@palbase/web 7.0.0 → 7.2.0

package/dist/next/client.js

@@ -6,7 +6,7 @@ import {
 import {
   __configure,
   getRuntime
-} from "../chunk-7SNSLY5M.js";
+} from "../chunk-VXQUBBHG.js";
 import "../chunk-ACCJV6FV.js";
 import "../chunk-CFDU23TB.js";
 import "../chunk-PZ5AY32C.js";

package/dist/next/index.cjs

@@ -964,6 +964,20 @@ var AuthClient = class {
       body: params
     });
   }
+  /**
+   * Give a PASSWORDLESS account its first password.
+   *
+   * Separate from `changePassword` because that one cannot serve the case: it
+   * sends a current password and palauth answers an account that has none with
+   * 401. Requires a RECENT sign-in (403 `reauthentication_required` otherwise,
+   * the same gate passkey enrollment carries); an account that already has a
+   * password gets 409 `password_already_set`.
+   */
+  async setPassword(params) {
+    return this.httpClient.request("POST", "/auth/password/set", {
+      body: params
+    });
+  }
   // ── Token ───────────────────────────────────────────────
   async refresh() {
     const refreshToken = this.tokenManager.getRefreshToken();
@@ -1487,6 +1501,162 @@ var PalbeAnalytics = class {
   }
 };
 
