@authu/react 1.0.65 → 1.0.67

package/README.md

@@ -128,6 +128,79 @@ function ApiComponent() {
 }
 ```
 
+### 5. Sign In Another Device with a QR Code
+
+`DeviceLinkQrCode` shows a QR code that signs the scanning phone into the
+current account, with no password:
+
+```tsx
+import {DeviceLinkQrCode} from '@authu/react';
+
+function OpenOnMobile() {
+  return <DeviceLinkQrCode size={220} />;
+}
+```
+
+The code encodes a one-shot AuthU link that expires after two minutes, and the
+component renews it on its own while mounted. Opening the link gives the phone
+its own AuthU session cookie, then redirects to the tenant `homeUrl`, where the
+silent renewal signs the app in. Since anyone photographing the screen within
+that window gets the session, only mount the component when the user asks for
+it.
+
+For a custom rendering, `useDeviceLink()` returns `{link, isLoading, error,
+renew}` with the same auto-renewal, and `createDeviceLink()` on `useAuthU()`
+creates a single link.
+
+## Token Storage
+
+**Tokens never touch `localStorage`, `sessionStorage` or any other persistent
+store.** The access token and the refresh token live in memory for the lifetime
+of the page: an XSS on the host application can still act as the user while the
+page is open, but it can no longer walk away with a 30-day refresh token and
+replay it from anywhere, later.
+
+The trade-off is that a reload loses the tokens. The session itself is not
+lost, though: it lives in AuthU's own cookie, and the SDK re-derives the tokens
+from it on every page load with one silent round trip.
+
+### Silent renewal (`prompt=none`)
+
+On mount, when no code is coming back in the URL, the SDK redirects to
+`/authorize?prompt=none`. AuthU answers without ever showing a page:
+
+- session cookie still valid → it redirects straight back with a fresh
+  authorization code, which the SDK exchanges for tokens. The visitor sees a
+  single redirect and stays signed in.
+- no session → it redirects back with `error=login_required`. The SDK reads
+  that as "anonymous", renders accordingly, and records the attempt in
+  `sessionStorage` so the tab never loops through AuthU again.
+
+The URL the visitor asked for is saved before the round trip and restored
+afterwards, so landing on `redirectUri` is invisible.
+
+Set `silentAuth: false` to opt out. The session then does not survive a reload
+at all: every load starts signed out until `login()` is called.
+
+### Logging out
+
+`logout()` now navigates to AuthU's `/logout` rather than only clearing memory.
+It has to: the session lives in the AuthU cookie, so a purely local logout
+would let the next silent renewal sign the visitor right back in. The browser
+returns to `redirectUri`, or to `options.returnTo` when given - which must be a
+URI registered for the tenant, or on the tenant's home origin, otherwise AuthU
+falls back to its own host.
+
+### Upgrading from 1.0.x
+
+Two behaviour changes to expect in an app that upgrades:
+
+- any token left in `localStorage` under `authu_tokens` by a previous version
+  is deleted on the first load;
+- `logout()` performs a full navigation. Code that expected it to be
+  synchronous and stay on the page must move whatever it did afterwards into
+  `options.returnTo`.
