@finueva/auth 0.1.0 → 0.4.0

package/dist/server.d.ts

@@ -1,4 +1,5 @@
-import { a as AuthSession, c as DriveCredentialInput, n as AuthErrorCode, o as AuthUser, r as AuthErrorStatus, s as DriveCredential, t as AuthError, u as PersonalWorkspaceSelection } from "./errors-C-cHFWC7.js";
+import { c as AuthUser, f as InvitationAcceptance, g as WorkspaceSelection, l as DriveCredential, m as PersonalWorkspaceSelection, o as AuthSession, p as OrganizationWorkspaceSelection, r as AuthOrganization, t as AcceptInvitationInput, u as DriveCredentialInput } from "./types-zEqO1_r2.js";
+import { n as AuthErrorCode, r as AuthErrorStatus, t as AuthError } from "./errors-Crd93Rah.js";
 //#region src/server.d.ts
 interface ServerAuthOptions {
   authOrigin: string;
@@ -11,11 +12,16 @@ interface ServerAuthOptions {
 interface ServerSignOutResult {
   applyCookies(headers: Headers): void;
 }
+interface ServerInvitationAcceptance extends InvitationAcceptance {
+  applyCookies(headers: Headers): void;
+}
 interface FinuevaServerAuth {
+  acceptInvitation(input: AcceptInvitationInput): Promise<ServerInvitationAcceptance>;
   getSession(): Promise<AuthSession | null>;
+  listOrganizations(): Promise<AuthOrganization[]>;
   getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
   signOut(): Promise<ServerSignOutResult>;
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthSession, type AuthUser, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type PersonalWorkspaceSelection, ServerAuthOptions, ServerSignOutResult, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type DriveCredential, type DriveCredentialInput, FinuevaServerAuth, type InvitationAcceptance, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, type WorkspaceSelection, createServerAuth };

package/dist/server.js

@@ -1,26 +1,3 @@
-//#region src/errors.ts
-const messages = {
-	invalid_credentials: "The credentials are invalid.",
-	authentication_required: "Authentication is required.",
-	request_origin_denied: "The request origin is not allowed.",
-	invalid_workspace_selection: "The workspace selection is invalid.",
-	credential_rate_limited: "Credential requests are temporarily limited.",
-	state_conflict: "The authentication state conflicts with the request.",
-	access_denied: "Access is denied.",
-	identity_authority_unavailable: "Authentication is temporarily unavailable."
-};
-var AuthError = class extends Error {
-	code;
-	status;
-	retryAfterSeconds;
-	constructor(code, status, retryAfterSeconds) {
-		super(messages[code]);
-		this.name = "AuthError";
-		this.code = code;
-		this.status = status;
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-};
 String.fromCharCode;
 const HASH_RE = /#/g;
 const AMPERSAND_RE = /&/g;
@@ -459,6 +436,35 @@ function createFetch(globalOptions = {}) {
 	return $fetch;
 }
 //#endregion
+//#region src/errors.ts
+const messages = {
+	invalid_credentials: "The credentials are invalid.",
+	authentication_required: "Authentication is required.",
+	request_origin_denied: "The request origin is not allowed.",
+	invalid_invitation: "The invitation is invalid.",
+	invitation_unavailable: "The invitation is not available.",
+	invitation_recipient_mismatch: "The invitation cannot be accepted by this account.",
+	email_verification_required: "Email verification is required.",
+	invalid_workspace_selection: "The workspace selection is invalid.",
+	organization_context_too_large: "The organization context is too large.",
+	credential_rate_limited: "Credential requests are temporarily limited.",
+	state_conflict: "The authentication state conflicts with the request.",
+	access_denied: "Access is denied.",
+	identity_authority_unavailable: "Authentication is temporarily unavailable."
