@authowl/react 0.22.0 → 0.23.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { AuthConfig, Locale, AuthOwlClient, PublicConfig, ConsentStatus, OrganizationInvitationDetails, OrganizationDetails, OrganizationMembership, HasParams, AuthUser, AuthClientError, InvitationRecipientHint, SessionState, Organization, AuthOwlErrorCode } from '@authowl/core';
+import { AuthConfig, Locale, AuthOwlClient, PublicConfig, ConsentStatus, OrganizationInvitationDetails, OrganizationDetails, OrganizationMembership, HasParams, AuthUser, AuthClientError, InvitationRecipientHint, SessionState, Organization, AuthOwlErrorCode, LastUsedSignInMethod } from '@authowl/core';
 export { AuthOwlError, AuthPasskey, ConsentStatus, HasParams, InvalidKeyError, Organization, OrganizationDetails, OrganizationInvitation, OrganizationMember, OrganizationMemberWithUser, OrganizationMembership, OrganizationRoleSummary, OrganizationTeam, OrganizationTeamMember, OrganizationUserInvitation, PublicConfig, RateLimitedError, createMembershipHas, membershipHas, membershipHasPermission, membershipHasTeam } from '@authowl/core';
 
 type Appearance = {
@@ -901,7 +901,7 @@ type GoogleOneTapError = {
 type GoogleOneTapProps = {
     /** Disable prompting without unmounting the component. */
     disabled?: boolean;
-    /** Bind Google's ID token to this browser attempt. Generate a fresh random value server-side. */
+    /** Ask Google to include this nonce and verify the returned token carries the same value. */
     nonce?: string;
     /** Let eligible returning Google users sign in automatically. Defaults to false. */
     autoSelect?: boolean;
@@ -924,4 +924,24 @@ type GoogleOneTapProps = {
 /** Invisible, server-configured Google One Tap conversion helper. */
 declare function GoogleOneTap({ disabled, nonce, autoSelect, cancelOnTapOutside, context, itpSupport, loginHint, hostedDomain, stateCookieDomain, scriptNonce, onSignedIn, onSkipped, onDismissed, onError, }: GoogleOneTapProps): null;
 
-export { type Appearance, AuthLoaded, type AuthLoadedProps, AuthLoading, type AuthLoadingProps, AuthOwlBadge, type AuthOwlBadgeProps, AuthOwlBranding, type AuthOwlBrandingProps, AuthOwlProvider, type AuthOwlProviderProps, type AutofillHost, BackupCodesManager, type BackupCodesManagerProps, Bidi, type ConfigState, ConsentDocLinks, type ConsentDocLinksProps, ConsentGate, type ConsentGateProps, CreateOrganization, type CreateOrganizationProps, DEFAULT_BRAND_COLOR, EmailOtpForm, type EmailOtpFormProps, ForgotPassword, type ForgotPasswordProps, GoogleOneTap, type GoogleOneTapDismissReason, type GoogleOneTapError, type GoogleOneTapErrorCode, type GoogleOneTapProps, type GoogleOneTapSkipReason, InvitationPrompt, type InvitationPromptStatus, KNOWN_METHODS, type KnownMethod, MFAChallenge, type MFAChallengeProps, MFAEnrollment, type MFAEnrollmentProps, MFARequiredGate, type MFARequiredGateProps, MagicLinkForm, type MagicLinkFormProps, OrganizationList, type OrganizationListProps, OrganizationProfile, type OrganizationProfileProps, type OrganizationProfileSection, OrganizationSwitcher, type OrganizationSwitcherProps, PasskeyButton, type PasskeyButtonProps, PasskeyManager, type PasskeyManagerProps, PhoneOTP, type PhoneOTPProps, Protect, type ProtectProps, ResetPassword, type ResetPasswordProps, SignIn, type SignInPlan, type SignInProps, SignOutButton, type SignOutButtonProps, SignUp, type SignUpProps, SignedIn, type SignedInProps, SignedOut, type SignedOutProps, SocialButtons, type SocialButtonsProps, Spinner, type UseAccountResult, type UseAuthResult, type UseConsentResult, type UseEmailVerificationResult, type UseMFAResult, type UseOrganizationInvitationResult, type UseOrganizationResult, type UsePasskeysResult, type UsePasswordResetResult, type UsePublicConfigResult, type UseSignInResult, type UseSignOutResult, type UseSignUpResult, type UseUserResult, type UseWaitlistResult, UserButton, UserProfile, type UserProfileProps, type UserProfileSection, VerificationPending, type VerificationPendingProps, VerifyEmail, type VerifyEmailProps, Waitlist, type WaitlistProps, emailAutocomplete, resolveSignInMethods, useAccount, useAuth, useAuthClient, useAuthOwlContext, useConsent, useEmailVerification, useInvitationRecipientHint, useLocale, useMFA, useOrganization, useOrganizationInvitation, usePasskeys, usePasswordReset, usePublicConfig, useSession, useSignIn, useSignOut, useSignUp, useUser, useWaitlist };
+/**
+ * Which sign-in method last worked in this browser, for this project.
