@authyon/auth 0.1.3

package/dist/index.js

@@ -0,0 +1,468 @@
+// src/errors.ts
+var AuthyonError = class extends Error {
+  constructor(status, body) {
+    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    this.name = "AuthyonError";
+    this.status = status;
+    this.code = body.code ?? "unknown";
+    this.title = body.title ?? "Error";
+    this.detail = body.detail;
+  }
+  is(code) {
+    return this.code === code;
+  }
+};
+var ErrorCodes = {
+  EmailTaken: "user.email_taken",
+  PasswordWeak: "user.password_weak",
+  PasswordPwned: "user.password_pwned"
+};
+
+// src/storage.ts
+var STORAGE_KEY = "authyon.session";
+function memoryStorage() {
+  let session = null;
+  return {
+    get: () => session,
+    set: (s) => {
+      session = s;
+    },
+    clear: () => {
+      session = null;
+    }
+  };
+}
+function localStorageAdapter(key = STORAGE_KEY) {
+  return {
+    get() {
+      try {
+        const raw = window.localStorage.getItem(key);
+        return raw ? JSON.parse(raw) : null;
+      } catch {
+        return null;
+      }
+    },
+    set(session) {
+      try {
+        window.localStorage.setItem(key, JSON.stringify(session));
+      } catch {
+      }
+    },
+    clear() {
+      try {
+        window.localStorage.removeItem(key);
+      } catch {
+      }
+    }
+  };
+}
+function defaultStorage() {
+  if (typeof window !== "undefined" && typeof window.localStorage !== "undefined") {
+    return localStorageAdapter();
+  }
+  return memoryStorage();
+}
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.authyon.com";
+var EXPIRY_SKEW_MS = 3e4;
+var AuthyonClient = class {
+  constructor(options) {
+    this.listeners = /* @__PURE__ */ new Set();
+    this.refreshInFlight = null;
+    // ── Passwordless (passkey) login ─────────────────────────────────────────
+    this.webauthn = {
+      /** POST /auth/webauthn/login/start — begins a passkey sign-in. */
+      loginStart: (email) => this.request("/auth/webauthn/login/start", { method: "POST", body: { email } }),
+      /**
+       * POST /auth/webauthn/login/finish — completes the passkey ceremony and
+       * stores the session.
+       */
+      loginFinish: (assertion) => this.request("/auth/webauthn/login/finish", {
+        method: "POST",
+        body: assertion
+      }).then((data) => this.setSession(data, "signed_in"))
+    };
+    // ── Social sign-in (SSO) ─────────────────────────────────────────────────
+    this.sso = {
+      /** GET /auth/sso/providers — providers enabled for this environment. */
+      providers: () => this.request("/auth/sso/providers"),
+      /**
+       * Builds the URL to redirect the browser to in order to start a
+       * provider's sign-in flow (`GET /auth/sso/{provider}/start`). Navigate
+       * to it directly — e.g. `window.location.href = client.sso.startUrl(...)`.
+       */
+      startUrl: (provider, params) => {
+        const query = new URLSearchParams({ redirect_uri: params.redirectUri });
+        if (params.state) query.set("state", params.state);
+        if (params.mode) query.set("mode", params.mode);
+        return `${this.baseUrl}/auth/sso/${encodeURIComponent(provider)}/start?${query}`;
+      },
+      /**
+       * POST /auth/sso/exchange — swaps the one-time code from the provider
+       * callback for tokens and stores the session.
+       */
+      exchange: (code) => this.request("/auth/sso/exchange", { method: "POST", body: { code } }).then(
+        (data) => this.setSession(data, "signed_in")
+      )
+    };
+    // ── User ─────────────────────────────────────────────────────────────────
+    this.user = {
+      /** GET /auth/me — fresh profile of the current user. */
+      me: () => this.request("/auth/me", { bearer: true }).then(normalizeUser),
+      /** GET /auth/sessions — active refresh-token sessions with device/IP data. */
+      sessions: () => this.request("/auth/sessions", { bearer: true }),
+      /** GET /auth/me/activities — recent account activity for the current user. */
+      activities: (params = {}) => this.request(`/auth/me/activities?${toQuery(params)}`, { bearer: true }),
+      /**
+       * Revokes a single session by id (e.g. one entry from `sessions()`),
+       * signing that device out without affecting the current one.
+       *
+       * ⚠️ Not directly confirmed against the published API reference at the
+       * time this SDK was written — `DELETE /auth/sessions/{id}` follows the
+       * REST convention the rest of the documented API uses, but verify it
+       * against the Authyon dashboard/API reference before relying on it. If
+       * the endpoint differs, override via a raw call to your own backend.
