@camstack/addon-auth 1.1.4 → 1.1.6

package/dist/{dist-JUeAGU3c.mjs → dist-BlBNW5nA.mjs}

@@ -16401,10 +16401,32 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -16457,6 +16479,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+			verified: boolean(),
+			userId: string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(object({
 			userId: string(),
@@ -16465,6 +16500,15 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: method(object({ userId: string() }), object({ enabled: boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: method(object({
+			userId: string(),
+			enabled: boolean()
+		}), object({ success: literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -22959,6 +23003,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22971,12 +23021,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22989,6 +23051,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",
@@ -23241,4 +23309,4 @@ object({
 	schemaVersion: literal(1)
 });
 //#endregion
-export { loginMethodCapability as a, BaseAddon as c, string as d, buildAddonRouteProvider as i, array as l, addonWidgetsSourceCapability as n, userPasskeysCapability as o, authProviderCapability as r, errMsg as s, addonRoutesCapability as t, object as u };
+export { loginMethodCapability as a, BaseAddon as c, number as d, object as f, buildAddonRouteProvider as i, array as l, addonWidgetsSourceCapability as n, userPasskeysCapability as o, string as p, authProviderCapability as r, errMsg as s, addonRoutesCapability as t, boolean as u };

package/dist/{dist-BLBS0d1z.js → dist-CS-GzG-v.js}

@@ -16401,10 +16401,32 @@ method(_void(), array(TurnServerSchema).readonly());
 *      b. `finishAuthentication({userId, response})` → server verifies
 *         the assertion, bumps the credential counter, returns ok.
 *
+*   2b. Usernameless (discoverable-credential) authentication — the
+*       passkey IS the primary factor, no password leg:
+*       a. `beginDiscoverableAuthentication({})` → assertion options with
+*          EMPTY `allowCredentials` (the browser offers every resident
+*          passkey it holds for this RP) + `userVerification: 'required'`
+*          (the passkey replaces both factors, so UV is mandatory).
+*          The challenge is stored server-side, NOT bound to any user.
+*       b. `finishDiscoverableAuthentication({response})` → the provider
+*          resolves the credential by the response's credential id,
+*          verifies the assertion against the stored challenge + that
+*          credential's public key/counter, and returns the OWNING
+*          `userId` — the caller (core auth router) mints the session.
+*
 *   3. Management:
 *      - `listPasskeys({userId})` — enumerate user's enrolled credentials.
 *      - `removePasskey({userId, credentialId})` — revoke one credential.
 *
+*   4. Second-factor preference (opt-in, default OFF):
+*      Enrolling a passkey only enables passkey-FIRST sign-in. It is
+*      demanded as a second factor after a password login ONLY when the
+*      user explicitly opts in via `setSecondFactorPreference`.
+*      - `getSecondFactorPreference({userId})` → `{ enabled }` (missing
+*        row ⇒ `enabled: false`).
+*      - `setSecondFactorPreference({userId, enabled})` — persisted by
+*        the providing addon beside its credentials.
+*
 * Challenges are short-lived (5 min, in-memory). The cap is internal —
 * the admin-ui composes the begin/finish round-trip and never exposes
 * the cap to non-admins.
@@ -16457,6 +16479,19 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			access: "view"
 		}),
+		beginDiscoverableAuthentication: method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
+			kind: "mutation",
+			access: "view"
+		}),
+		finishDiscoverableAuthentication: method(object({ 
+		/** AuthenticationResponseJSON from the browser. */
+response: record(string(), unknown()) }), object({
+			verified: boolean(),
+			userId: string().nullable()
+		}), {
+			kind: "mutation",
+			access: "view"
+		}),
 		listPasskeys: method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(object({
 			userId: string(),
@@ -16465,6 +16500,15 @@ var userPasskeysCapability = {
 			kind: "mutation",
 			auth: "admin",
 			access: "delete"
+		}),
+		getSecondFactorPreference: method(object({ userId: string() }), object({ enabled: boolean() }), { auth: "admin" }),
+		setSecondFactorPreference: method(object({
+			userId: string(),
+			enabled: boolean()
+		}), object({ success: literal(true) }), {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
 		})
 	}
 };
@@ -22959,6 +23003,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.beginDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.beginRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22971,12 +23021,24 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"userPasskeys.finishDiscoverableAuthentication": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.finishRegistration": {
 		capName: "user-passkeys",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
+	"userPasskeys.getSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userPasskeys.listPasskeys": {
 		capName: "user-passkeys",
 		capScope: "system",
@@ -22989,6 +23051,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userPasskeys.setSecondFactorPreference": {
+		capName: "user-passkeys",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"vacuumControl.locate": {
 		capName: "vacuum-control",
 		capScope: "device",
@@ -23271,6 +23339,12 @@ Object.defineProperty(exports, "authProviderCapability", {
 		return authProviderCapability;
 	}
 });
+Object.defineProperty(exports, "boolean", {
+	enumerable: true,
+	get: function() {
+		return boolean;
+	}
+});
 Object.defineProperty(exports, "buildAddonRouteProvider", {
 	enumerable: true,
 	get: function() {
@@ -23289,6 +23363,12 @@ Object.defineProperty(exports, "loginMethodCapability", {
 		return loginMethodCapability;
 	}
 });
+Object.defineProperty(exports, "number", {
+	enumerable: true,
+	get: function() {
+		return number;
+	}
+});
 Object.defineProperty(exports, "object", {
 	enumerable: true,
 	get: function() {

