@gopherium/react-auth 0.6.0 → 0.8.0

package/dist/AuthGate.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 import { useQueryClient } from '@tanstack/react-query';
 import { __ } from '@wordpress/i18n';
 import { DOMAIN } from './domain.js';
-import { sessionQueryKey, useSession } from './session.js';
+import { adoptSession, useSession } from './session.js';
 /**
  * Guards its children behind a login session, rendering the given login
  * screen until the user is authenticated.
@@ -23,10 +23,7 @@ export function AuthGate({ children, loginScreen, loading = _jsx("p", { role: "s
         return _jsx(_Fragment, { children: loading });
     }
     if (session.data === null) {
-        return (_jsx(_Fragment, { children: loginScreen(async (user) => {
-                await queryClient.cancelQueries({ queryKey: sessionQueryKey });
-                queryClient.setQueryData(sessionQueryKey, user);
-            }) }));
+        return (_jsx(_Fragment, { children: loginScreen((user) => adoptSession(queryClient, user)) }));
     }
     return _jsx(_Fragment, { children: children });
 }

package/dist/admin/index.d.ts

@@ -15,17 +15,24 @@ export interface NewUser {
     password: string;
     role?: string;
 }
+export interface NewInvite {
+    email: string;
+    name: string;
+    role?: string;
+}
+declare const invitationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    delivered: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    delivered: z.ZodLiteral<false>;
+    activation_link: z.ZodString;
+}, z.core.$strip>], "delivered">;
+export type Invitation = z.infer<typeof invitationSchema>;
 /**
  * EmailTakenError is thrown when a new user's email is already in use.
  */
 export declare class EmailTakenError extends Error {
 }
-/**
- * ValidationError is thrown when the backend rejects the submitted user
- * details; its message is the backend's human-readable explanation.
- */
-export declare class ValidationError extends Error {
-}
+export { ValidationError } from '../api.js';
 /**
  * RoleRefusedError is thrown when the actor holds no role the server admits.
  */
@@ -66,4 +73,10 @@ export declare function setUserDisabled(id: string, disabled: boolean): Promise<
  * @param role - The role the account is to hold.
  */
 export declare function setUserRole(id: string, role: string): Promise<void>;
-export {};
+/**
+ * Sends an invitation, answering the same shape whatever the address's
+ * state, and holding every transport to the invitation contract.
+ * @param input - The email, name, and optional role of the invited account.
+ * @returns The delivery report, carrying the link when nothing mailed it.
+ */
+export declare function invite(input: NewInvite): Promise<Invitation>;

package/dist/admin/index.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { __ } from '@wordpress/i18n';
 import { z } from 'zod';
-import { UnauthorizedError } from '../api.js';
+import { RateLimitedError, UnauthorizedError, ValidationError } from '../api.js';
 import { DOMAIN } from '../domain.js';
 import { resolveTransport } from '../transport.js';
 export const usersQueryKey = ['users'];
@@ -13,17 +13,16 @@ const userSchema = z.object({
     role: z.string().default(''),
     created_at: z.coerce.date(),
 });
+const invitationSchema = z.discriminatedUnion('delivered', [
+    z.object({ delivered: z.literal(true) }),
+    z.object({ delivered: z.literal(false), activation_link: z.string().trim().min(1) }),
+]);
 /**
  * EmailTakenError is thrown when a new user's email is already in use.
  */
 export class EmailTakenError extends Error {
 }
-/**
- * ValidationError is thrown when the backend rejects the submitted user
- * details; its message is the backend's human-readable explanation.
- */
-export class ValidationError extends Error {
-}
+export { ValidationError } from '../api.js';
 /**
  * RoleRefusedError is thrown when the actor holds no role the server admits.
  */
@@ -95,6 +94,32 @@ async function restCreateUser(input) {
     }
     return userSchema.parse(await response.json());
 }
+/**
+ * Sends an invitation over REST, answering the same shape whatever the
+ * address's state.
+ * @param input - The email, name, and optional role of the invited account.
+ * @returns The delivery report, carrying the link when nothing mailed it.
+ */
+async function restInvite(input) {
+    const response = await fetch('/api/users/invite', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(input),
+    });
+    if (response.status === 401) {
+        throw new UnauthorizedError('session expired');
+    }
+    if (response.status === 422) {
+        throw new ValidationError(await errorMessage(response, __('invalid invitation details', DOMAIN)));
+    }
+    if (response.status === 429) {
+        throw new RateLimitedError('too many attempts');
+    }
+    if (!response.ok) {
+        throw new Error(`inviting failed with status ${response.status}`);
+    }
+    return invitationSchema.parse(await response.json());
+}
 /**
  * Updates an account's disabled flag over REST.
  * @param id - The identifier of the user to update.
@@ -130,24 +155,24 @@ async function restSetUserRole(id, role) {
     if (response.status === 401) {
         throw new UnauthorizedError('session expired');
     }
-    const refusal = await refusalOf(response);
-    if (refusal.code === 'role_insufficient') {
-        throw new RoleRefusedError(refusal.message);
+    const failed = await errorOf(response);
+    if (failed.code === 'role_insufficient') {
+        throw new RoleRefusedError(failed.message);
     }
-    if (refusal.code === 'self_role_refused') {
-        throw new SelfRoleError(refusal.message);
+    if (failed.code === 'self_role_refused') {
+        throw new SelfRoleError(failed.message);
     }
-    if (refusal.code === 'last_privileged_refused') {
-        throw new LastPrivilegedError(refusal.message);
+    if (failed.code === 'last_privileged_refused') {
+        throw new LastPrivilegedError(failed.message);
     }
     throw new Error(`updating role failed with status ${response.status}`);
 }
 /**
  * Returns the code and message a refused response carries.
  * @param response - The refused HTTP response.
- * @returns The refusal code, if any, and its message.
+ * @returns The error code, if any, and its message.
  */
-async function refusalOf(response) {
+async function errorOf(response) {
     try {
         const held = errorSchema.parse(await response.json());
         return { code: held.code, message: held.error };
@@ -188,3 +213,12 @@ export async function setUserDisabled(id, disabled) {
 export async function setUserRole(id, role) {
     await resolveTransport('setUserRole', restSetUserRole)(id, role);
 }
+/**
+ * Sends an invitation, answering the same shape whatever the address's
+ * state, and holding every transport to the invitation contract.
+ * @param input - The email, name, and optional role of the invited account.
+ * @returns The delivery report, carrying the link when nothing mailed it.
+ */
+export async function invite(input) {
+    return invitationSchema.parse(await resolveTransport('invite', restInvite)(input));
+}

