@palbase/web 6.0.0 → 7.1.0

package/dist/{chunk-OWLTZG2V.js → chunk-ZC6Q3GPX.js}

@@ -1,6 +1,6 @@
 import {
   BackendError
-} from "./chunk-BNAGRUIQ.js";
+} from "./chunk-ACCJV6FV.js";
 
 // src/next/shared.ts
 var nextServerModule;
@@ -21,4 +21,4 @@ async function importNextServer(caller) {
 export {
   importNextServer
 };
-//# sourceMappingURL=chunk-OWLTZG2V.js.map
+//# sourceMappingURL=chunk-ZC6Q3GPX.js.map

package/dist/index.cjs

@@ -449,6 +449,162 @@ function asWireAuthResult(raw) {
   return raw;
 }
 
+// src/passkey.ts
+function base64UrlToBytes(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded.padEnd(padded.length + (4 - padded.length % 4) % 4, "="));
+  const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function bytesToBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function requireString(source, key) {
+  const value = source[key];
+  if (typeof value !== "string" || value === "") {
+    throw new Error(`passkey options are missing ${key}`);
+  }
+  return value;
+}
+function toCreationOptions(publicKey) {
+  const rp = publicKey.rp;
+  const user = publicKey.user;
+  if (!user?.id) {
+    throw new Error("passkey options carry no user id \u2014 the credential would be unusable");
+  }
+  const excludeCredentials = Array.isArray(publicKey.excludeCredentials) ? publicKey.excludeCredentials.map((c) => ({
+    id: base64UrlToBytes(c.id),
+    type: "public-key"
+  })) : void 0;
+  return {
+    challenge: base64UrlToBytes(requireString(publicKey, "challenge")),
+    rp: { id: rp?.id, name: rp?.name ?? rp?.id ?? "" },
+    user: {
+      id: base64UrlToBytes(user.id),
+      name: user.name ?? "",
+      displayName: user.displayName ?? user.name ?? ""
+    },
+    pubKeyCredParams: publicKey.pubKeyCredParams ?? [],
+    authenticatorSelection: publicKey.authenticatorSelection,
+    timeout: publicKey.timeout,
+    attestation: publicKey.attestation,
+    excludeCredentials
+  };
+}
+function toRequestOptions(publicKey) {
+  const allowCredentials = Array.isArray(publicKey.allowCredentials) ? publicKey.allowCredentials.map((c) => ({
+    id: base64UrlToBytes(c.id),
+    type: "public-key"
+  })) : void 0;
+  return {
+    challenge: base64UrlToBytes(requireString(publicKey, "challenge")),
+    rpId: publicKey.rpId,
+    timeout: publicKey.timeout,
+    userVerification: publicKey.userVerification,
+    allowCredentials
+  };
+}
+function attestationToJSON(credential) {
+  const response = credential.response;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+      attestationObject: bytesToBase64Url(response.attestationObject)
+    }
+  };
+}
+function assertionToJSON(credential) {
+  const response = credential.response;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+      authenticatorData: bytesToBase64Url(response.authenticatorData),
+      signature: bytesToBase64Url(response.signature),
+      // The user handle is how palauth resolves WHO signed in on a discoverable
+      // login — there is no identifier in the request.
+      userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null
+    }
+  };
+}
+function isPasskeySupported() {
+  return typeof window !== "undefined" && typeof window.PublicKeyCredential === "function" && typeof navigator !== "undefined" && navigator.credentials !== void 0;
+}
+function ensureSupported() {
+  if (!isPasskeySupported()) {
+    throw new Error("This browser cannot use passkeys \u2014 offer a password or e-mail sign-in");
+  }
+}
+async function createCredential(publicKey) {
+  const credential = await navigator.credentials.create({
+    publicKey: toCreationOptions(publicKey)
+  });
+  if (credential === null) {
+    throw new Error("the browser returned no credential");
+  }
+  return credential;
+}
+async function getCredential(publicKey) {
+  const credential = await navigator.credentials.get({
+    publicKey: toRequestOptions(publicKey)
+  });
+  if (credential === null) {
+    throw new Error("the browser returned no credential");
+  }
+  return credential;
+}
+async function passkeySignIn(rt) {