+};
+var AuthError = class extends Error {
+	code;
+	status;
+	retryAfterSeconds;
+	constructor(code, status, retryAfterSeconds) {
+		super(messages[code]);
+		this.name = "AuthError";
+		this.code = code;
+		this.status = status;
+		this.retryAfterSeconds = retryAfterSeconds;
+	}
+};
+//#endregion
 //#region src/shared.ts
 const id = /^[A-Za-z0-9_-]{1,128}$/;
 const email = /^[^\s@]+@[^\s@]+$/;
@@ -505,6 +511,37 @@ function normalizeDriveCredential(value, now) {
 		expiresAt: new Date(now + value.expiresIn * 1e3)
 	};
 }
+function normalizeOrganizations(value) {
+	if (!Array.isArray(value) || value.length >= 100) throw authorityUnavailable();
+	const seen = new Set();
+	return value.map((organization) => {
+		if (!isObject(organization) || !isId(organization.id) || seen.has(organization.id) || typeof organization.name !== "string" || organization.name.length < 1 || typeof organization.slug !== "string" || organization.slug.length < 1) throw authorityUnavailable();
+		seen.add(organization.id);
+		return {
+			id: organization.id,
+			name: organization.name,
+			slug: organization.slug
+		};
+	});
+}
+function normalizeInvitationInput(value) {
+	if (!isObject(value) || Object.keys(value).length !== 1 || !isId(value.invitationId)) throw new AuthError("invalid_invitation", 422);
+	return { invitationId: value.invitationId };
+}
+function normalizeInvitationAcceptance(value, invitationId) {
+	if (!isObject(value) || !isObject(value.invitation) || !isObject(value.member) || value.invitation.id !== invitationId || value.invitation.status !== "accepted" || !isId(value.invitation.organizationId) || value.member.organizationId !== value.invitation.organizationId) throw authorityUnavailable();
+	return { organizationId: value.invitation.organizationId };
+}
+function normalizeWorkspaceSelection(value) {
+	if (!isObject(value)) throw new AuthError("invalid_workspace_selection", 422);
+	const keys = Object.keys(value);
+	if (value.type === "personal" && keys.length === 1 && keys[0] === "type") return { type: "personal" };
+	if (value.type === "organization" && keys.length === 2 && keys.includes("type") && keys.includes("organizationId") && typeof value.organizationId === "string" && id.test(value.organizationId)) return {
+		type: "organization",
+		organizationId: value.organizationId
+	};
+	throw new AuthError("invalid_workspace_selection", 422);
+}
 function fromAuthorityError(value, fallbackStatus, retryAfter) {
 	const mapped = mapError(isObject(value) && typeof value.code === "string" ? value.code : void 0, fallbackStatus);
 	return new AuthError(mapped.code, mapped.status, parseRetryAfter(retryAfter));
@@ -512,6 +549,23 @@ function fromAuthorityError(value, fallbackStatus, retryAfter) {
 function authorityUnavailable() {
 	return new AuthError("identity_authority_unavailable", 503);
 }
+function fromOrganizationListError(error) {
+	if (error instanceof AuthError && error.status === 401) return new AuthError("authentication_required", 401);
+	if (error instanceof AuthError) return error;
+	return authorityUnavailable();
+}
+function fromInvitationAuthorityError(value, status) {
+	const code = isObject(value) && typeof value.code === "string" ? value.code : void 0;
+	if (status === 401 && code === "UNAUTHORIZED") return new AuthError("authentication_required", 401);
+	if (status === 403 && (code === "INVALID_ORIGIN" || code === "MISSING_OR_NULL_ORIGIN")) return new AuthError("request_origin_denied", 403);
+	if (status === 403 && code === "YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION") return new AuthError("invitation_recipient_mismatch", 403);
