@authyon/auth 0.1.3 → 0.1.4

package/dist/index.cjs

@@ -113,7 +113,7 @@ var AuthyonClient = class {
       loginFinish: (assertion) => this.request("/auth/webauthn/login/finish", {
         method: "POST",
         body: assertion
-      }).then((data) => this.setSession(data, "signed_in"))
+      }).then((data) => this.setSession({ tokens: data.tokens }, "signed_in")).then((session) => this.hydrateUser(session))
     };
     // ── Social sign-in (SSO) ─────────────────────────────────────────────────
     this.sso = {
@@ -134,9 +134,7 @@ var AuthyonClient = class {
        * POST /auth/sso/exchange — swaps the one-time code from the provider
        * callback for tokens and stores the session.
        */
-      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then(
-        (data) => this.setSession(data, "signed_in")
-      )
+      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then((data) => this.setSession({ tokens: data.tokens }, "signed_in")).then((session) => this.hydrateUser(session))
     };
     // ── User ─────────────────────────────────────────────────────────────────
     this.user = {
@@ -144,7 +142,7 @@ var AuthyonClient = class {
       me: () => this.request("/auth/me", { bearer: true }).then(normalizeUser),
       /** GET /auth/sessions — active refresh-token sessions with device/IP data. */
       sessions: () => this.request("/auth/sessions", { bearer: true }),
-      /** GET /auth/me/activities — recent account activity for the current user. */
+      /** GET /auth/me/activities — paginated recent account activity for the current user. */
       activities: (params = {}) => this.request(`/auth/me/activities?${toQuery(params)}`, { bearer: true }),
       /**
        * Revokes a single session by id (e.g. one entry from `sessions()`),
@@ -194,7 +192,7 @@ var AuthyonClient = class {
         method: "POST",
         bearer: true,
         body: { tenantSlug: organizationSlug }
-      }).then((data) => this.setSession(data, "refreshed")),
+      }).then((data) => this.setSession({ tokens: data.tokens }, "refreshed")).then((session) => this.hydrateUser(session)),
       /** The organization the current session is scoped to, from the cached session — no network call. */
       current: () => this.getSession()?.user?.activeOrganization ?? null,
       members: {
@@ -332,9 +330,9 @@ var AuthyonClient = class {
   }
   setSession(raw, event) {
     const session = {
-      ...raw,
+      ...raw.tokens,
       user: raw.user ? normalizeUser(raw.user) : void 0,
-      expiresAt: Date.now() + raw.expiresIn * 1e3
+      expiresAt: Date.now() + raw.tokens.expiresIn * 1e3
     };
     this.storage.set(session);
     this.emit(event === "signed_out" ? { type: "signed_out" } : { type: event, session });
@@ -344,6 +342,23 @@ var AuthyonClient = class {
     this.storage.clear();
     this.emit({ type: "signed_out" });
   }
+  /**
+   * `/auth/login` and the other endpoints that mint a session don't return
+   * a `user` object on the wire — only `tokens` (plus `twoFactor`, when a
+   * challenge is required). Fetch the profile right after so callers get a
+   * fully-populated `session.user` without an extra manual round trip.
+   * Best-effort: keeps the session usable even if this fetch fails.