package/dist/api.d.ts

@@ -23,6 +23,18 @@ export declare class UnauthorizedError extends Error {
  */
 export declare class RateLimitedError extends Error {
 }
+/**
+ * InvalidTokenError is thrown when an invitation or reset link is spent,
+ * expired, or unknown.
+ */
+export declare class InvalidTokenError extends Error {
+}
+/**
+ * ValidationError is thrown when the backend rejects submitted details;
+ * its message is the backend's human-readable explanation.
+ */
+export declare class ValidationError extends Error {
+}
 /**
  * Returns the logged-in user, or null when no session is active.
  * @param signal - Aborts the in-flight request.
@@ -40,4 +52,22 @@ export declare function login(email: string, password: string): Promise<User>;
  * Ends the current session.
  */
 export declare function logout(): Promise<void>;
+/**
+ * Accepts an invitation, setting the password and starting the session.
+ * @param token - The invitation link's secret.
+ * @param password - The password the person chose.
+ * @returns The signed-in user.
+ */
+export declare function acceptInvite(token: string, password: string): Promise<User>;
+/**
+ * Asks for a password reset link, answering nothing about the address.
+ * @param email - The address the link is mailed to.
+ */
+export declare function requestPasswordReset(email: string): Promise<void>;
+/**
+ * Replaces the password using a reset link's secret.
+ * @param token - The reset link's secret.
+ * @param password - The password the person chose.
+ */
+export declare function resetPassword(token: string, password: string): Promise<void>;
 export {};

package/dist/api.js

@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
+import { __ } from '@wordpress/i18n';
 import { z } from 'zod';
+import { DOMAIN } from './domain.js';
 import { resolveTransport } from './transport.js';
 const userSchema = z.object({
     id: z.string(),
@@ -24,6 +26,52 @@ export class UnauthorizedError extends Error {
  */
 export class RateLimitedError extends Error {
 }
+/**
+ * InvalidTokenError is thrown when an invitation or reset link is spent,
+ * expired, or unknown.
+ */
+export class InvalidTokenError extends Error {
+}
+/**
+ * ValidationError is thrown when the backend rejects submitted details;
+ * its message is the backend's human-readable explanation.
+ */
+export class ValidationError extends Error {
+}
+const refusalSchema = z.object({ error: z.string(), code: z.string().optional() });
+/**
+ * Reads the backend's refusal from a failed response body.
+ * @param response - The failed HTTP response.
+ * @param fallback - The message to use when the body is unreadable.
+ * @returns The refusal message and optional code.
+ */
+async function refusalOf(response, fallback) {
+    try {
+        const held = refusalSchema.parse(await response.json());
+        return { message: held.error, code: held.code };
+    }
+    catch {
+        return { message: fallback };
+    }
+}
+/**
+ * Maps a token route refusal onto the error class contract.
+ * @param response - The failed HTTP response.
+ * @returns The error to throw.
+ */
+async function tokenRefusal(response) {
+    if (response.status === 429) {
+        return new RateLimitedError('too many attempts');
+    }
+    if (response.status === 422) {
+        const refusal = await refusalOf(response, __('invalid password details', DOMAIN));
+        if (refusal.code === 'token_invalid') {
+            return new InvalidTokenError('the link is no longer valid');
+        }
+        return new ValidationError(refusal.message);
+    }
+    return new Error(`the request failed with status ${response.status}`);
+}
 /**
  * Loads the session over REST.
  * @param signal - Aborts the in-flight request.
@@ -62,6 +110,56 @@ async function restLogin(email, password) {
     }
     return userSchema.parse(await response.json());
 }
+/**
+ * Accepts an invitation over REST, setting the password and starting the
+ * session.
+ * @param token - The invitation link's secret.
+ * @param password - The password the person chose.
+ * @returns The signed-in user.
+ */
+async function restAcceptInvite(token, password) {
+    const response = await fetch('/api/auth/activate', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token, password }),
+    });
+    if (!response.ok) {
+        throw await tokenRefusal(response);
+    }
+    return userSchema.parse(await response.json());
+}
+/**
+ * Asks for a password reset link over REST.
+ * @param email - The address the link is mailed to.
+ */
+async function restRequestPasswordReset(email) {
+    const response = await fetch('/api/auth/password-reset', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email }),
+    });
+    if (response.status === 429) {
+        throw new RateLimitedError('too many attempts');
+    }
+    if (!response.ok) {
+        throw new Error(`the request failed with status ${response.status}`);
+    }
+}
+/**
+ * Replaces the password over REST using a reset link's secret.
+ * @param token - The reset link's secret.
+ * @param password - The password the person chose.
+ */
+async function restResetPassword(token, password) {
+    const response = await fetch('/api/auth/password-reset/confirm', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token, password }),
+    });
+    if (!response.ok) {
+        throw await tokenRefusal(response);
+    }
+}
 /**
  * Ends the session over REST.
  */
@@ -94,3 +192,27 @@ export async function login(email, password) {
 export async function logout() {
     await resolveTransport('logout', restLogout)();
 }
+/**
+ * Accepts an invitation, setting the password and starting the session.
+ * @param token - The invitation link's secret.
+ * @param password - The password the person chose.
+ * @returns The signed-in user.
+ */
+export async function acceptInvite(token, password) {
+    return resolveTransport('acceptInvite', restAcceptInvite)(token, password);
+}
+/**
+ * Asks for a password reset link, answering nothing about the address.
+ * @param email - The address the link is mailed to.
+ */
+export async function requestPasswordReset(email) {
+    await resolveTransport('requestPasswordReset', restRequestPasswordReset)(email);
+}
+/**
+ * Replaces the password using a reset link's secret.
+ * @param token - The reset link's secret.
+ * @param password - The password the person chose.
+ */
+export async function resetPassword(token, password) {
+    await resolveTransport('resetPassword', restResetPassword)(token, password);
+}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { InvalidCredentialsError, RateLimitedError, UnauthorizedError, fetchSession, login, logout, } from './api.js';
+export { InvalidCredentialsError, InvalidTokenError, RateLimitedError, UnauthorizedError, ValidationError, acceptInvite, fetchSession, login, logout, requestPasswordReset, resetPassword, } from './api.js';
 export type { User } from './api.js';
 export { AuthGate } from './AuthGate.js';
 export { DOMAIN } from './domain.js';
@@ -6,6 +6,6 @@ export { catalogFor } from './languages.js';
 export type { Catalog } from './languages.js';
 export { isSessionRevoked } from './probe.js';
 export { createAuthQueryClient } from './queryClient.js';
-export { sessionQueryKey, useLogout, useSession } from './session.js';
+export { adoptSession, sessionQueryKey, useLogout, useSession } from './session.js';
 export { configureAuthTransport, resetAuthTransport } from './transport.js';
 export type { AuthTransport } from './transport.js';

