@baasix/sdk 0.2.0 → 0.2.1

package/README.md

@@ -202,6 +202,9 @@ const { user, token } = await baasix.auth.verifyMagicLink('verification-token');
 
 // Session type / tenant, so the tenant's web/mobile session limits apply
 await baasix.auth.verifyMagicLink(code, { authType: 'web', tenant_Id: 'tenant-uuid' });
+
+// Emailed code + email: wrong codes are counted and the code is burned after 5 tries
+await baasix.auth.verifyMagicLink(code, { email: 'user@example.com', authType: 'web' });
 ```
 
 ### Password Reset
@@ -221,6 +224,9 @@ await baasix.auth.forgotPassword({
 
 // Reset password with the token or emailed code
 await baasix.auth.resetPassword('reset-token-or-code', 'newpassword123');
+
+// With an emailed code, pass the email too (5-try limit per email)
+await baasix.auth.resetPassword('K7M2PQ9X', 'newSecurePassword', { email: 'user@example.com' });
 ```
 
 ### Change Password
@@ -1601,7 +1607,7 @@ try {
 }
 ```
 
-`error.message` is the server's reason, read from `error.message`, a top-level `message`, or a plain-string `error` (`{ "error": "Authentication required" }`), and falls back to the HTTP status text. `error.code` comes from `error.code` or a top-level `code`. `error.details` is set only when the server sends an array of details.
+`error.message` is the server's reason, read from `error.message`, a top-level `message`, or a plain-string `error` (`{ "error": "Authentication required" }`), and falls back to the HTTP status text. `error.code` comes from `error.code` or a top-level `code`. `error.details` is always an array: a details array from the server is passed through, and a string or object detail is wrapped (`[{ message: "…" }]` or `[{ code, errors }]`).
 
 A **401** with code `INVALID_SESSION` means the session is gone (logged out, expired, revoked or suspended user). With `autoRefresh` on, the SDK tries one token refresh and retries the request; if that fails, sign the user in again. A **503** `AUTH_UNAVAILABLE` is temporary — retry.
 

package/dist/index.cjs

@@ -195,7 +195,7 @@ var HttpClient = class {
     const message = errorObj?.message || errorData.message || (typeof errorData.error === "string" ? errorData.error : "") || response.statusText || "Request failed";
     const code = errorObj?.code ?? errorData.code;
     const rawDetails = errorObj?.details ?? errorData.details;
-    const details = Array.isArray(rawDetails) ? rawDetails : void 0;
+    const details = rawDetails == null ? void 0 : Array.isArray(rawDetails) ? rawDetails : typeof rawDetails === "object" ? [rawDetails] : [{ message: String(rawDetails) }];
     return new BaasixError(message, response.status, code, details);
   }
   /**
@@ -904,12 +904,20 @@ var AuthModule = class {
    *
    * // Enforce the tenant's web/mobile session limits for this sign-in
    * await baasix.auth.verifyMagicLink(code, { authType: 'web', tenant_Id });
+   *
+   * // Emailed code + email: wrong codes are counted and the code is burned after 5
+   * await baasix.auth.verifyMagicLink(code, { email: 'user@example.com', authType: 'web' });
    * ```
    */
   async verifyMagicLink(token, opts) {
-    const response = await this.client.get(
+    const { email, ...params } = opts || {};
+    const response = email ? await this.client.post(
+      "/auth/magiclink/verify",
+      { email, code: token, ...params },
+      { skipAuth: true }
+    ) : await this.client.get(
       `/auth/magiclink/${encodeURIComponent(token)}`,
-      { skipAuth: true, params: opts }
+      { skipAuth: true, params }
     );
     await this.storeTokens(response);
     this.emitAuthStateChange("SIGNED_IN", response.user);
@@ -950,9 +958,20 @@ var AuthModule = class {
    * @example
    * ```typescript
    * await baasix.auth.resetPassword('reset-token-or-code', 'newpassword123');
+   *
+   * // Emailed code + email: wrong codes are counted and the code is burned after 5
+   * await baasix.auth.resetPassword('K7M2PQ9X', 'newpassword123', { email: 'user@example.com' });
    * ```
    */
-  async resetPassword(token, newPassword) {
+  async resetPassword(token, newPassword, opts) {
+    if (opts?.email) {
+      await this.client.post(
+        "/auth/password/reset/verify",
+        { email: opts.email, code: token, password: newPassword },
+        { skipAuth: true }
+      );
+      return;
+    }
     await this.client.post(
       `/auth/password/reset/${encodeURIComponent(token)}`,
       { password: newPassword },