@plitzi/sdk-auth 0.33.2 → 0.34.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @plitzi/sdk-auth
 
+## 0.34.0
+
+### Minor Changes
+
+- v0.34.0
+
+### Patch Changes
+
+- Updated dependencies [5aceda0]
+- Updated dependencies
+- Updated dependencies [5aceda0]
+  - @plitzi/sdk-shared@0.34.0
+  - @plitzi/sdk-navigation@0.34.0
+  - @plitzi/sdk-schema@0.34.0
+
 ## 0.33.2
 
 ### Patch Changes

package/dist/AuthContextProvider.mjs

@@ -1,5 +1,5 @@
-import e from "./hooks/useAuth/index.mjs";
-import { AuthContext as t } from "./AuthContext.mjs";
+import { AuthContext as e } from "./AuthContext.mjs";
+import t from "./hooks/useAuth/index.mjs";
 import { use as n, useMemo as r, useRef as i } from "react";
 import { QueryBuilderEvaluator as a } from "@plitzi/plitzi-ui/QueryBuilder";
 import o from "@plitzi/sdk-navigation/hooks/useNavigation";
@@ -65,7 +65,7 @@ var f = [
 		E,
 		b,
 		y
-	]), { manager: O, loading: k, authenticated: A, state: j, bootstrapUser: M, bootstrapToken: N, peekedUser: P, peekedToken: F } = e({
+	]), { manager: O, loading: k, authenticated: A, state: j, bootstrapUser: M, bootstrapToken: N, peekedUser: P, peekedToken: F } = t({
 		server: h,
 		isHydrating: _,
 		provider: b.userProvider ?? "",
@@ -93,7 +93,7 @@ var f = [
 		g,
 		B
 	]);
-	return /* @__PURE__ */ d(t, {
+	return /* @__PURE__ */ d(e, {
 		value: V,
 		children: !k && m
 	});

package/dist/AuthManager.d.ts

@@ -1,6 +1,6 @@
 import { default as AuthProvider, AuthBootstrap, AuthEventListener } from './AuthProvider';
 import { AuthProviderSettings } from './types';
-import { AuthFailureReason, AuthState, TokenResult } from '@plitzi/sdk-shared';
+import { AuthFailureReason, AuthState, LoginResult, TokenResult } from '@plitzi/sdk-shared';
 export type AuthProviderFactory<U = Record<string, unknown>> = (settings: AuthProviderSettings) => AuthProvider<U>;
 /**
  * Adds an auth provider a space can then select by name in its settings. Spaces run against whichever backend their
@@ -52,7 +52,8 @@ export declare class AuthManager<U = Record<string, unknown>> {
      * disagrees.
      */
     init(bootstrap?: AuthBootstrap<U>): Promise<void>;
-    login(...args: Parameters<AuthProvider<U>['login']>): Promise<TokenResult | undefined>;
+    /** With no provider there is nothing to sign in against, which is a refusal like any other — and has to say so. */
+    login(...args: Parameters<AuthProvider<U>['login']>): Promise<LoginResult>;
     refresh(): Promise<TokenResult | undefined>;
     revalidate(force?: boolean): Promise<boolean>;
     invalidate(reason?: AuthFailureReason): void;

package/dist/AuthManager.mjs

@@ -42,7 +42,10 @@ var t = /* @__PURE__ */ new Map([["basic", (t) => new e(t)]]), n = (e, n) => {
 		return this.provider.init(e);
 	}
 	login(...e) {
-		return this.provider?.login(...e) ?? Promise.resolve(void 0);
+		return this.provider?.login(...e) ?? Promise.resolve({
+			ok: !1,
+			reason: "missing"
+		});
 	}
 	refresh() {
 		return this.provider?.refresh() ?? Promise.resolve(void 0);

package/dist/AuthProvider.d.ts

@@ -1,4 +1,4 @@
-import { AuthFailureReason, AuthResult, AuthState, Schema, TokenResult } from '@plitzi/sdk-shared';
+import { AuthFailureReason, AuthResult, AuthState, LoginResult, Schema, TokenResult } from '@plitzi/sdk-shared';
 /** Why a state changed. Not control flow — it is what makes an auth trace readable, and every transition below
  *  names one, because "it went to guest" is not a diagnosis and "the hint cookie was gone" is. */
 export type AuthStateReason = 'bootstrap' | 'restored' | 'granted' | 'renewed' | 'identity' | 'redirect' | 'exchanged' | 'no-provider' | 'skip-auth' | 'hint-missing' | 'no-evidence' | 'signed-out' | 'another-tab' | 'settled' | 'authenticating';
@@ -121,7 +121,15 @@ declare abstract class AuthProvider<U = Record<string, unknown>> {
     private decide;
     /** Drops timers and window listeners. Called when the provider is replaced, so a re-configured space leaves none behind. */
     dispose(): void;
-    login(params: Record<string, unknown>): Promise<TokenResult | undefined>;
+    /**
+     * Resolves to WHY when it does not resolve to a session.
+     *
+     * It used to resolve to `undefined` for every refusal there is, which left the one screen that has to explain
+     * itself — a sign-in form — with a single sentence to cover a wrong password, an address that has never been
+     * confirmed, a blocked account and a backend that could not be reached. Three quarters of the time it was telling
+     * somebody to check credentials that were perfectly correct.
+     */
+    login(params: Record<string, unknown>): Promise<LoginResult>;
     /**
      * A credential obtained in the browser — by a client-side identity provider, or by a redirect coming back from
      * one — is unknown to the server that renders the pages. It therefore renders every one of them as a guest while
@@ -130,6 +138,9 @@ declare abstract class AuthProvider<U = Record<string, unknown>> {
      * Handing the credential over closes that gap: the server verifies it with the provider and establishes its own
      * session, cookie and all, so the next server-rendered page already knows. Providers whose grants came from that
      * same server return undefined here and nothing happens.
+     *
+     * Answers with the reason when it ended the session, so the caller can say which refusal this was rather than
+     * inferring one from the state it is left in.
      */
     private handOffToServer;
     refresh(): Promise<TokenResult | undefined>;

