@robosystems/core 0.7.2 → 0.8.1

package/auth-core/client.d.ts

@@ -1,4 +1,4 @@
-import type { APIKey, AuthProviders, AuthResponse, AuthUser, CreateAPIKeyRequest, SSOTokenResponse } from './types';
+import type { APIKey, AuthProviders, AuthResponse, AuthUser, CreateAPIKeyRequest, PasskeyEnrollmentResult, SSOTokenResponse } from './types';
 export declare class TokenExpiredError extends Error {
     constructor(message?: string);
 }
@@ -35,6 +35,18 @@ export declare class RoboSystemsAuthClient {
      */
     private syncClientConfigToken;
     login(email: string, password: string): Promise<AuthResponse>;
+    /**
+     * Validate an auth-shaped SDK response, store the session token when one
+     * is present, and map to the public shape. Shared by every entrance that
+     * can mint a session: password login, MFA verify, passwordless login,
+     * and forced-enrollment completion.
+     *
+     * An MFA-step response (`status` of `mfa_required` /
+     * `mfa_enrollment_required`) carries no token — `success` is false and
+     * `mfaToken` authorizes the next step. Pre-MFA backends send no `status`
+     * at all, which reads as authenticated.
+     */
+    private finalizeAuthResponse;
     register(email: string, password: string, name?: string, captchaToken?: string, inviteToken?: string, options?: {
         appSource?: string;
     }): Promise<AuthResponse>;
@@ -63,6 +75,58 @@ export declare class RoboSystemsAuthClient {
      * the caller renders the default password posture.
      */
     getAuthProviders(): Promise<AuthProviders | null>;
+    /** Second-factor step: exchange an mfa_required token for assertion options. */
+    getMfaOptions(mfaToken: string): Promise<Record<string, unknown>>;
+    /** Second-factor step: complete with an assertion or a recovery code. */
+    verifyMfa(mfaToken: string, input: {
+        assertion?: Record<string, unknown>;
+        recoveryCode?: string;
+    }): Promise<AuthResponse>;
+    /** Passwordless login: usernameless assertion options. */
+    getPasskeyLoginOptions(): Promise<Record<string, unknown>>;
+    /** Passwordless login: assertion → session. */
+    completePasskeyLogin(assertion: Record<string, unknown>): Promise<AuthResponse>;
+    /**
+     * Begin enrollment. The settings lane must carry a fresh re-auth proof —
+     * `password`, or a reauth-ceremony `assertion` when adding a passkey
+     * beside an existing one; a session alone is refused by the backend. The
+     * forced-enrollment lane passes only the `mfaToken` from an
+     * `mfa_enrollment_required` login, which is its own freshness proof.
+     */
+    getPasskeyRegistrationOptions(proof?: {
+        mfaToken?: string;
+        password?: string;
+        assertion?: Record<string, unknown>;
+    }): Promise<Record<string, unknown>>;
+    /**
+     * Finish enrollment. First passkey returns recovery codes (once); in the
+     * forced-enrollment lane the result carries the completed login and the
+     * session token is stored.
+     */
+    completePasskeyEnrollment(credential: Record<string, unknown>, options?: {
+        name?: string;
+        mfaToken?: string;
+    }): Promise<PasskeyEnrollmentResult>;
+    /** Enrolled passkeys for the settings surface. */
+    listPasskeys(): Promise<Record<string, unknown>[]>;
+    /** Fresh-assertion options for destructive lifecycle actions. */
+    getPasskeyReauthOptions(): Promise<Record<string, unknown>>;
+    /** Remove a passkey; exactly one re-auth proof must be supplied. */
+    deletePasskey(passkeyId: string, proof: {
+        password?: string;
+        assertion?: Record<string, unknown>;
+    }): Promise<void>;
+    /** MFA posture for the settings surface; null on any failure. */
+    getMfaStatus(): Promise<{
+        passkeyCount: number;
+        recoveryCodesRemaining: number;
+        enforcementApplies: boolean;
+    } | null>;
+    /** Replace the recovery-code set; codes are shown exactly once. */
+    regenerateRecoveryCodes(proof: {
+        password?: string;
+        assertion?: Record<string, unknown>;
+    }): Promise<string[]>;
     clearAuthCache(): void;
     /**
      * Send password reset email