+
 ## API Reference
 
 ### AuthUProvider Props
@@ -139,6 +212,7 @@ function ApiComponent() {
 | `redirectUri` | `string` | Yes | Callback URL after login |
 | `scope` | `string` | No | OAuth2 scopes (default: `openid profile email`) |
 | `audience` | `string` | No | API audience for access tokens |
+| `silentAuth` | `boolean` | No | Silent session renewal (default: `true`, see below) |
 
 ### useAuthU Returns
 
@@ -151,6 +225,7 @@ function ApiComponent() {
 | `login(options?)` | `function` | Redirect to login |
 | `logout(options?)` | `function` | Log out user |
 | `getAccessToken()` | `function` | Get current access token |
+| `createDeviceLink()` | `function` | One-shot sign-in link for another device (`{url, expiresAt} \| null`) |
 
 ## Development
 

package/dist/AuthUProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthUProvider.d.ts","sourceRoot":"","sources":["../src/AuthUProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAIf,MAAM,OAAO,CAAC;AAef,OAAO,KAAK,EAEV,WAAW,EACX,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,YAAY,mDAAgD,CAAC;AAO1E,UAAU,kBAAkB;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAID,wBAAgB,aAAa,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAC,EAAE,kBAAkB,2CAqcnE"}
+{"version":3,"file":"AuthUProvider.d.ts","sourceRoot":"","sources":["../src/AuthUProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAKf,MAAM,OAAO,CAAC;AAef,OAAO,KAAK,EAEV,WAAW,EACX,iBAAiB,EAKlB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,YAAY,mDAAgD,CAAC;AAO1E,UAAU,kBAAkB;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAuDD,wBAAgB,aAAa,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAC,EAAE,kBAAkB,2CA6ZnE"}

package/dist/AuthUProvider.js

@@ -1,23 +1,77 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { createContext, useCallback, useEffect, useState } from 'react';
+import { createContext, useCallback, useEffect, useRef, useState } from 'react';
 import { clearCodeVerifier, clearNonce, clearState, generateCodeChallenge, generateCodeVerifier, generateNonce, generateState, getCodeVerifier, getStoredState, storeCodeVerifier, storeNonce, storeState } from './pkce.js';
 export const AuthUContext = createContext(null);
 function buildBaseUrl(domain) {
     const protocol = domain.startsWith('localhost') ? 'http' : 'https';
     return `${protocol}://${domain}`;
 }
-const TOKEN_STORAGE_KEY = 'authu_tokens';
+/**
+ * Tokens are never written to disk. Up to 1.0.x they lived in localStorage
+ * under this key, where any XSS on the host app could read them and replay a
+ * 30-day refresh token from anywhere; the key is only kept here so an app
+ * upgrading to this version wipes what the previous one left behind.
+ */
+const LEGACY_TOKEN_STORAGE_KEY = 'authu_tokens';
+/**
+ * Holding the tokens in memory means a reload loses them, so the session is
+ * re-derived from the AuthU session cookie instead: one `prompt=none` round
+ * trip through /authorize, which returns a fresh code without showing a page
+ * when the cookie is still valid, and `error=login_required` when it is not.
+ * The attempt is recorded per tab so a signed-out visitor bounces once and
+ * then renders anonymously rather than looping through AuthU forever.
+ */
+const SILENT_ATTEMPT_KEY = 'authu_silent_attempted';
+const RETURN_TO_KEY = 'authu_return_to';
+const EMPTY_STATE = {
+    isLoading: false,
+    isAuthenticated: false,
+    user: null,
+    accessToken: null,
+    refreshToken: null,
+    expiresAt: null,
+    error: null
+};
+function currentLocation() {
+    return `${window.location.pathname}${window.location.search}${window.location.hash}`;
+}
+/**
+ * Only a same-origin path is ever restored: `//evil.example` is a valid
+ * relative URL for the browser but a different origin, so a poisoned entry
+ * cannot turn the silent round trip into an open redirect.
+ */
+function readReturnTo() {
+    const stored = sessionStorage.getItem(RETURN_TO_KEY);
+    sessionStorage.removeItem(RETURN_TO_KEY);
+    if (!stored || !stored.startsWith('/') || stored.startsWith('//')) {
+        return null;
+    }
+    return stored;
+}
 export function AuthUProvider({ config, children }) {
     const [state, setState] = useState({
-        isLoading: true,
-        isAuthenticated: false,
-        user: null,
-        accessToken: null,
-        refreshToken: null,
-        expiresAt: null,
-        error: null
+        ...EMPTY_STATE,
+        isLoading: true
     });
-    const getAuthorizationUrl = useCallback(async (options) => {
+    // The tokens also live in a ref so getAccessToken() and refreshTokens() read
+    // the current pair rather than the one captured when the callback was built:
+    // two concurrent API calls racing on an expiring token would otherwise both
+    // rotate the refresh token, and the loser is now treated as a replay.
