@authyon/auth 0.2.0-beta.2 → 0.2.0-beta.20

package/dist/index.js

@@ -4,8 +4,40 @@ import {
   AuthyonSessionController,
   createAuthyonAbility,
   createAuthyonRules,
-  hasPermission
-} from "./chunk-EHZEUM47.js";
+  hasPermission,
+  hasPermissionGroup
+} from "./chunk-3XJY6BCI.js";
+
+// ../../internal/core/security/approvals.ts
+function path(id, suffix = "") {
+  if (typeof id !== "string" || !id.trim())
+    throw new TypeError("Authyon: an approval id is required.");
+  return `/auth/authorizations/${encodeURIComponent(id)}${suffix}`;
+}
+var NO_METHODS = {
+  password: false,
+  authenticator: false,
+  emailCode: false,
+  passkey: false,
+  passkeyCount: 0,
+  recoveryCodes: 0,
+  sso: [],
+  twoFactor: false
+};
+function subjectSecurity(request) {
+  return {
+    methods: async () => {
+      const me = await request("/auth/me");
+      return me.security ?? NO_METHODS;
+    },
+    approvals: {
+      get: (id) => request(path(id)),
+      webauthnOptions: (id) => request(path(id, "/webauthn/options"), { method: "POST" }),
+      confirm: (id, input) => request(path(id, "/confirm"), { method: "POST", body: input }),
+      reject: (id) => request(path(id, "/reject"), { method: "POST" })
+    }
+  };
+}
 
 // ../../internal/core/errors/authyonError.ts
 var ErrorCodes = {
@@ -19,16 +51,45 @@ var ErrorCodes = {
   EmailTaken: "user.email_taken",
   PasswordWeak: "user.password_weak",
   PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
+  RateLimited: "rate_limited",
+  StepUpRequired: "step_up_required",
+  InvalidSecondFactorCode: "invalid_code",
+  VerificationAttemptsExhausted: "verification_attempts_exhausted",
+  MethodNotEnrolled: "method_not_enrolled",
+  InvalidApprovalState: "invalid_authorization_state",
+  PayloadMismatch: "payload_mismatch",
+  ApprovalNotConsumable: "authorization_not_consumable",
+  IdempotencyConflict: "idempotency_conflict",
+  UserDisabled: "user_disabled",
+  UserNotFound: "user_not_found",
+  TemporarilyUnavailable: "temporarily_unavailable",
+  InsufficientScope: "insufficient_scope",
+  CredentialThrottled: "credential_throttled",
+  ApprovalNotFound: "authorization_not_found",
+  SessionRevoked: "session_revoked",
+  TwoFactorTooManyFailures: "user.2fa.too_many_failures"
 };
+var STANDARD_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "type",
+  "status",
+  "title",
+  "detail",
+  "code",
+  "error",
+  "error_description"
+]);
 var AuthyonError = class extends Error {
   constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    const detail = body.detail ?? body.error_description;
+    super(detail ?? body.title ?? `Authyon request failed with status ${status}`);
     this.name = "AuthyonError";
     this.status = status;
-    this.code = body.code ?? "unknown";
+    this.code = body.code ?? body.error ?? "unknown";
     this.title = body.title ?? "Error";
-    this.detail = body.detail;
+    this.detail = detail;
+    this.extensions = Object.fromEntries(
+      Object.entries(body).filter(([key]) => !STANDARD_ERROR_FIELDS.has(key))
+    );
     this.requestId = options.requestId;
     this.retryAfter = options.retryAfter;
     this.cause = options.cause;
@@ -78,6 +139,7 @@ var AuthyonError = class extends Error {
 };
 function classifyError(status, code) {
   if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.StepUpRequired) return "authentication";
   if (code === ErrorCodes.Timeout || status === 408) return "timeout";
   if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
   if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
@@ -171,14 +233,14 @@ var DEFAULT_BASE_URL = "https://api.authyon.com";
 var DEFAULT_EXPIRY_SKEW_MS = 3e4;
 
 // ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
+function appendQuery(path2, params) {
+  if (!params) return path2;
   const query = new URLSearchParams();
   for (const [key, value2] of Object.entries(params)) {
     if (value2 !== void 0) query.set(key, String(value2));
   }
   const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+  return value ? `${path2}${path2.includes("?") ? "&" : "?"}${value}` : path2;
 }
 
