@pawabase/client 0.0.0-stage → 0.1.0

package/dist/cjs/auth.js

@@ -0,0 +1,1016 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthClient = void 0;
+const errors_js_1 = require("./errors.js");
+const session_store_js_1 = require("./session-store.js");
+const util_js_1 = require("./util.js");
+const LOCK_PREFIX = "pawabase-auth-refresh:";
+const FATAL_REFRESH = new Set([400, 401, 403]);
+function storageKeyFor(baseUrl, apiKey) {
+    return `pawabase.auth.${baseUrl.replace(/^https?:\/\//, "")}.${apiKey.slice(0, 14)}`;
+}
+function toSession(wire, user, fallback) {
+    const issued = (0, util_js_1.nowSeconds)();
+    const resolved = user ?? wire.user ?? fallback?.user;
+    if (!resolved)
+        throw new errors_js_1.PawabaseError("The server returned a session without a user.");
+    return {
+        access_token: wire.access_token,
+        refresh_token: wire.refresh_token,
+        token_type: "bearer",
+        expires_in: wire.expires_in,
+        expires_at: wire.expires_at ?? issued + wire.expires_in,
+        ...(wire.session_id ? { session_id: wire.session_id } : {}),
+        org: wire.org ?? null,
+        org_role: wire.org_role ?? null,
+        user: resolved,
+    };
+}
+function validSession(value) {
+    return ((0, util_js_1.isRecord)(value) &&
+        typeof value["access_token"] === "string" &&
+        typeof value["refresh_token"] === "string" &&
+        typeof value["expires_at"] === "number" &&
+        (0, util_js_1.isRecord)(value["user"]));
+}
+/**
+ * Sign-in, session lifecycle and everything about the signed-in person.
+ *
+ * The session is kept in storage, refreshed before it expires, and refreshed only
+ * once at a time: Akountz rotates refresh tokens and treats a reused one as theft,
+ * so two refreshes racing (two requests, or two tabs) would sign the user out.
+ * Concurrent callers share one refresh; across tabs the Web Locks API serialises it.
+ */
+class AuthClient {
+    http;
+    options;
+    session = null;
+    listeners = new Set();
+    storage;
+    persist;
+    storageKey;
+    autoRefresh;
+    margin;
+    timer = null;
+    inflight = null;
+    ready;
+    disposers = [];
+    disposed = false;
+    mfa;
+    sessions;
+    orgs;
+    /** Browsers and apps the user has signed in from. */
+    devices;
+    /** Keys a user makes for themselves to call the API as themselves. */
+    apiKeys;
+    /** Passkeys (WebAuthn): register one, sign in with one. */
+    passkeys;
+    constructor(http, options = {}) {
+        this.http = http;
+        this.options = options;
+        const browser = (0, session_store_js_1.browserStorage)();
+        this.persist = options.persistSession ?? true;
+        this.storage = options.storage ?? (this.persist && browser ? browser : new session_store_js_1.MemoryStorage());
+        this.storageKey = options.storageKey ?? storageKeyFor(http.config.baseUrl, http.config.apiKey);
+        this.autoRefresh = options.autoRefreshToken ?? true;
+        this.margin = options.refreshMarginSeconds ?? 60;
+        this.mfa = new AuthMfa(http, () => this.refreshSession());
+        this.sessions = new AuthSessions(http);
+        this.orgs = new AuthOrgs(http);
+        this.devices = new AuthDevices(http);
+        this.apiKeys = new AuthApiKeys(http);
+        this.passkeys = new AuthPasskeys(http, (wire) => this.adopt(wire));
+        this.ready = this.initialize();
+        this.ready.catch(() => undefined);
+    }
+    // ── lifecycle ─────────────────────────────────────────────────────────
+    async initialize() {
+        try {
+            const raw = await this.storage.getItem(this.storageKey);
+            if (raw) {
+                const parsed = JSON.parse(raw);
+                if (validSession(parsed))
+                    this.session = parsed;
+                else
+                    await this.storage.removeItem(this.storageKey);
+            }
+        }
+        catch {
+            await Promise.resolve(this.storage.removeItem(this.storageKey)).catch(() => undefined);
+        }
+        this.watchOtherTabs();
+        const inUrl = (this.options.detectSessionInUrl ?? typeof window !== "undefined") && typeof window !== "undefined";
+        if (inUrl && /(?:^#|&)(access_token|error|mfa_required|linked)=/.test(window.location.hash)) {
+            const result = await this.getSessionFromUrl().catch(() => ({ status: "none" }));
+            if (result.status === "signed_in")
+                return;
+        }
+        if (this.session)
+            this.schedule();
+    }
+    /** Resolves once the stored session has been read. Everything else awaits it for you. */
+    async initialized() {
+        await this.ready;
+    }
+    /** Stop timers and listeners. Call when discarding a client (tests, hot reload). */
+    dispose() {
+        this.disposed = true;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        for (const dispose of this.disposers)
+            dispose();
+        this.disposers = [];
+        this.listeners.clear();
+    }
+    /**
+     * Be told about sign-ins, sign-outs and refreshes (also from other tabs).