+    const tokensRef = useRef(null);
+    const refreshInFlight = useRef(null);
+    const setTokens = useCallback((tokens, user) => {
+        tokensRef.current = tokens;
+        setState(prev => ({
+            isLoading: false,
+            isAuthenticated: tokens !== null,
+            user: tokens === null ? null : user !== undefined ? user : prev.user,
+            accessToken: tokens?.accessToken ?? null,
+            refreshToken: tokens?.refreshToken ?? null,
+            expiresAt: tokens?.expiresAt ?? null,
+            error: null
+        }));
+    }, []);
+    const buildAuthorizationUrl = useCallback(async (options) => {
         const codeVerifier = generateCodeVerifier();
         const codeChallenge = await generateCodeChallenge(codeVerifier);
         const stateValue = generateState();
@@ -44,6 +98,9 @@ export function AuthUProvider({ config, children }) {
         if (options?.screenHint) {
             params.set('screen_hint', options.screenHint);
         }
+        if (options?.prompt) {
+            params.set('prompt', options.prompt);
+        }
         return `${buildBaseUrl(config.domain)}/authorize?${params.toString()}`;
     }, [config]);
     const exchangeCodeForTokensWithVerifier = useCallback(async (code, codeVerifier) => {
@@ -79,22 +136,31 @@ export function AuthUProvider({ config, children }) {
         };
     }, []);
     const login = useCallback(async (options) => {
-        const url = await getAuthorizationUrl(options);
-        console.log('[AuthU SDK] login() called, redirecting to:', url);
-        window.location.href = url;
-    }, [getAuthorizationUrl]);
-    const logout = useCallback(() => {
-        localStorage.removeItem(TOKEN_STORAGE_KEY);
-        setState({
-            isLoading: false,
-            isAuthenticated: false,
-            user: null,
-            accessToken: null,
-            refreshToken: null,
-            expiresAt: null,
-            error: null
+        sessionStorage.removeItem(SILENT_ATTEMPT_KEY);
+        if (options?.returnTo) {
+            sessionStorage.setItem(RETURN_TO_KEY, options.returnTo);
+        }
+        window.location.href = await buildAuthorizationUrl(options);
+    }, [buildAuthorizationUrl]);
+    /**
+     * A local logout is no longer enough: the session now lives in AuthU's own
+     * cookie, so clearing memory alone would let the next silent renewal sign
+     * the visitor straight back in. The browser is sent to AuthU /logout, which
+     * kills the session and bounces back to the app.
+     */
+    const logout = useCallback((options) => {
+        tokensRef.current = null;
+        sessionStorage.setItem(SILENT_ATTEMPT_KEY, '1');
+        setState(EMPTY_STATE);
+        // The destination has to survive AuthU's own check, which only accepts a
+        // URI the tenant registered or its home origin: the configured
+        // redirectUri is registered by construction, so it is the safe default.
+        const params = new URLSearchParams({
+            client_id: config.clientId,
+            redirect_uri: options?.returnTo || config.redirectUri
         });
-    }, []);
+        window.location.href = `${buildBaseUrl(config.domain)}/logout?${params.toString()}`;
+    }, [config.domain, config.clientId, config.redirectUri]);
     const fetchUserInfo = useCallback(async (accessToken) => {
         try {
             const response = await fetch(`${buildBaseUrl(config.domain)}/oauth/userinfo`, {
@@ -116,206 +182,151 @@ export function AuthUProvider({ config, children }) {
         }
     }, [config.domain]);
     const refreshTokens = useCallback(async () => {
-        if (!state.refreshToken)
+        const refreshToken = tokensRef.current?.refreshToken;
+        if (!refreshToken)
             return false;
-        try {
-            const response = await fetch(`${buildBaseUrl(config.domain)}/oauth/token`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    grant_type: 'refresh_token',
-                    refresh_token: state.refreshToken,
-                    client_id: config.clientId
-                })
-            });
-            if (!response.ok) {
-                logout();
+        if (refreshInFlight.current)
+            return refreshInFlight.current;
+        const run = async () => {
+            try {
+                const response = await fetch(`${buildBaseUrl(config.domain)}/oauth/token`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        grant_type: 'refresh_token',
+                        refresh_token: refreshToken,
+                        client_id: config.clientId
+                    })
