@nauth-toolkit/client 0.1.58 → 0.1.60

package/dist/index.cjs

@@ -25,6 +25,7 @@ __export(index_exports, {
   AuthAuditEventType: () => AuthAuditEventType,
   AuthChallenge: () => AuthChallenge,
   BrowserStorage: () => BrowserStorage,
+  ChallengeRouter: () => ChallengeRouter,
   EventEmitter: () => EventEmitter,
   FetchAdapter: () => FetchAdapter,
   InMemoryStorage: () => InMemoryStorage,
@@ -157,6 +158,7 @@ var defaultEndpoints = {
   requestPasswordChange: "/request-password-change",
   forgotPassword: "/forgot-password",
   confirmForgotPassword: "/forgot-password/confirm",
+  confirmAdminResetPassword: "/admin/reset-password/confirm",
   mfaStatus: "/mfa/status",
   mfaDevices: "/mfa/devices",
   mfaSetupData: "/mfa/setup-data",
@@ -562,6 +564,155 @@ var FetchAdapter = class {
   }
 };
 
+// src/core/challenge-router.ts
+var ChallengeRouter = class {
+  constructor(config) {
+    this.config = config;
+  }
+  /**
+   * Handle auth response - either call callback or auto-navigate.
+   *
+   * @param response - Auth response from backend
+   * @param context - Context about the auth operation
+   */
+  async handleAuthResponse(response, context) {
+    if (this.config.onAuthResponse) {
+      await this.config.onAuthResponse(response, context);
+      return;
+    }
+    if (response.challengeName) {
+      await this.navigateToChallenge(response);
+    } else {
+      await this.navigateToSuccess();
+    }
+  }
+  /**
+   * Navigate to appropriate challenge route.
+   *
+   * @param response - Auth response containing challenge info
+   */
+  async navigateToChallenge(response) {
+    const url = this.buildChallengeUrl(response);
+    await this.navigate(url);
+  }
+  /**
+   * Navigate to success URL.
+   */
+  async navigateToSuccess() {
+    const url = this.config.redirects?.success || "/";
+    await this.navigate(url);
+  }
+  /**
+   * Navigate to error URL.
+   *
+   * @param type - Type of error (oauth or session)
+   */
+  async navigateToError(type) {
+    const url = type === "oauth" ? this.config.redirects?.oauthError || "/login" : this.config.redirects?.sessionExpired || "/login";
+    await this.navigate(url);
+  }
+  /**
+   * Build challenge URL based on configuration.
+   *
+   * Priority:
+   * 1. Custom route mapping (challengeRoutes)
+   * 2. Single route with query param (useSingleChallengeRoute)
+   * 3. MFA-specific routes (mfaRoutes) - for MFA_REQUIRED challenge only
+   * 4. Default separate routes (challengeBase + kebab-case)
+   *
+   * @param response - Auth response containing challenge info
+   * @returns URL to navigate to
+   */
+  buildChallengeUrl(response) {
+    const challengeName = response.challengeName;
+    if (this.config.redirects?.challengeRoutes?.[challengeName]) {
+      return this.config.redirects.challengeRoutes[challengeName];
+    }
+    const base = this.config.redirects?.challengeBase || "/auth/challenge";
+    if (this.config.redirects?.useSingleChallengeRoute) {
+      return `${base}?challenge=${challengeName}`;
+    }
+    if (challengeName === "MFA_REQUIRED" /* MFA_REQUIRED */) {
+      const mfaUrl = this.buildMFAUrl(response);
+      if (mfaUrl) {
+        return mfaUrl;
+      }
+    }
+    const route = this.buildDefaultRouteSegment(challengeName, response);
+    return `${base}/${route}`;
+  }
+  /**
+   * Build MFA-specific URL if custom mfaRoutes are configured.
+   *
+   * @param response - Auth response with MFA challenge parameters
+   * @returns Custom MFA URL if configured, null otherwise
+   */
+  buildMFAUrl(response) {
+    const params = response.challengeParameters;
+    const method = params?.["preferredMethod"] || params?.["method"];
+    const mfaRoutes = this.config.redirects?.mfaRoutes;
+    if (!mfaRoutes) {
+      return null;
+    }
+    if (method === "passkey" && mfaRoutes.passkey) {
+      return mfaRoutes.passkey;
+    }
+    if (!method && params?.["availableMethods"] && Array.isArray(params["availableMethods"]) && params["availableMethods"].length > 1) {
+      if (mfaRoutes.selector) {
+        return mfaRoutes.selector;
+      }
+    }
+    if (mfaRoutes.default) {
+      return mfaRoutes.default;
+    }
+    return null;
+  }
+  /**
+   * Build default route segment for a challenge.
+   *
+   * @param challengeName - Challenge type
+   * @param response - Auth response for extracting challenge parameters (needed for MFA)
+   * @returns Route segment (e.g., 'mfa-required/passkey', 'verify-email')
+   */
+  buildDefaultRouteSegment(challengeName, response) {
+    if (challengeName === "MFA_REQUIRED" /* MFA_REQUIRED */ && response) {
+      const params = response.challengeParameters;
+      const method = params?.["preferredMethod"] || params?.["method"];
+      if (method === "passkey") {
+        return "mfa-required/passkey";
+      }
+      if (!method && params?.["availableMethods"] && Array.isArray(params["availableMethods"]) && params["availableMethods"].length > 1) {
+        return "mfa-selector";
+      }
+      return "mfa-required";
+    }
+    return challengeName.toLowerCase().replace(/_/g, "-");
+  }
+  /**
+   * Execute navigation using configured handler or default.
+   *
+   * @param url - URL to navigate to
+   */
+  async navigate(url) {
+    if (this.config.navigationHandler) {
