@finueva/auth 0.1.0 → 0.3.0

package/README.md

@@ -16,15 +16,36 @@ const auth = createAuthClient({
   appOrigin: window.location.origin,
 });
 
+const stop = auth.onAuthStateChange((state) => {
+  if (state.status === "cached") renderSessionHint(state.session);
+  if (state.status === "authenticated") renderVerifiedSession(state.session);
+});
+
 const session = await auth.getSession();
 await auth.signIn({ email, password });
+const organizations = await auth.listOrganizations();
+const acceptance = await auth.acceptInvitation({ invitationId });
 const credential = await auth.getDriveCredential({
   workspace: { type: "personal" },
 });
+const organizationCredential = await auth.getDriveCredential({
+  workspace: { type: "organization", organizationId: organizations[0].id },
+});
 await auth.signOut();
+stop();
 ```
 
-The Auth session uses the Auth-owned HTTP-only cookie. Drive credentials are cached only in memory, shared across concurrent requests, and renewed once they have two minutes remaining. Passing `forceRefresh: true` requests a replacement after a Drive authentication failure; the SDK never replays a Drive request.
+The Auth session uses the Auth-owned HTTP-only cookie. `getSession()` and `onSessionChange()` report Better Auth authority results only. `onAuthStateChange()` separately emits `loading`, non-authoritative `cached`, authoritative `authenticated`/`unauthenticated`, or non-authoritative `unavailable`; it verifies every cache hint immediately.
+
+DOM browsers use local storage by default. Set `persistence` to `"session"`, `"memory"`, or a structural driver with `getItem`, `setItem`, and `removeItem`; Workers and Node default to memory. The one 16 KiB versioned snapshot contains only a normalized session and its Auth authority identity. It expires with the session and never contains cookies, passwords, Drive credentials, tokens, headers, workspace selection, Better Auth payloads, or errors. Persistence failure cannot change an Auth request result.
+
+A workspace is either `{ type: "personal" }` or `{ type: "organization", organizationId }`; organization IDs must match `[A-Za-z0-9_-]{1,128}`. Workspace selections are strict and reject additional properties locally with `invalid_workspace_selection` before making a request.
+
+`listOrganizations()` returns strict current `{ id, name, slug }` records from Better Auth authority. Results are not cached or persisted. Because the current upstream endpoint is unpaginated and silently capped at 100 records, the SDK fails closed rather than return an ambiguous list when that cap is reached.
+
+`acceptInvitation({ invitationId })` performs one non-retried Better Auth acceptance and returns only `{ organizationId }`. Invitation details, recipient email, inviter identity, membership payloads, and raw authority errors are never exposed or persisted. Unknown, expired, canceled, accepted, and concurrently claimed invitations all report the same value-free `invitation_unavailable` conflict.
+
+The browser retains at most one completed Drive credential in memory and renews it once it has two minutes remaining. Concurrent requests for the same workspace share one credential request. Selecting a different workspace never reuses the completed or in-flight credential for the previous workspace and replaces the retained credential. Passing `forceRefresh: true` requests a replacement after a Drive authentication failure; the SDK never replays a Drive request.
 
 ## Server
 
@@ -38,13 +59,19 @@ const auth = createServerAuth({
 });
 
 const session = await auth.getSession();
+const organizations = await auth.listOrganizations();
+const acceptance = await auth.acceptInvitation({ invitationId });
+const credential = await auth.getDriveCredential({
+  workspace: { type: "organization", organizationId: organizations[0].id },
+});
 ```
 
-The server client is request-scoped. It forwards the incoming Auth cookie only to Auth and never sends it to Drive.
+The server client is request-scoped and does not cache credentials. It forwards the incoming Auth cookie only to Auth and never sends it to Drive. Apply cookies returned by server invitation acceptance to the outgoing response with `acceptance.applyCookies(headers)`.
 
 ## Current Limits
 
-- Only personal workspace credentials are supported.
-- Cross-root SSO and organization switching are not part of `0.1.0`.
-- The package does not persist Drive credentials or expose Better Auth internals.
+- Organization mutation and active-organization state are not exposed; callers select an organization returned by `listOrganizations()` explicitly.
+- Cross-root SSO is not part of `0.1.0`.
+- The package does not persist Drive credentials or expose Better Auth or Unstorage internals.
 - Public errors are `AuthError` instances with stable, value-free codes.
+- Organization contexts with more than 50 current teams fail with `organization_context_too_large` and status `422`.

package/THIRD_PARTY_NOTICES.md

@@ -98,3 +98,55 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+## unstorage 1.17.5
+
+Source: https://github.com/unjs/unstorage
+
+MIT License
+
+Copyright (c) Pooya Parsa <pooya@pi0.io>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## destr 2.0.5
+
+Source: https://github.com/unjs/destr
+
+MIT License
+
+Copyright (c) Pooya Parsa <pooya@pi0.io>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/errors-B0S9-QGH.d.ts

