@benmore/bm 2.7.311 → 2.7.313

package/index.js

@@ -45,7 +45,7 @@ async function request(method, path, body, options) {
     }
   }
   observeSessionResponse(method, path, res.ok, data);
-  return { ok: res.ok, status: res.status, data };
+  return { ok: res.ok, status: res.status, data, redirected: !!res.redirected, url: res.url || '' };
 }
 
 // apiError builds the Error a failed request throws. The framework's JSON
@@ -200,9 +200,51 @@ async function refreshMe() {
 async function signIn(identifier, password) {
   const res = await request('POST', '/login', { email: identifier, password });
   if (!res.ok) throw apiError(res, 'Invalid credentials');
+  const step = signInStepURL('/login', res, _pageLocation());
+  if (step) return _goToSignInStep(step);
   return res.data?.user || null;
 }
 
+// A sign-in or sign-up that still needs a second step (the emailed or texted
+// code with auth.otp, an authenticator code with MFA) has not made a session:
+// the server answers {otp_required: true, redirect} (or mfa_required), or
+// redirects the request to the step's page. signInStepURL returns that page,
+// same-origin and carrying the current page's ?next=, else null (also when
+// there is no page: outside a browser the calls resolve null as before).
+// Callers send the browser there, as a form post would, and do not return: code written as
+// `await bm.auth.signIn(...); location.href = '/'` would otherwise leave the
+// person on a page with no session and the code already emailed.
+function signInStepURL(path, res, loc) {
+  if (!loc || typeof loc.assign !== 'function') return null;
+  const data = res && res.data;
+  let to = '';
+  if (data && typeof data === 'object' && (data.otp_required || data.mfa_required) && typeof data.redirect === 'string') {
+    to = data.redirect;
+  } else if (res && res.redirected && typeof res.url === 'string' && loc.origin && res.url.startsWith(loc.origin + '/')) {
+    const target = res.url.slice(loc.origin.length);
+    if (target.split(/[?#]/, 1)[0] !== String(path).split(/[?#]/, 1)[0]) to = target;
+  }
+  if (!to || to[0] !== '/' || to[1] === '/' || to[1] === '\\') return null;
+  const m = /[?&]next=([^&#]*)/.exec(loc.search || '');
+  if (m && !/[?&]next=/.test(to)) {
+    let next = '';
+    try { next = decodeURIComponent(m[1].replace(/\+/g, ' ')); } catch { next = ''; }
+    if (next[0] === '/' && next[1] !== '/' && next[1] !== '\\') to += (to.includes('?') ? '&' : '?') + 'next=' + encodeURIComponent(next);
+  }
+  return to;
+}
+
+function _pageLocation() {
+  return typeof location === 'undefined' ? null : location;
+}
+
+// The page is leaving for the step; the caller's code after the await must
+// not run, so the promise never settles.
+function _goToSignInStep(url) {
+  location.assign(url);
+  return new Promise(() => {});
+}
+
 // signUp - POST /signup. Pass any extra signup_fields (configured in
 // app.yaml's `auth.signup_fields`) as additional keys on the object:
 //   await bm.auth.signUp({ email, password, first_name: 'Ada' })
@@ -211,6 +253,8 @@ async function signUp(fields) {
   if (!res.ok) {
     throw apiError(res, 'Sign-up failed');
   }
+  const step = signInStepURL('/signup', res, _pageLocation());
+  if (step) return _goToSignInStep(step);
   return res.data?.user || null;
 }
 
@@ -285,6 +329,10 @@ const passkey = {
         userHandle: r.userHandle ? _bufToB64u(r.userHandle) : '',
       },
     }, 'Passkey sign-in failed');
+    // With auth.otp the passkey proves the account and the emailed code
+    // still has to be entered before there is a session.
+    const step = signInStepURL('/api/_auth/passkeys/login', { data }, _pageLocation());
+    if (step) return _goToSignInStep(step);
     return data.user || null;
   },
   async list() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@benmore/bm",
-  "version": "2.7.311",
+  "version": "2.7.313",
   "description": "Zero-dependency browser SDK for external Benmore frontends",
   "type": "module",
   "module": "./index.js",