@productcraft/auth 0.5.2 → 0.7.1

package/dist/index.js

@@ -763,11 +763,15 @@ function getApiKeyControllerListApiKeysUrl({
   const res = { method: "GET", url: `/v1/apps/${app_id}/api-keys` };
   return res;
 }
-async function apiKeyControllerListApiKeys({ appId }, config = {}) {
+async function apiKeyControllerListApiKeys({
+  appId,
+  params
+}, config = {}) {
   const { client: request = client, ...requestConfig } = config;
   const res = await request({
     method: "GET",
     url: getApiKeyControllerListApiKeysUrl({ appId }).url.toString(),
+    params,
     ...requestConfig
   });
   return res.data;
@@ -1029,7 +1033,9 @@ async function appAuditControllerGetAuditLogs({
     limit: params.limit,
     cursor: params.cursor,
     action: params.action,
-    actor_id: params.actorId
+    actor_id: params.actorId,
+    since: params.since,
+    until: params.until
   } : void 0;
   const res = await request({
     method: "GET",
@@ -1359,6 +1365,36 @@ async function consumerAuthControllerRequestPasswordReset({
   return res.data;
 }
 
+// src/_generated/clients/consumerAuth/consumerAuthControllerSendPasswordResetEmail.ts
+function getConsumerAuthControllerSendPasswordResetEmailUrl({
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/auth/send-password-reset-email`
+  };
+  return res;
+}
+async function consumerAuthControllerSendPasswordResetEmail({
+  appSlug,
+  data,
+  headers
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const requestData = data;
+  const res = await request({
+    method: "POST",
+    url: getConsumerAuthControllerSendPasswordResetEmailUrl({
+      appSlug
+    }).url.toString(),
+    data: requestData,
+    ...requestConfig,
+    headers: { ...headers, ...requestConfig.headers }
+  });
+  return res.data;
+}
+
 // src/_generated/clients/consumerAuth/consumerAuthControllerResetPassword.ts
 function getConsumerAuthControllerResetPasswordUrl({
   appSlug
@@ -1525,6 +1561,220 @@ async function consumerIdpControllerNativeSignIn({
   return res.data;
 }
 
+// src/_generated/clients/consumerAuth/consumerAuthControllerPasskeyOptions.ts
+function getConsumerAuthControllerPasskeyOptionsUrl({
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/auth/passkey/options`
+  };
+  return res;
+}
+async function consumerAuthControllerPasskeyOptions({
+  appSlug,
+  data
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const requestData = data;
+  const res = await request({
+    method: "POST",
+    url: getConsumerAuthControllerPasskeyOptionsUrl({ appSlug }).url.toString(),
+    data: requestData,
+    ...requestConfig
+  });
+  return res.data;
+}
+
+// src/_generated/clients/consumerAuth/consumerAuthControllerPasskeyVerify.ts
+function getConsumerAuthControllerPasskeyVerifyUrl({
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/auth/passkey/verify`
+  };
+  return res;
+}
+async function consumerAuthControllerPasskeyVerify({
+  appSlug,
+  data
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const requestData = data;
+  const res = await request({
+    method: "POST",
+    url: getConsumerAuthControllerPasskeyVerifyUrl({ appSlug }).url.toString(),
+    data: requestData,
+    ...requestConfig
+  });
+  return res.data;
+}
+
+// src/_generated/clients/consumerAuth/consumerAuthControllerMfaWebauthnOptions.ts
+function getConsumerAuthControllerMfaWebauthnOptionsUrl({
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/auth/mfa/webauthn/options`
+  };
+  return res;
+}
+async function consumerAuthControllerMfaWebauthnOptions({
+  appSlug,
+  data
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const requestData = data;
+  const res = await request({
+    method: "POST",
+    url: getConsumerAuthControllerMfaWebauthnOptionsUrl({
+      appSlug
+    }).url.toString(),
+    data: requestData,
+    ...requestConfig
+  });
+  return res.data;
+}
+
+// src/_generated/clients/consumerAuth/consumerAuthControllerMfaVerify.ts
+function getConsumerAuthControllerMfaVerifyUrl({
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/auth/mfa/verify`
+  };
+  return res;
+}
+async function consumerAuthControllerMfaVerify({
+  appSlug,
+  data
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const requestData = data;
+  const res = await request({
