@atlasauth/js 0.36.0 → 0.38.0

package/dist/sign-in-flow.js

@@ -0,0 +1,232 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECOND_FACTOR_STRATEGIES = void 0;
+exports.createSignInFlow = createSignInFlow;
+exports.createSignUpFlow = createSignUpFlow;
+/**
+ * Headless sign-in and sign-up: one typed step at a time, no UI.
+ *
+ * `createSignInFlow()` / `createSignUpFlow()` wrap the same requests the
+ * prebuilt components send. You render whatever the current `step` asks for and
+ * call the matching method; the flow never decides the next step itself, the
+ * server does. Captcha is handled for you: when the server asks for one the step
+ * is `needs_captcha`, and `solveCaptcha(container)` draws the widget for the
+ * right flow and submits its token.
+ *
+ * Errors carry a stable `reason` (`form_password_incorrect`, `captcha_wrong_flow`,
+ * …). Turn it into a sentence in the app's language with `reasonMessage`.
+ */
+const attempt_1 = require("./attempt");
+const instance_settings_1 = require("./instance-settings");
+const policies_1 = require("./policies");
+const passkey_sign_in_1 = require("./passkey-sign-in");
+const redirect_1 = require("./redirect");
+const captcha_widget_1 = require("./captcha-widget");
+const fapi_1 = require("./fapi");
+/** Second-factor strategies the server accepts. Not narrowed per account: that would reveal what the account has. */
+exports.SECOND_FACTOR_STRATEGIES = ['totp', 'backup_code', 'sms', 'email_code'];
+const CAPTCHA_CODES = ['CAPTCHA_REQUIRED', 'CAPTCHA_FAILED'];
+function makeCore(opts, captchaFlow) {
+    const { client } = opts;
+    let flow = fapi_1.initialFlow;
+    let step = { type: 'needs_identifier' };
+    let busy = false;
+    let errors = [];
+    let reason = null;
+    let captchaToken = null;
+    let captchaSettings;
+    let redirect = null;
+    const listeners = new Set();
+    const snapshot = () => ({ step, errors, reason, busy });
+    const emit = () => {
+        const s = snapshot();
+        for (const l of listeners)
+            l(s);
+        return s;
+    };
+    const loadCaptcha = async () => {
+        if (captchaSettings === undefined) {
+            const settings = await (0, instance_settings_1.fetchInstanceSettings)(client);
+            captchaSettings = settings?.captchaFlows[captchaFlow] ?? null;
+        }
+        return captchaSettings;
+    };
+    const stepFor = async (attempt) => {
+        if (redirect)
+            return { type: 'redirect', url: redirect };
+        if (!attempt)
+            return { type: 'needs_identifier' };
+        const next = (0, attempt_1.nextStep)(attempt);
+        switch (next.kind) {
+            case 'collect_identifier':
+            case 'restart':
+                return { type: 'needs_identifier' };
+            case 'collect_captcha':
+                return { type: 'needs_captcha', flow: captchaFlow, captcha: await loadCaptcha() };
+            case 'collect_first_factor':
+                return { type: 'needs_first_factor', factors: next.strategies };
+            case 'collect_second_factor':
+                return { type: 'needs_second_factor', factors: [...exports.SECOND_FACTOR_STRATEGIES] };
+            case 'accept_policies':
+                return { type: 'needs_policy_acceptance', policies: next.policies };
+            case 'collect_email_code':
+                return { type: 'needs_email_verification' };
+            case 'done':
+                return { type: 'complete', sessionId: next.sessionId };
+            case 'await_oauth':
+            case 'enroll_second_factor':
+            case 'collect_new_password':
+            case 'complete_required_action':
+            case 'unknown':
+                return { type: 'needs_other', status: attempt.status };
+        }
+    };
+    /** Run one call, fold its resulting FlowState in, exchange a completion ticket, and publish. */
+    const run = async (call) => {
+        busy = true;
+        emit();
+        let next = await call();
+        if (next.ticket && next.attempt?.id) {
+            const exchanged = await client.post('/v1/client/tickets/exchange', { attempt_id: next.attempt.id, ticket: next.ticket });
+            next = exchanged.ok ? { ...next, ticket: null } : { ...next, errors: exchanged.errors };
+        }
+        flow = next;
+        errors = next.errors;
+        reason = errors[0]?.reason ?? next.attempt?.reason ?? null;
+        busy = false;
+        step = await stepFor(next.attempt);
+        return emit();
+    };
+    /** A captcha error on a call that has no attempt yet becomes the captcha step. */
+    const captchaStepFromErrors = async () => {
+        if (!errors.some((e) => CAPTCHA_CODES.includes(e.code)))
+            return false;
+        step = { type: 'needs_captcha', flow: captchaFlow, captcha: await loadCaptcha() };
+        emit();
+        return true;
+    };
+    return {
+        get flow() { return flow; },
+        get captchaToken() { return captchaToken; },
+        takeCaptchaToken() { const t = captchaToken; captchaToken = null; return t; },
+        setCaptchaToken(t) { captchaToken = t; },
+        get errors() { return errors; },
+        run,
+        captchaStepFromErrors,
+        setRedirect(url) { redirect = url; },
+        api(extra) {
+            return {
+                getSnapshot: snapshot,
+                subscribe(l) { listeners.add(l); return () => void listeners.delete(l); },