+   */
+  async hydrateUser(session) {
+    try {
+      const user = await this.user.me();
+      const hydrated = { ...session, user };
+      this.storage.set(hydrated);
+      return hydrated;
+    } catch {
+      return session;
+    }
+  }
   // ── HTTP core ────────────────────────────────────────────────────────────
   async request(path, options = {}, isRetry = false) {
     const headers = {
@@ -395,20 +410,20 @@ var AuthyonClient = class {
   async login(params) {
     const { organizationSlug, ...rest } = params;
     const body = organizationSlug ? { ...rest, tenantSlug: organizationSlug } : rest;
-    const data = await this.request("/auth/login", {
-      method: "POST",
-      body
-    });
-    if (data.twoFactorRequired) {
-      return data;
+    const data = await this.request("/auth/login", { method: "POST", body });
+    if (data.twoFactor) {
+      return { twoFactorRequired: true, ...data.twoFactor };
     }
-    const session = this.setSession(data, "signed_in");
+    const session = await this.hydrateUser(this.setSession({ tokens: data.tokens }, "signed_in"));
     return { twoFactorRequired: false, session };
   }
   /** POST /auth/2fa/verify — redeems a 2FA challenge from `login()` and stores the session. */
   async verifyTwoFactor(params) {
-    const data = await this.request("/auth/2fa/verify", { method: "POST", body: params });
-    return this.setSession(data, "signed_in");
+    const data = await this.request("/auth/2fa/verify", {
+      method: "POST",
+      body: params
+    });
+    return this.hydrateUser(this.setSession({ tokens: data.tokens }, "signed_in"));
   }
   /** POST /auth/refresh — rotates the single-use refresh token (single-flight). */
   async refresh() {
@@ -420,7 +435,10 @@ var AuthyonClient = class {
       method: "POST",
       body: { refreshToken: current.refreshToken }
     }).then(
-      (data) => this.setSession({ user: current.user, ...data }, "refreshed")
+      (data) => this.setSession(
+        { tokens: data.tokens, user: current.user },
+        "refreshed"
+      )
     ).catch((error) => {
       if (error instanceof AuthyonError && (error.status === 401 || error.status === 403)) {
         this.clearSession();
@@ -472,11 +490,11 @@ var AuthyonClient = class {
   }
 };
 function normalizeUser(raw) {
-  const { tenants, activeTenant, ...rest } = raw;
+  const { tenant, tenants, activeTenant, ...rest } = raw;
   return {
     ...rest,
     organizations: raw.organizations ?? tenants,
-    activeOrganization: raw.activeOrganization ?? activeTenant ?? null
+    activeOrganization: tenant ?? raw.activeOrganization ?? activeTenant ?? null
   };
 }
 function createClient(options) {

package/dist/index.d.cts

@@ -35,9 +35,17 @@ interface User {
     id: string;
     email: string;
     username?: string;
+    emailConfirmed?: boolean;
+    firstName?: string | null;
+    lastName?: string | null;
+    roles?: string[];
+    permissions?: string[];
+    createdAt?: string;
+    lastLoginAt?: string;
     organizations?: Organization[];
     activeOrganization?: Organization | null;
-    permissions?: string[];
+    /** Actions the user must complete before continuing (e.g. confirm e-mail). */
+    pendencies?: string[];
 }
 /** Token pair issued by login / refresh / tenant switch. */
 interface Session {
@@ -89,9 +97,18 @@ interface TwoFactorVerifyParams {
     /** Required when `method` is `"webauthn"`. */
     webAuthnAssertion?: WebAuthnAssertion;
 }
+/** GET /auth/2fa/status — per-method enrolment flags, confirmed against the live API. */
 interface TwoFactorStatus {
-    methods: TwoFactorMethod[];
-    recoveryCodesRemaining?: number;
+    authenticatorEnabled: boolean;
+    authenticatorConfirmedAt?: string | null;
+    emailEnabled: boolean;
+    emailEnabledAt?: string | null;
+    /** Partially redacted (e.g. `"n**********@h***.com"`). */
+    emailHint?: string | null;
+    webAuthnEnabled: boolean;
+    webAuthnCredentialCount: number;
+    webAuthnCredentials: WebAuthnCredential[];
+    remainingRecoveryCodes: number;
