@palbase/web 6.0.0 → 7.1.0

package/dist/next/client.js

@@ -6,8 +6,8 @@ import {
 import {
   __configure,
   getRuntime
-} from "../chunk-KOJ4OAAR.js";
-import "../chunk-BNAGRUIQ.js";
+} from "../chunk-P6TWUWZC.js";
+import "../chunk-ACCJV6FV.js";
 import "../chunk-CFDU23TB.js";
 import "../chunk-PZ5AY32C.js";
 

package/dist/next/index.cjs

@@ -166,6 +166,27 @@ var PalbaseError = class extends Error {
     this.details = details;
   }
 };
+function detectPlatform() {
+  if (typeof Deno !== "undefined") {
+    return "deno";
+  }
+  if (process?.versions) {
+    if ("bun" in process.versions) {
+      return "bun";
+    }
+    if ("node" in process.versions) {
+      return "node";
+    }
+  }
+  if (typeof navigator !== "undefined" && navigator.product === "ReactNative") {
+    return "react-native";
+  }
+  return "browser";
+}
+function wirePlatform() {
+  const host = detectPlatform();
+  return host === "browser" ? "web" : host;
+}
 var PALBASE_DEFAULT_HOST = "api.palbase.studio";
 var API_KEY_RE2 = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20}$/;
 function parseEnvironmentRef(apiKey) {
@@ -251,8 +272,17 @@ var HttpClient = class _HttpClient {
   }
   buildHeaders(options) {
     const headers = {
-      "Content-Type": "application/json"
+      "Content-Type": "application/json",
+      // Client identity, the web counterpart of the iOS SDK's
+      // ClientInfo.augment(). The server reads these to resolve flag targeting
+      // conditions and to label telemetry, so an app declares nothing and calls
+      // nothing — whatever the SDK can know, it sends.
+      "X-Platform": wirePlatform()
     };
+    const appVersion = this.options?.appVersion?.trim();
+    if (appVersion) {
+      headers["X-Palbase-Client-Version"] = appVersion;
+    }
     const effectiveKey = this.apiKey;
     if (effectiveKey) {
       headers["apikey"] = effectiveKey;
@@ -1457,6 +1487,162 @@ var PalbeAnalytics = class {
   }
 };
 