+                submitCaptcha: extra.submitCaptcha,
+                async solveCaptcha(container) {
+                    const settings = await loadCaptcha();
+                    if (!settings) {
+                        errors = [{ code: 'CAPTCHA_UNAVAILABLE', reason: 'captcha_unavailable', message: 'No captcha is configured for this flow.' }];
+                        reason = 'captcha_unavailable';
+                        return emit();
+                    }
+                    try {
+                        return await extra.submitCaptcha(await (0, captcha_widget_1.renderCaptchaWidget)(settings, container).token);
+                    }
+                    catch {
+                        errors = [{ code: 'CAPTCHA_FAILED', reason: 'captcha_failed', message: 'The security check did not complete.' }];
+                        reason = 'captcha_failed';
+                        return emit();
+                    }
+                },
+                async startOAuth(provider, redirectUrl) {
+                    const started = await (0, redirect_1.startOauthRedirect)(client, { provider, redirectUrl });
+                    if (!started) {
+                        errors = [{ code: 'OAUTH_START_FAILED', reason: 'oauth_start_failed', message: 'Could not start the social sign-in.' }];
+                        reason = 'oauth_start_failed';
+                        return emit();
+                    }
+                    redirect = started.authorizationUrl;
+                    step = { type: 'redirect', url: started.authorizationUrl };
+                    errors = [];
+                    reason = null;
+                    return emit();
+                },
+                acceptPolicies: (acceptances) => run(() => (0, policies_1.acceptAttemptPolicies)(client, flow, acceptances)),
+                reset() {
+                    flow = fapi_1.initialFlow;
+                    step = { type: 'needs_identifier' };
+                    errors = [];
+                    reason = null;
+                    captchaToken = null;
+                    redirect = null;
+                    return emit();
+                },
+            };
+        },
+    };
+}
+function createSignInFlow(opts) {
+    const core = makeCore(opts, 'signIn');
+    const { client } = opts;
+    let identifier = '';
+    const attemptId = () => core.flow.attempt?.id ?? '';
+    const start = (id) => {
+        identifier = id;
+        return core.run(() => (0, fapi_1.advance)(client, { ...fapi_1.initialFlow }, { identifier: id, ...(core.captchaToken ? { captcha_token: core.takeCaptchaToken() } : {}) }));
+    };
+    // A captcha asked for by the passkey button is answered by trying the passkey again, not by an identifier.
+    let viaPasskey = false;
+    const passkey = async () => {
+        viaPasskey = true;
+        const snap = await core.run(() => (0, passkey_sign_in_1.signInWithPasskey)(client, { captcha: core.captchaToken ? async () => core.takeCaptchaToken() : null }));
+        viaPasskey = await core.captchaStepFromErrors();
+        return viaPasskey ? api.getSnapshot() : snap;
+    };
+    const submitCaptcha = async (token) => {
+        core.setCaptchaToken(token);
+        return viaPasskey ? passkey() : start(core.flow.attempt?.identifier ?? identifier);
+    };
+    const api = core.api({ submitCaptcha });
+    return {
+        ...api,
+        submitIdentifier: (id) => {
+            viaPasskey = false;
+            return start(id);
+        },
+        submitPassword: (password) => core.run(() => (0, fapi_1.advance)(client, core.flow, { password })),
+        sendEmailCode: () => core.run(() => (0, fapi_1.prepareFactor)(client, core.flow, 'email_code')),
+        submitEmailCode: (code) => core.run(() => (0, fapi_1.advance)(client, core.flow, { code })),
+        signInWithPasskey: passkey,
+        submitSecondFactor: (code, strategy = 'totp', options = {}) => core.run(() => (0, fapi_1.advance)(client, core.flow, {
+            code,
+            ...(strategy === 'email_code' ? { strategy } : {}),
+            ...(options.rememberDevice ? { remember_device: 'true' } : {}),
+        })),
+        async sendSecondFactorCode(strategy) {
+            const res = await client.post(`/v1/client/sign_ins/${encodeURIComponent(attemptId())}/prepare_second_factor`, { strategy });
+            return core.run(async () => ({ ...core.flow, errors: res.ok ? [] : res.errors }));
+        },
+    };
+}
+function createSignUpFlow(opts) {
+    const core = makeCore(opts, 'signUp');
+    const { client } = opts;
+    let last = null;
+    const submit = async (input) => {
+        last = input;
+        const token = core.takeCaptchaToken();
+        const snap = await core.run(() => (0, fapi_1.startSignUp)(client, { ...input, ...(token ? { captchaToken: token } : {}) }));
+        if (!(await core.captchaStepFromErrors()))
+            return snap;
+        return api.getSnapshot();
+    };
+    const submitCaptcha = async (token) => {
+        core.setCaptchaToken(token);
+        return last ? submit(last) : api.getSnapshot();
+    };
+    const api = core.api({ submitCaptcha });
+    return {
+        ...api,
+        submit,
+        submitEmailCode: (code) => core.run(() => (0, fapi_1.advance)(client, core.flow, { code })),
+        resendEmailCode: () => core.run(() => (0, fapi_1.resendSignUpVerification)(client, core.flow)),
+    };
+}
+//# sourceMappingURL=sign-in-flow.js.map

