@aurabase/auth 0.7.0 → 0.7.2

package/README.md

@@ -39,8 +39,13 @@ await aura.auth.signOut()
 ### Session
 
 ```ts
-// getSession() n'est PAS un AuraResponse : il lit directement le store local (synchrone en pratique).
-const { accessToken, user } = await aura.auth.getSession()
+// getSession() lit le store local (synchrone en pratique) :
+const { data: { session } } = await aura.auth.getSession()
+if (session) {
+  console.log('Session ID:', session.id)
+  console.log('Access token:', session.access_token)
+  console.log('User ID:', session.user.id)
+}
 
 const refreshed = await aura.auth.refreshSession()
 
@@ -55,6 +60,32 @@ if (first) await aura.auth.revokeSession(first.id)
 await aura.auth.revokeAllSessions()
 ```
 
+### Configuration du stockage (SSR & Node.js)
+
+```ts
+import { createClient, LocalAuthStore, BaseAuthStore } from '@aurabase/aurabase-js'
+
+// Par défaut, le client choisit automatiquement :
+// - Navigateur : `LocalAuthStore` avec clé scopée par projet (`aura-<slug>-auth`)
+// - Node.js / SSR : `BaseAuthStore` en mémoire avec exportToCookie() / loadFromCookie()
+
+// Pour personnaliser le stockage :
+const aura = createClient('https://mon-projet.aurabase.cloud', 'aura_anon_xxx', {
+  auth: {
+    storage: new LocalAuthStore('custom-auth-key'),
+    autoRefreshToken: true,
+    persistSession: true,
+  },
+})
+
+// Sérialisation cookie (SSR) :
+const setCookieHeader = aura.authStore.exportToCookie({
+  httpOnly: true,
+  secure: true,
+  sameSite: 'lax',
+})
+```
+
 ### OAuth (implicite ou PKCE)
 
 `signInWithOAuth` ne redirige plus « en dur » : il renvoie toujours `{ url }` (et redirige en plus via `window.location.href` si un `window` existe).

package/dist/index.cjs

@@ -52,9 +52,69 @@ var AuthAdminService = class extends core.BaseService {
   }
   /**
    * Génère un lien à usage unique pour un utilisateur (`'magic'`, `'recovery'` ou `'invite'`) et renvoie `{ link, token }`.
+   * Accepte `generateLink(userId, type)` ou `generateLink({ userId, type })` ou `generateLink({ email, type })`.
    */
-  async generateLink(userId, type) {
-    return this.request("POST", `${this.prefix}/users/${userId}/generate-link`, { type });
+  async generateLink(userIdOrParams, type) {
+    let resolvedUserId;
+    let resolvedType;
+    let resolvedRedirectTo;
+    if (typeof userIdOrParams === "object" && userIdOrParams !== null) {
+      resolvedUserId = userIdOrParams.userId ?? userIdOrParams.user_id;
+      resolvedType = userIdOrParams.type ?? type;
+      resolvedRedirectTo = userIdOrParams.redirectTo ?? userIdOrParams.redirect_to;
+      if (!resolvedUserId && userIdOrParams.email) {
+        const email = userIdOrParams.email.trim().toLowerCase();
+        const searchRes = await this.listUsers({ search: email, limit: 1 });
+        const usersList = Array.isArray(searchRes.data) ? searchRes.data : [];
+        if (usersList[0]?.id) {
+          resolvedUserId = usersList[0].id;
+        } else {
+          return {
+            data: null,
+            error: new core.AuraError(404, {
+              error: {
+                code: "USER_NOT_FOUND",
+                message: `No user found with email "${email}".`
+              }
+            })
+          };
+        }
+      }
+    } else if (typeof userIdOrParams === "string") {
+      resolvedUserId = userIdOrParams;
+      resolvedType = type;
+    }
+    if (!resolvedUserId || typeof resolvedUserId !== "string" || resolvedUserId.trim() === "" || resolvedUserId.includes("[object")) {
+      return {
+        data: null,
+        error: new core.AuraError(400, {
+          error: {
+            code: "INVALID_ARGUMENT",
+            message: "userId or email is required. Usage: generateLink({ email, type }) or generateLink(userId, type)."
+          }
+        })
+      };
+    }
+    if (!resolvedType) {
+      return {
+        data: null,
+        error: new core.AuraError(400, {
+          error: {
+            code: "INVALID_ARGUMENT",
+            message: 'type is required for generateLink ("magic" | "recovery" | "invite").'
+          }
+        })
+      };
+    }
+    const body = { type: resolvedType };
+    if (resolvedRedirectTo) {
+      body.redirect_to = resolvedRedirectTo;
+    }
+    return this.request(
+      "POST",
+      `${this.prefix}/users/${encodeURIComponent(resolvedUserId)}/generate-link`,
+      body
+    );
   }
   /**
    * Impersonation (AUTH-037) : jeton COURT (10 minutes au plus) pour agir en tant que l'utilisateur,
@@ -536,6 +596,15 @@ var SessionManager = class {
 };
 
