@finueva/auth 0.18.1 → 0.19.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +48 -25
- package/dist/device.d.ts +22 -2
- package/dist/device.js +379 -23
- package/dist/index.d.ts +2 -2
- package/dist/index.js +882 -31
- package/dist/server.d.ts +6 -2
- package/dist/server.js +88 -1
- package/dist/types-BEgD_Js1.d.ts +591 -0
- package/package.json +1 -1
- package/dist/types-CrdIcEJ3.d.ts +0 -351
package/README.md
CHANGED
|
@@ -94,31 +94,42 @@ The browser owns the session cookie. The SDK does not expose or persist it.
|
|
|
94
94
|
|
|
95
95
|
## Common Tasks
|
|
96
96
|
|
|
97
|
-
| Task
|
|
98
|
-
|
|
|
99
|
-
| Create an account
|
|
100
|
-
| Read the current session
|
|
101
|
-
| Observe session state
|
|
102
|
-
| Update a profile
|
|
103
|
-
| Change a password
|
|
104
|
-
|
|
|
105
|
-
|
|
|
106
|
-
|
|
|
107
|
-
|
|
|
108
|
-
|
|
|
109
|
-
|
|
|
110
|
-
|
|
|
111
|
-
|
|
|
112
|
-
|
|
|
113
|
-
|
|
|
114
|
-
|
|
|
115
|
-
|
|
|
116
|
-
|
|
|
117
|
-
|
|
|
118
|
-
|
|
|
119
|
-
|
|
|
120
|
-
|
|
|
121
|
-
|
|
|
97
|
+
| Task | Browser | Server | Device |
|
|
98
|
+
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------------------------------------ |
|
|
99
|
+
| Create an account | `signUp()` | Not available | `signUpWithEmail()` |
|
|
100
|
+
| Read the current session | `getSession()` | `getSession()` | `getSession()` |
|
|
101
|
+
| Observe session state | `onAuthStateChange()` | Not available | Not available |
|
|
102
|
+
| Update a profile | `updateProfile()` | Not available | `updateProfile()` |
|
|
103
|
+
| Change a password | `changePassword()` | Not available | `changePassword()` |
|
|
104
|
+
| Complete a second-factor sign-in | `verifyTwoFactor()` | Not available | Device authorization |
|
|
105
|
+
| Manage two-step verification | `startTwoFactorEnrollment()`, `confirmTwoFactorEnrollment()`, `disableTwoFactor()`, `regenerateTwoFactorBackupCodes()` | Not available | Not available |
|
|
106
|
+
| Read two-step verification state | `getTwoFactorStatus()` | Not available | `getTwoFactorStatus()` |
|
|
107
|
+
| Reset a password | `requestPasswordReset()`, `resetPassword()` | Not available | Not available |
|
|
108
|
+
| Verify an email | `sendVerificationEmail()` | Not available | Not available |
|
|
109
|
+
| List organizations | `listOrganizations()` | `listOrganizations()` | `listOrganizations()` |
|
|
110
|
+
| Read member authority | `getOrganizationMemberAuthority()` | `getOrganizationMemberAuthority()` | `getOrganizationMemberAuthority()` |
|
|
111
|
+
| Create an ordinary organization | `createOrganization()` | `createOrganization()` | `createOrganization()` |
|
|
112
|
+
| Create an ordinary team | `createOrganizationTeam()` | `createOrganizationTeam()` | `createOrganizationTeam()` |
|
|
113
|
+
| Invite an ordinary member | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
|
|
114
|
+
| Resend a member invitation | `resendOrganizationInvitation()` | `resendOrganizationInvitation()` (cookie) | Not available |
|
|
115
|
+
| Cancel a member invitation | `cancelOrganizationInvitation()` | `cancelOrganizationInvitation()` (cookie) | Not available |
|
|
116
|
+
| Remove an ordinary member | `removeOrganizationMember()` | `removeOrganizationMember()` (cookie) | Not available |
|
|
117
|
+
| Leave an organization | `leaveOrganization()` | `leaveOrganization()` (cookie) | Not available |
|
|
118
|
+
| Add a member to a team | `addOrganizationTeamMember()` | `addOrganizationTeamMember()` (cookie) | Not available |
|
|
119
|
+
| Remove a member from a team | `removeOrganizationTeamMember()` | `removeOrganizationTeamMember()` (cookie) | Not available |
|
|
120
|
+
| Delete an ordinary team | `deleteOrganizationTeam()` | `deleteOrganizationTeam()` (cookie) | Not available |
|
|
121
|
+
| Accept an invitation | `acceptInvitation()` | `acceptInvitation()` | Not available |
|
|
122
|
+
| Decline an invitation | `declineInvitation()` | `declineInvitation()` | Not available |
|
|
123
|
+
| Enroll a passkey | `addPasskey()` | Not available | Not available |
|
|
124
|
+
| Perform recent authentication | Platform and organization action methods | Not available | Not available |
|
|
125
|
+
| Change manual roles or owners | Organization authority methods | Not available | Not available |
|
|
126
|
+
| Read current platform roles | `getPlatformStatus()` | Not available | Not available |
|
|
127
|
+
| Request Drive access | `getDriveCredential()` | `getDriveCredential()` | `getDriveCredential()` |
|
|
128
|
+
| List signed-in sessions | `listSessions()` | Not available | `listSessions()` |
|
|
129
|
+
| End other sessions | `revokeSession()`, `revokeOtherSessions()` | Not available | `revokeSession()`, `revokeOtherSessions()` |
|
|
130
|
+
| Start an Auth-Origin ceremony | `createCeremonyHandoff()` | Not available | `createCeremonyHandoff()` |
|
|
131
|
+
| List and rename passkeys | `listPasskeys()`, `renamePasskey()` | Not available | `listPasskeys()`, `renamePasskey()` |
|
|
132
|
+
| End the current session | `signOut()` | `signOut()` | `revokeCurrentDevice()` |
|
|
122
133
|
|
|
123
134
|
## Create An Organization Invitation
|
|
124
135
|
|
|
@@ -156,6 +167,18 @@ const left = await auth.leaveOrganization(organizationId, crypto.randomUUID());
|
|
|
156
167
|
|
|
157
168
|
An owner target is refused. Transfer ownership first. Repeat a removal with the same key only after a lost response; a membership that is already gone under that key replays the same result. A bearer-backed server client rejects both methods before network I/O.