 // ../../internal/core/http/httpAdapter.ts
@@ -191,7 +253,8 @@ var FetchHttpAdapter = class {
       method: request.method,
       headers: request.headers,
       body: request.body,
-      signal: request.signal
+      signal: request.signal,
+      redirect: "error"
     });
   }
 };
@@ -243,6 +306,9 @@ function defaultHttpLogger(event) {
 }
 function sanitizeUrl(value) {
   const url = new URL(value);
+  url.username = "";
+  url.password = "";
+  url.hash = "";
   const queryKeys = /* @__PURE__ */ new Set();
   url.searchParams.forEach((_value, key) => queryKeys.add(key));
   url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
@@ -272,12 +338,12 @@ function createSharedTransport(options) {
   const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
   return {
     baseUrl,
-    async request(path, init) {
+    async request(path2, init) {
       const controller = new AbortController();
       const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
       try {
         return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
+          url: `${baseUrl}${path2}`,
           method: init.method ?? "GET",
           headers: normalizeHeaders(init.headers),
           body: init.body,
@@ -335,11 +401,11 @@ var JsonHttpClient = class {
   constructor(transport) {
     this.transport = transport;
   }
-  async send(path, options = {}) {
+  async send(path2, options = {}) {
     const headers = { ...options.headers };
     if (options.body !== void 0) headers["Content-Type"] = "application/json";
     try {
-      return await this.transport.request(appendQuery(path, options.query), {
+      return await this.transport.request(appendQuery(path2, options.query), {
         method: options.method ?? "GET",
         headers,
         body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
@@ -353,7 +419,9 @@ var JsonHttpClient = class {
     if (!response.ok) {
       let body = {};
       try {
-        body = await response.json();
+        const parsed = await response.json();
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+          body = parsed;
       } catch {
       }
       throw new AuthyonError(response.status, body, responseMetadata(response));
@@ -361,11 +429,33 @@ var JsonHttpClient = class {
     if (response.status === 204) return void 0;
     return await response.json();
   }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
+  async request(path2, options = {}) {
+    return this.parse(await this.send(path2, options));
   }
 };
 
