@oxy.so/contracts 4.15.0 → 4.17.0

package/dist/types/sessionStatus.d.ts

@@ -179,8 +179,8 @@ export declare const sessionStatusSchema: z.ZodObject<{
     openedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
     status: string;
-    purpose?: "device_sign_in" | "oauth_authorization" | undefined;
     expiresAt?: string | undefined;
+    purpose?: "device_sign_in" | "oauth_authorization" | undefined;
     sessionId?: string | null | undefined;
     userId?: string | null | undefined;
     publicKey?: string | null | undefined;
@@ -204,8 +204,8 @@ export declare const sessionStatusSchema: z.ZodObject<{
     openedAt?: string | null | undefined;
 }, {
     status: string;
-    purpose?: "device_sign_in" | "oauth_authorization" | undefined;
     expiresAt?: string | undefined;
+    purpose?: "device_sign_in" | "oauth_authorization" | undefined;
     sessionId?: string | null | undefined;
     userId?: string | null | undefined;
     publicKey?: string | null | undefined;

package/dist/types/signIn.d.ts

@@ -18,6 +18,11 @@
  *    one-use second-factor challenge instead of a session, and
  *    `POST /auth/signin/second-factor` takes the TOTP (or a backup code).
  *
+ * An email may hold several accounts (up to `EMAIL_ACCOUNTS_MAX`). Signing in
+ * with the email, once the code or the link proves it, answers the accounts to
+ * choose from when there are several, and `POST /auth/signin/email/choose`
+ * names one. A username always names one account.
+ *
  * `POST /auth/signup` creates an account from a username and an email confirmed
  * with `POST /auth/email/verify/{start,confirm}` (purpose `signup`).
  *
@@ -26,37 +31,8 @@
  */
 import { z } from 'zod';
 import type { LoginResult } from './deviceBoot';
-/** How long the link in a sign-in email can be opened. */
-export declare const EMAIL_SIGNIN_LINK_TTL_MS: number;
-/** How long a second-factor challenge can be answered. */
-export declare const SIGNIN_SECOND_FACTOR_TTL_MS: number;
-/** Wrong second-factor codes one challenge accepts. */
-export declare const SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS = 5;
-/** Shortest password Oxy accepts when one is set. */
-export declare const PASSWORD_MIN_LENGTH = 10;
-/** Longest password Oxy accepts (characters). */
-export declare const PASSWORD_MAX_LENGTH = 256;
-/** Digits in an authenticator code. */
-export declare const TOTP_DIGITS = 6;
-/** Seconds each authenticator code lasts. */
-export declare const TOTP_PERIOD_SECONDS = 30;
-/** Backup codes issued when an authenticator is enabled or they are regenerated. */
-export declare const TOTP_BACKUP_CODE_COUNT = 10;
-/**
- * The long sign-in code: ten characters of Crockford base32 without the
- * look-alikes (no 0, O, 1, I, L, U), shown as `XXXXX-XXXXX`. An account whose
- * sign-in codes were guessed at too often today (the per-account ceiling) is
- * sent this instead of 6 digits for the rest of the day, so its owner can still
- * type a code while guessing one is infeasible.
- */
-export declare const EMAIL_SIGNIN_LONG_CODE_ALPHABET = "23456789ABCDEFGHJKMNPQRSTVWXYZ";
-export declare const EMAIL_SIGNIN_LONG_CODE_LENGTH = 10;
-/**
- * Normalise a typed sign-in code: 6 digits stay as they are; a long code is
- * upper-cased with its dash and spaces removed. Anything else is returned
- * trimmed (and will simply be wrong).