package/auth-core/client.js

@@ -1,5 +1,5 @@
 var _a;
-import { checkPasswordStrength, client, completeSsoAuth, createUserApiKey, forgotPassword, generateSsoToken, getAuthProviders, getCurrentAuthUser, getInvitationPreview, getPasswordPolicy, listUserApiKeys, loginUser, logoutUser, refreshAuthSession, registerUser, resendVerificationEmail, resetPassword, revokeUserApiKey, ssoTokenExchange, validateResetToken, verifyEmail, } from '@robosystems/client';
+import { checkPasswordStrength, client, completeSsoAuth, createUserApiKey, deleteUserPasskey, forgotPassword, generateSsoToken, getAuthProviders, getCurrentAuthUser, getInvitationPreview, getMfaOptions, getMfaStatus, getPasskeyLoginOptions, getPasskeyReauthOptions, getPasskeyRegistrationOptions, getPasswordPolicy, listUserApiKeys, listUserPasskeys, loginUser, logoutUser, refreshAuthSession, regenerateMfaRecoveryCodes, registerUser, resendVerificationEmail, resetPassword, revokeUserApiKey, ssoTokenExchange, validateResetToken, verifyEmail, verifyMfa, verifyPasskeyLogin, verifyPasskeyRegistration, } from '@robosystems/client';
 import * as sdkClientsModule from '@robosystems/client/clients';
 import { getToken, getValidToken } from './token-storage';
 // Global config hook for the clients package's lazy default singleton
@@ -188,7 +188,24 @@ export class RoboSystemsAuthClient {
             client: this.client,
             body: { email, password },
         });
-        const sdkResponse = this.validateSDKAuthResponse(response.data);
+        return this.finalizeAuthResponse(response.data);
+    }
+    /**
+     * Validate an auth-shaped SDK response, store the session token when one
+     * is present, and map to the public shape. Shared by every entrance that
+     * can mint a session: password login, MFA verify, passwordless login,
+     * and forced-enrollment completion.
+     *
+     * An MFA-step response (`status` of `mfa_required` /
+     * `mfa_enrollment_required`) carries no token — `success` is false and
+     * `mfaToken` authorizes the next step. Pre-MFA backends send no `status`
+     * at all, which reads as authenticated.
+     */
+    async finalizeAuthResponse(data) {
+        var _a, _b, _c;
+        const sdkResponse = this.validateSDKAuthResponse(data);
+        const status = sdkResponse.status;
+        const authenticated = !status || status === 'authenticated';
         // Store JWT token with expiry information if present in response
         if (sdkResponse.token) {
             const { storeToken } = await import('./token-storage');
@@ -202,11 +219,13 @@ export class RoboSystemsAuthClient {
         }
         return {
             user: sdkResponse.user,
-            success: true,
+            success: authenticated,
+            status,
+            mfaToken: (_a = sdkResponse.mfa_token) !== null && _a !== void 0 ? _a : undefined,
             message: sdkResponse.message,
             token: sdkResponse.token,
-            expires_in: sdkResponse.expires_in,
-            refresh_threshold: sdkResponse.refresh_threshold,
+            expires_in: (_b = sdkResponse.expires_in) !== null && _b !== void 0 ? _b : undefined,
+            refresh_threshold: (_c = sdkResponse.refresh_threshold) !== null && _c !== void 0 ? _c : undefined,
         };
     }
     async register(email, password, name, captchaToken, inviteToken, options) {
@@ -511,6 +530,136 @@ export class RoboSystemsAuthClient {
             return null;
         }
     }
+    // ---- Passkey MFA -------------------------------------------------------
+    // WebAuthn options and credential payloads are opaque JSON between the
+    // backend RP library and the browser's navigator.credentials — core
+    // carries them verbatim and never imports a WebAuthn library. Methods
+    // that can mint a session route through finalizeAuthResponse so token
+    // storage stays in one place.
+    /** Second-factor step: exchange an mfa_required token for assertion options. */
+    async getMfaOptions(mfaToken) {
+        const response = await getMfaOptions({
+            client: this.client,
+            body: { mfa_token: mfaToken },
+        });
+        return response.data.options;
+    }
+    /** Second-factor step: complete with an assertion or a recovery code. */
+    async verifyMfa(mfaToken, input) {
+        const response = await verifyMfa({
+            client: this.client,
+            body: {
+                mfa_token: mfaToken,
+                assertion: input.assertion,
+                recovery_code: input.recoveryCode,
+            },
+        });
