@lalternative/auth 0.2.0 → 0.3.0

package/README.md

@@ -34,3 +34,37 @@ export const authClient = createPlatformAuthClient({ baseURL })
 // UI + hooks
 import { VerifyEmailForm, ForgotPasswordForm, ResetPasswordForm, AuthLayout, useSession, useLogout } from "@lalternative/auth"
 ```
+
+### Invitations
+
+An invitation link lands on the app's own sign-up page
+(`/register?invite=<token>`) and is redeemed once the account exists. Claim on
+the auth callback, not in the page: a sign-up completes through password + OTP,
+OAuth redirect or email verification, and only two of those return to the page
+that held the token.
+
+```ts
+// server — auth callback (e.g. routes/api/auth/$.ts)
+import { claimInvitation, inviteTokenFrom } from "@lalternative/auth/server"
+
+const token = inviteTokenFrom(request)
+if (token && user) {
+  // Best-effort: a sign-in must never fail because a claim did not go through.
+  const outcome = await claimInvitation({
+    endpoint: `${process.env.LUNGOR_API_URL}/invitations/claim`,
+    apiKey: process.env.LUNGOR_APP_API_KEY,
+    token,
+    externalUserId: user.id,
+  })
+}
+```
+
+```tsx
+// UI — telling the invitee why a link did not work
+import { InvitationNotice, isInvitationFailure } from "@lalternative/auth"
+
+if (isInvitationFailure(outcome)) return <InvitationNotice reason={outcome} />
+```
+
+`endpoint` is any backend that redeems a token, so an app already claiming
+against its own API keeps doing so; `extra` adds fields to the request body.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lalternative/auth",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Shared Better Auth wrapper for L'Alternative apps (server + React client + auth UI)",
   "type": "module",
   "main": "./dist/index.js",