@authowl/react 0.18.1 → 0.18.3

package/dist/index.cjs

@@ -625,7 +625,21 @@ var KNOWN_METHODS = [
 function emailAutocomplete(isPasskeyHost) {
   return isPasskeyHost ? "email webauthn" : "email";
 }
-function resolveSignInMethods(config) {
+function passkeyReachableFrom(authBaseUrl, pageHost, relyingPartyId) {
+  if (pageHost === void 0) return true;
+  let rpId = relyingPartyId ?? void 0;
+  if (!rpId) {
+    if (!authBaseUrl) return true;
+    try {
+      rpId = new URL(authBaseUrl).hostname;
+    } catch {
+      return true;
+    }
+  }
+  if (rpId !== "localhost" && !rpId.includes(".")) return false;
+  return pageHost === rpId || pageHost.endsWith(`.${rpId}`);
+}
+function resolveSignInMethods(config, pageHost) {
   const methods = config?.enabledMethods ?? ["password"];
   const social = config?.socialProviders ?? [];
   const has = (m) => methods.includes(m);
@@ -635,7 +649,11 @@ function resolveSignInMethods(config) {
   const magicLink = capabilities.magicLinkSignIn;
   const emailOtp = capabilities.emailOtpSignIn && !capabilities.totp && !capabilities.mfaRequired;
   const phoneOtp = capabilities.phoneSignIn;
-  const passkey = capabilities.passkeySignIn;
+  const passkey = capabilities.passkeySignIn && passkeyReachableFrom(
+    config?.authBaseUrl,
+    pageHost,
+    config?.authentication?.passkey?.relyingPartyId
+  );
   const sso = has("sso");
   const renderable = password || username || magicLink || emailOtp || phoneOtp || passkey || sso || social.length > 0;
   const emptyReason = renderable ? null : methods.length > 0 ? "unsupported" : "none";
@@ -688,8 +706,15 @@ function hasUsableSession(store) {
   const data = store.getSnapshot().data;
   return Boolean(data?.user && data.session.pendingMfaEnrollment !== true);
 }
+function isHeldAtEnrollment(store) {
+  const data = store.getSnapshot().data;
+  return Boolean(data?.user && data.session.pendingMfaEnrollment === true);
+}
 function waitForUsableSession(store) {
-  if (hasUsableSession(store)) return Promise.resolve();
+  const outcome = () => isHeldAtEnrollment(store) ? "held" : "settled";
+  if (hasUsableSession(store) || isHeldAtEnrollment(store)) {
+    return Promise.resolve(outcome());
+  }
   return new Promise((resolve) => {
     let settled = false;
     let unsubscribe = () => {
@@ -699,23 +724,22 @@ function waitForUsableSession(store) {
       settled = true;
       window.clearTimeout(timeout);
       unsubscribe();
-      resolve();
+      resolve(outcome());
     };
     const timeout = window.setTimeout(finish, SESSION_SETTLE_TIMEOUT_MS);
     unsubscribe = store.subscribe(() => {
-      if (hasUsableSession(store)) finish();
+      if (hasUsableSession(store) || isHeldAtEnrollment(store)) finish();
     });
-    if (hasUsableSession(store)) finish();
+    if (hasUsableSession(store) || isHeldAtEnrollment(store)) finish();
   });
 }
 async function finishSignIn(opts) {
+  if (await waitForUsableSession(opts.sessionStore) === "held") return;
   opts.onSignedIn?.();
   if (safeRedirect(opts.redirectTo)) {
     await new Promise(() => {
     });
-    return;
   }
-  await waitForUsableSession(opts.sessionStore);
 }
 
 // src/components/use-submit-action.ts
@@ -3623,7 +3647,10 @@ function SignIn({
   const [challenge, setChallenge] = React16.useState(false);
   const mfaEnrolment = useConfirmedMfaPending();
   const emailRef = React16.useRef(null);
-  const plan = resolveSignInMethods(config);
+  const plan = resolveSignInMethods(
+    config,
+    typeof window === "undefined" ? void 0 : window.location.hostname
+  );
   usePasskeyAutofill({
     enabled: credentialMode === "email" && plan.autofillHost !== null,
     redirectTo,

package/dist/index.d.cts

@@ -311,12 +311,9 @@ type SignInPlan = {
  * passkeys inline. One place owns the token string.
  */
 declare function emailAutocomplete(isPasskeyHost: boolean): string;
-/**
- * Resolve the sign-in surfaces from a project's public config. On a config error
- * (`config` null) fall back to password - the safe default that always renders -
- * rather than showing nothing.
- */
-declare function resolveSignInMethods(config: PublicConfig | null): SignInPlan;
+declare function resolveSignInMethods(config: PublicConfig | null, 
+/** The hostname the form is rendering on; omit when it is not knowable. */
+pageHost?: string): SignInPlan;
 
 type SignInProps = {
     redirectTo?: string;

