@finueva/auth 0.18.1 → 0.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +60 -25
- package/dist/device.d.ts +22 -2
- package/dist/device.js +384 -23
- package/dist/index.d.ts +2 -2
- package/dist/index.js +887 -31
- package/dist/server.d.ts +25 -2
- package/dist/server.js +349 -176
- package/dist/types-Cv_qxcBP.d.ts +591 -0
- package/package.json +1 -1
- package/dist/types-CrdIcEJ3.d.ts +0 -351
package/README.md
CHANGED
|
@@ -94,31 +94,42 @@ The browser owns the session cookie. The SDK does not expose or persist it.
|
|
|
94
94
|
|
|
95
95
|
## Common Tasks
|
|
96
96
|
|
|
97
|
-
| Task
|
|
98
|
-
|
|
|
99
|
-
| Create an account
|
|
100
|
-
| Read the current session
|
|
101
|
-
| Observe session state
|
|
102
|
-
| Update a profile
|
|
103
|
-
| Change a password
|
|
104
|
-
|
|
|
105
|
-
|
|
|
106
|
-
|
|
|
107
|
-
|
|
|
108
|
-
|
|
|
109
|
-
|
|
|
110
|
-
|
|
|
111
|
-
|
|
|
112
|
-
|
|
|
113
|
-
|
|
|
114
|
-
|
|
|
115
|
-
|
|
|
116
|
-
|
|
|
117
|
-
|
|
|
118
|
-
|
|
|
119
|
-
|
|
|
120
|
-
|
|
|
121
|
-
|
|
|
97
|
+
| Task | Browser | Server | Device |
|
|
98
|
+
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------------------------------------ |
|
|
99
|
+
| Create an account | `signUp()` | Not available | `signUpWithEmail()` |
|
|
100
|
+
| Read the current session | `getSession()` | `getSession()` | `getSession()` |
|
|
101
|
+
| Observe session state | `onAuthStateChange()` | Not available | Not available |
|
|
102
|
+
| Update a profile | `updateProfile()` | Not available | `updateProfile()` |
|
|
103
|
+
| Change a password | `changePassword()` | Not available | `changePassword()` |
|
|
104
|
+
| Complete a second-factor sign-in | `verifyTwoFactor()` | Not available | Device authorization |
|
|
105
|
+
| Manage two-step verification | `startTwoFactorEnrollment()`, `confirmTwoFactorEnrollment()`, `disableTwoFactor()`, `regenerateTwoFactorBackupCodes()` | Not available | Not available |
|
|
106
|
+
| Read two-step verification state | `getTwoFactorStatus()` | Not available | `getTwoFactorStatus()` |
|
|
107
|
+
| Reset a password | `requestPasswordReset()`, `resetPassword()` | Not available | Not available |
|
|
108
|
+
| Verify an email | `sendVerificationEmail()` | Not available | Not available |
|
|
109
|
+
| List organizations | `listOrganizations()` | `listOrganizations()` | `listOrganizations()` |
|
|
110
|
+
| Read member authority | `getOrganizationMemberAuthority()` | `getOrganizationMemberAuthority()` | `getOrganizationMemberAuthority()` |
|
|
111
|
+
| Create an ordinary organization | `createOrganization()` | `createOrganization()` | `createOrganization()` |
|
|
112
|
+
| Create an ordinary team | `createOrganizationTeam()` | `createOrganizationTeam()` | `createOrganizationTeam()` |
|
|
113
|
+
| Invite an ordinary member | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` | `createOrganizationMemberInvitation()` |
|
|
114
|
+
| Resend a member invitation | `resendOrganizationInvitation()` | `resendOrganizationInvitation()` (cookie) | Not available |
|
|
115
|
+
| Cancel a member invitation | `cancelOrganizationInvitation()` | `cancelOrganizationInvitation()` (cookie) | Not available |
|
|
116
|
+
| Remove an ordinary member | `removeOrganizationMember()` | `removeOrganizationMember()` (cookie) | Not available |
|
|
117
|
+
| Leave an organization | `leaveOrganization()` | `leaveOrganization()` (cookie) | Not available |
|
|
118
|
+
| Add a member to a team | `addOrganizationTeamMember()` | `addOrganizationTeamMember()` (cookie) | Not available |
|
|
119
|
+
| Remove a member from a team | `removeOrganizationTeamMember()` | `removeOrganizationTeamMember()` (cookie) | Not available |
|
|
120
|
+
| Delete an ordinary team | `deleteOrganizationTeam()` | `deleteOrganizationTeam()` (cookie) | Not available |
|
|
121
|
+
| Accept an invitation | `acceptInvitation()` | `acceptInvitation()` | Not available |
|
|
122
|
+
| Decline an invitation | `declineInvitation()` | `declineInvitation()` | Not available |
|
|
123
|
+
| Enroll a passkey | `addPasskey()` | Not available | Not available |
|
|
124
|
+
| Perform recent authentication | Platform and organization action methods | Not available | Not available |
|
|
125
|
+
| Change manual roles or owners | Organization authority methods | Not available | Not available |
|
|
126
|
+
| Read current platform roles | `getPlatformStatus()` | Not available | Not available |
|
|
127
|
+
| Request Drive access | `getDriveCredential()` | `getDriveCredential()` | `getDriveCredential()` |
