@heyatom/bastion-client 0.4.0 → 0.6.0

package/dist/cjs/core/api-client.d.ts

@@ -1,6 +1,6 @@
 import type { BastionHttp } from './bastion-http.js';
 import { type BastionLogger } from './types.js';
-import type { BastionAgeVerificationResult, BastionAuthMethods, BastionClientContext, BastionEmailChangeRequest, BastionLinkTicket, BastionLoginResult, BastionMe, BastionProfile, BastionProfileUpdate, BastionRegisterInput, BastionSession, BastionSocialAccount, BastionTokenPair, BastionTwoFactorConfirmed, BastionTwoFactorSetup, BastionTwoFactorStatus, BastionUserAuditEventsPage } from './api-types.js';
+import type { BastionAgeVerificationResult, BastionAuthMethods, BastionClientContext, BastionEmailChangeRequest, BastionLinkCompleted, BastionLinkTicket, BastionLoginResult, BastionMe, BastionProfile, BastionProfileUpdate, BastionRegisterInput, BastionSession, BastionSocialAccount, BastionTokenPair, BastionTwoFactorConfirmed, BastionTwoFactorSetup, BastionTwoFactorStatus, BastionUserAuditEventsPage } from './api-types.js';
 export interface BastionApiClientOptions {
     http: BastionHttp;
     /** This app's slug — sent as `appSlug` on every user-facing call. */
@@ -75,6 +75,13 @@ export declare class BastionApiClient {
     }>;
     listSocialAccounts(accessToken: string): Promise<BastionSocialAccount[]>;
     createSocialAccountLinkTicket(accessToken: string, provider: string): Promise<BastionLinkTicket>;
+    /**
+     * Second step of a link: spends the one-time `linkCode` Bastion put on the
+     * redirect to `/auth/callback`. Pass the signed-in user's own token — Bastion
+     * links only if its `sub` is the user the ticket was issued to (403
+     * `OAUTH_LINK_USER_MISMATCH` otherwise; the code is spent either way).
+     */
+    completeSocialAccountLink(accessToken: string, code: string): Promise<BastionLinkCompleted>;
     unlinkSocialAccount(accessToken: string, provider: string): Promise<void>;
     updateSocialAccountSyncAvatar(accessToken: string, provider: string, syncAvatar: boolean): Promise<BastionSocialAccount>;
     resendVerification(email: string, ctx?: BastionClientContext): Promise<void>;

package/dist/cjs/core/api-client.js

@@ -156,6 +156,15 @@ class BastionApiClient {
     createSocialAccountLinkTicket(accessToken, provider) {
         return this.call('POST', `/auth/me/social-accounts/${encodeURIComponent(provider)}/link-ticket`, undefined, { token: accessToken });
     }
+    /**
+     * Second step of a link: spends the one-time `linkCode` Bastion put on the
+     * redirect to `/auth/callback`. Pass the signed-in user's own token — Bastion
+     * links only if its `sub` is the user the ticket was issued to (403
+     * `OAUTH_LINK_USER_MISMATCH` otherwise; the code is spent either way).
+     */
+    completeSocialAccountLink(accessToken, code) {
+        return this.call('POST', '/auth/me/social-accounts/link/complete', { code }, { token: accessToken });
+    }
     unlinkSocialAccount(accessToken, provider) {
         return this.call('DELETE', `/auth/me/social-accounts/${encodeURIComponent(provider)}`, undefined, { token: accessToken });
     }

package/dist/cjs/core/api-types.d.ts

@@ -96,6 +96,8 @@ export interface BastionClientContext {
 }
 export interface BastionSocialAccount {
     provider: string;
+    /** The provider's own id for the account (e.g. the Twitch user id), as verified by the OAuth flow. */
+    providerId: string;
     username: string | null;
     email: string | null;
     avatar: string | null;
@@ -119,6 +121,10 @@ export interface BastionAuthMethods {
 export interface BastionLinkTicket {
     url: string;
 }
+/** `POST /auth/me/social-accounts/link/complete` — the provider now linked (lowercase slug). */
+export interface BastionLinkCompleted {
+    provider: string;
+}
 /** One row of `GET /auth/me/events` — the user-facing projection, deliberately without `ip`/`userAgent`. */
 export interface BastionUserAuditEvent {
     id: string;

