@flow-industries/id 0.24.5 → 0.26.0

package/README.md

@@ -127,7 +127,9 @@ and navigates to Flow ID's `/authorize` page. Completion returns to the saved
 app path; read the new session after navigation instead of continuing after
 `await flow.login()`.
 
-`ProfileButton` and `flow.openAccount()` open `/account` in a normal new tab.
+`ProfileButton` opens the shared account dropdown, with saved accounts, account
+switching, add-account, management, and sign-out actions. `flow.openAccount()`
+opens `/account` in a normal new tab.
 The source app stays loaded and refreshes its session on refocus. Sign-in and
 own-account management no longer use an embedded dialog. The remaining dialog supports signing, public profiles, and widgets. SDK `ConnectResponse` remains a deprecated type alias for source compatibility; sign-in itself returns through the first-party callback. See the
 [integration guide](docs/integration-guide.md) for server wiring and migration.

package/contracts/v1/sdk-exports.json

@@ -92,6 +92,16 @@
         "type": false,
         "value": true
       },
+      {
+        "name": "BrowserAccount",
+        "type": true,
+        "value": false
+      },
+      {
+        "name": "BrowserAccounts",
+        "type": true,
+        "value": false
+      },
       {
         "name": "catalogFieldIndex",
         "type": false,
@@ -607,6 +617,11 @@
         "type": true,
         "value": false
       },
+      {
+        "name": "SwitchAccountOptions",
+        "type": true,
+        "value": false
+      },
       {
         "name": "UpdateStudySubjectInput",
         "type": true,

package/dist/sdk/browser-session-route.d.ts

@@ -1,8 +1,10 @@
 export declare function safeReturnTo(value: string, audience: string, sessionPath?: string): string | null;
 export declare function startBrowserSession(request: Request, audience: string, issuerUrl: string, body: {
-    action: "login" | "account";
+    action: "login" | "account" | "switch";
+    intent?: "login" | "manage" | "switch" | "add";
     redirect?: boolean;
     returnTo?: string;
+    userId?: string;
     signUp?: boolean;
     accessKeyHash?: string;
 }, apiUrl?: string): Promise<Response>;