package/dist/index.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
-export { InvalidCredentialsError, RateLimitedError, UnauthorizedError, fetchSession, login, logout, } from './api.js';
+export { InvalidCredentialsError, InvalidTokenError, RateLimitedError, UnauthorizedError, ValidationError, acceptInvite, fetchSession, login, logout, requestPasswordReset, resetPassword, } from './api.js';
 export { AuthGate } from './AuthGate.js';
 export { DOMAIN } from './domain.js';
 export { catalogFor } from './languages.js';
 export { isSessionRevoked } from './probe.js';
 export { createAuthQueryClient } from './queryClient.js';
-export { sessionQueryKey, useLogout, useSession } from './session.js';
+export { adoptSession, sessionQueryKey, useLogout, useSession } from './session.js';
 export { configureAuthTransport, resetAuthTransport } from './transport.js';

package/dist/languages/es-ES.json

@@ -1 +1 @@
-{ "": { "lang": "es-ES", "plural-forms": "nplurals=2; plural=(n != 1);" }, "Actions": ["Acciones"], "Active": ["Activo"], "Create user": ["Crear usuario"], "Disable": ["Desactivar"], "Disable %s": ["Desactivar a %s"], "Disabled": ["Desactivado"], "Enable": ["Activar"], "Enable %s": ["Activar a %s"], "Invalid email or password.": ["Correo o contraseña no válidos."], "Loading users…": ["Cargando usuarios…"], "Loading…": ["Cargando…"], "Log in": ["Iniciar sesión"], "Log out": ["Cerrar sesión"], "Login failed, please try again.": ["No se pudo iniciar sesión, inténtalo de nuevo."], "Logout failed, please try again.": ["No se pudo cerrar sesión, inténtalo de nuevo."], "Password": ["Contraseña"], "Something went wrong.": ["Algo ha ido mal."], "That email is already in use.": ["Ese correo ya está en uso."], "The user could not be created.": ["No se pudo crear el usuario."], "Too many attempts. Please wait a minute and try again.": ["Demasiados intentos. Espera un minuto e inténtalo de nuevo."], "Update failed.": ["No se pudo actualizar."], "Users could not be loaded.": ["No se pudieron cargar los usuarios."], "admin section\u0004Users": ["Usuarios"], "button\u0004New user": ["Nuevo usuario"], "column\u0004Email": ["Correo"], "column\u0004Name": ["Nombre"], "column\u0004Status": ["Estado"], "field label\u0004Email": ["Correo"], "field label\u0004Name": ["Nombre"], "invalid user details": ["datos de usuario no válidos"], "page heading\u0004New user": ["Nuevo usuario"], "page heading\u0004Users": ["Usuarios"], "the account could not be updated": ["no se ha podido actualizar la cuenta"] }
+{ "": { "lang": "es-ES", "plural-forms": "nplurals=2; plural=(n != 1);" }, "Actions": ["Acciones"], "Active": ["Activo"], "Back to login": ["Volver al inicio de sesión"], "Disable": ["Desactivar"], "Disable %s": ["Desactivar a %s"], "Disabled": ["Desactivado"], "Done": ["Hecho"], "Enable": ["Activar"], "Enable %s": ["Activar a %s"], "Forgot your password?": ["¿Has olvidado tu contraseña?"], "Go to login": ["Ir al inicio de sesión"], "If that address has an account, a reset link is on its way.": ["Si esa dirección tiene una cuenta, le llegará un enlace para restablecerla."], "Invalid email or password.": ["Correo o contraseña no válidos."], "Loading users…": ["Cargando usuarios…"], "Loading…": ["Cargando…"], "Log in": ["Iniciar sesión"], "Log out": ["Cerrar sesión"], "Login failed, please try again.": ["No se pudo iniciar sesión, inténtalo de nuevo."], "Logout failed, please try again.": ["No se pudo cerrar sesión, inténtalo de nuevo."], "No mail server is configured. Deliver the activation link by hand.": ["No hay servidor de correo configurado. Entrega el enlace de activación a mano."], "Password": ["Contraseña"], "Send invitation": ["Enviar invitación"], "Send reset link": ["Enviar enlace de restablecimiento"], "Set password": ["Guardar contraseña"], "Something went wrong.": ["Algo ha ido mal."], "The invitation could not be sent.": ["No se pudo enviar la invitación."], "The password could not be set, please try again.": ["No se pudo guardar la contraseña, inténtalo de nuevo."], "The request failed, please try again.": ["No se pudo completar la petición, inténtalo de nuevo."], "This link is no longer valid. Ask for a new one.": ["Este enlace ya no es válido. Pide uno nuevo."], "This link is no longer valid. Ask the person who invited you for a new one.": ["Este enlace ya no es válido. Pide uno nuevo a quien te invitó."], "Too many attempts. Please wait a minute and try again.": ["Demasiados intentos. Espera un minuto e inténtalo de nuevo."], "Try again": ["Inténtalo de nuevo"], "Update failed.": ["No se pudo actualizar."], "Users could not be loaded.": ["No se pudieron cargar los usuarios."], "Your password is set. Sign in with it.": ["Tu contraseña está guardada. Inicia sesión con ella."], "admin section\u0004Users": ["Usuarios"], "button\u0004New user": ["Nuevo usuario"], "column\u0004Email": ["Correo"], "column\u0004Name": ["Nombre"], "column\u0004Status": ["Estado"], "field label\u0004Activation link": ["Enlace de activación"], "field label\u0004Email": ["Correo"], "field label\u0004Name": ["Nombre"], "invalid invitation details": ["datos de invitación no válidos"], "invalid password details": ["datos de contraseña no válidos"], "invalid user details": ["datos de usuario no válidos"], "page heading\u0004New user": ["Nuevo usuario"], "page heading\u0004Users": ["Usuarios"], "the account could not be updated": ["no se ha podido actualizar la cuenta"] }