+    method: "POST",
+    url: getConsumerAuthControllerMfaVerifyUrl({ appSlug }).url.toString(),
+    data: requestData,
+    ...requestConfig
+  });
+  return res.data;
+}
+
+// src/_generated/clients/consumerMfa/consumerMfaControllerStartEnrollment.ts
+function getConsumerMfaControllerStartEnrollmentUrl({
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/me/mfa/factors`
+  };
+  return res;
+}
+async function consumerMfaControllerStartEnrollment({
+  appSlug,
+  data
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const requestData = data;
+  const res = await request({
+    method: "POST",
+    url: getConsumerMfaControllerStartEnrollmentUrl({ appSlug }).url.toString(),
+    data: requestData,
+    ...requestConfig
+  });
+  return res.data;
+}
+
+// src/_generated/clients/consumerMfa/consumerMfaControllerConfirmEnrollment.ts
+function getConsumerMfaControllerConfirmEnrollmentUrl({
+  id,
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/me/mfa/factors/${id}/verify`
+  };
+  return res;
+}
+async function consumerMfaControllerConfirmEnrollment({
+  id,
+  appSlug,
+  data
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const requestData = data;
+  const res = await request({
+    method: "POST",
+    url: getConsumerMfaControllerConfirmEnrollmentUrl({
+      id,
+      appSlug
+    }).url.toString(),
+    data: requestData,
+    ...requestConfig
+  });
+  return res.data;
+}
+
+// src/_generated/clients/consumerMfa/consumerMfaControllerStepUpWebauthnOptions.ts
+function getConsumerMfaControllerStepUpWebauthnOptionsUrl({
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/me/mfa/step-up/webauthn/options`
+  };
+  return res;
+}
+async function consumerMfaControllerStepUpWebauthnOptions({
+  appSlug
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const res = await request({
+    method: "POST",
+    url: getConsumerMfaControllerStepUpWebauthnOptionsUrl({
+      appSlug
+    }).url.toString(),
+    ...requestConfig
+  });
+  return res.data;
+}
+
+// src/_generated/clients/consumerMfa/consumerMfaControllerStepUp.ts
+function getConsumerMfaControllerStepUpUrl({
+  appSlug
+}) {
+  const app_slug = appSlug;
+  const res = {
+    method: "POST",
+    url: `/${app_slug}/v1/me/mfa/step-up`
+  };
+  return res;
+}
+async function consumerMfaControllerStepUp({
+  appSlug,
+  data
+}, config = {}) {
+  const { client: request = client, ...requestConfig } = config;
+  const requestData = data;
+  const res = await request({
+    method: "POST",
+    url: getConsumerMfaControllerStepUpUrl({ appSlug }).url.toString(),
+    data: requestData,
+    ...requestConfig
+  });
+  return res.data;
+}
+
 // src/_generated/clients/consumerVerify/consumerVerifyControllerVerify.ts
 function getConsumerVerifyControllerVerifyUrl({
   appSlug
@@ -1630,6 +1880,165 @@ async function consumerOAuthControllerClientCredentials({
   return res.data;
 }
 
+// src/passkeys.ts
+function toB64u(buf) {
+  const bytes = buf instanceof ArrayBuffer ? new Uint8Array(buf) : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromB64u(s) {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(b64.padEnd(Math.ceil(b64.length / 4) * 4, "="));
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+var snakeToCamel = (k) => k.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
+function camelizeKeys(value) {
+  if (Array.isArray(value)) return value.map(camelizeKeys);
+  if (value && typeof value === "object" && !(value instanceof Uint8Array)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[snakeToCamel(k)] = camelizeKeys(v);
+    }
+    return out;
+  }
+  return value;
+}
+function decodeOptions(publicKey) {
+  const pk = camelizeKeys(publicKey);
+  const out = {
+    ...pk,
+    challenge: fromB64u(pk.challenge)
+  };
+  if (pk.user) {
+    out.user = { ...pk.user, id: fromB64u(pk.user.id) };
+  }
+  for (const list of ["excludeCredentials", "allowCredentials"]) {
+    const entries = pk[list];
+    if (entries) {
+      out[list] = entries.map((c) => ({ ...c, id: fromB64u(c.id) }));
+    }
+  }
+  return out;
+}
+function encodeCredential(cred) {
+  const r = cred.response;
+  const response = {
+    clientDataJSON: toB64u(r.clientDataJSON)
+  };