+                });
+                if (!response.ok) {
+                    tokensRef.current = null;
+                    setState(EMPTY_STATE);
+                    return false;
+                }
+                const tokens = await response.json();
+                setTokens({
+                    accessToken: tokens.access_token,
+                    refreshToken: tokens.refresh_token ?? null,
+                    expiresAt: Date.now() + tokens.expires_in * 1000
+                }, tokens.id_token ? parseIdToken(tokens.id_token) : undefined);
+                return true;
+            }
+            catch {
+                tokensRef.current = null;
+                setState(EMPTY_STATE);
                 return false;
             }
-            const tokens = await response.json();
-            const expiresAt = Date.now() + tokens.expires_in * 1000;
-            const user = tokens.id_token ? parseIdToken(tokens.id_token) : state.user;
-            localStorage.setItem(TOKEN_STORAGE_KEY, JSON.stringify({
-                accessToken: tokens.access_token,
-                refreshToken: tokens.refresh_token,
-                expiresAt
-            }));
-            setState(prev => ({
-                ...prev,
-                accessToken: tokens.access_token,
-                refreshToken: tokens.refresh_token,
-                expiresAt,
-                user: user || prev.user
-            }));
-            return true;
-        }
-        catch {
-            logout();
-            return false;
-        }
-    }, [
-        state.refreshToken,
-        state.user,
-        config.domain,
-        config.clientId,
-        logout,
-        parseIdToken
-    ]);
+        };
+        const pending = run().finally(() => {
+            refreshInFlight.current = null;
+        });
+        refreshInFlight.current = pending;
+        return pending;
+    }, [config.domain, config.clientId, parseIdToken, setTokens]);
     const getAccessToken = useCallback(async () => {
-        if (!state.accessToken)
+        const tokens = tokensRef.current;
+        if (!tokens)
             return null;
-        if (state.expiresAt && Date.now() >= state.expiresAt - 60000) {
+        if (Date.now() >= tokens.expiresAt - 60000) {
             const refreshed = await refreshTokens();
             if (!refreshed)
                 return null;
         }
-        return state.accessToken;
-    }, [state.accessToken, state.expiresAt, refreshTokens]);
+        return tokensRef.current?.accessToken ?? null;
+    }, [refreshTokens]);
+    const configRef = useRef(config);
+    configRef.current = config;
+    const bootstrapped = useRef(false);
     useEffect(() => {
-        const handleCallback = async () => {
-            console.log('[AuthU SDK] handleCallback starting, URL:', window.location.href);
+        if (bootstrapped.current)
+            return;
+        bootstrapped.current = true;
+        // Silent renewal lands on redirectUri, which for most apps is a bare
+        // /callback route: the URL is rewritten back to the page the visitor
+        // actually asked for. replaceState alone would leave a client-side router
+        // still rendering /callback, so a popstate is dispatched to make it
+        // re-read the location.
+        const restoreUrl = () => {
+            const returnTo = readReturnTo();
+            window.history.replaceState({}, document.title, returnTo || window.location.pathname);
+            if (returnTo) {
+                window.dispatchEvent(new PopStateEvent('popstate'));
+            }
+        };
+        const bootstrap = async () => {
+            localStorage.removeItem(LEGACY_TOKEN_STORAGE_KEY);
             const params = new URLSearchParams(window.location.search);
             const code = params.get('code');
             const returnedState = params.get('state');
             const error = params.get('error');
-            console.log('[AuthU SDK] handleCallback params - code:', !!code, 'state:', returnedState, 'error:', error);
             if (error) {
-                setState(prev => ({
-                    ...prev,
-                    isLoading: false,
-                    error: new Error(params.get('error_description') || error)
-                }));
+                const description = params.get('error_description') ||
+                    params.get('errorDescription') ||
+                    error;
+                restoreUrl();
+                // A refused silent renewal is the expected answer for a visitor who is
+                // simply not signed in: it is an anonymous render, not an error.