package/dist/languages/languages/es-ES.json

@@ -1 +1 @@
-{"":{"lang":"es-ES","plural-forms":"nplurals=2; plural=(n != 1);"},"Actions":["Acciones"],"Active":["Activo"],"Create user":["Crear usuario"],"Disable":["Desactivar"],"Disable %s":["Desactivar a %s"],"Disabled":["Desactivado"],"Enable":["Activar"],"Enable %s":["Activar a %s"],"Invalid email or password.":["Correo o contraseña no válidos."],"Loading users…":["Cargando usuarios…"],"Loading…":["Cargando…"],"Log in":["Iniciar sesión"],"Log out":["Cerrar sesión"],"Login failed, please try again.":["No se pudo iniciar sesión, inténtalo de nuevo."],"Logout failed, please try again.":["No se pudo cerrar sesión, inténtalo de nuevo."],"Password":["Contraseña"],"Something went wrong.":["Algo ha ido mal."],"That email is already in use.":["Ese correo ya está en uso."],"The user could not be created.":["No se pudo crear el usuario."],"Too many attempts. Please wait a minute and try again.":["Demasiados intentos. Espera un minuto e inténtalo de nuevo."],"Update failed.":["No se pudo actualizar."],"Users could not be loaded.":["No se pudieron cargar los usuarios."],"admin section\u0004Users":["Usuarios"],"button\u0004New user":["Nuevo usuario"],"column\u0004Email":["Correo"],"column\u0004Name":["Nombre"],"column\u0004Status":["Estado"],"field label\u0004Email":["Correo"],"field label\u0004Name":["Nombre"],"invalid user details":["datos de usuario no válidos"],"page heading\u0004New user":["Nuevo usuario"],"page heading\u0004Users":["Usuarios"],"the account could not be updated":["no se ha podido actualizar la cuenta"]}
+{"":{"lang":"es-ES","plural-forms":"nplurals=2; plural=(n != 1);"},"Actions":["Acciones"],"Active":["Activo"],"Back to login":["Volver al inicio de sesión"],"Disable":["Desactivar"],"Disable %s":["Desactivar a %s"],"Disabled":["Desactivado"],"Done":["Hecho"],"Enable":["Activar"],"Enable %s":["Activar a %s"],"Forgot your password?":["¿Has olvidado tu contraseña?"],"Go to login":["Ir al inicio de sesión"],"If that address has an account, a reset link is on its way.":["Si esa dirección tiene una cuenta, le llegará un enlace para restablecerla."],"Invalid email or password.":["Correo o contraseña no válidos."],"Loading users…":["Cargando usuarios…"],"Loading…":["Cargando…"],"Log in":["Iniciar sesión"],"Log out":["Cerrar sesión"],"Login failed, please try again.":["No se pudo iniciar sesión, inténtalo de nuevo."],"Logout failed, please try again.":["No se pudo cerrar sesión, inténtalo de nuevo."],"No mail server is configured. Deliver the activation link by hand.":["No hay servidor de correo configurado. Entrega el enlace de activación a mano."],"Password":["Contraseña"],"Send invitation":["Enviar invitación"],"Send reset link":["Enviar enlace de restablecimiento"],"Set password":["Guardar contraseña"],"Something went wrong.":["Algo ha ido mal."],"The invitation could not be sent.":["No se pudo enviar la invitación."],"The password could not be set, please try again.":["No se pudo guardar la contraseña, inténtalo de nuevo."],"The request failed, please try again.":["No se pudo completar la petición, inténtalo de nuevo."],"This link is no longer valid. Ask for a new one.":["Este enlace ya no es válido. Pide uno nuevo."],"This link is no longer valid. Ask the person who invited you for a new one.":["Este enlace ya no es válido. Pide uno nuevo a quien te invitó."],"Too many attempts. Please wait a minute and try again.":["Demasiados intentos. Espera un minuto e inténtalo de nuevo."],"Try again":["Inténtalo de nuevo"],"Update failed.":["No se pudo actualizar."],"Users could not be loaded.":["No se pudieron cargar los usuarios."],"Your password is set. Sign in with it.":["Tu contraseña está guardada. Inicia sesión con ella."],"admin section\u0004Users":["Usuarios"],"button\u0004New user":["Nuevo usuario"],"column\u0004Email":["Correo"],"column\u0004Name":["Nombre"],"column\u0004Status":["Estado"],"field label\u0004Activation link":["Enlace de activación"],"field label\u0004Email":["Correo"],"field label\u0004Name":["Nombre"],"invalid invitation details":["datos de invitación no válidos"],"invalid password details":["datos de contraseña no válidos"],"invalid user details":["datos de usuario no válidos"],"page heading\u0004New user":["Nuevo usuario"],"page heading\u0004Users":["Usuarios"],"the account could not be updated":["no se ha podido actualizar la cuenta"]}

package/dist/session.d.ts

@@ -1,3 +1,5 @@
+import type { QueryClient } from '@tanstack/react-query';
+import type { User } from './api.js';
 /**
  * sessionQueryKey is the react-query key the login session is cached under.
  */
@@ -18,3 +20,10 @@ export declare function useSession(): import("@tanstack/react-query").UseQueryRe
  * @returns The logout mutation.
  */
 export declare function useLogout(): import("@tanstack/react-query").UseMutationResult<void, Error, void, unknown>;
+/**
+ * Installs a freshly authenticated user as the cached session, cancelling
+ * any in-flight fetch and dropping what the previous account left cached.
+ * @param client - The query client holding the session.
+ * @param user - The authenticated user to install.
+ */
+export declare function adoptSession(client: QueryClient, user: User): Promise<void>;

package/dist/session.js

@@ -33,3 +33,16 @@ export function useLogout() {
         },
     });
 }
+/**
+ * Installs a freshly authenticated user as the cached session, cancelling
+ * any in-flight fetch and dropping what the previous account left cached.
+ * @param client - The query client holding the session.
+ * @param user - The authenticated user to install.
+ */
+export async function adoptSession(client, user) {
+    await client.cancelQueries();
+    client.setQueryData(sessionQueryKey, user);
+    client.removeQueries({
+        predicate: (query) => query.queryHash !== hashKey(sessionQueryKey),
+    });
+}

package/dist/testing/index.d.ts

@@ -17,6 +17,53 @@ export declare const defaultUser: User;
  * @returns The account.
  */
 export declare function userWithRole(role: string): User;
+/**
+ * Answers an invitation as mailed.
+ * @returns The msw handler.
+ */
+export declare function inviteDelivered(): import("msw").HttpHandler;
+/**
+ * Answers an invitation with the by-hand activation link.
+ * @param link - The activation link the admin delivers by hand.
+ * @returns The msw handler.
+ */
+export declare function inviteUndelivered(link: string): import("msw").HttpHandler;
+/**
+ * Fails the invitation endpoint with a server error.
+ * @returns The msw handler.
+ */
+export declare function inviteFailure(): import("msw").HttpHandler;
+/**
+ * Accepts an activation with the given user.
+ * @param user - The user the activation signs in.
+ * @returns The msw handler.
+ */
+export declare function activateOk(user?: User): import("msw").HttpHandler;
+/**
+ * Refuses an activation for a dead link.
+ * @returns The msw handler.
+ */
+export declare function activateInvalidToken(): import("msw").HttpHandler;
+/**
+ * Accepts a password reset request with the neutral answer.
+ * @returns The msw handler.
+ */
+export declare function resetRequestOk(): import("msw").HttpHandler;
+/**
+ * Refuses a password reset request for too many attempts.
+ * @returns The msw handler.
+ */
+export declare function resetRequestRateLimited(): import("msw").HttpHandler;
+/**
+ * Accepts a password reset confirmation.
+ * @returns The msw handler.
+ */
+export declare function resetOk(): import("msw").HttpHandler;
+/**
+ * Refuses a password reset confirmation for a dead link.
+ * @returns The msw handler.
+ */
+export declare function resetInvalidToken(): import("msw").HttpHandler;
 /**
  * Accepts a role change.
  * @returns The msw handler.