+ *
+ * Two kinds of method need different treatment, and conflating them is the bug
+ * this shape exists to avoid:
+ *
+ *   completes in page   password, email-OTP verification, passkey - observable
+ *                       success, so it is recorded when it happens.
+ *
+ *   leaves the page     social, SSO, magic link - the page that would observe
+ *                       success is one the browser navigates away from. The
+ *                       attempt is PARKED and promoted only when a session
+ *                       actually appears, so bouncing off a consent screen does
+ *                       not teach the form that the provider worked.
+ *
+ * Everything is per project and per browser, and never keyed by an identifier -
+ * see the core module for why that line matters.
+ */
+declare function useLastUsedSignInMethod(): LastUsedSignInMethod | null;
+
+export { type Appearance, AuthLoaded, type AuthLoadedProps, AuthLoading, type AuthLoadingProps, AuthOwlBadge, type AuthOwlBadgeProps, AuthOwlBranding, type AuthOwlBrandingProps, AuthOwlProvider, type AuthOwlProviderProps, type AutofillHost, BackupCodesManager, type BackupCodesManagerProps, Bidi, type ConfigState, ConsentDocLinks, type ConsentDocLinksProps, ConsentGate, type ConsentGateProps, CreateOrganization, type CreateOrganizationProps, DEFAULT_BRAND_COLOR, EmailOtpForm, type EmailOtpFormProps, ForgotPassword, type ForgotPasswordProps, GoogleOneTap, type GoogleOneTapDismissReason, type GoogleOneTapError, type GoogleOneTapErrorCode, type GoogleOneTapProps, type GoogleOneTapSkipReason, InvitationPrompt, type InvitationPromptStatus, KNOWN_METHODS, type KnownMethod, MFAChallenge, type MFAChallengeProps, MFAEnrollment, type MFAEnrollmentProps, MFARequiredGate, type MFARequiredGateProps, MagicLinkForm, type MagicLinkFormProps, OrganizationList, type OrganizationListProps, OrganizationProfile, type OrganizationProfileProps, type OrganizationProfileSection, OrganizationSwitcher, type OrganizationSwitcherProps, PasskeyButton, type PasskeyButtonProps, PasskeyManager, type PasskeyManagerProps, PhoneOTP, type PhoneOTPProps, Protect, type ProtectProps, ResetPassword, type ResetPasswordProps, SignIn, type SignInPlan, type SignInProps, SignOutButton, type SignOutButtonProps, SignUp, type SignUpProps, SignedIn, type SignedInProps, SignedOut, type SignedOutProps, SocialButtons, type SocialButtonsProps, Spinner, type UseAccountResult, type UseAuthResult, type UseConsentResult, type UseEmailVerificationResult, type UseMFAResult, type UseOrganizationInvitationResult, type UseOrganizationResult, type UsePasskeysResult, type UsePasswordResetResult, type UsePublicConfigResult, type UseSignInResult, type UseSignOutResult, type UseSignUpResult, type UseUserResult, type UseWaitlistResult, UserButton, UserProfile, type UserProfileProps, type UserProfileSection, VerificationPending, type VerificationPendingProps, VerifyEmail, type VerifyEmailProps, Waitlist, type WaitlistProps, emailAutocomplete, resolveSignInMethods, useAccount, useAuth, useAuthClient, useAuthOwlContext, useConsent, useEmailVerification, useInvitationRecipientHint, useLastUsedSignInMethod, useLocale, useMFA, useOrganization, useOrganizationInvitation, usePasskeys, usePasswordReset, usePublicConfig, useSession, useSignIn, useSignOut, useSignUp, useUser, useWaitlist };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as React from 'react';
-import { AuthConfig, Locale, AuthOwlClient, PublicConfig, ConsentStatus, OrganizationInvitationDetails, OrganizationDetails, OrganizationMembership, HasParams, AuthUser, AuthClientError, InvitationRecipientHint, SessionState, Organization, AuthOwlErrorCode } from '@authowl/core';
+import { AuthConfig, Locale, AuthOwlClient, PublicConfig, ConsentStatus, OrganizationInvitationDetails, OrganizationDetails, OrganizationMembership, HasParams, AuthUser, AuthClientError, InvitationRecipientHint, SessionState, Organization, AuthOwlErrorCode, LastUsedSignInMethod } from '@authowl/core';