 }
 interface AuthenticatorSetup {
     secret: string;
@@ -123,12 +140,27 @@ interface SsoProvider {
     /** URL to redirect the browser to in order to start this provider's flow. */
     startUrl: string;
 }
+/** GET /auth/me/activities — one audit-trail entry, confirmed against the live API. */
 interface Activity {
     id: string;
-    type: string;
-    createdAt: string;
+    eventType: string;
+    occurredAt: string;
+    environmentId?: string;
     ip?: string;
-    device?: string;
+    userAgent?: string;
+    /** JSON-encoded string — `JSON.parse` it for the event-specific payload. */
+    payloadJson?: string;
+}
+/** Paginated list envelope returned by `user.activities()`. */
+interface Page<T> {
+    data: T[];
+    /** Item count actually returned for this page. */
+    perPage?: number;
+    pageSize: number;
+    total: number;
+    pages: number;
+    hasNext: boolean;
+    hasPrev: boolean;
 }
 /** A role available within an organization (tenant). */
 interface Role {
@@ -137,13 +169,17 @@ interface Role {
     description?: string;
     permissions?: string[];
 }
+/** GET /auth/sessions — confirmed against the live API. */
 interface SessionInfo {
     id: string;
-    createdAt?: string;
-    lastUsedAt?: string;
-    ip?: string;
-    device?: string;
-    current?: boolean;
+    createdAt: string;
+    expiresAt: string;
+    revokedAt?: string | null;
+    createdFromIp?: string;
+    isActive: boolean;
+    userAgent?: string;
+    lastUsedAt?: string | null;
+    lastUsedFromIp?: string | null;
 }
 interface IntrospectResult {
     active: boolean;
@@ -211,6 +247,14 @@ declare class AuthyonClient {
     private emit;
     private setSession;
     private clearSession;
+    /**
+     * `/auth/login` and the other endpoints that mint a session don't return
+     * a `user` object on the wire — only `tokens` (plus `twoFactor`, when a
+     * challenge is required). Fetch the profile right after so callers get a
+     * fully-populated `session.user` without an extra manual round trip.
+     * Best-effort: keeps the session usable even if this fetch fails.
+     */
+    private hydrateUser;
     private request;
     private toError;
     /** POST /auth/register — creates a new user (rate-limited to 20/hour per IP). */
@@ -266,8 +310,8 @@ declare class AuthyonClient {
         me: () => Promise<User>;
         /** GET /auth/sessions — active refresh-token sessions with device/IP data. */
         sessions: () => Promise<SessionInfo[]>;
-        /** GET /auth/me/activities — recent account activity for the current user. */
-        activities: (params?: PageParams) => Promise<Activity[]>;
+        /** GET /auth/me/activities — paginated recent account activity for the current user. */
+        activities: (params?: PageParams) => Promise<Page<Activity>>;
         /**
          * Revokes a single session by id (e.g. one entry from `sessions()`),
          * signing that device out without affecting the current one.
@@ -400,4 +444,4 @@ declare function memoryStorage(): TokenStorage;
 declare function localStorageAdapter(key?: string): TokenStorage;
 declare function defaultStorage(): TokenStorage;
 
-export { type Activity, type AuthEvent, type AuthStateListener, type AuthenticatorSetup, AuthyonClient, type AuthyonClientOptions, AuthyonError, type CreateOrganizationParams, ErrorCodes, type IntrospectResult, type InviteMemberParams, type LoginParams, type LoginResult, type Organization, type OrganizationMember, type PageParams, type RegisterParams, type Role, type Session, type SessionInfo, type SsoProvider, type TokenStorage, type TwoFactorChallenge, type TwoFactorMethod, type TwoFactorStatus, type TwoFactorVerifyParams, type User, type ValidateResult, type WebAuthnAssertion, type WebAuthnCeremonyStart, type WebAuthnCredential, createClient, defaultStorage, localStorageAdapter, memoryStorage };
