@orangecheck/auth-client 1.1.0 → 2.1.0

package/dist/index.d.mts

@@ -108,4 +108,49 @@ interface OcSignInProps {
 }
 declare function OcSignIn({ audience, returnTo, onSuccess, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
 
-export { DEFAULT_CONFIG, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, buildSignInUrl, useOcAddressSuggestion, useOcSession, useOptionalOcSession };
+interface WebAuthnCredentialPublic {
+    id: string;
+    label: string;
+    authenticator_type: 'platform' | 'cross-platform' | 'unknown';
+    transports: string[];
+    user_verified: boolean;
+    created_at: string;
+    last_used_at: string | null;
+}
+type WebAuthnRegisterStatus = 'idle' | 'requesting-options' | 'authenticating' | 'verifying' | 'success' | 'error';
+type WebAuthnAssertionStatus = WebAuthnRegisterStatus;
+type WebAuthnListStatus = 'loading' | 'ready' | 'error';
+interface UseHostOptions {
+    authOrigin?: string;
+}
+interface UseWebAuthnRegisterReturn {
+    status: WebAuthnRegisterStatus;
+    error: Error | null;
+    register: (args?: {
+        label?: string;
+    }) => Promise<WebAuthnCredentialPublic | null>;
+    reset: () => void;
+}
+declare function useWebAuthnRegister(opts?: UseHostOptions): UseWebAuthnRegisterReturn;
+interface UseWebAuthnListReturn {
+    status: WebAuthnListStatus;
+    credentials: WebAuthnCredentialPublic[];
+    error: Error | null;
+    refetch: () => Promise<void>;
+    rename: (id: string, label: string) => Promise<WebAuthnCredentialPublic | null>;
+    remove: (id: string) => Promise<boolean>;
+}
+declare function useWebAuthnList(opts?: UseHostOptions): UseWebAuthnListReturn;
+interface UseStepUpAuthReturn {
+    status: WebAuthnAssertionStatus;
+    error: Error | null;
+    stepUp: (args: {
+        purpose: string;
+    }) => Promise<{
+        step_up_at: number;
+    } | null>;
+    reset: () => void;
+}
+declare function useStepUpAuth(opts?: UseHostOptions): UseStepUpAuthReturn;
+
+export { DEFAULT_CONFIG, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterStatus, buildSignInUrl, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };

package/dist/index.d.ts

@@ -108,4 +108,49 @@ interface OcSignInProps {
 }
 declare function OcSignIn({ audience, returnTo, onSuccess, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
 
-export { DEFAULT_CONFIG, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, buildSignInUrl, useOcAddressSuggestion, useOcSession, useOptionalOcSession };
+interface WebAuthnCredentialPublic {
+    id: string;
+    label: string;
+    authenticator_type: 'platform' | 'cross-platform' | 'unknown';
+    transports: string[];
+    user_verified: boolean;
+    created_at: string;
+    last_used_at: string | null;
+}
+type WebAuthnRegisterStatus = 'idle' | 'requesting-options' | 'authenticating' | 'verifying' | 'success' | 'error';
+type WebAuthnAssertionStatus = WebAuthnRegisterStatus;
+type WebAuthnListStatus = 'loading' | 'ready' | 'error';
+interface UseHostOptions {
+    authOrigin?: string;
+}
+interface UseWebAuthnRegisterReturn {
+    status: WebAuthnRegisterStatus;
+    error: Error | null;
+    register: (args?: {
+        label?: string;
+    }) => Promise<WebAuthnCredentialPublic | null>;
+    reset: () => void;
+}
+declare function useWebAuthnRegister(opts?: UseHostOptions): UseWebAuthnRegisterReturn;
+interface UseWebAuthnListReturn {
+    status: WebAuthnListStatus;
+    credentials: WebAuthnCredentialPublic[];
+    error: Error | null;
+    refetch: () => Promise<void>;
+    rename: (id: string, label: string) => Promise<WebAuthnCredentialPublic | null>;
+    remove: (id: string) => Promise<boolean>;
+}
+declare function useWebAuthnList(opts?: UseHostOptions): UseWebAuthnListReturn;
+interface UseStepUpAuthReturn {
+    status: WebAuthnAssertionStatus;
+    error: Error | null;
+    stepUp: (args: {
+        purpose: string;
+    }) => Promise<{
+        step_up_at: number;
+    } | null>;
+    reset: () => void;
+}
+declare function useStepUpAuth(opts?: UseHostOptions): UseStepUpAuthReturn;
+
+export { DEFAULT_CONFIG, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterStatus, buildSignInUrl, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };

package/dist/index.js

@@ -1,7 +1,8 @@
 'use strict';
 