package/dist/sign-in-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-flow.js","sourceRoot":"","sources":["../src/sign-in-flow.ts"],"names":[],"mappings":";;;AAkOA,4CAiDC;AAuBD,4CAuBC;AAjUD;;;;;;;;;;;;GAYG;AACH,uCAA4F;AAC5F,2DAA4D;AAC5D,yCAA0E;AAC1E,uDAAsD;AACtD,yCAAgD;AAChD,qDAA8F;AAC9F,iCAQgB;AAEhB,qHAAqH;AACxG,QAAA,wBAAwB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,CAAU,CAAC;AA4C9F,MAAM,aAAa,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;AAE7D,SAAS,QAAQ,CAAC,IAAiB,EAAE,WAA2B;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,IAAI,GAAc,kBAAW,CAAC;IAClC,IAAI,IAAI,GAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAClD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,MAAM,GAAiB,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,eAA+C,CAAC;IACpD,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEvD,MAAM,QAAQ,GAAG,GAAiB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,KAAK,IAAiC,EAAE;QAC1D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAqB,EAAC,MAAM,CAAC,CAAC;YACrD,eAAe,GAAG,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAChE,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,OAA2B,EAAqB,EAAE;QACvE,IAAI,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,OAAO,CAAC,CAAC;QAC/B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,oBAAoB,CAAC;YAC1B,KAAK,SAAS;gBACZ,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;YACtC,KAAK,iBAAiB;gBACpB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC;YACpF,KAAK,sBAAsB;gBACzB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YAClE,KAAK,uBAAuB;gBAC1B,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,GAAG,gCAAwB,CAAC,EAAE,CAAC;YACjF,KAAK,iBAAiB;gBACpB,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtE,KAAK,oBAAoB;gBACvB,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;YAC9C,KAAK,MAAM;gBACT,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,KAAK,aAAa,CAAC;YACnB,KAAK,sBAAsB,CAAC;YAC5B,KAAK,sBAAsB,CAAC;YAC5B,KAAK,0BAA0B,CAAC;YAChC,KAAK,SAAS;gBACZ,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IAEF,gGAAgG;IAChG,MAAM,GAAG,GAAG,KAAK,EAAE,IAA8B,EAAyB,EAAE;QAC1E,IAAI,GAAG,IAAI,CAAC;QACZ,IAAI,EAAE,CAAC;QACP,IAAI,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACzH,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1F,CAAC;QACD,IAAI,GAAG,IAAI,CAAC;QACZ,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACrB,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;QAC3D,IAAI,GAAG,KAAK,CAAC;QACb,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,kFAAkF;IAClF,MAAM,qBAAqB,GAAG,KAAK,IAAsB,EAAE;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC;QAClF,IAAI,EAAE,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;QAC3B,IAAI,YAAY,KAAK,OAAO,YAAY,CAAC,CAAC,CAAC;QAC3C,gBAAgB,KAAK,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7E,eAAe,CAAC,CAAS,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC;QAC/B,GAAG;QACH,qBAAqB;QACrB,WAAW,CAAC,GAAW,IAAI,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5C,GAAG,CAAC,KAA8D;YAChE,OAAO;gBACL,WAAW,EAAE,QAAQ;gBACrB,SAAS,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzE,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,KAAK,CAAC,YAAY,CAAC,SAAS;oBAC1B,MAAM,QAAQ,GAAG,MAAM,WAAW,EAAE,CAAC;oBACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;wBAC9H,MAAM,GAAG,qBAAqB,CAAC;wBAC/B,OAAO,