package/dist/testing/index.js

@@ -46,6 +46,71 @@ export function userWithRole(role) {
         role,
     };
 }
+/**
+ * Answers an invitation as mailed.
+ * @returns The msw handler.
+ */
+export function inviteDelivered() {
+    return http.post('/api/users/invite', () => HttpResponse.json({ delivered: true }));
+}
+/**
+ * Answers an invitation with the by-hand activation link.
+ * @param link - The activation link the admin delivers by hand.
+ * @returns The msw handler.
+ */
+export function inviteUndelivered(link) {
+    return http.post('/api/users/invite', () => HttpResponse.json({ delivered: false, activation_link: link }));
+}
+/**
+ * Fails the invitation endpoint with a server error.
+ * @returns The msw handler.
+ */
+export function inviteFailure() {
+    return http.post('/api/users/invite', () => HttpResponse.json({ error: 'internal error' }, { status: 500 }));
+}
+/**
+ * Accepts an activation with the given user.
+ * @param user - The user the activation signs in.
+ * @returns The msw handler.
+ */
+export function activateOk(user = defaultUser) {
+    return http.post('/api/auth/activate', () => HttpResponse.json(user));
+}
+/**
+ * Refuses an activation for a dead link.
+ * @returns The msw handler.
+ */
+export function activateInvalidToken() {
+    return http.post('/api/auth/activate', () => HttpResponse.json({ error: 'token not found', code: 'token_invalid' }, { status: 422 }));
+}
+/**
+ * Accepts a password reset request with the neutral answer.
+ * @returns The msw handler.
+ */
+export function resetRequestOk() {
+    return http.post('/api/auth/password-reset', () => new HttpResponse(null, { status: 204 }));
+}
+/**
+ * Refuses a password reset request for too many attempts.
+ * @returns The msw handler.
+ */
+export function resetRequestRateLimited() {
+    return http.post('/api/auth/password-reset', () => HttpResponse.json({ error: 'slow down' }, { status: 429 }));
+}
+/**
+ * Accepts a password reset confirmation.
+ * @returns The msw handler.
+ */
+export function resetOk() {
+    return http.post('/api/auth/password-reset/confirm', () => new HttpResponse(null, { status: 204 }));
+}
+/**
+ * Refuses a password reset confirmation for a dead link.
+ * @returns The msw handler.
+ */
+export function resetInvalidToken() {
+    return http.post('/api/auth/password-reset/confirm', () => HttpResponse.json({ error: 'token not found', code: 'token_invalid' }, { status: 422 }));
+}
 /**
  * Accepts a role change.
  * @returns The msw handler.

package/dist/transport.d.ts

@@ -1,4 +1,4 @@
-import type { User as Account, NewUser } from './admin/index.js';
+import type { Invitation, NewInvite, User as Account, NewUser } from './admin/index.js';
 import type { User } from './api.js';
 /**
  * AuthTransport carries every backend call of the package, so a consumer
@@ -15,6 +15,10 @@ export interface AuthTransport {
     createUser(input: NewUser): Promise<Account>;
     setUserDisabled(id: string, disabled: boolean): Promise<void>;
     setUserRole(id: string, role: string): Promise<void>;
+    invite(input: NewInvite): Promise<Invitation>;
+    acceptInvite(token: string, password: string): Promise<User>;
+    requestPasswordReset(email: string): Promise<void>;
+    resetPassword(token: string, password: string): Promise<void>;
 }
 /**
  * Replaces backend calls with the given implementations, keeping the REST

package/dist/wpds/LoginScreen.d.ts

@@ -5,7 +5,8 @@ import type { User } from '../api.js';
  * @param onLogin - Called with the user after a successful login.
  * @returns The login screen element.
  */
-export declare function LoginScreen({ brand, onLogin, }: {
+export declare function LoginScreen({ brand, onLogin, onForgotPassword, }: {
     brand: string;
     onLogin: (user: User) => void | Promise<void>;
+    onForgotPassword?: () => void;
 }): import("react").JSX.Element;

package/dist/wpds/LoginScreen.js

@@ -26,7 +26,7 @@ function loginErrorMessage(error) {
  * @param onLogin - Called with the user after a successful login.
  * @returns The login screen element.
  */
-export function LoginScreen({ brand, onLogin, }) {
+export function LoginScreen({ brand, onLogin, onForgotPassword, }) {
     const [email, setEmail] = useState('');
     const [password, setPassword] = useState('');
     const attempt = useMutation({
@@ -36,5 +36,5 @@ export function LoginScreen({ brand, onLogin, }) {
     return (_jsx("div", { className: "gopherium-login", children: _jsx(Card.Root, { className: "gopherium-login__card", children: _jsx(Card.Content, { children: _jsx("form", { onSubmit: (event) => {
                         event.preventDefault();
                         attempt.mutate();
-                    }, children: _jsxs(Stack, { direction: "column", gap: "lg", children: [_jsx(Text, { variant: "heading-lg", render: _jsx("h1", {}), children: brand }), _jsx(InputControl, { label: _x('Email', 'field label', DOMAIN), type: "email", value: email, onChange: (event) => setEmail(event.target.value) }), _jsx(InputControl, { label: __('Password', DOMAIN), type: "password", value: password, onChange: (event) => setPassword(event.target.value) }), _jsx(Button, { type: "submit", disabled: email.trim() === '' || password === '' || attempt.isPending, loading: attempt.isPending, children: __('Log in', DOMAIN) }), attempt.isError ? (_jsx(Text, { role: "alert", children: loginErrorMessage(attempt.error) })) : null] }) }) }) }) }));
+                    }, children: _jsxs(Stack, { direction: "column", gap: "lg", children: [_jsx(Text, { variant: "heading-lg", render: _jsx("h1", {}), children: brand }), _jsx(InputControl, { label: _x('Email', 'field label', DOMAIN), type: "email", autoComplete: "username", value: email, onChange: (event) => setEmail(event.target.value) }), _jsx(InputControl, { label: __('Password', DOMAIN), type: "password", autoComplete: "current-password", value: password, onChange: (event) => setPassword(event.target.value) }), _jsx(Button, { type: "submit", disabled: email.trim() === '' || password === '' || attempt.isPending, loading: attempt.isPending, children: __('Log in', DOMAIN) }), attempt.isError ? (_jsx(Text, { role: "alert", children: loginErrorMessage(attempt.error) })) : null, onForgotPassword ? (_jsx(Button, { type: "button", variant: "outline", onClick: onForgotPassword, children: __('Forgot your password?', DOMAIN) })) : null] }) }) }) }) }));
 }