|
|
158
169
|
|
|
170
|
+
## Manage Team Membership
|
|
171
|
+
|
|
172
|
+
Manual owners and manual administrators add a current organization member to an ordinary team, remove a member from a team, or delete an ordinary team. The three operations use browser-cookie or server-cookie authority:
|
|
173
|
+
|
|
174
|
+
```ts
|
|
175
|
+
await auth.addOrganizationTeamMember(organizationId, teamId, memberId, crypto.randomUUID());
|
|
176
|
+
await auth.removeOrganizationTeamMember(organizationId, teamId, memberId, crypto.randomUUID());
|
|
177
|
+
await auth.deleteOrganizationTeam(organizationId, teamId, crypto.randomUUID());
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
Auth keeps the last active team, the caller's selected team, and a team that a pending invitation targets. Repeat an operation with the same key only after a lost response. A bearer-backed server client rejects the three methods before network I/O. The invitation recipient declines an invitation with `declineInvitation({ invitationId })`.
|
|
181
|
+
|
|
159
182
|
## Perform Recent Authentication
|
|
160
183
|
|
|
161
184
|
The experimental passkey methods run only when the browser page uses the exact Auth Origin. To enroll a passkey, first create a new password-authenticated session on that origin:
|
package/dist/device.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { At as AuthError, B as OrganizationMember, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, Pt as UserApiCredentialInput, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, b as CreatedOrganization, c as AuthSessionInventory, i as AuthOrganization, jt as AuthErrorCode, m as CeremonyHandoffInput, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, vt as SocialIdTokenInput, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-BEgD_Js1.js";
|
|
2
2
|
//#region src/device.d.ts
|
|
3
3
|
type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
|
|
4
4
|
declare class DeviceAuthorizationError extends Error {
|
|
@@ -60,7 +60,27 @@ interface DeviceAuthClient {
|
|
|
60
60
|
getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
|
|
61
61
|
getToken(): Promise<DeviceToken | null>;
|
|
62
62
|
signUpWithEmail(email: string, password: string, name: string): Promise<AuthSession>;
|
|
63
|
+
/**
|
|
64
|
+
* Signs in with a password. A User with a second factor gets `two_factor_required`: a device cannot complete
|
|
65
|
+
* the cookie-bound challenge, so it must use device authorization and let the User finish in a browser.
|
|
66
|
+
*/
|
|
63
67
|
signInWithEmail(email: string, password: string): Promise<AuthSession>;
|
|
68
|
+
/** Reads whether the current User has a second factor. A device can read it but cannot change it. */
|
|
69
|
+
getTwoFactorStatus(): Promise<TwoFactorStatus>;
|
|
70
|
+
listSessions(): Promise<AuthSessionInventory>;
|
|
71
|
+
/** Signs out one other session. Use `revokeCurrentDevice()` for this device. */
|
|
72
|
+
revokeSession(sessionId: string): Promise<void>;
|
|
73
|
+
/** Signs out every session except this device. */
|
|
74
|
+
revokeOtherSessions(): Promise<{
|
|
75
|
+
revoked: number;
|
|
76
|
+
}>;
|
|
77
|
+
/**
|
|
78
|
+
* Starts one Auth-Origin ceremony for this device session. Open the returned address in the system
|
|
79
|
+
* browser. The device never runs WebAuthn for the Auth Relying Party itself.
|
|
80
|
+
*/
|
|
81
|
+
createCeremonyHandoff(input: CeremonyHandoffInput): Promise<CeremonyHandoff>;
|
|
82
|
+
listPasskeys(): Promise<PasskeyInventory>;
|
|
83
|
+
renamePasskey(passkeyId: string, name: string): Promise<void>;
|
|
64
84
|
signInWithSocialIdToken(input: SocialIdTokenInput): Promise<AuthSession>;
|
|
65
85
|
updateProfile(input: UpdateProfileInput): Promise<AuthSession>;
|
|
66
86
|
changePassword(currentPassword: string, newPassword: string, revokeOtherSessions?: boolean): Promise<AuthSession>;
|
|
@@ -71,4 +91,4 @@ interface DeviceAuthClient {
|
|
|
71
91
|
}
|
|
72
92
|
declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
|
|
73
93
|
//#endregion
|
|
74
|
-
export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };
|
|
94
|
+
export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type TwoFactorStatus, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };
|