- */
-export declare function normalizeEmailSignInCode(code: string): string;
+export { EMAIL_SIGNIN_LINK_TTL_MS, SIGNIN_SECOND_FACTOR_TTL_MS, SIGNIN_SECOND_FACTOR_MAX_ATTEMPTS, PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH, TOTP_DIGITS, TOTP_PERIOD_SECONDS, TOTP_BACKUP_CODE_COUNT, EMAIL_SIGNIN_LONG_CODE_ALPHABET, EMAIL_SIGNIN_LONG_CODE_LENGTH, normalizeEmailSignInCode, EMAIL_SIGNIN_CHOICE_TTL_MS, EMAIL_ACCOUNTS_MAX, isSecondFactorRequired, isEmailSignInChooseAccount, REAUTH_ACTIONS, SIGN_IN_ERROR_CODES, } from './client/signIn';
+export type { ReauthAction, SignInErrorCode } from './client/signIn';
 /** A username or an email. */
 export declare const signInIdentifierSchema: z.ZodString;
 /** A password as typed. Its policy applies only when one is set. */
@@ -247,8 +223,8 @@ export declare const passwordSignInRequestSchema: z.ZodObject<{
     identifier: z.ZodString;
     password: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    identifier: string;
     password: string;
+    identifier: string;
     device?: {
         deviceId: string;
         deviceSecret: string;
@@ -256,8 +232,8 @@ export declare const passwordSignInRequestSchema: z.ZodObject<{
     deviceName?: string | undefined;
     deviceFingerprint?: string | undefined;
 }, {
-    identifier: string;
     password: string;
+    identifier: string;
     device?: {
         deviceId: string;
         deviceSecret: string;
@@ -359,14 +335,71 @@ export interface EmailSignInPending {
 export declare const emailSignInPendingSchema: z.ZodType<EmailSignInPending>;
 /** What a first factor answers: a session, or the second-factor step. */
 export type SignInStepResult = LoginResult | SecondFactorRequired;
-/** Narrow a {@link SignInStepResult}. */
-export declare function isSecondFactorRequired(result: SignInStepResult | EmailSignInPending): result is SecondFactorRequired;
+/** One account an email holds, as the choice after proving it shows it. */
+export interface EmailSignInAccountOption {
+    id: string;
+    username?: string;
+    /** The account's own display name; absent → show the handle. */
+    displayName?: string;
+    /** Asset id of the avatar. */
+    avatar?: string;
+}
+export declare const emailSignInAccountOptionSchema: z.ZodType<EmailSignInAccountOption>;
 /**
- * What a re-verification email code confirms. The code is bound to it: a code
- * asked for one change never authorises another, and the email names it.
+ * The email was signed in with, and it holds several accounts: the person
+ * chooses one (`POST /auth/signin/email/choose`) before `expiresAt`. Only the
+ * holder of the request's `requestSecret` ever sees this, after the code or
+ * the link proved the mailbox; a sign-in by username names one account and
+ * never asks.
  */
-export declare const REAUTH_ACTIONS: readonly ["change_password", "totp", "link_commons", "delete_account", "credentials_manage"];
-export type ReauthAction = (typeof REAUTH_ACTIONS)[number];
+export interface EmailSignInChooseAccount {
+    chooseAccount: true;
+    accounts: EmailSignInAccountOption[];
+    /** Unix milliseconds. */
+    expiresAt: number;
+}
+export declare const emailSignInChooseAccountSchema: z.ZodType<EmailSignInChooseAccount>;
+/** What proving an email answers: a session, the second-factor step, or the account choice. */
+export type EmailSignInStepResult = SignInStepResult | EmailSignInChooseAccount;
+/** `POST /auth/signin/email/choose` — the account, from those {@link EmailSignInChooseAccount} listed. */
+export declare const emailSignInChooseRequestSchema: z.ZodObject<{
+    deviceName: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    device: z.ZodOptional<z.ZodObject<{
+        deviceId: z.ZodString;
+        deviceSecret: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        deviceId: string;
+        deviceSecret: string;
+    }, {