 // src/AuthService.ts
+function extractSessionId(token) {
+  if (!token) return void 0;
+  try {
+    const payload = decodeJwt(token).payload;
+    return payload?.session_id ?? payload?.sid ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
 function isMfaChallenge(v) {
   return typeof v === "object" && v !== null && v.mfa_required === true;
 }
@@ -814,6 +883,7 @@ var AuthService = class extends core.BaseService {
     queueMicrotask(() => {
       if (this._stateListeners.has(callback)) {
         const session = store.token && store.user ? {
+          id: extractSessionId(store.token),
           access_token: store.token,
           refresh_token: store.refreshToken ?? "",
           token_type: "Bearer",
@@ -828,6 +898,7 @@ var AuthService = class extends core.BaseService {
   _emitEvent(event, user, accessToken, extra) {
     if (event === "SIGNED_OUT") this._signedOutSeq = this._clearSeq;
     const session = accessToken && user ? {
+      id: extractSessionId(accessToken),
       access_token: accessToken,
       refresh_token: this.client.authStore.refreshToken ?? "",
       token_type: "Bearer",
@@ -859,6 +930,7 @@ var AuthService = class extends core.BaseService {
     }
     if (req.options?.data) payload.data = req.options.data;
     if (req.options?.emailRedirectTo) payload.email_redirect_to = req.options.emailRedirectTo;
+    if (req.options?.preventEmailEnumeration) payload.prevent_email_enumeration = true;
     const res = await this.request("POST", `${this.prefix}/register`, payload);
     if (res.data && !isMfaChallenge(res.data) && !res.data.access_token) {
       res.data.session = null;
@@ -867,6 +939,7 @@ var AuthService = class extends core.BaseService {
     if (res.data && !isMfaChallenge(res.data)) {
       const tp = res.data;
       tp.session = {
+        id: extractSessionId(tp.access_token),
         access_token: tp.access_token,
         refresh_token: tp.refresh_token,
         token_type: tp.token_type,
@@ -902,6 +975,7 @@ var AuthService = class extends core.BaseService {
     if (res.data && !isMfaChallenge(res.data)) {
       const tp = res.data;
       tp.session = {
+        id: extractSessionId(tp.access_token),
         access_token: tp.access_token,
         refresh_token: tp.refresh_token,
         token_type: tp.token_type,
@@ -1069,6 +1143,7 @@ var AuthService = class extends core.BaseService {
     const token = this.client.authStore.token;
     const user = this.client.authStore.user;
     const session = token && user ? {
+      id: extractSessionId(token),
       access_token: token,
       refresh_token: this.client.authStore.refreshToken ?? "",
       token_type: "Bearer",
@@ -1460,14 +1535,28 @@ var AuthService = class extends core.BaseService {
         const code = typeof codeOrParams === "string" ? codeOrParams : codeOrParams.code;
         return this.regenerateRecoveryCodes(code);
       },
-      factors: (mfaToken) => this.request("POST", `${this.prefix}/mfa/factors`, { mfa_token: mfaToken }),
+      factors: (mfaToken) => this.request("POST", `${this.prefix}/mfa/factors`, {
+        mfa_token: mfaToken
+      }),
       sms: {
         setup: (phone) => this.request("POST", `${this.prefix}/mfa/sms/setup`, { phone }),
-        verifySetup: (code) => this.request("POST", `${this.prefix}/mfa/sms/setup/verify`, { code }),
-        send: (mfaToken) => this.request("POST", `${this.prefix}/mfa/sms/send`, {
-          mfa_token: mfaToken
-        }),
-        remove: (password) => this.request("DELETE", `${this.prefix}/mfa/sms`, { password })
+        verifySetup: (code) => this.request(
+          "POST",
+          `${this.prefix}/mfa/sms/setup/verify`,
+          { code }
+        ),