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BLBS0d1z.js");
+const require_dist = require("../dist-CS-GzG-v.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-JUeAGU3c.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BlBNW5nA.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-BLBS0d1z.js");
+const require_dist = require("../dist-CS-GzG-v.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-JUeAGU3c.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-BlBNW5nA.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/_stub.js

@@ -414,7 +414,17 @@ function B(e) {
 	let n = a(), l = r({
 		queryKey: ["auth", "listOwnPasskeys"],
 		queryFn: () => n.listOwnPasskeys()
-	}), u = l.data ?? [], [d, f] = t(""), [p, m] = t(!1), [h, g] = t(null), S = async () => {
+	}), u = l.data ?? [], [d, f] = t(""), [p, m] = t(!1), [h, g] = t(null), S = r({
+		queryKey: ["auth", "getOwnPasskeySecondFactorPreference"],
+		queryFn: () => n.getOwnPasskeySecondFactorPreference(),
+		enabled: u.length > 0
+	}), C = S.data?.enabled ?? !1, w = i({
+		mutationFn: (e) => n.setOwnPasskeySecondFactorPreference({ enabled: e }),
+		onSuccess: () => {
+			g(null), S.refetch();
+		},
+		onError: (e) => g(e instanceof Error ? e.message : "Could not update the preference")
+	}), T = async () => {
 		g(null), m(!0);
 		try {
 			let e = await z((await n.beginOwnPasskeyRegistration()).optionsJSON);
@@ -427,7 +437,7 @@ function B(e) {
 		} finally {
 			m(!1);
 		}
-	}, C = i({
+	}, E = i({
 		mutationFn: (e) => n.removeOwnPasskey({ credentialId: e }),
 		onSuccess: () => {
 			g(null), l.refetch();
@@ -447,7 +457,7 @@ function B(e) {
 			children: [
 				/* @__PURE__ */ o("div", {
 					className: "text-xs text-foreground-subtle",
-					children: "Add a passkey (Touch ID, Windows Hello, or a security key) as a phishing-resistant second factor. You'll be prompted for it at every login."
+					children: "Add a passkey (Touch ID, Windows Hello, or a security key) to sign in directly — fast and phishing-resistant, no password needed."
 				}),
 				l.isLoading ? /* @__PURE__ */ s("div", {
 					className: "flex items-center gap-2 text-xs text-foreground-subtle",
@@ -473,8 +483,8 @@ function B(e) {
 								})]
 							}),
 							/* @__PURE__ */ s("button", {
-								onClick: () => C.mutate(e.credentialId),
-								disabled: C.isPending,
+								onClick: () => E.mutate(e.credentialId),
+								disabled: E.isPending,
 								className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[11px] text-danger hover:bg-danger/10 disabled:opacity-50",
 								children: [/* @__PURE__ */ o(x, { className: "h-3 w-3" }), "Remove"]
 							})
@@ -484,6 +494,28 @@ function B(e) {
 					className: "text-[11px] text-foreground-subtle",
 					children: "No passkeys enrolled yet."
 				}),
+				u.length > 0 && /* @__PURE__ */ s("div", {
+					className: "flex items-start justify-between gap-3 rounded-md border border-border px-3 py-2.5",
+					children: [/* @__PURE__ */ s("div", {
+						className: "min-w-0",
+						children: [/* @__PURE__ */ o("div", {
+							className: "text-xs font-medium text-foreground",
+							children: "Require passkey as second factor"
+						}), /* @__PURE__ */ o("div", {
+							className: "text-[10px] text-foreground-subtle mt-0.5",
+							children: "Also ask for a passkey after every password sign-in. Off by default — enrolling a passkey on its own only enables direct passkey sign-in."
+						})]
+					}), /* @__PURE__ */ o("button", {
+						type: "button",
+						role: "switch",
+						"aria-checked": C,
+						"aria-label": "Require passkey as second factor",
+						onClick: () => w.mutate(!C),
+						disabled: S.isLoading || w.isPending,
+						className: `relative inline-flex h-5 w-9 shrink-0 items-center rounded-full transition-colors disabled:opacity-50 ${C ? "bg-primary" : "bg-foreground-subtle/30"}`,
+						children: /* @__PURE__ */ o("span", { className: `inline-block h-3.5 w-3.5 rounded-full bg-white shadow transition-transform ${C ? "translate-x-[18px]" : "translate-x-[3px]"}` })
+					})]
+				}),
 				h && /* @__PURE__ */ s("div", {
 					className: "text-[11px] text-danger flex items-center gap-1",
 					children: [/* @__PURE__ */ o(_, { className: "h-3 w-3" }), h]
@@ -503,7 +535,7 @@ function B(e) {