+        return this.finalizeAuthResponse(response.data);
+    }
+    /** Passwordless login: usernameless assertion options. */
+    async getPasskeyLoginOptions() {
+        const response = await getPasskeyLoginOptions({ client: this.client });
+        return response.data.options;
+    }
+    /** Passwordless login: assertion → session. */
+    async completePasskeyLogin(assertion) {
+        const response = await verifyPasskeyLogin({
+            client: this.client,
+            body: { assertion },
+        });
+        return this.finalizeAuthResponse(response.data);
+    }
+    /**
+     * Begin enrollment. The settings lane must carry a fresh re-auth proof —
+     * `password`, or a reauth-ceremony `assertion` when adding a passkey
+     * beside an existing one; a session alone is refused by the backend. The
+     * forced-enrollment lane passes only the `mfaToken` from an
+     * `mfa_enrollment_required` login, which is its own freshness proof.
+     */
+    async getPasskeyRegistrationOptions(proof) {
+        const response = await getPasskeyRegistrationOptions({
+            client: this.client,
+            // The proof fields land in client 1.11's generated request model;
+            // until the regen they ride as extra JSON properties, hence the cast.
+            body: {
+                mfa_token: proof === null || proof === void 0 ? void 0 : proof.mfaToken,
+                password: proof === null || proof === void 0 ? void 0 : proof.password,
+                assertion: proof === null || proof === void 0 ? void 0 : proof.assertion,
+            },
+        });
+        return response.data.options;
+    }
+    /**
+     * Finish enrollment. First passkey returns recovery codes (once); in the
+     * forced-enrollment lane the result carries the completed login and the
+     * session token is stored.
+     */
+    async completePasskeyEnrollment(credential, options) {
+        var _a;
+        const response = await verifyPasskeyRegistration({
+            client: this.client,
+            body: {
+                credential,
+                name: options === null || options === void 0 ? void 0 : options.name,
+                mfa_token: options === null || options === void 0 ? void 0 : options.mfaToken,
+            },
+        });
+        const data = response.data;
+        let auth;
+        if (data.auth) {
+            auth = await this.finalizeAuthResponse(data.auth);
+        }
+        return {
+            passkey: data.passkey,
+            recoveryCodes: (_a = data.recovery_codes) !== null && _a !== void 0 ? _a : undefined,
+            auth,
+        };
+    }
+    /** Enrolled passkeys for the settings surface. */
+    async listPasskeys() {
+        var _a, _b;
+        const response = await listUserPasskeys({ client: this.client });
+        return ((_b = (_a = response.data) === null || _a === void 0 ? void 0 : _a.passkeys) !== null && _b !== void 0 ? _b : []);
+    }
+    /** Fresh-assertion options for destructive lifecycle actions. */
+    async getPasskeyReauthOptions() {
+        const response = await getPasskeyReauthOptions({ client: this.client });
+        return response.data.options;
+    }
+    /** Remove a passkey; exactly one re-auth proof must be supplied. */
+    async deletePasskey(passkeyId, proof) {
+        await deleteUserPasskey({
+            client: this.client,
+            path: { passkey_id: passkeyId },
+            body: { password: proof.password, assertion: proof.assertion },
+        });
+    }
+    /** MFA posture for the settings surface; null on any failure. */
+    async getMfaStatus() {
+        try {
+            const response = await getMfaStatus({ client: this.client });
+            const data = response.data;
+            if (!data || typeof data.passkey_count !== 'number') {
+                return null;
+            }
+            return {
+                passkeyCount: data.passkey_count,
+                recoveryCodesRemaining: data.recovery_codes_remaining,
+                enforcementApplies: data.enforcement_applies,
+            };
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    /** Replace the recovery-code set; codes are shown exactly once. */
+    async regenerateRecoveryCodes(proof) {
+        const response = await regenerateMfaRecoveryCodes({
+            client: this.client,
+            body: { password: proof.password, assertion: proof.assertion },
+        });
+        return response.data.codes;
+    }
     // Clear request deduplication cache (useful after login/logout)
     clearAuthCache() {
         this.lastAuthCheck = null;

