@authowl/react 0.25.2 → 0.25.3

package/dist/index.cjs

@@ -4649,26 +4649,32 @@ var KNOWN_METHODS = [
 function emailAutocomplete(isPasskeyHost) {
   return isPasskeyHost ? "email webauthn" : "email";
 }
-function passkeyReachableFrom(authBaseUrl, pageHost, relyingPartyId) {
-  if (pageHost === void 0) return true;
-  let rpId = relyingPartyId ?? void 0;
-  if (!rpId) {
-    if (!authBaseUrl) return true;
-    try {
-      rpId = new URL(authBaseUrl).hostname;
-    } catch {
-      return true;
-    }
+function hostCoveredByRelyingParty(pageHost, rpId) {
+  const host = pageHost.toLowerCase();
+  const id = rpId.toLowerCase();
+  if (id !== "localhost" && !id.includes(".")) return false;
+  return host === id || host.endsWith(`.${id}`);
+}
+function resolveRelyingPartyId(authBaseUrl, relyingPartyId) {
+  if (relyingPartyId) return relyingPartyId;
+  if (!authBaseUrl) return void 0;
+  try {
+    return new URL(authBaseUrl).hostname || void 0;
+  } catch {
+    return void 0;
   }
-  if (rpId !== "localhost" && !rpId.includes(".")) return false;
-  return pageHost === rpId || pageHost.endsWith(`.${rpId}`);
 }
-function passkeyReachableForConfig(config, pageHost) {
-  return passkeyReachableFrom(
+function passkeyBlockingDomain(config, pageHost) {
+  if (pageHost === void 0) return void 0;
+  const rpId = resolveRelyingPartyId(
     config?.authBaseUrl,
-    pageHost,
     config?.authentication?.passkey?.relyingPartyId
   );
+  if (rpId === void 0) return void 0;
+  return hostCoveredByRelyingParty(pageHost, rpId) ? void 0 : rpId;
+}
+function passkeyReachableForConfig(config, pageHost) {
+  return passkeyBlockingDomain(config, pageHost) === void 0;
 }
 function resolveSignInMethods(config, pageHost) {
   const methods = config?.enabledMethods ?? ["password"];
@@ -4713,6 +4719,11 @@ var React20 = __toESM(require("react"), 1);
 init_hooks();
 init_i18n();
 
+// src/components/page-host.ts
+function currentPageHost() {
+  return typeof window === "undefined" ? void 0 : window.location.hostname;
+}
+
 // src/components/redirect.ts
 function isSafeRedirect(redirectTo, origin) {
   try {
@@ -4950,6 +4961,10 @@ function PasskeyButton({ redirectTo, onSignedIn }) {
   const { sessionStore } = useAuthClient();
   const { signInPasskey } = useSignIn();
   const { pending, error, run } = useSubmitAction();
+  const { config, isLoading: configLoading, isError: configError } = usePublicConfig();
+  const configPending = configLoading || config === null && !configError;
+  const blocked = passkeyBlockingDomain(config, currentPageHost()) !== void 0;
+  if (configPending || blocked) return null;
   return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("div", { className: "ba-fields", children: [
     /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
       "button",
@@ -6103,10 +6118,7 @@ function SignIn({
     recordSignInMethod("phone-otp");
     onSignedIn?.();
   }, [onSignedIn, recordSignInMethod]);
-  const plan = resolveSignInMethods(
-    config,
-    typeof window === "undefined" ? void 0 : window.location.hostname
-  );
+  const plan = resolveSignInMethods(config, currentPageHost());
   usePasskeyAutofill({
     enabled: credentialMode === "email" && plan.autofillHost !== null,
     redirectTo,
@@ -7625,6 +7637,9 @@ function PasskeyManagerBody({
   const api = usePasskeys();
   const apiRef = React31.useRef(api);
   apiRef.current = api;
+  const { config, isLoading: configLoading, isError: configError } = usePublicConfig();
+  const blockedBy = passkeyBlockingDomain(config, currentPageHost());
+  const configPending = configLoading || config === null && !configError;
   const { pending, error, setError, run } = useSubmitAction();
   const [passkeys, setPasskeys] = React31.useState(null);
   const loadTokenRef = React31.useRef(0);
@@ -7697,7 +7712,12 @@ function PasskeyManagerBody({
       /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(FormError, { children: error }),
       passkeys === null && /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("button", { className: "ba-link-button", type: "button", onClick: () => void load(), children: t("userProfile.retry") })
     ] }),
-    passkeys !== null && allowAdd && /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(
+    passkeys !== null && allowAdd && !configPending && (blockedBy !== void 0 ? (
+      // The add button is HIDDEN, not disabled, and the list stays: a user
+      // may hold passkeys enrolled on the relying-party origin and must
+      // still be able to rename or remove them from here.
+      /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("p", { className: "ba-muted", "data-testid": "passkey-add-elsewhere", children: t("passkeys.addElsewhere", { domain: blockedBy }) })
+    ) : /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(
       "button",
       {
         className: "ba-button",
@@ -7710,7 +7730,7 @@ function PasskeyManagerBody({
         }),
         children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Busy, { busy: pending, label: t("common.working"), children: t("passkeys.add") })
       }
-    )
+    ))
   ] });
 }
 