 							className: "w-full rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground focus:outline-none focus:ring-1 focus:ring-primary"
 						})]
 					}), /* @__PURE__ */ o("button", {
-						onClick: S,
+						onClick: T,
 						disabled: p,
 						className: "inline-flex items-center gap-1.5 rounded-lg bg-primary px-3 py-2 text-xs font-semibold text-primary-foreground hover:opacity-90 disabled:opacity-50",
 						children: p ? /* @__PURE__ */ s(c, { children: [/* @__PURE__ */ o(b, { className: "h-3.5 w-3.5 animate-spin" }), "Enrolling…"] }) : /* @__PURE__ */ s(c, { children: [/* @__PURE__ */ o(v, { className: "h-3.5 w-3.5" }), "Add passkey"] })
@@ -559,10 +591,90 @@ function H(e) {
 	});
 }
 //#endregion
-//#region src/webauthn/widgets/index.tsx
+//#region src/webauthn/widgets/direct-login-i18n.ts
 var U = {
+	en: {
+		signInWithPasskey: "Sign in with a passkey",
+		unsupported: "This browser does not support passkeys.",
+		failed: "Passkey sign-in failed",
+		secondFactorRequired: "Additional verification is required — sign in with your password to continue."
+	},
+	it: {
+		signInWithPasskey: "Accedi con una passkey",
+		unsupported: "Questo browser non supporta le passkey.",
+		failed: "Accesso con passkey non riuscito",
+		secondFactorRequired: "È richiesta una verifica aggiuntiva — accedi con la password per continuare."
+	}
+};
+function W(e) {
+	return (e ?? globalThis.navigator?.language ?? "en").toLowerCase().split("-")[0] === "it" ? "it" : "en";
+}
+function G(e, t) {
+	return U[e][t];
+}
+//#endregion
+//#region src/webauthn/widgets/PasskeyDirectLogin.tsx
+function K(e) {
+	if (!e) return null;
+	let t = e.onComplete, n = e.onSecondFactor, r = e.onError, i = e.locale;
+	return typeof t == "function" ? {
+		onComplete: t,
+		onSecondFactor: typeof n == "function" ? n : void 0,
+		onError: typeof r == "function" ? r : void 0,
+		locale: typeof i == "string" ? i : void 0
+	} : null;
+}
+function q(e) {
+	let n = a(), r = K(e.config), [i, c] = t(!1), [l, u] = t(null), d = W(r?.locale);
+	return r ? L() ? /* @__PURE__ */ s("div", {
+		className: "space-y-2",
+		children: [/* @__PURE__ */ s("button", {
+			type: "button",
+			"data-testid": "login-passkey-direct",
+			onClick: async () => {
+				u(null), c(!0);
+				try {
+					let e = await R((await n.passkeyLoginBegin()).optionsJSON), t = await n.passkeyLoginFinish(e), i = t.secondFactors ?? (t.requiresTotp === !0 ? ["totp"] : []);
+					if (i.length > 0) {
+						if (r.onSecondFactor) r.onSecondFactor({
+							challengeToken: t.token,
+							factors: i
+						});
+						else {
+							let e = G(d, "secondFactorRequired");
+							u(e), r.onError?.(e);
+						}
+						return;
+					}
+					r.onComplete(t.token);
+				} catch (e) {
+					let t = e instanceof Error ? e.message : G(d, "failed");
+					u(t), r.onError?.(t);
+				} finally {
+					c(!1);
+				}
+			},
+			disabled: i,
+			className: "w-full flex items-center justify-center gap-2 rounded-lg border border-border bg-surface px-4 py-2.5 text-sm font-medium text-foreground hover:bg-surface-hover disabled:opacity-50 transition-colors",
+			children: [i ? /* @__PURE__ */ o(b, { className: "h-4 w-4 animate-spin text-primary" }) : /* @__PURE__ */ o(v, { className: "h-4 w-4 text-primary" }), G(d, "signInWithPasskey")]
+		}), l && /* @__PURE__ */ o("div", {
+			className: "rounded-md bg-danger/10 border border-danger/20 px-3 py-2 text-xs text-danger",
+			children: l
+		})]
+	}) : /* @__PURE__ */ o("div", {
+		className: "rounded-lg border border-border bg-surface px-3 py-2 text-xs text-foreground-subtle",
+		children: G(d, "unsupported")
+	}) : /* @__PURE__ */ o("div", {
+		className: "rounded-lg border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning",
+		children: "Passkey direct-login widget requires an onComplete callback."
+	});
+}
+//#endregion
+//#region src/webauthn/widgets/index.tsx
+var J = {
 	"passkey-enrollment": B,
-	"passkey-login": H
+	"passkey-login": H,
+	"passkey-direct-login": q
 };
 //#endregion
-export { U as default };
+export { J as default };

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Bg_T1-iY.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Du23U8IZ.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.1.20",
+		version: "1.1.22",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.1.36",
+		version: "1.1.39",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",