|
|
128
|
+
| List signed-in sessions | `listSessions()` | Not available | `listSessions()` |
|
|
129
|
+
| End other sessions | `revokeSession()`, `revokeOtherSessions()` | Not available | `revokeSession()`, `revokeOtherSessions()` |
|
|
130
|
+
| Start an Auth-Origin ceremony | `createCeremonyHandoff()` | Not available | `createCeremonyHandoff()` |
|
|
131
|
+
| List and rename passkeys | `listPasskeys()`, `renamePasskey()` | Not available | `listPasskeys()`, `renamePasskey()` |
|
|
132
|
+
| End the current session | `signOut()` | `signOut()` | `revokeCurrentDevice()` |
|
|
122
133
|
|
|
123
134
|
## Create An Organization Invitation
|
|
124
135
|
|
|
@@ -156,6 +167,18 @@ const left = await auth.leaveOrganization(organizationId, crypto.randomUUID());
|
|
|
156
167
|
|
|
157
168
|
An owner target is refused. Transfer ownership first. Repeat a removal with the same key only after a lost response; a membership that is already gone under that key replays the same result. A bearer-backed server client rejects both methods before network I/O.
|
|
158
169
|
|
|
170
|
+
## Manage Team Membership
|
|
171
|
+
|
|
172
|
+
Manual owners and manual administrators add a current organization member to an ordinary team, remove a member from a team, or delete an ordinary team. The three operations use browser-cookie or server-cookie authority:
|
|
173
|
+
|
|
174
|
+
```ts
|
|
175
|
+
await auth.addOrganizationTeamMember(organizationId, teamId, memberId, crypto.randomUUID());
|
|
176
|
+
await auth.removeOrganizationTeamMember(organizationId, teamId, memberId, crypto.randomUUID());
|
|
177
|
+
await auth.deleteOrganizationTeam(organizationId, teamId, crypto.randomUUID());
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
Auth keeps the last active team, the caller's selected team, and a team that a pending invitation targets. Repeat an operation with the same key only after a lost response. A bearer-backed server client rejects the three methods before network I/O. The invitation recipient declines an invitation with `declineInvitation({ invitationId })`.
|
|
181
|
+
|
|
159
182
|
## Perform Recent Authentication
|
|
160
183
|
|
|
161
184
|
The experimental passkey methods run only when the browser page uses the exact Auth Origin. To enroll a passkey, first create a new password-authenticated session on that origin:
|
|
@@ -284,6 +307,18 @@ return new Response(null, { status: 303, headers });
|
|
|
284
307
|
|
|
285
308
|
Call `applyCookies()` after server `signOut()`, `acceptInvitation()`, and `signInWithSocialIdToken()`.
|
|
286
309
|
|
|
310
|
+
## Recover A Google Account Conflict
|
|
311
|
+
|
|
312
|
+
Use the request-scoped server client. If Google sign-in reports an account conflict, call `startGoogleAccountRecovery({ idToken: { token, nonce } })`. Auth verifies the Google identity and confirms that an existing verified password account requires linking. A generic sign-in error alone does not authorize recovery.
|
|
313
|
+
|
|
314
|
+
The result contains an opaque `recoveryToken` and an ISO `expiresAt`. Keep the result and Google ID token in short-lived encrypted server-managed state. Do not put them in URLs, logs, or browser storage.
|
|
315
|
+
|
|
316
|
+
Ask the user to sign in to the existing account with its password. Complete the configured second factor. Then create a new request-scoped client with that session and call `completeGoogleAccountRecovery({ recoveryToken, idToken: { token, nonce } })`. Auth requires a fresh password authentication after the recovery request. An old session or a different account cannot complete recovery. The result is `{ linked: true }`; the current session remains in use.
|
|
317
|
+
|
|
318
|
+
If completion returns `google_recovery_in_progress`, retain the current session and recovery state. A retry can confirm a committed link. Auth does not repeat an uncertain linking mutation. If the original attempt cannot finish, wait for its ten-minute expiry before restarting.
|
|
319
|
+
|
|
320
|
+
Recovery is cookie-only and bound to the registered app origin. It does not enable implicit linking or link users by an email match alone. If recovery expires, restart Google sign-in. If email verification is required, complete the existing account's verification first.
|
|
321
|
+
|
|
287
322
|
## Resolve A Drive Recipient
|
|
288
323
|
|
|
289
324
|
Use the separate server client. Before lookup, Drive must check the caller's current permission to manage the item's shares. Recipient resolution does not grant file access.
