@base316/react 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @base316/react
 
+## 0.7.0 — 2026-10-29
+
+Needs `@base316/sdk` 0.9.0 (`auth.methods`, `socialSignInUrl`), so release the SDK first.
+
+### Changed
+
+- **`<SignIn>` and `<SignUp>` follow the environment's sign-in settings.** They
+  read `GET /v1/auth/methods` and offer what the dashboard has switched on —
+  password, magic link, passkeys, text-message codes, social providers and SSO —
+  instead of what props turned on. Props can now only turn a method **off**
+  (`password`, `passkeys`, `magicLink`, `phone`, `social`, `sso` = `false`).
+  Two consequences to check when upgrading: passkeys appear only where the
+  environment allows them (they were on by default), and `phone` no longer turns
+  text messages on by itself. Until the answer arrives, or against an older API,
+  the form draws as before from its props.
+- A magic link lands on the page rendering the form unless
+  `magicLinkRedirectUrl` says otherwise (it must be on the redirect allow-list).
+
+### Added
+
+- Social sign-in buttons — "Continue with Google", "Continue with Apple" and the
+  rest — with each provider's mark and colours, on `<SignIn>` and `<SignUp>`,
+  when `socialRedirectUrl` names your server route that receives the `code`.
+  The button writes a `b316_oauth_state` cookie and sends the same value as
+  `state`; check them with `readOAuthState` before `exchangeCode`.
+  `socialState` carries a value of yours through.
+- `<SocialSignIn socialRedirectUrl>`: the same buttons alone, for a sign-in or
+  sign-up form an application draws itself (`intent="sign-up"` hides them when
+  the environment is closed to new accounts; `divider` draws the "or" rule).
+- "Sign in with SSO" on `<SignIn>` when an enterprise connection claims a
+  domain: the person types their work address and goes to their identity
+  provider.
+- `labels` on `<SignIn>` (`SignInLabels`) for every string it shows, and new
+  `continueWith`, `or` and `closed` on `<SignUp>`. A closed sign-up says so
+  instead of offering a form, unless the page carries an invitation.
+
 ## 0.6.0 — Unreleased
 
 Needs `@base316/sdk` 0.8.0 (`Base316Browser` `organizationId`), so release the SDK first.