-var React2 = require('react');
+var React4 = require('react');
 var jsxRuntime = require('react/jsx-runtime');
+var browser = require('@simplewebauthn/browser');
 
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
@@ -21,7 +22,7 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var React2__namespace = /*#__PURE__*/_interopNamespace(React2);
+var React4__namespace = /*#__PURE__*/_interopNamespace(React4);
 
 // src/provider.tsx
 
@@ -42,7 +43,7 @@ function buildSignInUrl(cfg, returnTo) {
   u.searchParams.set("return_to", returnTo);
   return u.toString();
 }
-var SessionContext = React2__namespace.createContext(null);
+var SessionContext = React4__namespace.createContext(null);
 function normalizeAccount(raw) {
   if (!raw) return null;
   const didOc = raw.did_oc ?? raw.didOc;
@@ -64,11 +65,11 @@ function OcSessionProvider({
   config,
   defaultReturnTo
 }) {
-  const cfg = React2__namespace.useMemo(() => resolveConfig(config), [config]);
-  const [account, setAccount] = React2__namespace.useState(null);
-  const [status, setStatus] = React2__namespace.useState("loading");
-  const [error, setError] = React2__namespace.useState(null);
-  const refresh = React2__namespace.useCallback(async () => {
+  const cfg = React4__namespace.useMemo(() => resolveConfig(config), [config]);
+  const [account, setAccount] = React4__namespace.useState(null);
+  const [status, setStatus] = React4__namespace.useState("loading");
+  const [error, setError] = React4__namespace.useState(null);
+  const refresh = React4__namespace.useCallback(async () => {
     if (typeof window === "undefined") return;
     try {
       const res = await fetch(cfg.mePath, {
@@ -97,10 +98,10 @@ function OcSessionProvider({
       setError(err instanceof Error ? err : new Error(String(err)));
     }
   }, [cfg.mePath]);
-  React2__namespace.useEffect(() => {
+  React4__namespace.useEffect(() => {
     void refresh();
   }, [refresh]);
-  const signOut = React2__namespace.useCallback(async () => {
+  const signOut = React4__namespace.useCallback(async () => {
     try {
       await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
         method: "POST",
@@ -111,7 +112,7 @@ function OcSessionProvider({
     setAccount(null);
     setStatus("anonymous");
   }, [cfg.authOrigin, cfg.logoutPath]);
-  const value = React2__namespace.useMemo(() => {
+  const value = React4__namespace.useMemo(() => {
     const returnTo = defaultReturnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
     return {
       status,
@@ -125,7 +126,7 @@ function OcSessionProvider({
   return /* @__PURE__ */ jsxRuntime.jsx(SessionContext.Provider, { value, children });
 }
 function useOcSession() {
-  const ctx = React2__namespace.useContext(SessionContext);
+  const ctx = React4__namespace.useContext(SessionContext);
   if (!ctx) {
     throw new Error(
       "[@orangecheck/auth-client] useOcSession() must be called inside <OcSessionProvider>"
@@ -134,7 +135,7 @@ function useOcSession() {
   return ctx;
 }
 function useOptionalOcSession() {
-  return React2__namespace.useContext(SessionContext);
+  return React4__namespace.useContext(SessionContext);
 }
 function shortenAddress(addr) {
   if (addr.length <= 12) return addr;
@@ -149,7 +150,7 @@ function isPrefixOf(value, target) {
 }
 var listboxIdCounter = 0;
 function useUniqueId(prefix) {
-  const [id] = React2__namespace.useState(() => `${prefix}-${++listboxIdCounter}`);
+  const [id] = React4__namespace.useState(() => `${prefix}-${++listboxIdCounter}`);
   return id;
 }
 function OcAccountChip({
@@ -163,9 +164,9 @@ function OcAccountChip({
 }) {
   const { status, account, signInUrl: sessionSignInUrl, signOut } = useOcSession();
   const signInUrl = signInUrlOverride ?? sessionSignInUrl;
-  const [open, setOpen] = React2__namespace.useState(false);
-  const wrapRef = React2__namespace.useRef(null);
-  React2__namespace.useEffect(() => {
+  const [open, setOpen] = React4__namespace.useState(false);
+  const wrapRef = React4__namespace.useRef(null);
+  React4__namespace.useEffect(() => {
     if (!open) return;
     function handleClickOutside(e) {
       if (wrapRef.current && !wrapRef.current.contains(e.target)) {
@@ -488,9 +489,9 @@ function useOcAddressSuggestion(options) {
   } = options;
   const { status, account } = useOcSession();
   const sessionAddress = status === "authenticated" ? account?.primaryBtc ?? null : null;
-  const [open, setOpen] = React2__namespace.useState(false);
-  const [highlighted, setHighlighted] = React2__namespace.useState(false);
-  const blurTimer = React2__namespace.useRef(null);
+  const [open, setOpen] = React4__namespace.useState(false);
+  const [highlighted, setHighlighted] = React4__namespace.useState(false);
+  const blurTimer = React4__namespace.useRef(null);
   const listboxId = useUniqueId("oc-addr-listbox");
   const optionId = `${listboxId}-opt`;
   const valueMatchesSession = sessionAddress != null && value.toLowerCase() === sessionAddress.toLowerCase();
@@ -502,7 +503,7 @@ function useOcAddressSuggestion(options) {
     setOpen(false);
     setHighlighted(false);
   }
-  React2__namespace.useEffect(() => {
+  React4__namespace.useEffect(() => {
     return () => {
       if (blurTimer.current != null) window.clearTimeout(blurTimer.current);
     };
@@ -605,7 +606,7 @@ function useOcAddressSuggestion(options) {
   ) : null;
   return { inputProps, popover };
 }
-var OcAddressInput = React2__namespace.forwardRef(
+var OcAddressInput = React4__namespace.forwardRef(
   function OcAddressInput2({
     value,
     onValueChange,
@@ -620,15 +621,15 @@ var OcAddressInput = React2__namespace.forwardRef(
   }, forwardedRef) {
     const { status, account } = useOcSession();
     const sessionAddress = status === "authenticated" ? account?.primaryBtc ?? null : null;
-    const [open, setOpen] = React2__namespace.useState(false);
-    const [highlighted, setHighlighted] = React2__namespace.useState(false);
-    const innerRef = React2__namespace.useRef(null);
+    const [open, setOpen] = React4__namespace.useState(false);
+    const [highlighted, setHighlighted] = React4__namespace.useState(false);
+    const innerRef = React4__namespace.useRef(null);
     const setRef = (node) => {
       innerRef.current = node;
       if (typeof forwardedRef === "function") forwardedRef(node);
       else if (forwardedRef) forwardedRef.current = node;
     };
-    const blurTimer = React2__namespace.useRef(null);
+    const blurTimer = React4__namespace.useRef(null);
     const listboxId = useUniqueId("oc-addr-listbox");
     const optionId = `${listboxId}-opt`;
     const valueMatchesSession = sessionAddress != null && value.toLowerCase() === sessionAddress.toLowerCase();
@@ -675,7 +676,7 @@ var OcAddressInput = React2__namespace.forwardRef(
       }
       onKeyDown?.(e);
     }
-    React2__namespace.useEffect(() => {
+    React4__namespace.useEffect(() => {
       return () => {
         if (blurTimer.current != null) window.clearTimeout(blurTimer.current);
       };
@@ -790,8 +791,8 @@ function OcSignIn({
   const walletEnabled = paths?.wallet ?? true;
   const emailEnabled = paths?.email ?? true;
   const safeReturn = safeReturnTo(returnTo);
-  const [path, setPath] = React2__namespace.useState(initialPath);
-  const handleSuccess = React2__namespace.useCallback(
+  const [path, setPath] = React4__namespace.useState(initialPath);
+  const handleSuccess = React4__namespace.useCallback(
     (account) => {
       if (onSuccess) {
         onSuccess(account);
@@ -899,10 +900,10 @@ function SigninTab({
   );
 }
 function WalletFlow({ authOrigin, audience, onSuccess }) {
-  const [address, setAddress] = React2__namespace.useState("");
-  const [error, setError] = React2__namespace.useState(null);
-  const [submitting, setSubmitting] = React2__namespace.useState(false);
-  const [stage, setStage] = React2__namespace.useState("enter");
+  const [address, setAddress] = React4__namespace.useState("");
+  const [error, setError] = React4__namespace.useState(null);
+  const [submitting, setSubmitting] = React4__namespace.useState(false);
+  const [stage, setStage] = React4__namespace.useState("enter");
   async function signIn(e) {
     e.preventDefault();
     const addr = address.trim();
@@ -1001,13 +1002,13 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
   ] });
 }
 function EmailFlow({ authOrigin, onSuccess }) {
-  const [stage, setStage] = React2__namespace.useState("enter");
-  const [email, setEmail] = React2__namespace.useState("");
-  const [emailError, setEmailError] = React2__namespace.useState(null);