+                if (error === 'login_required' || error === 'interaction_required') {
+                    sessionStorage.setItem(SILENT_ATTEMPT_KEY, '1');
+                    setState(EMPTY_STATE);
+                    return;
+                }
+                setState({ ...EMPTY_STATE, error: new Error(description) });
                 return;
             }
             if (code) {
                 const storedState = getStoredState();
                 if (returnedState !== storedState) {
-                    setState(prev => ({
-                        ...prev,
-                        isLoading: false,
+                    setState({
+                        ...EMPTY_STATE,
                         error: new Error('Invalid state parameter')
-                    }));
+                    });
                     return;
                 }
-                // Get and immediately clear code verifier to prevent duplicate exchanges
-                // (React StrictMode double-mount protection)
+                // Read and clear the verifier in one go: React StrictMode mounts this
+                // effect twice, and the second pass must not replay the same code.
                 const codeVerifier = getCodeVerifier();
-                if (!codeVerifier) {
-                    console.log('[AuthU SDK] No code verifier found, skipping duplicate callback');
+                if (!codeVerifier)
                     return;
-                }
                 clearCodeVerifier();
                 clearState();
                 clearNonce();
-                // Clear URL immediately to prevent issues on refresh
-                window.history.replaceState({}, document.title, window.location.pathname);
+                restoreUrl();
                 try {
                     const tokens = await exchangeCodeForTokensWithVerifier(code, codeVerifier);
-                    const user = parseIdToken(tokens.id_token);
-                    const expiresAt = Date.now() + tokens.expires_in * 1000;
-                    localStorage.setItem(TOKEN_STORAGE_KEY, JSON.stringify({
-                        accessToken: tokens.access_token,
-                        refreshToken: tokens.refresh_token,
-                        expiresAt
-                    }));
-                    setState({
-                        isLoading: false,
-                        isAuthenticated: true,
-                        user,
+                    sessionStorage.removeItem(SILENT_ATTEMPT_KEY);
+                    setTokens({
                         accessToken: tokens.access_token,
-                        refreshToken: tokens.refresh_token,
-                        expiresAt,
-                        error: null
-                    });
+                        refreshToken: tokens.refresh_token ?? null,
+                        expiresAt: Date.now() + tokens.expires_in * 1000
+                    }, tokens.id_token
+                        ? parseIdToken(tokens.id_token)
+                        : await fetchUserInfo(tokens.access_token));
                 }
                 catch (err) {
-                    setState(prev => ({
-                        ...prev,
-                        isLoading: false,
+                    setState({
+                        ...EMPTY_STATE,
                         error: err instanceof Error ? err : new Error('Authentication failed')
-                    }));
+                    });
                 }
                 return;
             }
-            const stored = localStorage.getItem(TOKEN_STORAGE_KEY);
-            console.log('[AuthU SDK] Checking localStorage for tokens:', !!stored);
-            if (stored) {
-                try {
-                    const tokens = JSON.parse(stored);
-                    console.log('[AuthU SDK] Found tokens, expiresAt:', tokens.expiresAt, 'now:', Date.now(), 'valid:', tokens.expiresAt > Date.now());
-                    if (tokens.expiresAt > Date.now()) {
-                        const user = await fetchUserInfo(tokens.accessToken);
-                        console.log('[AuthU SDK] Tokens valid, user:', user);
-                        setState({
-                            isLoading: false,
-                            isAuthenticated: true,
-                            user,
-                            accessToken: tokens.accessToken,
-                            refreshToken: tokens.refreshToken,
-                            expiresAt: tokens.expiresAt,
-                            error: null
-                        });
-                        return;
-                    }
-                    if (tokens.refreshToken) {
-                        console.log('[AuthU SDK] Access token expired, attempting refresh...');
-                        try {
-                            const response = await fetch(`${buildBaseUrl(config.domain)}/oauth/token`, {
-                                method: 'POST',
-                                headers: { 'Content-Type': 'application/json' },
