@finueva/auth 0.1.0 → 0.4.0

package/README.md

@@ -16,15 +16,36 @@ const auth = createAuthClient({
   appOrigin: window.location.origin,
 });
 
+const stop = auth.onAuthStateChange((state) => {
+  if (state.status === "cached") renderSessionHint(state.session);
+  if (state.status === "authenticated") renderVerifiedSession(state.session);
+});
+
 const session = await auth.getSession();
 await auth.signIn({ email, password });
+const organizations = await auth.listOrganizations();
+const acceptance = await auth.acceptInvitation({ invitationId });
 const credential = await auth.getDriveCredential({
   workspace: { type: "personal" },
 });
+const organizationCredential = await auth.getDriveCredential({
+  workspace: { type: "organization", organizationId: organizations[0].id },
+});
 await auth.signOut();
+stop();
 ```
 
-The Auth session uses the Auth-owned HTTP-only cookie. Drive credentials are cached only in memory, shared across concurrent requests, and renewed once they have two minutes remaining. Passing `forceRefresh: true` requests a replacement after a Drive authentication failure; the SDK never replays a Drive request.
+The Auth session uses the Auth-owned HTTP-only cookie. `getSession()` and `onSessionChange()` report Better Auth authority results only. `onAuthStateChange()` separately emits `loading`, non-authoritative `cached`, authoritative `authenticated`/`unauthenticated`, or non-authoritative `unavailable`; it verifies every cache hint immediately.
+
+DOM browsers use local storage by default. Set `persistence` to `"session"`, `"memory"`, or a structural driver with `getItem`, `setItem`, and `removeItem`; Workers and Node default to memory. The one 16 KiB versioned snapshot contains only a normalized session and its Auth authority identity. It expires with the session and never contains cookies, passwords, Drive credentials, tokens, headers, workspace selection, Better Auth payloads, or errors. Persistence failure cannot change an Auth request result.
+
+A workspace is either `{ type: "personal" }` or `{ type: "organization", organizationId }`; organization IDs must match `[A-Za-z0-9_-]{1,128}`. Workspace selections are strict and reject additional properties locally with `invalid_workspace_selection` before making a request.
+
+`listOrganizations()` returns strict current `{ id, name, slug }` records from Better Auth authority. Results are not cached or persisted. Because the current upstream endpoint is unpaginated and silently capped at 100 records, the SDK fails closed rather than return an ambiguous list when that cap is reached.
+
+`acceptInvitation({ invitationId })` performs one non-retried Better Auth acceptance and returns only `{ organizationId }`. Invitation details, recipient email, inviter identity, membership payloads, and raw authority errors are never exposed or persisted. Unknown, expired, canceled, accepted, and concurrently claimed invitations all report the same value-free `invitation_unavailable` conflict.
+
+The browser retains at most one completed Drive credential in memory and renews it once it has two minutes remaining. Concurrent requests for the same workspace share one credential request. Selecting a different workspace never reuses the completed or in-flight credential for the previous workspace and replaces the retained credential. Passing `forceRefresh: true` requests a replacement after a Drive authentication failure; the SDK never replays a Drive request.
 
 ## Server
 
@@ -38,13 +59,42 @@ const auth = createServerAuth({
 });
 
 const session = await auth.getSession();
+const organizations = await auth.listOrganizations();
+const acceptance = await auth.acceptInvitation({ invitationId });
+const credential = await auth.getDriveCredential({
+  workspace: { type: "organization", organizationId: organizations[0].id },
+});
+const signOut = await auth.signOut();
+const responseHeaders = new Headers();
+signOut.applyCookies(responseHeaders);
+```
+
+The server client is request-scoped and does not cache credentials. It forwards only reserved Better Auth cookies to Auth and never sends them to Drive. Apply cookies returned by server invitation acceptance or sign-out to the outgoing response with `acceptance.applyCookies(headers)` or `signOut.applyCookies(headers)`.
+
+## Device
+
+```ts
+import { createDeviceAuth } from "@finueva/auth/device";
+
+const auth = createDeviceAuth({
+  authOrigin: "https://auth.finueva.com",
+  clientId: "finueva-cli",
+});
+const authorization = await auth.requestAuthorization();
+showCode(authorization.userCode, authorization.verificationUri);
+const token = await auth.pollForToken(authorization, { signal });
+const session = await auth.getSession();
+await auth.revokeCurrentDevice(); // or revokeAllSessions()
 ```
 