+	if (status === 403 && code === "EMAIL_VERIFICATION_REQUIRED_BEFORE_ACCEPTING_OR_REJECTING_INVITATION") return new AuthError("email_verification_required", 403);
+	if (status === 400 && (code === "INVITATION_NOT_FOUND" || code === "ORGANIZATION_NOT_FOUND" || code === "TEAM_NOT_FOUND")) return new AuthError("invitation_unavailable", 409);
+	return authorityUnavailable();
+}
+function fromInvitationError(error) {
+	return error instanceof AuthError ? error : authorityUnavailable();
+}
 function mapError(code, status) {
 	if (code === "authentication_required") return {
 		code,
@@ -525,6 +579,10 @@ function mapError(code, status) {
 		code,
 		status: 422
 	};
+	if (code === "organization_context_too_large") return {
+		code,
+		status: 422
+	};
 	if (code === "credential_rate_limited") return {
 		code,
 		status: 429
@@ -577,6 +635,9 @@ function isObject(value) {
 //#region src/http.ts
 const MAX_RESPONSE_BYTES = 64 * 1024;
 async function requestJson(url, options) {
+	return (await requestJsonResponse(url, options)).value;
+}
+async function requestJsonResponse(url, options) {
 	let response;
 	try {
 		response = await createFetch({ fetch: options.fetch }).raw(url, {
@@ -587,6 +648,7 @@ async function requestJson(url, options) {
 			retry: 0,
 			timeout: options.timeoutMs,
 			redirect: "manual",
+			signal: options.signal,
 			responseType: "stream",
 			ignoreResponseError: true
 		});
@@ -597,9 +659,12 @@ async function requestJson(url, options) {
 	if (response.status >= 300 || response.status < 200 || contentType !== "application/json") {
 		const body = contentType === "application/json" ? await readJson(response) : void 0;
 		await response.body?.cancel();
-		throw fromAuthorityError(body, response.status, response.headers.get("retry-after"));
+		throw (options.mapError ?? fromAuthorityError)(body, response.status, response.headers.get("retry-after"));
 	}
-	return readJson(response);
+	return {
+		value: await readJson(response),
+		headers: response.headers
+	};
 }
 async function readJson(response) {
 	const length = response.headers.get("content-length");
@@ -652,6 +717,32 @@ function createServerAuth(options) {
 		origin: appOrigin
 	});
 	return {
+		async acceptInvitation(input) {
+			const invitation = normalizeInvitationInput(input);
+			try {
+				const result = await requestJsonResponse(joinURL(authOrigin, "api/v1/auth/organization/accept-invitation"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "POST",
+					headers: {
+						...authHeaders(),
+						"content-type": "application/json; charset=utf-8"
+					},
+					body: invitation,
+					mapError: fromInvitationAuthorityError
+				});
+				const acceptance = normalizeInvitationAcceptance(result.value, invitation.invitationId);
+				const cookies = responseCookies(result.headers);
+				return {
+					...acceptance,
+					applyCookies(headers) {
+						applyCookies(cookies, headers);
+					}
+				};
+			} catch (error) {
+				throw fromInvitationError(error);
+			}
+		},
 		async getSession() {
 			return normalizeSession(await requestJson(joinURL(authOrigin, "api/v1/auth/get-session"), {
 				fetch: fetchImpl,
@@ -660,8 +751,20 @@ function createServerAuth(options) {
 				headers: { cookie }
 			}));
 		},
+		async listOrganizations() {
+			try {
+				return normalizeOrganizations(await requestJson(joinURL(authOrigin, "api/v1/auth/organization/list"), {
+					fetch: fetchImpl,
+					timeoutMs,
+					method: "GET",
+					headers: authHeaders()
+				}));
+			} catch (error) {
+				throw fromOrganizationListError(error);
+			}
+		},
 		async getDriveCredential(input) {
-			if (input.workspace.type !== "personal") throw new AuthError("invalid_workspace_selection", 422);