+     * The listener is called once, soon, with `INITIAL_SESSION`.
+     */
+    onAuthStateChange(listener) {
+        this.listeners.add(listener);
+        void this.ready.then(() => {
+            if (this.listeners.has(listener))
+                this.call(listener, "INITIAL_SESSION", this.session);
+        });
+        return { unsubscribe: () => void this.listeners.delete(listener) };
+    }
+    emit(event) {
+        for (const listener of [...this.listeners])
+            this.call(listener, event, this.session);
+    }
+    call(listener, event, session) {
+        try {
+            const result = listener(event, session);
+            if (result instanceof Promise)
+                result.catch(() => undefined);
+        }
+        catch {
+            /* a listener must not break auth */
+        }
+    }
+    // ── session access ────────────────────────────────────────────────────
+    /**
+     * The current session, refreshed first when it is about to expire. `null` when signed out.
+     * Throws only if the token has already expired and refreshing failed for a reason that
+     * may pass (offline, a server error).
+     */
+    async getSession() {
+        await this.ready;
+        const session = this.session;
+        if (!session)
+            return null;
+        if (!this.expiring(session))
+            return session;
+        try {
+            return await this.refreshSession();
+        }
+        catch (error) {
+            if (!this.session)
+                return null; // the refresh token was refused: signed out
+            if (session.expires_at > (0, util_js_1.nowSeconds)())
+                return session; // still valid for now
+            throw error;
+        }
+    }
+    /** The access token to send as a bearer, or `null`. */
+    async getAccessToken() {
+        return (await this.getSession())?.access_token ?? null;
+    }
+    /** The signed-in user as last known, without a request. */
+    async getCachedUser() {
+        await this.ready;
+        return this.session?.user ?? null;
+    }
+    /** Called by the transport after a `401`: refresh once, unless someone already did. */
+    async onUnauthorized(failed) {
+        await this.ready;
+        if (!this.session)
+            return null;
+        if (this.session.access_token !== failed)
+            return this.session.access_token;
+        try {
+            return (await this.refreshSession()).access_token;
+        }
+        catch {
+            return null;
+        }
+    }
+    expiring(session) {
+        return session.expires_at - this.margin <= (0, util_js_1.nowSeconds)();
+    }
+    /**
+     * Adopt a session you obtained elsewhere (a server-side rendered page's cookies,
+     * a mobile deep link). Both tokens are required; the user is fetched with them.
+     */
+    async setSession(tokens) {
+        await this.ready;
+        const claims = (0, util_js_1.decodeJwt)(tokens.access_token);
+        const exp = typeof claims?.["exp"] === "number" ? claims["exp"] : (0, util_js_1.nowSeconds)() + 300;
+        const user = await this.http.request({
+            path: "/auth/v1/user",
+            accessToken: tokens.access_token,
+        });
+        const session = toSession({
+            access_token: tokens.access_token,
+            refresh_token: tokens.refresh_token,
+            token_type: "bearer",
+            expires_in: Math.max(0, exp - (0, util_js_1.nowSeconds)()),
+            expires_at: exp,
+            org: typeof claims?.["org"] === "string" ? claims["org"] : null,
+            org_role: typeof claims?.["org_role"] === "string" ? claims["org_role"] : null,
+        }, user);
+        await this.store(session, "SIGNED_IN");
+        return session;
+    }
+    async store(session, event) {
+        this.session = session;
+        try {
+            if (session)
+                await this.storage.setItem(this.storageKey, JSON.stringify(session));
+            else
+                await this.storage.removeItem(this.storageKey);
+        }
+        catch {
+            /* storage can be full or blocked; the in-memory session still works */
+        }
+        if (session)
+            this.schedule();
+        else if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
+        this.emit(event);
+    }
+    schedule() {
+        if (!this.autoRefresh || this.disposed || !this.session)
+            return;
+        if (this.timer)
+            clearTimeout(this.timer);
+        const wait = Math.max(1, this.session.expires_at - this.margin - (0, util_js_1.nowSeconds)());
+        // setTimeout caps at ~24.8 days; tokens last minutes, but be safe.