package/dist/sdk/browser-session-route.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { BROWSER_FLOW_TTL_MS, browserSigningSchema } from "./browser-contract";
 import { clearCookieString, cookieNamesFor, parseCookieHeader, serializeCookie, } from "./cookies";
 import { fetchIssuerApi, resolveIssuerApiUrl } from "./issuer-api";
-import { claimsToUser, sessionCookies } from "./session-core";
+import { claimsToUser, resolveSessionCore, sessionCookies, } from "./session-core";
 import { verifyFlowJWT } from "./verify";
 const opaquePattern = /^[A-Za-z0-9_-]{43}$/;
 const pendingSchema = z.object({
@@ -10,10 +10,12 @@ const pendingSchema = z.object({
     verifier: z.string().regex(opaquePattern),
     returnTo: z.string(),
     expires: z.number(),
+    manageAccount: z.boolean().optional(),
 });
 const exchangeSchema = z.object({
     jwt: z.string(),
     refreshToken: z.string(),
+    accountsGrant: z.string().regex(opaquePattern).optional(),
     webauthn: browserSigningSchema.optional(),
 });
 function base64Url(bytes) {
@@ -62,8 +64,13 @@ export function safeReturnTo(value, audience, sessionPath = "/flow/session") {
     }
 }
 export async function startBrowserSession(request, audience, issuerUrl, body, apiUrl = resolveIssuerApiUrl(issuerUrl)) {
+    const sessionPath = new URL(request.url).pathname;
+    const returnTo = safeReturnTo(body.returnTo ?? "/", audience, sessionPath);
+    if (!returnTo)
+        return reply({ error: "invalid_return_destination" }, 400);
     const cookies = parseCookieHeader(request.headers.get("Cookie"));
-    const refresh = cookies[cookieNamesFor(audience).refresh];
+    const refreshCookieName = cookieNamesFor(audience).refresh;
+    const refresh = cookies[refreshCookieName];
     const headers = new Headers({ "Content-Type": "application/json" });
     if (refresh)
         headers.set("Authorization", `Bearer ${refresh}`);
@@ -72,65 +79,81 @@ export async function startBrowserSession(request, audience, issuerUrl, body, ap
         if (value)
             headers.set(name, value);
     }
+    let manageAccount = false;
+    let sessionUpdates = [];
     if (body.action === "account") {
         if (!refresh)
             return reply({ error: "signed_out" }, 401);
-        const response = await fetchIssuerApi(`${apiUrl}/api/auth/browser/account-handoff`, { method: "POST", headers, body: JSON.stringify({ audience }) });
+        const resolved = await resolveSessionCore(request.headers.get("Cookie"), audience, issuerUrl, apiUrl);
+        sessionUpdates = resolved.setCookies;
+        if (!resolved.session)
+            return reply({ error: "account_unavailable" }, 401, sessionUpdates);
+        manageAccount = !resolved.session.user.isGuest;
+        const refreshedCookie = sessionUpdates.find((cookie) => cookie.startsWith(`${refreshCookieName}=`));
+        if (refreshedCookie) {
+            const token = parseCookieHeader(refreshedCookie)[refreshCookieName];
+            if (token)
+                headers.set("Authorization", `Bearer ${token}`);
+        }
+    }
+    try {
+        let intent = body.intent ?? "login";
+        if (body.action === "account")
+            intent = manageAccount ? "manage" : "login";
+        if (body.action === "switch")
+            intent = "switch";
+        const state = secret();
+        const verifier = secret();
+        const callback = `${audience}${sessionPath}`;
+        const response = await fetchIssuerApi(`${apiUrl}/api/auth/browser/transaction`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({
+                audience,
+                callback,
+                state,
+                challenge: await pkce(verifier),
+                signUp: body.signUp ?? false,
+                targetUserId: body.action === "switch" ? body.userId : undefined,
+                intent,
+                accessKeyHash: body.accessKeyHash,
+            }),
+        });
         if (!response.ok)
-            return reply({ error: "account_unavailable" }, response.status);
-        const { handoff } = z
-            .object({ handoff: z.string().regex(opaquePattern) })
+            return reply({ error: "login_unavailable" }, response.status, sessionUpdates);
+        const { transaction } = z
+            .object({ transaction: z.string().regex(opaquePattern) })
             .parse(await response.json());
-        const accountUrl = `${issuerUrl}/account#handoff=${handoff}`;
-        if (body.redirect)
