@binary1702/auth 0.3.0 → 0.4.0

package/dist/react/index.d.ts

@@ -1,6 +1,7 @@
 import { type ReactNode } from "react";
 import { type Authorization, type Organization, type Session } from "../core/org.ts";
-export type { Session, Organization, Authorization };
+import type { SignupPolicy } from "../core/signup.ts";
+export type { Session, Organization, Authorization, SignupPolicy };
 export type AuthState = {
     user: Session["user"] | null;
     organization: Organization | null;
@@ -9,6 +10,8 @@ export type AuthState = {
     loading: boolean;
     /** Re-fetch GET /auth/session (after switching organization, for instance) */
     refresh: () => Promise<void>;
+    /** May this user do that? For showing and hiding UI; the server still checks with requirePermission(). */
+    can: (permission: string) => boolean;
 };
 export declare function fetchSession(): Promise<Session | null>;
 export declare function AuthProvider(props: {
@@ -16,3 +19,54 @@ export declare function AuthProvider(props: {
     children: ReactNode;
 }): import("react").FunctionComponentElement<import("react").ProviderProps<AuthState | null>>;
 export declare function useAuth(): AuthState;
+/**
+ * What a sign-in or sign-up attempt comes back with.
+ *   ok, verify false    signed in; go to `next` (checked by the server: same origin only)
+ *   ok, verify true     account created, no session yet: "check your email"
+ *   not ok              `error` is the message to show; `status` 401 wrong password,
+ *                       403 cross-site / wrong invite / email not verified, 404 sign-up closed,
+ *                       409 email taken, 429 too many tries (`retryAfter` seconds)
+ */
+export type AuthResult = {
+    ok: true;
+    user: Session["user"];
+    next: string;
+    verify: boolean;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    verify: boolean;
+    retryAfter?: number;
+};
+/** POST /auth/sign-in. On success the cookie is set; navigate to `next`. */
+export declare function signIn(input: {
+    email: string;
+    password: string;
+    next?: string;
+}): Promise<AuthResult>;
+/** POST /auth/sign-up. `invite` when the policy requires it. */
+export declare function signUp(input: {
+    email: string;
+    password: string;
+    invite?: string;
+    next?: string;
+}): Promise<AuthResult>;
+/** POST /auth/sign-out: clears the cookie. Then navigate somewhere public (or link to /auth/sign-out?next=/). */
+export declare function signOut(): Promise<void>;
+/** What a sign-in or sign-up page needs to know before it renders. */
+export type Policy = {
+    /** May anyone sign up right now, is an invite code required, and is this the first account? */
+    signup: SignupPolicy;
+    /** Where the pages are: the app's own (b17_auth.yaml `pages:`) or the package's */
+    pages: {
+        signIn: string;
+        signUp: string;
+    };
+    /** The signed-in home (b17_auth.yaml `home:`), else "/" */
+    home: string;
+    /** The app name from b17_auth.yaml, if set */
+    name?: string;
+};
+/** GET /auth/policy */
+export declare function fetchPolicy(): Promise<Policy>;

package/dist/react/index.js

@@ -10,10 +10,23 @@
 //   const { user, organization, authorization } = useAuth()
 //
 // Signed out: user and organization are null, permissions are empty.
+//
+// For an app that draws its own sign-in / sign-up pages (b17_auth.yaml
+// `pages:`), the protocol as functions. The package decides what is
+// valid, where to go next and when to refuse; the page only renders:
+//
+//   const r = await signIn({ email, password, next })
+//   r.ok ? location.assign(r.next) : setError(r.error)
+//
+//   const { signup } = await fetchPolicy()   // may anyone sign up right now? first account?
 // ─────────────────────────────────────────────────────────────
 import { createContext, createElement, useCallback, useContext, useEffect, useState } from "react";
-import { NO_SESSION } from "../core/org.js";
+import { NO_SESSION, hasPermission } from "../core/org.js";
 const SESSION_URL = "/auth/session";
+const SIGN_IN_URL = "/auth/sign-in";
+const SIGN_UP_URL = "/auth/sign-up";
+const SIGN_OUT_URL = "/auth/sign-out";
+const POLICY_URL = "/auth/policy";
 const Ctx = createContext(null);
 export async function fetchSession() {
     const res = await fetch(SESSION_URL, { credentials: "same-origin", cache: "no-store" });
@@ -38,12 +51,14 @@ export function AuthProvider(props) {
         else
             void refresh();
     }, [provided, props.session, refresh]);
+    const authorization = session?.authorization ?? NO_SESSION.authorization;
     const value = {
         user: session?.user ?? NO_SESSION.user,
         organization: session?.organization ?? NO_SESSION.organization,
-        authorization: session?.authorization ?? NO_SESSION.authorization,
+        authorization,
         loading,
         refresh,
+        can: (permission) => hasPermission({ authorization }, permission),
     };
     return createElement(Ctx.Provider, { value }, props.children);
 }
@@ -53,3 +68,40 @@ export function useAuth() {
         throw new Error("useAuth() needs an <AuthProvider> above it");
     return ctx;
 }
+async function attempt(url, body) {
+    const res = await fetch(url, {
+        method: "POST",
+        credentials: "same-origin",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+    });
+    const data = (await res.json().catch(() => ({})));
+    if (res.ok && data.user)
+        return { ok: true, user: data.user, next: data.next ?? "/", verify: data.verify === true };
+    return {
+        ok: false,
+        status: res.status,
+        error: data.error ?? (data.verify ? "Check your email for a verification link, then sign in." : "Something went wrong. Try again."),
+        verify: data.verify === true,
+        retryAfter: data.retryAfter,
+    };
+}
+/** POST /auth/sign-in. On success the cookie is set; navigate to `next`. */
+export function signIn(input) {
+    return attempt(SIGN_IN_URL, input);
+}
+/** POST /auth/sign-up. `invite` when the policy requires it. */
+export function signUp(input) {
+    return attempt(SIGN_UP_URL, input);
+}
+/** POST /auth/sign-out: clears the cookie. Then navigate somewhere public (or link to /auth/sign-out?next=/). */
+export async function signOut() {
+    await fetch(SIGN_OUT_URL, { method: "POST", credentials: "same-origin", headers: { "content-type": "application/json" }, body: "{}" });
+}
+/** GET /auth/policy */
+export async function fetchPolicy() {
+    const res = await fetch(POLICY_URL, { credentials: "same-origin", cache: "no-store" });
+    if (!res.ok)
+        throw new Error(`GET ${POLICY_URL} answered ${res.status}`);
+    return (await res.json());
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@binary1702/auth",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Email + password auth for Next.js. One command: npx @binary1702/auth",
   "type": "module",
   "repository": {
@@ -42,7 +42,8 @@
   "scripts": {
     "build": "tsc",
     "prepublishOnly": "npm run build",
-    "test": "node --test tests/*.test.ts"
+    "test": "node --test tests/*.test.ts",
+    "dev": "npx next dev demo -p 3002"
   },
   "dependencies": {
     "@neondatabase/serverless": "^1.1.0",