@insforge/sdk 0.0.58-dev.8 → 0.0.59-dev.0

package/dist/index.mjs

@@ -259,12 +259,12 @@ function convertDbProfileToCamelCase(dbProfile) {
   const result = {
     id: dbProfile.id
   };
-  if (dbProfile.created_at !== void 0) result.createdAt = dbProfile.created_at;
-  if (dbProfile.updated_at !== void 0) result.updatedAt = dbProfile.updated_at;
   Object.keys(dbProfile).forEach((key) => {
-    if (key === "id" || key === "created_at" || key === "updated_at") return;
-    const camelKey = key.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
-    result[camelKey] = dbProfile[key];
+    result[key] = dbProfile[key];
+    if (key.includes("_")) {
+      const camelKey = key.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+      result[camelKey] = dbProfile[key];
+    }
   });
   return result;
 }
@@ -282,14 +282,14 @@ var Auth = class {
     this.http = http;
     this.tokenManager = tokenManager;
     this.database = new Database(http, tokenManager);
-    this.detectOAuthCallback();
+    this.detectAuthCallback();
   }
   /**
    * Automatically detect and handle OAuth callback parameters in the URL
    * This runs on initialization to seamlessly complete the OAuth flow
    * Matches the backend's OAuth callback response (backend/src/api/routes/auth.ts:540-544)
    */
-  detectOAuthCallback() {
+  detectAuthCallback() {
     if (typeof window === "undefined") return;
     try {
       const params = new URLSearchParams(window.location.search);
@@ -591,14 +591,10 @@ var Auth = class {
         session.user = {
           id: data2.user.id,
           email: data2.user.email,
-          name: data2.profile?.nickname || "",
-          // Fallback - profile structure is dynamic
+          name: "",
           emailVerified: false,
-          // Not available from API, but required by UserSchema
           createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          // Fallback
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-          // Fallback
         };
         this.tokenManager.saveSession(session);
       }
@@ -611,13 +607,48 @@ var Auth = class {
     return { data: null, error };
   }
   /**
-   * Send password reset code to user's email
-   * Always returns success to prevent user enumeration
+   * Send email verification (code or link based on config)
+   *
+   * Send email verification using the method configured in auth settings (verifyEmailMethod).
+   * When method is 'code', sends a 6-digit numeric code. When method is 'link', sends a magic link.
+   * Prevents user enumeration by returning success even if email doesn't exist.
    */
-  async sendPasswordResetCode(request) {
+  async sendVerificationEmail(request) {
     try {
       const response = await this.http.post(
-        "/api/auth/email/send-reset-password-code",
+        "/api/auth/email/send-verification",
+        request
+      );
+      return {
+        data: response,
+        error: null
+      };
+    } catch (error) {
+      if (error instanceof InsForgeError) {
+        return { data: null, error };
+      }
+      return {
+        data: null,
+        error: new InsForgeError(
+          "An unexpected error occurred while sending verification code",
+          500,
+          "UNEXPECTED_ERROR"
+        )
+      };
+    }
+  }
+  /**
+   * Send password reset (code or link based on config)
+   *
+   * Send password reset email using the method configured in auth settings (resetPasswordMethod).
+   * When method is 'code', sends a 6-digit numeric code for two-step flow.
+   * When method is 'link', sends a magic link.
+   * Prevents user enumeration by returning success even if email doesn't exist.
+   */
+  async sendResetPasswordEmail(request) {
+    try {
+      const response = await this.http.post(
+        "/api/auth/email/send-reset-password",
         request
       );
       return {
@@ -639,13 +670,55 @@ var Auth = class {
     }
   }
   /**
-   * Reset password with OTP token
-   * Token can be from magic link or from code verification
+   * Exchange reset password code for reset token
+   *
+   * Step 1 of two-step password reset flow (only used when resetPasswordMethod is 'code'):
+   * 1. Verify the 6-digit code sent to user's email
+   * 2. Return a reset token that can be used to actually reset the password
+   *
+   * This endpoint is not used when resetPasswordMethod is 'link' (magic link flow is direct).
+   */
+  async exchangeResetPasswordToken(request) {
+    try {
+      const response = await this.http.post(
+        "/api/auth/email/exchange-reset-password-token",
+        request
+      );
+      return {
+        data: response,
+        error: null
+      };
+    } catch (error) {
+      if (error instanceof InsForgeError) {
+        return { data: null, error };
+      }
+      return {
+        data: null,
+        error: new InsForgeError(
+          "An unexpected error occurred while verifying reset code",
+          500,
+          "UNEXPECTED_ERROR"
+        )
+      };
+    }
+  }
+  /**
+   * Reset password with token
+   *
+   * Reset user password with a token. The token can be:
+   * - Magic link token (64-character hex token from send-reset-password when method is 'link')
+   * - Reset token (from exchange-reset-password-token after code verification when method is 'code')
+   *
+   * Both token types use RESET_PASSWORD purpose and are verified the same way.
+   *
+   * Flow summary:
+   * - Code method: send-reset-password → exchange-reset-password-token → reset-password (with resetToken)
+   * - Link method: send-reset-password → reset-password (with link token directly)
    */
   async resetPassword(request) {
     try {
       const response = await this.http.post(
-        "/api/auth/reset-password",
+        "/api/auth/email/reset-password",
         request
       );
       return {
@@ -667,14 +740,22 @@ var Auth = class {
     }
   }
   /**
-   * Verify email with OTP token
-   * If email is provided: uses numeric OTP verification (6-digit code)
-   * If email is NOT provided: uses link OTP verification (64-char token)
+   * Verify email with code or link
+   *
+   * Verify email address using the method configured in auth settings (verifyEmailMethod):
+   * - Code verification: Provide both `email` and `otp` (6-digit numeric code)
+   * - Link verification: Provide only `otp` (64-character hex token from magic link)
+   *
+   * Successfully verified users will receive a session token.
+   *
+   * The email verification link sent to users always points to the backend API endpoint.
+   * If `verifyEmailRedirectTo` is configured, the backend will redirect to that URL after successful verification.
+   * Otherwise, a default success page is displayed.
    */
   async verifyEmail(request) {
     try {
       const response = await this.http.post(
-        "/api/auth/verify-email",
+        "/api/auth/email/verify",
         request
       );
       if (response.accessToken) {