+        const timer = setTimeout(() => {
+            void this.refreshSession().catch(() => {
+                if (this.session && !this.disposed) {
+                    this.timer = setTimeout(() => this.schedule(), 10_000);
+                    this.timer.unref?.();
+                }
+            });
+        }, Math.min(wait * 1000, 2 ** 31 - 1));
+        timer.unref?.();
+        this.timer = timer;
+    }
+    watchOtherTabs() {
+        if (typeof window === "undefined" || !this.persist)
+            return;
+        const onStorage = (event) => {
+            if (event.key !== this.storageKey)
+                return;
+            void (async () => {
+                const before = this.session;
+                const raw = event.newValue;
+                let next = null;
+                try {
+                    const parsed = raw ? JSON.parse(raw) : null;
+                    next = validSession(parsed) ? parsed : null;
+                }
+                catch {
+                    next = null;
+                }
+                this.session = next;
+                if (next)
+                    this.schedule();
+                this.emit(!next ? "SIGNED_OUT" : !before ? "SIGNED_IN" : "TOKEN_REFRESHED");
+            })();
+        };
+        const onVisible = () => {
+            if (document.visibilityState === "visible" && this.session && this.expiring(this.session)) {
+                void this.refreshSession().catch(() => undefined);
+            }
+        };
+        window.addEventListener("storage", onStorage);
+        document.addEventListener("visibilitychange", onVisible);
+        this.disposers.push(() => {
+            window.removeEventListener("storage", onStorage);
+            document.removeEventListener("visibilitychange", onVisible);
+        });
+    }
+    // ── refresh ───────────────────────────────────────────────────────────
+    /** Exchange the refresh token for a new session. Concurrent calls share one exchange. */
+    refreshSession(options = {}) {
+        if (this.inflight && !("org" in options))
+            return this.inflight;
+        const run = this.exclusive(() => this.doRefresh(options));
+        const tracked = run.finally(() => {
+            if (this.inflight === tracked)
+                this.inflight = null;
+        });
+        this.inflight = tracked;
+        return tracked;
+    }
+    async exclusive(fn) {
+        const locks = globalThis
+            .navigator?.locks;
+        if (locks?.request && this.persist && this.storage !== undefined && typeof window !== "undefined") {
+            return locks.request(`${LOCK_PREFIX}${this.storageKey}`, fn);
+        }
+        return fn();
+    }
+    async doRefresh(options) {
+        await this.ready;
+        let current = this.session;
+        // Another tab may have refreshed while we waited for the lock.
+        if (this.persist) {
+            try {
+                const raw = await this.storage.getItem(this.storageKey);
+                const parsed = raw ? JSON.parse(raw) : null;
+                if (validSession(parsed) && parsed.refresh_token !== current?.refresh_token) {
+                    this.session = parsed;
+                    current = parsed;
+                    if (!this.expiring(parsed) && !("org" in options)) {
+                        this.schedule();
+                        this.emit("TOKEN_REFRESHED");
+                        return parsed;
+                    }
+                }
+            }
+            catch {
+                /* fall through to a normal refresh */
+            }
+        }
+        if (!current)
+            throw new errors_js_1.AuthenticationError({ status: 401, code: "no_session", message: "Not signed in." });
+        try {
+            const wire = await this.http.request({
+                method: "POST",
+                path: "/auth/v1/token",
+                body: { grant_type: "refresh_token", refresh_token: current.refresh_token, ...("org" in options ? { org: options.org } : {}) },
+                auth: "none",
+            });
+            const next = toSession(wire, undefined, current);
+            await this.store(next, "TOKEN_REFRESHED");
+            return next;
+        }
+        catch (error) {
+            if (error instanceof errors_js_1.ApiError && FATAL_REFRESH.has(error.status)) {
+                await this.store(null, "SIGNED_OUT");
+            }
+            throw error;
+        }
+    }
+    // ── sign-in ───────────────────────────────────────────────────────────
+    /** What this environment offers: sign-up, magic links, MFA, providers, password rules. */
+    settings() {
+        return this.http.request({ path: "/auth/v1/settings", auth: "none" });
+    }
+    /**
+     * Create an account. When the project requires email confirmation the result has no
+     * session (`verificationRequired` is `true`); otherwise the user is signed in.
+     */
+    async signUp(input) {
+        const wire = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/signup",
+            body: {
+                email: input.email,
+                password: input.password,
+                ...(input.username ? { username: input.username } : {}),
+                ...(input.name ? { name: input.name } : {}),
+                ...(input.data ? { data: input.data } : {}),
+                ...(input.redirectTo ? { redirect_to: input.redirectTo } : {}),
+            },
+            auth: "none",
+        });
+        if (wire.verification_required || !wire.access_token) {
+            return { user: wire.user, session: null, verificationRequired: true };
+        }
+        const session = toSession(wire, undefined);
+        await this.store(session, "SIGNED_IN");
+        return { user: session.user, session, verificationRequired: false };
+    }
+    /**
+     * Sign in with email and password. When the account has MFA the result is
+     * `{ status: "mfa_required" }`; call its `verify(code)` to finish.