+        send: (mfaToken) => this.request(
+          "POST",
+          `${this.prefix}/mfa/sms/send`,
+          {
+            mfa_token: mfaToken
+          }
+        ),
+        remove: (password) => this.request(
+          "DELETE",
+          `${this.prefix}/mfa/sms`,
+          { password }
+        )
       },
       webauthn: {
         register: (params) => this.webauthnRegister(params),
@@ -1481,6 +1570,13 @@ var AuthService = class extends core.BaseService {
       }
     };
   }
+  /**
+   * API d'administration de l'authentification (alias vers `client.authAdmin`).
+   * Exige une clé `service_role` (côté serveur uniquement).
+   */
+  get admin() {
+    return this.client.authAdmin;
+  }
   webauthnIndisponible() {
     return {
       data: null,
@@ -1505,7 +1601,7 @@ var AuthService = class extends core.BaseService {
       `${this.prefix}/mfa/webauthn/register/start`,
       { friendly_name: params?.friendlyName }
     );
-    if (!debut.data) return debut;
+    if (!debut.data) return { data: null, error: debut.error };
     let cred;
     try {
       cred = await conteneur.create(creationOptionsFromJson(debut.data.options));
@@ -1513,10 +1609,14 @@ var AuthService = class extends core.BaseService {
       return this.webauthnAnnule(e);
     }
     if (!cred) return this.webauthnAnnule(new Error("no credential returned"));
-    return this.request("POST", `${this.prefix}/mfa/webauthn/register/finish`, {
-      credential: attestationToJson(cred),
-      friendly_name: params?.friendlyName
-    });
+    return this.request(
+      "POST",
+      `${this.prefix}/mfa/webauthn/register/finish`,
+      {
+        credential: attestationToJson(cred),
+        friendly_name: params?.friendlyName
+      }
+    );
   }
   /**
    * Relève un défi MFA (`mfaToken`, reçu d'un `signIn`) avec une passkey : options du serveur,
@@ -1530,7 +1630,7 @@ var AuthService = class extends core.BaseService {
       `${this.prefix}/mfa/webauthn/verify/start`,
       { mfa_token: params.mfaToken }
     );
-    if (!debut.data) return debut;
+    if (!debut.data) return { data: null, error: debut.error };
     let cred;
     try {
       cred = await conteneur.get(requestOptionsFromJson(debut.data.options));
@@ -1572,10 +1672,31 @@ var AuthService = class extends core.BaseService {
    * MFA : termine une connexion qui a renvoyé un défi (`mfa_token` et code TOTP). Enregistre la session et émet `SIGNED_IN`.
    */
   async mfaVerify(req) {
-    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, req);
+    const raw = req;
+    const mfa_token = raw.mfa_token ?? raw.mfaToken ?? raw.challenge_id ?? raw.challengeId;
+    const code = raw.code;
+    const recovery_code = raw.recovery_code ?? raw.recoveryCode;
+    const sms_code = raw.sms_code ?? raw.smsCode;
+    const body = {};
+    if (mfa_token) body.mfa_token = mfa_token;
+    if (code !== void 0) body.code = code;
+    if (recovery_code !== void 0) body.recovery_code = recovery_code;
+    if (sms_code !== void 0) body.sms_code = sms_code;
+    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, body);
     if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
+      const tp = res.data;
+      tp.session = {
+        id: extractSessionId(tp.access_token),
+        access_token: tp.access_token,
+        refresh_token: tp.refresh_token,
+        token_type: tp.token_type,
+        expires_in: tp.expires_in,
+        user: tp.user,
+        provider_token: tp.provider_token,
+        provider_refresh_token: tp.provider_refresh_token
+      };
+      this.client.authStore.save(tp.access_token, tp.refresh_token, tp.user);
+      this._emitEvent("SIGNED_IN", tp.user, tp.access_token);
     }
     return res;
   }