@@ -0,0 +1,100 @@
+//#region src/types.d.ts
+interface AuthUser {
+  id: string;
+  name: string;
+  email: string;
+  emailVerified: boolean;
+  image: string | null;
+}
+interface AuthSession {
+  id: string;
+  expiresAt: Date;
+  user: AuthUser;
+}
+interface AuthOrganization {
+  id: string;
+  name: string;
+  slug: string;
+}
+interface AcceptInvitationInput {
+  invitationId: string;
+}
+interface InvitationAcceptance {
+  organizationId: string;
+}
+type AuthState = {
+  status: "loading";
+} | {
+  status: "cached";
+  session: AuthSession;
+  authoritative: false;
+} | {
+  status: "authenticated";
+  session: AuthSession;
+  authoritative: true;
+} | {
+  status: "unauthenticated";
+  session: null;
+  authoritative: true;
+} | {
+  status: "unavailable";
+  session: AuthSession | null;
+  authoritative: false;
+};
+interface AuthPersistenceDriver {
+  getItem(key: string): string | null | Promise<string | null>;
+  setItem(key: string, value: string): void | Promise<void>;
+  removeItem(key: string): void | Promise<void>;
+}
+type AuthPersistence = "local" | "session" | "memory" | AuthPersistenceDriver;
+interface PersonalWorkspaceSelection {
+  type: "personal";
+}
+interface OrganizationWorkspaceSelection {
+  type: "organization";
+  organizationId: string;
+}
+type WorkspaceSelection = PersonalWorkspaceSelection | OrganizationWorkspaceSelection;
+interface DriveCredential {
+  tokenType: "Bearer";
+  token: string;
+  expiresAt: Date;
+}
+interface SignInInput {
+  email: string;
+  password: string;
+}
+interface DriveCredentialInput {
+  workspace: WorkspaceSelection;
+  forceRefresh?: boolean;
+}
+interface AuthClientOptions {
+  authOrigin: string;
+  appOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  now?: () => number;
+  persistence?: AuthPersistence;
+  timeoutMs?: number;
+}
+interface FinuevaAuthClient {
+  acceptInvitation(input: AcceptInvitationInput): Promise<InvitationAcceptance>;
+  getSession(): Promise<AuthSession | null>;
+  listOrganizations(): Promise<AuthOrganization[]>;
+  signIn(input: SignInInput): Promise<AuthSession>;
+  signOut(): Promise<void>;
+  getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
+  onAuthStateChange(listener: (state: AuthState) => void): () => void;
+  onSessionChange(listener: (session: AuthSession | null) => void): () => void;
+}
+//#endregion
+//#region src/errors.d.ts
+type AuthErrorCode = "invalid_credentials" | "authentication_required" | "request_origin_denied" | "invalid_invitation" | "invitation_unavailable" | "invitation_recipient_mismatch" | "email_verification_required" | "invalid_workspace_selection" | "organization_context_too_large" | "credential_rate_limited" | "state_conflict" | "access_denied" | "identity_authority_unavailable";
+type AuthErrorStatus = 401 | 403 | 409 | 422 | 429 | 503;
+declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  readonly status: AuthErrorStatus;
+  readonly retryAfterSeconds?: number;
+  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number);
+}
+//#endregion
+export { PersonalWorkspaceSelection as _, AuthClientOptions as a, AuthPersistenceDriver as c, AuthUser as d, DriveCredential as f, OrganizationWorkspaceSelection as g, InvitationAcceptance as h, AcceptInvitationInput as i, AuthSession as l, FinuevaAuthClient as m, AuthErrorCode as n, AuthOrganization as o, DriveCredentialInput as p, AuthErrorStatus as r, AuthPersistence as s, AuthError as t, AuthState as u, SignInInput as v, WorkspaceSelection as y };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AuthSession, c as DriveCredentialInput, d as SignInInput, i as AuthClientOptions, l as FinuevaAuthClient, n as AuthErrorCode, o as AuthUser, r as AuthErrorStatus, s as DriveCredential, t as AuthError, u as PersonalWorkspaceSelection } from "./errors-C-cHFWC7.js";
+import { _ as PersonalWorkspaceSelection, a as AuthClientOptions, c as AuthPersistenceDriver, d as AuthUser, f as DriveCredential, g as OrganizationWorkspaceSelection, h as InvitationAcceptance, i as AcceptInvitationInput, l as AuthSession, m as FinuevaAuthClient, n as AuthErrorCode, o as AuthOrganization, p as DriveCredentialInput, r as AuthErrorStatus, s as AuthPersistence, t as AuthError, u as AuthState, v as SignInInput, y as WorkspaceSelection } from "./errors-B0S9-QGH.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthSession, type AuthUser, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type PersonalWorkspaceSelection, type SignInInput, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type SignInInput, type WorkspaceSelection, createAuthClient };