@protobase/client 0.4.1 → 0.6.0

package/dist/account-security.d.ts

@@ -47,6 +47,14 @@ export declare const accountSecurity: (client: BetterAuthClient) => {
   /** Turns on two-factor authentication with a code emailed at each sign-in. */
   turnOnEmailedCodes: (password?: string) => Promise<void>;
   turnOffTwoFactor: (password?: string) => Promise<void>;
+  /** The ids of the sign-in providers the account is linked to, for example `github`. */
+  linkedProviders: () => Promise<string[]>;
+  /**
+   * Starts linking the account to a provider such as `github`, whatever address the provider has: resolves with the
+   * provider's authorization URL, for the page to go to. The provider sends the browser back to `callbackURL`, with
+   * `?error=<code>` when the link did not go through, for example `account_already_linked_to_different_user`.
+   */
+  linkProvider: (provider: string, callbackURL: string) => Promise<string>;
   /** New backup codes for the authenticator app; the old ones stop working. */
   newBackupCodes: (password?: string) => Promise<string[]>;
 };

package/dist/account-security.js

@@ -64,6 +64,27 @@ const accountSecurity = (client) => ({
 		const { error } = await client.twoFactor.disable(password ? { password } : {});
 		if (error) throw authError(error, "Could not turn off two-factor authentication");
 	},
+	/** The ids of the sign-in providers the account is linked to, for example `github`. */
+	linkedProviders: async () => {
+		const { data, error } = await client.listAccounts();
+		if (error || !data) throw authError(error, "Could not read your linked accounts");
+		return [...new Set(data.map((account) => account.providerId).filter((provider) => provider !== "credential"))];
+	},
+	/**
+	* Starts linking the account to a provider such as `github`, whatever address the provider has: resolves with the
+	* provider's authorization URL, for the page to go to. The provider sends the browser back to `callbackURL`, with
+	* `?error=<code>` when the link did not go through, for example `account_already_linked_to_different_user`.
+	*/
+	linkProvider: async (provider, callbackURL) => {
+		const { data, error } = await client.linkSocial({
+			provider,
+			callbackURL,
+			errorCallbackURL: callbackURL,
+			disableRedirect: true
+		});
+		if (error || !data?.url) throw authError(error, "Could not start linking the account");
+		return data.url;
+	},
 	/** New backup codes for the authenticator app; the old ones stop working. */
 	newBackupCodes: async (password) => {
 		const { data, error } = await client.twoFactor.generateBackupCodes(password ? { password } : {});

package/dist/assistant.d.ts

@@ -25,6 +25,12 @@ export type AssistantClient = {
   send: (text: string, page?: string) => Promise<void>;
   /** Sends a click on a card's button; the backend answers with events. Rejects with `ApiError`. */
   act: (partId: string, actionId: string) => Promise<void>;
+  /**
+   * Calls the backend beyond the protocol, such as a widget reading what it shows: `path` resolves against the
+   * backend's URL and is refused, before any request, when it lands on another origin, so the user's token goes only
+   * to the backend. Sends the token like every request; rejects with `ApiError` on an answer that is not 2xx.
+   */
+  fetch: (path: string, init?: RequestInit) => Promise<Response>;
 };
 /** A client of an assistant backend: the protocol's event stream and its two requests, with the user's token. */
 export declare const createAssistantClient: (options: AssistantClientOptions) => AssistantClient;

package/dist/assistant.js

@@ -9,6 +9,14 @@ const pause = (ms, signal) => new Promise((resolve) => {
 		resolve();
 	}, { once: true });
 });
+const sameOrigin = "http://same-origin.invalid";
+/** The URL `path` names on the backend at `base`, or an error when it is on another origin. */
+const backendUrl = (base, path) => {
+	const backend = new URL(base, sameOrigin);
+	const url = new URL(path, `${backend.href}/`);
+	if (url.origin !== backend.origin) throw new Error(`${path} is not on the assistant backend's origin`);
+	return backend.origin === sameOrigin ? `${url.pathname}${url.search}` : url.href;
+};
 /** A client of an assistant backend: the protocol's event stream and its two requests, with the user's token. */
 const createAssistantClient = (options) => {
 	const base = options.url.replace(/\/+$/, "");
@@ -76,6 +84,18 @@ const createAssistantClient = (options) => {
 					actionId
 				}
 			});
+		},
+		fetch: async (path, init = {}) => {
+			const url = backendUrl(base, path);
+			const token = await options.token();
+			const headers = new Headers(init.headers);
+			if (token) headers.set("authorization", `Bearer ${token}`);
+			const response = await doFetch(url, {
+				...init,
+				headers
+			});
+			if (!response.ok) throw await readProblem(response);
+			return response;
 		}
 	};
 };