+      await this.config.navigationHandler(url);
+    } else {
+      if (typeof window !== "undefined") {
+        window.location.replace(url);
+      }
+    }
+  }
+  /**
+   * Expose URL builder for guards/components that need it.
+   *
+   * @param response - Auth response containing challenge info
+   * @returns URL for the challenge
+   */
+  getChallengeUrl(response) {
+    return this.buildChallengeUrl(response);
+  }
+};
+
 // src/core/client.ts
 var USER_KEY2 = "nauth_user";
 var CHALLENGE_KEY2 = "nauth_challenge_session";
@@ -582,6 +733,7 @@ var NAuthClient = class {
     __publicField(this, "config");
     __publicField(this, "tokenManager");
     __publicField(this, "eventEmitter");
+    __publicField(this, "challengeRouter");
     __publicField(this, "currentUser", null);
     /**
      * Handle cross-tab storage updates.
@@ -600,6 +752,7 @@ var NAuthClient = class {
     this.config = resolveConfig({ ...userConfig, storage }, defaultAdapter);
     this.tokenManager = new TokenManager(storage);
     this.eventEmitter = new EventEmitter();
+    this.challengeRouter = new ChallengeRouter(this.config);
     if (hasWindow()) {
       window.addEventListener("storage", this.handleStorageEvent);
     }
@@ -629,6 +782,7 @@ var NAuthClient = class {
         const successEvent = { type: "auth:success", data: response, timestamp: Date.now() };
         this.eventEmitter.emit(successEvent);
       }
+      await this.challengeRouter.handleAuthResponse(response, { source: "login" });
       return response;
     } catch (error) {
       const authError = error instanceof NAuthClientError ? error : new NAuthClientError("AUTH_INVALID_CREDENTIALS" /* AUTH_INVALID_CREDENTIALS */, error.message || "Login failed");
@@ -650,6 +804,7 @@ var NAuthClient = class {
       } else {
         this.eventEmitter.emit({ type: "auth:success", data: response, timestamp: Date.now() });
       }
+      await this.challengeRouter.handleAuthResponse(response, { source: "signup" });
       return response;
     } catch (error) {
       const authError = error instanceof NAuthClientError ? error : new NAuthClientError("AUTH_INVALID_CREDENTIALS" /* AUTH_INVALID_CREDENTIALS */, error.message || "Signup failed");
@@ -779,6 +934,7 @@ var NAuthClient = class {
         const successEvent = { type: "auth:success", data: result, timestamp: Date.now() };
         this.eventEmitter.emit(successEvent);
       }
+      await this.challengeRouter.handleAuthResponse(result, { source: "challenge" });
       return result;
     } catch (error) {
       const authError = error instanceof NAuthClientError ? error : new NAuthClientError(
@@ -866,6 +1022,45 @@ var NAuthClient = class {
     await this.clearAuthState(false);
     return result;
   }
+  /**
+   * Reset password with code or token (works for both admin-initiated and user-initiated resets).
+   *
+   * Accepts either:
+   * - code: Short numeric code from email/SMS (6-10 digits)
+   * - token: Long hex token from reset link (64 chars)
+   *
+   * WHY: Generic method that works for both admin-initiated (adminResetPassword) and
+   * user-initiated (forgotPassword) password resets. Uses same backend endpoint.
+   *
+   * @param identifier - User identifier (email, username, phone)
+   * @param codeOrToken - Verification code OR token from link (one required)
+   * @param newPassword - New password
+   * @returns Success response
+   * @throws {NAuthClientError} When reset fails
+   *
+   * @example
+   * ```typescript
+   * // With code from email
+   * await client.resetPasswordWithCode('user@example.com', '123456', 'NewPass123!');
+   *
+   * // With token from link
+   * await client.resetPasswordWithCode('user@example.com', '64-char-token', 'NewPass123!');
+   * ```
+   */
+  async resetPasswordWithCode(identifier, codeOrToken, newPassword) {
+    const isToken = codeOrToken.length > 10;
+    const payload = {
+      identifier,
+      ...isToken ? { token: codeOrToken } : { code: codeOrToken },
+      newPassword
+    };
+    const result = await this.post(
+      this.config.endpoints.confirmAdminResetPassword,
+      payload
+    );
+    await this.clearAuthState(false);
+    return result;
+  }
   /**
    * Request password change (must change on next login).
    */
@@ -1026,6 +1221,7 @@ var NAuthClient = class {
     }
     const result = await this.post(this.config.endpoints.socialExchange, { exchangeToken: token });
     await this.handleAuthResponse(result);
+    await this.challengeRouter.handleAuthResponse(result, { source: "social" });
     return result;
   }
   /**
@@ -1379,6 +1575,21 @@ var NAuthClient = class {
     });
     return response.data;
   }
+  /**
+   * Get challenge router for manual navigation control.
+   * Useful for guards that need to handle errors or build custom URLs.
+   *
+   * @returns ChallengeRouter instance
+   *
+   * @example
+   * ```typescript
+   * const router = client.getChallengeRouter();
+   * await router.navigateToError('oauth');
+   * ```
+   */
+  getChallengeRouter() {
+    return this.challengeRouter;
+  }
 };
 
 // src/core/challenge-helpers.ts
@@ -1427,6 +1638,7 @@ function isOTPChallenge(challenge) {
   AuthAuditEventType,
   AuthChallenge,
   BrowserStorage,
+  ChallengeRouter,
   EventEmitter,
   FetchAdapter,
   InMemoryStorage,