@protobase/client 0.9.0 → 0.10.0

package/dist/auth-types.d.ts

@@ -35,6 +35,11 @@ export type SetupStatus = {
   socialProviders: string[];
   platformSignIn?: PlatformSignIn;
   staffSignIn?: string;
+  /**
+   * When people have passkeys made for more than one of the app's domains: those domains, the one new passkeys are made
+   * for first. A passkey sign-in asks for one at a time (see `signInWithPasskey`).
+   */
+  passkeyDomains?: string[];
   /** With organizations: who may create them, and every role with its label, `membership` for those a member can hold. */
   organizations?: {
     create: 'admins' | 'everyone';

package/dist/auth.d.ts

@@ -1,6 +1,7 @@
 import { SignInPolicy, SignInPolicyState } from "./sign-in-policy.js";
 import { AccountSignIn, AuthenticatorSetup, Passkey } from "./account-security.js";
 import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole } from "./organizations.js";
+import { ActiveRole } from "./roles.js";
 import { StaffSignIn } from "./staff-sign-in.js";
 import { AuthUser, SetupStatus, SignInResult, TwoFactorMethod } from "./auth-types.js";
 import { AuthError } from "./auth-error.js";
@@ -22,7 +23,7 @@ export declare const tokenExpiry: (token: string) => number;
  * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
  * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
  * sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), organizations
- * (`organizations`), and a short-lived
+ * (`organizations`), the role the session acts with (`roles`), and a short-lived
  * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
  */
 export declare const createAuthSession: (options?: AuthSessionOptions) => {
@@ -92,6 +93,10 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
       password?: string;
     }) => Promise<unknown>;
   };
+  roles: {
+    current: () => Promise<ActiveRole>;
+    switchTo: (role: string) => Promise<void>;
+  };
   signInPolicy: {
     read: () => Promise<SignInPolicyState>;
     save: (policy: SignInPolicy) => Promise<SignInPolicyState>;
@@ -109,7 +114,7 @@ export declare const createAuthSession: (options?: AuthSessionOptions) => {
   signIn: (email: string, password: string) => Promise<SignInResult>;
   sendSignInCode: (email: string) => Promise<void>;
   signInWithCode: (email: string, code: string) => Promise<SignInResult>;
-  signInWithPasskey: () => Promise<AuthUser>;
+  signInWithPasskey: (domain?: string) => Promise<AuthUser>;
   sendTwoFactorCode: () => Promise<void>;
   verifyTwoFactor: ({ method, code, trustDevice }: {
     method: TwoFactorMethod | "backup";

package/dist/auth.js

@@ -2,6 +2,7 @@ import { AuthError, authError } from "./auth-error.js";
 import { accountSecurity } from "./account-security.js";
 import { betterAuthClient } from "./better-auth-client.js";
 import { organizationsClient } from "./organizations.js";
+import { rolesClient } from "./roles.js";
 import { signInFlows } from "./sign-in-flows.js";
 import { signInPolicyClient } from "./sign-in-policy.js";
 import { staffSignInClient } from "./staff-sign-in.js";
@@ -18,7 +19,7 @@ const tokenExpiry = (token) => {
 * The browser side of Better Auth: sign in with a password, an emailed code or a passkey (with a second step for an
 * account with two-factor authentication), the account's passkeys and two-factor authentication (`account`), the
 * sign-in policy for admins (`signInPolicy`), staff of the operator signing in as people (`staff`), organizations
-* (`organizations`), and a short-lived
+* (`organizations`), the role the session acts with (`roles`), and a short-lived
 * JWT held in memory only (never in storage), fetched with the session cookie and refreshed before it expires.
 */
 const createAuthSession = (options = {}) => {
@@ -75,6 +76,7 @@ const createAuthSession = (options = {}) => {
 				socialProviders: body.socialProviders ?? [],
 				...body.platformSignIn && { platformSignIn: body.platformSignIn },
 				...body.staffSignIn && { staffSignIn: body.staffSignIn },
+				...body.passkeyDomains && { passkeyDomains: body.passkeyDomains },
 				...body.organizations && { organizations: body.organizations }
 			};
 		},
@@ -124,6 +126,7 @@ const createAuthSession = (options = {}) => {
 		},
 		account: accountSecurity(client),
 		organizations: organizationsClient(client, () => token({ refresh: true })),
+		roles: rolesClient(client, () => token({ refresh: true })),
 		signInPolicy: signInPolicyClient(client),
 		staff: {
 			...staff,

