@passflow/react 0.17.0 → 0.19.0

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to `@passflow/react` are documented in this file.
 
+## [0.19.0] - 2026-11-04
+
+### Added
+
+- Cross-device magic-link sign-in. With PKCE on, the tab that asked for the link shows a 4-digit code and finishes sign-in itself once the link is approved. The device that opens the link shows the request details, asks for that code, and offers Approve and Deny. Resend replaces the request, and the tab waits on the new one.
+- `federatedLanding` prop on `Passflow` (`'app'` by default, or `'login-page'`). With `'login-page'`, PKCE on and no `parent_challenge_id`, a federated sign-in returns to the login page, which finishes it and forwards to the app with tokens, once. `useProvider` takes the same value as its third argument.
+- `federatedLandingOutcome` on `NavigationContext`: `'signed-in'` or `'failed'` after a federated landing.
+- `LoginScreen` states `passwordless-waiting` and `passwordless-approval`, each with Storybook stories. Also exported: the `FederatedLanding` and `FederatedLandingOutcome` types, and the approval message helpers from the utils.
+
+### Changed
+
+- Requires `@passflow/core` `^0.24.0`.
+- Federated PKCE landings now run from a committed effect through core's `deferFederatedLanding`, so they hold under React 18 StrictMode.
+
+### Fixed
+
+- A refused parent challenge (`error.auth.flow.parent.expired`, `.not.found`, `.completed`) shows its own message on the form instead of marking the credential fields invalid. Start again reloads the page without `parent_challenge_id`.
+- `match_code` from a passwordless start is no longer put in the query of the verify screen.
+
+## [0.18.0] - 2026-11-03
+
+### Added
+
+- Email verification code step. When an app's registration policy requires a verified email, `/auth/register` and `/auth/login` may answer with a challenge instead of tokens. Sign-up and sign-in then show a code screen bound to that challenge. The submitted code goes to `/auth/validate`, and its answer continues the flow as before: second factor, PKCE or redirect. Resend repeats the original request. Cancel goes back to the form.
+- When the server's code budget is spent and it emails a link instead, the flow shows a "check your email" screen with no code input. The link opens the reset-password screen with a continuation grant. That screen titles itself "Create your password" and signs the user in with the tokens `/auth/password/change` returns.
+- `useEmailCodeStep()` (with `UseEmailCodeStep` and `UseEmailCodeStepOptions` types) drives the code step for custom UIs. Also exported: `EmailCodeStep`, `EmailVerificationStep`, `readEmailVerificationStep`, `emailCodeStepReducer`, `initialEmailCodeStepState`, and the error helpers `authErrorFrom`, `authRedirectErrorFrom`, `invitationJoinErrorFrom`, `emailCodeErrorMessage`, `newPasswordErrorMessage`, `serverMessageFor` and `isPasswordSavedRateLimit`.
+- `LoginScreen` states `email-code` and `new-password`, and an `info` tone for the `status` state, each with a Storybook story.
+- `Button` honours `aria-disabled`: it looks disabled and ignores clicks but stays focusable, so focus is not lost while a resend cooldown runs.
+
+### Changed
+
+- Requires `@passflow/core` `^0.22.0`, which adds `verifyEmailCode` and the `EmailVerificationRequired` event.
+- For these error ids the forms show the server's localized `error.message` instead of fixed copy: `error.registration.email.domain_not_allowed`, `email.required`, `email.not_verified_by_provider`, `error.invite.email.domain_not_allowed`, `error.verification.code.rate_limited`, and wrong, expired or used codes. The same list applies to errors that arrive in the URL from a federated sign-in. Other ids keep the fixed copy.
+- The reset-password screen is built on `LoginScreen`. Its outer wrapper class is unchanged, but the elements inside it are different, so `custom_css` rules aimed at its inner classes need updating.
+
+### Fixed
+
+- A 429 from the server is recognised whether core passes it on as a `PassflowError` or as a raw HTTP error, so rate limits show the rate-limit message instead of a generic failure.
+- A URL error message containing a literal `%` no longer breaks decoding.
+
 ## [0.17.0] - 2026-11-03
 
 ### Changed