package/dist/index.d.cts

@@ -72,8 +72,16 @@ declare class AuthAdminService extends BaseService {
     unbanUser(userId: string): Promise<AuraResponse<null>>;
     /**
      * Génère un lien à usage unique pour un utilisateur (`'magic'`, `'recovery'` ou `'invite'`) et renvoie `{ link, token }`.
+     * Accepte `generateLink(userId, type)` ou `generateLink({ userId, type })` ou `generateLink({ email, type })`.
      */
-    generateLink(userId: string, type: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>>;
+    generateLink(userIdOrParams: string | {
+        userId?: string;
+        user_id?: string;
+        email?: string;
+        type: GenerateLinkType;
+        redirectTo?: string;
+        redirect_to?: string;
+    }, type?: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>>;
     /**
      * Impersonation (AUTH-037) : jeton COURT (10 minutes au plus) pour agir en tant que l'utilisateur,
      * avec le claim `act: { sub }`. Pas de refresh token, journalisé (`admin_impersonation`).
@@ -568,6 +576,11 @@ declare class AuthService extends BaseService {
             }>>;
         };
     };
+    /**
+     * API d'administration de l'authentification (alias vers `client.authAdmin`).
+     * Exige une clé `service_role` (côté serveur uniquement).
+     */
+    get admin(): AuthAdminService;
     private webauthnIndisponible;
     /**
      * Enrôle une passkey WebAuthn pour l'utilisateur connecté (cérémonie complète : options du serveur,

package/dist/index.d.ts

@@ -72,8 +72,16 @@ declare class AuthAdminService extends BaseService {
     unbanUser(userId: string): Promise<AuraResponse<null>>;
     /**
      * Génère un lien à usage unique pour un utilisateur (`'magic'`, `'recovery'` ou `'invite'`) et renvoie `{ link, token }`.
+     * Accepte `generateLink(userId, type)` ou `generateLink({ userId, type })` ou `generateLink({ email, type })`.
      */
-    generateLink(userId: string, type: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>>;
+    generateLink(userIdOrParams: string | {
+        userId?: string;
+        user_id?: string;
+        email?: string;
+        type: GenerateLinkType;
+        redirectTo?: string;
+        redirect_to?: string;
+    }, type?: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>>;
     /**
      * Impersonation (AUTH-037) : jeton COURT (10 minutes au plus) pour agir en tant que l'utilisateur,
      * avec le claim `act: { sub }`. Pas de refresh token, journalisé (`admin_impersonation`).
@@ -568,6 +576,11 @@ declare class AuthService extends BaseService {
             }>>;
         };
     };
+    /**
+     * API d'administration de l'authentification (alias vers `client.authAdmin`).
+     * Exige une clé `service_role` (côté serveur uniquement).
+     */
+    get admin(): AuthAdminService;
     private webauthnIndisponible;
     /**
      * Enrôle une passkey WebAuthn pour l'utilisateur connecté (cérémonie complète : options du serveur,

package/dist/index.js

@@ -1,4 +1,4 @@
-import { BaseService, isTokenExpired, clientScope, AuraError, refreshOnce, DEFAULT_REQUEST_TIMEOUT_MS, emitAuraEvent } from '@aurabase/core';
+import { BaseService, AuraError, isTokenExpired, clientScope, refreshOnce, DEFAULT_REQUEST_TIMEOUT_MS, emitAuraEvent } from '@aurabase/core';
 