+// src/passkey.ts
+function base64UrlToBytes(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded.padEnd(padded.length + (4 - padded.length % 4) % 4, "="));
+  const bytes = new Uint8Array(new ArrayBuffer(binary.length));
+  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function bytesToBase64Url(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function requireString(source, key) {
+  const value = source[key];
+  if (typeof value !== "string" || value === "") {
+    throw new Error(`passkey options are missing ${key}`);
+  }
+  return value;
+}
+function toCreationOptions(publicKey) {
+  const rp = publicKey.rp;
+  const user = publicKey.user;
+  if (!user?.id) {
+    throw new Error("passkey options carry no user id \u2014 the credential would be unusable");
+  }
+  const excludeCredentials = Array.isArray(publicKey.excludeCredentials) ? publicKey.excludeCredentials.map((c) => ({
+    id: base64UrlToBytes(c.id),
+    type: "public-key"
+  })) : void 0;
+  return {
+    challenge: base64UrlToBytes(requireString(publicKey, "challenge")),
+    rp: { id: rp?.id, name: rp?.name ?? rp?.id ?? "" },
+    user: {
+      id: base64UrlToBytes(user.id),
+      name: user.name ?? "",
+      displayName: user.displayName ?? user.name ?? ""
+    },
+    pubKeyCredParams: publicKey.pubKeyCredParams ?? [],
+    authenticatorSelection: publicKey.authenticatorSelection,
+    timeout: publicKey.timeout,
+    attestation: publicKey.attestation,
+    excludeCredentials
+  };
+}
+function toRequestOptions(publicKey) {
+  const allowCredentials = Array.isArray(publicKey.allowCredentials) ? publicKey.allowCredentials.map((c) => ({
+    id: base64UrlToBytes(c.id),
+    type: "public-key"
+  })) : void 0;
+  return {
+    challenge: base64UrlToBytes(requireString(publicKey, "challenge")),
+    rpId: publicKey.rpId,
+    timeout: publicKey.timeout,
+    userVerification: publicKey.userVerification,
+    allowCredentials
+  };
+}
+function attestationToJSON(credential) {
+  const response = credential.response;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+      attestationObject: bytesToBase64Url(response.attestationObject)
+    }
+  };
+}
+function assertionToJSON(credential) {
+  const response = credential.response;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    response: {
+      clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+      authenticatorData: bytesToBase64Url(response.authenticatorData),
+      signature: bytesToBase64Url(response.signature),
+      // The user handle is how palauth resolves WHO signed in on a discoverable
+      // login — there is no identifier in the request.
+      userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null
+    }
+  };
+}
+function isPasskeySupported() {
+  return typeof window !== "undefined" && typeof window.PublicKeyCredential === "function" && typeof navigator !== "undefined" && navigator.credentials !== void 0;
+}
+function ensureSupported() {
+  if (!isPasskeySupported()) {
+    throw new Error("This browser cannot use passkeys \u2014 offer a password or e-mail sign-in");
+  }
+}
+async function createCredential(publicKey) {
+  const credential = await navigator.credentials.create({
+    publicKey: toCreationOptions(publicKey)
+  });
+  if (credential === null) {
+    throw new Error("the browser returned no credential");
+  }
+  return credential;
+}
+async function getCredential(publicKey) {
+  const credential = await navigator.credentials.get({
+    publicKey: toRequestOptions(publicKey)
+  });
+  if (credential === null) {
+    throw new Error("the browser returned no credential");
+  }
+  return credential;
+}
+async function passkeySignIn(rt) {
+  ensureSupported();
+  const envelope = await palbeRequest(rt, "POST", "/auth/webauthn/login/begin", {
+    body: {}
+  });
+  const credential = await getCredential(envelope.options.publicKey);
+  const raw = await palbeRequest(rt, "POST", "/auth/webauthn/login/finish", {
+    body: assertionToJSON(credential)
+  });
+  const result = asWireAuthResult(raw);
+  if (result === null) {
+    throw new Error("passkey sign-in returned an unusable session");
+  }
+  return result;
+}
+async function passkeySignUp(rt, email, displayName) {
+  ensureSupported();
+  const begun = await palbeRequest(rt, "POST", "/auth/webauthn/signup/begin", {
+    body: { email, user_name: displayName }
+  });
+  const credential = await createCredential(begun.options.publicKey);
+  await palbeRequest(
+    rt,
+    "POST",
+    `/auth/webauthn/signup/finish?user_id=${encodeURIComponent(begun.user_id)}`,
+    { body: attestationToJSON(credential) }
+  );
+  return await passkeySignIn(rt);
+}
+async function passkeyRegister(rt, name) {
+  ensureSupported();
+  const envelope = await palbeRequest(
+    rt,
+    "POST",
+    "/auth/webauthn/register/begin",
+    { body: { name } }
+  );
+  const credential = await createCredential(envelope.options.publicKey);
+  await palbeRequest(rt, "POST", "/auth/webauthn/register/finish", {
+    body: attestationToJSON(credential)
+  });
+}
+
 // src/auth-facade.ts
 function mapWireUser(raw) {
   return {
@@ -1818,6 +1988,26 @@ var PalbeAuth = class {
       })
     );
   }
+  /**
+   * Give a passwordless account its FIRST password, in-app.
+   *
+   * For accounts created with a passkey or a social provider: they have no
+   * current password, so `updatePassword` cannot serve them — it sends one and
+   * the server answers 401. Before this existed the only route was the
+   * password-RESET e-mail, which asks someone already signed in to go find
+   * their inbox.
+   *
+   * Requires a RECENT sign-in, not merely a session: a first password is a
+   * credential that outlives the rest, so the server answers 403
+   * `reauthentication_required` on a stale one — the same gate
+   * `registerPasskey` carries. An account that already has a password gets 409
+   * `password_already_set`; change it with `updatePassword` instead.
+   *
+   * The session stays valid — no re-login.
+   */
+  async setPassword(newPassword) {
+    unwrap(await this.rt.authClient.setPassword({ new_password: newPassword }));
+  }
   async verifyEmail(params) {
     unwrap(await this.rt.authClient.verifyEmail(params));
   }
@@ -1841,6 +2031,39 @@ var PalbeAuth = class {
       return this.adopt(data);
     });
   }
+  /**
+   * Sign in with a passkey stored for this Environment. No identifier is typed:
+   * the browser lists the accounts it holds and the user picks one.
+   *
+   * Throws when the browser cannot run a ceremony — check `passkeysSupported`
+   * first and keep a password or e-mail path beside the button.
+   */
+  async signInWithPasskey() {
+    return this.withSigningIn(async () => this.adoptWire(await passkeySignIn(this.rt)));
+  }
+  /**
+   * Create an account whose only credential is a passkey — the e-mail is the
+   * identifier, the passkey is the credential, and no password ever exists.
+   */
+  async signUpWithPasskey(email, displayName) {
+    return this.withSigningIn(
+      async () => this.adoptWire(await passkeySignUp(this.rt, email, displayName))
+    );
+  }
+  /**
+   * Add a passkey to the signed-in account, so the next sign-in is one tap.
+   *
+   * Rejects with a 403 `reauthentication_required` when the session is not
+   * recent: a passkey outlives a password reset, so enrolling one takes more
+   * than a valid session.
+   */
+  async registerPasskey(name) {
+    await passkeyRegister(this.rt, name);
+  }
+  /** Whether this browser can run a passkey ceremony at all. */
+  get passkeysSupported() {
+    return isPasskeySupported();
+  }
   async signInWithOAuth(params) {
     const { redirect = true, ...opts } = params;
     const { url } = unwrap(await this.rt.authClient.getOAuthURL(opts));
@@ -9084,7 +9307,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "7.0.0";
+var VERSION = "7.2.0";
 
 // src/runtime.ts
 function buildRuntime(config) {