+  if (r.attestationObject) response.attestationObject = toB64u(r.attestationObject);
+  if (r.authenticatorData) response.authenticatorData = toB64u(r.authenticatorData);
+  if (r.signature) response.signature = toB64u(r.signature);
+  if (r.userHandle) response.userHandle = toB64u(r.userHandle);
+  return { id: cred.id, response };
+}
+var PasskeyError = class extends Error {
+  code;
+  cause;
+  constructor(code, message, cause) {
+    super(message);
+    this.name = "PasskeyError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+function browserCredentials() {
+  const nav = globalThis.navigator;
+  const creds = nav?.credentials;
+  if (!creds || typeof creds.create !== "function" || typeof creds.get !== "function") {
+    return void 0;
+  }
+  return creds;
+}
+function isPasskeySupported() {
+  const g = globalThis;
+  if (typeof g.window === "undefined") return false;
+  if (typeof g.PublicKeyCredential !== "function") return false;
+  if (g.isSecureContext === false) return false;
+  return browserCredentials() !== void 0;
+}
+function mapDomError(err) {
+  const name = err?.name;
+  const message = err?.message ?? String(err);
+  switch (name) {
+    case "NotAllowedError":
+      return new PasskeyError(
+        "cancelled",
+        `Passkey prompt was cancelled, timed out, or no passkey matched: ${message}`,
+        err
+      );
+    case "InvalidStateError":
+      return new PasskeyError("invalid_state", `Authenticator refused: ${message}`, err);
+    case "SecurityError":
+      return new PasskeyError(
+        "security",
+        `Page origin does not match the app's rp_id: ${message}`,
+        err
+      );
+    case "AbortError":
+      return new PasskeyError("cancelled", `Passkey ceremony aborted: ${message}`, err);
+    case "TimeoutError":
+      return new PasskeyError(
+        "timeout",
+        `Passkey prompt timed out before a credential was produced: ${message}`,
+        err
+      );
+    default:
+      return new PasskeyError("unknown", `navigator.credentials failed: ${message}`, err);
+  }
+}
+function resolveCredentials(opts = {}) {
+  const creds = opts.credentials ?? browserCredentials();
+  if (!creds) {
+    throw new PasskeyError(
+      "unsupported",
+      "navigator.credentials is not available \u2014 passkeys need a browser with WebAuthn (check isPasskeySupported())"
+    );
+  }
+  return creds;
+}
+function isCredentialLike(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.id === "string" && !!v.response && typeof v.response === "object";
+}
+async function createPasskeyCredential(publicKey, opts = {}) {
+  const creds = resolveCredentials(opts);
+  let cred;
+  try {
+    cred = await creds.create({ publicKey: decodeOptions(publicKey), signal: opts.signal });
+  } catch (err) {
+    throw mapDomError(err);
+  }
+  if (!isCredentialLike(cred)) {
+    throw new PasskeyError(
+      "no_credential",
+      "navigator.credentials.create() returned no usable credential"
+    );
+  }
+  return encodeCredential(cred);
+}
+async function getPasskeyCredential(publicKey, opts = {}) {
+  const creds = resolveCredentials(opts);
+  let cred;
+  try {
+    cred = await creds.get({
+      publicKey: decodeOptions(publicKey),
+      mediation: opts.mediation,
+      signal: opts.signal
+    });
+  } catch (err) {
+    throw mapDomError(err);
+  }
+  if (!isCredentialLike(cred)) {
+    throw new PasskeyError(
+      "no_credential",
+      "navigator.credentials.get() returned no usable credential"
+    );
+  }
+  return encodeCredential(cred);
+}
+
 // src/jwt/errors.ts
 var JwtVerifyError = class extends Error {
   code;
@@ -1885,7 +2294,17 @@ var ConsumerScope = class {
       { client: this.client }
     ),
     /**
-     * PAK-required: caller must instantiate `Auth` with
+     * Mint a 6-digit password-reset code. **Sends no email.** Returns
+     * `{ code, expires_at }` for delivery via your own channel — or
+     * `{}` when the contact doesn't match a verified account (uniform
+     * shape — no account enumeration).
+     *
+     * If you want Mail to deliver the code for you, call
+     * {@link sendPasswordResetEmail} instead. Calling this one and
+     * discarding the `code` means the user never hears anything.