 // src/AuthAdminService.ts
 var AuthAdminService = class extends BaseService {
@@ -50,9 +50,69 @@ var AuthAdminService = class extends BaseService {
   }
   /**
    * Génère un lien à usage unique pour un utilisateur (`'magic'`, `'recovery'` ou `'invite'`) et renvoie `{ link, token }`.
+   * Accepte `generateLink(userId, type)` ou `generateLink({ userId, type })` ou `generateLink({ email, type })`.
    */
-  async generateLink(userId, type) {
-    return this.request("POST", `${this.prefix}/users/${userId}/generate-link`, { type });
+  async generateLink(userIdOrParams, type) {
+    let resolvedUserId;
+    let resolvedType;
+    let resolvedRedirectTo;
+    if (typeof userIdOrParams === "object" && userIdOrParams !== null) {
+      resolvedUserId = userIdOrParams.userId ?? userIdOrParams.user_id;
+      resolvedType = userIdOrParams.type ?? type;
+      resolvedRedirectTo = userIdOrParams.redirectTo ?? userIdOrParams.redirect_to;
+      if (!resolvedUserId && userIdOrParams.email) {
+        const email = userIdOrParams.email.trim().toLowerCase();
+        const searchRes = await this.listUsers({ search: email, limit: 1 });
+        const usersList = Array.isArray(searchRes.data) ? searchRes.data : [];
+        if (usersList[0]?.id) {
+          resolvedUserId = usersList[0].id;
+        } else {
+          return {
+            data: null,
+            error: new AuraError(404, {
+              error: {
+                code: "USER_NOT_FOUND",
+                message: `No user found with email "${email}".`
+              }
+            })
+          };
+        }
+      }
+    } else if (typeof userIdOrParams === "string") {
+      resolvedUserId = userIdOrParams;
+      resolvedType = type;
+    }
+    if (!resolvedUserId || typeof resolvedUserId !== "string" || resolvedUserId.trim() === "" || resolvedUserId.includes("[object")) {
+      return {
+        data: null,
+        error: new AuraError(400, {
+          error: {
+            code: "INVALID_ARGUMENT",
+            message: "userId or email is required. Usage: generateLink({ email, type }) or generateLink(userId, type)."
+          }
+        })
+      };
+    }
+    if (!resolvedType) {
+      return {
+        data: null,
+        error: new AuraError(400, {
+          error: {
+            code: "INVALID_ARGUMENT",
+            message: 'type is required for generateLink ("magic" | "recovery" | "invite").'
+          }
+        })
+      };
+    }
+    const body = { type: resolvedType };
+    if (resolvedRedirectTo) {
+      body.redirect_to = resolvedRedirectTo;
+    }
+    return this.request(
+      "POST",
+      `${this.prefix}/users/${encodeURIComponent(resolvedUserId)}/generate-link`,
+      body
+    );
   }
   /**
    * Impersonation (AUTH-037) : jeton COURT (10 minutes au plus) pour agir en tant que l'utilisateur,
@@ -534,6 +594,15 @@ var SessionManager = class {
 };
 