+			const workspace = normalizeWorkspaceSelection(input?.workspace);
 			return normalizeDriveCredential(await requestJson(joinURL(authOrigin, "api/v1/auth/drive-credential"), {
 				fetch: fetchImpl,
 				timeoutMs,
@@ -670,7 +773,7 @@ function createServerAuth(options) {
 					...authHeaders(),
 					"content-type": "application/json; charset=utf-8"
 				},
-				body: { workspace: { type: "personal" } }
+				body: { workspace }
 			}), now());
 		},
 		async signOut() {
@@ -689,15 +792,21 @@ function createServerAuth(options) {
 				await response.body?.cancel();
 				throw authorityUnavailable();
 			}
-			const getSetCookie = response.headers.getSetCookie;
-			const cookies = getSetCookie ? getSetCookie.call(response.headers) : [response.headers.get("set-cookie")].filter(Boolean);
+			const cookies = responseCookies(response.headers);
 			await response.body?.cancel();
 			return { applyCookies(headers) {
-				for (const value of cookies) headers.append("set-cookie", value);
+				applyCookies(cookies, headers);
 			} };
 		}
 	};
 }
+function responseCookies(headers) {
+	const getSetCookie = headers.getSetCookie;
+	return getSetCookie ? getSetCookie.call(headers) : [headers.get("set-cookie")].filter((value) => !!value);
+}
+function applyCookies(cookies, headers) {
+	for (const value of cookies) headers.append("set-cookie", value);
+}
 function authCookieHeader(value) {
 	if (!value) return "";
 	return value.split(";").map((cookie) => cookie.trim()).filter((cookie) => {

package/dist/types-zEqO1_r2.d.ts

@@ -0,0 +1,90 @@
+//#region src/types.d.ts
+interface AuthUser {
+  id: string;
+  name: string;
+  email: string;
+  emailVerified: boolean;
+  image: string | null;
+}
+interface AuthSession {
+  id: string;
+  expiresAt: Date;
+  user: AuthUser;
+}
+interface AuthOrganization {
+  id: string;
+  name: string;
+  slug: string;
+}
+interface AcceptInvitationInput {
+  invitationId: string;
+}
+interface InvitationAcceptance {
+  organizationId: string;
+}
+type AuthState = {
+  status: "loading";
+} | {
+  status: "cached";
+  session: AuthSession;
+  authoritative: false;
+} | {
+  status: "authenticated";
+  session: AuthSession;
+  authoritative: true;
+} | {
+  status: "unauthenticated";
+  session: null;
+  authoritative: true;
+} | {
+  status: "unavailable";
+  session: AuthSession | null;
+  authoritative: false;
+};
+interface AuthPersistenceDriver {
+  getItem(key: string): string | null | Promise<string | null>;
+  setItem(key: string, value: string): void | Promise<void>;
+  removeItem(key: string): void | Promise<void>;
+}
+type AuthPersistence = "local" | "session" | "memory" | AuthPersistenceDriver;
+interface PersonalWorkspaceSelection {
+  type: "personal";
+}
+interface OrganizationWorkspaceSelection {
+  type: "organization";
+  organizationId: string;
+}
+type WorkspaceSelection = PersonalWorkspaceSelection | OrganizationWorkspaceSelection;
+interface DriveCredential {
+  tokenType: "Bearer";
+  token: string;
+  expiresAt: Date;
+}
+interface SignInInput {
+  email: string;
+  password: string;
+}
+interface DriveCredentialInput {
+  workspace: WorkspaceSelection;
+  forceRefresh?: boolean;
+}
+interface AuthClientOptions {
+  authOrigin: string;
+  appOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  now?: () => number;
+  persistence?: AuthPersistence;
+  timeoutMs?: number;
+}
+interface FinuevaAuthClient {
+  acceptInvitation(input: AcceptInvitationInput): Promise<InvitationAcceptance>;
+  getSession(): Promise<AuthSession | null>;
+  listOrganizations(): Promise<AuthOrganization[]>;
+  signIn(input: SignInInput): Promise<AuthSession>;
+  signOut(): Promise<void>;
+  getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