-            return new Response(null, {
-                status: 303,
-                headers: {
-                    Location: accountUrl,
-                    "Cache-Control": "no-store",
-                    "Referrer-Policy": "no-referrer",
-                },
+        const pending = btoa(encodeURIComponent(JSON.stringify({
+            state,
+            verifier,
+            returnTo,
+            manageAccount,
+            expires: Date.now() + BROWSER_FLOW_TTL_MS,
+        })));
+        const authorizeUrl = `${issuerUrl}/authorize?transaction=${transaction}`;
+        const pendingCookies = [
+            ...sessionUpdates,
+            serializeCookie(cookieName(audience, state), pending, {
+                maxAge: BROWSER_FLOW_TTL_MS / 1000,
+                secure: audience.startsWith("https:"),
+            }),
+        ];
+        if (body.redirect) {
+            const headers = new Headers({
+                Location: authorizeUrl,
+                "Cache-Control": "no-store",
+                "Referrer-Policy": "no-referrer",
             });
-        return reply({ accountUrl });
+            for (const cookie of pendingCookies)
+                headers.append("Set-Cookie", cookie);
+            return new Response(null, { status: 303, headers });
+        }
+        return reply({ loginId: state, authorizeUrl, accountUrl: authorizeUrl }, 200, pendingCookies);
+    }
+    catch {
+        return reply({ error: "login_unavailable" }, 502, sessionUpdates);
     }
-    const returnTo = safeReturnTo(body.returnTo ?? "/", audience, new URL(request.url).pathname);
-    if (!returnTo)
-        return reply({ error: "invalid_return_destination" }, 400);
-    const state = secret();
-    const verifier = secret();
-    const callback = `${audience}${new URL(request.url).pathname}`;
-    const response = await fetchIssuerApi(`${apiUrl}/api/auth/browser/transaction`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify({
-            audience,
-            callback,
-            state,
-            challenge: await pkce(verifier),
-            signUp: body.signUp ?? false,
-            accessKeyHash: body.accessKeyHash,
-        }),
-    });
-    if (!response.ok)
-        return reply({ error: "login_unavailable" }, response.status);
-    const { transaction } = z
-        .object({ transaction: z.string().regex(opaquePattern) })
-        .parse(await response.json());
-    const pending = btoa(encodeURIComponent(JSON.stringify({
-        state,
-        verifier,
-        returnTo,
-        expires: Date.now() + BROWSER_FLOW_TTL_MS,
-    })));
-    return reply({
-        loginId: state,
-        authorizeUrl: `${issuerUrl}/authorize?transaction=${transaction}`,
-    }, 200, [
-        serializeCookie(cookieName(audience, state), pending, {
-            maxAge: BROWSER_FLOW_TTL_MS / 1000,
-            secure: audience.startsWith("https:"),
-        }),
-    ]);
 }
 export async function finishBrowserSession(request, audience, issuerUrl, apiUrl = resolveIssuerApiUrl(issuerUrl)) {
     const url = new URL(request.url);
@@ -190,6 +213,15 @@ export async function finishBrowserSession(request, audience, issuerUrl, apiUrl
             throw new Error("Invalid session");
         for (const value of sessionCookies(audience, session.jwt, session.refreshToken))
             headers.append("Set-Cookie", value);
+        const accountsCookieName = `${cookieNamesFor(audience).refresh}.accounts`;
+        headers.append("Set-Cookie", session.accountsGrant
+            ? serializeCookie(accountsCookieName, session.accountsGrant, {
+                maxAge: 60 * 60 * 24 * 60,
+                secure: audience.startsWith("https:"),
+            })
+            : clearCookieString(accountsCookieName, {
+                secure: audience.startsWith("https:"),
+            }));
         if (session.webauthn) {
             const completion = btoa(encodeURIComponent(JSON.stringify({
                 loginId: state,
@@ -200,6 +232,8 @@ export async function finishBrowserSession(request, audience, issuerUrl, apiUrl
             headers.append("Set-Cookie", serializeCookie(`${cookieNamesFor(audience).refresh}.completion`, completion, { maxAge: 60, secure: audience.startsWith("https:") }));
         }
         headers.append("Set-Cookie", clear);
+        if (pending.manageAccount)
+            headers.set("Location", `${issuerUrl}/account`);
         return new Response(null, { status: 303, headers });
     }
     catch {

