post(path, body) {
+        return this.request(path, {
+            method: 'POST',
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+    }
+    get(path) {
+        return this.request(path, { method: 'GET' });
+    }
+}
+exports.FapiClient = FapiClient;
+/**
+ * Fetch the signed-in user's provider access token. Returns null when there is
+ * no usable token (no linked account, or the provider granted none / revoked
+ * it) — the caller's cue to prompt a re-connect rather than treat it as fatal.
+ * The server refreshes a stale token on read, single-flight, so the token
+ * handed back is always live.
+ */
+async function getProviderToken(client, provider) {
+    const response = await client.get(`/v1/client/me/external_accounts/${encodeURIComponent(provider)}/token`);
+    if (!response.ok || !response.data)
+        return null;
+    return {
+        provider: response.data.provider,
+        accessToken: response.data.access_token,
+        expiresAt: response.data.expires_at ?? null,
+        scopes: response.data.scopes ?? [],
+    };
+}
+exports.initialFlow = {
+    attempt: null,
+    errors: [],
+    busy: false,
+    pollSecret: null,
+    ticket: null,
+};
+/**
+ * Which request the current step needs.
+ *
+ * Exported and tested separately from the network call, because this mapping is
+ * the part that can be wrong in a way nobody notices until a user is stuck.
+ */
+function requestForStep(attempt, values) {
+    if (!attempt) {
+        return {
+            path: '/v1/client/sign_ins',
+            // §5 carry a captcha token when the sign-in flow gates the identifier
+            // step (an always-on per-flow captcha, or a risk-triggered challenge the
+            // server answered with needs_captcha).
+            body: {
+                identifier: values.identifier ?? '',
+                ...(values.captcha_token ? { captcha_token: values.captcha_token } : {}),
+            },
+        };
+    }
+    const step = (0, attempt_1.nextStep)(attempt);
+    const id = attempt.id ?? '';
+    switch (step.kind) {
+        case 'collect_identifier':
+            return {
+                path: '/v1/client/sign_ins',
+                body: {
+                    identifier: values.identifier ?? '',
+                    ...(values.captcha_token ? { captcha_token: values.captcha_token } : {}),
+                },
+            };
+        case 'collect_first_factor':
+            /**
+             * An emailed code and a password both arrive as "the thing the user
+             * typed", but they are different strategies on the same endpoint. The
+             * presence of a code field is what distinguishes them — a client-declared
+             * strategy would be a field the client can get wrong.
+             */
+            return values.code
+                ? {
+                    path: `/v1/client/sign_ins/${id}/attempt_first_factor`,
+                    body: { strategy: 'email_code', code: values.code },
+                }
+                : {
+                    path: `/v1/client/sign_ins/${id}/attempt_first_factor`,
+                    body: { strategy: 'password', password: values.password ?? '' },
+                };
+        case 'collect_second_factor':
+            // Only ever the code (+ the §5.3 "remember this device" opt-in). Sending
+            // `password` here would be posting a credential to an endpoint that has no
+            // business seeing one.
+            return {
+                path: `/v1/client/sign_ins/${id}/attempt_second_factor`,
+                body: {
+                    code: values.code ?? '',
+                    ...(values.remember_device === 'true' ? { remember_device: true } : {}),
+                },
+            };
+        /**
+         * §11.1 MFA policy `required`. Two consecutive codes, and the factor id
+         * from the prepare step — a different endpoint from the second factor,
+         * because there is no factor to verify against yet.
+         */
+        case 'enroll_second_factor':
+            return {
+                path: `/v1/client/sign_ins/${id}/attempt_mfa_enrollment`,
+                body: {
+                    factor_id: values.factorId ?? '',
+                    codes: [values.code ?? '', values.secondCode ?? ''],
+                },
+            };
+        case 'collect_email_code':
+            return {
+                path: `/v1/client/sign_ups/${id}/attempt_verification`,
+                body: { code: values.code ?? '' },
+            };
+        case 'collect_captcha':
+            /**
+             * §5 the challenge marker carries no attempt id — the server withheld the
+             * attempt until the captcha clears. There is nothing to submit until the
+             * widget yields a token (the client should render the captcha, not POST);
+             * once solved, re-issue the identifier POST WITH the token to create the
+             * real attempt. Submitting without a token just re-triggers the challenge.