+       */
+      revokeSession: (sessionId) => this.request(`/auth/sessions/${encodeURIComponent(sessionId)}`, {
+        method: "DELETE",
+        bearer: true
+      }),
+      /** POST /auth/password-reset/request — always resolves (no account enumeration). */
+      requestPasswordReset: (email) => this.request("/auth/password-reset/request", { method: "POST", body: { email } }),
+      /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
+      confirmPasswordReset: (token, newPassword) => this.request("/auth/password-reset/confirm", {
+        method: "POST",
+        body: { token, newPassword }
+      })
+    };
+    // ── Organization ─────────────────────────────────────────────────────────
+    this.organization = {
+      /** GET /auth/tenants — all organization memberships. */
+      list: () => this.request("/auth/tenants", { bearer: true }),
+      /**
+       * POST /auth/tenants — creates an organization owned by the signed-in
+       * user (only available when self-service organization creation is
+       * enabled for the environment).
+       */
+      create: (params = {}) => this.request("/auth/tenants", { method: "POST", bearer: true, body: params }),
+      /** GET /auth/tenants/{organizationId} — fetch one of the user's organizations by id. */
+      get: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}`, { bearer: true }),
+      /**
+       * PATCH /auth/tenants/{organizationId} — renames the organization.
+       * Requires the `tenants:manage` custom permission on it.
+       */
+      rename: (organizationId, name) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}`, {
+        method: "PATCH",
+        bearer: true,
+        body: { name }
+      }),
+      /** POST /auth/switch-tenant — issues a fresh token scoped to the new organization. */
+      switch: (organizationSlug) => this.request("/auth/switch-tenant", {
+        method: "POST",
+        bearer: true,
+        body: { tenantSlug: organizationSlug }
+      }).then((data) => this.setSession(data, "refreshed")),
+      /** The organization the current session is scoped to, from the cached session — no network call. */
+      current: () => this.getSession()?.user?.activeOrganization ?? null,
+      members: {
+        /** GET /auth/tenants/{organizationId}/members — list an organization's members. */
+        list: (organizationId, params = {}) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/members?${toQuery(params)}`,
+          { bearer: true }
+        ),
+        /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+        invite: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, {
+          method: "POST",
+          bearer: true,
+          body: params
+        }),
+        /** DELETE /auth/tenants/{organizationId}/members/{userId} — remove a member. */
+        remove: (organizationId, userId) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/members/${encodeURIComponent(userId)}`,
+          { method: "DELETE", bearer: true }
+        )
+      },
+      roles: {
+        /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
+        list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/roles`, {
+          bearer: true
+        })
+      }
+    };
+    // ── Two-factor management (authenticated) ────────────────────────────────
+    this.twoFactor = {
+      /** GET /auth/2fa/status — enrolled methods and recovery code count. */
+      status: () => this.request("/auth/2fa/status", { bearer: true }),
+      /** POST /auth/2fa/resend-email — resends the code for an in-flight login challenge. */
+      resendEmail: (challengeToken) => this.request("/auth/2fa/resend-email", { method: "POST", body: { challengeToken } }),
+      /** POST /auth/2fa/authenticator/setup — returns secret, QR SVG and otpauth URI. */
+      setupAuthenticator: () => this.request("/auth/2fa/authenticator/setup", { method: "POST", bearer: true }),
+      /** POST /auth/2fa/authenticator/confirm — returns 10 single-use recovery codes. */
+      confirmAuthenticator: (code) => this.request("/auth/2fa/authenticator/confirm", {
+        method: "POST",
+        bearer: true,
+        body: { code }
+      }),
+      /**
+       * POST /auth/2fa/email/enable — two-step opt-in for email-based OTP.
+       * Call without `code` to receive one by e-mail, then call again with
+       * that code to confirm enrolment.
+       */
+      enableEmail: (code) => this.request("/auth/2fa/email/enable", { method: "POST", bearer: true, body: { code } }),
+      /** POST /auth/2fa/disable — turns off a specific 2FA method (requires current password). */
+      disable: (method, currentPassword) => this.request("/auth/2fa/disable", {
+        method: "POST",
+        bearer: true,
+        body: { method, currentPassword }
+      }),
+      /**
+       * POST /auth/2fa/recovery-codes/regenerate — rotates the 10 single-use
+       * recovery codes (requires current password).
