@proveanything/smartlinks-auth-ui 0.6.0 → 0.6.2

package/dist/index.js

@@ -11502,6 +11502,17 @@ class AuthAPI {
             throw error;
         }
     }
+    /**
+     * Complete a password reset OR accept an invite by setting the first password.
+     *
+     * The backend distinguishes the two flows via the token's `metadata.invitedBy`:
+     *  - Plain password reset → returns `{ success, message }` only.
+     *  - Invite acceptance under `verify-auto-login` → returns a full session
+     *    (`token`, `user`, `accountData`, and on native: refresh-token fields)
+     *    so the kit can log the user straight in without bouncing them to /login.
+     *
+     * See: SDK_AUTHKIT_REFRESH_TOKENS / "Invite Auto-Login" spec.
+     */
     async completePasswordReset(token, newPassword) {
         return smartlinks__namespace.authKit.completePasswordReset(this.clientId, token, newPassword);
     }
@@ -14132,7 +14143,13 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             if (urlMode === 'verifyEmail') {
                 log.log('Verifying email with token:', token);
                 const response = await api.verifyEmailWithToken(token);
-                log.log('Email verification response:', { hasToken: !!response.token, hasUser: !!response.user, emailVerificationMode: response.emailVerificationMode, isNewUser: response.isNewUser });
+                log.log('Email verification response:', { hasToken: !!response?.token, hasUser: !!response?.user, emailVerificationMode: response?.emailVerificationMode, isNewUser: response?.isNewUser });
+                // Detect resolved-error shapes (proxy mode serializes errors instead of throwing).
+                // Common case: sign-up intent claim / verification token already consumed → route to login.
+                const resolvedErrorMessage = getActionResultErrorMessage(response);
+                if (resolvedErrorMessage || !response) {
+                    throw new Error(resolvedErrorMessage || 'This verification link has already been used or has expired.');
+                }
                 // Get email verification mode from response or config
                 const verificationMode = response.emailVerificationMode || config?.emailVerification?.mode || 'verify-auto-login';
                 if ((verificationMode === 'verify-auto-login' || verificationMode === 'immediate') && response.token) {
@@ -14194,7 +14211,12 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
             else if (urlMode === 'magicLink') {
                 log.log('Verifying magic link token:', token);
                 const response = await api.verifyMagicLink(token);
-                log.log('Magic link verification response:', { hasToken: !!response.token, hasUser: !!response.user, isNewUser: response.isNewUser });
+                log.log('Magic link verification response:', { hasToken: !!response?.token, hasUser: !!response?.user, isNewUser: response?.isNewUser });
+                // Detect resolved-error shapes (proxy mode serializes errors instead of throwing).
+                const resolvedMagicError = getActionResultErrorMessage(response);
+                if (resolvedMagicError || !response) {
+                    throw new Error(resolvedMagicError || 'This magic link has already been used or has expired.');
+                }
                 // Auto-login with magic link if token is provided
                 if (response.token) {
                     // Always await - auth.login now waits for parent ack automatically in iframe mode
@@ -15024,9 +15046,22 @@ const SmartlinksAuthUI = ({ apiEndpoint, clientId, clientName, accountData, onAu
         const effectiveRedirectUrl = getRedirectUrl();
         try {
             if (resetToken && confirmPassword) {
-                // Complete password reset with token
-                await api.completePasswordReset(resetToken, emailOrPassword);
-                // Auto-login with the new password if we have the email
+                // Complete password reset (or invite acceptance) with token
+                const completeResponse = await api.completePasswordReset(resetToken, emailOrPassword);
+                // Invite acceptance under verify-auto-login: backend returns a full session.
+                // Adopt it directly — same pattern as verifyEmail / verifyMagicLink — and skip /login.
+                if (completeResponse?.token && completeResponse.user) {
+                    log.log('complete-reset returned a session (invite auto-login), adopting it');
+                    await auth.login(completeResponse.token, completeResponse.user, completeResponse.accountData, true, getExpirationFromResponse(completeResponse), completeResponse.refreshToken, completeResponse.refreshTokenExpiresAt);
+                    setAuthSuccess(true);
+                    setSuccessMessage('Welcome! Your account is ready.');
+                    onAuthSuccess(completeResponse.token, completeResponse.user, completeResponse.accountData);
+                    setResetToken(undefined);
+                    setResetEmail(undefined);
+                    return;
+                }
+                // Plain password reset: no session returned. Try auto-login with the new password
+                // if we have the email on hand.
                 if (resetEmail) {
                     try {
                         log.log('Auto-login after password reset for:', resetEmail);