@authagonal/login 0.3.8 → 0.3.9

package/dist/api.d.ts

@@ -10,10 +10,10 @@ export declare function register(email: string, password: string, firstName?: st
 export declare function logout(): Promise<{
     success: true;
 }>;
-export declare function forgotPassword(email: string): Promise<{
+export declare function forgotPassword(email: string, turnstileToken?: string): Promise<{
     success: true;
 }>;
-export declare function resetPassword(token: string, newPassword: string): Promise<{
+export declare function resetPassword(token: string, newPassword: string, turnstileToken?: string): Promise<{
     success: true;
 }>;
 export declare function getSession(): Promise<SessionResponse>;

package/dist/index.js

@@ -4724,18 +4724,22 @@ function Yr(e, t, n, r, i) {
 function Xr() {
 	return $("/api/auth/logout", { method: "POST" });
 }
-function Zr(e) {
+function Zr(e, t) {
 	return $("/api/auth/forgot-password", {
 		method: "POST",
-		body: JSON.stringify({ email: e })
+		body: JSON.stringify({
+			email: e,
+			turnstileToken: t
+		})
 	});
 }
-function Qr(e, t) {
+function Qr(e, t, n) {
 	return $("/api/auth/reset-password", {
 		method: "POST",
 		body: JSON.stringify({
 			token: e,
-			newPassword: t
+			newPassword: t,
+			turnstileToken: n
 		})
 	});
 }
@@ -5326,25 +5330,29 @@ function vi() {
 //#endregion
 //#region src/pages/ForgotPasswordPage.tsx
 function yi() {
-	let { t: e } = L(), [t] = _(), n = t.get("returnUrl") || "", [r, i] = s(""), [a, o] = s(!1), [c, d] = s(!1), [p, m] = s(""), h = n ? `/login?returnUrl=${encodeURIComponent(n)}` : "/login";
-	async function g(t) {
-		t.preventDefault(), m(""), o(!0);
+	let { t: e } = L(), [t] = _(), n = t.get("returnUrl") || "", [r, i] = s(""), [o, c] = s(!1), [d, p] = s(!1), [m, h] = s(""), [g, v] = s(void 0), [y, b] = s(null), [x, S] = s(0);
+	a(() => {
+		ti().then((e) => v(e.turnstileSiteKey)).catch(() => {});
+	}, []);
+	let C = n ? `/login?returnUrl=${encodeURIComponent(n)}` : "/login";
+	async function w(t) {
+		t.preventDefault(), h(""), c(!0);
 		try {
-			await Zr(r), d(!0);
+			await Zr(r, y || void 0), p(!0);
 		} catch {
-			m(e("errorUnexpected"));
+			h(e("errorUnexpected")), g && (b(null), S((e) => e + 1));
 		} finally {
-			o(!1);
+			c(!1);
 		}
 	}
-	return c ? /* @__PURE__ */ u("div", { children: [
+	return d ? /* @__PURE__ */ u("div", { children: [
 		/* @__PURE__ */ l(G, { children: e("checkYourEmail") }),
 		/* @__PURE__ */ l(Q, {
 			variant: "success",
 			children: e("resetEmailSent")
 		}),
 		/* @__PURE__ */ l(K, { children: /* @__PURE__ */ l(f, {
-			to: h,
+			to: C,
 			className: "text-sm font-medium text-primary hover:underline no-underline",
 			children: e("backToSignIn")
 		}) })
@@ -5354,12 +5362,12 @@ function yi() {
 			className: "mb-5",
 			children: e("resetSubtitle")
 		}),
-		p && /* @__PURE__ */ l(Q, {
+		m && /* @__PURE__ */ l(Q, {
 			variant: "error",
-			children: p
+			children: m
 		}),
 		/* @__PURE__ */ u("form", {
-			onSubmit: g,
+			onSubmit: w,
 			children: [
 				/* @__PURE__ */ u("div", {
 					className: "mb-4",
@@ -5378,13 +5386,21 @@ function yi() {
 						required: !0
 					})]
 				}),
+				g && /* @__PURE__ */ l("div", {
+					className: "mb-4",
+					children: /* @__PURE__ */ l(mi, {
+						siteKey: g,
+						onToken: b
+					}, x)
+				}),
 				/* @__PURE__ */ l(Y, {
 					type: "submit",
-					loading: a,
-					children: e(a ? "sending" : "sendResetLink")
+					loading: o,
+					disabled: !!g && !y,
+					children: e(o ? "sending" : "sendResetLink")
 				}),
 				/* @__PURE__ */ l(K, { children: /* @__PURE__ */ l(f, {
