@finueva/auth 0.10.1 → 0.11.1

package/README.md

@@ -2,7 +2,9 @@
 
 Use `@finueva/auth` to add Finueva sign-in, organization access, invitations, and Drive credentials to a browser, server, CLI, or native application.
 
-The current published version is `0.10.0`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
+The current published version is `0.11.0`. The package is ESM-only. Node.js consumers require Node.js 22 or later. Other server runtimes must provide compatible Fetch, Web Crypto, URL, and Web Streams APIs. Its interface is Experimental until version `1.0.0`.
+
+The platform-status and organization-authority methods below describe this repository's next package candidate. Published version `0.11.0` does not include them.
 
 ## Install
 
@@ -76,21 +78,25 @@ The browser owns the session cookie. The SDK does not expose or persist it.
 
 ## Common Tasks
 
-| Task                      | Browser                                     | Server                                 | Device                                 |
-| ------------------------- | ------------------------------------------- | -------------------------------------- | -------------------------------------- |
-| Create an account         | `signUp()`                                  | Not available                          | `signUpWithEmail()`                    |
-| Read the current session  | `getSession()`                              | `getSession()`                         | `getSession()`                         |
-| Observe session state     | `onAuthStateChange()`                       | Not available                          | Not available                          |
-| Update a profile          | `updateProfile()`                           | Not available                          | `updateProfile()`                      |
-| Change a password         | `changePassword()`                          | Not available                          | `changePassword()`                     |
-| Reset a password          | `requestPasswordReset()`, `resetPassword()` | Not available                          | Not available                          |
-| Verify an email           | `sendVerificationEmail()`                   | Not available                          | Not available                          |
-| List organizations        | `listOrganizations()`                       | `listOrganizations()`                  | `listOrganizations()`                  |
-| Create an ordinary team   | `createOrganizationTeam()`                  | `createOrganizationTeam()`             | `createOrganizationTeam()`             |
-| Invite an ordinary member | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
-| Accept an invitation      | `acceptInvitation()`                        | `acceptInvitation()`                   | Not available                          |
-| Request Drive access      | `getDriveCredential()`                      | `getDriveCredential()`                 | `getDriveCredential()`                 |
-| End the current session   | `signOut()`                                 | `signOut()`                            | `revokeCurrentDevice()`                |
+| Task                          | Browser                                     | Server                                 | Device                                 |
+| ----------------------------- | ------------------------------------------- | -------------------------------------- | -------------------------------------- |
+| Create an account             | `signUp()`                                  | Not available                          | `signUpWithEmail()`                    |
+| Read the current session      | `getSession()`                              | `getSession()`                         | `getSession()`                         |
+| Observe session state         | `onAuthStateChange()`                       | Not available                          | Not available                          |
+| Update a profile              | `updateProfile()`                           | Not available                          | `updateProfile()`                      |
+| Change a password             | `changePassword()`                          | Not available                          | `changePassword()`                     |
+| Reset a password              | `requestPasswordReset()`, `resetPassword()` | Not available                          | Not available                          |
+| Verify an email               | `sendVerificationEmail()`                   | Not available                          | Not available                          |
+| List organizations            | `listOrganizations()`                       | `listOrganizations()`                  | `listOrganizations()`                  |
+| Create an ordinary team       | `createOrganizationTeam()`                  | `createOrganizationTeam()`             | `createOrganizationTeam()`             |
+| Invite an ordinary member     | `createOrganizationMemberInvitation()`      | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
+| Accept an invitation          | `acceptInvitation()`                        | `acceptInvitation()`                   | Not available                          |
+| Enroll a passkey              | `addPasskey()`                              | Not available                          | Not available                          |
+| Perform recent authentication | Platform and organization action methods    | Not available                          | Not available                          |
+| Change manual roles or owners | Organization authority methods              | Not available                          | Not available                          |
+| Read current platform roles   | `getPlatformStatus()`                       | Not available                          | Not available                          |
+| Request Drive access          | `getDriveCredential()`                      | `getDriveCredential()`                 | `getDriveCredential()`                 |
+| End the current session       | `signOut()`                                 | `signOut()`                            | `revokeCurrentDevice()`                |
 
 ## Create An Organization Invitation
 
@@ -108,6 +114,67 @@ console.log(invitation.id, invitation.expiresAt);
 
 If the response is lost, repeat the same request with the same key. The SDK does not retry automatically. The result confirms invitation creation. It does not confirm email delivery.
 