package/dist/AuthProvider.mjs

@@ -128,14 +128,29 @@ var s = 60, c = 300, l = 2147483647, u = class {
 	async login(e) {
 		this.setState("authenticating", "authenticating");
 		let t = await this.requestLogin(e);
-		if (!t.ok) {
-			this.endSession(t.reason);
-			return;
-		}
-		if (this.adopt(t), await this.handOffToServer(), this.state !== "guest") return !this.session.user && this.capabilities.identity && await this.loadIdentity(), this.emit({
+		if (!t.ok) return this.endSession(t.reason), {
+			ok: !1,
+			reason: t.reason
+		};
+		this.adopt(t);
+		let n = await this.handOffToServer();
+		return n ? {
+			ok: !1,
+			reason: n
+		} : (!this.session.user && this.capabilities.identity && await this.loadIdentity(), this.state === "authenticated" ? (this.emit({
 			type: "login",
 			token: this.session.token
-		}), this.session.token;
+		}), {
+			ok: !0,
+			...this.session.token ?? {
+				accessToken: "",
+				expiresAt: null,
+				refreshToken: null
+			}
+		}) : {
+			ok: !1,
+			reason: "inactive"
+		});
 	}
 	async handOffToServer() {
 		let e = await this.requestExchange();
@@ -148,7 +163,7 @@ var s = 60, c = 300, l = 2147483647, u = class {
 				this.offline = !0;
 				return;
 			}
-			this.endSession(e.reason);
+			return this.endSession(e.reason), e.reason;
 		}
 	}
 	async refresh() {
@@ -230,7 +245,9 @@ var s = 60, c = 300, l = 2147483647, u = class {
 		return n() - this.session.validatedAt < this.revalidateSeconds;
 	}
 	hasEvidence() {
-		return this.session.token?.accessToken || this.session.token?.refreshToken ? !0 : !!e(this.hintCookie);
+		if (this.session.token?.accessToken || this.session.token?.refreshToken) return !0;
+		let t = e(this.hintCookie);
+		return t?.refreshExpiresAt !== void 0 && t.refreshExpiresAt <= n() ? !1 : !!t;
 	}
 	scheduleRenewal() {
 		clearTimeout(this.renewalTimer), this.renewalTimer = void 0;

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { readSessionHint as e } from "./helpers/sessionHint.mjs";
-import { nowInSeconds as t, tokenExpiresAt as n } from "./helpers/tokenClaims.mjs";
-import r from "./AuthProvider.mjs";
-import { AuthManager as i, getAuthProviderNames as a, registerAuthProvider as o } from "./AuthManager.mjs";
-import s from "./hooks/useAuth/index.mjs";
-import { AuthContext as c } from "./AuthContext.mjs";
+import { AuthContext as e } from "./AuthContext.mjs";
+import { readSessionHint as t } from "./helpers/sessionHint.mjs";
+import { nowInSeconds as n, tokenExpiresAt as r } from "./helpers/tokenClaims.mjs";
+import i from "./AuthProvider.mjs";
+import { AuthManager as a, getAuthProviderNames as o, registerAuthProvider as s } from "./AuthManager.mjs";
+import c from "./hooks/useAuth/index.mjs";
 import l from "./AuthContextProvider.mjs";
-export { c as AuthContext, l as AuthContextProvider, i as AuthManager, r as AuthProvider, a as getAuthProviderNames, t as nowInSeconds, e as readSessionHint, o as registerAuthProvider, n as tokenExpiresAt, s as useAuth };
+export { e as AuthContext, l as AuthContextProvider, a as AuthManager, i as AuthProvider, o as getAuthProviderNames, n as nowInSeconds, t as readSessionHint, s as registerAuthProvider, r as tokenExpiresAt, c as useAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-auth",
-  "version": "0.33.2",
+  "version": "0.34.0",
   "license": "AGPL-3.0",
   "files": [
     "dist"
@@ -75,15 +75,15 @@
     "build:prod": "vite build && node ../sdk-shared/scripts/generate-exports.mjs"
   },
   "dependencies": {
-    "@plitzi/plitzi-ui": "^1.6.20",
-    "@plitzi/sdk-navigation": "0.33.2",
-    "@plitzi/sdk-schema": "0.33.2",
-    "@plitzi/sdk-shared": "0.33.2"
+    "@plitzi/plitzi-ui": "^1.6.21",
+    "@plitzi/sdk-navigation": "0.34.0",
+    "@plitzi/sdk-schema": "0.34.0",
+    "@plitzi/sdk-shared": "0.34.0"
   },
   "devDependencies": {
     "eslint": "^9.39.5",
     "typescript": "^6.0.3",
-    "vite": "^8.2.1",
-    "vitest": "^4.1.10"
+    "vite": "^8.3.0",
+    "vitest": "^5.0.0"
   }
 }