@dloizides/auth-web 1.8.1 → 1.9.0

package/dist/index.d.mts

@@ -345,6 +345,13 @@ interface PasskeyLoginLabels {
     errorCancelled: string;
     /** Error banner when the ceremony failed. */
     errorFailed: string;
+    /**
+     * The "try another way" affordance shown after an in-page ceremony error — it
+     * hands off to the Keycloak-hosted passkey/password flow. This is the seam that
+     * rescues a user whose credential is only enrolled in Keycloak (not the in-page
+     * RP store): the in-page ceremony can't see it, so they fall back to KC.
+     */
+    tryAnotherWay: string;
 }
 /** Strings rendered by `<PasskeySettingsCard>` — the account passkey card. */
 interface PasskeySettingsLabels {
@@ -1301,6 +1308,7 @@ declare const AuthTestIds: {
     readonly passkeyLogin: "auth-passkey-login";
     readonly passkeyLoginButton: "auth-passkey-login-button";
     readonly passkeyLoginError: "auth-passkey-login-error";
+    readonly passkeyLoginFallback: "auth-passkey-login-fallback";
     readonly passkeySettings: "auth-passkey-settings";
     readonly passkeySettingsAdd: "auth-passkey-settings-add";
     readonly passkeySettingsSuccess: "auth-passkey-settings-success";
@@ -1768,6 +1776,13 @@ interface UsePasskeyCeremonyResult {
     isSupported: boolean;
     /** Start the ceremony (or redirect-fallback when the RP is off / unsupported). */
     start: () => void;
+    /**
+     * Hand off to the legacy Keycloak redirect explicitly. Wired to the "try
+     * another way" affordance a surface shows after an in-page error — the escape
+     * hatch for a credential enrolled only in Keycloak (invisible to the in-page
+     * RP store), which the in-page ceremony cannot use.
+     */
+    fallbackToRedirect: () => void;
     /** Clear a terminal state so the affordance can be retried. */
     reset: () => void;
 }

package/dist/index.d.ts

@@ -345,6 +345,13 @@ interface PasskeyLoginLabels {
     errorCancelled: string;
     /** Error banner when the ceremony failed. */
     errorFailed: string;
+    /**
+     * The "try another way" affordance shown after an in-page ceremony error — it
+     * hands off to the Keycloak-hosted passkey/password flow. This is the seam that
+     * rescues a user whose credential is only enrolled in Keycloak (not the in-page
+     * RP store): the in-page ceremony can't see it, so they fall back to KC.
+     */
+    tryAnotherWay: string;
 }
 /** Strings rendered by `<PasskeySettingsCard>` — the account passkey card. */
 interface PasskeySettingsLabels {
@@ -1301,6 +1308,7 @@ declare const AuthTestIds: {
     readonly passkeyLogin: "auth-passkey-login";
     readonly passkeyLoginButton: "auth-passkey-login-button";
     readonly passkeyLoginError: "auth-passkey-login-error";
+    readonly passkeyLoginFallback: "auth-passkey-login-fallback";
     readonly passkeySettings: "auth-passkey-settings";
     readonly passkeySettingsAdd: "auth-passkey-settings-add";
     readonly passkeySettingsSuccess: "auth-passkey-settings-success";
@@ -1768,6 +1776,13 @@ interface UsePasskeyCeremonyResult {
     isSupported: boolean;
     /** Start the ceremony (or redirect-fallback when the RP is off / unsupported). */
     start: () => void;
+    /**
+     * Hand off to the legacy Keycloak redirect explicitly. Wired to the "try
+     * another way" affordance a surface shows after an in-page error — the escape
+     * hatch for a credential enrolled only in Keycloak (invisible to the in-page
+     * RP store), which the in-page ceremony cannot use.
+     */
+    fallbackToRedirect: () => void;
     /** Clear a terminal state so the affordance can be retried. */
     reset: () => void;
 }