+  ensureSupported();
+  const envelope = await palbeRequest(rt, "POST", "/auth/webauthn/login/begin", {
+    body: {}
+  });
+  const credential = await getCredential(envelope.options.publicKey);
+  const raw = await palbeRequest(rt, "POST", "/auth/webauthn/login/finish", {
+    body: assertionToJSON(credential)
+  });
+  const result = asWireAuthResult(raw);
+  if (result === null) {
+    throw new Error("passkey sign-in returned an unusable session");
+  }
+  return result;
+}
+async function passkeySignUp(rt, email, displayName) {
+  ensureSupported();
+  const begun = await palbeRequest(rt, "POST", "/auth/webauthn/signup/begin", {
+    body: { email, user_name: displayName }
+  });
+  const credential = await createCredential(begun.options.publicKey);
+  await palbeRequest(
+    rt,
+    "POST",
+    `/auth/webauthn/signup/finish?user_id=${encodeURIComponent(begun.user_id)}`,
+    { body: attestationToJSON(credential) }
+  );
+  return await passkeySignIn(rt);
+}
+async function passkeyRegister(rt, name) {
+  ensureSupported();
+  const envelope = await palbeRequest(
+    rt,
+    "POST",
+    "/auth/webauthn/register/begin",
+    { body: { name } }
+  );
+  const credential = await createCredential(envelope.options.publicKey);
+  await palbeRequest(rt, "POST", "/auth/webauthn/register/finish", {
+    body: attestationToJSON(credential)
+  });
+}
+
 // src/auth-facade.ts
 function mapWireUser(raw) {
   return {
@@ -585,6 +741,23 @@ var PalbeAuth = class {
     const raw = await palbeRequest(this.rt, "GET", "/auth/user");
     return mapWireUser(raw);
   }
+  /**
+   * Which credentials this account actually has.
+   *
+   * An account reached through Google has no password, so showing it a
+   * "current password" field gives the user something they can never fill —
+   * and `getUser()` cannot tell you, because GET /auth/user carries no
+   * credential information. Read this before rendering any re-auth or
+   * change-password form.
+   */
+  async getSignInMethods() {
+    const raw = await palbeRequest(this.rt, "GET", "/auth/me");
+    return {
+      password: raw.has_password,
+      mfa: raw.has_mfa,
+      providers: raw.providers ?? null
+    };
+  }
   async refreshUser() {
     const user = await this.getUser();
     const changed = !usersEqual(user, this.cachedUser);
@@ -786,6 +959,39 @@ var PalbeAuth = class {
       return this.adopt(data);
     });
   }
+  /**
+   * Sign in with a passkey stored for this Environment. No identifier is typed:
+   * the browser lists the accounts it holds and the user picks one.
+   *
+   * Throws when the browser cannot run a ceremony — check `passkeysSupported`
+   * first and keep a password or e-mail path beside the button.
+   */
+  async signInWithPasskey() {
+    return this.withSigningIn(async () => this.adoptWire(await passkeySignIn(this.rt)));
+  }
+  /**
+   * Create an account whose only credential is a passkey — the e-mail is the
+   * identifier, the passkey is the credential, and no password ever exists.
+   */
+  async signUpWithPasskey(email, displayName) {
+    return this.withSigningIn(
+      async () => this.adoptWire(await passkeySignUp(this.rt, email, displayName))
+    );
+  }
+  /**
+   * Add a passkey to the signed-in account, so the next sign-in is one tap.
+   *
+   * Rejects with a 403 `reauthentication_required` when the session is not
+   * recent: a passkey outlives a password reset, so enrolling one takes more
+   * than a valid session.
+   */
+  async registerPasskey(name) {
+    await passkeyRegister(this.rt, name);
+  }
+  /** Whether this browser can run a passkey ceremony at all. */
+  get passkeysSupported() {
+    return isPasskeySupported();
+  }
   async signInWithOAuth(params) {
     const { redirect = true, ...opts } = params;
     const { url } = unwrap(await this.rt.authClient.getOAuthURL(opts));
@@ -7685,7 +7891,7 @@ function localStorageSessionStorage(key = DEFAULT_KEY) {
 }
 
 // src/version.ts
-var VERSION = "6.0.0";
+var VERSION = "7.1.0";
 
 // src/internal.ts
 function getRuntime() {