@orangecheck/auth-client 2.15.0 → 2.17.0

package/README.md

@@ -12,6 +12,13 @@ sign-in button.
 
 Pairs with [`@orangecheck/auth-core`](../auth-core) on the server side.
 
+> **Which integration pathway is this?** This package is for letting
+> OrangeCheck *be* your sign-in. If you already run your own login
+> (Google, Auth0, Clerk, NextAuth, …) and just want to add a `did:oc`
+> to your users, you don't need this package — see
+> [OrangeCheck Connect](https://docs.ochk.io/connect). Both pathways are
+> compared at [docs.ochk.io/integration](https://docs.ochk.io/integration).
+
 ## Install
 
 ```bash

package/dist/index.d.mts

@@ -19,12 +19,25 @@ interface OcAccount {
     displayIdentity: DisplayIdentity;
 }
 type OcSessionStatus = 'loading' | 'authenticated' | 'anonymous' | 'error';
+interface OcAccountSummary {
+    didOc: string;
+    displayName: string | null;
+    primaryBtc: string | null;
+    displayIdentity: DisplayIdentity;
+    lastSeenAt: string | null;
+}
+type OcSignOutScope = 'all' | 'current';
 interface OcSessionState {
     status: OcSessionStatus;
     account: OcAccount | null;
+    roster: OcAccountSummary[];
     error: Error | null;
     refresh: () => Promise<void>;
-    signOut: () => Promise<void>;
+    signOut: (opts?: {
+        scope?: OcSignOutScope;
+    }) => Promise<void>;
+    switchAccount: (didOc: string) => Promise<void>;
+    addAccountUrl: (returnTo?: string) => string;
     setDisplayIdentity: (kind: DisplayIdentityKind) => Promise<void>;
     signInUrl: string;
 }
@@ -36,6 +49,7 @@ interface OcAuthConfig {
 }
 declare const DEFAULT_CONFIG: Required<OcAuthConfig>;
 declare function buildSignInUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
+declare function buildAddAccountUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
 
 interface OcSessionProviderProps {
     children: React.ReactNode;
@@ -115,9 +129,10 @@ interface OcSignInProps {
         email?: boolean;
     };
     linkPrompt?: boolean;
+    add?: boolean;
     className?: string;
 }
-declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
+declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, add: addProp, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
 
 interface OcLinkedIdentity {
     id: string;
@@ -219,4 +234,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };

package/dist/index.d.ts

@@ -19,12 +19,25 @@ interface OcAccount {
     displayIdentity: DisplayIdentity;
 }
 type OcSessionStatus = 'loading' | 'authenticated' | 'anonymous' | 'error';
+interface OcAccountSummary {
+    didOc: string;
+    displayName: string | null;
+    primaryBtc: string | null;
+    displayIdentity: DisplayIdentity;
+    lastSeenAt: string | null;
+}
+type OcSignOutScope = 'all' | 'current';
 interface OcSessionState {
     status: OcSessionStatus;
     account: OcAccount | null;
+    roster: OcAccountSummary[];
     error: Error | null;
     refresh: () => Promise<void>;
-    signOut: () => Promise<void>;
+    signOut: (opts?: {
+        scope?: OcSignOutScope;
+    }) => Promise<void>;
+    switchAccount: (didOc: string) => Promise<void>;
+    addAccountUrl: (returnTo?: string) => string;
     setDisplayIdentity: (kind: DisplayIdentityKind) => Promise<void>;
     signInUrl: string;
 }
@@ -36,6 +49,7 @@ interface OcAuthConfig {
 }
 declare const DEFAULT_CONFIG: Required<OcAuthConfig>;
 declare function buildSignInUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
+declare function buildAddAccountUrl(cfg: Required<OcAuthConfig>, returnTo?: string): string;
 
 interface OcSessionProviderProps {
     children: React.ReactNode;
@@ -115,9 +129,10 @@ interface OcSignInProps {
         email?: boolean;
     };
     linkPrompt?: boolean;
+    add?: boolean;
     className?: string;
 }
-declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
+declare function OcSignIn({ audience, returnTo, onSuccess, resolveReturnTo, linkPrompt, add: addProp, authOrigin, initialPath, paths, className, }: OcSignInProps): React.ReactElement;
 
 interface OcLinkedIdentity {
     id: string;
@@ -219,4 +234,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type RedirectToSudoArgs, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };

package/dist/index.js

@@ -44,6 +44,11 @@ function buildSignInUrl(cfg, returnTo) {
   u.searchParams.set("return_to", returnTo);
   return u.toString();
 }
+function buildAddAccountUrl(cfg, returnTo) {
+  const u = new URL(buildSignInUrl(cfg, returnTo));
+  u.searchParams.set("add", "1");
+  return u.toString();
+}
 var SessionContext = React3__namespace.createContext(null);
 function normalizeDisplayIdentity(raw, didOc) {
   const di = raw.display_identity ?? raw.displayIdentity;
@@ -52,6 +57,19 @@ function normalizeDisplayIdentity(raw, didOc) {
   }
   return { kind: "did", value: didOc };
 }
+function normalizeRosterEntry(raw) {
+  const didOc = raw.did_oc ?? raw.didOc;
+  if (!didOc) return null;
+  const di = raw.display_identity ?? raw.displayIdentity;
+  const displayIdentity = di && typeof di === "object" && typeof di.value === "string" && di.value.length > 0 && typeof di.kind === "string" && DISPLAY_IDENTITY_KINDS.includes(di.kind) ? { kind: di.kind, value: di.value } : { kind: "did", value: didOc };
+  return {
+    didOc,
+    displayName: raw.display_name ?? raw.displayName ?? null,
+    primaryBtc: raw.primary_btc ?? raw.primaryBtc ?? null,
+    displayIdentity,
+    lastSeenAt: raw.last_seen_at ?? raw.lastSeenAt ?? null
+  };
+}
 function normalizeAccount(raw) {
   if (!raw) return null;
   const didOc = raw.did_oc ?? raw.didOc;
@@ -77,6 +95,7 @@ function OcSessionProvider({
 }) {
   const cfg = React3__namespace.useMemo(() => resolveConfig(config), [config]);
   const [account, setAccount] = React3__namespace.useState(null);
+  const [roster, setRoster] = React3__namespace.useState([]);
   const [status, setStatus] = React3__namespace.useState("loading");
   const [error, setError] = React3__namespace.useState(null);
   const refresh = React3__namespace.useCallback(async () => {
@@ -89,6 +108,7 @@ function OcSessionProvider({
       });
       if (res.status === 401) {
         setAccount(null);
+        setRoster([]);
         setStatus("anonymous");
         setError(null);
         return;
@@ -100,7 +120,9 @@ function OcSessionProvider({
       }
       const body = await res.json();
       const acct = normalizeAccount(body.account);
+      const rosterEntries = Array.isArray(body.roster) ? body.roster.map(normalizeRosterEntry).filter((r) => r !== null) : [];
       setAccount(acct);
+      setRoster(rosterEntries);
       setStatus(acct ? "authenticated" : "anonymous");
       setError(null);
     } catch (err) {
@@ -111,23 +133,63 @@ function OcSessionProvider({
   React3__namespace.useEffect(() => {
     void refresh();
   }, [refresh]);
-  const signOut = React3__namespace.useCallback(async () => {
-    try {
-      await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
+  const signOut = React3__namespace.useCallback(
+    async (opts) => {
+      const scope = opts?.scope ?? "all";
+      try {
+        const url = new URL(`${cfg.authOrigin}${cfg.logoutPath}`);
+        if (scope === "current") url.searchParams.set("scope", "current");
+        const res = await fetch(url.toString(), {
+          method: "POST",
+          credentials: "include",
+          // `keepalive` lets the logout round-trip complete even if
+          // the caller hard-navigates away in the same tick (e.g.
+          // `<OcAccountMenu>` redirects home immediately on sign-out).
+          // Without it the in-flight request is cancelled on unload
+          // and the `.ochk.io` cookie may never get cleared.
+          keepalive: true
+        });
+        if (scope === "current" && res.ok) {
+          await refresh();
+          return;
+        }
+      } catch {
+      }
+      setAccount(null);
+      setRoster([]);
+      setStatus("anonymous");
+    },
+    [cfg.authOrigin, cfg.logoutPath, refresh]
+  );
+  const switchAccount = React3__namespace.useCallback(
+    async (didOc) => {
+      if (typeof window === "undefined") return;
+      const res = await fetch(`${cfg.authOrigin}/api/auth/switch`, {
         method: "POST",
         credentials: "include",
-        // `keepalive` lets the logout round-trip complete even if
-        // the caller hard-navigates away in the same tick (e.g.