-  const [code, setCode] = React2__namespace.useState("");
-  const [codeError, setCodeError] = React2__namespace.useState(null);
-  const [token, setToken] = React2__namespace.useState(null);
-  const [submitting, setSubmitting] = React2__namespace.useState(false);
+  const [stage, setStage] = React4__namespace.useState("enter");
+  const [email, setEmail] = React4__namespace.useState("");
+  const [emailError, setEmailError] = React4__namespace.useState(null);
+  const [code, setCode] = React4__namespace.useState("");
+  const [codeError, setCodeError] = React4__namespace.useState(null);
+  const [token, setToken] = React4__namespace.useState(null);
+  const [submitting, setSubmitting] = React4__namespace.useState(false);
   async function start(e) {
     e.preventDefault();
     const trimmed = email.trim().toLowerCase();
@@ -1271,6 +1272,214 @@ function Hint({ children }) {
     }
   );
 }
+function resolveAuthOrigin(opts) {
+  if (!opts) return resolveConfig(void 0).authOrigin;
+  return resolveConfig(opts).authOrigin;
+}
+function isAbortError(err) {
+  if (!(err instanceof Error)) return false;
+  return /NotAllowed|aborted|cancel|user cancelled/i.test(err.message);
+}
+function useWebAuthnRegister(opts) {
+  const authOrigin = resolveAuthOrigin(opts);
+  const [status, setStatus] = React4__namespace.useState("idle");
+  const [error, setError] = React4__namespace.useState(null);
+  const reset = React4__namespace.useCallback(() => {
+    setStatus("idle");
+    setError(null);
+  }, []);
+  const register = React4__namespace.useCallback(
+    async (args) => {
+      setError(null);
+      setStatus("requesting-options");
+      try {
+        const optsRes = await fetch(`${authOrigin}/api/auth/webauthn/register/options`, {
+          method: "POST",
+          credentials: "include",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ label: args?.label })
+        });
+        const optsBody = await optsRes.json();
+        if (!optsRes.ok || !optsBody.ok || !optsBody.options || !optsBody.challenge_token) {
+          throw new Error(optsBody.reason ?? `options_failed_${optsRes.status}`);
+        }
+        setStatus("authenticating");
+        const attestation = await browser.startRegistration({
+          optionsJSON: optsBody.options
+        });
+        setStatus("verifying");
+        const verifyRes = await fetch(`${authOrigin}/api/auth/webauthn/register/verify`, {
+          method: "POST",
+          credentials: "include",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            challenge_token: optsBody.challenge_token,
+            response: attestation,
+            label: args?.label
+          })
+        });
+        const verifyBody = await verifyRes.json();
+        if (!verifyRes.ok || !verifyBody.ok || !verifyBody.credential) {
+          throw new Error(verifyBody.reason ?? `verify_failed_${verifyRes.status}`);
+        }
+        setStatus("success");
+        return verifyBody.credential;
+      } catch (e) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        setError(err);
+        setStatus("error");
+        if (isAbortError(err)) {
+          setError(new Error("cancelled"));
+        }
+        return null;
+      }
+    },
+    [authOrigin]
+  );
+  return { status, error, register, reset };
+}
+function useWebAuthnList(opts) {
+  const authOrigin = resolveAuthOrigin(opts);
+  const { status: sessionStatus } = useOcSession();
+  const [credentials, setCredentials] = React4__namespace.useState([]);
+  const [status, setStatus] = React4__namespace.useState("loading");
+  const [error, setError] = React4__namespace.useState(null);
+  const refetch = React4__namespace.useCallback(async () => {
+    setError(null);
+    if (sessionStatus !== "authenticated") {
+      setCredentials([]);
+      setStatus("ready");
+      return;
+    }
+    setStatus("loading");
+    try {
+      const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials`, {
+        credentials: "include"
+      });
+      if (r.status === 401) {
+        setCredentials([]);
+        setStatus("ready");
+        return;
+      }
+      const j = await r.json();
+      if (!j.ok || !j.credentials) {
+        throw new Error(j.reason ?? "list_failed");
+      }
+      setCredentials(j.credentials);
+      setStatus("ready");