package/dist/sdk/client/create-flow.js

@@ -112,11 +112,20 @@ export function createFlow(options = {}) {
      * knows neither, and overwriting would erase state restored from IDB.
      */
     let additionalSubject = null;
-    function commitSession(session) {
-        const previous = store.getSnapshot().user?.id;
+    let sessionRevision = 0;
+    async function commitSession(session) {
+        const revision = ++sessionRevision;
+        const previousState = store.getSnapshot();
+        const previous = previousState.user?.id;
         if (previous && previous !== session.user.id) {
             store.setState({ credential: null, address: null });
-            void idb.delete("flow.activeCredential");
+            await idb.delete("flow.activeCredential");
+            if (previousState.address) {
+                const { clearAccessKey } = await import("./access-key");
+                await clearAccessKey(previousState.address);
+            }
+            if (revision !== sessionRevision)
+                return;
         }
         const next = {
             user: session.user,
@@ -147,6 +156,7 @@ export function createFlow(options = {}) {
         }
     }
     async function recoverAccessKey(state, loginCompletion) {
+        const revision = sessionRevision;
         const completionKey = "flow.pendingAccessKey.completion";
         if (loginCompletion)
             await idb.set(completionKey, {
@@ -164,10 +174,11 @@ export function createFlow(options = {}) {
                     throw new Error("Could not restore signing state");
                 // SAFETY: the app session handler returns the SDK protocol response.
                 const resolved = (await fresh.json());
-                if (resolved.state?.user.id === completion.userId &&
+                if (revision === sessionRevision &&
+                    resolved.state?.user.id === completion.userId &&
                     resolved.state.credential &&
                     resolved.state.address) {
-                    commitSession(resolved.state);
+                    await commitSession(resolved.state);
                     const { finalizeAccessKey } = await import("./access-key");
                     await finalizeAccessKey({
                         address: resolved.state.address,
@@ -189,7 +200,13 @@ export function createFlow(options = {}) {
      * false (never throws) when the visitor is signed out or the route is
      * unreachable — the caller then falls back to ensureGuest()/login().
      */
+    let sessionRequest = 0;
+    let logoutInFlight = null;
+    let logoutGeneration = 0;
     async function refreshViaSession() {
+        if (logoutInFlight)
+            return false;
+        const request = ++sessionRequest;
         try {
             const res = await fetch(sessionPath, {
                 headers: { Accept: "application/json" },
@@ -198,9 +215,9 @@ export function createFlow(options = {}) {
                 return false;
             // SAFETY: the app's own /flow/session route answers this shape.
             const { state, loginCompletion } = (await res.json());
-            if (!state)
+            if (!state || request !== sessionRequest)
                 return false;
-            commitSession(state);
+            await commitSession(state);
             await recoverAccessKey(state, loginCompletion).catch(() => { });
             return true;
         }
@@ -240,7 +257,11 @@ export function createFlow(options = {}) {
     // and the guard short-circuits a caller that arrives after a concurrent
     // holder already minted a fresh JWT.
     async function doRefresh() {
+        if (logoutInFlight)
+            return false;
         return withOriginLock("flow.id.refresh", async () => {
+            if (logoutInFlight)
+                return false;
             const current = store.getSnapshot().jwt;
             if (current && !isExpiring(current))
                 return true;
@@ -290,18 +311,27 @@ export function createFlow(options = {}) {
      * in-memory store (never IDB) — IDB is reserved for a real passkey credential.
      */
     async function ensureGuest() {
+        if (logoutInFlight)
+            return false;
         if (store.getSnapshot().user)
             return true;
         if (!guestInFlight) {
+            const generation = logoutGeneration;
             guestInFlight = withOriginLock("flow.id.guest", async () => {
                 // Re-check under the lock: another tab may have minted the guest while
                 // we waited. Refresh-first (from this origin's session cookie)
                 // recovers an existing session instead of minting a duplicate guest.
+                if (logoutInFlight || generation !== logoutGeneration)
+                    return false;
                 if (store.getSnapshot().user)
                     return true;
-                if (await doRefresh())
+                const restored = await doRefresh();
+                if (logoutInFlight || generation !== logoutGeneration)
+                    return false;
+                if (restored)
                     return true;
                 try {
+                    const request = ++sessionRequest;
                     const response = await fetch(sessionPath, {
                         method: "POST",
                         headers: { "Content-Type": "application/json" },
@@ -311,9 +341,9 @@ export function createFlow(options = {}) {
                         return false;
                     // SAFETY: the app session handler returns the SDK protocol response.
                     const result = (await response.json());
-                    if (!result.state)