 export { AuthOwlError, AuthPasskey, ConsentStatus, HasParams, InvalidKeyError, Organization, OrganizationDetails, OrganizationInvitation, OrganizationMember, OrganizationMemberWithUser, OrganizationMembership, OrganizationRoleSummary, OrganizationTeam, OrganizationTeamMember, OrganizationUserInvitation, PublicConfig, RateLimitedError, createMembershipHas, membershipHas, membershipHasPermission, membershipHasTeam } from '@authowl/core';
 
 type Appearance = {
@@ -901,7 +901,7 @@ type GoogleOneTapError = {
 type GoogleOneTapProps = {
     /** Disable prompting without unmounting the component. */
     disabled?: boolean;
-    /** Bind Google's ID token to this browser attempt. Generate a fresh random value server-side. */
+    /** Ask Google to include this nonce and verify the returned token carries the same value. */
     nonce?: string;
     /** Let eligible returning Google users sign in automatically. Defaults to false. */
     autoSelect?: boolean;
@@ -924,4 +924,24 @@ type GoogleOneTapProps = {
 /** Invisible, server-configured Google One Tap conversion helper. */
 declare function GoogleOneTap({ disabled, nonce, autoSelect, cancelOnTapOutside, context, itpSupport, loginHint, hostedDomain, stateCookieDomain, scriptNonce, onSignedIn, onSkipped, onDismissed, onError, }: GoogleOneTapProps): null;
 
-export { type Appearance, AuthLoaded, type AuthLoadedProps, AuthLoading, type AuthLoadingProps, AuthOwlBadge, type AuthOwlBadgeProps, AuthOwlBranding, type AuthOwlBrandingProps, AuthOwlProvider, type AuthOwlProviderProps, type AutofillHost, BackupCodesManager, type BackupCodesManagerProps, Bidi, type ConfigState, ConsentDocLinks, type ConsentDocLinksProps, ConsentGate, type ConsentGateProps, CreateOrganization, type CreateOrganizationProps, DEFAULT_BRAND_COLOR, EmailOtpForm, type EmailOtpFormProps, ForgotPassword, type ForgotPasswordProps, GoogleOneTap, type GoogleOneTapDismissReason, type GoogleOneTapError, type GoogleOneTapErrorCode, type GoogleOneTapProps, type GoogleOneTapSkipReason, InvitationPrompt, type InvitationPromptStatus, KNOWN_METHODS, type KnownMethod, MFAChallenge, type MFAChallengeProps, MFAEnrollment, type MFAEnrollmentProps, MFARequiredGate, type MFARequiredGateProps, MagicLinkForm, type MagicLinkFormProps, OrganizationList, type OrganizationListProps, OrganizationProfile, type OrganizationProfileProps, type OrganizationProfileSection, OrganizationSwitcher, type OrganizationSwitcherProps, PasskeyButton, type PasskeyButtonProps, PasskeyManager, type PasskeyManagerProps, PhoneOTP, type PhoneOTPProps, Protect, type ProtectProps, ResetPassword, type ResetPasswordProps, SignIn, type SignInPlan, type SignInProps, SignOutButton, type SignOutButtonProps, SignUp, type SignUpProps, SignedIn, type SignedInProps, SignedOut, type SignedOutProps, SocialButtons, type SocialButtonsProps, Spinner, type UseAccountResult, type UseAuthResult, type UseConsentResult, type UseEmailVerificationResult, type UseMFAResult, type UseOrganizationInvitationResult, type UseOrganizationResult, type UsePasskeysResult, type UsePasswordResetResult, type UsePublicConfigResult, type UseSignInResult, type UseSignOutResult, type UseSignUpResult, type UseUserResult, type UseWaitlistResult, UserButton, UserProfile, type UserProfileProps, type UserProfileSection, VerificationPending, type VerificationPendingProps, VerifyEmail, type VerifyEmailProps, Waitlist, type WaitlistProps, emailAutocomplete, resolveSignInMethods, useAccount, useAuth, useAuthClient, useAuthOwlContext, useConsent, useEmailVerification, useInvitationRecipientHint, useLocale, useMFA, useOrganization, useOrganizationInvitation, usePasskeys, usePasswordReset, usePublicConfig, useSession, useSignIn, useSignOut, useSignUp, useUser, useWaitlist };
+/**
+ * Which sign-in method last worked in this browser, for this project.