IAAI,EAAE,CAAC;oBAChB,CAAC;oBACD,IAAI,CAAC;wBACH,OAAO,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,IAAA,oCAAmB,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC;oBACzF,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;wBACjH,MAAM,GAAG,gBAAgB,CAAC;wBAC1B,OAAO,IAAI,EAAE,CAAC;oBAChB,CAAC;gBACH,CAAC;gBACD,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,WAAW;oBACpC,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAkB,EAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;oBAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;wBACxH,MAAM,GAAG,oBAAoB,CAAC;wBAC9B,OAAO,IAAI,EAAE,CAAC;oBAChB,CAAC;oBACD,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;oBACpC,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBAC3D,MAAM,GAAG,EAAE,CAAC;oBACZ,MAAM,GAAG,IAAI,CAAC;oBACd,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,cAAc,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,gCAAqB,EAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC5F,KAAK;oBACH,IAAI,GAAG,kBAAW,CAAC;oBAAC,IAAI,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;oBAAC,MAAM,GAAG,EAAE,CAAC;oBAAC,MAAM,GAAG,IAAI,CAAC;oBAAC,YAAY,GAAG,IAAI,CAAC;oBAAC,QAAQ,GAAG,IAAI,CAAC;oBAC1H,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAmBD,SAAgB,gBAAgB,CAAC,IAAiB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC;IAEpD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE;QAC3B,UAAU,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,EAAE,GAAG,kBAAW,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5J,CAAC,CAAC;IACF,2GAA2G;IAC3G,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAC/B,IAAA,mCAAiB,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CACvG,CAAC;QACF,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAChD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;QAC5C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,UAAU,CAAC,CAAC;IACrF,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IAExC,OAAO;QACL,GAAG,GAAG;QACN,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE;YACvB,UAAU,GAAG,KAAK,CAAC;YACnB,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,oBAAa,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACnF,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,iBAAiB,EAAE,OAAO;QAC1B,kBAAkB,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE,CAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CACZ,IAAA,cAAO,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;YACzB,IAAI;YACJ,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CACH;QACH,KAAK,CAAC,oBAAoB,CAAC,QAAQ;YACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,EAAE,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5H,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;KACF,CAAC;AACJ,CAAC;AAuBD,SAAgB,gBAAgB,CAAC,IAAiB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,IAAI,GAAuB,IAAI,CAAC;IAEpC,MAAM,MAAM,GAAG,KAAK,EAAE,KAAkB,EAAE,EAAE;QAC1C,IAAI,GAAG,KAAK,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,kBAAW,EAAC,MAAM,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;QAC5C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,GAAG;QACN,MAAM;QACN,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,cAAO,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAA,+BAAwB,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;KACnF,CAAC;AACJ,CAAC"}