+export { type Activity, type AuthEvent, type AuthStateListener, type AuthenticatorSetup, AuthyonClient, type AuthyonClientOptions, AuthyonError, type CreateOrganizationParams, ErrorCodes, type IntrospectResult, type InviteMemberParams, type LoginParams, type LoginResult, type Organization, type OrganizationMember, type Page, type PageParams, type RegisterParams, type Role, type Session, type SessionInfo, type SsoProvider, type TokenStorage, type TwoFactorChallenge, type TwoFactorMethod, type TwoFactorStatus, type TwoFactorVerifyParams, type User, type ValidateResult, type WebAuthnAssertion, type WebAuthnCeremonyStart, type WebAuthnCredential, createClient, defaultStorage, localStorageAdapter, memoryStorage };

package/dist/index.d.ts

@@ -35,9 +35,17 @@ interface User {
     id: string;
     email: string;
     username?: string;
+    emailConfirmed?: boolean;
+    firstName?: string | null;
+    lastName?: string | null;
+    roles?: string[];
+    permissions?: string[];
+    createdAt?: string;
+    lastLoginAt?: string;
     organizations?: Organization[];
     activeOrganization?: Organization | null;
-    permissions?: string[];
+    /** Actions the user must complete before continuing (e.g. confirm e-mail). */
+    pendencies?: string[];
 }
 /** Token pair issued by login / refresh / tenant switch. */
 interface Session {
@@ -89,9 +97,18 @@ interface TwoFactorVerifyParams {
     /** Required when `method` is `"webauthn"`. */
     webAuthnAssertion?: WebAuthnAssertion;
 }
+/** GET /auth/2fa/status — per-method enrolment flags, confirmed against the live API. */
 interface TwoFactorStatus {
-    methods: TwoFactorMethod[];
-    recoveryCodesRemaining?: number;
+    authenticatorEnabled: boolean;
+    authenticatorConfirmedAt?: string | null;
+    emailEnabled: boolean;
+    emailEnabledAt?: string | null;
+    /** Partially redacted (e.g. `"n**********@h***.com"`). */
+    emailHint?: string | null;
+    webAuthnEnabled: boolean;
+    webAuthnCredentialCount: number;
+    webAuthnCredentials: WebAuthnCredential[];
+    remainingRecoveryCodes: number;
 }
 interface AuthenticatorSetup {
     secret: string;
@@ -123,12 +140,27 @@ interface SsoProvider {
     /** URL to redirect the browser to in order to start this provider's flow. */
     startUrl: string;
 }
+/** GET /auth/me/activities — one audit-trail entry, confirmed against the live API. */
 interface Activity {
     id: string;
-    type: string;
-    createdAt: string;
+    eventType: string;
+    occurredAt: string;
+    environmentId?: string;
     ip?: string;
-    device?: string;
+    userAgent?: string;
+    /** JSON-encoded string — `JSON.parse` it for the event-specific payload. */
+    payloadJson?: string;
+}
+/** Paginated list envelope returned by `user.activities()`. */
+interface Page<T> {
+    data: T[];
+    /** Item count actually returned for this page. */
+    perPage?: number;
+    pageSize: number;
+    total: number;
+    pages: number;
+    hasNext: boolean;
+    hasPrev: boolean;
 }
 /** A role available within an organization (tenant). */
 interface Role {
@@ -137,13 +169,17 @@ interface Role {
     description?: string;
     permissions?: string[];
 }
+/** GET /auth/sessions — confirmed against the live API. */
 interface SessionInfo {
     id: string;
-    createdAt?: string;
-    lastUsedAt?: string;
-    ip?: string;
-    device?: string;
-    current?: boolean;
+    createdAt: string;
+    expiresAt: string;
+    revokedAt?: string | null;
+    createdFromIp?: string;
+    isActive: boolean;
+    userAgent?: string;
+    lastUsedAt?: string | null;
+    lastUsedFromIp?: string | null;
 }
 interface IntrospectResult {
     active: boolean;
@@ -211,6 +247,14 @@ declare class AuthyonClient {
     private emit;
     private setSession;
     private clearSession;
+    /**
+     * `/auth/login` and the other endpoints that mint a session don't return
+     * a `user` object on the wire — only `tokens` (plus `twoFactor`, when a
+     * challenge is required). Fetch the profile right after so callers get a
+     * fully-populated `session.user` without an extra manual round trip.
+     * Best-effort: keeps the session usable even if this fetch fails.