+     *
+     * PAK-required with `auth.user.password-reset.create`: caller must
+     * instantiate `Auth` with
      * `auth: { type: "apiKey", key: "pcft_live_..." }`. The
      * kubb-generated `headers.authorization` slot is a stub — the
      * HTTP client's auth middleware overrides whatever's passed.
@@ -1894,6 +2313,31 @@ var ConsumerScope = class {
       { appSlug: this.appSlug, data, headers: { authorization: "" } },
       { client: this.client }
     ),
+    /**
+     * Mint + dispatch a password-reset email via Mail in one call.
+     * Returns `{ expires_at }` on success; the plaintext code is NOT
+     * returned. Returns `{}` when the contact is missing or unverified
+     * (same enumeration defence as {@link requestReset}).
+     *
+     * This is the counterpart to {@link sendVerificationEmail} for the
+     * reset slot, and the method you want for a plain "forgot
+     * password" flow — {@link requestReset} only mints, it does not
+     * email.
+     *
+     * PAK-required with `auth.user.password-reset.send-email` —
+     * distinct permission from the bare mint so customers can enable
+     * mint without enabling outbound Mail traffic. Surfaces typed 412
+     * precondition errors (e.g. `ENVOI_NOT_ENABLED`,
+     * `ENVOI_TEMPLATE_NOT_CONFIGURED`) rather than failing silently.
+     */
+    sendPasswordResetEmail: (data) => consumerAuthControllerSendPasswordResetEmail(
+      {
+        appSlug: this.appSlug,
+        data,
+        headers: { authorization: "" }
+      },
+      { client: this.client }
+    ),
     resetPassword: (data) => consumerAuthControllerResetPassword(
       { appSlug: this.appSlug, data },
       { client: this.client }
@@ -2049,6 +2493,141 @@ var ConsumerScope = class {
     )
   };
   // ─────────────────────────────────────────────────────────────
+  // Passkeys — WebAuthn ceremonies, one call each. BROWSER ONLY at
+  // call time (they drive navigator.credentials); importing is safe
+  // anywhere. Base64url in both directions is handled here; the
+  // wire stays snake_case except the spec-fixed response members
+  // (clientDataJSON, attestationObject, authenticatorData, signature,
+  // userHandle), which travel verbatim.
+  // ─────────────────────────────────────────────────────────────
+  passkeys = {
+    /**
+     * Enrol a passkey as an MFA factor for the signed-in end-user.
+     * Requires the scope to carry the user's access token
+     * (`new Auth({ auth: { type: "bearer", token } })`).
+     *
+     * `POST /me/mfa/factors { type: "webauthn" }` →
+     * `navigator.credentials.create()` →
+     * `POST /me/mfa/factors/:id/verify { credential }`.
+     *
+     * Resolves with the now-enabled factor and the user's recovery
+     * codes — show those once, they are not retrievable later. The
+     * factor stays disabled until the verify call succeeds, so an
+     * abandoned prompt leaves nothing usable behind.
+     */
+    enroll: async (opts = {}) => {
+      const credentials = resolveCredentials(opts);
+      const start = await consumerMfaControllerStartEnrollment(
+        {
+          appSlug: this.appSlug,
+          data: { type: "webauthn", ...opts.label ? { label: opts.label } : {} }
+        },
+        { client: this.client }
+      );
+      const publicKey = start.enrollment.public_key;
+      const credential = await createPasskeyCredential(publicKey, { ...opts, credentials });
+      return await consumerMfaControllerConfirmEnrollment(
+        { appSlug: this.appSlug, id: start.factor.id, data: { credential } },
+        { client: this.client }
+      );
+    },
+    /**
+     * Passwordless sign-in with a discoverable passkey. No password,
+     * no email address: the authenticator finds its own passkey for
+     * the app's rp_id.
+     *
+     * `POST /auth/passkey/options {}` → `navigator.credentials.get()`
+     * → `POST /auth/passkey/verify { credential }`.
+     *
+     * Resolves with the session (`access_token`, `refresh_token`,
+     * …; `amr: ["webauthn"]`). Rejects with `PasskeyError`
+     * (`code: "cancelled"`) when the user dismisses the prompt or no
+     * passkey matches, and with `AuthHttpError` 401 for a forged,
+     * unknown, replayed or expired assertion — the server answers
+     * those uniformly on purpose.