package/dist/wpds/NewUserScreen.d.ts

@@ -1,7 +1,7 @@
 /**
- * Renders the new user form, creating an account and reporting success
- * upward, typically for the app to navigate back to its user list.
- * @param onCreated - Called after the account is created.
+ * Renders the new user form, sending an invitation and reporting success
+ * upward, or showing the activation link when no mail server delivered it.
+ * @param onCreated - Called after the invitation is handled.
  * @returns The new user screen element.
  */
 export declare function NewUserScreen({ onCreated, }: {

package/dist/wpds/NewUserScreen.js

@@ -4,46 +4,67 @@ import { useMutation, useQueryClient } from '@tanstack/react-query';
 import { __, _x } from '@wordpress/i18n';
 import { Button, InputControl, Stack, Text } from '@wordpress/ui';
 import { useState } from 'react';
-import { EmailTakenError, ValidationError, createUser, usersQueryKey } from '../admin/index.js';
+import { ValidationError, invite, usersQueryKey } from '../admin/index.js';
 import { DOMAIN } from '../domain.js';
+import { Outcome } from './Outcome.js';
 /**
- * Maps a creation failure to the message shown under the form, surfacing
- * the backend's explanation for rejected input.
- * @param error - The error thrown by the create mutation.
- * @returns The human-readable failure message.
+ * Maps the screen's failures to the message shown beside the form,
+ * surfacing the backend's explanation for rejected input.
+ * @param invited - The error the invitation raised, if any.
+ * @param handedOff - The error handing the invitation onward raised, if any.
+ * @returns The message to display, or null when nothing failed.
  */
-function createErrorMessage(error) {
-    if (error instanceof EmailTakenError) {
-        return __('That email is already in use.', DOMAIN);
+function failureMessage(invited, handedOff) {
+    if (invited instanceof ValidationError) {
+        return invited.message;
     }
-    if (error instanceof ValidationError) {
-        return error.message;
+    if (invited) {
+        return __('The invitation could not be sent.', DOMAIN);
     }
-    return __('The user could not be created.', DOMAIN);
+    if (handedOff) {
+        return __('Something went wrong.', DOMAIN);
+    }
+    return null;
 }
 /**
- * Renders the new user form, creating an account and reporting success
- * upward, typically for the app to navigate back to its user list.
- * @param onCreated - Called after the account is created.
+ * Renders the new user form, sending an invitation and reporting success
+ * upward, or showing the activation link when no mail server delivered it.
+ * @param onCreated - Called after the invitation is handled.
  * @returns The new user screen element.
  */
 export function NewUserScreen({ onCreated, }) {
     const queryClient = useQueryClient();
     const [email, setEmail] = useState('');
     const [name, setName] = useState('');
-    const [password, setPassword] = useState('');
+    const [activationLink, setActivationLink] = useState(null);
+    const finish = useMutation({
+        mutationFn: async () => {
+            await onCreated?.();
+        },
+    });
     const create = useMutation({
-        mutationFn: () => createUser({ email: email.trim(), name: name.trim(), password }),
-        onSuccess: async () => {
+        mutationFn: () => invite({ email: email.trim(), name: name.trim() }),
+        onMutate: () => {
+            finish.reset();
+        },
+        onSuccess: async (invitation) => {
             await queryClient.invalidateQueries({ queryKey: usersQueryKey });
-            await onCreated?.();
+            if (invitation.delivered) {
+                finish.mutate();
+                return;
+            }
+            setActivationLink(invitation.activation_link);
         },
     });
+    const failure = failureMessage(create.error, finish.error);
+    if (activationLink !== null) {
+        return (_jsxs(Stack, { direction: "column", gap: "lg", children: [_jsx(Text, { variant: "heading-lg", render: _jsx("h1", {}), children: _x('New user', 'page heading', DOMAIN) }), _jsx(Outcome, { children: _jsx(Text, { children: __('No mail server is configured. Deliver the activation link by hand.', DOMAIN) }) }), _jsx(InputControl, { label: _x('Activation link', 'field label', DOMAIN), readOnly: true, value: activationLink }), _jsx(Button, { type: "button", disabled: finish.isPending, loading: finish.isPending, onClick: () => finish.mutate(), children: __('Done', DOMAIN) }), failure ? _jsx(Text, { role: "alert", children: failure }) : null] }));
+    }
     return (_jsxs(Stack, { direction: "column", gap: "lg", children: [_jsx(Text, { variant: "heading-lg", render: _jsx("h1", {}), children: _x('New user', 'page heading', DOMAIN) }), _jsx("form", { onSubmit: (event) => {
                     event.preventDefault();
                     create.mutate();
-                }, children: _jsxs(Stack, { direction: "column", gap: "md", children: [_jsx(InputControl, { label: _x('Email', 'field label', DOMAIN), type: "email", autoComplete: "off", value: email, onChange: (event) => setEmail(event.target.value) }), _jsx(InputControl, { label: _x('Name', 'field label', DOMAIN), autoComplete: "off", value: name, onChange: (event) => setName(event.target.value) }), _jsx(InputControl, { label: __('Password', DOMAIN), type: "password", autoComplete: "new-password", value: password, onChange: (event) => setPassword(event.target.value) }), _jsx(Button, { type: "submit", disabled: email.trim() === '' ||
+                }, children: _jsxs(Stack, { direction: "column", gap: "md", children: [_jsx(InputControl, { label: _x('Email', 'field label', DOMAIN), type: "email", autoComplete: "off", value: email, onChange: (event) => setEmail(event.target.value) }), _jsx(InputControl, { label: _x('Name', 'field label', DOMAIN), autoComplete: "off", value: name, onChange: (event) => setName(event.target.value) }), _jsx(Button, { type: "submit", disabled: email.trim() === '' ||
                                 name.trim() === '' ||
-                                password === '' ||
-                                create.isPending, children: __('Create user', DOMAIN) }), create.isError ? (_jsx(Text, { role: "alert", children: createErrorMessage(create.error) })) : null] }) })] }));
+                                create.isPending ||
+                                finish.isPending, loading: create.isPending || finish.isPending, children: __('Send invitation', DOMAIN) }), failure ? _jsx(Text, { role: "alert", children: failure }) : null] }) })] }));
 }

package/dist/wpds/Outcome.d.ts

@@ -0,0 +1,9 @@
+import type { ReactNode } from 'react';
+/**
+ * Announces an in-screen outcome, taking focus so it is read aloud.
+ * @param children - The outcome to announce.
+ * @returns The focused status element.
+ */
+export declare function Outcome({ children }: {
+    children: ReactNode;
+}): import("react").JSX.Element;