+## Perform Recent Authentication
+
+The experimental passkey methods run only when the browser page uses the exact Auth Origin. To enroll a passkey, first create a new password-authenticated session on that origin:
+
+```ts
+await auth.signIn({ email, password });
+await auth.addPasskey();
+```
+
+The enrollment authorization expires after five minutes. It is single-use. Signup, social sign-in, session refresh, bearer use, and generic session creation do not authorize enrollment. A User without a fresh password sign-in cannot use this path.
+
+Start one reviewed platform-role action before invoking passkey authentication:
+
+```ts
+await auth.startPlatformRoleChangeRecentAuthentication({
+  targetUserId: "user_01J8R7M6N5P4Q3S2T1",
+  requestedRoles: ["administrator", "investigator"],
+  expectedTargetRevision: 0,
+  expectedGlobalRevision: 0,
+  reasonCategory: "initial_bootstrap",
+  changeReference: "change_01J8R7M6N5P4Q3S2T1",
+  idempotencyKey: crypto.randomUUID(),
+});
+
+await auth.verifyRecentAuthenticationWithPasskey();
+
+const continuation = await auth.getRecentAuthenticationStatus();
+if (continuation.status === "ready") {
+  showReviewedActionIsReady();
+}
+```
+
+The maintained passkey client performs the WebAuthn ceremony for the pending action when a compatible authenticator is present. Auth binds the exact generated challenge to that action. The SDK returns only `pending` or `ready`. It does not expose the challenge, WebAuthn response, session, cookies, proof, or hashes. `ready` does not grant a platform role or reusable administration mode. Bootstrap approval consumes the proof atomically with its state transition.
+
+Organization owner changes use the same ceremony. Pass the same input to the start and submit methods:
+
+```ts
+const change = {
+  requestedManualRole: "owner" as const,
+  expectedActorAuthorityRevision: 3,
+  expectedTargetAuthorityRevision: 1,
+  idempotencyKey: crypto.randomUUID(),
+};
+
+await auth.startOrganizationOwnerRoleChangeRecentAuthentication(organizationId, memberId, change);
+await auth.verifyRecentAuthenticationWithPasskey();
+await auth.changeOrganizationMemberManualRole(organizationId, memberId, change);
+```
+
+Atomic transfer similarly pairs `startOrganizationOwnershipTransferRecentAuthentication()` with `transferOrganizationOwnership()`. The input names distinct outgoing-owner and successor memberships, the outgoing owner's resulting `member` or `admin` role, all exact authority revisions, and one idempotency key. The SDK validates and sends one normalized request and never exposes the consumed proof.
+
+If a start result is unavailable, call `startPlatformRoleChangeRecentAuthentication()` again with the same normalized input. The client reuses the current request nonce. A different start or observed account transition removes this local retry state. Only one start request can be active. An overlapping call returns `state_conflict` before network I/O. The SDK does not retry automatically.
+
+Read the signed-in User's current effective platform roles on the exact Auth Origin:
+
+```ts
+const platform = await auth.getPlatformStatus();
+```
+
+The result contains `eligible`, `roles`, and `globalRevision`. Use it for display and mutation preparation only. Each platform operation checks current authority again. The browser SDK sends Auth-origin cookie credentials and an exact browser-generated `Origin`. It sends no `Authorization` header. Server and device clients do not expose this method.
+
 ## Request A Drive Credential
 
 Request one short-lived credential for one workspace:

package/THIRD_PARTY_NOTICES.md

@@ -47,6 +47,32 @@ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+## @simplewebauthn/browser 13.3.0
+
+Source: https://github.com/MasterKale/SimpleWebAuthn
+
+MIT License
+
+Copyright (c) 2020 Matthew Miller
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 ## ofetch 1.5.1
 