-                                body: JSON.stringify({
-                                    grant_type: 'refresh_token',
-                                    refresh_token: tokens.refreshToken,
-                                    client_id: config.clientId
-                                })
-                            });
-                            if (response.ok) {
-                                const newTokens = await response.json();
-                                const expiresAt = Date.now() + newTokens.expires_in * 1000;
-                                const user = newTokens.id_token
-                                    ? parseIdToken(newTokens.id_token)
-                                    : await fetchUserInfo(newTokens.access_token);
-                                localStorage.setItem(TOKEN_STORAGE_KEY, JSON.stringify({
-                                    accessToken: newTokens.access_token,
-                                    refreshToken: newTokens.refresh_token,
-                                    expiresAt
-                                }));
-                                console.log('[AuthU SDK] Token refresh successful, user:', user);
-                                setState({
-                                    isLoading: false,
-                                    isAuthenticated: true,
-                                    user,
-                                    accessToken: newTokens.access_token,
-                                    refreshToken: newTokens.refresh_token,
-                                    expiresAt,
-                                    error: null
-                                });
-                                return;
-                            }
-                            console.log('[AuthU SDK] Token refresh failed, clearing tokens');
-                            localStorage.removeItem(TOKEN_STORAGE_KEY);
-                        }
-                        catch {
-                            console.log('[AuthU SDK] Token refresh error, clearing tokens');
-                            localStorage.removeItem(TOKEN_STORAGE_KEY);
-                        }
-                    }
-                }
-                catch {
-                    console.log('[AuthU SDK] Error parsing stored tokens, removing');
-                    localStorage.removeItem(TOKEN_STORAGE_KEY);
-                }
+            if (configRef.current.silentAuth === false ||
+                sessionStorage.getItem(SILENT_ATTEMPT_KEY)) {
+                setState(EMPTY_STATE);
+                return;
             }
-            console.log('[AuthU SDK] No valid tokens found, setting isLoading: false');
-            setState(prev => ({ ...prev, isLoading: false }));
+            sessionStorage.setItem(SILENT_ATTEMPT_KEY, '1');
+            sessionStorage.setItem(RETURN_TO_KEY, currentLocation());
+            window.location.replace(await buildAuthorizationUrl({ prompt: 'none' }));
         };
-        handleCallback();
+        bootstrap();
     }, [
+        buildAuthorizationUrl,
         exchangeCodeForTokensWithVerifier,
         fetchUserInfo,
-        config.clientId,
-        config.domain,
-        parseIdToken
+        parseIdToken,
+        setTokens
     ]);
     const checkEmailExists = useCallback(async (email) => {
         try {
@@ -333,6 +344,24 @@ export function AuthUProvider({ config, children }) {
             return false;
         }
     }, [config.clientId, config.domain]);
+    const createDeviceLink = useCallback(async () => {
+        const accessToken = await getAccessToken();
+        if (!accessToken)
+            return null;
+        try {
+            const response = await fetch(`${buildBaseUrl(config.domain)}/api/auth/device-link`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${accessToken}` }
+            });
+            if (!response.ok)
+                return null;
+            const data = await response.json();
+            return { url: data.url, expiresAt: new Date(data.expiresAt).getTime() };
+        }
+        catch {
+            return null;
+        }
+    }, [config.domain, getAccessToken]);
     const contextValue = {
         isLoading: state.isLoading,
         isAuthenticated: state.isAuthenticated,
@@ -341,7 +370,8 @@ export function AuthUProvider({ config, children }) {
         login,
         logout,
         getAccessToken,
-        checkEmailExists
+        checkEmailExists,
+        createDeviceLink
     };
     return (_jsx(AuthUContext.Provider, { value: contextValue, children: children }));
 }

package/dist/DeviceLinkQrCode.d.ts

@@ -0,0 +1,16 @@
+import { type CSSProperties } from 'react';
+interface DeviceLinkQrCodeProps {
+    /** Rendered width and height in pixels */
+    size?: number;
+    color?: string;
+    background?: string;
+    className?: string;
+    style?: CSSProperties;
+}
+/**
+ * QR code that signs the scanning device into the current account. The link
+ * renews itself while mounted; nothing is rendered when signed out.
