@orangecheck/auth-client 2.15.0 → 2.17.0

package/dist/index.mjs

@@ -22,6 +22,11 @@ function buildSignInUrl(cfg, returnTo) {
   u.searchParams.set("return_to", returnTo);
   return u.toString();
 }
+function buildAddAccountUrl(cfg, returnTo) {
+  const u = new URL(buildSignInUrl(cfg, returnTo));
+  u.searchParams.set("add", "1");
+  return u.toString();
+}
 var SessionContext = React3.createContext(null);
 function normalizeDisplayIdentity(raw, didOc) {
   const di = raw.display_identity ?? raw.displayIdentity;
@@ -30,6 +35,19 @@ function normalizeDisplayIdentity(raw, didOc) {
   }
   return { kind: "did", value: didOc };
 }
+function normalizeRosterEntry(raw) {
+  const didOc = raw.did_oc ?? raw.didOc;
+  if (!didOc) return null;
+  const di = raw.display_identity ?? raw.displayIdentity;
+  const displayIdentity = di && typeof di === "object" && typeof di.value === "string" && di.value.length > 0 && typeof di.kind === "string" && DISPLAY_IDENTITY_KINDS.includes(di.kind) ? { kind: di.kind, value: di.value } : { kind: "did", value: didOc };
+  return {
+    didOc,
+    displayName: raw.display_name ?? raw.displayName ?? null,
+    primaryBtc: raw.primary_btc ?? raw.primaryBtc ?? null,
+    displayIdentity,
+    lastSeenAt: raw.last_seen_at ?? raw.lastSeenAt ?? null
+  };
+}
 function normalizeAccount(raw) {
   if (!raw) return null;
   const didOc = raw.did_oc ?? raw.didOc;
@@ -55,6 +73,7 @@ function OcSessionProvider({
 }) {
   const cfg = React3.useMemo(() => resolveConfig(config), [config]);
   const [account, setAccount] = React3.useState(null);
+  const [roster, setRoster] = React3.useState([]);
   const [status, setStatus] = React3.useState("loading");
   const [error, setError] = React3.useState(null);
   const refresh = React3.useCallback(async () => {
@@ -67,6 +86,7 @@ function OcSessionProvider({
       });
       if (res.status === 401) {
         setAccount(null);
+        setRoster([]);
         setStatus("anonymous");
         setError(null);
         return;
@@ -78,7 +98,9 @@ function OcSessionProvider({
       }
       const body = await res.json();
       const acct = normalizeAccount(body.account);
+      const rosterEntries = Array.isArray(body.roster) ? body.roster.map(normalizeRosterEntry).filter((r) => r !== null) : [];
       setAccount(acct);
+      setRoster(rosterEntries);
       setStatus(acct ? "authenticated" : "anonymous");
       setError(null);
     } catch (err) {
@@ -89,23 +111,63 @@ function OcSessionProvider({
   React3.useEffect(() => {
     void refresh();
   }, [refresh]);
-  const signOut = React3.useCallback(async () => {
-    try {
-      await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
+  const signOut = React3.useCallback(
+    async (opts) => {
+      const scope = opts?.scope ?? "all";
+      try {
+        const url = new URL(`${cfg.authOrigin}${cfg.logoutPath}`);
+        if (scope === "current") url.searchParams.set("scope", "current");
+        const res = await fetch(url.toString(), {
+          method: "POST",
+          credentials: "include",
+          // `keepalive` lets the logout round-trip complete even if
+          // the caller hard-navigates away in the same tick (e.g.
+          // `<OcAccountMenu>` redirects home immediately on sign-out).
+          // Without it the in-flight request is cancelled on unload
+          // and the `.ochk.io` cookie may never get cleared.
+          keepalive: true
+        });
+        if (scope === "current" && res.ok) {
+          await refresh();
+          return;
+        }
+      } catch {
+      }
+      setAccount(null);
+      setRoster([]);
+      setStatus("anonymous");
+    },
+    [cfg.authOrigin, cfg.logoutPath, refresh]
+  );
+  const switchAccount = React3.useCallback(
+    async (didOc) => {
+      if (typeof window === "undefined") return;
+      const res = await fetch(`${cfg.authOrigin}/api/auth/switch`, {
         method: "POST",
         credentials: "include",
-        // `keepalive` lets the logout round-trip complete even if
-        // the caller hard-navigates away in the same tick (e.g.