+        deviceId: string;
+        deviceSecret: string;
+    }>>;
+    requestId: z.ZodString;
+    requestSecret: z.ZodString;
+    userId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    userId: string;
+    requestId: string;
+    requestSecret: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}, {
+    userId: string;
+    requestId: string;
+    requestSecret: string;
+    device?: {
+        deviceId: string;
+        deviceSecret: string;
+    } | undefined;
+    deviceName?: string | undefined;
+    deviceFingerprint?: string | undefined;
+}>;
+export type EmailSignInChooseRequest = z.infer<typeof emailSignInChooseRequestSchema>;
 /** `POST /users/me/reauth/email` */
 export declare const reauthEmailStartRequestSchema: z.ZodObject<{
     action: z.ZodEnum<["change_password", "totp", "link_commons", "delete_account", "credentials_manage"]>;
@@ -589,6 +622,7 @@ export declare const totpConfirmRequestSchema: z.ZodObject<{
         totpCode?: string | undefined;
     }>;
 }, "strict", z.ZodTypeAny, {
+    code: string;
     reauth: {
         password?: string | undefined;
         emailCode?: {
@@ -597,8 +631,8 @@ export declare const totpConfirmRequestSchema: z.ZodObject<{
         } | undefined;
         totpCode?: string | undefined;
     };
-    code: string;
 }, {
+    code: string;
     reauth: {
         password?: string | undefined;
         emailCode?: {
@@ -607,7 +641,6 @@ export declare const totpConfirmRequestSchema: z.ZodObject<{
         } | undefined;
         totpCode?: string | undefined;
     };
-    code: string;
 }>;
 export type TotpConfirmRequest = z.infer<typeof totpConfirmRequestSchema>;
 /** `POST /users/me/totp/disable` and `POST /users/me/totp/backup-codes` */
@@ -680,38 +713,3 @@ export interface TotpBackupCodesResponse {
     backupCodes: string[];
 }
 export declare const totpBackupCodesResponseSchema: z.ZodType<TotpBackupCodesResponse>;
-/**
- * Stable error codes (`error.code` in the API error body). Clients map these
- * through their localization, never the English message.
- */
-export declare const SIGN_IN_ERROR_CODES: {
-    /** Wrong identifier or password — never says which. */
-    readonly invalidCredentials: "SIGNIN_INVALID_CREDENTIALS";
-    /** The request is unknown, expired, spent, or its secret is wrong. */
-    readonly requestInvalid: "SIGNIN_REQUEST_INVALID";
-    /** The link is unknown, expired or already used. */
-    readonly linkInvalid: "SIGNIN_LINK_INVALID";
-    /** The link was opened in another browser: type the code in the app instead. */
-    readonly linkOtherDevice: "SIGNIN_LINK_OTHER_DEVICE";
-    /** The second-factor challenge or its code is wrong, expired or spent. */
-    readonly secondFactorInvalid: "SECOND_FACTOR_INVALID";
-    /** Too many failures for this account: wait and try again. */
-    readonly locked: "SIGNIN_LOCKED";
-    /** The step needs a fresh proof (`reauth`). */
-    readonly reauthRequired: "REAUTH_REQUIRED";
-    /** The fresh proof was wrong. */
-    readonly reauthInvalid: "REAUTH_INVALID";
-    /** The account has an authenticator: the proof must carry its code. */
-    readonly totpRequired: "TOTP_REQUIRED";
-    /** Enrolling or confirming an authenticator that is already on. */
-    readonly totpAlreadyEnabled: "TOTP_ALREADY_ENABLED";
-    /** Disabling, confirming or regenerating codes with no authenticator (or no pending one). */
-    readonly totpNotEnabled: "TOTP_NOT_ENABLED";
-    /** The code the authenticator showed at enrolment is wrong. */
-    readonly totpCodeInvalid: "TOTP_CODE_INVALID";
-    /** Only official Oxy apps and auth.oxy.so may sign people in here. */
-    readonly originNotAllowed: "SIGNIN_ORIGIN_NOT_ALLOWED";
-    /** The username is taken. */
-    readonly usernameTaken: "USERNAME_TAKEN";
-};
-export type SignInErrorCode = (typeof SIGN_IN_ERROR_CODES)[keyof typeof SIGN_IN_ERROR_CODES];