+             */
+            return values.captcha_token
+                ? {
+                    path: '/v1/client/sign_ins',
+                    body: {
+                        identifier: values.identifier ?? '',
+                        captcha_token: values.captcha_token,
+                    },
+                }
+                : null;
+        case 'collect_new_password':
+            return {
+                path: `/v1/client/password_resets/${id}/set_new_password`,
+                body: { password: values.password ?? '' },
+            };
+        case 'await_oauth':
+        case 'done':
+        case 'restart':
+        case 'unknown':
+            /**
+             * Nothing to submit. Returning null rather than a best guess means a
+             * component cannot accidentally POST to an endpoint that does not apply
+             * to the state the server put it in.
+             */
+            return null;
+    }
+}
+/**
+ * §5.3: seed a flow from an attempt the app was handed mid-stream — an OAuth
+ * redirect that came back needing a second factor (`__atlas_status`), with no
+ * ticket because the server withheld the session until the factor is passed.
+ *
+ * The attempt id lets the next submit target the right attempt; the status
+ * routes the UI to the step the server is demanding. A null pending attempt —
+ * the ordinary fresh sign-in — yields the empty initial flow.
+ */
+function flowFromPending(pending) {
+    if (!pending)
+        return exports.initialFlow;
+    return {
+        ...exports.initialFlow,
+        attempt: { id: pending.id, status: pending.status },
+    };
+}
+/** Advance the flow by one step. Never decides the next status itself. */
+async function advance(client, state, values) {
+    const request = requestForStep(state.attempt, values);
+    if (!request)
+        return state;
+    const response = await client.post(request.path, request.body);
+    if (!response.ok || !response.data) {
+        /**
+         * The attempt is KEPT on failure. Clearing it would drop the user back to
+         * the identifier step after one wrong password, losing the progress they
+         * made and re-triggering the anti-enumeration path for no reason.
+         */
+        return { ...state, busy: false, errors: response.errors };
+    }
+    return {
+        attempt: response.data,
+        errors: [],
+        busy: false,
+        pollSecret: state.pollSecret,
+        // A completion response carries the ticket to exchange for cookies.
+        ticket: response.data.ticket ?? null,
+    };
+}
+/**
+ * §5 Begin a password sign-up. POSTs email + password + the tenant's configured
+ * extra fields (name, company, phone, custom…) to `/v1/client/sign_ups` and
+ * returns a flow. Usually `needs_email_verification` — the shared `advance` then
+ * drives the emailed code to completion — or, when the instance doesn't gate on
+ * verification, a `complete` attempt carrying the session ticket.
+ */
+async function startSignUp(client, input) {
+    const hasFields = input.fields && Object.keys(input.fields).length > 0;
+    const response = await client.post('/v1/client/sign_ups', {
+        email: input.email,
+        password: input.password,
+        ...(hasFields ? { fields: input.fields } : {}),
+        // §5.1 forward the legal-consent tick so the server can enforce a REQUIRED
+        // agreement (the disabled submit is only a client-side courtesy).
+        ...(input.consent ? { consent: true } : {}),
+        // §5 the bot-defence token, when the sign-up flow's captcha is enabled.
+        ...(input.captchaToken ? { captcha_token: input.captchaToken } : {}),
+    });
+    if (!response.ok || !response.data) {
+        return { ...exports.initialFlow, busy: false, errors: response.errors };
+    }
+    return {
+        attempt: response.data,
+        errors: [],
+        busy: false,
+        pollSecret: exports.initialFlow.pollSecret,
+        ticket: response.data.ticket ?? null,
+    };
+}
+/** §5.3: ask the server to send a code or a magic link. */
+async function prepareFactor(client, state, strategy) {
+    const id = state.attempt?.id;
+    if (!id)
+        return state;
+    const response = await client.post(`/v1/client/sign_ins/${id}/prepare_first_factor`, { strategy });
+    if (!response.ok)
+        return { ...state, busy: false, errors: response.errors };
+    return {
+        ...state,
+        busy: false,
+        errors: [],
+        // Held in memory only. It is what lets THIS tab collect a sign-in completed
+        // by a link opened on another device.
+        pollSecret: response.data?.poll_secret ?? null,
+    };
+}
+/**
+ * §5.3 polling. Returns the updated flow, and a ticket once the link has been
+ * opened somewhere.