+     */
+    private hydrateUser;
     private request;
     private toError;
     /** POST /auth/register — creates a new user (rate-limited to 20/hour per IP). */
@@ -266,8 +310,8 @@ declare class AuthyonClient {
         me: () => Promise<User>;
         /** GET /auth/sessions — active refresh-token sessions with device/IP data. */
         sessions: () => Promise<SessionInfo[]>;
-        /** GET /auth/me/activities — recent account activity for the current user. */
-        activities: (params?: PageParams) => Promise<Activity[]>;
+        /** GET /auth/me/activities — paginated recent account activity for the current user. */
+        activities: (params?: PageParams) => Promise<Page<Activity>>;
         /**
          * Revokes a single session by id (e.g. one entry from `sessions()`),
          * signing that device out without affecting the current one.
@@ -400,4 +444,4 @@ declare function memoryStorage(): TokenStorage;
 declare function localStorageAdapter(key?: string): TokenStorage;
 declare function defaultStorage(): TokenStorage;
 
-export { type Activity, type AuthEvent, type AuthStateListener, type AuthenticatorSetup, AuthyonClient, type AuthyonClientOptions, AuthyonError, type CreateOrganizationParams, ErrorCodes, type IntrospectResult, type InviteMemberParams, type LoginParams, type LoginResult, type Organization, type OrganizationMember, type PageParams, type RegisterParams, type Role, type Session, type SessionInfo, type SsoProvider, type TokenStorage, type TwoFactorChallenge, type TwoFactorMethod, type TwoFactorStatus, type TwoFactorVerifyParams, type User, type ValidateResult, type WebAuthnAssertion, type WebAuthnCeremonyStart, type WebAuthnCredential, createClient, defaultStorage, localStorageAdapter, memoryStorage };
+export { type Activity, type AuthEvent, type AuthStateListener, type AuthenticatorSetup, AuthyonClient, type AuthyonClientOptions, AuthyonError, type CreateOrganizationParams, ErrorCodes, type IntrospectResult, type InviteMemberParams, type LoginParams, type LoginResult, type Organization, type OrganizationMember, type Page, type PageParams, type RegisterParams, type Role, type Session, type SessionInfo, type SsoProvider, type TokenStorage, type TwoFactorChallenge, type TwoFactorMethod, type TwoFactorStatus, type TwoFactorVerifyParams, type User, type ValidateResult, type WebAuthnAssertion, type WebAuthnCeremonyStart, type WebAuthnCredential, createClient, defaultStorage, localStorageAdapter, memoryStorage };

package/dist/index.js

@@ -81,7 +81,7 @@ var AuthyonClient = class {
       loginFinish: (assertion) => this.request("/auth/webauthn/login/finish", {
         method: "POST",
         body: assertion
-      }).then((data) => this.setSession(data, "signed_in"))
+      }).then((data) => this.setSession({ tokens: data.tokens }, "signed_in")).then((session) => this.hydrateUser(session))
     };
     // ── Social sign-in (SSO) ─────────────────────────────────────────────────
     this.sso = {
@@ -102,9 +102,7 @@ var AuthyonClient = class {
        * POST /auth/sso/exchange — swaps the one-time code from the provider
        * callback for tokens and stores the session.
