@lalternative/auth 0.5.0 → 0.7.0

package/dist/{types-BEldQPou.d.ts → types-SieiPwdd.d.ts}

@@ -116,13 +116,34 @@ interface PlatformAuthClientConfig {
     /** Additional client plugins */
     plugins?: any[];
 }
-interface VerifyEmailFormProps {
+interface VerifyEmailFormLabels {
+    title?: string;
+    subtitle?: string;
+    subtitleNoEmail?: string;
+    codePlaceholder?: string;
+    submit?: string;
+    submitPending?: string;
+    resend?: string;
+    resendPending?: string;
+    resent?: string;
+    alreadyVerified?: string;
+    login?: string;
+    codeRequired?: string;
+    invalidCode?: string;
+    resendFailed?: string;
+    missingEmail?: string;
+}
+interface VerifyEmailFormProps extends AuthHeadingProps {
     /** Email to verify */
     email: string;
     /** Callback on successful verification */
     onSuccess?: () => void;
     /** URL to navigate to on success */
     successUrl?: string;
+    /** Link to the login page */
+    loginUrl?: string;
+    /** Copy overrides; anything omitted keeps the French default */
+    labels?: VerifyEmailFormLabels;
     /** Auth client instance */
     authClient: any;
 }
@@ -174,9 +195,24 @@ interface RegisterFormLabels {
     passwordTooShort?: string;
     signUpFailed?: string;
 }
-interface LoginFormProps {
+/**
+ * Styling of the form's own heading. The package fixes the structure and a
+ * neutral default; the app fixes the type. Passing a class replaces the
+ * default size and weight, so pass the whole look, not an addition to it.
+ */
+interface AuthHeadingProps {
+    /** Replaces the default `text-2xl font-semibold tracking-tight` */
+    titleClassName?: string;
+}
+interface LoginFormProps extends AuthHeadingProps {
     /** Callback once the session cookie is set and the core token minted */
     onSuccess?: () => void;
+    /**
+     * Error raised outside the form — a failed OAuth round-trip coming back as
+     * `?error=`, a guard bouncing an unauthenticated visitor. Rendered in the
+     * same banner as the form's own errors, and superseded by them on submit.
+     */
+    error?: string;
     /** Link to the registration page */
     registerUrl?: string;
     /** Link to the password recovery page */
@@ -199,9 +235,11 @@ interface LoginFormProps {
     /** Auth client instance */
     authClient: any;
 }
-interface RegisterFormProps {
+interface RegisterFormProps extends AuthHeadingProps {
     /** Callback on successful sign-up, receives the email to verify */
     onSuccess?: (email: string) => void;
+    /** Error raised outside the form, rendered in the same banner */
+    error?: string;
     /** Link to the login page */
     loginUrl?: string;
     /** Rendered under the submit button — typically terms and privacy links */
@@ -215,32 +253,70 @@ interface RegisterFormProps {
     /** Auth client instance */
     authClient: any;
 }
-interface ForgotPasswordFormProps {
+interface ForgotPasswordFormLabels {
+    title?: string;
+    subtitle?: string;
+    emailPlaceholder?: string;
+    submit?: string;
+    submitPending?: string;
+    rememberPassword?: string;
+    login?: string;
+    emailRequired?: string;
+    sendFailed?: string;
+}
+interface ForgotPasswordFormProps extends AuthHeadingProps {
     /** Callback on successful OTP send, receives the email */
     onSuccess?: (email: string) => void;
     /** Link to login page */
     loginUrl?: string;
+    /** Copy overrides; anything omitted keeps the French default */
+    labels?: ForgotPasswordFormLabels;
     /** Auth client instance */
     authClient: any;
 }
-interface ResetPasswordFormProps {
+interface ResetPasswordFormLabels {
+    title?: string;
+    subtitle?: string;
+    codePlaceholder?: string;
+    passwordPlaceholder?: string;
+    passwordHint?: string;
+    confirmPlaceholder?: string;
+    submit?: string;
+    submitPending?: string;
+    resend?: string;
+    resendPending?: string;
+    resent?: string;
+    rememberPassword?: string;
+    login?: string;
+    codeRequired?: string;
+    passwordTooShort?: string;
+    passwordMismatch?: string;
+    resetFailed?: string;
+    resendFailed?: string;
+}
+interface ResetPasswordFormProps extends AuthHeadingProps {
     /** Email address to reset password for */
     email: string;
     /** Callback on successful password reset */
     onSuccess?: () => void;
     /** Link to login page */
     loginUrl?: string;
+    /** Copy overrides; anything omitted keeps the French default */
+    labels?: ResetPasswordFormLabels;
     /** Auth client instance */
     authClient: any;
 }
 interface AuthLayoutProps {
-    /** Logo element to display at the top */
+    /** The app's mark, rendered above the form inside the card */
     logo?: React.ReactNode;
-    /** Page title */
-    title: string;
-    /** Subtitle below the title */
-    subtitle?: string;
-    /** Content to render inside the card */
+    /**
+     * Illustration filling the right half of the card from md up, dropped below
+     * it. Any node: an `<img className="h-full w-full object-cover">`, a
+     * gradient, a testimonial. Purely decorative — it is hidden from assistive
+     * technology, so it must not carry anything the form does not say.