+ */
+async function pollAttempt(client, state) {
+    const id = state.attempt?.id;
+    if (!id || !state.pollSecret)
+        return { state, ticket: null };
+    const response = await client.get(`/v1/client/sign_ins/${id}?poll_secret=${encodeURIComponent(state.pollSecret)}`);
+    if (!response.ok || !response.data)
+        return { state, ticket: null };
+    return {
+        state: { ...state, attempt: response.data },
+        ticket: response.data.ticket ?? null,
+    };
+}
+/** Whether polling should continue, so a tab does not poll a dead attempt forever. */
+function shouldKeepPolling(state) {
+    return Boolean(state.pollSecret) && Boolean(state.attempt) && !(0, attempt_1.isTerminal)(state.attempt);
+}
+//# sourceMappingURL=fapi.js.map

package/dist/fapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fapi.js","sourceRoot":"","sources":["../src/fapi.ts"],"names":[],"mappings":";;;AAoHA,4CAmBC;AA8BD,wCAkHC;AAWD,0CAMC;AAGD,0BA2BC;AASD,kCAiCC;AAGD,sCAuBC;AAMD,kCAiBC;AAGD,8CAEC;AAtaD,uCAAiG;AA+BjG,MAAa,UAAU;IACQ;IAA7B,YAA6B,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;IAAG,CAAC;IAE3D,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,OAAoB,EAAE;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAEhD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE;gBAC/D,GAAG,IAAI;gBACP,yEAAyE;gBACzE,4DAA4D;gBAC5D,WAAW,EAAE,SAAS;gBACtB,OAAO,EAAE;oBACP,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;oBAChD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,GAAG,IAAI,CAAC,OAAO;iBAChB;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP;;;;eAIG;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;QAED,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAE,IAAU,CAAC,CAAC,CAAC,IAAI;YACtC,8DAA8D;YAC9D,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAA,qBAAW,EAAC,IAAI,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,IAAI,CAAI,IAAY,EAAE,IAAc;QAClC,OAAO,IAAI,CAAC,OAAO,CAAI,IAAI,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAI,IAAY;QACjB,OAAO,IAAI,CAAC,OAAO,CAAI,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;CACF;AA3DD,gCA2DC;AAmBD;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAK9B,mCAAmC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;QAChC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY;QACvC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI;QAC3C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAgBY,QAAA,WAAW,GAAc;IACpC,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,KAAK;IACX,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE,IAAI;CACb,CAAC;AAEF;;;;;GAKG;AACH,SAAgB,cAAc,CAC5B,OAA2B,EAC3B,MAA8B;IAE9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,sEAAsE;YACtE,yEAAyE;YACzE,uCAAuC;YACvC,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;gBACnC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAI,OAA2B,CAAC,EAAE,IAAI,EAAE,CAAC;IAEjD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,IAAI,EAAE;oBACJ,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;oBACnC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE;aACF,CAAC;QAEJ,KAAK,sBAAsB;YACzB;;;;;eAKG;YACH,OAAO,MAAM,CAAC,IAAI;gBAChB,CAAC,CAAC;oBACE,IAAI,EAAE,uBAAuB,EAAE,uBAAuB;oBACtD,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBACpD;gBACH,CAAC,CAAC;oBACE,IAAI,EAAE,uBAAuB,EAAE,uBAAuB;oBACtD,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;iBAChE,CAAC;QAER,KAAK,uBAAuB;YAC1B,yEAAyE;YACzE,2EAA2E;YAC3E,uBAAuB;YACvB,OAAO;gBACL,IAAI,EAAE,uBAAuB,EAAE,wBAAwB;gBACvD,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;oBACvB,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxE;aACF,CAAC;QAEJ;;;;WAIG;QACH,KAAK,sBAAsB;YACzB,OAAO;gBACL,IAAI,EAAE,uBAAuB,EAAE,yBAAyB;gBACxD,IAAI,EAAE;oBACJ,SAAS,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;oBAChC,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;iBACpD;aACF,CAAC;QAEJ,KAAK,oBAAoB;YACvB,OAAO;gBACL,IAAI,EAAE,uBAAuB,EAAE,uBAAuB;gBACtD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE;aAClC,CAAC;QAEJ,KAAK,iBAAiB;YACpB;;;;;;eAMG;YACH,OAAO,MAAM,CAAC,aAAa;gBACzB,CAAC,CAAC;oBACE,IAAI,EAAE,qBAAqB;oBAC3B,IAAI,EAAE;wBACJ,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;wBACnC,aAAa,EAAE,MAAM,CAAC,aAAa;qBACpC;iBACF;gBACH,CAAC,CAAC,IAAI,CAAC;QAEX,KAAK,sBAAsB;YACzB,OAAO;gBACL,IAAI,EAAE,8BAA8B,EAAE,mBAAmB;gBACzD,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE;aAC1C,CAAC;QAEJ,KAAK,aAAa,CAAC;QACnB,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ;;;;eAIG;YACH,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,OAA8C;IAC5E,IAAI,CAAC,OAAO;QAAE,OAAO,mBAAW,CAAC;IACjC,OAAO;QACL,GAAG,mBAAW;QACd,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAiB;KACnE,CAAC;AACJ,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,OAAO,CAC3B,MAAkB,EAClB,KAAgB,EAChB,MAA8B;IAE9B,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAElG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC;;;;WAIG;QACH,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,oEAAoE;QACpE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,KAMC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAoC,qBAAqB,EAAE;QAC3F,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,2EAA2E;QAC3E,kEAAkE;QAClE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,wEAAwE;QACxE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,EAAE,GAAG,mBAAW,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,mBAAW,CAAC,UAAU;QAClC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,aAAa,CACjC,MAAkB,EAClB,KAAgB,EAChB,QAAqC;IAErC,MAAM,EAAE,GAAI,KAAK,CAAC,OAAkC,EAAE,EAAE,CAAC;IACzD,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAEtB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,uBAAuB,EAAE,uBAAuB,EAChD,EAAE,QAAQ,EAAE,CACb,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAE5E,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,EAAE;QACV,4EAA4E;QAC5E,sCAAsC;QACtC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,IAAI,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAC/B,MAAkB,EAClB,KAAgB;IAEhB,MAAM,EAAE,GAAI,KAAK,CAAC,OAAkC,EAAE,EAAE,CAAC;IACzD,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAE7D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,uBAAuB,EAAE,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAChF,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEnE,OAAO;QACL,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE;QAC3C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACrC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,KAAgB;IAChD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAA,oBAAU,EAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;AAC5F,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export * from './token-cache';
+export * from './tab-election';
+export * from './attempt';
+export * from './redirect';
+export * from './fapi';
+export * from './native';
+export * from './passkey';
+export * from './telegram';
+export * from './siwe';
+export * from './telemetry';
+export * from './reauth';
+export * from './connect';
+export * from './password-reset';
+export * from './check-session';
+export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, ROLE_KEY_PATTERN, PERMISSION_KEY_PATTERN, isRoleKey, isPermissionKey, } from '@atlasauth/authz';

package/dist/index.js

@@ -0,0 +1,43 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPermissionKey = exports.isRoleKey = exports.PERMISSION_KEY_PATTERN = exports.ROLE_KEY_PATTERN = exports.ForbiddenError = exports.protectFromClaims = exports.hasFromClaims = exports.evaluate = void 0;
+__exportStar(require("./token-cache"), exports);
+__exportStar(require("./tab-election"), exports);
+__exportStar(require("./attempt"), exports);
+__exportStar(require("./redirect"), exports);
+__exportStar(require("./fapi"), exports);
+__exportStar(require("./native"), exports);
+__exportStar(require("./passkey"), exports);
+__exportStar(require("./telegram"), exports);
+__exportStar(require("./siwe"), exports);
+__exportStar(require("./telemetry"), exports);
+__exportStar(require("./reauth"), exports);
+__exportStar(require("./connect"), exports);
+__exportStar(require("./password-reset"), exports);
+__exportStar(require("./check-session"), exports);
+// Framework-agnostic authorization primitive — `has()`/`evaluate` for any
+// non-React/Next consumer reading org_role/org_permissions off its session.
+var authz_1 = require("@atlasauth/authz");
+Object.defineProperty(exports, "evaluate", { enumerable: true, get: function () { return authz_1.evaluate; } });
+Object.defineProperty(exports, "hasFromClaims", { enumerable: true, get: function () { return authz_1.hasFromClaims; } });
+Object.defineProperty(exports, "protectFromClaims", { enumerable: true, get: function () { return authz_1.protectFromClaims; } });
+Object.defineProperty(exports, "ForbiddenError", { enumerable: true, get: function () { return authz_1.ForbiddenError; } });
+Object.defineProperty(exports, "ROLE_KEY_PATTERN", { enumerable: true, get: function () { return authz_1.ROLE_KEY_PATTERN; } });
+Object.defineProperty(exports, "PERMISSION_KEY_PATTERN", { enumerable: true, get: function () { return authz_1.PERMISSION_KEY_PATTERN; } });
+Object.defineProperty(exports, "isRoleKey", { enumerable: true, get: function () { return authz_1.isRoleKey; } });
+Object.defineProperty(exports, "isPermissionKey", { enumerable: true, get: function () { return authz_1.isPermissionKey; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,2CAAyB;AACzB,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}

package/dist/native.d.ts

@@ -0,0 +1,112 @@
+/**
+ * §6 native / One-Tap sign-in — the client half.