package/auth-core/types.d.ts

@@ -6,14 +6,28 @@ export interface AuthUser {
     createdAt: string;
     updatedAt: string;
 }
+/**
+ * Login flow state. `authenticated` is the terminal state (token present);
+ * the two MFA states mean no session exists yet and `mfaToken` authorizes
+ * the next step (the second-factor handshake or forced enrollment).
+ */
+export type AuthFlowStatus = 'authenticated' | 'mfa_required' | 'mfa_enrollment_required';
 export interface AuthResponse {
     user: AuthUser;
     success: boolean;
     message?: string;
+    status?: AuthFlowStatus;
+    mfaToken?: string;
     token?: string;
     expires_in?: number;
     refresh_threshold?: number;
 }
+/** Enrollment result from completing a passkey registration ceremony. */
+export interface PasskeyEnrollmentResult {
+    passkey: Record<string, unknown>;
+    recoveryCodes?: string[];
+    auth?: AuthResponse;
+}
 /**
  * Deployment auth posture from `GET /v1/auth/providers`.
  *
@@ -136,6 +150,8 @@ export interface UseUserHook {
 export interface SDKAuthResponse {
     user: AuthUser;
     message?: string;
+    status?: AuthFlowStatus;
+    mfa_token?: string | null;
     token?: string;
     expires_in?: number | null;
     refresh_threshold?: number | null;

package/index.d.ts

@@ -26,7 +26,7 @@ export type { TaskCreateResponse, TaskMonitorState, TaskPollingOptions, TaskStat
 export { useGraphCreation, useOperationMonitoring, useRepositorySubscription, type OperationMonitorState, type UseOperationMonitoringResult, } from './task-monitoring/operationHooks';
 import { client } from '@robosystems/client';
 export { client };
-export type { APIKey, AppName, AuthContextType, AuthProviders, AuthUser, } from './auth-core';
+export type { APIKey, AppName, AuthContextType, AuthFlowStatus, AuthProviders, AuthUser, PasskeyEnrollmentResult, } from './auth-core';
 export { CURRENT_APP } from './auth-core/config';
 export { getLoginHomeUrl, isLoginHome, LOGIN_HOME_APP, } from './auth-core/config';
 export { buildLoginHomeUrl, buildReturnTo, isSafeRelativePath, parseReturnTo, } from './auth-core/login-home';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,
@@ -27,7 +27,7 @@
     "tailwind-merge": "^3"
   },
   "peerDependencies": {
-    "@robosystems/client": ">=1.9 <2",
+    "@robosystems/client": ">=1.10 <2",
     "flowbite-react": "^0.12.5",
     "next": ">=15 <17",
     "react": ">=18 <20",