@orangecheck/auth-client 2.20.0 → 2.22.0

package/dist/index.d.mts

@@ -156,6 +156,7 @@ declare function OcLinkedIdentities({ authOrigin, className, onChange, }: OcLink
 
 declare const TAB_SESSION_HEADER = "x-oc-tab-session";
 declare const TAB_SESSION_STORAGE_KEY = "oc_tab_session";
+declare const TAB_ACCOUNT_HINT_KEY = "oc-as";
 declare const TAB_ADOPT_HASH = "#oc-adopt";
 interface OcTabSession {
     token: string;
@@ -167,6 +168,8 @@ declare function clearTabSession(): void;
 declare function tabSessionHeader(): Record<string, string>;
 declare function installTabFetchInterceptor(authOrigin: string): () => void;
 declare function consumeTabAdoptMarker(): boolean;
+declare function installTabLinkDecorator(authOrigin: string): () => void;
+declare function consumeTabAccountHint(authOrigin: string): Promise<string | null>;
 
 interface WebAuthnCredentialPublic {
     id: string;
@@ -250,4 +253,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };

package/dist/index.d.ts

@@ -156,6 +156,7 @@ declare function OcLinkedIdentities({ authOrigin, className, onChange, }: OcLink
 
 declare const TAB_SESSION_HEADER = "x-oc-tab-session";
 declare const TAB_SESSION_STORAGE_KEY = "oc_tab_session";
+declare const TAB_ACCOUNT_HINT_KEY = "oc-as";
 declare const TAB_ADOPT_HASH = "#oc-adopt";
 interface OcTabSession {
     token: string;
@@ -167,6 +168,8 @@ declare function clearTabSession(): void;
 declare function tabSessionHeader(): Record<string, string>;
 declare function installTabFetchInterceptor(authOrigin: string): () => void;
 declare function consumeTabAdoptMarker(): boolean;
+declare function installTabLinkDecorator(authOrigin: string): () => void;
+declare function consumeTabAccountHint(authOrigin: string): Promise<string | null>;
 
 interface WebAuthnCredentialPublic {
     id: string;
@@ -250,4 +253,4 @@ declare function handleSudoRequired(body: {
     returnTo?: string;
 }): boolean;
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, type DisplayIdentity, type DisplayIdentityKind, type OcAccount, OcAccountChip, type OcAccountChipProps, OcAccountPill, type OcAccountPillProps, type OcAccountSummary, OcAddressInput, type OcAddressInputProps, type OcAuthConfig, OcLinkedIdentities, type OcLinkedIdentitiesProps, type OcLinkedIdentity, OcSessionProvider, type OcSessionState, type OcSessionStatus, OcSignIn, OcSignInButton, type OcSignInButtonProps, type OcSignInProps, type OcSignOutScope, type OcTabSession, type RedirectToSudoArgs, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, type UseOcAddressSuggestionOptions, type UseOcAddressSuggestionReturn, type UseStepUpAuthReturn, type UseWebAuthnListReturn, type UseWebAuthnRegisterReturn, type WebAuthnAssertionStatus, type WebAuthnCredentialPublic, type WebAuthnListStatus, type WebAuthnRegisterResult, type WebAuthnRegisterStatus, type WebAuthnRemoveResult, type WebAuthnRenameResult, type WebAuthnStepUpResult, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };

package/dist/index.js

@@ -53,6 +53,7 @@ function buildAddAccountUrl(cfg, returnTo) {
 // src/tab-session.ts
 var TAB_SESSION_HEADER = "x-oc-tab-session";
 var TAB_SESSION_STORAGE_KEY = "oc_tab_session";
+var TAB_ACCOUNT_HINT_KEY = "oc-as";
 var TAB_ADOPT_HASH = "#oc-adopt";
 function readTabSession() {
   if (typeof window === "undefined") return null;
@@ -134,6 +135,92 @@ function consumeTabAdoptMarker() {
   }
   return true;
 }
+var OC_AS_HINT_RE = /^oc-as=(did:oc:[0-9a-f]{32})$/;
+function familyApex(authOrigin) {
+  try {
+    return new URL(authOrigin).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function isFamilyUrl(u, authOrigin) {
+  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
+  if (typeof window !== "undefined" && u.origin === window.location.origin) return true;
+  const apex = familyApex(authOrigin);
+  if (!apex) return false;
+  const host = u.hostname.toLowerCase();
+  return host === apex || host.endsWith(`.${apex}`);
+}
+function opensWithoutTabPin(e, anchor, dest) {
+  if (typeof window !== "undefined" && dest.origin !== window.location.origin) return true;
+  const target = (anchor.getAttribute("target") ?? "").toLowerCase();
+  return e.button === 1 || // middle-click
+  e.metaKey || e.ctrlKey || e.shiftKey || target === "_blank";
+}
+function installTabLinkDecorator(authOrigin) {
+  if (typeof window === "undefined" || typeof document === "undefined") return () => {
+  };
+  const onActivate = (e) => {
+    try {
+      const pin = readTabSession();
+      if (!pin) return;
+      const target = e.target;
+      if (!(target instanceof Element)) return;
+      const anchor = target.closest("a[href]");
+      if (!anchor || anchor.hasAttribute("download")) return;
+      const raw = anchor.getAttribute("href");
+      if (!raw || raw.includes(`${TAB_ACCOUNT_HINT_KEY}=`)) return;
+      let dest;
+      try {
+        dest = new URL(anchor.href);
+      } catch {
+        return;
+      }
+      if (dest.hash) return;
+      if (!isFamilyUrl(dest, authOrigin)) return;
+      if (!opensWithoutTabPin(e, anchor, dest)) return;
+      anchor.setAttribute("href", `${raw}#${TAB_ACCOUNT_HINT_KEY}=${pin.didOc}`);
+    } catch {
+    }
+  };
+  window.addEventListener("click", onActivate, true);
+  window.addEventListener("auxclick", onActivate, true);
+  return () => {
+    window.removeEventListener("click", onActivate, true);
+    window.removeEventListener("auxclick", onActivate, true);
+  };
+}
+async function consumeTabAccountHint(authOrigin) {
+  if (typeof window === "undefined") return null;
+  const frag = window.location.hash.replace(/^#/, "");
+  const m = OC_AS_HINT_RE.exec(frag);
+  if (!m) return null;
+  const did = m[1];
+  try {
+    const url = new URL(window.location.href);
+    url.hash = "";
+    window.history.replaceState(window.history.state, "", url.toString());
+  } catch {
+  }
+  const existing = readTabSession();
+  if (existing && existing.didOc === did) return did;
+  try {
+    const res = await fetch(`${authOrigin}/api/auth/tab`, {
+      method: "POST",
+      credentials: "include",
+      headers: { Accept: "application/json", "Content-Type": "application/json" },
+      body: JSON.stringify({ did_oc: did })
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (body.ok && typeof body.token === "string" && body.account?.did_oc === did) {
+      writeTabSession({ token: body.token, didOc: did });
+      return did;
+    }
+  } catch {
+  }
+  return null;
+}
 var SessionContext = React3__namespace.createContext(null);
 function normalizeDisplayIdentity(raw, didOc) {
   const di = raw.display_identity ?? raw.displayIdentity;
@@ -277,10 +364,18 @@ function OcSessionProvider({
     }
   }, [cfg, pinThisTab]);
   React3__namespace.useEffect(() => {
+    let cancelled = false;
     consumeTabAdoptMarker();
-    void refresh();
-  }, [refresh]);
+    void (async () => {
+      await consumeTabAccountHint(cfg.authOrigin);
+      if (!cancelled) void refresh();
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [refresh, cfg.authOrigin]);
   React3__namespace.useEffect(() => installTabFetchInterceptor(cfg.authOrigin), [cfg.authOrigin]);
+  React3__namespace.useEffect(() => installTabLinkDecorator(cfg.authOrigin), [cfg.authOrigin]);
   const signOut = React3__namespace.useCallback(
     async (opts) => {
       const scope = opts?.scope ?? "all";
@@ -1063,7 +1158,8 @@ var DEFAULT_AUTH_ORIGIN = "https://ochk.io";
 async function fetchOcLinkedIdentities(opts) {
   const authOrigin = opts?.authOrigin ?? DEFAULT_AUTH_ORIGIN;
   const r = await fetch(`${authOrigin}/api/auth/identities`, {
-    credentials: "include"
+    credentials: "include",
+    headers: { ...tabSessionHeader() }
   });
   if (r.status === 401) return [];
   if (!r.ok) throw new Error(`identities fetch failed: http_${r.status}`);
@@ -1083,7 +1179,8 @@ function OcLinkedIdentities({
     setError(null);
     try {
       const r = await fetch(`${authOrigin}/api/auth/identities`, {
-        credentials: "include"
+        credentials: "include",
+        headers: { ...tabSessionHeader() }
       });
       if (!r.ok) {
         if (r.status === 401) {
@@ -3022,16 +3119,19 @@ exports.OcLinkedIdentities = OcLinkedIdentities;
 exports.OcSessionProvider = OcSessionProvider;
 exports.OcSignIn = OcSignIn;
 exports.OcSignInButton = OcSignInButton;
+exports.TAB_ACCOUNT_HINT_KEY = TAB_ACCOUNT_HINT_KEY;
 exports.TAB_ADOPT_HASH = TAB_ADOPT_HASH;
 exports.TAB_SESSION_HEADER = TAB_SESSION_HEADER;
 exports.TAB_SESSION_STORAGE_KEY = TAB_SESSION_STORAGE_KEY;
 exports.buildAddAccountUrl = buildAddAccountUrl;
 exports.buildSignInUrl = buildSignInUrl;
 exports.clearTabSession = clearTabSession;
+exports.consumeTabAccountHint = consumeTabAccountHint;
 exports.consumeTabAdoptMarker = consumeTabAdoptMarker;
 exports.fetchOcLinkedIdentities = fetchOcLinkedIdentities;
 exports.handleSudoRequired = handleSudoRequired;
 exports.installTabFetchInterceptor = installTabFetchInterceptor;
+exports.installTabLinkDecorator = installTabLinkDecorator;
 exports.readTabSession = readTabSession;
 exports.redirectToSudo = redirectToSudo;
 exports.tabSessionHeader = tabSessionHeader;