package/dist/index.d.ts

@@ -311,12 +311,9 @@ type SignInPlan = {
  * passkeys inline. One place owns the token string.
  */
 declare function emailAutocomplete(isPasskeyHost: boolean): string;
-/**
- * Resolve the sign-in surfaces from a project's public config. On a config error
- * (`config` null) fall back to password - the safe default that always renders -
- * rather than showing nothing.
- */
-declare function resolveSignInMethods(config: PublicConfig | null): SignInPlan;
+declare function resolveSignInMethods(config: PublicConfig | null, 
+/** The hostname the form is rendering on; omit when it is not knowable. */
+pageHost?: string): SignInPlan;
 
 type SignInProps = {
     redirectTo?: string;

package/dist/index.js

@@ -544,7 +544,21 @@ var KNOWN_METHODS = [
 function emailAutocomplete(isPasskeyHost) {
   return isPasskeyHost ? "email webauthn" : "email";
 }
-function resolveSignInMethods(config) {
+function passkeyReachableFrom(authBaseUrl, pageHost, relyingPartyId) {
+  if (pageHost === void 0) return true;
+  let rpId = relyingPartyId ?? void 0;
+  if (!rpId) {
+    if (!authBaseUrl) return true;
+    try {
+      rpId = new URL(authBaseUrl).hostname;
+    } catch {
+      return true;
+    }
+  }
+  if (rpId !== "localhost" && !rpId.includes(".")) return false;
+  return pageHost === rpId || pageHost.endsWith(`.${rpId}`);
+}
+function resolveSignInMethods(config, pageHost) {
   const methods = config?.enabledMethods ?? ["password"];
   const social = config?.socialProviders ?? [];
   const has = (m) => methods.includes(m);
@@ -554,7 +568,11 @@ function resolveSignInMethods(config) {
   const magicLink = capabilities.magicLinkSignIn;
   const emailOtp = capabilities.emailOtpSignIn && !capabilities.totp && !capabilities.mfaRequired;
   const phoneOtp = capabilities.phoneSignIn;
-  const passkey = capabilities.passkeySignIn;
+  const passkey = capabilities.passkeySignIn && passkeyReachableFrom(
+    config?.authBaseUrl,
+    pageHost,
+    config?.authentication?.passkey?.relyingPartyId
+  );
   const sso = has("sso");
   const renderable = password || username || magicLink || emailOtp || phoneOtp || passkey || sso || social.length > 0;
   const emptyReason = renderable ? null : methods.length > 0 ? "unsupported" : "none";
@@ -607,8 +625,15 @@ function hasUsableSession(store) {
   const data = store.getSnapshot().data;
   return Boolean(data?.user && data.session.pendingMfaEnrollment !== true);
 }
+function isHeldAtEnrollment(store) {
+  const data = store.getSnapshot().data;
+  return Boolean(data?.user && data.session.pendingMfaEnrollment === true);
+}
 function waitForUsableSession(store) {
-  if (hasUsableSession(store)) return Promise.resolve();
+  const outcome = () => isHeldAtEnrollment(store) ? "held" : "settled";
+  if (hasUsableSession(store) || isHeldAtEnrollment(store)) {
+    return Promise.resolve(outcome());
+  }
   return new Promise((resolve) => {
     let settled = false;
     let unsubscribe = () => {
@@ -618,23 +643,22 @@ function waitForUsableSession(store) {
       settled = true;
       window.clearTimeout(timeout);
       unsubscribe();
-      resolve();
+      resolve(outcome());
     };
     const timeout = window.setTimeout(finish, SESSION_SETTLE_TIMEOUT_MS);
     unsubscribe = store.subscribe(() => {
-      if (hasUsableSession(store)) finish();
+      if (hasUsableSession(store) || isHeldAtEnrollment(store)) finish();
     });
-    if (hasUsableSession(store)) finish();
+    if (hasUsableSession(store) || isHeldAtEnrollment(store)) finish();
   });
 }
 async function finishSignIn(opts) {
+  if (await waitForUsableSession(opts.sessionStore) === "held") return;
   opts.onSignedIn?.();
   if (safeRedirect(opts.redirectTo)) {
     await new Promise(() => {
     });
-    return;
   }
-  await waitForUsableSession(opts.sessionStore);
 }
 
 // src/components/use-submit-action.ts
@@ -3545,7 +3569,10 @@ function SignIn({
   const [challenge, setChallenge] = React16.useState(false);
   const mfaEnrolment = useConfirmedMfaPending();
   const emailRef = React16.useRef(null);
-  const plan = resolveSignInMethods(config);
+  const plan = resolveSignInMethods(
+    config,
+    typeof window === "undefined" ? void 0 : window.location.hostname
+  );
   usePasskeyAutofill({
     enabled: credentialMode === "email" && plan.autofillHost !== null,
     redirectTo,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authowl/react",
-  "version": "0.18.1",
+  "version": "0.18.3",
   "description": "React provider, hooks, and drop-in components for AuthOwl, the multi-tenant auth SaaS.",
   "license": "MIT",
   "publishConfig": {
@@ -47,7 +47,7 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@authowl/core": "0.15.0"
+    "@authowl/core": "0.15.1"
   },
   "peerDependencies": {
     "react": ">=18",