@robosystems/core 0.8.1 → 0.8.2

package/auth-components/SignInForm.d.ts

@@ -17,6 +17,20 @@ export interface SignInFormProps {
  * auth body) stays "Invalid email or password"; 5xx gets its own message.
  */
 export declare function loginErrorMessage(error: unknown): string;
+/**
+ * Message for a login that verified the password but did not mint a session.
+ *
+ * The backend interposes a passkey step between password check and session
+ * (`mfa_required` for an enrolled user, `mfa_enrollment_required` for a
+ * privileged one under enforcement). This form implements no such step, so
+ * the flow ends here — and it must end *visibly*. Navigating on a sessionless
+ * response drops the user on a protected route that bounces them straight
+ * back to the login page, an unexplained loop.
+ *
+ * Deployments that enable passkeys need a login surface that carries the
+ * ceremony through; see the platform app's `MfaChallenge`.
+ */
+export declare function mfaUnsupportedMessage(status?: string): string;
 /**
  * Messages for the `?reason=` a redirect into the login page can carry. The
  * producer is `AuthProvider`'s `logout(reason)`, which sends the user to

package/auth-components/SignInForm.js

@@ -26,6 +26,25 @@ export function loginErrorMessage(error) {
     }
     return 'Invalid email or password';
 }
+/**
+ * Message for a login that verified the password but did not mint a session.
+ *
+ * The backend interposes a passkey step between password check and session
+ * (`mfa_required` for an enrolled user, `mfa_enrollment_required` for a
+ * privileged one under enforcement). This form implements no such step, so
+ * the flow ends here — and it must end *visibly*. Navigating on a sessionless
+ * response drops the user on a protected route that bounces them straight
+ * back to the login page, an unexplained loop.
+ *
+ * Deployments that enable passkeys need a login surface that carries the
+ * ceremony through; see the platform app's `MfaChallenge`.
+ */
+export function mfaUnsupportedMessage(status) {
+    if (status === 'mfa_enrollment_required') {
+        return 'This account must enroll a passkey before signing in, which this sign-in page cannot complete.';
+    }
+    return 'This account requires passkey verification to sign in, which this sign-in page cannot complete.';
+}
 /**
  * Messages for the `?reason=` a redirect into the login page can carry. The
  * producer is `AuthProvider`'s `logout(reason)`, which sends the user to
@@ -125,6 +144,19 @@ export function SignInForm({ onSuccess, onRedirect, redirectTo = '/home', classN
         setError('');
         try {
             const result = await authClient.login(formData.email, formData.password);
+            // No session was minted — the backend is waiting on a passkey step this
+            // form cannot run. Stop here rather than redirecting into a route that
+            // will bounce straight back. `success` is false only for the MFA
+            // statuses; pre-MFA backends send no `status` and read as authenticated.
+            if (!result.success) {
+                if (process.env.NODE_ENV === 'development') {
+                    console.error(`[SignInForm] login returned "${result.status}" — this component does not implement the passkey step. ` +
+                        'Use a sign-in surface that completes the MFA ceremony.');
+                }
+                setError(mfaUnsupportedMessage(result.status));
+                setLoading(false);
+                return;
+            }
             // Call onSuccess callback if provided
             if (onSuccess) {
                 onSuccess(result.user);

package/auth-core/client.js

@@ -579,8 +579,6 @@ export class RoboSystemsAuthClient {
     async getPasskeyRegistrationOptions(proof) {
         const response = await getPasskeyRegistrationOptions({
             client: this.client,
-            // The proof fields land in client 1.11's generated request model;
-            // until the regen they ride as extra JSON properties, hence the cast.
             body: {
                 mfa_token: proof === null || proof === void 0 ? void 0 : proof.mfaToken,
                 password: proof === null || proof === void 0 ? void 0 : proof.password,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,