@aurabase/auth 0.7.0 → 0.7.1

package/README.md

@@ -39,8 +39,13 @@ await aura.auth.signOut()
 ### Session
 
 ```ts
-// getSession() n'est PAS un AuraResponse : il lit directement le store local (synchrone en pratique).
-const { accessToken, user } = await aura.auth.getSession()
+// getSession() lit le store local (synchrone en pratique) :
+const { data: { session } } = await aura.auth.getSession()
+if (session) {
+  console.log('Session ID:', session.id)
+  console.log('Access token:', session.access_token)
+  console.log('User ID:', session.user.id)
+}
 
 const refreshed = await aura.auth.refreshSession()
 
@@ -55,6 +60,32 @@ if (first) await aura.auth.revokeSession(first.id)
 await aura.auth.revokeAllSessions()
 ```
 
+### Configuration du stockage (SSR & Node.js)
+
+```ts
+import { createClient, LocalAuthStore, BaseAuthStore } from '@aurabase/aurabase-js'
+
+// Par défaut, le client choisit automatiquement :
+// - Navigateur : `LocalAuthStore` avec clé scopée par projet (`aura-<slug>-auth`)
+// - Node.js / SSR : `BaseAuthStore` en mémoire avec exportToCookie() / loadFromCookie()
+
+// Pour personnaliser le stockage :
+const aura = createClient('https://mon-projet.aurabase.cloud', 'aura_anon_xxx', {
+  auth: {
+    storage: new LocalAuthStore('custom-auth-key'),
+    autoRefreshToken: true,
+    persistSession: true,
+  },
+})
+
+// Sérialisation cookie (SSR) :
+const setCookieHeader = aura.authStore.exportToCookie({
+  httpOnly: true,
+  secure: true,
+  sameSite: 'lax',
+})
+```
+
 ### OAuth (implicite ou PKCE)
 
 `signInWithOAuth` ne redirige plus « en dur » : il renvoie toujours `{ url }` (et redirige en plus via `window.location.href` si un `window` existe).

package/dist/index.cjs

@@ -52,9 +52,41 @@ var AuthAdminService = class extends core.BaseService {
   }
   /**
    * Génère un lien à usage unique pour un utilisateur (`'magic'`, `'recovery'` ou `'invite'`) et renvoie `{ link, token }`.
+   * Accepte soit `generateLink(userId, type)` soit `generateLink({ userId, type })`.
    */
-  async generateLink(userId, type) {
-    return this.request("POST", `${this.prefix}/users/${userId}/generate-link`, { type });
+  async generateLink(userIdOrParams, type) {
+    let resolvedUserId;
+    let resolvedType;
+    if (typeof userIdOrParams === "object" && userIdOrParams !== null) {
+      resolvedUserId = userIdOrParams.userId ?? userIdOrParams.user_id;
+      resolvedType = userIdOrParams.type ?? type;
+    } else if (typeof userIdOrParams === "string") {
+      resolvedUserId = userIdOrParams;
+      resolvedType = type;
+    }
+    if (!resolvedUserId || typeof resolvedUserId !== "string" || resolvedUserId.trim() === "" || resolvedUserId.includes("[object")) {
+      return {
+        data: null,
+        error: new core.AuraError(400, {
+          error: {
+            code: "INVALID_ARGUMENT",
+            message: "userId must be a non-empty string (UUID). Usage: generateLink(userId, type) or generateLink({ userId, type })."
+          }
+        })
+      };
+    }
+    if (!resolvedType) {
+      return {
+        data: null,
+        error: new core.AuraError(400, {
+          error: {
+            code: "INVALID_ARGUMENT",
+            message: 'type is required for generateLink ("magic" | "recovery" | "invite").'
+          }
+        })
+      };
+    }
+    return this.request("POST", `${this.prefix}/users/${encodeURIComponent(resolvedUserId)}/generate-link`, { type: resolvedType });
   }
   /**
    * Impersonation (AUTH-037) : jeton COURT (10 minutes au plus) pour agir en tant que l'utilisateur,
@@ -536,6 +568,15 @@ var SessionManager = class {
 };
 