+ *
+ * Two kinds of method need different treatment, and conflating them is the bug
+ * this shape exists to avoid:
+ *
+ *   completes in page   password, email-OTP verification, passkey - observable
+ *                       success, so it is recorded when it happens.
+ *
+ *   leaves the page     social, SSO, magic link - the page that would observe
+ *                       success is one the browser navigates away from. The
+ *                       attempt is PARKED and promoted only when a session
+ *                       actually appears, so bouncing off a consent screen does
+ *                       not teach the form that the provider worked.
+ *
+ * Everything is per project and per browser, and never keyed by an identifier -
+ * see the core module for why that line matters.
+ */
+declare function useLastUsedSignInMethod(): LastUsedSignInMethod | null;
+
+export { type Appearance, AuthLoaded, type AuthLoadedProps, AuthLoading, type AuthLoadingProps, AuthOwlBadge, type AuthOwlBadgeProps, AuthOwlBranding, type AuthOwlBrandingProps, AuthOwlProvider, type AuthOwlProviderProps, type AutofillHost, BackupCodesManager, type BackupCodesManagerProps, Bidi, type ConfigState, ConsentDocLinks, type ConsentDocLinksProps, ConsentGate, type ConsentGateProps, CreateOrganization, type CreateOrganizationProps, DEFAULT_BRAND_COLOR, EmailOtpForm, type EmailOtpFormProps, ForgotPassword, type ForgotPasswordProps, GoogleOneTap, type GoogleOneTapDismissReason, type GoogleOneTapError, type GoogleOneTapErrorCode, type GoogleOneTapProps, type GoogleOneTapSkipReason, InvitationPrompt, type InvitationPromptStatus, KNOWN_METHODS, type KnownMethod, MFAChallenge, type MFAChallengeProps, MFAEnrollment, type MFAEnrollmentProps, MFARequiredGate, type MFARequiredGateProps, MagicLinkForm, type MagicLinkFormProps, OrganizationList, type OrganizationListProps, OrganizationProfile, type OrganizationProfileProps, type OrganizationProfileSection, OrganizationSwitcher, type OrganizationSwitcherProps, PasskeyButton, type PasskeyButtonProps, PasskeyManager, type PasskeyManagerProps, PhoneOTP, type PhoneOTPProps, Protect, type ProtectProps, ResetPassword, type ResetPasswordProps, SignIn, type SignInPlan, type SignInProps, SignOutButton, type SignOutButtonProps, SignUp, type SignUpProps, SignedIn, type SignedInProps, SignedOut, type SignedOutProps, SocialButtons, type SocialButtonsProps, Spinner, type UseAccountResult, type UseAuthResult, type UseConsentResult, type UseEmailVerificationResult, type UseMFAResult, type UseOrganizationInvitationResult, type UseOrganizationResult, type UsePasskeysResult, type UsePasswordResetResult, type UsePublicConfigResult, type UseSignInResult, type UseSignOutResult, type UseSignUpResult, type UseUserResult, type UseWaitlistResult, UserButton, UserProfile, type UserProfileProps, type UserProfileSection, VerificationPending, type VerificationPendingProps, VerifyEmail, type VerifyEmailProps, Waitlist, type WaitlistProps, emailAutocomplete, resolveSignInMethods, useAccount, useAuth, useAuthClient, useAuthOwlContext, useConsent, useEmailVerification, useInvitationRecipientHint, useLastUsedSignInMethod, useLocale, useMFA, useOrganization, useOrganizationInvitation, usePasskeys, usePasswordReset, usePublicConfig, useSession, useSignIn, useSignOut, useSignUp, useUser, useWaitlist };

package/dist/index.js

@@ -20,6 +20,7 @@ import {
   useConsent,
   useEmailVerification,
   useInvitationRecipientHint,
+  useLastUsedSignInMethod,
   useLocale,
   useMFA,
   useOrganization,
@@ -31,13 +32,14 @@ import {
   useServerError,
   useSession,
   useSignIn,
+  useSignInMethodRecorder,
   useSignOut,
   useSignUp,
   useSubmitAction,
   useT,
   useUser,
   useWaitlist
-} from "./chunk-PUJV7S6G.js";
+} from "./chunk-E5ZOQHXY.js";
 
 // src/project-capabilities.ts
 import {