-					to: h,
+					to: C,
 					className: "text-sm font-medium text-primary hover:underline no-underline",
 					children: e("backToSignIn")
 				}) })
@@ -5449,13 +5465,15 @@ function Si(e, t) {
 	});
 }
 function Ci() {
-	let { t: e } = L(), [t] = _(), n = t.get("p") || "", [r, i] = s(""), [o, c] = s(""), [d, p] = s(!1), [m, h] = s(""), [g, v] = s(!1), [y, b] = s(""), [x, S] = s(xi);
+	let { t: e } = L(), [t] = _(), n = t.get("p") || "", [r, i] = s(""), [o, c] = s(""), [d, p] = s(!1), [m, h] = s(""), [g, v] = s(!1), [y, b] = s(""), [x, S] = s(xi), [C, w] = s(void 0), [T, E] = s(null), [D, O] = s(0);
 	a(() => {
 		fetch(`${bi}/api/auth/password-policy`).then((e) => e.ok ? e.json() : null).then((e) => {
 			e?.rules && S(e.rules);
 		}).catch(() => {});
+	}, []), a(() => {
+		ti().then((e) => w(e.turnstileSiteKey)).catch(() => {});
 	}, []);
-	function C(t) {
+	function k(t) {
 		switch (t.rule) {
 			case "minLength": return e("ruleMinLength", { count: t.value ?? 8 });
 			case "uppercase": return e("ruleUppercase");
@@ -5465,12 +5483,12 @@ function Ci() {
 			default: return t.label;
 		}
 	}
-	let w = Si(r, x.map((e) => ({
+	let A = Si(r, x.map((e) => ({
 		...e,
-		label: C(e)
-	}))), T = w.every((e) => e.met);
-	async function E(t) {
-		if (t.preventDefault(), h(""), b(""), !T) {
+		label: k(e)
+	}))), j = A.every((e) => e.met);
+	async function M(t) {
+		if (t.preventDefault(), h(""), b(""), !j) {
 			b(e("passwordNotMeetRequirements"));
 			return;
 		}
@@ -5480,7 +5498,7 @@ function Ci() {
 		}
 		p(!0);
 		try {
-			await Qr(n, r), v(!0);
+			await Qr(n, r, T || void 0), v(!0);
 		} catch (t) {
 			if (t instanceof Kr) switch (t.error) {
 				case "weak_password":
@@ -5493,9 +5511,13 @@ function Ci() {
 				case "password_required":
 					h(e("errorPasswordRequired"));
 					break;
+				case "captcha_failed":
+					h(e("errorUnexpected"));
+					break;
 				default: h(t.message || e("errorUnexpected"));
 			}
 			else h(e("errorUnexpected"));
+			C && (E(null), O((e) => e + 1));
 		} finally {
 			p(!1);
 		}
@@ -5522,7 +5544,7 @@ function Ci() {
 			children: y
 		}),
 		/* @__PURE__ */ u("form", {
-			onSubmit: E,
+			onSubmit: M,
 			children: [
 				/* @__PURE__ */ u("div", {
 					className: "mb-4",
@@ -5543,7 +5565,7 @@ function Ci() {
 				}),
 				r.length > 0 && /* @__PURE__ */ l("ul", {
 					className: "list-none mb-4 p-3 bg-gray-50 dark:bg-gray-800/60 rounded-md",
-					children: w.map((e) => /* @__PURE__ */ u("li", {
+					children: A.map((e) => /* @__PURE__ */ u("li", {
 						className: `text-[13px] py-0.5 flex items-center gap-1.5 ${e.met ? "text-green-800 dark:text-green-400" : "text-red-800 dark:text-red-400"}`,
 						children: [e.met ? /* @__PURE__ */ l(Xt, { className: "h-3.5 w-3.5 shrink-0" }) : /* @__PURE__ */ l(tn, { className: "h-3.5 w-3.5 shrink-0" }), e.label]
 					}, e.label))
@@ -5564,10 +5586,17 @@ function Ci() {
 						required: !0
 					})]
 				}),
+				C && /* @__PURE__ */ l("div", {
+					className: "mb-4",
+					children: /* @__PURE__ */ l(mi, {
+						siteKey: C,
+						onToken: E
+					}, D)
+				}),
 				/* @__PURE__ */ l(Y, {
 					type: "submit",
 					loading: d,
-					disabled: !T,
+					disabled: !j || !!C && !T,
 					children: e(d ? "resetting" : "resetPassword")
 				}),
 				/* @__PURE__ */ l(K, { children: /* @__PURE__ */ l(f, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authagonal/login",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Default login UI for Authagonal — runtime-configurable via branding.json",
   "type": "module",
   "license": "MIT",