package/dist/wpds/Outcome.js

@@ -0,0 +1,15 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+// SPDX-License-Identifier: Apache-2.0
+import { useEffect, useRef } from 'react';
+/**
+ * Announces an in-screen outcome, taking focus so it is read aloud.
+ * @param children - The outcome to announce.
+ * @returns The focused status element.
+ */
+export function Outcome({ children }) {
+    const held = useRef(null);
+    useEffect(() => {
+        held.current?.focus();
+    }, []);
+    return (_jsx("div", { role: "status", tabIndex: -1, ref: held, children: children }));
+}

package/dist/wpds/RequestResetScreen.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Renders the forgotten password form, answering the same sentence
+ * whatever the address.
+ * @param brand - The product name shown above the form.
+ * @param onBack - Called when the user heads back to the login.
+ * @returns The request reset screen element.
+ */
+export declare function RequestResetScreen({ brand, onBack, }: {
+    brand: string;
+    onBack?: () => void;
+}): import("react").JSX.Element;

package/dist/wpds/RequestResetScreen.js

@@ -0,0 +1,37 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// SPDX-License-Identifier: Apache-2.0
+import { useMutation } from '@tanstack/react-query';
+import { __, _x } from '@wordpress/i18n';
+import { Button, Card, InputControl, Stack, Text } from '@wordpress/ui';
+import { useState } from 'react';
+import { RateLimitedError, requestPasswordReset } from '../api.js';
+import { DOMAIN } from '../domain.js';
+import { Outcome } from './Outcome.js';
+/**
+ * Maps a reset request failure to the message shown to the user.
+ * @param error - The error thrown by the request attempt.
+ * @returns The message to display.
+ */
+function requestErrorMessage(error) {
+    if (error instanceof RateLimitedError) {
+        return __('Too many attempts. Please wait a minute and try again.', DOMAIN);
+    }
+    return __('The request failed, please try again.', DOMAIN);
+}
+/**
+ * Renders the forgotten password form, answering the same sentence
+ * whatever the address.
+ * @param brand - The product name shown above the form.
+ * @param onBack - Called when the user heads back to the login.
+ * @returns The request reset screen element.
+ */
+export function RequestResetScreen({ brand, onBack, }) {
+    const [email, setEmail] = useState('');
+    const attempt = useMutation({
+        mutationFn: () => requestPasswordReset(email.trim()),
+    });
+    return (_jsx("div", { className: "gopherium-login", children: _jsx(Card.Root, { className: "gopherium-login__card", children: _jsx(Card.Content, { children: _jsxs(Stack, { direction: "column", gap: "lg", children: [_jsx(Text, { variant: "heading-lg", render: _jsx("h1", {}), children: brand }), attempt.isSuccess ? (_jsx(Outcome, { children: _jsx(Text, { children: __('If that address has an account, a reset link is on its way.', DOMAIN) }) })) : (_jsx("form", { onSubmit: (event) => {
+                                event.preventDefault();
+                                attempt.mutate();
+                            }, children: _jsxs(Stack, { direction: "column", gap: "md", children: [_jsx(InputControl, { label: _x('Email', 'field label', DOMAIN), type: "email", autoComplete: "email", value: email, onChange: (event) => setEmail(event.target.value) }), _jsx(Button, { type: "submit", disabled: email.trim() === '' || attempt.isPending, loading: attempt.isPending, children: __('Send reset link', DOMAIN) }), attempt.isError ? (_jsx(Text, { role: "alert", children: requestErrorMessage(attempt.error) })) : null] }) })), onBack ? (_jsx(Button, { type: "button", variant: "outline", onClick: onBack, children: __('Back to login', DOMAIN) })) : null] }) }) }) }));
+}

package/dist/wpds/ResetPasswordScreen.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Renders the password reset form, replacing it with the outcome once the
+ * password is set.
+ * @param brand - The product name shown above the form.
+ * @param token - The reset link's secret.
+ * @param onDone - Called when the user heads to the login afterward.
+ * @returns The reset password screen element.
+ */
+export declare function ResetPasswordScreen({ brand, token, onDone, }: {
+    brand: string;
+    token: string;
+    onDone?: () => void;
+}): import("react").JSX.Element;

package/dist/wpds/ResetPasswordScreen.js

@@ -0,0 +1,44 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// SPDX-License-Identifier: Apache-2.0
+import { useMutation } from '@tanstack/react-query';
+import { __ } from '@wordpress/i18n';
+import { Button, Card, InputControl, Stack, Text } from '@wordpress/ui';
+import { useState } from 'react';
+import { InvalidTokenError, RateLimitedError, ValidationError, resetPassword, } from '../api.js';
+import { DOMAIN } from '../domain.js';
+import { Outcome } from './Outcome.js';
+/**
+ * Maps a reset failure to the message shown to the user.
+ * @param error - The error thrown by the reset attempt.
+ * @returns The message to display.
+ */
+function resetErrorMessage(error) {
+    if (error instanceof InvalidTokenError) {
+        return __('This link is no longer valid. Ask for a new one.', DOMAIN);
+    }
+    if (error instanceof ValidationError) {
+        return error.message;
+    }
+    if (error instanceof RateLimitedError) {
+        return __('Too many attempts. Please wait a minute and try again.', DOMAIN);
+    }
+    return __('The password could not be set, please try again.', DOMAIN);
+}
+/**
+ * Renders the password reset form, replacing it with the outcome once the
+ * password is set.
+ * @param brand - The product name shown above the form.
+ * @param token - The reset link's secret.
+ * @param onDone - Called when the user heads to the login afterward.
+ * @returns The reset password screen element.
+ */
+export function ResetPasswordScreen({ brand, token, onDone, }) {
+    const [password, setPassword] = useState('');
+    const attempt = useMutation({
+        mutationFn: () => resetPassword(token, password),
+    });
+    return (_jsx("div", { className: "gopherium-login", children: _jsx(Card.Root, { className: "gopherium-login__card", children: _jsx(Card.Content, { children: _jsxs(Stack, { direction: "column", gap: "lg", children: [_jsx(Text, { variant: "heading-lg", render: _jsx("h1", {}), children: brand }), attempt.isSuccess ? (_jsxs(Stack, { direction: "column", gap: "md", children: [_jsx(Outcome, { children: _jsx(Text, { children: __('Your password is set. Sign in with it.', DOMAIN) }) }), onDone ? (_jsx(Button, { type: "button", onClick: onDone, children: __('Go to login', DOMAIN) })) : null] })) : (_jsx("form", { onSubmit: (event) => {
+                                event.preventDefault();
+                                attempt.mutate();
+                            }, children: _jsxs(Stack, { direction: "column", gap: "md", children: [_jsx(InputControl, { label: __('Password', DOMAIN), type: "password", autoComplete: "new-password", value: password, onChange: (event) => setPassword(event.target.value) }), _jsx(Button, { type: "submit", disabled: password === '' || attempt.isPending, loading: attempt.isPending, children: __('Set password', DOMAIN) }), attempt.isError ? (_jsx(Text, { role: "alert", children: resetErrorMessage(attempt.error) })) : null] }) }))] }) }) }) }));
+}