+       */
+      regenerateRecoveryCodes: (currentPassword) => this.request("/auth/2fa/recovery-codes/regenerate", {
+        method: "POST",
+        bearer: true,
+        body: { currentPassword }
+      }),
+      webauthn: {
+        /** POST /auth/2fa/webauthn/register/start — begins passkey enrolment for 2FA. */
+        registerStart: () => this.request("/auth/2fa/webauthn/register/start", { method: "POST", bearer: true }),
+        /** POST /auth/2fa/webauthn/register/finish — finishes passkey enrolment. */
+        registerFinish: (ceremonyToken, attestationJson, nickname) => this.request("/auth/2fa/webauthn/register/finish", {
+          method: "POST",
+          bearer: true,
+          body: { ceremonyToken, attestationJson, nickname }
+        }),
+        /** GET /auth/2fa/webauthn/credentials — the caller's registered passkeys. */
+        credentials: () => this.request("/auth/2fa/webauthn/credentials", { bearer: true }),
+        /** PATCH /auth/2fa/webauthn/credentials/{id} — renames a passkey. */
+        renameCredential: (id, nickname) => this.request(`/auth/2fa/webauthn/credentials/${encodeURIComponent(id)}`, {
+          method: "PATCH",
+          bearer: true,
+          body: { nickname }
+        }),
+        /** DELETE /auth/2fa/webauthn/credentials/{id} — removes a passkey (requires current password). */
+        removeCredential: (id, currentPassword) => this.request(`/auth/2fa/webauthn/credentials/${encodeURIComponent(id)}`, {
+          method: "DELETE",
+          bearer: true,
+          body: { currentPassword }
+        }),
+        /**
+         * POST /auth/2fa/webauthn/assertion/start — fetches WebAuthn assertion
+         * options for an in-flight login challenge (2FA method `"webauthn"`).
+         */
+        assertionStart: (challengeToken) => this.request("/auth/2fa/webauthn/assertion/start", {
+          method: "POST",
+          body: { challengeToken }
+        })
+      }
+    };
+    if (!options.envKey)
+      throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
+    this.envKey = options.envKey;
+    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.storage = options.storage ?? defaultStorage();
+    this.autoRefresh = options.autoRefresh ?? true;
+    this.fetchImpl = options.fetch ?? fetch.bind(globalThis);
+  }
+  // ── Session state ────────────────────────────────────────────────────────
+  /** Current persisted session, or null when signed out. */
+  getSession() {
+    return this.storage.get();
+  }
+  isAuthenticated() {
+    return this.getSession() !== null;
+  }
+  /**
+   * Returns a valid access token, refreshing it transparently when it is
+   * expired or about to expire. Returns null when signed out.
+   */
+  async getAccessToken() {
+    const session = this.getSession();
+    if (!session) return null;
+    if (this.autoRefresh && Date.now() >= session.expiresAt - EXPIRY_SKEW_MS) {
+      try {
+        return (await this.refresh()).accessToken;
+      } catch {
+        return null;
+      }
+    }
+    return session.accessToken;
+  }
+  /** Subscribe to sign-in / refresh / sign-out events. Returns an unsubscribe fn. */
+  onAuthStateChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  emit(event) {
+    for (const listener of this.listeners) listener(event);
+  }
+  setSession(raw, event) {
+    const session = {
+      ...raw,
+      user: raw.user ? normalizeUser(raw.user) : void 0,
+      expiresAt: Date.now() + raw.expiresIn * 1e3
+    };
+    this.storage.set(session);
+    this.emit(event === "signed_out" ? { type: "signed_out" } : { type: event, session });
+    return session;
+  }
+  clearSession() {
+    this.storage.clear();
+    this.emit({ type: "signed_out" });
+  }
+  // ── HTTP core ────────────────────────────────────────────────────────────
+  async request(path, options = {}, isRetry = false) {
+    const headers = {
+      "X-Authyon-Environment": this.envKey,
+      ...options.headers
+    };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    if (options.bearer) {
+      const token = await this.getAccessToken();
+      if (!token)
+        throw new AuthyonError(401, { code: "auth.not_authenticated", title: "Not authenticated" });
+      headers.Authorization = `Bearer ${token}`;
+    }
+    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      method: options.method ?? "GET",
+      headers,
+      body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+    });
+    if (response.status === 401 && options.bearer && this.autoRefresh && !isRetry && this.getSession()) {
+      try {
+        await this.refresh();
+      } catch {
+        this.clearSession();
+        throw await this.toError(response);
+      }
+      return this.request(path, options, true);
+    }
+    if (!response.ok) throw await this.toError(response);
+    if (response.status === 204) return void 0;
+    return await response.json();
+  }
+  async toError(response) {
+    let body = {};
+    try {
+      body = await response.json();
+    } catch {
+    }
+    return new AuthyonError(response.status, body);
+  }
+  // ── Auth flows ───────────────────────────────────────────────────────────
+  /** POST /auth/register — creates a new user (rate-limited to 20/hour per IP). */
+  async register(params) {
+    return this.request("/auth/register", { method: "POST", body: params });
+  }
+  /**
+   * POST /auth/login — authenticates and stores the session, or returns a
+   * 2FA challenge to complete via `verifyTwoFactor()`.