        */
-      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then(
-        (data) => this.setSession(data, "signed_in")
-      )
+      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then((data) => this.setSession({ tokens: data.tokens }, "signed_in")).then((session) => this.hydrateUser(session))
     };
     // ── User ─────────────────────────────────────────────────────────────────
     this.user = {
@@ -112,7 +110,7 @@ var AuthyonClient = class {
       me: () => this.request("/auth/me", { bearer: true }).then(normalizeUser),
       /** GET /auth/sessions — active refresh-token sessions with device/IP data. */
       sessions: () => this.request("/auth/sessions", { bearer: true }),
-      /** GET /auth/me/activities — recent account activity for the current user. */
+      /** GET /auth/me/activities — paginated recent account activity for the current user. */
       activities: (params = {}) => this.request(`/auth/me/activities?${toQuery(params)}`, { bearer: true }),
       /**
        * Revokes a single session by id (e.g. one entry from `sessions()`),
@@ -162,7 +160,7 @@ var AuthyonClient = class {
         method: "POST",
         bearer: true,
         body: { tenantSlug: organizationSlug }
-      }).then((data) => this.setSession(data, "refreshed")),
+      }).then((data) => this.setSession({ tokens: data.tokens }, "refreshed")).then((session) => this.hydrateUser(session)),
       /** The organization the current session is scoped to, from the cached session — no network call. */
       current: () => this.getSession()?.user?.activeOrganization ?? null,
       members: {
@@ -300,9 +298,9 @@ var AuthyonClient = class {
   }
   setSession(raw, event) {
     const session = {
-      ...raw,
+      ...raw.tokens,
       user: raw.user ? normalizeUser(raw.user) : void 0,
-      expiresAt: Date.now() + raw.expiresIn * 1e3
+      expiresAt: Date.now() + raw.tokens.expiresIn * 1e3
     };
     this.storage.set(session);
     this.emit(event === "signed_out" ? { type: "signed_out" } : { type: event, session });
@@ -312,6 +310,23 @@ var AuthyonClient = class {
     this.storage.clear();
     this.emit({ type: "signed_out" });
   }
+  /**
+   * `/auth/login` and the other endpoints that mint a session don't return
+   * a `user` object on the wire — only `tokens` (plus `twoFactor`, when a
+   * challenge is required). Fetch the profile right after so callers get a
+   * fully-populated `session.user` without an extra manual round trip.
+   * Best-effort: keeps the session usable even if this fetch fails.
+   */
+  async hydrateUser(session) {
+    try {
+      const user = await this.user.me();
+      const hydrated = { ...session, user };
+      this.storage.set(hydrated);
+      return hydrated;
+    } catch {
+      return session;
+    }
+  }
   // ── HTTP core ────────────────────────────────────────────────────────────
   async request(path, options = {}, isRetry = false) {
     const headers = {
@@ -363,20 +378,20 @@ var AuthyonClient = class {
   async login(params) {
     const { organizationSlug, ...rest } = params;
     const body = organizationSlug ? { ...rest, tenantSlug: organizationSlug } : rest;
-    const data = await this.request("/auth/login", {
-      method: "POST",
-      body
-    });
-    if (data.twoFactorRequired) {
-      return data;
+    const data = await this.request("/auth/login", { method: "POST", body });
+    if (data.twoFactor) {
+      return { twoFactorRequired: true, ...data.twoFactor };
     }
-    const session = this.setSession(data, "signed_in");
+    const session = await this.hydrateUser(this.setSession({ tokens: data.tokens }, "signed_in"));
     return { twoFactorRequired: false, session };
   }
   /** POST /auth/2fa/verify — redeems a 2FA challenge from `login()` and stores the session. */
   async verifyTwoFactor(params) {
-    const data = await this.request("/auth/2fa/verify", { method: "POST", body: params });
-    return this.setSession(data, "signed_in");
+    const data = await this.request("/auth/2fa/verify", {
+      method: "POST",
+      body: params
+    });
+    return this.hydrateUser(this.setSession({ tokens: data.tokens }, "signed_in"));
   }
   /** POST /auth/refresh — rotates the single-use refresh token (single-flight). */
   async refresh() {
@@ -388,7 +403,10 @@ var AuthyonClient = class {
       method: "POST",
       body: { refreshToken: current.refreshToken }
     }).then(
-      (data) => this.setSession({ user: current.user, ...data }, "refreshed")
+      (data) => this.setSession(
+        { tokens: data.tokens, user: current.user },
+        "refreshed"
+      )
     ).catch((error) => {
       if (error instanceof AuthyonError && (error.status === 401 || error.status === 403)) {
         this.clearSession();
@@ -440,11 +458,11 @@ var AuthyonClient = class {
   }
 };
 function normalizeUser(raw) {
-  const { tenants, activeTenant, ...rest } = raw;
+  const { tenant, tenants, activeTenant, ...rest } = raw;
   return {
     ...rest,
     organizations: raw.organizations ?? tenants,
-    activeOrganization: raw.activeOrganization ?? activeTenant ?? null
+    activeOrganization: tenant ?? raw.activeOrganization ?? activeTenant ?? null
   };
 }
 function createClient(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",