 // src/AuthService.ts
+function extractSessionId(token) {
+  if (!token) return void 0;
+  try {
+    const payload = decodeJwt(token).payload;
+    return payload?.session_id ?? payload?.sid ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
 function isMfaChallenge(v) {
   return typeof v === "object" && v !== null && v.mfa_required === true;
 }
@@ -812,6 +881,7 @@ var AuthService = class extends BaseService {
     queueMicrotask(() => {
       if (this._stateListeners.has(callback)) {
         const session = store.token && store.user ? {
+          id: extractSessionId(store.token),
           access_token: store.token,
           refresh_token: store.refreshToken ?? "",
           token_type: "Bearer",
@@ -826,6 +896,7 @@ var AuthService = class extends BaseService {
   _emitEvent(event, user, accessToken, extra) {
     if (event === "SIGNED_OUT") this._signedOutSeq = this._clearSeq;
     const session = accessToken && user ? {
+      id: extractSessionId(accessToken),
       access_token: accessToken,
       refresh_token: this.client.authStore.refreshToken ?? "",
       token_type: "Bearer",
@@ -857,6 +928,7 @@ var AuthService = class extends BaseService {
     }
     if (req.options?.data) payload.data = req.options.data;
     if (req.options?.emailRedirectTo) payload.email_redirect_to = req.options.emailRedirectTo;
+    if (req.options?.preventEmailEnumeration) payload.prevent_email_enumeration = true;
     const res = await this.request("POST", `${this.prefix}/register`, payload);
     if (res.data && !isMfaChallenge(res.data) && !res.data.access_token) {
       res.data.session = null;
@@ -865,6 +937,7 @@ var AuthService = class extends BaseService {
     if (res.data && !isMfaChallenge(res.data)) {
       const tp = res.data;
       tp.session = {
+        id: extractSessionId(tp.access_token),
         access_token: tp.access_token,
         refresh_token: tp.refresh_token,
         token_type: tp.token_type,
@@ -900,6 +973,7 @@ var AuthService = class extends BaseService {
     if (res.data && !isMfaChallenge(res.data)) {
       const tp = res.data;
       tp.session = {
+        id: extractSessionId(tp.access_token),
         access_token: tp.access_token,
         refresh_token: tp.refresh_token,
         token_type: tp.token_type,
@@ -1067,6 +1141,7 @@ var AuthService = class extends BaseService {
     const token = this.client.authStore.token;
     const user = this.client.authStore.user;
     const session = token && user ? {
+      id: extractSessionId(token),
       access_token: token,
       refresh_token: this.client.authStore.refreshToken ?? "",
       token_type: "Bearer",
@@ -1458,14 +1533,28 @@ var AuthService = class extends BaseService {
         const code = typeof codeOrParams === "string" ? codeOrParams : codeOrParams.code;
         return this.regenerateRecoveryCodes(code);
       },
-      factors: (mfaToken) => this.request("POST", `${this.prefix}/mfa/factors`, { mfa_token: mfaToken }),
+      factors: (mfaToken) => this.request("POST", `${this.prefix}/mfa/factors`, {
+        mfa_token: mfaToken
+      }),
       sms: {
         setup: (phone) => this.request("POST", `${this.prefix}/mfa/sms/setup`, { phone }),
-        verifySetup: (code) => this.request("POST", `${this.prefix}/mfa/sms/setup/verify`, { code }),
-        send: (mfaToken) => this.request("POST", `${this.prefix}/mfa/sms/send`, {
-          mfa_token: mfaToken
-        }),
-        remove: (password) => this.request("DELETE", `${this.prefix}/mfa/sms`, { password })
+        verifySetup: (code) => this.request(
+          "POST",
+          `${this.prefix}/mfa/sms/setup/verify`,
+          { code }
+        ),
+        send: (mfaToken) => this.request(
+          "POST",
+          `${this.prefix}/mfa/sms/send`,
+          {
+            mfa_token: mfaToken
+          }
+        ),
+        remove: (password) => this.request(
+          "DELETE",
+          `${this.prefix}/mfa/sms`,
+          { password }
+        )