package/dist/auth-types.d.ts

@@ -17,16 +17,23 @@ export type SignInResult = {
   kind: 'two-factor';
   methods: TwoFactorMethod[];
 };
+/** The sign-in provider the platform adds to the app: its id, as in `socialProviders`, and the name to show. */
+export type PlatformSignIn = {
+  provider: string;
+  name: string;
+};
 /**
  * `needsAdmin` while no user exists yet; `signInMethods` the ways to sign in the server's policy leaves on;
  * `passwordReset` when the server can email reset links; `socialProviders` the ids of the sign-in providers, for example
- * `github`; `staffSignIn` the operator provider's name when its staff can sign in as people.
+ * `github`; `platformSignIn` the one of them the platform adds; `staffSignIn` the operator provider's name when its staff
+ * can sign in as people.
  */
 export type SetupStatus = {
   needsAdmin: boolean;
   signInMethods: SignInMethod[];
   passwordReset: boolean;
   socialProviders: string[];
+  platformSignIn?: PlatformSignIn;
   staffSignIn?: string;
 };
 //#endregion

package/dist/auth.d.ts

@@ -26,7 +26,8 @@ export declare const tokenExpiry: (token: string) => number;
 export declare const createAuthSession: (options?: AuthSessionOptions) => {
   /**
    * Starts sign-in with a provider such as `github`: resolves with the provider's authorization URL, for the page to go to.
-   * The provider sends the browser back to `callbackURL` signed in, or with `?error=<code>`.
+   * The provider sends the browser back to `callbackURL` signed in, or with `?error=<code>`, for example
+   * `signup_disabled` when no account here has that provider account or its address.
    */
   signInSocial: (provider: string, callbackURL: string) => Promise<string>;
   signOut: () => Promise<void>;
@@ -47,6 +48,8 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
     confirmAuthenticatorApp: (code: string) => Promise<void>;
     turnOnEmailedCodes: (password?: string) => Promise<void>;
     turnOffTwoFactor: (password?: string) => Promise<void>;
+    linkedProviders: () => Promise<string[]>;
+    linkProvider: (provider: string, callbackURL: string) => Promise<string>;
     newBackupCodes: (password?: string) => Promise<string[]>;
   };
   signInPolicy: {

package/dist/auth.js

@@ -71,6 +71,7 @@ const createAuthSession = (options = {}) => {
 				signInMethods: body.signInMethods ?? ["password"],
 				passwordReset: Boolean(body.passwordReset),
 				socialProviders: body.socialProviders ?? [],
+				...body.platformSignIn && { platformSignIn: body.platformSignIn },
 				...body.staffSignIn && { staffSignIn: body.staffSignIn }
 			};
 		},
@@ -82,7 +83,8 @@ const createAuthSession = (options = {}) => {
 		...signInFlows(client, () => token({ refresh: true })),
 		/**
 		* Starts sign-in with a provider such as `github`: resolves with the provider's authorization URL, for the page to go to.
-		* The provider sends the browser back to `callbackURL` signed in, or with `?error=<code>`.
+		* The provider sends the browser back to `callbackURL` signed in, or with `?error=<code>`, for example
+		* `signup_disabled` when no account here has that provider account or its address.
 		*/
 		signInSocial: async (provider, callbackURL) => {
 			const { data, error } = await client.signIn.social({