+   */
+  async login(params) {
+    const { organizationSlug, ...rest } = params;
+    const body = organizationSlug ? { ...rest, tenantSlug: organizationSlug } : rest;
+    const data = await this.request("/auth/login", {
+      method: "POST",
+      body
+    });
+    if (data.twoFactorRequired) {
+      return data;
+    }
+    const session = this.setSession(data, "signed_in");
+    return { twoFactorRequired: false, session };
+  }
+  /** POST /auth/2fa/verify — redeems a 2FA challenge from `login()` and stores the session. */
+  async verifyTwoFactor(params) {
+    const data = await this.request("/auth/2fa/verify", { method: "POST", body: params });
+    return this.setSession(data, "signed_in");
+  }
+  /** POST /auth/refresh — rotates the single-use refresh token (single-flight). */
+  async refresh() {
+    if (this.refreshInFlight) return this.refreshInFlight;
+    const current = this.getSession();
+    if (!current)
+      throw new AuthyonError(401, { code: "auth.not_authenticated", title: "Not authenticated" });
+    this.refreshInFlight = this.request("/auth/refresh", {
+      method: "POST",
+      body: { refreshToken: current.refreshToken }
+    }).then(
+      (data) => this.setSession({ user: current.user, ...data }, "refreshed")
+    ).catch((error) => {
+      if (error instanceof AuthyonError && (error.status === 401 || error.status === 403)) {
+        this.clearSession();
+      }
+      throw error;
+    }).finally(() => {
+      this.refreshInFlight = null;
+    });
+    return this.refreshInFlight;
+  }
+  /**
+   * POST /auth/logout — revokes the current refresh token and clears local
+   * state. Pass `{ everywhere: true }` to revoke every session for the user.
+   */
+  async logout(options = {}) {
+    const session = this.getSession();
+    if (session) {
+      try {
+        if (options.everywhere) {
+          await this.request("/auth/logout", { method: "POST", bearer: true });
+        } else {
+          await this.request("/auth/logout", {
+            method: "POST",
+            body: { refreshToken: session.refreshToken }
+          });
+        }
+      } catch {
+      }
+    }
+    this.clearSession();
+  }
+  // ── Token verification ───────────────────────────────────────────────────
+  /** POST /auth/introspect — lightweight token introspection. */
+  async introspect(token) {
+    const accessToken = token ?? await this.getAccessToken();
+    return this.request("/auth/introspect", { method: "POST", body: { token: accessToken } });
+  }
+  /** POST /auth/validate — recommended: cross-checks DB state, returns user + organization. */
+  async validate(token) {
+    const accessToken = token ?? await this.getAccessToken();
+    const raw = await this.request("/auth/validate", {
+      method: "POST",
+      headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : void 0
+    });
+    return {
+      user: normalizeUser(raw.user),
+      organization: raw.organization ?? raw.tenant ?? null
+    };
+  }
+};
+function normalizeUser(raw) {
+  const { tenants, activeTenant, ...rest } = raw;
+  return {
+    ...rest,
+    organizations: raw.organizations ?? tenants,
+    activeOrganization: raw.activeOrganization ?? activeTenant ?? null
+  };
+}
+function createClient(options) {
+  return new AuthyonClient(options);
+}
+function toQuery(params) {
+  const query = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0) query.set(key, String(value));
+  }
+  return query.toString();
+}
+export {
+  AuthyonClient,
+  AuthyonError,
+  ErrorCodes,
+  createClient,
+  defaultStorage,
+  localStorageAdapter,
+  memoryStorage
+};

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@authyon/auth",
+  "version": "0.1.3",
+  "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
+    "typecheck": "tsc --noEmit"
+  },
+  "keywords": [
+    "authyon",
+    "auth",
+    "authentication",
+    "jwt",
+    "2fa",
+    "multi-tenant"
+  ],
+  "devDependencies": {
+    "tsup": "^8.0.0",
+    "typescript": "^5.5.0"
+  }
+}