+// src/passkey.ts
+function base64UrlToBytes(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded.padEnd(padded.length + (4 - padded.length % 4) % 4, "="));
+  const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function bytesToBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function requireString(source, key) {
+  const value = source[key];
+  if (typeof value !== "string" || value === "") {
+    throw new Error(`passkey options are missing ${key}`);
+  }
+  return value;
+}
+function toCreationOptions(publicKey) {
+  const rp = publicKey.rp;
+  const user = publicKey.user;
+  if (!user?.id) {
+    throw new Error("passkey options carry no user id \u2014 the credential would be unusable");
+  }
+  const excludeCredentials = Array.isArray(publicKey.excludeCredentials) ? publicKey.excludeCredentials.map((c) => ({
+    id: base64UrlToBytes(c.id),
+    type: "public-key"
+  })) : void 0;
+  return {
+    challenge: base64UrlToBytes(requireString(publicKey, "challenge")),
+    rp: { id: rp?.id, name: rp?.name ?? rp?.id ?? "" },
+    user: {
+      id: base64UrlToBytes(user.id),
+      name: user.name ?? "",
+      displayName: user.displayName ?? user.name ?? ""
+    },
+    pubKeyCredParams: publicKey.pubKeyCredParams ?? [],
+    authenticatorSelection: publicKey.authenticatorSelection,
+    timeout: publicKey.timeout,
+    attestation: publicKey.attestation,
+    excludeCredentials
+  };
+}
+function toRequestOptions(publicKey) {
+  const allowCredentials = Array.isArray(publicKey.allowCredentials) ? publicKey.allowCredentials.map((c) => ({
+    id: base64UrlToBytes(c.id),
+    type: "public-key"
+  })) : void 0;
+  return {
+    challenge: base64UrlToBytes(requireString(publicKey, "challenge")),
+    rpId: publicKey.rpId,
+    timeout: publicKey.timeout,
+    userVerification: publicKey.userVerification,
+    allowCredentials
+  };
+}
+function attestationToJSON(credential) {
+  const response = credential.response;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+      attestationObject: bytesToBase64Url(response.attestationObject)
+    }
+  };
+}
+function assertionToJSON(credential) {
+  const response = credential.response;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+      authenticatorData: bytesToBase64Url(response.authenticatorData),
+      signature: bytesToBase64Url(response.signature),
+      // The user handle is how palauth resolves WHO signed in on a discoverable
+      // login — there is no identifier in the request.
+      userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null
+    }
+  };
+}
+function isPasskeySupported() {
+  return typeof window !== "undefined" && typeof window.PublicKeyCredential === "function" && typeof navigator !== "undefined" && navigator.credentials !== void 0;
+}
+function ensureSupported() {
+  if (!isPasskeySupported()) {
+    throw new Error("This browser cannot use passkeys \u2014 offer a password or e-mail sign-in");
+  }
+}
+async function createCredential(publicKey) {
+  const credential = await navigator.credentials.create({
+    publicKey: toCreationOptions(publicKey)
+  });
+  if (credential === null) {
+    throw new Error("the browser returned no credential");
+  }
+  return credential;
+}
+async function getCredential(publicKey) {
+  const credential = await navigator.credentials.get({
+    publicKey: toRequestOptions(publicKey)
+  });
+  if (credential === null) {
+    throw new Error("the browser returned no credential");
+  }
+  return credential;
+}
+async function passkeySignIn(rt) {
+  ensureSupported();
+  const envelope = await palbeRequest(rt, "POST", "/auth/webauthn/login/begin", {
+    body: {}
+  });
+  const credential = await getCredential(envelope.options.publicKey);
+  const raw = await palbeRequest(rt, "POST", "/auth/webauthn/login/finish", {
+    body: assertionToJSON(credential)
+  });
+  const result = asWireAuthResult(raw);
+  if (result === null) {
+    throw new Error("passkey sign-in returned an unusable session");
+  }
+  return result;
+}
+async function passkeySignUp(rt, email, displayName) {
+  ensureSupported();
+  const begun = await palbeRequest(rt, "POST", "/auth/webauthn/signup/begin", {
+    body: { email, user_name: displayName }
+  });
+  const credential = await createCredential(begun.options.publicKey);
+  await palbeRequest(
+    rt,
+    "POST",
+    `/auth/webauthn/signup/finish?user_id=${encodeURIComponent(begun.user_id)}`,
+    { body: attestationToJSON(credential) }
+  );
+  return await passkeySignIn(rt);
+}
+async function passkeyRegister(rt, name) {
+  ensureSupported();
+  const envelope = await palbeRequest(
+    rt,
+    "POST",
+    "/auth/webauthn/register/begin",
+    { body: { name } }
+  );
+  const credential = await createCredential(envelope.options.publicKey);
+  await palbeRequest(rt, "POST", "/auth/webauthn/register/finish", {
+    body: attestationToJSON(credential)
+  });
+}
+
 // src/auth-facade.ts
 function mapWireUser(raw) {
   return {
@@ -1593,6 +1779,23 @@ var PalbeAuth = class {
     const raw = await palbeRequest(this.rt, "GET", "/auth/user");
     return mapWireUser(raw);
   }
+  /**
+   * Which credentials this account actually has.
+   *
+   * An account reached through Google has no password, so showing it a
+   * "current password" field gives the user something they can never fill —
+   * and `getUser()` cannot tell you, because GET /auth/user carries no
+   * credential information. Read this before rendering any re-auth or
+   * change-password form.
+   */
+  async getSignInMethods() {
+    const raw = await palbeRequest(this.rt, "GET", "/auth/me");
+    return {
+      password: raw.has_password,
+      mfa: raw.has_mfa,
+      providers: raw.providers ?? null
+    };
+  }
   async refreshUser() {
     const user = await this.getUser();
     const changed = !usersEqual(user, this.cachedUser);
@@ -1794,6 +1997,39 @@ var PalbeAuth = class {
       return this.adopt(data);
     });
   }
+  /**
+   * Sign in with a passkey stored for this Environment. No identifier is typed:
+   * the browser lists the accounts it holds and the user picks one.
+   *
+   * Throws when the browser cannot run a ceremony — check `passkeysSupported`
+   * first and keep a password or e-mail path beside the button.
+   */
+  async signInWithPasskey() {
+    return this.withSigningIn(async () => this.adoptWire(await passkeySignIn(this.rt)));
+  }
+  /**
+   * Create an account whose only credential is a passkey — the e-mail is the
+   * identifier, the passkey is the credential, and no password ever exists.
+   */
+  async signUpWithPasskey(email, displayName) {
+    return this.withSigningIn(
+      async () => this.adoptWire(await passkeySignUp(this.rt, email, displayName))
+    );
+  }
+  /**
+   * Add a passkey to the signed-in account, so the next sign-in is one tap.
+   *
+   * Rejects with a 403 `reauthentication_required` when the session is not
+   * recent: a passkey outlives a password reset, so enrolling one takes more
+   * than a valid session.
+   */
+  async registerPasskey(name) {
+    await passkeyRegister(this.rt, name);
+  }
+  /** Whether this browser can run a passkey ceremony at all. */
+  get passkeysSupported() {
+    return isPasskeySupported();
+  }
   async signInWithOAuth(params) {
     const { redirect = true, ...opts } = params;
     const { url } = unwrap(await this.rt.authClient.getOAuthURL(opts));
@@ -9037,7 +9273,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "6.0.0";
+var VERSION = "7.1.0";
 
 // src/runtime.ts
 function buildRuntime(config) {