@@ -276,6 +278,7 @@ function SocialButtons({ providers, callbackURL }) {
   const t = useT();
   const toServerError = useServerError();
   const { signInSocial } = useSignIn();
+  const recordSignInMethod = useSignInMethodRecorder();
   const [pending, setPending] = React2.useState(null);
   const [error, setError] = React2.useState(null);
   React2.useEffect(() => {
@@ -308,6 +311,8 @@ function SocialButtons({ providers, callbackURL }) {
             if (res?.error) {
               setError(toServerError(res.error, t("social.error.startFailed")));
               setPending(null);
+            } else {
+              recordSignInMethod(`social:${provider}`, true);
             }
           } catch {
             setError(t("social.error.startFailed"));
@@ -1415,6 +1420,15 @@ function SignIn({
   const [challenge, setChallenge] = React13.useState(false);
   const mfaEnrolment = useConfirmedMfaPending("clear");
   const emailRef = React13.useRef(null);
+  const recordSignInMethod = useSignInMethodRecorder();
+  const onPasskeySignedIn = React13.useCallback(() => {
+    recordSignInMethod("passkey");
+    onSignedIn?.();
+  }, [onSignedIn, recordSignInMethod]);
+  const onPhoneOtpSignedIn = React13.useCallback(() => {
+    recordSignInMethod("phone-otp");
+    onSignedIn?.();
+  }, [onSignedIn, recordSignInMethod]);
   const plan = resolveSignInMethods(
     config,
     typeof window === "undefined" ? void 0 : window.location.hostname
@@ -1422,7 +1436,7 @@ function SignIn({
   usePasskeyAutofill({
     enabled: credentialMode === "email" && plan.autofillHost !== null,
     redirectTo,
-    onSignedIn
+    onSignedIn: onPasskeySignedIn
   });
   const badge = /* @__PURE__ */ jsx19(AuthOwlBadge, { force: showBadge });
   const branding = showBranding ? /* @__PURE__ */ jsx19(AuthOwlBranding, {}) : null;
@@ -1474,7 +1488,10 @@ function SignIn({
           error,
           onSubmit: () => void run(() => signInEmailOtp({ email, otp }), {
             failure: t("emailOtp.error.invalidCode"),
-            onSuccess: () => finishSignIn({ sessionStore, redirectTo, onSignedIn })
+            onSuccess: () => {
+              recordSignInMethod("email-otp");
+              finishSignIn({ sessionStore, redirectTo, onSignedIn });
+            }
           }),
           onChangeEmail: () => {
             setOtp("");
@@ -1502,7 +1519,7 @@ function SignIn({
         PhoneOTP,
         {
           redirectTo,
-          onSignedIn,
+          onSignedIn: onPhoneOtpSignedIn,
           onBack: () => setView("sign-in"),
           onMfaPasswordRequired: () => {
             setView("sign-in");
@@ -1530,6 +1547,7 @@ function SignIn({
       failure: t("signIn.error.failed"),
       onSuccess: (res) => {
         const data = res.data;
+        recordSignInMethod(credentialMode === "username" ? "username" : "password");
         if (data && "twoFactorRedirect" in data && data.twoFactorRedirect) {
           setChallenge(true);
         } else {
@@ -1542,7 +1560,10 @@ function SignIn({
     "magic",
     () => void run(() => authChallenge.run(AUTH_CHALLENGE_ACTIONS.passwordless, (options) => signInMagicLink({ email, callbackURL: redirectTo }, options)), {
       failure: t("magicLink.error.sendFailed"),
-      onSuccess: () => setView("magic-sent")
+      onSuccess: () => {
+        recordSignInMethod("magic-link", true);
+        setView("magic-sent");
+      }
     })
   );
   const doRequestOtp = () => start(
@@ -1559,6 +1580,7 @@ function SignIn({
       {
         failure: t("sso.error.startFailed"),
         mapError: (error2) => error2.status === 404 ? t("sso.error.notFound") : null,
+        onSuccess: () => recordSignInMethod("sso", true),
         // SSO always redirects the browser to the IdP; keep the spinner up
         // through that navigation instead of flashing back to idle.