+    } catch (e) {
+      setError(e instanceof Error ? e : new Error(String(e)));
+      setStatus("error");
+    }
+  }, [authOrigin, sessionStatus]);
+  React4__namespace.useEffect(() => {
+    void refetch();
+  }, [refetch]);
+  const rename = React4__namespace.useCallback(
+    async (id, label) => {
+      try {
+        const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials/${id}`, {
+          method: "PATCH",
+          credentials: "include",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ label })
+        });
+        const j = await r.json();
+        if (!j.ok || !j.credential) {
+          setError(new Error(j.reason ?? "rename_failed"));
+          return null;
+        }
+        await refetch();
+        return j.credential;
+      } catch (e) {
+        setError(e instanceof Error ? e : new Error(String(e)));
+        return null;
+      }
+    },
+    [authOrigin, refetch]
+  );
+  const remove = React4__namespace.useCallback(
+    async (id) => {
+      try {
+        const r = await fetch(`${authOrigin}/api/auth/webauthn/credentials/${id}`, {
+          method: "DELETE",
+          credentials: "include"
+        });
+        const j = await r.json();
+        if (!j.ok) {
+          setError(new Error(j.reason ?? "delete_failed"));
+          return false;
+        }
+        await refetch();
+        return true;
+      } catch (e) {
+        setError(e instanceof Error ? e : new Error(String(e)));
+        return false;
+      }
+    },
+    [authOrigin, refetch]
+  );
+  return { status, credentials, error, refetch, rename, remove };
+}
+function useStepUpAuth(opts) {
+  const authOrigin = resolveAuthOrigin(opts);
+  const { refresh } = useOcSession();
+  const [status, setStatus] = React4__namespace.useState("idle");
+  const [error, setError] = React4__namespace.useState(null);
+  const reset = React4__namespace.useCallback(() => {
+    setStatus("idle");
+    setError(null);
+  }, []);
+  const stepUp = React4__namespace.useCallback(
+    async (args) => {
+      setError(null);
+      setStatus("requesting-options");
+      try {
+        const optsRes = await fetch(`${authOrigin}/api/auth/webauthn/assertion/options`, {
+          method: "POST",
+          credentials: "include",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ purpose: args.purpose })
+        });
+        const optsBody = await optsRes.json();
+        if (!optsRes.ok || !optsBody.ok || !optsBody.options || !optsBody.challenge_token) {
+          throw new Error(optsBody.reason ?? `options_failed_${optsRes.status}`);
+        }
+        setStatus("authenticating");
+        const assertion = await browser.startAuthentication({
+          optionsJSON: optsBody.options
+        });
+        setStatus("verifying");
+        const verifyRes = await fetch(
+          `${authOrigin}/api/auth/webauthn/assertion/verify`,
+          {
+            method: "POST",
+            credentials: "include",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              challenge_token: optsBody.challenge_token,
+              response: assertion
+            })
+          }
+        );
+        const verifyBody = await verifyRes.json();
+        if (!verifyRes.ok || !verifyBody.ok || typeof verifyBody.step_up_at !== "number") {
+          throw new Error(verifyBody.reason ?? `verify_failed_${verifyRes.status}`);
+        }
+        await refresh();
+        setStatus("success");
+        return { step_up_at: verifyBody.step_up_at };
+      } catch (e) {
+        const err = isAbortError(e) ? new Error("cancelled") : e instanceof Error ? e : new Error(String(e));
+        setError(err);
+        setStatus("error");
+        return null;
+      }
+    },
+    [authOrigin, refresh]
+  );
+  return { status, error, stepUp, reset };
+}
 
 exports.DEFAULT_CONFIG = DEFAULT_CONFIG;
 exports.OcAccountChip = OcAccountChip;
@@ -1283,5 +1492,8 @@ exports.buildSignInUrl = buildSignInUrl;
 exports.useOcAddressSuggestion = useOcAddressSuggestion;
 exports.useOcSession = useOcSession;
 exports.useOptionalOcSession = useOptionalOcSession;
+exports.useStepUpAuth = useStepUpAuth;
+exports.useWebAuthnList = useWebAuthnList;
+exports.useWebAuthnRegister = useWebAuthnRegister;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map