+                    if (!result.state || request !== sessionRequest)
                         return false;
-                    commitSession(result.state);
+                    await commitSession(result.state);
                     return true;
                 }
                 catch {
@@ -329,13 +359,16 @@ export function createFlow(options = {}) {
         void idb.pruneExpired("flow.pendingAccessKey.").catch(() => { });
         if (options.autoRestore !== false) {
             const restored = await refreshViaSession();
-            if (restored) {
+            if (restored && !logoutInFlight) {
+                const request = ++sessionRequest;
                 const response = await fetch(`${sessionPath}?refresh=1`);
                 if (response.ok) {
                     // SAFETY: the app session handler returns the SDK protocol response.
                     const result = (await response.json());
+                    if (request !== sessionRequest)
+                        return;
                     if (result.state)
-                        commitSession(result.state);
+                        await commitSession(result.state);
                     else
                         await runLogout(store);
                 }
@@ -357,11 +390,30 @@ export function createFlow(options = {}) {
     }
     /** Starts top-level authentication; successful navigation never resolves in this document. */
     async function login(loginOpts = {}) {
+        return startLogin(loginOpts, "login");
+    }
+    async function switchAccounts(loginOpts = {}) {
+        return startLogin(loginOpts, "switch");
+    }
+    async function addAccount(loginOpts = {}) {
+        return startLogin(loginOpts, "add");
+    }
+    async function listAccounts() {
+        const response = await fetch(sessionPath, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ action: "accounts" }),
+        });
+        if (!response.ok)
+            throw new Error("Could not load saved accounts. Try again.");
+        return response.json();
+    }
+    async function startLogin(loginOpts, intent) {
         if (window.top !== window) {
             throw new Error("Open sign-in from the containing app.");
         }
         let preparation;
-        if (accessKeyOptions) {
+        if (accessKeyOptions && intent === "login") {
             const chain = getChain();
             if (!chain)
                 throw new Error("accessKey requires a configured chain");
@@ -372,7 +424,9 @@ export function createFlow(options = {}) {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({
-                action: "login",
+                action: intent === "add" ? "login" : intent,
+                intent,
+                userId: loginOpts.userId,
                 accessKeyHash: preparation?.accessKeyHash,
                 signUp: loginOpts.signUp,
                 returnTo: loginOpts.returnTo ??
@@ -396,6 +450,7 @@ export function createFlow(options = {}) {
     function openAccount() {
         const url = new URL(sessionPath, window.location.origin);
         url.searchParams.set("action", "account");
+        url.searchParams.set("returnTo", `${window.location.pathname}${window.location.search}${window.location.hash}`);
         const tab = window.open(url.href, "_blank");
         if (!tab)
             return false;
@@ -403,19 +458,37 @@ export function createFlow(options = {}) {
         return true;
     }
     async function logout() {
-        const response = await fetch(sessionPath, { method: "DELETE" });
-        if (!response.ok)
-            throw new Error("Could not sign out. Try again.");
-        await runLogout(store);
-        additionalSubject = null;
+        if (logoutInFlight)
+            return logoutInFlight;
+        ++logoutGeneration;
+        ++sessionRequest;
+        ++sessionRevision;
+        logoutInFlight = (async () => {
+            const response = await fetch(sessionPath, { method: "DELETE" });
+            if (!response.ok)
+                throw new Error("Could not sign out. Try again.");
+            ++sessionRequest;
+            ++sessionRevision;
+            await runLogout(store);
+            additionalSubject = null;
+        })();
+        try {
+            await logoutInFlight;
+        }
+        finally {
+            logoutInFlight = null;
+        }
         if (options.autoGuest)
             await ensureGuest();
     }
     let focusRefresh = null;
     const refreshOnFocus = () => {
-        if (document.visibilityState === "hidden" || focusRefresh)
+        if (document.visibilityState === "hidden" || focusRefresh || logoutInFlight)
             return;
         focusRefresh = withOriginLock("flow.id.refresh", async () => {
+            if (logoutInFlight)
+                return;
+            const request = ++sessionRequest;
             const response = await fetch(`${sessionPath}?refresh=1`, {
                 headers: { Accept: "application/json" },
             });
@@ -423,8 +496,10 @@ export function createFlow(options = {}) {
                 return;
             // SAFETY: the app session handler returns the SDK protocol response.
             const result = (await response.json());
+            if (request !== sessionRequest)
+                return;
             if (result.state)
-                commitSession(result.state);
+                await commitSession(result.state);
             else
                 await runLogout(store);
         })
@@ -456,6 +531,9 @@ export function createFlow(options = {}) {
         },
         login,
         openAccount,
+        switchAccounts,
+        addAccount,
+        listAccounts,
         logout,
         restore: refreshViaSession,
         ensureGuest,