package/dist/index.d.ts

@@ -6,10 +6,10 @@ import { ApiError, PreconditionFailedError, ProblemDetails, ProblemError, isApiE
 import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffAccessRule } from "./sign-in-policy.js";
 import { AccountSecurity, AccountSignIn, AuthenticatorSetup, Passkey, RequiredSetup } from "./account-security.js";
 import { StaffSignIn, StaffSignInClient } from "./staff-sign-in.js";
-import { AuthUser, SetupStatus, SignInMethod, SignInResult, TwoFactorMethod } from "./auth-types.js";
+import { AuthUser, PlatformSignIn, SetupStatus, SignInMethod, SignInResult, TwoFactorMethod } from "./auth-types.js";
 import { AuthError } from "./auth-error.js";
 import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from "./auth.js";
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimePolicy, RuntimeStatus, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type Facet, type FilterInput, type Histogram, type HistogramBucket, type ListPage, type ListParams, type Meta, type MetaResult, type Passkey, PreconditionFailedError, type ProblemDetails, type ProblemError, type RecordOf, type RecordPermissions, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RuntimeClient, type RuntimeClientOptions, type RuntimePolicy, type RuntimeStatus, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type TwoFactorMethod, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type Facet, type FilterInput, type Histogram, type HistogramBucket, type ListPage, type ListParams, type Meta, type MetaResult, type Passkey, type PlatformSignIn, PreconditionFailedError, type ProblemDetails, type ProblemError, type RecordOf, type RecordPermissions, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RuntimeClient, type RuntimeClientOptions, type RuntimePolicy, type RuntimeStatus, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type TwoFactorMethod, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, tokenExpiry };

package/dist/sign-in-policy.d.ts

@@ -5,8 +5,8 @@ export type SignInRule = 'allowed' | 'required' | 'forbidden';
 export type StaffAccessRule = 'allowed' | 'notify' | 'forbidden';
 /**
  * How people may sign in, as the server stores it: passwords and emailed codes are allowed or forbidden, passkeys and
- * two-factor authentication can also be required (everyone without one is asked to set it up), and staff of the
- * operator may sign in as people, with or without telling them, or not.
+ * two-factor authentication can also be required (everyone without one is asked to set it up), staff of the operator
+ * may sign in as people, with or without telling them, or not, and the sign-in provider the platform adds is on or off.
  */
 export type SignInPolicy = {
   password: 'allowed' | 'forbidden';
@@ -14,17 +14,20 @@ export type SignInPolicy = {
   passkey: SignInRule;
   twoFactor: SignInRule;
   staffAccess: StaffAccessRule;
+  platformSignIn: 'allowed' | 'forbidden';
 };
 /**
  * The saved policy, how it applies (`effective`: emailed codes need mail, and without mail passwords stay on and staff
- * who would have to tell the person cannot sign in), the name of the operator provider when staff can sign in at all,
- * and who saved it when.
+ * who would have to tell the person cannot sign in; the platform's provider is off while a second step is required), the
+ * name of the operator provider when staff can sign in at all, the name of the platform's sign-in provider when it adds
+ * one, and who saved it when.
  */
 export type SignInPolicyState = {
   policy: SignInPolicy;
   effective: SignInPolicy;
   mail: boolean;
   operator?: string;
+  platformSignIn?: string;
   savedAt?: string;
   savedBy?: string;
 };

package/dist/static-session.js

@@ -45,7 +45,8 @@ const createStaticSession = (token, user = {
 				emailCode: "allowed",
 				passkey: "allowed",
 				twoFactor: "allowed",
-				staffAccess: "allowed"
+				staffAccess: "allowed",
+				platformSignIn: "allowed"
 			},
 			mail: false,
 			account: {
@@ -64,7 +65,9 @@ const createStaticSession = (token, user = {
 		confirmAuthenticatorApp: unsupported("turn on two-factor authentication"),
 		turnOnEmailedCodes: unsupported("turn on two-factor authentication"),
 		turnOffTwoFactor: unsupported("turn off two-factor authentication"),
-		newBackupCodes: unsupported("make backup codes")
+		newBackupCodes: unsupported("make backup codes"),
+		linkedProviders: async () => [],
+		linkProvider: unsupported("link a sign-in provider")
 	},
 	signInPolicy: {
 		read: unsupported("read the sign-in policy"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,8 +30,8 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.4.1",
-    "@protobase/schema": "0.4.1",
+    "@protobase/layout": "0.6.0",
+    "@protobase/schema": "0.6.0",
     "better-auth": "^1.7.7"
   }
 }