|
package/dist/device.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { At as AuthError, B as OrganizationMember, D as DriveCredential, Dt as UpdateOrganizationTeamDisplayInput, Et as UpdateOrganizationDisplayInput, G as OrganizationTeam, H as OrganizationMemberPage, J as OrganizationTeamPage, K as OrganizationTeamDisplay, L as OrganizationDisplay, Mt as AuthErrorStatus, Nt as UserApiCredential, O as DriveCredentialInput, Ot as UpdateProfileInput, Pt as UserApiCredentialInput, R as OrganizationInvitation, S as CreatedOrganizationTeam, U as OrganizationPage, V as OrganizationMemberAuthority, W as OrganizationPageInput, X as PasskeyInventory, b as CreatedOrganization, c as AuthSessionInventory, i as AuthOrganization, jt as AuthErrorCode, m as CeremonyHandoffInput, ot as ReceivedOrganizationInvitation, p as CeremonyHandoff, q as OrganizationTeamMemberPage, s as AuthSession, st as ReceivedOrganizationInvitationPage, vt as SocialIdTokenInput, wt as TwoFactorStatus, x as CreatedOrganizationMemberInvitation, y as CreateOrganizationMemberInvitationInput, yt as SocialIdTokenProvider, z as OrganizationInvitationPage } from "./types-Cv_qxcBP.js";
|
|
2
2
|
//#region src/device.d.ts
|
|
3
3
|
type DeviceAuthorizationErrorCode = "device_access_denied" | "device_authorization_cancelled" | "device_code_expired" | "invalid_device_authorization" | "identity_authority_unavailable";
|
|
4
4
|
declare class DeviceAuthorizationError extends Error {
|
|
@@ -60,7 +60,27 @@ interface DeviceAuthClient {
|
|
|
60
60
|
getReceivedInvitation(invitationId: string): Promise<ReceivedOrganizationInvitation>;
|
|
61
61
|
getToken(): Promise<DeviceToken | null>;
|
|
62
62
|
signUpWithEmail(email: string, password: string, name: string): Promise<AuthSession>;
|
|
63
|
+
/**
|
|
64
|
+
* Signs in with a password. A User with a second factor gets `two_factor_required`: a device cannot complete
|
|
65
|
+
* the cookie-bound challenge, so it must use device authorization and let the User finish in a browser.
|
|
66
|
+
*/
|
|
63
67
|
signInWithEmail(email: string, password: string): Promise<AuthSession>;
|
|
68
|
+
/** Reads whether the current User has a second factor. A device can read it but cannot change it. */
|
|
69
|
+
getTwoFactorStatus(): Promise<TwoFactorStatus>;
|
|
70
|
+
listSessions(): Promise<AuthSessionInventory>;
|
|
71
|
+
/** Signs out one other session. Use `revokeCurrentDevice()` for this device. */
|
|
72
|
+
revokeSession(sessionId: string): Promise<void>;
|
|
73
|
+
/** Signs out every session except this device. */
|
|
74
|
+
revokeOtherSessions(): Promise<{
|
|
75
|
+
revoked: number;
|
|
76
|
+
}>;
|
|
77
|
+
/**
|
|
78
|
+
* Starts one Auth-Origin ceremony for this device session. Open the returned address in the system
|
|
79
|
+
* browser. The device never runs WebAuthn for the Auth Relying Party itself.
|
|
80
|
+
*/
|
|
81
|
+
createCeremonyHandoff(input: CeremonyHandoffInput): Promise<CeremonyHandoff>;
|
|
82
|
+
listPasskeys(): Promise<PasskeyInventory>;
|
|
83
|
+
renamePasskey(passkeyId: string, name: string): Promise<void>;
|
|
64
84
|
signInWithSocialIdToken(input: SocialIdTokenInput): Promise<AuthSession>;
|
|
65
85
|
updateProfile(input: UpdateProfileInput): Promise<AuthSession>;
|
|
66
86
|
changePassword(currentPassword: string, newPassword: string, revokeOtherSessions?: boolean): Promise<AuthSession>;
|
|
@@ -71,4 +91,4 @@ interface DeviceAuthClient {
|
|
|
71
91
|
}
|
|
72
92
|
declare function createDeviceAuth(options: DeviceAuthOptions): DeviceAuthClient;
|
|
73
93
|
//#endregion
|
|
74
|
-
export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };
|
|
94
|
+
export { AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type CreateOrganizationMemberInvitationInput, type CreatedOrganization, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, DeviceAuthClient, DeviceAuthOptions, DeviceAuthorization, DeviceAuthorizationError, DeviceAuthorizationErrorCode, DeviceToken, DeviceTokenPersistence, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, PollDeviceOptions, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type SocialIdTokenInput, type SocialIdTokenProvider, type TwoFactorStatus, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type UserApiCredential, type UserApiCredentialInput, createDeviceAuth };
|