@masonitestudios/spartanauth-widgets 1.3.0 → 1.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -6,9 +6,9 @@ A collection of drop-in web components for authentication, built with [SolidJS](
|
|
|
6
6
|
|
|
7
7
|
| Custom Element | Description |
|
|
8
8
|
|---|---|
|
|
9
|
-
| `<spartan-login>` | Full login form supporting password, WebAuthn (passkeys), email OTP, authenticator-app (TOTP) codes, self-sign-up, and password reset
|
|
9
|
+
| `<spartan-login>` | Full login form supporting password, WebAuthn (passkeys), email OTP, authenticator-app (TOTP) codes, self-sign-up, password reset, and a breached-password reset prompt |
|
|
10
10
|
| `<spartan-invite>` | Invitation completion form — lets invited users set their password using a one-time code |
|
|
11
|
-
| `<spartan-account-settings>` | Authenticated account settings panel for
|
|
11
|
+
| `<spartan-account-settings>` | Authenticated account settings panel for passwords, passkeys, email MFA, and authenticator apps |
|
|
12
12
|
|
|
13
13
|
## Installation
|
|
14
14
|
|
|
@@ -57,6 +57,8 @@ The library exposes both UMD (`dist/sa-widgets.umd.js`) and ES module (`dist/sa-
|
|
|
57
57
|
- Authenticator enrollment during sign-in when the sector requires MFA and the user has no second factor yet
|
|
58
58
|
- Self-service sign-up (when enabled on the sector)
|
|
59
59
|
- Password reset via emailed code
|
|
60
|
+
- When a sector requires a reset for a password already known to be breached, sign-in stops on that screen and emails a reset code. The widget does not store a session or continue to another factor
|
|
61
|
+
- Reset, invite, and sign-up show the server's breach and "could not check" messages instead of treating every rejection as a bad code or a generic failure
|
|
60
62
|
- Emits a `spartan-login` CustomEvent on success with `{ token, transactionID }` in `event.detail`
|
|
61
63
|
- Stores the JWT in `localStorage` under `spartan-token`
|
|
62
64
|
|
|
@@ -145,6 +147,7 @@ The widget can also read the OTP code from the URL hash (e.g. `#invite?otp=ABC12
|
|
|
145
147
|
| `styles` | `""` | Custom CSS injected into the widget's shadow DOM |
|
|
146
148
|
|
|
147
149
|
**Features:**
|
|
150
|
+
- Change the signed-in password. When that password is in a known breach, the panel shows a warning and can email a reset code
|
|
148
151
|
- List, add, and remove WebAuthn passkeys
|
|
149
152
|
- List, add, validate, and remove MFA registrations (email & SMS OTP)
|
|
150
153
|
- List, add, and remove authenticator apps. Setup shows a QR code and the shared secret once, then the one-time recovery codes the first time the user enrolls
|