 Source: https://github.com/unjs/ofetch

package/dist/device.d.ts

@@ -1,4 +1,4 @@
-import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, L as UpdateProfileInput, N as SocialIdTokenInput, P as SocialIdTokenProvider, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
+import { C as OrganizationTeam, E as OrganizationTeamPage, G as UpdateProfileInput, H as SocialIdTokenProvider, I as ReceivedOrganizationInvitation, J as AuthErrorCode, L as ReceivedOrganizationInvitationPage, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationDisplayInput, V as SocialIdTokenInput, W as UpdateOrganizationTeamDisplayInput, Y as AuthErrorStatus, _ as OrganizationInvitation, b as OrganizationMemberPage, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, l as CreateOrganizationMemberInvitationInput, o as AuthSession, p as DriveCredentialInput, q as AuthError, r as AuthOrganization, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember } from "./types--G_Gwf2r.js";
 //#region src/device.d.ts
 type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
 declare class DeviceAuthorizationError extends Error {

package/dist/device.js

@@ -455,6 +455,9 @@ const messages = {
 	auth_request_rate_limited: "Authentication requests are temporarily limited.",
 	state_conflict: "The authentication state conflicts with the request.",
 	access_denied: "Access is denied.",
+	platform_target_unavailable: "The platform administration target is unavailable.",
+	platform_quorum_unavailable: "Platform administration quorum is unavailable.",
+	platform_recovery_required: "Platform administration requires separate recovery.",
 	identity_authority_unavailable: "Authentication is temporarily unavailable."
 };
 var AuthError = class extends Error {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { A as ReceivedOrganizationInvitationPage, B as AuthErrorCode, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as UpdateOrganizationDisplayInput, I as UpdateOrganizationTeamDisplayInput, L as UpdateProfileInput, M as SignInInput, N as SocialIdTokenInput, O as PersonalWorkspaceSelection, P as SocialIdTokenProvider, R as WorkspaceSelection, S as OrganizationPageInput, T as OrganizationTeamMemberPage, V as AuthErrorStatus, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as SendVerificationEmailInput, k as ReceivedOrganizationInvitation, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as AuthError } from "./types-Byw9JQwL.js";
+import { A as PlatformRole, B as SignInInput, C as OrganizationTeam, D as OrganizationWorkspaceSelection, E as OrganizationTeamPage, F as PlatformStatus, G as UpdateProfileInput, H as SocialIdTokenProvider, I as ReceivedOrganizationInvitation, J as AuthErrorCode, K as WorkspaceSelection, L as ReceivedOrganizationInvitationPage, M as PlatformRoleApproval, N as PlatformRoleChangeRecentAuthenticationInput, O as PersonalWorkspaceSelection, P as PlatformRoleFirstApproval, R as RecentAuthenticationStatus, S as OrganizationPageInput, T as OrganizationTeamMemberPage, U as UpdateOrganizationDisplayInput, V as SocialIdTokenInput, W as UpdateOrganizationTeamDisplayInput, Y as AuthErrorStatus, _ as OrganizationInvitation, a as AuthPersistenceDriver, b as OrganizationMemberPage, c as AuthUser, d as CreatedOrganizationTeam, f as DriveCredential, g as OrganizationDisplay, h as InvitationAcceptance, i as AuthPersistence, j as PlatformRoleApplied, k as PlatformBootstrapRoleChangeInput, l as CreateOrganizationMemberInvitationInput, m as FinuevaAuthClient, n as AuthClientOptions, o as AuthSession, p as DriveCredentialInput, q as AuthError, r as AuthOrganization, s as AuthState, t as AcceptInvitationInput, u as CreatedOrganizationMemberInvitation, v as OrganizationInvitationPage, w as OrganizationTeamDisplay, x as OrganizationPage, y as OrganizationMember, z as SendVerificationEmailInput } from "./types--G_Gwf2r.js";
 //#region src/client.d.ts
 declare function createAuthClient(options: AuthClientOptions): FinuevaAuthClient;
 //#endregion
-export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };
+export { type AcceptInvitationInput, type AuthClientOptions, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthPersistence, type AuthPersistenceDriver, type AuthSession, type AuthState, type AuthUser, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type FinuevaAuthClient, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type PlatformBootstrapRoleChangeInput, type PlatformRole, type PlatformRoleApplied, type PlatformRoleApproval, type PlatformRoleChangeRecentAuthenticationInput, type PlatformRoleFirstApproval, type PlatformStatus, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type RecentAuthenticationStatus, type SendVerificationEmailInput, type SignInInput, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UpdateProfileInput, type WorkspaceSelection, createAuthClient };