+     */
+    panel?: React.ReactNode;
+    /** The form. It renders its own title. */
     children: React.ReactNode;
     /** Footer content below the card (e.g. legal links) */
     footer?: React.ReactNode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lalternative/auth",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Shared Better Auth wrapper for L'Alternative apps (server + React client + auth UI)",
   "type": "module",
   "main": "./dist/index.js",

package/dist/chunk-73BHM4PZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/invitation.ts"],"sourcesContent":["import type { InvitationFailure } from \"./types\"\n\n/**\n * What became of a claim, in terms the invitee can be told.\n *\n * 'expired' and 'claimed' are kept apart from 'unknown' because only they say\n * the offer was real, which is what tells someone that asking for a new link is\n * worth it rather than doubting the address they were invited at. The three\n * failures match InvitationFailure, so an outcome feeds InvitationNotice\n * directly.\n */\nexport type ClaimOutcome = \"granted\" | InvitationFailure | \"failed\"\n\nconst OUTCOME_BY_STATUS: Record<number, ClaimOutcome> = {\n  404: \"unknown\",\n  409: \"claimed\",\n  410: \"expired\",\n}\n\nexport interface ClaimInvitationOptions {\n  /** Absolute URL of the endpoint that redeems a token. */\n  endpoint: string\n  token: string\n  /** The account the app just created, which the grant is attached to. */\n  externalUserId: string\n  /** Sent as the Authorization bearer — typically the app's API key. */\n  apiKey?: string\n  /** Merged into the request body, for backends wanting more than the token. */\n  extra?: Record<string, unknown>\n  /** Headers merged last, so a caller can pass a cookie-based credential. */\n  headers?: Record<string, string>\n  /** Bounds the call so a slow API never stalls the sign-in response. */\n  timeoutMs?: number\n}\n\n/**\n * Redeems an invitation token for a user who has just signed in, turning the\n * offer into a grant on their account.\n *\n * Why this belongs on the SERVER, on the auth callback rather than in the page:\n * the invitation link lands on /register?invite=<token>, but the sign-up that\n * follows can complete through any of three flows (password + OTP, OAuth\n * redirect, email verification), and only two of them return to the page that\n * held the token. Claiming where the session is established covers every flow\n * with one code path.\n *\n * Best-effort by design: a sign-in must never fail because an invitation could\n * not be redeemed. A failed claim leaves the invitation unclaimed and the user\n * on their default tier — recoverable by following the link again, since a\n * refused claim consumes nothing.\n */\nexport async function claimInvitation({\n  endpoint,\n  token,\n  externalUserId,\n  apiKey,\n  extra,\n  headers,\n  timeoutMs = 5000,\n}: ClaimInvitationOptions): Promise<ClaimOutcome> {\n  try {\n    const res = await fetch(endpoint, {\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}),\n        ...headers,\n      },\n      body: JSON.stringify({\n        token,\n        external_user_id: externalUserId,\n        ...extra,\n      }),\n      signal: AbortSignal.timeout(timeoutMs),\n    })\n\n    if (res.ok) return \"granted\"\n    return OUTCOME_BY_STATUS[res.status] ?? \"failed\"\n  } catch {\n    return \"failed\"\n  }\n}\n\n/**\n * Extracts the invitation token from an auth request.\n *\n * The token lives on the page the invitee landed on (/register?invite=…), never\n * on the auth endpoints themselves, so it has to be recovered from the request\n * that completes the sign-up. Two sources, because no single one covers every\n * flow: the URL, for the OAuth callback reached through a redirect whose query\n * string the app controls; and the Referer, for the password and OTP flows,\n * which are XHR calls issued BY that page and therefore carry it.