package/dist/index.d.ts

@@ -7,6 +7,7 @@ import { ApiError, PreconditionFailedError, ProblemDetails, ProblemError, isApiE
 import { SignInPolicy, SignInPolicyClient, SignInPolicyState, SignInRule, StaffAccessRule } from "./sign-in-policy.js";
 import { AccountSecurity, AccountSignIn, AuthenticatorSetup, Passkey, RequiredSetup } from "./account-security.js";
 import { CurrentOrganization, InvitationPreview, InvitationSent, Organization, OrganizationInvitation, OrganizationMember, OrganizationRole, OrganizationsClient } from "./organizations.js";
+import { ActiveRole, RoleOption, RolesClient } from "./roles.js";
 import { StaffSignIn, StaffSignInClient } from "./staff-sign-in.js";
 import { AuthUser, PlatformSignIn, RoleLabel, SetupStatus, SignInMethod, SignInResult, TwoFactorMethod } from "./auth-types.js";
 import { AuthError } from "./auth-error.js";
@@ -14,4 +15,4 @@ import { AuthSession, AuthSessionOptions, createAuthSession, tokenExpiry } from
 import { createStaticSession } from "./static-session.js";
 import { AssistantClient, AssistantClientOptions, AssistantConnection, createAssistantClient } from "./assistant.js";
 import { RuntimeClient, RuntimeClientOptions, RuntimePolicy, RuntimeStatus, createRuntimeClient } from "./runtime.js";
-export { type AccountSecurity, type AccountSignIn, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CurrentOrganization, type Facet, type FilterInput, type Histogram, type HistogramBucket, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type Passkey, type PlatformSignIn, PreconditionFailedError, type ProblemDetails, type ProblemError, type RecordOf, type RecordPermissions, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RuntimeClient, type RuntimeClientOptions, type RuntimePolicy, type RuntimeStatus, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, tokenExpiry };
+export { type AccountSecurity, type AccountSignIn, type ActiveRole, ApiError, type AssistantClient, type AssistantClientOptions, type AssistantConnection, AuthError, type AuthSession, type AuthSessionOptions, type AuthUser, type AuthenticatorSetup, type BatchOp, type BatchRef, type BatchResult, type Client, type ClientOptions, type CurrentOrganization, type Facet, type FilterInput, type Histogram, type HistogramBucket, type InvitationPreview, type InvitationSent, type InvokeOptions, type ListPage, type ListParams, type Meta, type MetaResult, type Organization, type OrganizationInvitation, type OrganizationMember, type OrganizationRole, type OrganizationsClient, type Passkey, type PlatformSignIn, PreconditionFailedError, type ProblemDetails, type ProblemError, type RecordOf, type RecordPermissions, type RequiredSetup, type ResourcePermissions, type ResourceRef, type RoleLabel, type RoleOption, type RolesClient, type RuntimeClient, type RuntimeClientOptions, type RuntimePolicy, type RuntimeStatus, type Series, type SeriesParams, type SeriesPoint, type SetupStatus, type SignInMethod, type SignInPolicy, type SignInPolicyClient, type SignInPolicyState, type SignInResult, type SignInRule, type StaffAccessRule, type StaffSignIn, type StaffSignInClient, type Stored, type StoredFile, type TwoFactorMethod, type UploadOptions, type UploadProgress, type UploadResult, createAssistantClient, createAuthSession, createClient, createRuntimeClient, createStaticSession, filterText, isApiError, listWire, tokenExpiry };

package/dist/query-string.d.ts

@@ -3,7 +3,7 @@ import { FilterExpr } from "@protobase/schema";
 export type FilterInput = string | FilterExpr;
 export type ListParams = {
   filter?: FilterInput;
-  /** AIP-132 text, for example `createdAt desc`. */
+  /** AIP-132 text, for example `created_at desc`. */
   orderBy?: string;
   pageSize?: number;
   pageToken?: string;

package/dist/roles.d.ts

@@ -0,0 +1,26 @@
+import { BetterAuthClient } from "./better-auth-client.js";
+//#region src/roles.d.ts
+/** A role someone can act with: its name and the label to show. */
+export type RoleOption = {
+  name: string;
+  label: string;
+};
+/**
+ * The role the session acts with, the only one its tokens carry (`null` for someone without a role), and the roles the
+ * person holds where the session works, to switch to.
+ */
+export type ActiveRole = {
+  active: string | null;
+  roles: RoleOption[];
+};
+/**
+ * Switching the role the session acts with. Its tokens carry that role alone, so a switch fetches a new token at once
+ * (`refreshToken`), as a switch of organization does. Each call rejects with `AuthError`.
+ */
+export declare const rolesClient: (client: BetterAuthClient, refreshToken: () => Promise<unknown>) => {
+  current: () => Promise<ActiveRole>;
+  /** Acts with another role the person holds from now on, in this session and the next ones. */
+  switchTo: (role: string) => Promise<void>;
+};
+export type RolesClient = ReturnType<typeof rolesClient>;
+//#endregion

package/dist/roles.js

@@ -0,0 +1,24 @@
+import { authError } from "./auth-error.js";
+//#region src/roles.ts
+/**
+* Switching the role the session acts with. Its tokens carry that role alone, so a switch fetches a new token at once
+* (`refreshToken`), as a switch of organization does. Each call rejects with `AuthError`.
+*/
+const rolesClient = (client, refreshToken) => ({
+	current: async () => {
+		const { data, error } = await client.$fetch("/role/current", { method: "GET" });
+		if (error) throw authError(error, "Could not read your roles");
+		return data;
+	},
+	/** Acts with another role the person holds from now on, in this session and the next ones. */
+	switchTo: async (role) => {
+		const { error } = await client.$fetch("/role/switch", {
+			method: "POST",
+			body: { role }
+		});
+		if (error) throw authError(error, "Could not switch the role");
+		await refreshToken();
+	}
+});
+//#endregion
+export { rolesClient };