@@ -7729,7 +7749,7 @@ function usePasskeyOffer() {
   const api = React32.useRef(listPasskeys);
   api.current = listPasskeys;
   const projectId = config?.environmentId ?? null;
-  const eligible = projectId !== null && isSignedIn && (0, import_core4.resolveProjectCapabilities)(config).passkeyAdd && typeof window !== "undefined" && "PublicKeyCredential" in window && passkeyReachableForConfig(config, window.location.hostname);
+  const eligible = projectId !== null && isSignedIn && (0, import_core4.resolveProjectCapabilities)(config).passkeyAdd && typeof window !== "undefined" && "PublicKeyCredential" in window && passkeyReachableForConfig(config, currentPageHost());
   const userId = user?.id ?? null;
   const sessionId = sessionData?.session?.id ?? null;
   const subject = React32.useMemo(

package/dist/index.d.cts

@@ -372,6 +372,11 @@ type SignInPlan = {
  * passkeys inline. One place owns the token string.
  */
 declare function emailAutocomplete(isPasskeyHost: boolean): string;
+/**
+ * Resolve the sign-in surfaces from a project's public config. A null config
+ * gets a structural password default for callers that resolve before the fetch
+ * settles; the drop-in components fail closed when the fetch itself errors.
+ */
 declare function resolveSignInMethods(config: PublicConfig | null, 
 /** The hostname the form is rendering on; omit when it is not knowable. */
 pageHost?: string): SignInPlan;
@@ -581,7 +586,7 @@ type PasskeyButtonProps = {
  * click. Complements the inline conditional-mediation autofill armed by
  * <SignIn/> - the button always works even where autofill is unavailable.
  */
-declare function PasskeyButton({ redirectTo, onSignedIn }: PasskeyButtonProps): React.JSX.Element;
+declare function PasskeyButton({ redirectTo, onSignedIn }: PasskeyButtonProps): React.JSX.Element | null;
 
 type ForgotPasswordProps = {
     /**

package/dist/index.d.ts

@@ -372,6 +372,11 @@ type SignInPlan = {
  * passkeys inline. One place owns the token string.
  */
 declare function emailAutocomplete(isPasskeyHost: boolean): string;
+/**
+ * Resolve the sign-in surfaces from a project's public config. A null config
+ * gets a structural password default for callers that resolve before the fetch
+ * settles; the drop-in components fail closed when the fetch itself errors.
+ */
 declare function resolveSignInMethods(config: PublicConfig | null, 
 /** The hostname the form is rendering on; omit when it is not knowable. */
 pageHost?: string): SignInPlan;
@@ -581,7 +586,7 @@ type PasskeyButtonProps = {
  * click. Complements the inline conditional-mediation autofill armed by
  * <SignIn/> - the button always works even where autofill is unavailable.
  */
-declare function PasskeyButton({ redirectTo, onSignedIn }: PasskeyButtonProps): React.JSX.Element;
+declare function PasskeyButton({ redirectTo, onSignedIn }: PasskeyButtonProps): React.JSX.Element | null;
 
 type ForgotPasswordProps = {
     /**

package/dist/index.js

@@ -60,26 +60,32 @@ var KNOWN_METHODS = [
 function emailAutocomplete(isPasskeyHost) {
   return isPasskeyHost ? "email webauthn" : "email";
 }
-function passkeyReachableFrom(authBaseUrl, pageHost, relyingPartyId) {
-  if (pageHost === void 0) return true;
-  let rpId = relyingPartyId ?? void 0;
-  if (!rpId) {
-    if (!authBaseUrl) return true;
-    try {
-      rpId = new URL(authBaseUrl).hostname;
-    } catch {
-      return true;
-    }
+function hostCoveredByRelyingParty(pageHost, rpId) {
+  const host = pageHost.toLowerCase();
+  const id = rpId.toLowerCase();
+  if (id !== "localhost" && !id.includes(".")) return false;
+  return host === id || host.endsWith(`.${id}`);
+}
+function resolveRelyingPartyId(authBaseUrl, relyingPartyId) {
+  if (relyingPartyId) return relyingPartyId;
+  if (!authBaseUrl) return void 0;
+  try {
+    return new URL(authBaseUrl).hostname || void 0;
+  } catch {
+    return void 0;
   }
-  if (rpId !== "localhost" && !rpId.includes(".")) return false;
-  return pageHost === rpId || pageHost.endsWith(`.${rpId}`);
 }
-function passkeyReachableForConfig(config, pageHost) {
-  return passkeyReachableFrom(
+function passkeyBlockingDomain(config, pageHost) {
+  if (pageHost === void 0) return void 0;
+  const rpId = resolveRelyingPartyId(
     config?.authBaseUrl,
-    pageHost,
     config?.authentication?.passkey?.relyingPartyId
   );
+  if (rpId === void 0) return void 0;
+  return hostCoveredByRelyingParty(pageHost, rpId) ? void 0 : rpId;
+}
+function passkeyReachableForConfig(config, pageHost) {
+  return passkeyBlockingDomain(config, pageHost) === void 0;
 }
 function resolveSignInMethods(config, pageHost) {
   const methods = config?.enabledMethods ?? ["password"];
@@ -122,6 +128,11 @@ function resolveSignInMethods(config, pageHost) {
 // src/components/SignIn.tsx
 import * as React13 from "react";
 