         keepPendingOnSuccess: true
@@ -1697,7 +1719,7 @@ function SignIn({
         ]
       }
     ),
-    plan.passkey && /* @__PURE__ */ jsx19(PasskeyButton, { redirectTo, onSignedIn }),
+    plan.passkey && /* @__PURE__ */ jsx19(PasskeyButton, { redirectTo, onSignedIn: onPasskeySignedIn }),
     plan.phoneOtp && /* @__PURE__ */ jsx19(
       "button",
       {
@@ -4433,7 +4455,7 @@ var SECTION_KEYS2 = {
   invitations: "organization.profile.nav.invitations",
   danger: "organization.profile.nav.danger"
 };
-var TeamsSection = React44.lazy(() => import("./TeamsSection-ZQDNMWV3.js"));
+var TeamsSection = React44.lazy(() => import("./TeamsSection-NV64O5I4.js"));
 function OrganizationProfile({ organizationId, defaultSection = "general", onDeleted, onLeft } = {}) {
   const t = useT();
   const toServerError = useServerError();
@@ -5000,6 +5022,14 @@ function normalizeDismissReason(reason) {
   }
   return "unknown";
 }
+var warnedMissingNonce = /* @__PURE__ */ new Set();
+function warnOneTapWithoutNonce(clientId) {
+  if (warnedMissingNonce.has(clientId)) return;
+  warnedMissingNonce.add(clientId);
+  console.warn(
+    "[AuthOwl] <GoogleOneTap/> is running without a `nonce`. Google\u2019s ID token is then not bound to a value chosen for this prompt. Generate a fresh random value per prompt and pass it as `nonce`; AuthOwl forwards it to Google and verifies the match. The direct browser exchange does not keep separate one-time server state, so do not treat this prop by itself as replay protection. (This warning is dev-only.)"
+  );
+}
 function GoogleOneTap({
   disabled = false,
   nonce,
@@ -5023,6 +5053,11 @@ function GoogleOneTap({
   callbacks.current = { onSignedIn, onSkipped, onDismissed, onError };
   const googleEnabled = config?.socialProviders.includes("google") === true;
   const clientId = config?.socialProviderClientIds?.google;
+  React47.useEffect(() => {
+    if (process.env.NODE_ENV === "production") return;
+    if (disabled || !googleEnabled || !clientId || nonce) return;
+    warnOneTapWithoutNonce(clientId);
+  }, [clientId, disabled, googleEnabled, nonce]);
   React47.useEffect(() => {
     if (configLoading || !sessionLoaded) return;
     if (disabled) {
@@ -5198,6 +5233,7 @@ export {
   useConsent,
   useEmailVerification,
   useInvitationRecipientHint,
+  useLastUsedSignInMethod,
   useLocale,
   useMFA,
   useOrganization,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authowl/react",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "React provider, hooks, and drop-in components for AuthOwl, the multi-tenant auth SaaS.",
   "license": "MIT",
   "publishConfig": {
@@ -47,7 +47,7 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@authowl/core": "0.19.0"
+    "@authowl/core": "0.20.0"
   },
   "peerDependencies": {
     "react": ">=18",