@baasix/sdk 0.1.22 → 0.2.1

package/README.md

@@ -199,6 +199,12 @@ await baasix.auth.sendMagicLink({
 
 // Verify (after user clicks link)
 const { user, token } = await baasix.auth.verifyMagicLink('verification-token');
+
+// Session type / tenant, so the tenant's web/mobile session limits apply
+await baasix.auth.verifyMagicLink(code, { authType: 'web', tenant_Id: 'tenant-uuid' });
+
+// Emailed code + email: wrong codes are counted and the code is burned after 5 tries
+await baasix.auth.verifyMagicLink(code, { email: 'user@example.com', authType: 'web' });
 ```
 
 ### Password Reset
@@ -218,6 +224,9 @@ await baasix.auth.forgotPassword({
 
 // Reset password with the token or emailed code
 await baasix.auth.resetPassword('reset-token-or-code', 'newpassword123');
+
+// With an emailed code, pass the email too (5-try limit per email)
+await baasix.auth.resetPassword('K7M2PQ9X', 'newSecurePassword', { email: 'user@example.com' });
 ```
 
 ### Change Password
@@ -1598,6 +1607,10 @@ try {
 }
 ```
 
+`error.message` is the server's reason, read from `error.message`, a top-level `message`, or a plain-string `error` (`{ "error": "Authentication required" }`), and falls back to the HTTP status text. `error.code` comes from `error.code` or a top-level `code`. `error.details` is always an array: a details array from the server is passed through, and a string or object detail is wrapped (`[{ message: "…" }]` or `[{ code, errors }]`).
+
+A **401** with code `INVALID_SESSION` means the session is gone (logged out, expired, revoked or suspended user). With `autoRefresh` on, the SDK tries one token refresh and retries the request; if that fails, sign the user in again. A **503** `AUTH_UNAVAILABLE` is temporary — retry.
+
 ## TypeScript Support
 
 ### Shared Types from @baasix/types

package/dist/index.cjs

@@ -191,9 +191,11 @@ var HttpClient = class {
       errorData = await response.json();
     } catch {
     }
-    const message = errorData.error?.message || errorData.message || response.statusText || "Request failed";
-    const code = errorData.error?.code ?? errorData.code;
-    const details = errorData.details;
+    const errorObj = typeof errorData.error === "object" && errorData.error !== null ? errorData.error : void 0;
+    const message = errorObj?.message || errorData.message || (typeof errorData.error === "string" ? errorData.error : "") || response.statusText || "Request failed";
+    const code = errorObj?.code ?? errorData.code;
+    const rawDetails = errorObj?.details ?? errorData.details;
+    const details = rawDetails == null ? void 0 : Array.isArray(rawDetails) ? rawDetails : typeof rawDetails === "object" ? [rawDetails] : [{ message: String(rawDetails) }];
     return new BaasixError(message, response.status, code, details);
   }
   /**
@@ -899,12 +901,23 @@ var AuthModule = class {
    * @example
    * ```typescript
    * const { user, token } = await baasix.auth.verifyMagicLink('verification-token');
+   *
+   * // Enforce the tenant's web/mobile session limits for this sign-in
+   * await baasix.auth.verifyMagicLink(code, { authType: 'web', tenant_Id });
+   *
+   * // Emailed code + email: wrong codes are counted and the code is burned after 5
+   * await baasix.auth.verifyMagicLink(code, { email: 'user@example.com', authType: 'web' });
    * ```
    */
-  async verifyMagicLink(token) {
-    const response = await this.client.get(
-      `/auth/magiclink/${encodeURIComponent(token)}`,
+  async verifyMagicLink(token, opts) {
+    const { email, ...params } = opts || {};
+    const response = email ? await this.client.post(
+      "/auth/magiclink/verify",
+      { email, code: token, ...params },
       { skipAuth: true }
+    ) : await this.client.get(
+      `/auth/magiclink/${encodeURIComponent(token)}`,
+      { skipAuth: true, params }
     );
     await this.storeTokens(response);
     this.emitAuthStateChange("SIGNED_IN", response.user);
@@ -945,9 +958,20 @@ var AuthModule = class {
    * @example
    * ```typescript
    * await baasix.auth.resetPassword('reset-token-or-code', 'newpassword123');
+   *
+   * // Emailed code + email: wrong codes are counted and the code is burned after 5
+   * await baasix.auth.resetPassword('K7M2PQ9X', 'newpassword123', { email: 'user@example.com' });
    * ```
    */
-  async resetPassword(token, newPassword) {
+  async resetPassword(token, newPassword, opts) {
+    if (opts?.email) {
+      await this.client.post(
+        "/auth/password/reset/verify",
+        { email: opts.email, code: token, password: newPassword },
+        { skipAuth: true }
+      );
+      return;
+    }
     await this.client.post(
       `/auth/password/reset/${encodeURIComponent(token)}`,
       { password: newPassword },