+// ../../internal/core/http/clientIp.ts
+function clientIpHeaders(context) {
+  if (!context?.clientIp) return {};
+  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
+}
+function normalizeClientIp(value) {
+  let ip = value.trim();
+  if (ip.startsWith("[") && ip.endsWith("]")) ip = ip.slice(1, -1);
+  if (!ip || ip.length > 45 || ip.includes(",") || /[\r\n\s]/.test(ip) || !/^[0-9a-f:.]+$/i.test(ip) || !ip.includes(".") && !ip.includes(":")) {
+    throw invalidClientIp();
+  }
+  try {
+    new URL(ip.includes(":") ? `http://[${ip}]` : `http://${ip}`);
+  } catch {
+    throw invalidClientIp();
+  }
+  return ip;
+}
+function invalidClientIp() {
+  return new Error("Authyon: `clientIp` must be a single valid IPv4 or IPv6 address");
+}
+
 // src/client/authyonClient.ts
 var FALLBACK_EXPIRES_IN = 1800;
 function readTokens(raw) {
@@ -443,18 +533,41 @@ var AuthyonClient = class {
         method: "DELETE",
         bearer: true
       }),
-      /** POST /auth/password-reset/request — always resolves (no account enumeration). */
-      requestPasswordReset: (email) => this.request("/auth/password-reset/request", { method: "POST", body: { email } }),
-      /** POST /auth/password-reset/confirm — sets a new password and revokes all refresh tokens. */
-      confirmPasswordReset: (token, newPassword) => this.request("/auth/password-reset/confirm", {
+      /**
+       * POST /auth/password-reset/request — resolves whether or not the address
+       * has an account (no account enumeration). `redirectUri` is where the
+       * person lands after changing the password; it must be one of the
+       * environment's registered redirect URIs, or the call rejects with
+       * `user.password_reset.redirect_uri.not_allowed`.
+       */
+      requestPasswordReset: (email, options = {}) => this.request("/auth/password-reset/request", {
         method: "POST",
-        body: { token, newPassword }
-      })
+        body: { email, ...options }
+      }),
+      /**
+       * POST /auth/password-reset/validate — checks a reset token without
+       * spending it, so the reset page can refuse a dead link before asking for
+       * a password. Rejects with `user.password_reset.invalid` (401) when the
+       * token is unknown, used or expired.
+       */
+      validatePasswordReset: (token) => this.request("/auth/password-reset/validate", { method: "POST", body: { token } }),
+      /**
+       * POST /auth/password-reset/confirm — sets a new password and revokes all
+       * refresh tokens. Resolves with the `redirectUri` the reset was requested
+       * with (`null` when there was none); following it is up to the caller.
+       */
+      confirmPasswordReset: async (token, newPassword) => {
+        const done = await this.request(
+          "/auth/password-reset/confirm",
+          { method: "POST", body: { token, newPassword } }
+        );
+        return { redirectUri: done?.redirectUri ?? null };
+      }
     };
     // ── Organization ─────────────────────────────────────────────────────────
     this.organization = {
-      /** GET /auth/tenants — all organization memberships. */
-      list: () => this.request("/auth/tenants", { bearer: true }),
+      /** GET /auth/tenants — filterable list of organization memberships. */
+      list: (params = {}) => this.request(appendQuery("/auth/tenants", params), { bearer: true }),
       /**
        * POST /auth/tenants — creates an organization owned by the signed-in
        * user (only available when self-service organization creation is
@@ -491,7 +604,11 @@ var AuthyonClient = class {
           appendQuery(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, params),
           { bearer: true }
         ),
-        /** POST /auth/tenants/{organizationId}/members — invite a member by e-mail. */
+        /**
+         * POST /auth/tenants/{organizationId}/members — add an existing
+         * environment user by e-mail (no e-mail is sent). To invite an address
+         * that may not have an account yet, use `organization.invites.create`.
+         */
         invite: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/members`, {
           method: "POST",
           bearer: true,
@@ -503,6 +620,59 @@ var AuthyonClient = class {
           { method: "DELETE", bearer: true }
         )
       },
+      /**
+       * Invites by e-mail or by link. Managing them requires the
+       * `tenants:members:invite` permission on the organization; `preview` and
+       * `accept` are public — the token in the link is the credential.
+       */
+      invites: {
+        /** GET /auth/tenants/{organizationId}/invites — every invite with its status, newest first. */
+        list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          bearer: true
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites — invite an address.
+         * Always returns `acceptUrl`; with `sendEmail: false` Authyon does not
+         * mail it and you deliver the link yourself. The link is valid for 7
+         * days, once, and can't be read again later.
+         */
+        create: (organizationId, params) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/invites`, {
+          method: "POST",
+          bearer: true,
+          body: {
+            email: params.email,
+            roles: params.roles,
+            sendEmail: params.sendEmail ?? true,
+            redirectUri: params.redirectUri
+          }
+        }),
+        /**
+         * POST /auth/tenants/{organizationId}/invites/{inviteId}/resend — issue
+         * a new link (the previous one stops working), mailing it unless
+         * `sendEmail` is `false`.
+         */
+        resend: (organizationId, inviteId, params = {}) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}/resend`,
+          { method: "POST", bearer: true, body: { sendEmail: params.sendEmail ?? true } }
+        ),
+        /** DELETE /auth/tenants/{organizationId}/invites/{inviteId} — revoke a pending invite. */
+        revoke: (organizationId, inviteId) => this.request(
+          `/auth/tenants/${encodeURIComponent(organizationId)}/invites/${encodeURIComponent(inviteId)}`,
+          { method: "DELETE", bearer: true }
+        ),
+        /**
+         * POST /auth/tenant-invites/preview — public. Read the `token` query
+         * parameter of the invite link and pick the form: one click when
+         * `accountExists`, sign-up otherwise.
+         */
+        preview: (token) => this.request("/auth/tenant-invites/preview", { method: "POST", body: { token } }),
+        /**
+         * POST /auth/tenant-invites/accept — public. Joins the organization; for
+         * an address with no account, also creates it (password required) with
+         * the e-mail already confirmed. Does not sign the user in.
+         */
+        accept: (params) => this.request("/auth/tenant-invites/accept", { method: "POST", body: params })
+      },
       roles: {
         /** GET /auth/tenants/{organizationId}/roles — roles available in the organization. */
         list: (organizationId) => this.request(`/auth/tenants/${encodeURIComponent(organizationId)}/roles`, {
@@ -578,9 +748,20 @@ var AuthyonClient = class {
         })
       }
     };
+    // ── Security (customer side) ─────────────────────────────────────────────
+    /**
+     * `security.approvals`: approve or reject what your backend asked the
+     * customer to confirm (`@authyon/server` → `security.approvals.create`).
+     * Show the payload with `get()`, then `confirm()` with the customer's
+     * authenticator code or passkey, or `reject()`.
+     */
+    this.security = subjectSecurity(
+      (path2, options) => this.request(path2, { ...options, bearer: true })
+    );
     if (!options.envKey)
       throw new Error("Authyon: `envKey` is required (pk_live_... / pk_test_...)");
     this.envKey = options.envKey;
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -690,9 +871,10 @@ var AuthyonClient = class {
     }
   }
   // ── HTTP core ────────────────────────────────────────────────────────────
-  async request(path, options = {}, isRetry = false) {
+  async request(path2, options = {}, isRetry = false) {
     const headers = {
       "X-Authyon-Environment": this.envKey,
+      ...clientIpHeaders({ clientIp: this.clientIp }),
       ...options.headers
     };
     if (options.bearer) {
@@ -704,7 +886,7 @@ var AuthyonClient = class {
         });
       headers.Authorization = `Bearer ${token}`;
     }
-    const response = await this.http.send(path, { ...options, headers });
+    const response = await this.http.send(path2, { ...options, headers });
     if (response.status === 401 && options.bearer && this.autoRefresh && !isRetry && this.getSession()) {
       try {
         await this.refresh();
@@ -712,7 +894,7 @@ var AuthyonClient = class {
         this.clearSession();
         return this.http.parse(response);
       }
-      return this.request(path, options, true);
+      return this.request(path2, options, true);
     }
     return this.http.parse(response);
   }
@@ -857,6 +1039,10 @@ var AuthyonClientBuilder = class {
     this.options.autoRefresh = enabled;
     return this;
   }
+  withClientIp(clientIp) {
+    this.options.clientIp = clientIp;
+    return this;
+  }
   withTimeout(timeoutMs) {
     this.options.timeoutMs = timeoutMs;
     return this;
@@ -889,5 +1075,6 @@ export {
   createDefaultStorage,
   createLocalStorage,
   createMemoryStorage,
-  hasPermission
+  hasPermission,
+  hasPermissionGroup
 };

package/dist/react/index.d.cts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { U as User, B as SessionControllerOptions, A as AuthyonClient, E as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-g6nBpOQM.cjs';
-export { q as AuthyonSessionController, G as SessionSnapshotListener, J as SessionStatus } from '../ability-g6nBpOQM.cjs';
+import { ac as User, a1 as SessionControllerOptions, A as AuthyonClient, a3 as SessionSnapshot, a0 as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-BTcayvkM.cjs';
+export { w as AuthyonSessionController, a4 as SessionSnapshotListener, a5 as SessionStatus } from '../ability-BTcayvkM.cjs';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.d.ts

@@ -1,7 +1,7 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { U as User, B as SessionControllerOptions, A as AuthyonClient, E as SessionSnapshot, S as Session, f as AbilitySubject, n as AuthyonAbilityOptions, l as AuthyonAbility } from '../ability-g6nBpOQM.js';
-export { q as AuthyonSessionController, G as SessionSnapshotListener, J as SessionStatus } from '../ability-g6nBpOQM.js';
+import { ac as User, a1 as SessionControllerOptions, A as AuthyonClient, a3 as SessionSnapshot, a0 as Session, f as AbilitySubject, t as AuthyonAbilityOptions, r as AuthyonAbility } from '../ability-BTcayvkM.js';
+export { w as AuthyonSessionController, a4 as SessionSnapshotListener, a5 as SessionStatus } from '../ability-BTcayvkM.js';
 
 interface AuthyonProviderProps<TUser extends User = User> extends SessionControllerOptions {
     client: AuthyonClient;

package/dist/react/index.js

@@ -2,7 +2,7 @@
 import {
   AuthyonSessionController,
   createAuthyonAbility
-} from "../chunk-EHZEUM47.js";
+} from "../chunk-3XJY6BCI.js";
 
 // src/react/index.tsx
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/auth",
-  "version": "0.2.0-beta.2",
+  "version": "0.2.0-beta.20",
   "description": "Authyon SDK for browsers — auth, sessions, multi-tenant and 2FA for vanilla JS/TS.",
   "license": "MIT",
   "type": "module",