+     */
+    async signInWithPassword(input) {
+        const wire = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/token",
+            body: {
+                grant_type: "password",
+                email: input.email,
+                password: input.password,
+                ...(input.org ? { org: input.org } : {}),
+            },
+            auth: "none",
+        });
+        if ("mfa_required" in wire && wire.mfa_required) {
+            return this.challenge(wire.mfa_token, wire.factors, input.org);
+        }
+        const session = toSession(wire, undefined);
+        await this.store(session, "SIGNED_IN");
+        return { status: "signed_in", session };
+    }
+    challenge(mfaToken, factors, org) {
+        return {
+            status: "mfa_required",
+            mfaToken,
+            factors,
+            verify: (code) => this.verifyMfa({ mfaToken, code, ...(org ? { org } : {}) }),
+        };
+    }
+    /** Finish an MFA sign-in with an authenticator code or a recovery code. */
+    async verifyMfa(input) {
+        const wire = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/token",
+            body: {
+                grant_type: "mfa",
+                mfa_token: input.mfaToken,
+                code: input.code,
+                ...(input.org ? { org: input.org } : {}),
+            },
+            auth: "none",
+        });
+        const session = toSession(wire, undefined);
+        await this.store(session, "SIGNED_IN");
+        return session;
+    }
+    /** Email a one-time sign-in link. Always resolves the same way, so it does not reveal whether an account exists. */
+    async signInWithMagicLink(input) {
+        await this.http.request({
+            method: "POST",
+            path: "/auth/v1/magic-link",
+            body: {
+                email: input.email,
+                ...(input.redirectTo ? { redirect_to: input.redirectTo } : {}),
+                ...(input.createUser !== undefined ? { create_user: input.createUser } : {}),
+            },
+            auth: "none",
+        });
+    }
+    /** Exchange the token from a magic-link email for a session. */
+    async verifyMagicLink(token) {
+        const wire = await this.http.request({ method: "POST", path: "/auth/v1/magic-link/verify", body: { token }, auth: "none" });
+        if ("mfa_required" in wire && wire.mfa_required)
+            return this.challenge(wire.mfa_token, wire.factors);
+        const session = toSession(wire, undefined);
+        await this.store(session, "SIGNED_IN");
+        return { status: "signed_in", session };
+    }
+    /** Keep a session the server just issued and announce it. */
+    async adopt(wire) {
+        await this.ready;
+        const session = toSession(wire, undefined);
+        await this.store(session, "SIGNED_IN");
+        return session;
+    }
+    /**
+     * Start a guest session: an account with no email or password, for someone who has not signed up yet. Turn it into a real account with
+     * {@link upgradeAnonymous}, keeping everything the guest created. The environment must allow guest sign-in.
+     */
+    async signInAnonymously() {
+        const wire = await this.http.request({ method: "POST", path: "/auth/v1/anonymous", body: {}, auth: "none" });
+        return this.adopt(wire);
+    }
+    /** Turn the signed-in guest into a full account. A verification email is sent. */
+    async upgradeAnonymous(input) {
+        await this.ready;
+        const result = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/anonymous/upgrade",
+            body: {
+                email: input.email,
+                ...(input.password ? { password: input.password } : {}),
+                ...(input.name ? { name: input.name } : {}),
+                ...(input.redirectTo ? { redirect_to: input.redirectTo } : {}),
+            },
+        });
+        if (this.session) {
+            this.session = { ...this.session, user: result.user };
+            await Promise.resolve(this.storage.setItem(this.storageKey, JSON.stringify(this.session))).catch(() => undefined);
+        }
+        this.emit("USER_UPDATED");
+        return result;
+    }
+    /** Email a short sign-in code. The answer is the same whether or not the address has an account. */
+    async sendEmailCode(input) {
+        await this.http.request({ method: "POST", path: "/auth/v1/email-code", body: { email: input.email, create_user: input.createUser ?? true }, auth: "none" });
+    }
+    /** Sign in with the code from {@link sendEmailCode}. An account with a second factor answers `mfa_required`. */
+    async verifyEmailCode(input) {
+        const wire = await this.http.request({ method: "POST", path: "/auth/v1/email-code/verify", body: { email: input.email, code: input.code }, auth: "none" });
+        if ("mfa_required" in wire && wire.mfa_required)
+            return this.challenge(wire.mfa_token, wire.factors);
+        const session = await this.adopt(wire);
+        return { status: "signed_in", session };
+    }
+    /** The public keys that verify integration tokens ({@link issueToken}), for a server that checks them. */
+    async jwks() {
+        const { environment } = this.scope();
+        return this.http.request({ path: `/auth/v1/token-keys/${encodeURIComponent(environment)}/jwks`, auth: "none" });
+    }
+    /**
+     * Exchange the signed-in session for a short-lived token for another service, shaped by a token profile you defined in Studio.