package/dist/step-up.d.ts

@@ -13,6 +13,7 @@
  *   email_code    POST /v1/client/me/step_up/email_code, then { strategy: 'email_code', code }
  *   passkey       POST /v1/client/me/step_up/passkey (challenge), then the assertion
  */
+import type { FieldError } from './attempt';
 import type { FapiClient, FapiResponse } from './fapi';
 export type StepUpInput = {
     strategy: 'password';
@@ -50,3 +51,48 @@ export declare function sendStepUpEmailCode(client: FapiClient): Promise<FapiRes
 export declare function authenticatedWithin(claims: {
     auth_time?: unknown;
 }, maxAgeSeconds: number, nowMs?: number): boolean;
+/** What a STEP_UP_REQUIRED refusal asks for, read off the refusal alone. */
+export interface StepUpRequirement {
+    /** The action that was refused (`email_change`, `api_key_create`, …), when the server named it. */
+    action: string | null;
+    /** The factor strategies `stepUp()` accepts for it, e.g. `password`, `passkey`, `totp`. */
+    acceptedFactors: string[];
+    /** How recent the proof must be, in seconds; null when any multi-factor sign-in on the session counts. */
+    maxAgeSeconds: number | null;
+}
+/** The step-up a refusal asks for, or null when `errors` holds no STEP_UP_REQUIRED. */
+export declare function stepUpRequirement(errors: readonly FieldError[]): StepUpRequirement | null;
+/** What your prompt is asked to collect. */
+export interface StepUpPrompt extends StepUpRequirement {
+    /** The previous credential was wrong: show this error and ask again. */
+    error: FieldError | null;
+    /** Email the step-up code (for the `email_code` factor). */
+    sendEmailCode(): Promise<FapiResponse<unknown>>;
+}
+/** Thrown by {@link requireStepUp} when the prompt gives up (returns null). */
+export declare class StepUpCancelledError extends Error {
+    readonly code = "STEP_UP_CANCELLED";
+    constructor();
+}
+export interface RequireStepUpOptions {
+    client: FapiClient;
+    /** Ask the person for a credential; return null to cancel. */
+    prompt: (request: StepUpPrompt) => Promise<StepUpInput | null> | StepUpInput | null;
+    /** The refusal that triggered this, so the prompt knows the factors and window. */
+    requirement?: StepUpRequirement;
+    /** Wrong credentials allowed before the last error is thrown. Default 3. */
+    maxAttempts?: number;
+}
+/**
+ * Re-authenticate for `action`: ask `prompt` for a credential, send it to
+ * `POST /v1/client/me/step_up`, and resolve once the server accepts it. A wrong
+ * credential asks again (up to `maxAttempts`). Throws {@link StepUpCancelledError}
+ * when the prompt returns null.
+ */
+export declare function requireStepUp(action: string, opts: RequireStepUpOptions): Promise<StepUpResult>;
+/**
+ * Run `call`; if the server refuses it with STEP_UP_REQUIRED, re-authenticate
+ * with {@link requireStepUp} (using the refusal's own factors and window) and
+ * run it once more. Any other outcome is returned as is.
+ */
+export declare function retryWithStepUp<T>(call: () => Promise<FapiResponse<T>>, opts: Omit<RequireStepUpOptions, 'requirement'>): Promise<FapiResponse<T>>;