package/dist/cjs/core/errors.d.ts

@@ -29,6 +29,8 @@ export declare const BastionErrorCode: {
     readonly OAUTH_EMAIL_UNVERIFIED: "OAUTH_EMAIL_UNVERIFIED";
     readonly OAUTH_EMAIL_REQUIRED: "OAUTH_EMAIL_REQUIRED";
     readonly OAUTH_NO_ACCOUNT: "OAUTH_NO_ACCOUNT";
+    /** `completeSocialAccountLink` called with a token that is not the link ticket's owner. The code is spent; start the link again. */
+    readonly OAUTH_LINK_USER_MISMATCH: "OAUTH_LINK_USER_MISMATCH";
     readonly UNAVAILABLE: "UNAVAILABLE";
     readonly UPSTREAM: "UPSTREAM";
 };

package/dist/cjs/core/errors.js

@@ -37,6 +37,8 @@ exports.BastionErrorCode = {
     OAUTH_EMAIL_UNVERIFIED: 'OAUTH_EMAIL_UNVERIFIED',
     OAUTH_EMAIL_REQUIRED: 'OAUTH_EMAIL_REQUIRED',
     OAUTH_NO_ACCOUNT: 'OAUTH_NO_ACCOUNT',
+    /** `completeSocialAccountLink` called with a token that is not the link ticket's owner. The code is spent; start the link again. */
+    OAUTH_LINK_USER_MISMATCH: 'OAUTH_LINK_USER_MISMATCH',
     UNAVAILABLE: 'UNAVAILABLE',
     UPSTREAM: 'UPSTREAM',
 };
@@ -49,6 +51,7 @@ const CODE_MESSAGES = new Set([
     exports.BastionErrorCode.OAUTH_EMAIL_UNVERIFIED,
     exports.BastionErrorCode.OAUTH_EMAIL_REQUIRED,
     exports.BastionErrorCode.OAUTH_NO_ACCOUNT,
+    exports.BastionErrorCode.OAUTH_LINK_USER_MISMATCH,
 ]);
 const APP_CONTEXT_RE = /app not found|tenant not found|tenant is inactive|no tenants configured|tenantslug is required/i;
 const OAUTH_CODE_RE = /already used code|code expired|code\/app mismatch/i;

package/dist/esm/core/api-client.d.ts

@@ -1,6 +1,6 @@
 import type { BastionHttp } from './bastion-http.js';
 import { type BastionLogger } from './types.js';
-import type { BastionAgeVerificationResult, BastionAuthMethods, BastionClientContext, BastionEmailChangeRequest, BastionLinkTicket, BastionLoginResult, BastionMe, BastionProfile, BastionProfileUpdate, BastionRegisterInput, BastionSession, BastionSocialAccount, BastionTokenPair, BastionTwoFactorConfirmed, BastionTwoFactorSetup, BastionTwoFactorStatus, BastionUserAuditEventsPage } from './api-types.js';
+import type { BastionAgeVerificationResult, BastionAuthMethods, BastionClientContext, BastionEmailChangeRequest, BastionLinkCompleted, BastionLinkTicket, BastionLoginResult, BastionMe, BastionProfile, BastionProfileUpdate, BastionRegisterInput, BastionSession, BastionSocialAccount, BastionTokenPair, BastionTwoFactorConfirmed, BastionTwoFactorSetup, BastionTwoFactorStatus, BastionUserAuditEventsPage } from './api-types.js';
 export interface BastionApiClientOptions {
     http: BastionHttp;
     /** This app's slug — sent as `appSlug` on every user-facing call. */
@@ -75,6 +75,13 @@ export declare class BastionApiClient {
     }>;
     listSocialAccounts(accessToken: string): Promise<BastionSocialAccount[]>;
     createSocialAccountLinkTicket(accessToken: string, provider: string): Promise<BastionLinkTicket>;
+    /**
+     * Second step of a link: spends the one-time `linkCode` Bastion put on the
+     * redirect to `/auth/callback`. Pass the signed-in user's own token — Bastion
+     * links only if its `sub` is the user the ticket was issued to (403
+     * `OAUTH_LINK_USER_MISMATCH` otherwise; the code is spent either way).
+     */
+    completeSocialAccountLink(accessToken: string, code: string): Promise<BastionLinkCompleted>;
     unlinkSocialAccount(accessToken: string, provider: string): Promise<void>;
     updateSocialAccountSyncAvatar(accessToken: string, provider: string, syncAvatar: boolean): Promise<BastionSocialAccount>;
     resendVerification(email: string, ctx?: BastionClientContext): Promise<void>;