+     *
+     * The options call deliberately takes no identifier (it would be
+     * an account-existence oracle); `tenant_id` is the only
+     * accepted body member and only matters for multi-tenant apps.
+     * Pass `mediation: "conditional"` for autofill-style UI.
+     */
+    signIn: async (opts = {}) => {
+      const credentials = resolveCredentials(opts);
+      const { public_key } = await consumerAuthControllerPasskeyOptions(
+        {
+          appSlug: this.appSlug,
+          data: opts.tenant_id ? { tenant_id: opts.tenant_id } : {}
+        },
+        { client: this.client }
+      );
+      const credential = await getPasskeyCredential(
+        public_key,
+        { ...opts, credentials }
+      );
+      return await consumerAuthControllerPasskeyVerify(
+        { appSlug: this.appSlug, data: { credential } },
+        { client: this.client }
+      );
+    },
+    /**
+     * Satisfy the MFA step of a password sign-in with a passkey.
+     * Call it when `auth.signin()` answered
+     * `{ mfa_required: true, mfa_token, factors }` and `factors`
+     * contains a `webauthn` entry.
+     *
+     * `POST /auth/mfa/webauthn/options { mfa_token }` →
+     * `navigator.credentials.get()` →
+     * `POST /auth/mfa/verify { mfa_token, credential }`.
+     *
+     * Resolves with the session (`amr: ["pwd", "webauthn"]`, fresh
+     * `mfa_at`). Possession of the `mfa_token` — a correct password
+     * — is the authority for the options call.
+     */
+    completeMfaChallenge: async (args) => {
+      const { mfa_token, ...browserOpts } = args;
+      const credentials = resolveCredentials(browserOpts);
+      const { public_key } = await consumerAuthControllerMfaWebauthnOptions(
+        { appSlug: this.appSlug, data: { mfa_token } },
+        { client: this.client }
+      );
+      const credential = await getPasskeyCredential(
+        public_key,
+        { ...browserOpts, credentials }
+      );
+      return await consumerAuthControllerMfaVerify(
+        { appSlug: this.appSlug, data: { mfa_token, credential } },
+        { client: this.client }
+      );
+    },
+    /**
+     * Re-confirm the signed-in user's identity inside a live session
+     * (before a sensitive action). Requires the scope to carry the
+     * user's access token.
+     *
+     * `POST /me/mfa/step-up/webauthn/options` →
+     * `navigator.credentials.get()` →
+     * `POST /me/mfa/step-up { credential }`.
+     *
+     * Resolves with `{ amr, mfa_at }`. A passkey assertion is never
+     * tried as a recovery code, so a failed step-up never burns one.
+     */
+    stepUp: async (opts = {}) => {
+      const credentials = resolveCredentials(opts);
+      const { public_key } = await consumerMfaControllerStepUpWebauthnOptions(
+        { appSlug: this.appSlug },
+        { client: this.client }
+      );
+      const credential = await getPasskeyCredential(
+        public_key,
+        { ...opts, credentials }
+      );
+      return await consumerMfaControllerStepUp(
+        { appSlug: this.appSlug, data: { credential } },
+        { client: this.client }
+      );
+    }
+  };
+  // ─────────────────────────────────────────────────────────────
   // OAuth M2M — client_credentials grant for service-to-service tokens
   // ─────────────────────────────────────────────────────────────
   oauth = {
@@ -2067,9 +2646,9 @@ function getAppControllerListMyAppsUrl() {
 async function appControllerListMyApps({ params } = {}, config = {}) {
   const { client: request = client, ...requestConfig } = config;
   const mappedParams = params ? {
+    workspace_id: params.workspaceId,
     limit: params.limit,
-    cursor: params.cursor,
-    workspace_id: params.workspaceId
+    cursor: params.cursor
   } : void 0;
   const res = await request({
     method: "GET",
@@ -2192,6 +2771,6 @@ var Auth = class {
   };
 };
 
-export { AUTH_LEGACY_ISSUER, AppScope, Auth, AuthHttpError, ConsumerScope, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtVerifyError, verifyAuthToken };
+export { AUTH_LEGACY_ISSUER, AppScope, Auth, AuthHttpError, ConsumerScope, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtVerifyError, PasskeyError, createPasskeyCredential, decodeOptions, encodeCredential, fromB64u, getPasskeyCredential, isPasskeySupported, toB64u, verifyAuthToken };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map