+ */
+export declare function DeviceLinkQrCode({ size, color, background, className, style }: DeviceLinkQrCodeProps): import("react/jsx-runtime").JSX.Element | null;
+export {};
+//# sourceMappingURL=DeviceLinkQrCode.d.ts.map

package/dist/DeviceLinkQrCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceLinkQrCode.d.ts","sourceRoot":"","sources":["../src/DeviceLinkQrCode.tsx"],"names":[],"mappings":"AACA,OAAO,EAAC,KAAK,aAAa,EAAU,MAAM,OAAO,CAAC;AAGlD,UAAU,qBAAqB;IAC7B,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAKD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,IAAU,EACV,KAAiB,EACjB,UAAsB,EACtB,SAAS,EACT,KAAK,EACN,EAAE,qBAAqB,kDAsCvB"}

package/dist/DeviceLinkQrCode.js

@@ -0,0 +1,33 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import qrcode from 'qrcode-generator';
+import { useMemo } from 'react';
+import { useDeviceLink } from './useDeviceLink.js';
+/** Quiet zone around the code, in modules, required by scanners */
+const MARGIN = 2;
+/**
+ * QR code that signs the scanning device into the current account. The link
+ * renews itself while mounted; nothing is rendered when signed out.
+ */
+export function DeviceLinkQrCode({ size = 200, color = '#000000', background = '#ffffff', className, style }) {
+    const { link } = useDeviceLink();
+    const qr = useMemo(() => {
+        if (!link)
+            return null;
+        const code = qrcode(0, 'M');
+        code.addData(link.url);
+        code.make();
+        const count = code.getModuleCount();
+        let path = '';
+        for (let row = 0; row < count; row++) {
+            for (let col = 0; col < count; col++) {
+                if (code.isDark(row, col)) {
+                    path += `M${col + MARGIN} ${row + MARGIN}h1v1h-1z`;
+                }
+            }
+        }
+        return { path, viewBox: count + MARGIN * 2 };
+    }, [link]);
+    if (!qr)
+        return null;
+    return (_jsxs("svg", { role: "img", "aria-label": "Sign-in QR code", width: size, height: size, viewBox: `0 0 ${qr.viewBox} ${qr.viewBox}`, shapeRendering: "crispEdges", className: className, style: style, children: [_jsx("rect", { width: qr.viewBox, height: qr.viewBox, fill: background }), _jsx("path", { d: qr.path, fill: color })] }));
+}

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 export { AuthUProvider } from './AuthUProvider.js';
+export { DeviceLinkQrCode } from './DeviceLinkQrCode.js';
 export { PrivateRoute } from './PrivateRoute.js';
 export * from './pkce.js';
-export type { AuthUConfig, AuthUContextValue, AuthUUser } from './types.js';
+export type { AuthUConfig, AuthUContextValue, AuthUUser, DeviceLink } from './types.js';
 export { useApiToken } from './useApiToken.js';
 export { useAuthU } from './useAuthU.js';
+export { useDeviceLink } from './useDeviceLink.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAC,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC/C,cAAc,WAAW,CAAC;AAC1B,YAAY,EAAC,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAC,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAC,gBAAgB,EAAC,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAC,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC/C,cAAc,WAAW,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,SAAS,EACT,UAAU,EACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAC;AACvC,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -1,5 +1,7 @@
 export { AuthUProvider } from './AuthUProvider.js';
+export { DeviceLinkQrCode } from './DeviceLinkQrCode.js';
 export { PrivateRoute } from './PrivateRoute.js';
 export * from './pkce.js';
 export { useApiToken } from './useApiToken.js';
 export { useAuthU } from './useAuthU.js';
+export { useDeviceLink } from './useDeviceLink.js';

package/dist/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AA2BA,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAMD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/C;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AA2BA,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAcD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/C;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}

package/dist/pkce.js

@@ -34,6 +34,14 @@ export function generateState() {
 export function generateNonce() {
     return generateRandomString(32);
 }
+/**
+ * The verifier, the state and the nonce have to outlive a full navigation to
+ * AuthU and back. They stay in localStorage rather than sessionStorage on
+ * purpose: 1.0.10 moved them there after sessionStorage lost them across the
+ * cross-domain round trip. They are single-use, consumed within seconds, and
+ * cleared as soon as the callback is handled - unlike the tokens, which never
+ * touch any storage at all.
+ */
 const STORAGE_KEY_VERIFIER = 'authu_code_verifier';
 const STORAGE_KEY_STATE = 'authu_state';
 const STORAGE_KEY_NONCE = 'authu_nonce';

package/dist/types.d.ts

@@ -4,6 +4,13 @@ export interface AuthUConfig {
     redirectUri: string;
     scope?: string;
     audience?: string;
+    /**
+     * Silent session renewal through `/authorize?prompt=none`, on by default.