package/src/api.ts

@@ -66,17 +66,17 @@ export function logout(): Promise<{ success: true }> {
   });
 }
 
-export function forgotPassword(email: string): Promise<{ success: true }> {
+export function forgotPassword(email: string, turnstileToken?: string): Promise<{ success: true }> {
   return api<{ success: true }>('/api/auth/forgot-password', {
     method: 'POST',
-    body: JSON.stringify({ email }),
+    body: JSON.stringify({ email, turnstileToken }),
   });
 }
 
-export function resetPassword(token: string, newPassword: string): Promise<{ success: true }> {
+export function resetPassword(token: string, newPassword: string, turnstileToken?: string): Promise<{ success: true }> {
   return api<{ success: true }>('/api/auth/reset-password', {
     method: 'POST',
-    body: JSON.stringify({ token, newPassword }),
+    body: JSON.stringify({ token, newPassword, turnstileToken }),
   });
 }
 

package/src/pages/ForgotPasswordPage.tsx

@@ -1,7 +1,8 @@
-import { useState } from 'react';
+import { useState, useEffect } from 'react';
 import { useSearchParams, Link } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
-import { forgotPassword } from '../api';
+import { forgotPassword, getProviders } from '../api';
+import { Turnstile } from '../components/Turnstile';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
@@ -17,6 +18,16 @@ export default function ForgotPasswordPage() {
   const [loading, setLoading] = useState(false);
   const [submitted, setSubmitted] = useState(false);
   const [error, setError] = useState('');
+  const [turnstileSiteKey, setTurnstileSiteKey] = useState<string | undefined>(undefined);
+  const [turnstileToken, setTurnstileToken] = useState<string | null>(null);
+  const [turnstileKey, setTurnstileKey] = useState(0); // bump to re-mount the widget for a fresh challenge
+
+  // Surface the Turnstile site key (opt-in; empty when not configured for the tenant).
+  useEffect(() => {
+    getProviders()
+      .then((res) => setTurnstileSiteKey(res.turnstileSiteKey))
+      .catch(() => {});
+  }, []);
 
   const loginLink = returnUrl
     ? `/login?returnUrl=${encodeURIComponent(returnUrl)}`
@@ -28,11 +39,16 @@ export default function ForgotPasswordPage() {
     setLoading(true);
 
     try {
-      await forgotPassword(email);
+      await forgotPassword(email, turnstileToken || undefined);
       setSubmitted(true);
     } catch {
       // The API always returns 200 for anti-enumeration, but handle errors just in case
       setError(t('errorUnexpected'));
+      // Turnstile tokens are single-use — reset so a retry gets a fresh challenge.
+      if (turnstileSiteKey) {
+        setTurnstileToken(null);
+        setTurnstileKey((k) => k + 1);
+      }
     } finally {
       setLoading(false);
     }
@@ -75,7 +91,13 @@ export default function ForgotPasswordPage() {
           />
         </div>
 