+ *
+ * The SDK does not make HTTP calls (the app owns fetch + cookies), so this
+ * module is two pure helpers for the request/response shape plus a
+ * framework-agnostic Google Identity Services loader that resolves a credential
+ * id_token. The app posts that to `/v1/client/sign_ins/id_token` and then reads
+ * the result exactly like any other attempt (nextStep / a returned ticket).
+ */
+export interface NativeSignInBody {
+    provider: string;
+    id_token: string;
+    nonce?: string;
+}
+/** Build the POST body for `/v1/client/sign_ins/id_token`. */
+export declare function nativeSignInBody(input: {
+    provider: string;
+    idToken: string;
+    nonce?: string;
+}): NativeSignInBody;
+export interface NativeSignInResult {
+    attemptId: string;
+    status: string;
+    /** Present only when the sign-in completed — exchange it for cookies. */
+    ticket?: string;
+}
+/**
+ * Parse the native sign-in response. A `ticket` means complete; a status
+ * without a ticket (e.g. `needs_second_factor`) means a factor is still owed —
+ * the same contract the redirect flow uses, so callers must not treat it as
+ * signed-in.
+ */
+export declare function parseNativeSignInResponse(body: unknown): NativeSignInResult | null;
+interface GsiId {
+    initialize(config: Record<string, unknown>): void;
+    prompt(listener?: (notification: unknown) => void): void;
+    renderButton(parent: HTMLElement, options: Record<string, unknown>): void;
+    cancel(): void;
+}
+interface GsiHost {
+    google?: {
+        accounts?: {
+            id?: GsiId;
+        };
+    };
+    document: Document;
+    ResizeObserver?: typeof ResizeObserver;
+}
+/** Inject the GSI script once; resolves when it is ready. */
+export declare function loadGoogleIdentityServices(doc: Document): Promise<void>;
+/** Reset the one-shot loader (tests). */
+export declare function resetGoogleIdentityServices(): void;
+/**
+ * Load GSI and resolve a Google credential (an OIDC id_token) from One-Tap.
+ * The nonce, when supplied, is embedded in the credential and MUST be echoed to
+ * the server so it can bind the token to this request.
+ */
+export declare function requestGoogleCredential(opts: {
+    clientId: string;
+    nonce?: string;
+    autoSelect?: boolean;
+    host?: GsiHost;
+}): Promise<string>;
+/**
+ * Render the official "Sign in with Google" BUTTON into `parent` (and, when
+ * `oneTap` is set, also show the One-Tap prompt). Each resolved credential
+ * id_token is handed to `onCredential`, which the app posts to
+ * /v1/client/sign_ins/id_token. Unlike {@link requestGoogleCredential} this does
+ * not resolve once — a button can be clicked repeatedly — so it takes a
+ * callback. Framework-agnostic: the caller owns the DOM node and the fetch.
+ */
+export declare function renderGoogleButton(opts: {
+    parent: HTMLElement;
+    clientId: string;
+    nonce?: string;
+    onCredential: (idToken: string) => void;
+    onError?: (error: Error) => void;
+    /** GSI renderButton options (theme, size, text, shape, width…). */
+    buttonOptions?: Record<string, unknown>;
+    /** Also show the One-Tap prompt above the button. */
+    oneTap?: boolean;
+    host?: GsiHost;
+}): Promise<void>;
+/**
+ * Render YOUR uniform button, backed by Google's real (but invisible) GSI button.
+ *
+ * Google refuses to let you style its button, and One-Tap is FedCM-flaky — so to
+ * show your OWN button while still using the secretless id_token flow, you overlay
+ * Google's real button, at opacity 0, exactly on top of your styled one. The user
+ * sees your button; the click lands on Google's, which mints the id_token. No
+ * secret, no redirect.
+ *
+ * The failure mode people hit is misalignment — the invisible button not covering
+ * the visible one, so clicks miss. This guards against it: the overlay fills the
+ * wrapper, and a ResizeObserver keeps Google's button width matched to yours so
+ * the whole surface stays clickable as the layout changes.
+ *
+ * `wrapper` is YOUR styled button (or its container); it is made position:relative
+ * if it is not already positioned. Returns `{ destroy }` to tear the overlay down.
+ */
+export declare function renderGoogleOverlayButton(opts: {
+    wrapper: HTMLElement;
+    clientId: string;
+    nonce?: string;
+    onCredential: (idToken: string) => void;
+    onError?: (error: Error) => void;
+    size?: 'large' | 'medium' | 'small';
+    host?: GsiHost;
+}): Promise<{
+    destroy: () => void;
+}>;
+export {};