@orangecheck/auth-client 2.16.0 → 2.17.1

package/dist/index.mjs

@@ -22,6 +22,11 @@ function buildSignInUrl(cfg, returnTo) {
   u.searchParams.set("return_to", returnTo);
   return u.toString();
 }
+function buildAddAccountUrl(cfg, returnTo) {
+  const u = new URL(buildSignInUrl(cfg, returnTo));
+  u.searchParams.set("add", "1");
+  return u.toString();
+}
 var SessionContext = React3.createContext(null);
 function normalizeDisplayIdentity(raw, didOc) {
   const di = raw.display_identity ?? raw.displayIdentity;
@@ -30,6 +35,19 @@ function normalizeDisplayIdentity(raw, didOc) {
   }
   return { kind: "did", value: didOc };
 }
+function normalizeRosterEntry(raw) {
+  const didOc = raw.did_oc ?? raw.didOc;
+  if (!didOc) return null;
+  const di = raw.display_identity ?? raw.displayIdentity;
+  const displayIdentity = di && typeof di === "object" && typeof di.value === "string" && di.value.length > 0 && typeof di.kind === "string" && DISPLAY_IDENTITY_KINDS.includes(di.kind) ? { kind: di.kind, value: di.value } : { kind: "did", value: didOc };
+  return {
+    didOc,
+    displayName: raw.display_name ?? raw.displayName ?? null,
+    primaryBtc: raw.primary_btc ?? raw.primaryBtc ?? null,
+    displayIdentity,
+    lastSeenAt: raw.last_seen_at ?? raw.lastSeenAt ?? null
+  };
+}
 function normalizeAccount(raw) {
   if (!raw) return null;
   const didOc = raw.did_oc ?? raw.didOc;
@@ -55,6 +73,7 @@ function OcSessionProvider({
 }) {
   const cfg = React3.useMemo(() => resolveConfig(config), [config]);
   const [account, setAccount] = React3.useState(null);
+  const [roster, setRoster] = React3.useState([]);
   const [status, setStatus] = React3.useState("loading");
   const [error, setError] = React3.useState(null);
   const refresh = React3.useCallback(async () => {
@@ -67,6 +86,7 @@ function OcSessionProvider({
       });
       if (res.status === 401) {
         setAccount(null);
+        setRoster([]);
         setStatus("anonymous");
         setError(null);
         return;
@@ -78,7 +98,9 @@ function OcSessionProvider({
       }
       const body = await res.json();
       const acct = normalizeAccount(body.account);
+      const rosterEntries = Array.isArray(body.roster) ? body.roster.map(normalizeRosterEntry).filter((r) => r !== null) : [];
       setAccount(acct);
+      setRoster(rosterEntries);
       setStatus(acct ? "authenticated" : "anonymous");
       setError(null);
     } catch (err) {
@@ -89,23 +111,63 @@ function OcSessionProvider({
   React3.useEffect(() => {
     void refresh();
   }, [refresh]);
-  const signOut = React3.useCallback(async () => {
-    try {
-      await fetch(`${cfg.authOrigin}${cfg.logoutPath}`, {
+  const signOut = React3.useCallback(
+    async (opts) => {
+      const scope = opts?.scope ?? "all";
+      try {
+        const url = new URL(`${cfg.authOrigin}${cfg.logoutPath}`);
+        if (scope === "current") url.searchParams.set("scope", "current");
+        const res = await fetch(url.toString(), {
+          method: "POST",
+          credentials: "include",
+          // `keepalive` lets the logout round-trip complete even if
+          // the caller hard-navigates away in the same tick (e.g.
+          // `<OcAccountMenu>` redirects home immediately on sign-out).
+          // Without it the in-flight request is cancelled on unload
+          // and the `.ochk.io` cookie may never get cleared.
+          keepalive: true
+        });
+        if (scope === "current" && res.ok) {
+          await refresh();
+          return;
+        }
+      } catch {
+      }
+      setAccount(null);
+      setRoster([]);
+      setStatus("anonymous");
+    },
+    [cfg.authOrigin, cfg.logoutPath, refresh]
+  );
+  const switchAccount = React3.useCallback(
+    async (didOc) => {
+      if (typeof window === "undefined") return;
+      const res = await fetch(`${cfg.authOrigin}/api/auth/switch`, {
         method: "POST",
         credentials: "include",
-        // `keepalive` lets the logout round-trip complete even if
-        // the caller hard-navigates away in the same tick (e.g.
-        // `<OcAccountMenu>` redirects home immediately on sign-out).
-        // Without it the in-flight request is cancelled on unload
-        // and the `.ochk.io` cookie may never get cleared.