package/dist/wpds/SetPasswordScreen.d.ts

@@ -0,0 +1,14 @@
+import type { User } from '../api.js';
+/**
+ * Renders the invitation acceptance form and reports the signed-in user
+ * upward.
+ * @param brand - The product name shown above the form.
+ * @param token - The invitation link's secret.
+ * @param onAccepted - Called with the user after a successful activation.
+ * @returns The set password screen element.
+ */
+export declare function SetPasswordScreen({ brand, token, onAccepted, }: {
+    brand: string;
+    token: string;
+    onAccepted: (user: User) => void | Promise<void>;
+}): import("react").JSX.Element;

package/dist/wpds/SetPasswordScreen.js

@@ -0,0 +1,62 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// SPDX-License-Identifier: Apache-2.0
+import { useMutation } from '@tanstack/react-query';
+import { __ } from '@wordpress/i18n';
+import { Button, Card, InputControl, Stack, Text } from '@wordpress/ui';
+import { useState } from 'react';
+import { InvalidTokenError, RateLimitedError, ValidationError, acceptInvite, } from '../api.js';
+import { DOMAIN } from '../domain.js';
+/**
+ * Maps an activation failure to the message shown to the user.
+ * @param error - The error thrown by the activation attempt.
+ * @returns The message to display.
+ */
+function setPasswordErrorMessage(error) {
+    if (error instanceof InvalidTokenError) {
+        return __('This link is no longer valid. Ask the person who invited you for a new one.', DOMAIN);
+    }
+    if (error instanceof ValidationError) {
+        return error.message;
+    }
+    if (error instanceof RateLimitedError) {
+        return __('Too many attempts. Please wait a minute and try again.', DOMAIN);
+    }
+    return __('The password could not be set, please try again.', DOMAIN);
+}
+/**
+ * Renders the invitation acceptance form and reports the signed-in user
+ * upward.
+ * @param brand - The product name shown above the form.
+ * @param token - The invitation link's secret.
+ * @param onAccepted - Called with the user after a successful activation.
+ * @returns The set password screen element.
+ */
+export function SetPasswordScreen({ brand, token, onAccepted, }) {
+    const [password, setPassword] = useState('');
+    const [activated, setActivated] = useState(null);
+    const [handoffFailed, setHandoffFailed] = useState(false);
+    const finish = useMutation({
+        mutationFn: async (user) => {
+            await onAccepted(user);
+        },
+        onError: () => setHandoffFailed(true),
+        onSuccess: () => setHandoffFailed(false),
+    });
+    const attempt = useMutation({
+        mutationFn: () => acceptInvite(token, password),
+        onSuccess: (user) => {
+            setActivated(user);
+            finish.mutate(user);
+        },
+    });
+    if (activated !== null && handoffFailed) {
+        return (_jsx("div", { className: "gopherium-login", children: _jsx(Card.Root, { className: "gopherium-login__card", children: _jsx(Card.Content, { children: _jsxs(Stack, { direction: "column", gap: "lg", children: [_jsx(Text, { variant: "heading-lg", render: _jsx("h1", {}), children: brand }), _jsx(Text, { role: "alert", children: __('Something went wrong.', DOMAIN) }), _jsx(Button, { type: "button", disabled: finish.isPending, loading: finish.isPending, onClick: () => finish.mutate(activated), children: __('Try again', DOMAIN) })] }) }) }) }));
+    }
+    return (_jsx("div", { className: "gopherium-login", children: _jsx(Card.Root, { className: "gopherium-login__card", children: _jsx(Card.Content, { children: _jsx("form", { onSubmit: (event) => {
+                        event.preventDefault();
+                        attempt.mutate();
+                    }, children: _jsxs(Stack, { direction: "column", gap: "lg", children: [_jsx(Text, { variant: "heading-lg", render: _jsx("h1", {}), children: brand }), _jsx(InputControl, { label: __('Password', DOMAIN), type: "password", autoComplete: "new-password", value: password, onChange: (event) => setPassword(event.target.value) }), _jsx(Button, { type: "submit", disabled: password === '' ||
+                                    attempt.isPending ||
+                                    attempt.isSuccess ||
+                                    finish.isPending, loading: attempt.isPending || finish.isPending, children: __('Set password', DOMAIN) }), attempt.isError ? (_jsx(Text, { role: "alert", children: setPasswordErrorMessage(attempt.error) })) : null] }) }) }) }) }));
+}

package/dist/wpds/index.d.ts

@@ -2,4 +2,7 @@ export { AccountPanel } from './AccountPanel.js';
 export { LoginScreen } from './LoginScreen.js';
 export { usersNavItem } from './nav.js';
 export { NewUserScreen } from './NewUserScreen.js';
+export { RequestResetScreen } from './RequestResetScreen.js';
+export { ResetPasswordScreen } from './ResetPasswordScreen.js';
+export { SetPasswordScreen } from './SetPasswordScreen.js';
 export { UsersScreen } from './UsersScreen.js';

package/dist/wpds/index.js

@@ -3,4 +3,7 @@ export { AccountPanel } from './AccountPanel.js';
 export { LoginScreen } from './LoginScreen.js';
 export { usersNavItem } from './nav.js';
 export { NewUserScreen } from './NewUserScreen.js';
+export { RequestResetScreen } from './RequestResetScreen.js';
+export { ResetPasswordScreen } from './ResetPasswordScreen.js';
+export { SetPasswordScreen } from './SetPasswordScreen.js';
 export { UsersScreen } from './UsersScreen.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gopherium/react-auth",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Session authentication for React apps backed by gouncer's authkit.",
   "license": "Apache-2.0",
   "type": "module",
@@ -48,7 +48,7 @@
   },
   "peerDependencies": {
     "@tanstack/react-query": "^5.101.2",
-    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/jest-dom": "^6.9.1 || ^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@wordpress/i18n": ">=6.26.0 <7.0.0",
     "@wordpress/theme": ">=1.0.0 <2.0.0",
@@ -79,7 +79,7 @@
   },
   "devDependencies": {
     "@tanstack/react-query": "^5.101.2",
-    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/gettext-parser": "9.0.0",