+     */
+    issueToken(profile) {
+        return this.http.request({ method: "POST", path: "/auth/v1/token-profiles/issue", body: { profile } });
+    }
+    /** Where to send the browser for a social sign-in. Needs `environment` in the client options (or a signed-in session, which names it). */
+    signInWithOAuthUrl(provider, options = {}) {
+        const { environment } = this.scope();
+        if ((0, util_js_1.isSecretKey)(this.http.config.apiKey)) {
+            throw new errors_js_1.ConfigError("Refusing to put a secret key in a URL: use a publishable key for social sign-in.");
+        }
+        const query = (0, util_js_1.queryString)({ redirect_to: options.redirectTo, apikey: this.http.config.apiKey });
+        return this.http.url(`/auth/v1/authorize/${encodeURIComponent(environment)}/${encodeURIComponent(provider)}`) + query;
+    }
+    /** Trade the `code` a sign-in redirect carried for a session (pass the verifier of a PKCE `code_challenge` if the sign-in began with one). */
+    async exchangeCode(code, codeVerifier) {
+        const wire = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/token/exchange",
+            body: { code, ...(codeVerifier ? { code_verifier: codeVerifier } : {}) },
+            auth: "none",
+        });
+        const session = toSession(wire, undefined);
+        await this.store(session, "SIGNED_IN");
+        return session;
+    }
+    /** Redirect the browser to a provider. After the round trip, {@link getSessionFromUrl} (run automatically) picks the session up. */
+    signInWithOAuth(provider, options = {}) {
+        if (typeof window === "undefined") {
+            throw new errors_js_1.ConfigError("signInWithOAuth redirects a browser. On a server, use signInWithOAuthUrl().");
+        }
+        window.location.assign(this.signInWithOAuthUrl(provider, options));
+    }
+    scope() {
+        const claims = this.session ? (0, util_js_1.decodeJwt)(this.session.access_token) : null;
+        const environment = this.options.environment ?? (typeof claims?.["env"] === "string" ? claims["env"] : undefined);
+        if (!environment) {
+            throw new errors_js_1.ConfigError("Social sign-in needs the environment: pass `environment` to createClient().");
+        }
+        return { environment };
+    }
+    /**
+     * Read what a social sign-in left in the URL fragment (`#access_token=…`), store the
+     * session, and clean the URL. Called automatically in browsers; call it yourself in
+     * a mobile deep-link handler.
+     */
+    async getSessionFromUrl(url) {
+        const target = url ?? (typeof window !== "undefined" ? window.location.href : "");
+        const hash = target.includes("#") ? target.slice(target.indexOf("#") + 1) : "";
+        if (!hash)
+            return { status: "none" };
+        const params = new URLSearchParams(hash);
+        const clean = () => {
+            if (url === undefined && typeof window !== "undefined" && window.history?.replaceState) {
+                window.history.replaceState(null, "", window.location.pathname + window.location.search);
+            }
+        };
+        const error = params.get("error");
+        if (error) {
+            clean();
+            return { status: "error", error };
+        }
+        const linked = params.get("linked");
+        if (linked) {
+            clean();
+            return { status: "linked", provider: linked };
+        }
+        if (params.get("mfa_required") && params.get("mfa_token")) {
+            clean();
+            const mfaToken = params.get("mfa_token");
+            return { status: "mfa_required", mfaToken, verify: (code) => this.verifyMfa({ mfaToken, code }) };
+        }
+        const access = params.get("access_token");
+        const refresh = params.get("refresh_token");
+        if (!access || !refresh)
+            return { status: "none" };
+        clean();
+        const session = await this.setSession({ access_token: access, refresh_token: refresh });
+        return { status: "signed_in", session };
+    }
+    // ── session end ───────────────────────────────────────────────────────
+    /**
+     * Sign out. `local` (default) ends this session, `others` every other one, `global` all of them.
+     * The local session is always cleared, even when the server cannot be reached.
+     */
+    async signOut(options = {}) {
+        await this.ready;
+        const scope = options.scope ?? "local";
+        let failure = null;
+        if (this.session) {
+            try {
+                await this.http.request({ method: "POST", path: "/auth/v1/logout", body: { scope } });
+            }
+            catch (error) {
+                // An expired or revoked token already means "signed out" to the server.