package/dist/index.js

@@ -236,7 +236,8 @@ var DEFAULT_PASSKEY_LOGIN_LABELS = {
   signInButton: "Sign in with a passkey",
   signInHint: "Use your fingerprint, face, or security key to sign in",
   errorCancelled: "Passkey sign-in was cancelled. You can try again or sign in another way.",
-  errorFailed: "Passkey sign-in didn't work. Try again, or sign in another way."
+  errorFailed: "Passkey sign-in didn't work. Try again, or sign in another way.",
+  tryAnotherWay: "Sign in another way"
 };
 var DEFAULT_PASSKEY_SETTINGS_LABELS = {
   title: "Passkeys",
@@ -338,6 +339,7 @@ var AuthTestIds = {
   passkeyLogin: "auth-passkey-login",
   passkeyLoginButton: "auth-passkey-login-button",
   passkeyLoginError: "auth-passkey-login-error",
+  passkeyLoginFallback: "auth-passkey-login-fallback",
   // Passkey settings card
   passkeySettings: "auth-passkey-settings",
   passkeySettingsAdd: "auth-passkey-settings-add",
@@ -2746,6 +2748,10 @@ function usePasskeyCeremony(optionsArg) {
         const envelope = await optionsResponse.json();
         const credential = await runCeremony(mode, envelope);
         if (credential === null) {
+          if (mode === "login" /* Login */) {
+            redirectFallback(mode, returnUrl);
+            return;
+          }
           setStatus("error" /* Error */);
           setError(ERROR_FAILED);
           return;
@@ -2777,13 +2783,16 @@ function usePasskeyCeremony(optionsArg) {
       }
     })();
   }, [isSupported, mode, returnUrl, succeed]);
+  const fallbackToRedirect = react.useCallback(() => {
+    redirectFallback(mode, returnUrl);
+  }, [mode, returnUrl]);
   const reset = react.useCallback(() => {
     setStatus("idle" /* Idle */);
     setError(null);
   }, []);
   return react.useMemo(
-    () => ({ status, error, isSupported, start, reset }),
-    [status, error, isSupported, start, reset]
+    () => ({ status, error, isSupported, start, fallbackToRedirect, reset }),
+    [status, error, isSupported, start, fallbackToRedirect, reset]
   );
 }
 var DEFAULT_RETURN_URL = "/";
@@ -2802,14 +2811,27 @@ function PasskeyLoginButton({
   const ceremony = usePasskeyCeremony({ mode: "login" /* Login */, returnUrl });
   const error = ceremony.error ?? readPasskeyError();
   return /* @__PURE__ */ jsxRuntime.jsxs(reactNative.View, { testID: withTestIdPrefix(AuthTestIds.passkeyLogin, testIdPrefix), children: [
-    error !== null ? /* @__PURE__ */ jsxRuntime.jsx(
-      reactNative.Text,
-      {
-        style: styles3.errorText,
-        testID: withTestIdPrefix(AuthTestIds.passkeyLoginError, testIdPrefix),
-        children: error === "cancelled" ? labels.errorCancelled : labels.errorFailed
-      }
-    ) : null,
+    error !== null ? /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
+      /* @__PURE__ */ jsxRuntime.jsx(
+        reactNative.Text,
+        {
+          style: styles3.errorText,
+          testID: withTestIdPrefix(AuthTestIds.passkeyLoginError, testIdPrefix),
+          children: error === "cancelled" ? labels.errorCancelled : labels.errorFailed
+        }
+      ),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        reactNative.TouchableOpacity,
+        {
+          accessibilityHint: labels.tryAnotherWay,
+          accessibilityLabel: labels.tryAnotherWay,
+          accessibilityRole: "button",
+          testID: withTestIdPrefix(AuthTestIds.passkeyLoginFallback, testIdPrefix),
+          onPress: () => ceremony.fallbackToRedirect(),
+          children: /* @__PURE__ */ jsxRuntime.jsx(reactNative.Text, { style: styles3.linkText, children: labels.tryAnotherWay })
+        }
+      )
+    ] }) : null,
     /* @__PURE__ */ jsxRuntime.jsx(
       reactNative.TouchableOpacity,
       {