+  onAuthStateChange(listener: (state: AuthState) => void): () => void;
+  onSessionChange(listener: (session: AuthSession | null) => void): () => void;
+}
+//#endregion
+export { AuthPersistenceDriver as a, AuthUser as c, FinuevaAuthClient as d, InvitationAcceptance as f, WorkspaceSelection as g, SignInInput as h, AuthPersistence as i, DriveCredential as l, PersonalWorkspaceSelection as m, AuthClientOptions as n, AuthSession as o, OrganizationWorkspaceSelection as p, AuthOrganization as r, AuthState as s, AcceptInvitationInput as t, DriveCredentialInput as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.1.0",
+  "version": "0.4.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,
@@ -18,6 +18,10 @@
     "./server": {
       "types": "./dist/server.d.ts",
       "import": "./dist/server.js"
+    },
+    "./device": {
+      "types": "./dist/device.d.ts",
+      "import": "./dist/device.js"
     }
   },
   "files": [
@@ -38,20 +42,24 @@
     "coverage": "vitest run --coverage",
     "lint": "eslint .",
     "test": "pnpm test:unit && pnpm build && pnpm test:package",
+    "test:composition": "node scripts/test-composition.mjs",
     "test:package": "node scripts/test-package.mjs",
     "test:unit": "vitest run",
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
+    "@chiballc/utils": "2.2.22",
     "@types/node": "24.13.3",
     "@vitest/coverage-v8": "4.1.10",
-    "@chiballc/utils": "2.2.22",
     "better-auth": "1.6.22",
+    "miniflare": "4.20260722.0",
     "ofetch": "1.5.1",
+    "playwright": "1.62.0",
     "rolldown": "1.2.0",
     "rolldown-plugin-dts": "0.27.14",
     "typescript": "5.9.2",
     "ufo": "1.6.4",
+    "unstorage": "1.17.5",
     "vitest": "4.1.10"
   }
 }

package/dist/errors-C-cHFWC7.d.ts

@@ -1,55 +0,0 @@
-//#region src/types.d.ts
-interface AuthUser {
-  id: string;
-  name: string;
-  email: string;
-  emailVerified: boolean;
-  image: string | null;
-}
-interface AuthSession {
-  id: string;
-  expiresAt: Date;
-  user: AuthUser;
-}
-interface PersonalWorkspaceSelection {
-  type: "personal";
-}
-interface DriveCredential {
-  tokenType: "Bearer";
-  token: string;
-  expiresAt: Date;
-}
-interface SignInInput {
-  email: string;
-  password: string;
-}
-interface DriveCredentialInput {
-  workspace: PersonalWorkspaceSelection;
-  forceRefresh?: boolean;
-}
-interface AuthClientOptions {
-  authOrigin: string;
-  appOrigin: string;
-  fetch?: typeof globalThis.fetch;
-  now?: () => number;
-  timeoutMs?: number;
-}
-interface FinuevaAuthClient {
-  getSession(): Promise<AuthSession | null>;
-  signIn(input: SignInInput): Promise<AuthSession>;
-  signOut(): Promise<void>;
-  getDriveCredential(input: DriveCredentialInput): Promise<DriveCredential>;
-  onSessionChange(listener: (session: AuthSession | null) => void): () => void;
-}
-//#endregion
-//#region src/errors.d.ts
-type AuthErrorCode = "invalid_credentials" | "authentication_required" | "request_origin_denied" | "invalid_workspace_selection" | "credential_rate_limited" | "state_conflict" | "access_denied" | "identity_authority_unavailable";
-type AuthErrorStatus = 401 | 403 | 409 | 422 | 429 | 503;
-declare class AuthError extends Error {
-  readonly code: AuthErrorCode;
-  readonly status: AuthErrorStatus;
-  readonly retryAfterSeconds?: number;
-  constructor(code: AuthErrorCode, status: AuthErrorStatus, retryAfterSeconds?: number);
-}
-//#endregion
-export { AuthSession as a, DriveCredentialInput as c, SignInInput as d, AuthClientOptions as i, FinuevaAuthClient as l, AuthErrorCode as n, AuthUser as o, AuthErrorStatus as r, DriveCredential as s, AuthError as t, PersonalWorkspaceSelection as u };