package/dist/sign-in-flows.js

@@ -1,4 +1,5 @@
-import { authError } from "./auth-error.js";
+import { AuthError, authError } from "./auth-error.js";
+import { WebAuthnError, startAuthentication } from "@simplewebauthn/browser";
 //#region src/sign-in-flows.ts
 /**
 * The ways to sign in: a password, an emailed code or a passkey, and the second step after a password or a code for
@@ -41,12 +42,26 @@ const signInFlows = (client, signedIn) => {
 			if (error || !data) throw authError(error, "Sign-in failed");
 			return finish(data);
 		},
-		/** Asks the browser for one of the person's passkeys for this site. */
-		signInWithPasskey: async () => {
-			const { data, error } = await client.signIn.passkey();
-			if (error || !data) throw authError(error, "Sign-in failed");
+		/**
+		* Asks the browser for one of the person's passkeys made for `domain`, one of the status's `passkeyDomains`, or for
+		* the app's passkey domain when left out. A browser asks for the passkeys of one domain at a time.
+		*/
+		signInWithPasskey: async (domain) => {
+			const options = await client.$fetch("/passkey/generate-authenticate-options", {
+				method: "GET",
+				...domain && { query: { rpId: domain } }
+			});
+			if (options.error || !options.data) throw authError(options.error, "Sign-in failed");
+			const { clientExtensionResults: _, ...response } = await startAuthentication({ optionsJSON: options.data }).catch((error) => {
+				throw new AuthError("Auth cancelled", 400, error instanceof WebAuthnError ? error.code : "AUTH_CANCELLED");
+			});
+			const verified = await client.$fetch("/passkey/verify-authentication", {
+				method: "POST",
+				body: { response }
+			});
+			if (verified.error || !verified.data) throw authError(verified.error, "Sign-in failed");
 			await signedIn();
-			return data.user;
+			return verified.data.user;
 		},
 		/** Emails the code for the second step, to the address of the account signing in. */
 		sendTwoFactorCode: async () => {

package/dist/static-session.d.ts

@@ -4,7 +4,7 @@ import { AuthSession } from "./auth.js";
 /**
  * A session that is already signed in with a token you hold, for stories and scripts (`protobase token <email>`).
  * It never refreshes, so use a token that outlives the run. Its account has nothing to set up, and it cannot change
- * passkeys, two-factor authentication, the sign-in policy or organizations, and is never a staff session.
+ * passkeys, two-factor authentication, the sign-in policy, organizations or its role, and is never a staff session.
  */
 export declare const createStaticSession: (token: string, user?: AuthUser) => AuthSession;
 //#endregion

package/dist/static-session.js

@@ -6,7 +6,7 @@ const unsupported = (what) => async () => {
 /**
 * A session that is already signed in with a token you hold, for stories and scripts (`protobase token <email>`).
 * It never refreshes, so use a token that outlives the run. Its account has nothing to set up, and it cannot change
-* passkeys, two-factor authentication, the sign-in policy or organizations, and is never a staff session.
+* passkeys, two-factor authentication, the sign-in policy, organizations or its role, and is never a staff session.
 */
 const createStaticSession = (token, user = {
 	id: "token",
@@ -79,6 +79,13 @@ const createStaticSession = (token, user = {
 		stop: unsupported("end a staff session"),
 		log: unsupported("read the staff sign-ins")
 	},
+	roles: {
+		current: async () => ({
+			active: null,
+			roles: []
+		}),
+		switchTo: unsupported("switch roles")
+	},
 	organizations: {
 		list: async () => [],
 		current: async () => ({

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-import { InferRecord, ResourceModel, UserMenuModel, ViewModel } from "@protobase/schema";
+import { BottomBarModel, InferRecord, ResourceModel, UserMenuModel, ViewModel } from "@protobase/schema";
 import { PageModel } from "@protobase/layout";
 //#region src/types.d.ts
 /** A resource by name, or the builder from `resource(...)`, which carries its record type. */
@@ -65,6 +65,7 @@ export type ResourcePermissions = {
 /**
  * `assistant`: the assistant backend, for a caller with the `admin` or `ai` role when the app has one.
  * `runtime`: the runtime updates endpoint, for a caller with the `admin` role when the app has one.
+ * `bottomBar`: the tabs on phones, of the bottom bar that names the caller's active role.
  */
 export type Meta = {
   resources: ResourceModel[];
@@ -72,6 +73,7 @@ export type Meta = {
   pages?: PageModel[];
   permissions?: Record<string, ResourcePermissions>;
   userMenu?: UserMenuModel;
+  bottomBar?: Omit<BottomBarModel, 'roles'>;
   assistant?: {
     url: string;
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/client",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Typed fetch client for the Protobase REST API.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,8 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.9.0",
-    "@protobase/schema": "0.9.0",
+    "@protobase/layout": "0.10.0",
+    "@protobase/schema": "0.10.0",
+    "@simplewebauthn/browser": "^13.3.0",
     "better-auth": "^1.7.7"
   }
 }