@bunbase-ae/js 3.1.1-next.408.4c3055e → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunbase-ae/js",
-  "version": "3.1.1-next.408.4c3055e",
+  "version": "3.2.0",
   "type": "module",
   "description": "TypeScript/JavaScript SDK for BunBase",
   "license": "UNLICENSED",

package/src/admin.ts

@@ -257,6 +257,18 @@ export interface ServerSettings {
   auth_totp_enabled?: boolean;
   auth_oauth_enabled?: boolean;
   auth_api_keys_enabled?: boolean;
+  // Phone / SMS OTP auth method (issue #680).
+  auth_phone_otp_enabled?: boolean;
+  auth_phone_otp_code_length?: number;
+  auth_phone_otp_ttl_seconds?: number;
+  auth_phone_otp_max_attempts?: number;
+  auth_phone_otp_resend_cooldown_seconds?: number;
+  auth_phone_otp_rate_limit_per_phone?: number;
+  auth_phone_otp_rate_limit_per_ip?: number;
+  auth_phone_otp_auto_provision?: boolean;
+  auth_phone_otp_sms_provider?: string;
+  auth_phone_otp_sms_webhook_url?: string;
+  auth_phone_otp_sms_webhook_secret?: string;
   oauth_github_client_id?: string;
   oauth_github_client_secret?: string;
   oauth_google_client_id?: string;

package/src/auth.ts

@@ -181,6 +181,36 @@ export class AuthClient {
     return result;
   }
 
+  // Request an SMS one-time code for a phone number (issue #680). The response
+  // never reveals whether the number maps to an account. Pass the returned
+  // `request_id` plus the received code to verifyPhoneOtp() to complete sign-in.
+  async requestPhoneOtp(phone: string): Promise<{
+    request_id: string;
+    expires_in: number;
+    resend_after: number;
+  }> {
+    return await this.http.request<{
+      request_id: string;
+      expires_in: number;
+      resend_after: number;
+    }>("POST", "/api/v1/auth/phone-otp/request", {
+      body: { phone },
+      skipAuth: true,
+    });
+  }
+
+  // Complete phone-OTP sign-in by exchanging the code for the token pair.
+  async verifyPhoneOtp(requestId: string, code: string): Promise<AuthResult> {
+    const result = await this.http.request<AuthResult>("POST", "/api/v1/auth/phone-otp/verify", {
+      body: { request_id: requestId, code },
+      skipAuth: true,
+    });
+    this.cachedUser = result.user;
+    this.patchSnapshot({ user: result.user });
+    this.http.setTokens(result.access_token, result.refresh_token);
+    return result;
+  }
+
   // Redeem an OAuth handoff code for the token pair.
   //
   // The OAuth callback redirects to `{APP_URL}/auth/callback?handoff=<code>`.