-        keepalive: true
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ did_oc: didOc })
       });
-    } catch {
-    }
-    setAccount(null);
-    setStatus("anonymous");
-  }, [cfg.authOrigin, cfg.logoutPath]);
+      if (!res.ok) {
+        let reason = `http_${res.status}`;
+        try {
+          const body = await res.json();
+          if (body.reason) reason = body.reason;
+        } catch {
+        }
+        throw new Error(`[@orangecheck/auth-client] switchAccount failed: ${reason}`);
+      }
+      await refresh();
+    },
+    [cfg.authOrigin, refresh]
+  );
+  const addAccountUrl = React3.useCallback(
+    (returnTo) => {
+      const rt = returnTo ?? (typeof window !== "undefined" ? window.location.href : void 0);
+      return buildAddAccountUrl(cfg, rt);
+    },
+    [cfg]
+  );
   const setDisplayIdentity = React3.useCallback(
     async (kind) => {
       if (typeof window === "undefined") return;
@@ -133,13 +195,28 @@ function OcSessionProvider({
     return {
       status,
       account,
+      roster,
       error,
       refresh,
       signOut,
+      switchAccount,
+      addAccountUrl,
       setDisplayIdentity,
       signInUrl: buildSignInUrl(cfg, returnTo)
     };
-  }, [status, account, error, refresh, signOut, setDisplayIdentity, cfg, defaultReturnTo]);
+  }, [
+    status,
+    account,
+    roster,
+    error,
+    refresh,
+    signOut,
+    switchAccount,
+    addAccountUrl,
+    setDisplayIdentity,
+    cfg,
+    defaultReturnTo
+  ]);
   return /* @__PURE__ */ jsx(SessionContext.Provider, { value, children });
 }
 function useOcSession() {
@@ -1666,6 +1743,7 @@ function OcSignIn({
   onSuccess,
   resolveReturnTo,
   linkPrompt = true,
+  add: addProp,
   authOrigin = "https://ochk.io",
   initialPath = "wallet",
   paths,
@@ -1674,6 +1752,15 @@ function OcSignIn({
   const walletEnabled = paths?.wallet ?? true;
   const emailEnabled = paths?.email ?? true;
   const safeReturn = safeReturnTo(returnTo);
+  const [addMode, setAddMode] = React3.useState(Boolean(addProp));
+  React3.useEffect(() => {
+    if (typeof window === "undefined") return;
+    if (addProp !== void 0) {
+      setAddMode(Boolean(addProp));
+      return;
+    }
+    setAddMode(new URLSearchParams(window.location.search).get("add") === "1");
+  }, [addProp]);
   const [path, setPath] = React3.useState(initialPath);
   const [signedIn, setSignedIn] = React3.useState(null);
   const [linkAlso, setLinkAlso] = React3.useState(false);
@@ -1785,6 +1872,41 @@ function OcSignIn({
         children: "That sign-in didn't complete. Please try again."
       }
     ),
+    addMode && /* @__PURE__ */ jsxs(
+      "div",
+      {
+        "data-oc-signin-add-mode": "",
+        style: {
+          marginBottom: 14,
+          padding: "0.6rem 0.75rem",
+          border: "1px solid var(--primary, #f97316)",
+          borderLeftWidth: 3,
+          borderRadius: 4,
+          background: "color-mix(in srgb, var(--primary, #f97316) 8%, transparent)",
+          color: "var(--foreground, #fafafa)",
+          fontFamily: "ui-monospace, SFMono-Regular, monospace",
+          fontSize: 11,
+          lineHeight: 1.6
+        },
+        children: [
+          /* @__PURE__ */ jsx(
+            "strong",
+            {
+              style: {
+                color: "var(--primary, #f97316)",
+                letterSpacing: "0.12em",
+                textTransform: "uppercase",
+                fontSize: 10,
+                display: "block",
+                marginBottom: 3
+              },
+              children: "\xA7 adding another account"
+            }
+          ),
+          "Your current OrangeCheck account stays signed in. The new account joins your browser's roster; you can switch between them anytime from the account menu."
+        ]
+      }
+    ),
     bothEnabled && /* @__PURE__ */ jsxs(
       "div",
       {
@@ -1816,6 +1938,7 @@ function OcSignIn({
         {
           authOrigin,
           audience,
+          add: addMode,
           onSuccess: (a, t) => void handleSuccess(a, t, "wallet")
         }
       ),
@@ -1823,6 +1946,7 @@ function OcSignIn({
         EmailFlow,
         {
           authOrigin,
+          add: addMode,
           onSuccess: (a, t) => void handleSuccess(a, t, "email")
         }
       )
@@ -1970,7 +2094,7 @@ function ProviderSignIn({
     ))
   ] });
 }
-function WalletFlow({ authOrigin, audience, onSuccess }) {
+function WalletFlow({ authOrigin, audience, add, onSuccess }) {
   const [address, setAddress] = React3.useState("");
   const [error, setError] = React3.useState(null);
   const [submitting, setSubmitting] = React3.useState(false);
@@ -2018,7 +2142,12 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
           scheme: "bip322",
           expectedNonce: challenge.nonce,
           expectedAudience: audience,
-          expectedPurpose: "login"
+          expectedPurpose: "login",
+          // Multi-account add-mode · the auth host preserves
+          // the current roster_id when set, instead of minting
+          // a fresh one. Hosts that haven't deployed the
+          // multi-account migration silently ignore the field.
+          ...add ? { add: true } : {}
         })
       });
       const json = await res.json();
@@ -2069,7 +2198,7 @@ function WalletFlow({ authOrigin, audience, onSuccess }) {
     /* @__PURE__ */ jsx(Hint, { children: "Detection picks the first installed BIP-322-capable extension. Address is the one your wallet will sign for." })
   ] });
 }
-function EmailFlow({ authOrigin, onSuccess }) {
+function EmailFlow({ authOrigin, add, onSuccess }) {
   const [stage, setStage] = React3.useState("enter");
   const [email, setEmail] = React3.useState("");
   const [emailError, setEmailError] = React3.useState(null);
@@ -2120,7 +2249,13 @@ function EmailFlow({ authOrigin, onSuccess }) {
         method: "POST",
         credentials: "include",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email, code, token })
+        body: JSON.stringify({
+          email,
+          code,
+          token,
+          // Multi-account add-mode · see WalletFlow.
+          ...add ? { add: true } : {}
+        })
       });
       const json = await res.json();
       if (!res.ok || !("ok" in json) || !json.ok || !json.account) {
@@ -2612,6 +2747,6 @@ function handleSudoRequired(body, args = {}) {
   return false;
 }
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, buildAddAccountUrl, buildSignInUrl, fetchOcLinkedIdentities, handleSudoRequired, redirectToSudo, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map