package/dist/step-up.js

@@ -1,8 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.StepUpCancelledError = void 0;
 exports.stepUp = stepUp;
 exports.sendStepUpEmailCode = sendStepUpEmailCode;
 exports.authenticatedWithin = authenticatedWithin;
+exports.stepUpRequirement = stepUpRequirement;
+exports.requireStepUp = requireStepUp;
+exports.retryWithStepUp = retryWithStepUp;
 /** Prove a credential of the current session again. A wrong credential is a 401. */
 function stepUp(client, input) {
     return client.post('/v1/client/me/step_up', input);
@@ -21,4 +25,60 @@ function authenticatedWithin(claims, maxAgeSeconds, nowMs = Date.now()) {
         return false;
     return nowMs / 1000 - at <= maxAgeSeconds;
 }
+const DEFAULT_FACTORS = ['password', 'passkey', 'totp', 'backup_code', 'email_code'];
+/** The step-up a refusal asks for, or null when `errors` holds no STEP_UP_REQUIRED. */
+function stepUpRequirement(errors) {
+    const error = errors.find((e) => e.code === 'STEP_UP_REQUIRED');
+    if (!error)
+        return null;
+    const meta = error.meta ?? {};
+    const factors = Array.isArray(meta.accepted_factors) ? meta.accepted_factors.filter((f) => typeof f === 'string') : [];
+    return {
+        action: typeof meta.action === 'string' ? meta.action : null,
+        acceptedFactors: factors.length ? factors : [...DEFAULT_FACTORS],
+        maxAgeSeconds: typeof meta.max_age_seconds === 'number' ? meta.max_age_seconds : null,
+    };
+}
+/** Thrown by {@link requireStepUp} when the prompt gives up (returns null). */
+class StepUpCancelledError extends Error {
+    code = 'STEP_UP_CANCELLED';
+    constructor() {
+        super('The re-authentication was cancelled.');
+        this.name = 'StepUpCancelledError';
+    }
+}
+exports.StepUpCancelledError = StepUpCancelledError;
+/**
+ * Re-authenticate for `action`: ask `prompt` for a credential, send it to
+ * `POST /v1/client/me/step_up`, and resolve once the server accepts it. A wrong
+ * credential asks again (up to `maxAttempts`). Throws {@link StepUpCancelledError}
+ * when the prompt returns null.
+ */
+async function requireStepUp(action, opts) {
+    const base = opts.requirement ?? { action, acceptedFactors: [...DEFAULT_FACTORS], maxAgeSeconds: null };
+    let error = null;
+    for (let attempt = 0; attempt < (opts.maxAttempts ?? 3); attempt++) {
+        const input = await opts.prompt({ ...base, action: base.action ?? action, error, sendEmailCode: () => sendStepUpEmailCode(opts.client) });
+        if (!input)
+            throw new StepUpCancelledError();
+        const res = await stepUp(opts.client, input);
+        if (res.ok && res.data)
+            return res.data;
+        error = res.errors[0] ?? { code: 'UNAUTHENTICATED', message: 'Re-authentication failed.' };
+    }
+    throw Object.assign(new Error(error?.message ?? 'Re-authentication failed.'), { code: error?.code, reason: error?.reason });
+}
+/**
+ * Run `call`; if the server refuses it with STEP_UP_REQUIRED, re-authenticate
+ * with {@link requireStepUp} (using the refusal's own factors and window) and
+ * run it once more. Any other outcome is returned as is.
+ */
+async function retryWithStepUp(call, opts) {
+    const first = await call();
+    const requirement = first.ok ? null : stepUpRequirement(first.errors);
+    if (!requirement)
+        return first;
+    await requireStepUp(requirement.action ?? 'sensitive_action', { ...opts, requirement });
+    return call();
+}
 //# sourceMappingURL=step-up.js.map

package/dist/step-up.js.map

@@ -1 +1 @@
-{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../src/step-up.ts"],"names":[],"mappings":";;AA0CA,wBAEC;AAGD,kDAEC;AAMD,kDAIC;AAlBD,oFAAoF;AACpF,SAAgB,MAAM,CAAC,MAAkB,EAAE,KAAkB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAe,uBAAuB,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,qHAAqH;AACrH,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../src/step-up.ts"],"names":[],"mappings":";;;AA2CA,wBAEC;AAGD,kDAEC;AAMD,kDAIC;AAeD,8CAUC;AAmCD,sCAWC;AAOD,0CASC;AAzGD,oFAAoF;AACpF,SAAgB,MAAM,CAAC,MAAkB,EAAE,KAAkB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAe,uBAAuB,EAAE,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,qHAAqH;AACrH,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC;AAYD,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9F,uFAAuF;AACvF,SAAgB,iBAAiB,CAAC,MAA6B;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpI,OAAO;QACL,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAC5D,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;QAChE,aAAa,EAAE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;KACtF,CAAC;AACJ,CAAC;AAUD,+EAA+E;AAC/E,MAAa,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,mBAAmB,CAAC;IACpC;QACE,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAND,oDAMC;AAYD;;;;;GAKG;AACI,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,IAA0B;IAC5E,MAAM,IAAI,GAAsB,IAAI,CAAC,WAAW,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC3H,IAAI,KAAK,GAAsB,IAAI,CAAC;IACpC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1I,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QACxC,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,2BAA2B,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9H,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,eAAe,CACnC,IAAoC,EACpC,IAA+C;IAE/C,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,aAAa,CAAC,WAAW,CAAC,MAAM,IAAI,kBAAkB,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACxF,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-export declare const ATLAS_JS_VERSION = "0.36.0";
+export declare const ATLAS_JS_VERSION = "0.38.0";

package/dist/version.js

@@ -7,5 +7,5 @@ exports.ATLAS_JS_VERSION = void 0;
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-exports.ATLAS_JS_VERSION = '0.36.0';
+exports.ATLAS_JS_VERSION = '0.38.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {