@baasix/sdk 0.1.19 → 0.1.21

package/dist/index.d.cts

@@ -3,7 +3,7 @@ export { a as HttpClientConfig, R as RequestOptions } from './client-BHbM3KOy.cj
 import { S as StorageAdapter } from './types-BdjsGANq.cjs';
 export { a as STORAGE_KEYS, b as StorageKey } from './types-BdjsGANq.cjs';
 import { AuthModule } from './modules/auth.cjs';
-export { InviteOptions, OAuthOptions, OAuthProvider, VerifyInviteResult } from './modules/auth.cjs';
+export { AuthMethods, InviteOptions, LoginResult, OAuthOptions, OAuthProvider, SOCIAL_PROVIDERS, TwoFactorChallengeResponse, TwoFactorEnableResult, VerifyInviteResult } from './modules/auth.cjs';
 import { ItemsModule } from './modules/items.cjs';
 export { ImportResult, QueryBuilder } from './modules/items.cjs';
 import { FilesModule } from './modules/files.cjs';
@@ -318,9 +318,21 @@ declare class PermissionsModule {
      *   action: 'update',
      *   fields: ['title', 'content', 'status'],
      *   conditions: {
-     *     author_Id: { eq: '$CURRENT_USER' }
+     *     author_Id: { eq: '$CURRENT_USER' }      // USING: which rows may be updated
+     *   },
+     *   checkConditions: {
+     *     author_Id: { eq: '$CURRENT_USER' }      // WITH CHECK: what they may become
      *   }
      * });
+     *
+     * // Create grants use checkConditions (conditions is rejected on create):
+     * await baasix.permissions.create({
+     *   role_Id: 'user-role-uuid',
+     *   collection: 'tasks',
+     *   action: 'create',
+     *   fields: ['*'],
+     *   checkConditions: { owner_Id: { eq: '$CURRENT_USER' } }
+     * });
      * ```
      */
     create(data: CreatePermissionData): Promise<Permission>;
@@ -360,17 +372,18 @@ declare class PermissionsModule {
      * @example
      * ```typescript
      * await baasix.permissions.createCrudPermissions('role-uuid', 'products', {
-     *   create: { fields: ['name', 'price', 'description'] },
+     *   create: { fields: ['name', 'price'], checkConditions: { owner_Id: { eq: '$CURRENT_USER' } } },
      *   read: { fields: ['*'] },
-     *   update: { fields: ['name', 'price', 'description'] },
+     *   update: { fields: ['name', 'price'], conditions: { owner_Id: { eq: '$CURRENT_USER' } } },
      *   delete: false
      * });
      * ```
      */
     createCrudPermissions(roleId: string, collection: string, config: {
+        /** Create grants scope writes via checkConditions — `conditions` is rejected by the API on create. */
         create?: {
             fields?: string[];
-            conditions?: Permission["conditions"];
+            checkConditions?: Permission["checkConditions"];
         } | false;
         read?: {
             fields?: string[];
@@ -379,6 +392,7 @@ declare class PermissionsModule {
         update?: {
             fields?: string[];
             conditions?: Permission["conditions"];
+            checkConditions?: Permission["checkConditions"];
         } | false;
         delete?: {
             conditions?: Permission["conditions"];

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { a as HttpClientConfig, R as RequestOptions } from './client-D67LK80v.js
 import { S as StorageAdapter } from './types-BdjsGANq.js';
 export { a as STORAGE_KEYS, b as StorageKey } from './types-BdjsGANq.js';
 import { AuthModule } from './modules/auth.js';
-export { InviteOptions, OAuthOptions, OAuthProvider, VerifyInviteResult } from './modules/auth.js';
+export { AuthMethods, InviteOptions, LoginResult, OAuthOptions, OAuthProvider, SOCIAL_PROVIDERS, TwoFactorChallengeResponse, TwoFactorEnableResult, VerifyInviteResult } from './modules/auth.js';
 import { ItemsModule } from './modules/items.js';
 export { ImportResult, QueryBuilder } from './modules/items.js';
 import { FilesModule } from './modules/files.js';
@@ -318,9 +318,21 @@ declare class PermissionsModule {
      *   action: 'update',
      *   fields: ['title', 'content', 'status'],
      *   conditions: {
-     *     author_Id: { eq: '$CURRENT_USER' }
+     *     author_Id: { eq: '$CURRENT_USER' }      // USING: which rows may be updated
+     *   },
+     *   checkConditions: {
+     *     author_Id: { eq: '$CURRENT_USER' }      // WITH CHECK: what they may become
      *   }
      * });
+     *
+     * // Create grants use checkConditions (conditions is rejected on create):
+     * await baasix.permissions.create({
+     *   role_Id: 'user-role-uuid',
+     *   collection: 'tasks',
+     *   action: 'create',
+     *   fields: ['*'],
+     *   checkConditions: { owner_Id: { eq: '$CURRENT_USER' } }
+     * });
      * ```
      */
     create(data: CreatePermissionData): Promise<Permission>;
@@ -360,17 +372,18 @@ declare class PermissionsModule {
      * @example
      * ```typescript
      * await baasix.permissions.createCrudPermissions('role-uuid', 'products', {
-     *   create: { fields: ['name', 'price', 'description'] },
+     *   create: { fields: ['name', 'price'], checkConditions: { owner_Id: { eq: '$CURRENT_USER' } } },
      *   read: { fields: ['*'] },
-     *   update: { fields: ['name', 'price', 'description'] },
+     *   update: { fields: ['name', 'price'], conditions: { owner_Id: { eq: '$CURRENT_USER' } } },
      *   delete: false
      * });
      * ```
      */
     createCrudPermissions(roleId: string, collection: string, config: {
+        /** Create grants scope writes via checkConditions — `conditions` is rejected by the API on create. */
         create?: {
             fields?: string[];
-            conditions?: Permission["conditions"];
+            checkConditions?: Permission["checkConditions"];
         } | false;
         read?: {
             fields?: string[];
@@ -379,6 +392,7 @@ declare class PermissionsModule {
         update?: {
             fields?: string[];
             conditions?: Permission["conditions"];
+            checkConditions?: Permission["checkConditions"];
         } | false;
         delete?: {
             conditions?: Permission["conditions"];

package/dist/index.js

@@ -190,7 +190,7 @@ var HttpClient = class {
     } catch {
     }
     const message = errorData.error?.message || errorData.message || response.statusText || "Request failed";
-    const code = errorData.error?.code;
+    const code = errorData.error?.code ?? errorData.code;
     const details = errorData.details;
     return new BaasixError(message, response.status, code, details);
   }
@@ -474,17 +474,123 @@ var MemoryStorageAdapter = class {
 };
 
 // src/modules/auth.ts
+var SOCIAL_PROVIDERS = ["apple", "atlassian", "cognito", "discord", "dropbox", "facebook", "figma", "github", "gitlab", "google", "huggingface", "kakao", "kick", "line", "linear", "linkedin", "microsoft", "naver", "notion", "paybin", "paypal", "polar", "railway", "reddit", "roblox", "salesforce", "slack", "spotify", "tiktok", "twitch", "twitter", "vercel", "vk", "wechat", "zoom"];
 var AuthModule = class {
   client;
   storage;
   authMode;
   onAuthStateChange;
   currentUser = null;
+  authMethodsCache = null;
+  /**
+   * Two-factor authentication (TOTP) helpers.
+   *
+   * @example
+   * ```typescript
+   * const result = await baasix.auth.login({ email, password });
+   * if ("twoFactorRequired" in result && result.twoFactorRequired) {
+   *   const { user, token } = await baasix.auth.twoFactor.verify(result.twoFactorToken, code);
+   * }
+   * ```
+   */
+  twoFactor;
+  /**
+   * Passkey (WebAuthn) registration and authentication helpers.
+   * Browser-only: throws a `BaasixError` when called outside a browser
+   * environment (no `window`/`PublicKeyCredential`).
+   *
+   * @example
+   * ```typescript
+   * // Register a passkey for the currently logged-in user
+   * await baasix.auth.passkey.register("My Laptop");
+   *
+   * // Authenticate with a passkey (no prior login required)
+   * const { user, token } = await baasix.auth.passkey.authenticate();
+   *
+   * // List and remove registered passkeys
+   * const passkeys = await baasix.auth.passkey.list();
+   * await baasix.auth.passkey.remove(passkeys[0].id);
+   * ```
+   */
+  passkey = {
+    register: async (name) => {
+      this.assertBrowser();
+      const { startRegistration } = await import('@simplewebauthn/browser');
+      const options = await this.client.post("/auth/passkey/register/options", {});
+      const attestation = await startRegistration({ optionsJSON: options });
+      await this.client.post("/auth/passkey/register/verify", {
+        response: attestation,
+        name: name || null
+      });
+      return { verified: true };
+    },
+    authenticate: async (opts) => {
+      this.assertBrowser();
+      const { startAuthentication } = await import('@simplewebauthn/browser');
+      const { options, challengeId } = await this.client.post(
+        "/auth/passkey/authenticate/options",
+        {},
+        { skipAuth: true }
+      );
+      const assertion = await startAuthentication({ optionsJSON: options });
+      const response = await this.client.post(
+        "/auth/passkey/authenticate/verify",
+        { challengeId, response: assertion, authMode: opts?.authMode },
+        { skipAuth: true }
+      );
+      await this.storeTokens(response);
+      this.emitAuthStateChange("SIGNED_IN", response.user);
+      return response;
+    },
+    list: async () => (await this.client.get("/auth/passkey")).passkeys,
+    remove: async (id) => {
+      await this.client.delete(`/auth/passkey/${encodeURIComponent(id)}`);
+    }
+  };
   constructor(config) {
     this.client = config.client;
     this.storage = config.storage;
     this.authMode = config.authMode;
     this.onAuthStateChange = config.onAuthStateChange;
+    this.twoFactor = {
+      verify: async (twoFactorToken, code, opts) => {
+        const response = await this.client.post(
+          "/auth/2fa/verify",
+          {
+            twoFactorToken,
+            code,
+            authMode: opts?.authMode,
+            authType: opts?.authType
+          },
+          { skipAuth: true }
+        );
+        await this.storeTokens(response);
+        this.emitAuthStateChange("SIGNED_IN", response.user);
+        return response;
+      },
+      enable: () => {
+        return this.client.post("/auth/2fa/enable");
+      },
+      verifySetup: (code) => {
+        return this.client.post("/auth/2fa/verify-setup", {
+          code
+        });
+      },
+      disable: (password) => {
+        return this.client.post("/auth/2fa/disable", {
+          password
+        });
+      }
+    };
+  }
+  /**
+   * Assert that we're running in a browser environment with WebAuthn support.
+   * Throws a `BaasixError` otherwise.
+   */
+  assertBrowser() {
+    if (typeof window === "undefined" || !window.PublicKeyCredential) {
+      throw new BaasixError("Passkeys are only available in a browser", 400);
+    }
   }
   /**
    * Emit an authentication state change event
@@ -581,9 +687,39 @@ var AuthModule = class {
       },
       { skipAuth: true }
     );
-    await this.storeTokens(response);
-    this.emitAuthStateChange("SIGNED_IN", response.user);
-    return response;
+    if ("twoFactorRequired" in response && response.twoFactorRequired) {
+      return response;
+    }
+    const authResponse = response;
+    await this.storeTokens(authResponse);
+    this.emitAuthStateChange("SIGNED_IN", authResponse.user);
+    return authResponse;
+  }
+  /**
+   * Discover which authentication methods are enabled for this project
+   * (registration, email/password, magic link, passkey, 2FA, and the list
+   * of configured social/OAuth providers). Result is cached per instance;
+   * pass `force: true` to bypass the cache and refetch.
+   *
+   * @example
+   * ```typescript
+   * const methods = await baasix.auth.getAuthMethods();
+   * if (methods.socialProviders.includes("google")) {
+   *   // show "Sign in with Google"
+   * }
+   * ```
+   */
+  async getAuthMethods(force = false) {
+    if (this.authMethodsCache && !force) {
+      return this.authMethodsCache;
+    }
+    const response = await this.client.get(
+      "/",
+      { skipAuth: true }
+    );
+    const authMethods = response?.project?.auth;
+    this.authMethodsCache = authMethods;
+    return authMethods;
   }
   /**
    * Logout the current user
@@ -2572,9 +2708,21 @@ var PermissionsModule = class {
    *   action: 'update',
    *   fields: ['title', 'content', 'status'],
    *   conditions: {
-   *     author_Id: { eq: '$CURRENT_USER' }
+   *     author_Id: { eq: '$CURRENT_USER' }      // USING: which rows may be updated
+   *   },
+   *   checkConditions: {
+   *     author_Id: { eq: '$CURRENT_USER' }      // WITH CHECK: what they may become
    *   }
    * });
+   *
+   * // Create grants use checkConditions (conditions is rejected on create):
+   * await baasix.permissions.create({
+   *   role_Id: 'user-role-uuid',
+   *   collection: 'tasks',
+   *   action: 'create',
+   *   fields: ['*'],
+   *   checkConditions: { owner_Id: { eq: '$CURRENT_USER' } }
+   * });
    * ```
    */
   async create(data) {
@@ -2632,9 +2780,9 @@ var PermissionsModule = class {
    * @example
    * ```typescript
    * await baasix.permissions.createCrudPermissions('role-uuid', 'products', {
-   *   create: { fields: ['name', 'price', 'description'] },
+   *   create: { fields: ['name', 'price'], checkConditions: { owner_Id: { eq: '$CURRENT_USER' } } },
    *   read: { fields: ['*'] },
-   *   update: { fields: ['name', 'price', 'description'] },
+   *   update: { fields: ['name', 'price'], conditions: { owner_Id: { eq: '$CURRENT_USER' } } },
    *   delete: false
    * });
    * ```
@@ -2645,12 +2793,15 @@ var PermissionsModule = class {
     for (const action of actions) {
       const actionConfig = config[action];
       if (actionConfig === false) continue;
+      const cfg = actionConfig;
       const permission = await this.create({
         role_Id: roleId,
         collection,
         action,
-        fields: actionConfig?.fields || ["*"],
-        conditions: actionConfig?.conditions
+        fields: cfg?.fields || ["*"],
+        // `conditions` filters existing rows (USING) — never sent for create
+        conditions: action === "create" ? void 0 : cfg?.conditions,
+        checkConditions: action === "create" || action === "update" ? cfg?.checkConditions : void 0
       });
       permissions.push(permission);
     }
@@ -5086,6 +5237,6 @@ function createBaasix(config) {
   return new Baasix(config);
 }
 
-export { AsyncStorageAdapter, AuthModule, Baasix, BaasixError, FilesModule, HttpClient, ItemsModule, LocalStorageAdapter, MemoryStorageAdapter, MigrationsModule, NotificationsModule, PermissionsModule, QueryBuilder, RealtimeChannel, RealtimeModule, ReportsModule, RolesModule, STORAGE_KEYS, SchemasModule, SettingsModule, UsersModule, WorkflowsModule, createBaasix };
+export { AsyncStorageAdapter, AuthModule, Baasix, BaasixError, FilesModule, HttpClient, ItemsModule, LocalStorageAdapter, MemoryStorageAdapter, MigrationsModule, NotificationsModule, PermissionsModule, QueryBuilder, RealtimeChannel, RealtimeModule, ReportsModule, RolesModule, SOCIAL_PROVIDERS, STORAGE_KEYS, SchemasModule, SettingsModule, UsersModule, WorkflowsModule, createBaasix };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map