package/dist/esm/core/api-client.js

@@ -153,6 +153,15 @@ export class BastionApiClient {
     createSocialAccountLinkTicket(accessToken, provider) {
         return this.call('POST', `/auth/me/social-accounts/${encodeURIComponent(provider)}/link-ticket`, undefined, { token: accessToken });
     }
+    /**
+     * Second step of a link: spends the one-time `linkCode` Bastion put on the
+     * redirect to `/auth/callback`. Pass the signed-in user's own token — Bastion
+     * links only if its `sub` is the user the ticket was issued to (403
+     * `OAUTH_LINK_USER_MISMATCH` otherwise; the code is spent either way).
+     */
+    completeSocialAccountLink(accessToken, code) {
+        return this.call('POST', '/auth/me/social-accounts/link/complete', { code }, { token: accessToken });
+    }
     unlinkSocialAccount(accessToken, provider) {
         return this.call('DELETE', `/auth/me/social-accounts/${encodeURIComponent(provider)}`, undefined, { token: accessToken });
     }

package/dist/esm/core/api-types.d.ts

@@ -96,6 +96,8 @@ export interface BastionClientContext {
 }
 export interface BastionSocialAccount {
     provider: string;
+    /** The provider's own id for the account (e.g. the Twitch user id), as verified by the OAuth flow. */
+    providerId: string;
     username: string | null;
     email: string | null;
     avatar: string | null;
@@ -119,6 +121,10 @@ export interface BastionAuthMethods {
 export interface BastionLinkTicket {
     url: string;
 }
+/** `POST /auth/me/social-accounts/link/complete` — the provider now linked (lowercase slug). */
+export interface BastionLinkCompleted {
+    provider: string;
+}
 /** One row of `GET /auth/me/events` — the user-facing projection, deliberately without `ip`/`userAgent`. */
 export interface BastionUserAuditEvent {
     id: string;

package/dist/esm/core/errors.d.ts

@@ -29,6 +29,8 @@ export declare const BastionErrorCode: {
     readonly OAUTH_EMAIL_UNVERIFIED: "OAUTH_EMAIL_UNVERIFIED";
     readonly OAUTH_EMAIL_REQUIRED: "OAUTH_EMAIL_REQUIRED";
     readonly OAUTH_NO_ACCOUNT: "OAUTH_NO_ACCOUNT";
+    /** `completeSocialAccountLink` called with a token that is not the link ticket's owner. The code is spent; start the link again. */
+    readonly OAUTH_LINK_USER_MISMATCH: "OAUTH_LINK_USER_MISMATCH";
     readonly UNAVAILABLE: "UNAVAILABLE";
     readonly UPSTREAM: "UPSTREAM";
 };

package/dist/esm/core/errors.js

@@ -32,6 +32,8 @@ export const BastionErrorCode = {
     OAUTH_EMAIL_UNVERIFIED: 'OAUTH_EMAIL_UNVERIFIED',
     OAUTH_EMAIL_REQUIRED: 'OAUTH_EMAIL_REQUIRED',
     OAUTH_NO_ACCOUNT: 'OAUTH_NO_ACCOUNT',
+    /** `completeSocialAccountLink` called with a token that is not the link ticket's owner. The code is spent; start the link again. */
+    OAUTH_LINK_USER_MISMATCH: 'OAUTH_LINK_USER_MISMATCH',
     UNAVAILABLE: 'UNAVAILABLE',
     UPSTREAM: 'UPSTREAM',
 };
@@ -44,6 +46,7 @@ const CODE_MESSAGES = new Set([
     BastionErrorCode.OAUTH_EMAIL_UNVERIFIED,
     BastionErrorCode.OAUTH_EMAIL_REQUIRED,
     BastionErrorCode.OAUTH_NO_ACCOUNT,
+    BastionErrorCode.OAUTH_LINK_USER_MISMATCH,
 ]);
 const APP_CONTEXT_RE = /app not found|tenant not found|tenant is inactive|no tenants configured|tenantslug is required/i;
 const OAUTH_CODE_RE = /already used code|code expired|code\/app mismatch/i;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyatom/bastion-client",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
   "license": "MIT",
   "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",