@heyatom/bastion-client 0.7.0 → 0.7.2

package/README.md

@@ -4,7 +4,7 @@ Consumer SDK for [Bastion](https://github.com/heyatomdev/bastion), the HeyAtom i
 Replaces the `src/modules/bastion/` boilerplate every service used to copy by hand.
 
 - `@heyatom/bastion-client` — framework-free core: `JwksVerifier` (kid-indexed cache, unknown-kid refetch with cooldown, stale-on-error), `BastionHttp` (`POST /auth/client`, `POST /events`, any other route), `ServiceTokenProvider` (single-flight refresh ahead of `exp`), payload types.
-- `@heyatom/bastion-client` also carries Bastion's user-API contract: `BastionApiClient` (login, register, OAuth exchange, 2FA, single-flight refresh, logout, sessions, `/me`, profile, social accounts, email/password flows, export, delete), its types (`BastionMe`, `BastionTokenPair`, …) and `BastionErrorCode` (a stable code on every `BastionHttpError`: credentials, app context, refresh token, OAuth code, age gate, OAuth flow, unavailable, upstream). `refreshMemoryMs` tunes how long a refresh answer is remembered per token (default 60 s).
+- `@heyatom/bastion-client` also carries Bastion's user-API contract: `BastionApiClient` (login, register, OAuth exchange, 2FA, single-flight refresh, logout, sessions, `/me`, profile, social accounts, email/password flows, export, delete), its types (`BastionMe`, `BastionTokenPair`, …) and `BastionErrorCode` (a stable code on every `BastionHttpError`: credentials, app context, refresh token, OAuth code, age gate, OAuth flow, unavailable, upstream). `refreshMemoryMs` tunes how long a refresh answer is remembered per token (default 60 s). Since 0.7.2 `completeAgeVerification(token, birthDate, { currentPassword?, twoFactorCode? })` sends the step-up Bastion requires (as `deleteSelf`), and `UserJwtPayload.ageVerificationRequired?: true` is set only while the account owes the app's age screen: a consumer API can refuse it from the token alone.
 - `@heyatom/bastion-client/webhooks` — `verifyWebhookSignature` (`X-Bastion-Signature-V2` with timestamp + delivery id, legacy fallback only with `allowLegacySignature: true` (off by default since 0.7.0), secret rotation on both sides), header constants, payload type.
 - `@heyatom/bastion-client/nest` — NestJS: `BastionModule`, `ServiceClientJwtGuard`, `BastionUserGuard`, `BastionAuditService`, `AuditInterceptor` (attributes to `req.adminUser`, any `AuditActor` shape: `sub` plus optional `tenantId`/`tenantSlug`/`role`/`appSlug`), `@Public()`, `@RequireScope()`, `@Audit()`, `@CurrentClient()`, `@CurrentAdminUser()`.
 

package/dist/cjs/core/api-client.d.ts

@@ -50,8 +50,13 @@ export declare class BastionApiClient {
     register(input: BastionRegisterInput, ctx?: BastionClientContext): Promise<{
         message: string;
     }>;
-    /** Trades the one-time OAuth code for tokens. */
-    exchange(code: string, ctx?: BastionClientContext): Promise<BastionLoginResult>;
+    /**
+     * Trades the one-time OAuth code for tokens. `state` is the value the app put
+     * on the initiate URL, read back from its own cookie/session (never from the
+     * callback query): Bastion refuses a code minted under a different one, which
+     * is what stops an attacker's code from being redeemed in a victim's browser.
+     */
+    exchange(code: string, ctx?: BastionClientContext, state?: string): Promise<BastionLoginResult>;
     completeTwoFactor(twoFactorToken: string, code: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
     refresh(refreshToken: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
     /** Revokes the token and any successor issued through `refresh` within the memory window. Never throws. */
@@ -64,7 +69,11 @@ export declare class BastionApiClient {
     me(accessToken: string): Promise<BastionMe>;
     /** Answers the updated columns only (`BastionProfile`), not the full `BastionMe`. */
     updateProfile(accessToken: string, update: BastionProfileUpdate): Promise<BastionProfile>;
-    completeAgeVerification(accessToken: string, birthDate: string): Promise<BastionAgeVerificationResult>;
+    /** Step-up as `deleteSelf`: `currentPassword` when the account has one, `twoFactorCode` when 2FA is on. */
+    completeAgeVerification(accessToken: string, birthDate: string, stepUp?: {
+        currentPassword?: string;
+        twoFactorCode?: string;
+    }): Promise<BastionAgeVerificationResult>;
     /** Cached 5 min; a failed refetch serves the cached answer. */
     getAuthMethods(): Promise<BastionAuthMethods>;
     twoFactorStatus(accessToken: string): Promise<BastionTwoFactorStatus>;