\n *\n * Reading it per-request keeps the claim stateless: nothing associates a\n * browser with a pending invitation, and a request with no token claims\n * nothing. A malformed Referer is ignored rather than thrown on — it is\n * attacker-controlled input on a best-effort path.\n */\nexport function inviteTokenFrom(\n  request: Request,\n  param = \"invite\",\n): string | null {\n  const direct = new URL(request.url).searchParams.get(param)\n  if (direct && direct.trim() !== \"\") return direct\n\n  const referer = request.headers.get(\"referer\")\n  if (!referer) return null\n  try {\n    const token = new URL(referer).searchParams.get(param)\n    return token && token.trim() !== \"\" ? token : null\n  } catch {\n    return null\n  }\n}\n\n/**\n * BetterAuth paths that complete a sign-up. Email/password returns the user\n * straight from sign-up/email; the OTP and OAuth flows only produce a usable\n * account once the verification/callback succeeds, so those are the moments\n * worth reacting to.\n */\nconst SIGNUP_COMPLETING = [\n  \"/sign-up/email\",\n  \"/sign-in/email-otp\",\n  \"/email-otp/verify-email\",\n  \"/callback/\",\n]\n\n/**\n * Whether this request is the one that just created a usable account — the\n * moment to provision, claim an invitation, or greet someone. Matching on the\n * path rather than on a response body keeps it flow-agnostic: the three\n * sign-up flows return three different shapes.\n */\nexport function completesSignup(pathname: string): boolean {\n  return SIGNUP_COMPLETING.some((p) => pathname.includes(p))\n}\n\n/**\n * Carries a failed claim to the next page. The claim happens inside an auth\n * response nobody renders, so its result would otherwise reach only the server\n * log — leaving an invitee on the default tier with no idea their link had\n * lapsed. Short-lived and readable by the page, which reports it and clears it.\n */\nexport function invitationOutcomeCookie(\n  outcome: ClaimOutcome,\n  name = \"invite_claim\",\n): string {\n  return `${name}=${outcome}; Path=/; Max-Age=120; SameSite=Lax`\n}\n\n/**\n * Whether an outcome is one the invitee should be shown a reason for.\n * 'failed' is excluded: it means the call did not complete, so the offer may\n * still be good and telling someone their invitation is invalid would be wrong.\n */\nexport function isInvitationFailure(\n  outcome: ClaimOutcome,\n): outcome is InvitationFailure {\n  return outcome === \"expired\" || outcome === \"claimed\" || outcome === \"unknown\"\n}\n"],"mappings":";AAaA,IAAM,oBAAkD;AAAA,EACtD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAkCA,eAAsB,gBAAgB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAY;AACd,GAAkD;AAChD,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,UAAU;AAAA,MAChC,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAI,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG,IAAI,CAAC;AAAA,QACtD,GAAG;AAAA,MACL;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB;AAAA,QACA,kBAAkB;AAAA,QAClB,GAAG;AAAA,MACL,CAAC;AAAA,MACD,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AAED,QAAI,IAAI,GAAI,QAAO;AACnB,WAAO,kBAAkB,IAAI,MAAM,KAAK;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBO,SAAS,gBACd,SACA,QAAQ,UACO;AACf,QAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,KAAK;AAC1D,MAAI,UAAU,OAAO,KAAK,MAAM,GAAI,QAAO;AAE3C,QAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS;AAC7C,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,QAAQ,IAAI,IAAI,OAAO,EAAE,aAAa,IAAI,KAAK;AACrD,WAAO,SAAS,MAAM,KAAK,MAAM,KAAK,QAAQ;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,gBAAgB,UAA2B;AACzD,SAAO,kBAAkB,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC;AAC3D;AAQO,SAAS,wBACd,SACA,OAAO,gBACC;AACR,SAAO,GAAG,IAAI,IAAI,OAAO;AAC3B;AAOO,SAAS,oBACd,SAC8B;AAC9B,SAAO,YAAY,aAAa,YAAY,aAAa,YAAY;AACvE;","names":[]}