@glyphteck/veyl 0.63.7 → 0.64.0

package/dist/auth.js

@@ -458,6 +458,19 @@ function openAuth(options = {}) {
     const source = cleanText(operation.origin) || cleanText(configured) || cleanText(operation.webUrl) || cleanText(options.webUrl) || links.veyl;
     return new URL(source).origin;
   }
+  async function requireAuthenticatedUid(expectedUid = null) {
+    const uid = cleanText(transport.user?.uid);
+    const expected = cleanText(expectedUid);
+    if (uid && (!expected || uid === expected))
+      return uid;
+    const error = new Error(uid ? "account authentication mismatch" : "account authentication failed");
+    try {
+      await requireMethod(transport.logout, "account logout")();
+    } catch (cleanupError) {
+      error.cause = cleanupError;
+    }
+    throw error;
+  }
   async function createCredential(publicKeyOptions, operation = {}) {
     operation.onPrompt?.();
     const result = await requireMethod(ceremony.create, "passkey creation")(publicKeyOptions, operation);
@@ -488,8 +501,9 @@ function openAuth(options = {}) {
         return transport.register.token({ attestation });
       }
       await transport.register.finish({ attestation });
-      await operation.onVerified?.({ uid: start?.uid || null });
-      return { success: true, uid: start?.uid || null };
+      const uid = await requireAuthenticatedUid(start?.uid);
+      await operation.onVerified?.({ uid });
+      return { success: true, uid };
     } catch (error) {
       throw normalizePasskeyRegisterError(error, options.registerErrorOptions);
     }
@@ -507,8 +521,10 @@ function openAuth(options = {}) {
       if (tokenOnly) {
         return transport.login.token({ assertion });
       }
-      await transport.login.finish({ assertion }, operation.onVerified ? { onVerified: operation.onVerified } : undefined);
-      return { success: true };
+      await transport.login.finish({ assertion });
+      const uid = await requireAuthenticatedUid(operation.uid);
+      await operation.onVerified?.({ uid });
+      return { success: true, uid };
     } catch (error) {
       throw normalizePasskeyLoginError(error, options.loginErrorOptions);
     }
@@ -642,6 +658,12 @@ function openAuth(options = {}) {
       return transport.user || null;
     },
     subscribe: (listener) => transport.watch(listener),
+    activateToken: async (token) => {
+      if (!cleanText(token))
+        throw new Error("account session token required");
+      await requireMethod(transport.activateToken, "account session activation")(token);
+      return true;
+    },
     register: (operation) => register(operation),
     registerToken: (operation) => register(operation, true),
     login: (operation) => login(operation),
@@ -655,12 +677,6 @@ function openAuth(options = {}) {
         origin: operationOrigin(operation)
       }),
       add: addLink,
-      activate: async (sessionToken) => {
-        if (!cleanText(sessionToken))
-          throw new Error("passkey link session required");
-        await transport.passkeyLinks.activate(sessionToken);
-        return true;
-      },
       create: createLink
     }),
     passkeys: Object.freeze({