-        <Button type="submit" loading={loading}>
+        {turnstileSiteKey && (
+          <div className="mb-4">
+            <Turnstile key={turnstileKey} siteKey={turnstileSiteKey} onToken={setTurnstileToken} />
+          </div>
+        )}
+
+        <Button type="submit" loading={loading} disabled={!!turnstileSiteKey && !turnstileToken}>
           {loading ? t('sending') : t('sendResetLink')}
         </Button>
 

package/src/pages/ResetPasswordPage.tsx

@@ -1,7 +1,8 @@
 import { useState, useEffect } from 'react';
 import { useSearchParams, Link } from 'react-router-dom';
 import { useTranslation } from 'react-i18next';
-import { resetPassword, ApiRequestError } from '../api';
+import { resetPassword, getProviders, ApiRequestError } from '../api';
+import { Turnstile } from '../components/Turnstile';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
@@ -57,6 +58,9 @@ export default function ResetPasswordPage() {
   const [success, setSuccess] = useState(false);
   const [validationError, setValidationError] = useState('');
   const [rules, setRules] = useState<PasswordRule[]>(defaultRules);
+  const [turnstileSiteKey, setTurnstileSiteKey] = useState<string | undefined>(undefined);
+  const [turnstileToken, setTurnstileToken] = useState<string | null>(null);
+  const [turnstileKey, setTurnstileKey] = useState(0); // bump to re-mount the widget for a fresh challenge
 
   useEffect(() => {
     fetch(`${API_URL}/api/auth/password-policy`)
@@ -65,6 +69,13 @@ export default function ResetPasswordPage() {
       .catch(() => { /* use defaults */ });
   }, []);
 
+  // Surface the Turnstile site key (opt-in; empty when not configured for the tenant).
+  useEffect(() => {
+    getProviders()
+      .then((res) => setTurnstileSiteKey(res.turnstileSiteKey))
+      .catch(() => {});
+  }, []);
+
   function getRuleLabel(rule: PasswordRule): string {
     switch (rule.rule) {
       case 'minLength': return t('ruleMinLength', { count: rule.value ?? 8 });
@@ -102,7 +113,7 @@ export default function ResetPasswordPage() {
     setLoading(true);
 
     try {
-      await resetPassword(token, newPassword);
+      await resetPassword(token, newPassword, turnstileToken || undefined);
       setSuccess(true);
     } catch (err) {
       if (err instanceof ApiRequestError) {
@@ -117,12 +128,20 @@ export default function ResetPasswordPage() {
           case 'password_required':
             setError(t('errorPasswordRequired'));
             break;
+          case 'captcha_failed':
+            setError(t('errorUnexpected'));
+            break;
           default:
             setError(err.message || t('errorUnexpected'));
         }
       } else {
         setError(t('errorUnexpected'));
       }
+      // Turnstile tokens are single-use — reset so a retry gets a fresh challenge.
+      if (turnstileSiteKey) {
+        setTurnstileToken(null);
+        setTurnstileKey((k) => k + 1);
+      }
     } finally {
       setLoading(false);
     }
@@ -204,7 +223,13 @@ export default function ResetPasswordPage() {
           />
         </div>
 
-        <Button type="submit" loading={loading} disabled={!allRequirementsMet}>
+        {turnstileSiteKey && (
+          <div className="mb-4">
+            <Turnstile key={turnstileKey} siteKey={turnstileSiteKey} onToken={setTurnstileToken} />
+          </div>
+        )}
+
+        <Button type="submit" loading={loading} disabled={!allRequirementsMet || (!!turnstileSiteKey && !turnstileToken)}>
           {loading ? t('resetting') : t('resetPassword')}
         </Button>