-The server client is request-scoped. It forwards the incoming Auth cookie only to Auth and never sends it to Drive.
+Polling starts at the server-provided interval, adds five seconds after each RFC 8628 `slow_down`, has no transport retry, and stops on denial, expiry, cancellation, the configured `maxPollingMs`, malformed/bounded responses, or transport timeout. The only requested scope is `openid`.
+
+The token is memory-only by default. Secure persistence is opt-in through a structural adapter implementing `read`, atomic `replace`, and `delete`; every operation receives an `AbortSignal` and must stop without committing when aborted. The caller owns encryption and platform credential storage. Adapter and authority failures are value-free and never include device codes or tokens. This export uses standard expiring/revocable Better Auth sessions and does not implement refresh tokens.
 
 ## Current Limits
 
-- Only personal workspace credentials are supported.
-- Cross-root SSO and organization switching are not part of `0.1.0`.
-- The package does not persist Drive credentials or expose Better Auth internals.
+- Organization mutation and active-organization state are not exposed; callers select an organization returned by `listOrganizations()` explicitly.
+- Cross-root SSO is not implemented.
+- The package does not persist Drive credentials or expose Better Auth or Unstorage internals.
 - Public errors are `AuthError` instances with stable, value-free codes.
+- Organization contexts with more than 50 current teams fail with `organization_context_too_large` and status `422`.

package/THIRD_PARTY_NOTICES.md

@@ -98,3 +98,55 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+## unstorage 1.17.5
+
+Source: https://github.com/unjs/unstorage
+
+MIT License
+
+Copyright (c) Pooya Parsa <pooya@pi0.io>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## destr 2.0.5
+
+Source: https://github.com/unjs/destr
+
+MIT License
+
+Copyright (c) Pooya Parsa <pooya@pi0.io>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/device.d.ts

@@ -0,0 +1,51 @@
+import { o as AuthSession } from "./types-zEqO1_r2.js";
+//#region src/device.d.ts
+type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
+declare class DeviceAuthorizationError extends Error {
+  readonly code: DeviceAuthorizationErrorCode;
+  constructor(code: DeviceAuthorizationErrorCode);
+}
+interface DeviceToken {
+  accessToken: string;
+  tokenType: "Bearer";
+  expiresAt: Date;
+  scope: "openid";
+}
+interface DeviceTokenPersistence {
+  read(signal: AbortSignal): DeviceToken | null | Promise<DeviceToken | null>;
+  replace(token: DeviceToken, signal: AbortSignal): void | Promise<void>;
+  delete(signal: AbortSignal): void | Promise<void>;
+}
+interface DeviceAuthorization {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  verificationUriComplete: string;
+  expiresAt: Date;
+  intervalSeconds: number;
+}
+interface DeviceAuthOptions {
+  authOrigin: string;
+  clientId: string;
+  fetch?: typeof globalThis.fetch;
+  now?: () => number;
+  persistence?: DeviceTokenPersistence;
+  timeoutMs?: number;
+  maxPollingMs?: number;
+}
+interface PollDeviceOptions {
+  signal?: AbortSignal;
+}
+interface DeviceAuthClient {
+  requestAuthorization(options?: {
+    signal?: AbortSignal;
+  }): Promise<DeviceAuthorization>;
+  pollForToken(authorization: DeviceAuthorization, options?: PollDeviceOptions): Promise<DeviceToken>;
+  getSession(): Promise<AuthSession | null>;
+  getToken(): Promise<DeviceToken | null>;
+  revokeCurrentDevice(): Promise<void>;
+  revokeAllSessions(): Promise<void>;
+}
+declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
+//#endregion
+export { DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, PollDeviceOptions, createDeviceAuth };