+                if (!(error instanceof errors_js_1.AuthenticationError))
+                    failure = error;
+            }
+        }
+        if (scope !== "others")
+            await this.store(null, "SIGNED_OUT");
+        if (failure)
+            throw failure;
+    }
+    // ── the signed-in user ────────────────────────────────────────────────
+    /** The user, fresh from the server (and the session's cached copy is updated). */
+    async getUser() {
+        await this.ready;
+        const user = await this.http.request({ path: "/auth/v1/user" });
+        if (this.session) {
+            this.session = { ...this.session, user };
+            await Promise.resolve(this.storage.setItem(this.storageKey, JSON.stringify(this.session))).catch(() => undefined);
+        }
+        return user;
+    }
+    /** Update the profile, password or (with confirmation) email. */
+    async updateUser(input) {
+        await this.ready;
+        await this.http.request({ method: "PATCH", path: "/auth/v1/user", body: input });
+        const user = await this.getUser();
+        this.emit("USER_UPDATED");
+        return user;
+    }
+    /** Send the confirmation email again. Always resolves the same way. */
+    async resendVerification(input) {
+        await this.http.request({
+            method: "POST",
+            path: "/auth/v1/verify/request",
+            body: { email: input.email, ...(input.redirectTo ? { redirect_to: input.redirectTo } : {}) },
+            auth: "none",
+        });
+    }
+    /** Confirm an address with the token from the email. Signs the user in. */
+    async verifyEmail(token) {
+        const wire = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/verify",
+            body: { token },
+            auth: "none",
+        });
+        const session = toSession(wire, undefined);
+        await this.store(session, "SIGNED_IN");
+        return session;
+    }
+    /** Confirm a new address with the token from the email. */
+    async confirmEmailChange(token) {
+        await this.http.request({ method: "POST", path: "/auth/v1/email/confirm", body: { token }, auth: "none" });
+        if (this.session)
+            await this.getUser().catch(() => undefined);
+    }
+    /** Email a password reset link. Always resolves the same way. */
+    async requestPasswordReset(input) {
+        await this.http.request({
+            method: "POST",
+            path: "/auth/v1/recover",
+            body: { email: input.email, ...(input.redirectTo ? { redirect_to: input.redirectTo } : {}) },
+            auth: "none",
+        });
+    }
+    /** Set a new password with the token from the reset email. Every other session is ended and this one is signed in. */
+    async resetPassword(input) {
+        const wire = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/recover/confirm",
+            body: { token: input.token, password: input.password },
+            auth: "none",
+        });
+        const session = toSession(wire, undefined);
+        await this.store(session, "SIGNED_IN");
+        return session;
+    }
+    // ── identities and organization context ───────────────────────────────
+    /** A URL that links a provider to the signed-in account when the browser visits it. */
+    async linkIdentityUrl(provider, options = {}) {
+        const result = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/identities/link",
+            query: { provider, redirect_to: options.redirectTo },
+        });
+        return result.url;
+    }
+    async unlinkIdentity(identityId) {
+        await this.http.request({ method: "DELETE", path: `/auth/v1/identities/${identityId}` });
+        if (this.session)
+            await this.getUser().catch(() => undefined);
+    }
+    async identities() {
+        return (await this.getUser()).identities;
+    }
+    /** Issue tokens for another organization the user belongs to (or `null` for none). */
+    switchOrg(slug) {
+        return this.refreshSession({ org: slug });
+    }
+    /** Wait `ms` (abortable). Handy in tests. */
+    pause(ms) {
+        return (0, util_js_1.sleep)(ms);
+    }
+}
+exports.AuthClient = AuthClient;
+class AuthMfa {
+    http;
+    refresh;
+    constructor(http, refresh) {
+        this.http = http;
+        this.refresh = refresh;
+    }
+    status() {
+        return this.http.request({ path: "/auth/v1/mfa" });
+    }
+    /** Start enrolling an authenticator app. Show `otpauth_uri` as a QR code, then call {@link verifyEnrollment}. */
+    enroll() {
+        return this.http.request({ method: "POST", path: "/auth/v1/mfa/totp/enroll" });
+    }
+    /** Confirm enrolment with a first code. Returns one-time recovery codes: show them once. */
+    async verifyEnrollment(code) {
+        const result = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/mfa/totp/verify",
+            body: { code },
+        });
+        await this.refresh().catch(() => undefined); // the session is now aal2
+        return result;
+    }
+    /** Start using emailed codes as a factor (a code is sent to the account's address). */
+    enrollEmail() {
+        return this.http.request({ method: "POST", path: "/auth/v1/mfa/email/enroll" });
+    }
+    /** Send the emailed code for a sign-in that is waiting on MFA. */
+    challenge(mfaToken) {
+        return this.http.request({ method: "POST", path: "/auth/v1/mfa/challenge", body: { mfa_token: mfaToken }, auth: "none" });
+    }
+    /** When the environment requires MFA, a sign-in is held until a factor is set up: start it (`totp` or `email`). */
+    startSetup(input) {
+        return this.http.request({ method: "POST", path: "/auth/v1/mfa/setup/start", body: { mfa_token: input.mfaToken, method: input.method }, auth: "none" });
+    }
+    /** Finish the required setup with a first code: the response carries the session and the recovery codes. */
+    completeSetup(input) {
+        return this.http.request({
+            method: "POST",
+            path: "/auth/v1/mfa/setup/complete",
+            body: { mfa_token: input.mfaToken, code: input.code, ...(input.org ? { org: input.org } : {}) },
+            auth: "none",
+        });
+    }
+    disable(code) {
+        return this.http.request({ method: "POST", path: "/auth/v1/mfa/disable", body: { code } });
+    }
+    /** Replace the recovery codes. Needs a current authenticator code. */
+    regenerateRecoveryCodes(code) {
+        return this.http.request({ method: "POST", path: "/auth/v1/mfa/recovery-codes", body: { code } });
+    }
+}
+const b64uToBytes = (value) => {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const raw = atob(padded);
+    const bytes = new Uint8Array(raw.length);
+    for (let i = 0; i < raw.length; i += 1)
+        bytes[i] = raw.charCodeAt(i);
+    return bytes.buffer;
+};
+const bytesToB64u = (buffer) => {
+    const bytes = buffer instanceof ArrayBuffer ? new Uint8Array(buffer) : new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+function webauthn() {
+    if (typeof navigator === "undefined" || !navigator.credentials || typeof PublicKeyCredential === "undefined") {
+        throw new errors_js_1.ConfigError("Passkeys need a browser that supports WebAuthn. On a server, use `requestRegistration` / `requestSignIn` and carry the credential yourself.");
+    }
+    return navigator.credentials;
+}
+/**
+ * Passkeys. In a browser, {@link register} and {@link signIn} do the whole ceremony. Anywhere else (a native app, a test), use the
+ * `request…` and `finish…` pairs: hand `options` to the platform's WebAuthn, and send what it returns (already encoded as the
+ * server expects) back with the `ticket`.