-        // `<OcAccountMenu>` redirects home immediately on sign-out).
-        // Without it the in-flight request is cancelled on unload
-        // and the `.ochk.io` cookie may never get cleared.
-        keepalive: true
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ did_oc: didOc })
       });
-    } catch {
-    }
-    setAccount(null);
-    setStatus("anonymous");
-  }, [cfg.authOrigin, cfg.logoutPath]);
+      if (!res.ok) {
+        let reason = `http_${res.status}`;
+        try {
+          const body = await res.json();
+          if (body.reason) reason = body.reason;
+        } catch {
+        }
+        throw new Error(`[@orangecheck/auth-client] switchAccount failed: ${reason}`);
+      }
+      await refresh();
+    },
+    [cfg.authOrigin, refresh]
+  );
+  const addAccountUrl = React3__namespace.useCallback(
+    (returnTo) => {
+      const rt = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
+      return buildAddAccountUrl(cfg, rt);
+    },
+    [cfg]
+  );
   const setDisplayIdentity = React3__namespace.useCallback(
     async (kind) => {
       if (typeof window === "undefined") return;
@@ -155,13 +217,28 @@ function OcSessionProvider({
     return {
       status,
       account,
+      roster,
       error,
       refresh,
       signOut,
+      switchAccount,
+      addAccountUrl,
       setDisplayIdentity,
       signInUrl: buildSignInUrl(cfg, returnTo)
     };
-  }, [status, account, error, refresh, signOut, setDisplayIdentity, cfg, defaultReturnTo]);
+  }, [
+    status,
+    account,
+    roster,
+    error,
+    refresh,
+    signOut,
+    switchAccount,
+    addAccountUrl,
+    setDisplayIdentity,
+    cfg,
+    defaultReturnTo
+  ]);
   return /* @__PURE__ */ jsxRuntime.jsx(SessionContext.Provider, { value, children });
 }
 function useOcSession() {
@@ -1688,6 +1765,7 @@ function OcSignIn({
   onSuccess,
   resolveReturnTo,
   linkPrompt = true,
+  add: addProp,
   authOrigin = "https://ochk.io",
   initialPath = "wallet",
   paths,
@@ -1696,6 +1774,15 @@ function OcSignIn({
   const walletEnabled = paths?.wallet ?? true;
   const emailEnabled = paths?.email ?? true;
   const safeReturn = safeReturnTo(returnTo);
+  const [addMode, setAddMode] = React3__namespace.useState(Boolean(addProp));
+  React3__namespace.useEffect(() => {
+    if (typeof window === "undefined") return;
+    if (addProp !== void 0) {
+      setAddMode(Boolean(addProp));
+      return;
+    }
+    setAddMode(new URLSearchParams(window.location.search).get("add") === "1");
+  }, [addProp]);
   const [path, setPath] = React3__namespace.useState(initialPath);
   const [signedIn, setSignedIn] = React3__namespace.useState(null);
   const [linkAlso, setLinkAlso] = React3__namespace.useState(false);
@@ -1838,6 +1925,7 @@ function OcSignIn({
         {
           authOrigin,
           audience,
+          add: addMode,
           onSuccess: (a, t) => void handleSuccess(a, t, "wallet")
         }
       ),
@@ -1845,6 +1933,7 @@ function OcSignIn({
         EmailFlow,
         {
           authOrigin,
+          add: addMode,
           onSuccess: (a, t) => void handleSuccess(a, t, "email")
         }
       )
@@ -1900,6 +1989,23 @@ function SigninTab({
     }
   );
 }
+function ProviderIcon({ id }) {
+  const common = {
+    width: 14,
+    height: 14,
+    viewBox: "0 0 24 24",
+    fill: "currentColor",
+    "aria-hidden": true,
+    style: { flex: "0 0 auto" }
+  };
+  if (id === "google") {
+    return /* @__PURE__ */ jsxRuntime.jsx("svg", { ...common, children: /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M12.48 10.92v3.28h7.84c-.24 1.84-.853 3.187-1.787 4.133-1.147 1.147-2.933 2.4-6.053 2.4-4.827 0-8.6-3.893-8.6-8.72s3.773-8.72 8.6-8.72c2.6 0 4.507 1.027 5.907 2.347l2.307-2.307C18.747 1.44 16.133 0 12.48 0 5.867 0 .307 5.387.307 12s5.56 12 12.173 12c3.573 0 6.267-1.173 8.373-3.36 2.16-2.16 2.84-5.213 2.84-7.667 0-.76-.053-1.467-.173-2.053H12.48z" }) });