 // src/AuthService.ts
+function extractSessionId(token) {
+  if (!token) return void 0;
+  try {
+    const payload = decodeJwt(token).payload;
+    return payload?.session_id ?? payload?.sid ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
 function isMfaChallenge(v) {
   return typeof v === "object" && v !== null && v.mfa_required === true;
 }
@@ -814,6 +855,7 @@ var AuthService = class extends core.BaseService {
     queueMicrotask(() => {
       if (this._stateListeners.has(callback)) {
         const session = store.token && store.user ? {
+          id: extractSessionId(store.token),
           access_token: store.token,
           refresh_token: store.refreshToken ?? "",
           token_type: "Bearer",
@@ -828,6 +870,7 @@ var AuthService = class extends core.BaseService {
   _emitEvent(event, user, accessToken, extra) {
     if (event === "SIGNED_OUT") this._signedOutSeq = this._clearSeq;
     const session = accessToken && user ? {
+      id: extractSessionId(accessToken),
       access_token: accessToken,
       refresh_token: this.client.authStore.refreshToken ?? "",
       token_type: "Bearer",
@@ -859,6 +902,7 @@ var AuthService = class extends core.BaseService {
     }
     if (req.options?.data) payload.data = req.options.data;
     if (req.options?.emailRedirectTo) payload.email_redirect_to = req.options.emailRedirectTo;
+    if (req.options?.preventEmailEnumeration) payload.prevent_email_enumeration = true;
     const res = await this.request("POST", `${this.prefix}/register`, payload);
     if (res.data && !isMfaChallenge(res.data) && !res.data.access_token) {
       res.data.session = null;
@@ -867,6 +911,7 @@ var AuthService = class extends core.BaseService {
     if (res.data && !isMfaChallenge(res.data)) {
       const tp = res.data;
       tp.session = {
+        id: extractSessionId(tp.access_token),
         access_token: tp.access_token,
         refresh_token: tp.refresh_token,
         token_type: tp.token_type,
@@ -902,6 +947,7 @@ var AuthService = class extends core.BaseService {
     if (res.data && !isMfaChallenge(res.data)) {
       const tp = res.data;
       tp.session = {
+        id: extractSessionId(tp.access_token),
         access_token: tp.access_token,
         refresh_token: tp.refresh_token,
         token_type: tp.token_type,
@@ -1069,6 +1115,7 @@ var AuthService = class extends core.BaseService {
     const token = this.client.authStore.token;
     const user = this.client.authStore.user;
     const session = token && user ? {
+      id: extractSessionId(token),
       access_token: token,
       refresh_token: this.client.authStore.refreshToken ?? "",
       token_type: "Bearer",
@@ -1572,10 +1619,31 @@ var AuthService = class extends core.BaseService {
    * MFA : termine une connexion qui a renvoyé un défi (`mfa_token` et code TOTP). Enregistre la session et émet `SIGNED_IN`.
    */
   async mfaVerify(req) {
-    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, req);
+    const raw = req;
+    const mfa_token = raw.mfa_token ?? raw.mfaToken ?? raw.challenge_id ?? raw.challengeId;
+    const code = raw.code;
+    const recovery_code = raw.recovery_code ?? raw.recoveryCode;
+    const sms_code = raw.sms_code ?? raw.smsCode;
+    const body = {};
+    if (mfa_token) body.mfa_token = mfa_token;
+    if (code !== void 0) body.code = code;
+    if (recovery_code !== void 0) body.recovery_code = recovery_code;
+    if (sms_code !== void 0) body.sms_code = sms_code;
+    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, body);
     if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
+      const tp = res.data;
+      tp.session = {
+        id: extractSessionId(tp.access_token),
+        access_token: tp.access_token,
+        refresh_token: tp.refresh_token,
+        token_type: tp.token_type,
+        expires_in: tp.expires_in,
+        user: tp.user,
+        provider_token: tp.provider_token,
+        provider_refresh_token: tp.provider_refresh_token
+      };
+      this.client.authStore.save(tp.access_token, tp.refresh_token, tp.user);
+      this._emitEvent("SIGNED_IN", tp.user, tp.access_token);
     }
     return res;
   }

package/dist/index.d.cts

@@ -72,8 +72,13 @@ declare class AuthAdminService extends BaseService {
     unbanUser(userId: string): Promise<AuraResponse<null>>;
     /**
      * Génère un lien à usage unique pour un utilisateur (`'magic'`, `'recovery'` ou `'invite'`) et renvoie `{ link, token }`.
+     * Accepte soit `generateLink(userId, type)` soit `generateLink({ userId, type })`.
      */
-    generateLink(userId: string, type: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>>;
+    generateLink(userIdOrParams: string | {
+        userId?: string;
+        user_id?: string;
+        type: GenerateLinkType;
+    }, type?: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>>;
     /**
      * Impersonation (AUTH-037) : jeton COURT (10 minutes au plus) pour agir en tant que l'utilisateur,
      * avec le claim `act: { sub }`. Pas de refresh token, journalisé (`admin_impersonation`).