-        // `<OcAccountMenu>` redirects home immediately on sign-out).
-        // Without it the in-flight request is cancelled on unload
-        // and the `.ochk.io` cookie may never get cleared.
-        keepalive: true
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ did_oc: didOc })
       });
-    } catch {
-    }
-    setAccount(null);
-    setStatus("anonymous");
-  }, [cfg.authOrigin, cfg.logoutPath]);
+      if (!res.ok) {
+        let reason = `http_${res.status}`;
+        try {
+          const body = await res.json();
+          if (body.reason) reason = body.reason;
+        } catch {
+        }
+        throw new Error(`[@orangecheck/auth-client] switchAccount failed: ${reason}`);
+      }
+      await refresh();
+    },
+    [cfg.authOrigin, refresh]
+  );
+  const addAccountUrl = React3.useCallback(
+    (returnTo) => {
+      const rt = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
+      return buildAddAccountUrl(cfg, rt);
+    },
+    [cfg]
+  );
   const setDisplayIdentity = React3.useCallback(
     async (kind) => {
       if (typeof window === "undefined") return;
@@ -133,13 +195,28 @@ function OcSessionProvider({
     return {
       status,
       account,
+      roster,
       error,
       refresh,
       signOut,
+      switchAccount,
+      addAccountUrl,
       setDisplayIdentity,
       signInUrl: buildSignInUrl(cfg, returnTo)
     };
-  }, [status, account, error, refresh, signOut, setDisplayIdentity, cfg, defaultReturnTo]);
+  }, [
+    status,
+    account,
+    roster,
+    error,
+    refresh,
+    signOut,
+    switchAccount,
+    addAccountUrl,
+    setDisplayIdentity,
+    cfg,
+    defaultReturnTo
+  ]);
   return /* @__PURE__ */ jsx(SessionContext.Provider, { value, children });
 }
 function useOcSession() {
@@ -1666,6 +1743,7 @@ function OcSignIn({
   onSuccess,
   resolveReturnTo,
   linkPrompt = true,
+  add: addProp,
   authOrigin = "https://ochk.io",
   initialPath = "wallet",
   paths,
@@ -1674,6 +1752,15 @@ function OcSignIn({
   const walletEnabled = paths?.wallet ?? true;
   const emailEnabled = paths?.email ?? true;
   const safeReturn = safeReturnTo(returnTo);
+  const [addMode, setAddMode] = React3.useState(Boolean(addProp));
+  React3.useEffect(() => {
+    if (typeof window === "undefined") return;
+    if (addProp !== void 0) {
+      setAddMode(Boolean(addProp));
+      return;
+    }
+    setAddMode(new URLSearchParams(window.location.search).get("add") === "1");
+  }, [addProp]);
   const [path, setPath] = React3.useState(initialPath);
   const [signedIn, setSignedIn] = React3.useState(null);
   const [linkAlso, setLinkAlso] = React3.useState(false);
@@ -1816,6 +1903,7 @@ function OcSignIn({
         {
           authOrigin,
           audience,
+          add: addMode,
           onSuccess: (a, t) => void handleSuccess(a, t, "wallet")
         }
       ),
@@ -1823,6 +1911,7 @@ function OcSignIn({
         EmailFlow,
         {
           authOrigin,
+          add: addMode,
           onSuccess: (a, t) => void handleSuccess(a, t, "email")
         }
       )
@@ -1878,6 +1967,23 @@ function SigninTab({
     }
   );
 }
+function ProviderIcon({ id }) {
+  const common = {
+    width: 14,
+    height: 14,
+    viewBox: "0 0 24 24",
+    fill: "currentColor",
+    "aria-hidden": true,
+    style: { flex: "0 0 auto" }
+  };
+  if (id === "google") {
+    return /* @__PURE__ */ jsx("svg", { ...common, children: /* @__PURE__ */ jsx("path", { d: "M12.48 10.92v3.28h7.84c-.24 1.84-.853 3.187-1.787 4.133-1.147 1.147-2.933 2.4-6.053 2.4-4.827 0-8.6-3.893-8.6-8.72s3.773-8.72 8.6-8.72c2.6 0 4.507 1.027 5.907 2.347l2.307-2.307C18.747 1.44 16.133 0 12.48 0 5.867 0 .307 5.387.307 12s5.56 12 12.173 12c3.573 0 6.267-1.173 8.373-3.36 2.16-2.16 2.84-5.213 2.84-7.667 0-.76-.053-1.467-.173-2.053H12.48z" }) });