package/dist/cjs/core/api-client.js

@@ -61,9 +61,14 @@ class BastionApiClient {
     register(input, ctx) {
         return this.call('POST', '/auth/register', { ...input, ...this.appContext }, { headers: BastionApiClient.clientHeaders(ctx) });
     }
-    /** Trades the one-time OAuth code for tokens. */
-    exchange(code, ctx) {
-        return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug }, { headers: BastionApiClient.clientHeaders(ctx) });
+    /**
+     * Trades the one-time OAuth code for tokens. `state` is the value the app put
+     * on the initiate URL, read back from its own cookie/session (never from the
+     * callback query): Bastion refuses a code minted under a different one, which
+     * is what stops an attacker's code from being redeemed in a victim's browser.
+     */
+    exchange(code, ctx, state) {
+        return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug, ...(state !== undefined ? { state } : {}) }, { headers: BastionApiClient.clientHeaders(ctx) });
     }
     completeTwoFactor(twoFactorToken, code, ctx) {
         return this.call('POST', '/auth/2fa/authenticate', { twoFactorToken, code }, { headers: BastionApiClient.clientHeaders(ctx) });
@@ -113,8 +118,9 @@ class BastionApiClient {
     updateProfile(accessToken, update) {
         return this.call('PATCH', '/auth/me', update, { token: accessToken });
     }
-    completeAgeVerification(accessToken, birthDate) {
-        return this.call('POST', '/auth/age-verification', { birthDate }, { token: accessToken });
+    /** Step-up as `deleteSelf`: `currentPassword` when the account has one, `twoFactorCode` when 2FA is on. */
+    completeAgeVerification(accessToken, birthDate, stepUp = {}) {
+        return this.call('POST', '/auth/age-verification', { birthDate, ...stepUp }, { token: accessToken });
     }
     /** Cached 5 min; a failed refetch serves the cached answer. */
     async getAuthMethods() {

package/dist/cjs/core/types.d.ts

@@ -20,6 +20,12 @@ export interface UserJwtPayload extends CommonClaims {
     role: string;
     permissions: string[];
     sessionId?: string;
+    /**
+     * Present (always `true`) only while the app has a minimum age and the account hasn't cleared
+     * it — an OAuth signup that hasn't answered `completeAgeVerification`. Absent on every other
+     * token. Recomputed at each issuance: refresh after the screen.
+     */
+    ageVerificationRequired?: true;
 }
 /** A machine token from `POST /auth/client`. Discriminated by `type`. */
 export interface ServiceClientJwtPayload extends CommonClaims {