package/dist/index.d.ts

@@ -72,8 +72,13 @@ declare class AuthAdminService extends BaseService {
     unbanUser(userId: string): Promise<AuraResponse<null>>;
     /**
      * Génère un lien à usage unique pour un utilisateur (`'magic'`, `'recovery'` ou `'invite'`) et renvoie `{ link, token }`.
+     * Accepte soit `generateLink(userId, type)` soit `generateLink({ userId, type })`.
      */
-    generateLink(userId: string, type: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>>;
+    generateLink(userIdOrParams: string | {
+        userId?: string;
+        user_id?: string;
+        type: GenerateLinkType;
+    }, type?: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>>;
     /**
      * Impersonation (AUTH-037) : jeton COURT (10 minutes au plus) pour agir en tant que l'utilisateur,
      * avec le claim `act: { sub }`. Pas de refresh token, journalisé (`admin_impersonation`).

package/dist/index.js

@@ -1,4 +1,4 @@
-import { BaseService, isTokenExpired, clientScope, AuraError, refreshOnce, DEFAULT_REQUEST_TIMEOUT_MS, emitAuraEvent } from '@aurabase/core';
+import { BaseService, AuraError, isTokenExpired, clientScope, refreshOnce, DEFAULT_REQUEST_TIMEOUT_MS, emitAuraEvent } from '@aurabase/core';
 
 // src/AuthAdminService.ts
 var AuthAdminService = class extends BaseService {
@@ -50,9 +50,41 @@ var AuthAdminService = class extends BaseService {
   }
   /**
    * Génère un lien à usage unique pour un utilisateur (`'magic'`, `'recovery'` ou `'invite'`) et renvoie `{ link, token }`.
+   * Accepte soit `generateLink(userId, type)` soit `generateLink({ userId, type })`.
    */
-  async generateLink(userId, type) {
-    return this.request("POST", `${this.prefix}/users/${userId}/generate-link`, { type });
+  async generateLink(userIdOrParams, type) {
+    let resolvedUserId;
+    let resolvedType;
+    if (typeof userIdOrParams === "object" && userIdOrParams !== null) {
+      resolvedUserId = userIdOrParams.userId ?? userIdOrParams.user_id;
+      resolvedType = userIdOrParams.type ?? type;
+    } else if (typeof userIdOrParams === "string") {
+      resolvedUserId = userIdOrParams;
+      resolvedType = type;
+    }
+    if (!resolvedUserId || typeof resolvedUserId !== "string" || resolvedUserId.trim() === "" || resolvedUserId.includes("[object")) {
+      return {
+        data: null,
+        error: new AuraError(400, {
+          error: {
+            code: "INVALID_ARGUMENT",
+            message: "userId must be a non-empty string (UUID). Usage: generateLink(userId, type) or generateLink({ userId, type })."
+          }
+        })
+      };
+    }
+    if (!resolvedType) {
+      return {
+        data: null,
+        error: new AuraError(400, {
+          error: {
+            code: "INVALID_ARGUMENT",
+            message: 'type is required for generateLink ("magic" | "recovery" | "invite").'
+          }
+        })
+      };
+    }
+    return this.request("POST", `${this.prefix}/users/${encodeURIComponent(resolvedUserId)}/generate-link`, { type: resolvedType });
   }
   /**
    * Impersonation (AUTH-037) : jeton COURT (10 minutes au plus) pour agir en tant que l'utilisateur,
@@ -534,6 +566,15 @@ var SessionManager = class {
 };
 