package/dist/sdk/client/index.d.ts

@@ -1,5 +1,5 @@
 export { defaultIdHost, isLocalHostname } from "../id-host";
-export type { AccessKeyOptions, ActionCatalogEntry, ActionCatalogResponse, ActionCurve, ActionEventRequest, ActionEventResponse, ActionSubjectRef, ActionSurface, ActionsApi, ActionTransitionKind, ActiveAction, ActiveActionResponse, ActiveSessionConflict, AdditionalSession, Address, CatalogFieldRef, ClockAnchor, ConnectCapabilities, ConnectResponse, CreateFlowOptions, CreateStudySubjectInput, CurrentAction, DialogHost, FinishActionRequest, FinishActionResponse, FinishedSummary, Flow, FlowCredential, FlowSessionState, FlowState, FlowUser, FlowWidgetHandle, FlowWidgetName, FocusApi, FocusPhase, FocusSessionEvent, FocusSessionState, ListStudySessionsOptions, ListStudySubjectsOptions, LoginOptions, MarkNotificationsReadInput, MethodName, MountFlowWidgetOptions, MountProfileOptions, NotificationCounts, NotificationEntry, NotificationPage, NotificationReadResult, NotificationRefusal, OpenProfileOptions, ProfileButtonHandle, ProfilePosition, RoomMemberEntry, Session, StartActionInput, StartActionResponse, StartActionResult, StartFocusRequest, StudyApi, StudyCatalog, StudyCategory, StudyCategoryTotals, StudyField, StudyRange, StudySearchHit, StudySessionEntry, StudySessionPage, StudySubject, StudySubjectList, StudySubjectRefusal, StudySubjectRemovalResponse, StudySubjectResponse, StudySubjectTotals, StudySummary, UpdateStudySubjectInput, UserActionSurface, XpEstimateContext, XpMode, } from "../types";
+export type { AccessKeyOptions, ActionCatalogEntry, ActionCatalogResponse, ActionCurve, ActionEventRequest, ActionEventResponse, ActionSubjectRef, ActionSurface, ActionsApi, ActionTransitionKind, ActiveAction, ActiveActionResponse, ActiveSessionConflict, AdditionalSession, Address, BrowserAccount, BrowserAccounts, CatalogFieldRef, ClockAnchor, ConnectCapabilities, ConnectResponse, CreateFlowOptions, CreateStudySubjectInput, CurrentAction, DialogHost, FinishActionRequest, FinishActionResponse, FinishedSummary, Flow, FlowCredential, FlowSessionState, FlowState, FlowUser, FlowWidgetHandle, FlowWidgetName, FocusApi, FocusPhase, FocusSessionEvent, FocusSessionState, ListStudySessionsOptions, ListStudySubjectsOptions, LoginOptions, MarkNotificationsReadInput, MethodName, MountFlowWidgetOptions, MountProfileOptions, NotificationCounts, NotificationEntry, NotificationPage, NotificationReadResult, NotificationRefusal, OpenProfileOptions, ProfileButtonHandle, ProfilePosition, RoomMemberEntry, Session, StartActionInput, StartActionResponse, StartActionResult, StartFocusRequest, StudyApi, StudyCatalog, StudyCategory, StudyCategoryTotals, StudyField, StudyRange, StudySearchHit, StudySessionEntry, StudySessionPage, StudySubject, StudySubjectList, StudySubjectRefusal, StudySubjectRemovalResponse, StudySubjectResponse, StudySubjectTotals, StudySummary, SwitchAccountOptions, UpdateStudySubjectInput, UserActionSurface, XpEstimateContext, XpMode, } from "../types";
 export { consistencyCurve, estimateActionXp, FLOW_SCORE_MAX, flowMultiplier, } from "../xp/curve";
 export { ActionsRequestError, createActionsApi, isActiveSessionConflict, } from "./actions";
 export { createFlow, getFlow, requireFlow, resetFlow } from "./create-flow";

package/dist/sdk/client/profile-button.d.ts

@@ -1,3 +1,3 @@
 import type { MountProfileOptions, ProfileButtonHandle } from "../types";
-/** Mount an account button that signs guests in or opens full-account settings. */
+/** Mount the shared profile menu. Import @flow-industries/id/profile.css in non-Tailwind apps. */
 export declare function createProfileButton(options: MountProfileOptions): ProfileButtonHandle;