+  }
+  if (id === "github") {
+    return /* @__PURE__ */ jsxRuntime.jsx("svg", { ...common, children: /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12" }) });
+  }
+  return null;
+}
 function ProviderSignIn({
   authOrigin,
   returnTo
@@ -1942,7 +2048,7 @@ function ProviderSignIn({
         ]
       }
     ),
-    providers.map((p, i) => /* @__PURE__ */ jsxRuntime.jsx(
+    providers.map((p, i) => /* @__PURE__ */ jsxRuntime.jsxs(
       "a",
       {
         href: `${authOrigin}/api/auth/${p.id}/start?return_to=${encodeURIComponent(
@@ -1950,12 +2056,14 @@ function ProviderSignIn({
         )}`,
         "data-oc-signin-provider": p.id,
         style: {
-          display: "block",
+          display: "flex",
+          alignItems: "center",
+          justifyContent: "center",
+          gap: 10,
           boxSizing: "border-box",
           width: "100%",
           marginTop: i === 0 ? 0 : 8,
           padding: "0.6rem 0.875rem",
-          textAlign: "center",
           border: "1px solid var(--border, #27272a)",
           borderRadius: 6,
           background: "transparent",
@@ -1964,13 +2072,16 @@ function ProviderSignIn({
           fontSize: 12,
           textDecoration: "none"
         },
-        children: p.label
+        children: [
+          /* @__PURE__ */ jsxRuntime.jsx(ProviderIcon, { id: p.id }),
+          /* @__PURE__ */ jsxRuntime.jsx("span", { children: p.label })
+        ]
       },
       p.id
     ))
   ] });
 }
-function WalletFlow({ authOrigin, audience, onSuccess }) {
+function WalletFlow({ authOrigin, audience, add, onSuccess }) {
   const [address, setAddress] = React3__namespace.useState("");
   const [error, setError] = React3__namespace.useState(null);
   const [submitting, setSubmitting] = React3__namespace.useState(false);
@@ -2018,7 +2129,12 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
           scheme: "bip322",
           expectedNonce: challenge.nonce,
           expectedAudience: audience,
-          expectedPurpose: "login"
+          expectedPurpose: "login",
+          // Multi-account add-mode · the auth host preserves
+          // the current roster_id when set, instead of minting
+          // a fresh one. Hosts that haven't deployed the
+          // multi-account migration silently ignore the field.
+          ...add ? { add: true } : {}
         })
       });
       const json = await res.json();
@@ -2069,7 +2185,7 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
     /* @__PURE__ */ jsxRuntime.jsx(Hint, { children: "Detection picks the first installed BIP-322-capable extension. Address is the one your wallet will sign for." })
   ] });
 }
-function EmailFlow({ authOrigin, onSuccess }) {
+function EmailFlow({ authOrigin, add, onSuccess }) {
   const [stage, setStage] = React3__namespace.useState("enter");
   const [email, setEmail] = React3__namespace.useState("");
   const [emailError, setEmailError] = React3__namespace.useState(null);
@@ -2120,7 +2236,13 @@ function EmailFlow({ authOrigin, onSuccess }) {
         method: "POST",
         credentials: "include",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email, code, token })
+        body: JSON.stringify({
+          email,
+          code,
+          token,
+          // Multi-account add-mode · see WalletFlow.
+          ...add ? { add: true } : {}
+        })
       });
       const json = await res.json();
       if (!res.ok || !("ok" in json) || !json.ok || !json.account) {
@@ -2621,6 +2743,7 @@ exports.OcLinkedIdentities = OcLinkedIdentities;
 exports.OcSessionProvider = OcSessionProvider;
 exports.OcSignIn = OcSignIn;
 exports.OcSignInButton = OcSignInButton;
+exports.buildAddAccountUrl = buildAddAccountUrl;
 exports.buildSignInUrl = buildSignInUrl;
 exports.fetchOcLinkedIdentities = fetchOcLinkedIdentities;
 exports.handleSudoRequired = handleSudoRequired;