+  }
+  if (id === "github") {
+    return /* @__PURE__ */ jsx("svg", { ...common, children: /* @__PURE__ */ jsx("path", { d: "M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12" }) });
+  }
+  return null;
+}
 function ProviderSignIn({
   authOrigin,
   returnTo
@@ -1920,7 +2026,7 @@ function ProviderSignIn({
         ]
       }
     ),
-    providers.map((p, i) => /* @__PURE__ */ jsx(
+    providers.map((p, i) => /* @__PURE__ */ jsxs(
       "a",
       {
         href: `${authOrigin}/api/auth/${p.id}/start?return_to=${encodeURIComponent(
@@ -1928,12 +2034,14 @@ function ProviderSignIn({
         )}`,
         "data-oc-signin-provider": p.id,
         style: {
-          display: "block",
+          display: "flex",
+          alignItems: "center",
+          justifyContent: "center",
+          gap: 10,
           boxSizing: "border-box",
           width: "100%",
           marginTop: i === 0 ? 0 : 8,
           padding: "0.6rem 0.875rem",
-          textAlign: "center",
           border: "1px solid var(--border, #27272a)",
           borderRadius: 6,
           background: "transparent",
@@ -1942,13 +2050,16 @@ function ProviderSignIn({
           fontSize: 12,
           textDecoration: "none"
         },
-        children: p.label
+        children: [
+          /* @__PURE__ */ jsx(ProviderIcon, { id: p.id }),
+          /* @__PURE__ */ jsx("span", { children: p.label })
+        ]
       },
       p.id
     ))
   ] });
 }
-function WalletFlow({ authOrigin, audience, onSuccess }) {
+function WalletFlow({ authOrigin, audience, add, onSuccess }) {
   const [address, setAddress] = React3.useState("");
   const [error, setError] = React3.useState(null);
   const [submitting, setSubmitting] = React3.useState(false);
@@ -1996,7 +2107,12 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
           scheme: "bip322",
           expectedNonce: challenge.nonce,
           expectedAudience: audience,
-          expectedPurpose: "login"
+          expectedPurpose: "login",
+          // Multi-account add-mode · the auth host preserves
+          // the current roster_id when set, instead of minting
+          // a fresh one. Hosts that haven't deployed the
+          // multi-account migration silently ignore the field.
+          ...add ? { add: true } : {}
         })
       });
       const json = await res.json();
@@ -2047,7 +2163,7 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
     /* @__PURE__ */ jsx(Hint, { children: "Detection picks the first installed BIP-322-capable extension. Address is the one your wallet will sign for." })
   ] });
 }
-function EmailFlow({ authOrigin, onSuccess }) {
+function EmailFlow({ authOrigin, add, onSuccess }) {
   const [stage, setStage] = React3.useState("enter");
   const [email, setEmail] = React3.useState("");
   const [emailError, setEmailError] = React3.useState(null);
@@ -2098,7 +2214,13 @@ function EmailFlow({ authOrigin, onSuccess }) {
         method: "POST",
         credentials: "include",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email, code, token })
+        body: JSON.stringify({
+          email,
+          code,
+          token,
+          // Multi-account add-mode · see WalletFlow.
+          ...add ? { add: true } : {}
+        })
       });
       const json = await res.json();
       if (!res.ok || !("ok" in json) || !json.ok || !json.account) {
@@ -2590,6 +2712,6 @@ function handleSudoRequired(body, args = {}) {
   return false;
 }
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, buildAddAccountUrl, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map