 // src/AuthService.ts
+function extractSessionId(token) {
+  if (!token) return void 0;
+  try {
+    const payload = decodeJwt(token).payload;
+    return payload?.session_id ?? payload?.sid ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
 function isMfaChallenge(v) {
   return typeof v === "object" && v !== null && v.mfa_required === true;
 }
@@ -812,6 +853,7 @@ var AuthService = class extends BaseService {
     queueMicrotask(() => {
       if (this._stateListeners.has(callback)) {
         const session = store.token && store.user ? {
+          id: extractSessionId(store.token),
           access_token: store.token,
           refresh_token: store.refreshToken ?? "",
           token_type: "Bearer",
@@ -826,6 +868,7 @@ var AuthService = class extends BaseService {
   _emitEvent(event, user, accessToken, extra) {
     if (event === "SIGNED_OUT") this._signedOutSeq = this._clearSeq;
     const session = accessToken && user ? {
+      id: extractSessionId(accessToken),
       access_token: accessToken,
       refresh_token: this.client.authStore.refreshToken ?? "",
       token_type: "Bearer",
@@ -857,6 +900,7 @@ var AuthService = class extends BaseService {
     }
     if (req.options?.data) payload.data = req.options.data;
     if (req.options?.emailRedirectTo) payload.email_redirect_to = req.options.emailRedirectTo;
+    if (req.options?.preventEmailEnumeration) payload.prevent_email_enumeration = true;
     const res = await this.request("POST", `${this.prefix}/register`, payload);
     if (res.data && !isMfaChallenge(res.data) && !res.data.access_token) {
       res.data.session = null;
@@ -865,6 +909,7 @@ var AuthService = class extends BaseService {
     if (res.data && !isMfaChallenge(res.data)) {
       const tp = res.data;
       tp.session = {
+        id: extractSessionId(tp.access_token),
         access_token: tp.access_token,
         refresh_token: tp.refresh_token,
         token_type: tp.token_type,
@@ -900,6 +945,7 @@ var AuthService = class extends BaseService {
     if (res.data && !isMfaChallenge(res.data)) {
       const tp = res.data;
       tp.session = {
+        id: extractSessionId(tp.access_token),
         access_token: tp.access_token,
         refresh_token: tp.refresh_token,
         token_type: tp.token_type,
@@ -1067,6 +1113,7 @@ var AuthService = class extends BaseService {
     const token = this.client.authStore.token;
     const user = this.client.authStore.user;
     const session = token && user ? {
+      id: extractSessionId(token),
       access_token: token,
       refresh_token: this.client.authStore.refreshToken ?? "",
       token_type: "Bearer",
@@ -1570,10 +1617,31 @@ var AuthService = class extends BaseService {
    * MFA : termine une connexion qui a renvoyé un défi (`mfa_token` et code TOTP). Enregistre la session et émet `SIGNED_IN`.
    */
   async mfaVerify(req) {
-    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, req);
+    const raw = req;
+    const mfa_token = raw.mfa_token ?? raw.mfaToken ?? raw.challenge_id ?? raw.challengeId;
+    const code = raw.code;
+    const recovery_code = raw.recovery_code ?? raw.recoveryCode;
+    const sms_code = raw.sms_code ?? raw.smsCode;
+    const body = {};
+    if (mfa_token) body.mfa_token = mfa_token;
+    if (code !== void 0) body.code = code;
+    if (recovery_code !== void 0) body.recovery_code = recovery_code;
+    if (sms_code !== void 0) body.sms_code = sms_code;
+    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, body);
     if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
+      const tp = res.data;
+      tp.session = {
+        id: extractSessionId(tp.access_token),
+        access_token: tp.access_token,
+        refresh_token: tp.refresh_token,
+        token_type: tp.token_type,
+        expires_in: tp.expires_in,
+        user: tp.user,
+        provider_token: tp.provider_token,
+        provider_refresh_token: tp.provider_refresh_token
+      };
+      this.client.authStore.save(tp.access_token, tp.refresh_token, tp.user);
+      this._emitEvent("SIGNED_IN", tp.user, tp.access_token);
     }
     return res;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/auth",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Service d'authentification du SDK Aurabase (sessions, OAuth/PKCE, MFA, magic link, OTP, admin)",
   "type": "module",
   "main": "dist/index.cjs",
@@ -46,7 +46,7 @@
     "authentication"
   ],
   "dependencies": {
-    "@aurabase/core": "0.7.0"
+    "@aurabase/core": "0.7.1"
   },
   "devDependencies": {
     "@types/node": "20.14.15",