+// src/components/page-host.ts
+function currentPageHost() {
+  return typeof window === "undefined" ? void 0 : window.location.hostname;
+}
+
 // src/components/redirect.ts
 function isSafeRedirect(redirectTo, origin) {
   try {
@@ -342,6 +353,10 @@ function PasskeyButton({ redirectTo, onSignedIn }) {
   const { sessionStore } = useAuthClient();
   const { signInPasskey } = useSignIn();
   const { pending, error, run } = useSubmitAction();
+  const { config, isLoading: configLoading, isError: configError } = usePublicConfig();
+  const configPending = configLoading || config === null && !configError;
+  const blocked = passkeyBlockingDomain(config, currentPageHost()) !== void 0;
+  if (configPending || blocked) return null;
   return /* @__PURE__ */ jsxs3("div", { className: "ba-fields", children: [
     /* @__PURE__ */ jsx3(
       "button",
@@ -1452,10 +1467,7 @@ function SignIn({
     recordSignInMethod("phone-otp");
     onSignedIn?.();
   }, [onSignedIn, recordSignInMethod]);
-  const plan = resolveSignInMethods(
-    config,
-    typeof window === "undefined" ? void 0 : window.location.hostname
-  );
+  const plan = resolveSignInMethods(config, currentPageHost());
   usePasskeyAutofill({
     enabled: credentialMode === "email" && plan.autofillHost !== null,
     redirectTo,
@@ -2912,6 +2924,9 @@ function PasskeyManagerBody({
   const api = usePasskeys();
   const apiRef = React24.useRef(api);
   apiRef.current = api;
+  const { config, isLoading: configLoading, isError: configError } = usePublicConfig();
+  const blockedBy = passkeyBlockingDomain(config, currentPageHost());
+  const configPending = configLoading || config === null && !configError;
   const { pending, error, setError, run } = useSubmitAction();
   const [passkeys, setPasskeys] = React24.useState(null);
   const loadTokenRef = React24.useRef(0);
@@ -2984,7 +2999,12 @@ function PasskeyManagerBody({
       /* @__PURE__ */ jsx33(FormError, { children: error }),
       passkeys === null && /* @__PURE__ */ jsx33("button", { className: "ba-link-button", type: "button", onClick: () => void load(), children: t("userProfile.retry") })
     ] }),
-    passkeys !== null && allowAdd && /* @__PURE__ */ jsx33(
+    passkeys !== null && allowAdd && !configPending && (blockedBy !== void 0 ? (
+      // The add button is HIDDEN, not disabled, and the list stays: a user
+      // may hold passkeys enrolled on the relying-party origin and must
+      // still be able to rename or remove them from here.
+      /* @__PURE__ */ jsx33("p", { className: "ba-muted", "data-testid": "passkey-add-elsewhere", children: t("passkeys.addElsewhere", { domain: blockedBy }) })
+    ) : /* @__PURE__ */ jsx33(
       "button",
       {
         className: "ba-button",
@@ -2997,7 +3017,7 @@ function PasskeyManagerBody({
         }),
         children: /* @__PURE__ */ jsx33(Busy, { busy: pending, label: t("common.working"), children: t("passkeys.add") })
       }
-    )
+    ))
   ] });
 }
 
@@ -3019,7 +3039,7 @@ function usePasskeyOffer() {
   const api = React25.useRef(listPasskeys);
   api.current = listPasskeys;
   const projectId = config?.environmentId ?? null;
-  const eligible = projectId !== null && isSignedIn && resolveProjectCapabilities(config).passkeyAdd && typeof window !== "undefined" && "PublicKeyCredential" in window && passkeyReachableForConfig(config, window.location.hostname);
+  const eligible = projectId !== null && isSignedIn && resolveProjectCapabilities(config).passkeyAdd && typeof window !== "undefined" && "PublicKeyCredential" in window && passkeyReachableForConfig(config, currentPageHost());
   const userId = user?.id ?? null;
   const sessionId = sessionData?.session?.id ?? null;
   const subject = React25.useMemo(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authowl/react",
-  "version": "0.25.2",
+  "version": "0.25.3",
   "description": "React provider, hooks, and drop-in components for AuthOwl, the multi-tenant auth SaaS.",
   "license": "MIT",
   "publishConfig": {
@@ -47,7 +47,7 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@authowl/core": "0.24.1"
+    "@authowl/core": "0.24.2"
   },
   "peerDependencies": {
     "react": ">=18",
@@ -56,7 +56,7 @@
   "devDependencies": {
     "@testing-library/react": "16.3.2",
     "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
+    "@types/react-dom": "^19.2.5",
     "jsdom": "26.1.0",
     "qrcode-generator": "^2.0.4",
     "react": "^19.2.8",