package/dist/esm/core/api-client.d.ts

@@ -50,8 +50,13 @@ export declare class BastionApiClient {
     register(input: BastionRegisterInput, ctx?: BastionClientContext): Promise<{
         message: string;
     }>;
-    /** Trades the one-time OAuth code for tokens. */
-    exchange(code: string, ctx?: BastionClientContext): Promise<BastionLoginResult>;
+    /**
+     * Trades the one-time OAuth code for tokens. `state` is the value the app put
+     * on the initiate URL, read back from its own cookie/session (never from the
+     * callback query): Bastion refuses a code minted under a different one, which
+     * is what stops an attacker's code from being redeemed in a victim's browser.
+     */
+    exchange(code: string, ctx?: BastionClientContext, state?: string): Promise<BastionLoginResult>;
     completeTwoFactor(twoFactorToken: string, code: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
     refresh(refreshToken: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
     /** Revokes the token and any successor issued through `refresh` within the memory window. Never throws. */
@@ -64,7 +69,11 @@ export declare class BastionApiClient {
     me(accessToken: string): Promise<BastionMe>;
     /** Answers the updated columns only (`BastionProfile`), not the full `BastionMe`. */
     updateProfile(accessToken: string, update: BastionProfileUpdate): Promise<BastionProfile>;
-    completeAgeVerification(accessToken: string, birthDate: string): Promise<BastionAgeVerificationResult>;
+    /** Step-up as `deleteSelf`: `currentPassword` when the account has one, `twoFactorCode` when 2FA is on. */
+    completeAgeVerification(accessToken: string, birthDate: string, stepUp?: {
+        currentPassword?: string;
+        twoFactorCode?: string;
+    }): Promise<BastionAgeVerificationResult>;
     /** Cached 5 min; a failed refetch serves the cached answer. */
     getAuthMethods(): Promise<BastionAuthMethods>;
     twoFactorStatus(accessToken: string): Promise<BastionTwoFactorStatus>;

package/dist/esm/core/api-client.js

@@ -58,9 +58,14 @@ export class BastionApiClient {
     register(input, ctx) {
         return this.call('POST', '/auth/register', { ...input, ...this.appContext }, { headers: BastionApiClient.clientHeaders(ctx) });
     }
-    /** Trades the one-time OAuth code for tokens. */
-    exchange(code, ctx) {
-        return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug }, { headers: BastionApiClient.clientHeaders(ctx) });
+    /**
+     * Trades the one-time OAuth code for tokens. `state` is the value the app put
+     * on the initiate URL, read back from its own cookie/session (never from the
+     * callback query): Bastion refuses a code minted under a different one, which
+     * is what stops an attacker's code from being redeemed in a victim's browser.
+     */
+    exchange(code, ctx, state) {
+        return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug, ...(state !== undefined ? { state } : {}) }, { headers: BastionApiClient.clientHeaders(ctx) });
     }
     completeTwoFactor(twoFactorToken, code, ctx) {
         return this.call('POST', '/auth/2fa/authenticate', { twoFactorToken, code }, { headers: BastionApiClient.clientHeaders(ctx) });
@@ -110,8 +115,9 @@ export class BastionApiClient {
     updateProfile(accessToken, update) {
         return this.call('PATCH', '/auth/me', update, { token: accessToken });
     }
-    completeAgeVerification(accessToken, birthDate) {
-        return this.call('POST', '/auth/age-verification', { birthDate }, { token: accessToken });
+    /** Step-up as `deleteSelf`: `currentPassword` when the account has one, `twoFactorCode` when 2FA is on. */
+    completeAgeVerification(accessToken, birthDate, stepUp = {}) {
+        return this.call('POST', '/auth/age-verification', { birthDate, ...stepUp }, { token: accessToken });
     }
     /** Cached 5 min; a failed refetch serves the cached answer. */
     async getAuthMethods() {

package/dist/esm/core/types.d.ts

@@ -20,6 +20,12 @@ export interface UserJwtPayload extends CommonClaims {
     role: string;
     permissions: string[];
     sessionId?: string;
+    /**
+     * Present (always `true`) only while the app has a minimum age and the account hasn't cleared
+     * it — an OAuth signup that hasn't answered `completeAgeVerification`. Absent on every other
+     * token. Recomputed at each issuance: refresh after the screen.
+     */
+    ageVerificationRequired?: true;
 }
 /** A machine token from `POST /auth/client`. Discriminated by `type`. */
 export interface ServiceClientJwtPayload extends CommonClaims {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyatom/bastion-client",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
   "license": "MIT",
   "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",