       },
       webauthn: {
         register: (params) => this.webauthnRegister(params),
@@ -1479,6 +1568,13 @@ var AuthService = class extends BaseService {
       }
     };
   }
+  /**
+   * API d'administration de l'authentification (alias vers `client.authAdmin`).
+   * Exige une clé `service_role` (côté serveur uniquement).
+   */
+  get admin() {
+    return this.client.authAdmin;
+  }
   webauthnIndisponible() {
     return {
       data: null,
@@ -1503,7 +1599,7 @@ var AuthService = class extends BaseService {
       `${this.prefix}/mfa/webauthn/register/start`,
       { friendly_name: params?.friendlyName }
     );
-    if (!debut.data) return debut;
+    if (!debut.data) return { data: null, error: debut.error };
     let cred;
     try {
       cred = await conteneur.create(creationOptionsFromJson(debut.data.options));
@@ -1511,10 +1607,14 @@ var AuthService = class extends BaseService {
       return this.webauthnAnnule(e);
     }
     if (!cred) return this.webauthnAnnule(new Error("no credential returned"));
-    return this.request("POST", `${this.prefix}/mfa/webauthn/register/finish`, {
-      credential: attestationToJson(cred),
-      friendly_name: params?.friendlyName
-    });
+    return this.request(
+      "POST",
+      `${this.prefix}/mfa/webauthn/register/finish`,
+      {
+        credential: attestationToJson(cred),
+        friendly_name: params?.friendlyName
+      }
+    );
   }
   /**
    * Relève un défi MFA (`mfaToken`, reçu d'un `signIn`) avec une passkey : options du serveur,
@@ -1528,7 +1628,7 @@ var AuthService = class extends BaseService {
       `${this.prefix}/mfa/webauthn/verify/start`,
       { mfa_token: params.mfaToken }
     );
-    if (!debut.data) return debut;
+    if (!debut.data) return { data: null, error: debut.error };
     let cred;
     try {
       cred = await conteneur.get(requestOptionsFromJson(debut.data.options));
@@ -1570,10 +1670,31 @@ var AuthService = class extends BaseService {
    * MFA : termine une connexion qui a renvoyé un défi (`mfa_token` et code TOTP). Enregistre la session et émet `SIGNED_IN`.
    */
   async mfaVerify(req) {
-    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, req);
+    const raw = req;
+    const mfa_token = raw.mfa_token ?? raw.mfaToken ?? raw.challenge_id ?? raw.challengeId;
+    const code = raw.code;
+    const recovery_code = raw.recovery_code ?? raw.recoveryCode;
+    const sms_code = raw.sms_code ?? raw.smsCode;
+    const body = {};
+    if (mfa_token) body.mfa_token = mfa_token;
+    if (code !== void 0) body.code = code;
+    if (recovery_code !== void 0) body.recovery_code = recovery_code;
+    if (sms_code !== void 0) body.sms_code = sms_code;
+    const res = await this.request("POST", `${this.prefix}/mfa/verify-login`, body);
     if (res.data) {
-      this.client.authStore.save(res.data.access_token, res.data.refresh_token, res.data.user);
-      this._emitEvent("SIGNED_IN", res.data.user, res.data.access_token);
+      const tp = res.data;
+      tp.session = {
+        id: extractSessionId(tp.access_token),
+        access_token: tp.access_token,
+        refresh_token: tp.refresh_token,
+        token_type: tp.token_type,
+        expires_in: tp.expires_in,
+        user: tp.user,
+        provider_token: tp.provider_token,
+        provider_refresh_token: tp.provider_refresh_token
+      };
+      this.client.authStore.save(tp.access_token, tp.refresh_token, tp.user);
+      this._emitEvent("SIGNED_IN", tp.user, tp.access_token);
     }
     return res;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aurabase/auth",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Service d'authentification du SDK Aurabase (sessions, OAuth/PKCE, MFA, magic link, OTP, admin)",
   "type": "module",
   "main": "dist/index.cjs",
@@ -46,7 +46,7 @@
     "authentication"
   ],
   "dependencies": {
-    "@aurabase/core": "0.7.0"
+    "@aurabase/core": "0.7.2"
   },
   "devDependencies": {
     "@types/node": "20.14.15",