+ */
+class AuthPasskeys {
+    http;
+    adopt;
+    constructor(http, adopt) {
+        this.http = http;
+        this.adopt = adopt;
+    }
+    async list() {
+        const body = await this.http.request({ path: "/auth/v1/passkeys" });
+        return body.data;
+    }
+    async remove(passkeyId) {
+        await this.http.request({ method: "DELETE", path: `/auth/v1/passkeys/${encodeURIComponent(passkeyId)}` });
+    }
+    /** Begin adding a passkey to the signed-in account. */
+    requestRegistration() {
+        return this.http.request({ method: "POST", path: "/auth/v1/passkeys/register/options", body: {} });
+    }
+    /** Finish adding a passkey with the credential the device made. */
+    finishRegistration(input) {
+        return this.http.request({
+            method: "POST",
+            path: "/auth/v1/passkeys/register/verify",
+            body: { ticket: input.ticket, credential: input.credential, ...(input.name ? { name: input.name } : {}) },
+        });
+    }
+    /** Begin signing in with a passkey. With an email, only that account's passkeys are offered. */
+    requestSignIn(input = {}) {
+        return this.http.request({ method: "POST", path: "/auth/v1/passkeys/authenticate/options", body: input.email ? { email: input.email } : {}, auth: "none" });
+    }
+    /** Finish signing in with the credential the device made. */
+    async finishSignIn(input) {
+        const wire = await this.http.request({
+            method: "POST",
+            path: "/auth/v1/passkeys/authenticate/verify",
+            body: { ticket: input.ticket, credential: input.credential },
+            auth: "none",
+        });
+        return this.adopt(wire);
+    }
+    /** In a browser: ask the device to make a passkey and add it to the signed-in account. */
+    async register(input = {}) {
+        const credentials = webauthn();
+        const { ticket, options } = await this.requestRegistration();
+        const publicKey = {
+            ...options,
+            challenge: b64uToBytes(String(options.challenge)),
+            user: { ...options.user, id: new TextEncoder().encode(String(options.user.id)) },
+            excludeCredentials: (options.excludeCredentials ?? []).map((c) => ({ ...c, id: b64uToBytes(c.id) })),
+        };
+        const made = (await credentials.create({ publicKey }));
+        if (!made)
+            throw new errors_js_1.PawabaseError("No passkey was made.");
+        const response = made.response;
+        const result = await this.finishRegistration({
+            ticket,
+            ...(input.name ? { name: input.name } : {}),
+            credential: {
+                id: made.id,
+                rawId: bytesToB64u(made.rawId),
+                type: made.type,
+                response: {
+                    clientDataJSON: bytesToB64u(response.clientDataJSON),
+                    attestationObject: bytesToB64u(response.attestationObject),
+                    transports: typeof response.getTransports === "function" ? response.getTransports() : [],
+                },
+                clientExtensionResults: made.getClientExtensionResults(),
+            },
+        });
+        return result.passkey;
+    }
+    /** In a browser: ask the device for a passkey and sign in with it. */
+    async signIn(input = {}) {
+        const credentials = webauthn();
+        const { ticket, options } = await this.requestSignIn(input);
+        const publicKey = {
+            ...options,
+            challenge: b64uToBytes(String(options.challenge)),
+            allowCredentials: (options.allowCredentials ?? []).map((c) => ({ ...c, id: b64uToBytes(c.id) })),
+        };
+        const got = (await credentials.get({ publicKey }));
+        if (!got)
+            throw new errors_js_1.PawabaseError("No passkey was chosen.");
+        const response = got.response;
+        return this.finishSignIn({
+            ticket,
+            credential: {
+                id: got.id,
+                rawId: bytesToB64u(got.rawId),
+                type: got.type,
+                response: {
+                    clientDataJSON: bytesToB64u(response.clientDataJSON),
+                    authenticatorData: bytesToB64u(response.authenticatorData),
+                    signature: bytesToB64u(response.signature),
+                    userHandle: response.userHandle ? bytesToB64u(response.userHandle) : null,
+                },
+                clientExtensionResults: got.getClientExtensionResults(),
+            },
+        });
+    }
+}