+     * Tokens are held in memory only, so this round trip is what carries a
+     * session across a page reload. Turning it off means every reload starts
+     * signed out.
+     */
+    silentAuth?: boolean;
 }
 export interface AuthUUser {
     sub: string;
@@ -21,6 +28,16 @@ export interface AuthUContextValue {
     logout: (options?: LogoutOptions) => void;
     getAccessToken: () => Promise<string | null>;
     checkEmailExists: (email: string) => Promise<boolean>;
+    /**
+     * One-shot link that signs another device into the same account, meant to
+     * be shown as a QR code. Expires after two minutes; null when signed out.
+     */
+    createDeviceLink: () => Promise<DeviceLink | null>;
+}
+export interface DeviceLink {
+    url: string;
+    /** Epoch milliseconds */
+    expiresAt: number;
 }
 export interface LoginOptions {
     returnTo?: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IAC1C,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IAC1C,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD;;;OAGG;IACH,gBAAgB,EAAE,MAAM,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB"}

package/dist/useDeviceLink.d.ts

@@ -0,0 +1,14 @@
+import type { DeviceLink } from './types.js';
+interface UseDeviceLinkReturn {
+    link: DeviceLink | null;
+    isLoading: boolean;
+    error: Error | null;
+    renew: () => Promise<void>;
+}
+/**
+ * Keeps a fresh device link while the component is mounted (and `enabled`),
+ * so a QR code can stay on screen without ever showing an expired link.
+ */
+export declare function useDeviceLink(enabled?: boolean): UseDeviceLinkReturn;
+export {};
+//# sourceMappingURL=useDeviceLink.d.ts.map

package/dist/useDeviceLink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useDeviceLink.d.ts","sourceRoot":"","sources":["../src/useDeviceLink.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,YAAY,CAAC;AAS3C,UAAU,mBAAmB;IAC3B,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,UAAO,GAAG,mBAAmB,CA8BjE"}

package/dist/useDeviceLink.js

@@ -0,0 +1,39 @@
+import { useCallback, useEffect, useState } from 'react';
+import { useAuthU } from './useAuthU.js';
+/**
+ * Renewed this long before it expires, so a phone scanning at the last second
+ * still lands on a valid link.
+ */
+const RENEW_MARGIN_MS = 15_000;
+/**
+ * Keeps a fresh device link while the component is mounted (and `enabled`),
+ * so a QR code can stay on screen without ever showing an expired link.
+ */
+export function useDeviceLink(enabled = true) {
+    const { createDeviceLink, isAuthenticated } = useAuthU();
+    const [link, setLink] = useState(null);
+    const [isLoading, setIsLoading] = useState(false);
+    const [error, setError] = useState(null);
+    const renew = useCallback(async () => {
+        setIsLoading(true);
+        const created = await createDeviceLink();
+        setLink(created);
+        setError(created ? null : new Error('Could not create a device link'));
+        setIsLoading(false);
+    }, [createDeviceLink]);
+    useEffect(() => {
+        if (!enabled || !isAuthenticated) {
+            setLink(null);
+            return;
+        }
+        renew();
+    }, [enabled, isAuthenticated, renew]);
+    useEffect(() => {
+        if (!enabled || !link)
+            return;
+        const delay = Math.max(link.expiresAt - Date.now() - RENEW_MARGIN_MS, 0);
+        const timer = setTimeout(renew, delay);
+        return () => clearTimeout(timer);
+    }, [enabled, link, renew]);
+    return { link, isLoading, error, renew };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authu/react",
-  "version": "1.0.65",
+  "version": "1.0.67",
   "description": "React SDK for AuthU - Centralized Multi-Tenant Authentication Service",
   "type": "module",
   "main": "./dist/index.js",
@@ -43,5 +43,8 @@
     "@types/react": "^19.0.4",
     "react": "^19.0.0",
     "typescript": "^5.7.3"
+  },
+  "dependencies": {
+    "qrcode-generator": "^2.0.4"
   }
 }