+class AuthSessions {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    async list() {
+        return (await this.http.request({ path: "/auth/v1/sessions" })).data;
+    }
+    /** Sign one session out (a lost phone, another browser). */
+    async revoke(sessionId) {
+        await this.http.request({ method: "DELETE", path: `/auth/v1/sessions/${encodeURIComponent(sessionId)}` });
+    }
+    /** Recent sign-in activity for the account. */
+    async history() {
+        return (await this.http.request({ path: "/auth/v1/history" })).data;
+    }
+}
+class AuthDevices {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    async list() {
+        const body = await this.http.request({ path: "/auth/v1/user/devices" });
+        return body.data ?? [];
+    }
+    async forget(deviceId) {
+        await this.http.request({ method: "DELETE", path: `/auth/v1/user/devices/${encodeURIComponent(deviceId)}` });
+    }
+}
+class AuthApiKeys {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    async list() {
+        const body = await this.http.request({ path: "/auth/v1/user/api-keys" });
+        return body.data ?? [];
+    }
+    /** Make a key. The secret is in the answer once and never again. */
+    create(input) {
+        return this.http.request({
+            method: "POST",
+            path: "/auth/v1/user/api-keys",
+            body: { name: input.name, scopes: input.scopes ?? [], ...(input.expiresInDays ? { expires_in_days: input.expiresInDays } : {}), ...(input.org ? { org: input.org } : {}) },
+        });
+    }
+    async revoke(keyId) {
+        await this.http.request({ method: "DELETE", path: `/auth/v1/user/api-keys/${encodeURIComponent(keyId)}` });
+    }
+}
+class AuthOrgs {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    base(slug) {
+        return `/auth/v1/orgs/${encodeURIComponent(slug)}`;
+    }
+    async list() {
+        return (await this.http.request({ path: "/auth/v1/orgs" })).data;
+    }
+    create(input) {
+        return this.http.request({ method: "POST", path: "/auth/v1/orgs", body: input });
+    }
+    get(slug) {
+        return this.http.request({ path: this.base(slug) });
+    }
+    update(slug, input) {
+        return this.http.request({ method: "PATCH", path: this.base(slug), body: input });
+    }
+    async delete(slug) {
+        await this.http.request({ method: "DELETE", path: this.base(slug) });
+    }
+    async members(slug) {
+        return (await this.http.request({ path: `${this.base(slug)}/members` })).data;
+    }
+    setMemberRole(slug, userId, role) {
+        return this.http.request({ method: "PUT", path: `${this.base(slug)}/members/${encodeURIComponent(userId)}`, body: { role } });
+    }
+    async removeMember(slug, userId) {
+        await this.http.request({ method: "DELETE", path: `${this.base(slug)}/members/${encodeURIComponent(userId)}` });
+    }
+    invite(slug, input) {
+        return this.http.request({
+            method: "POST",
+            path: `${this.base(slug)}/invitations`,
+            body: {
+                email: input.email,
+                role: input.role ?? "member",
+                ...(input.redirectTo ? { redirect_to: input.redirectTo } : {}),
+            },
+        });
+    }
+    async invitations(slug) {
+        return (await this.http.request({ path: `${this.base(slug)}/invitations` })).data;
+    }
+    async revokeInvitation(slug, invitationId) {
+        await this.http.request({ method: "DELETE", path: `${this.base(slug)}/invitations/${invitationId}` });
+    }
+    /** Accept an invitation with the token from the email. The user must be signed in. */
+    acceptInvitation(token) {
+        return this.http.request({ method: "POST", path: "/auth/v1/invitations/accept", body: { token } });
+    }
+    async teams(slug) {
+        return (await this.http.request({ path: `${this.base(slug)}/teams` })).data;
+    }
+    createTeam(slug, input) {
+        return this.http.request({ method: "POST", path: `${this.base(slug)}/teams`, body: input });
+    }
+    async addTeamMember(slug, team, userId) {
+        await this.http.request({
+            method: "PUT",
+            path: `${this.base(slug)}/teams/${encodeURIComponent(team)}/members/${encodeURIComponent(userId)}`,
+        });
+    }
+    async removeTeamMember(slug, team, userId) {
+        await this.http.request({
+            method: "DELETE",
+            path: `${this.base(slug)}/teams/${encodeURIComponent(team)}/members/${encodeURIComponent(userId)}`,
+        });
+    }
+}
+//# sourceMappingURL=auth.js.map