@scalemule/news-publication 0.0.86 → 0.0.87

package/dist/reader-sso-client.cjs

@@ -376,7 +376,7 @@ function AccountLinkForm({
           /* @__PURE__ */ jsxRuntime.jsx("input", { type: "password", autoComplete: "current-password", required: true, minLength: 1, maxLength: 1024, value: password, onChange: (e) => setPassword(e.target.value) })
         ] }),
         mfaRequired && /* @__PURE__ */ jsxRuntime.jsxs("label", { children: [
-          "Authentication code",
+          "Verification code",
           /* @__PURE__ */ jsxRuntime.jsx("input", { type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, maxLength: 32, value: code, onChange: (e) => setCode(e.target.value) })
         ] }),
         /* @__PURE__ */ jsxRuntime.jsx("button", { className: classNames.button, disabled: busy || !password || mfaRequired && !code, children: busy ? "Connecting\u2026" : "Connect and sign in" }),

package/dist/reader-sso-client.js

@@ -374,7 +374,7 @@ function AccountLinkForm({
           /* @__PURE__ */ jsx("input", { type: "password", autoComplete: "current-password", required: true, minLength: 1, maxLength: 1024, value: password, onChange: (e) => setPassword(e.target.value) })
         ] }),
         mfaRequired && /* @__PURE__ */ jsxs("label", { children: [
-          "Authentication code",
+          "Verification code",
           /* @__PURE__ */ jsx("input", { type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, maxLength: 32, value: code, onChange: (e) => setCode(e.target.value) })
         ] }),
         /* @__PURE__ */ jsx("button", { className: classNames.button, disabled: busy || !password || mfaRequired && !code, children: busy ? "Connecting\u2026" : "Connect and sign in" }),

package/dist/reader-sso.cjs

@@ -34,7 +34,8 @@ function readerSsoCookieNames(prefix) {
     newsletter: `${prefix}-newsletter`,
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
-    pending: `${prefix}-sso-pending`
+    pending: `${prefix}-sso-pending`,
+    linkCode: `${prefix}-link-code`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -365,6 +366,35 @@ function linkFailureMessage(code) {
       return null;
   }
 }
+function linkEmailCodeFailure(code, response, cookieName) {
+  switch (code) {
+    case "LOGIN_CHALLENGE_REQUIRED": {
+      const body = response.body;
+      let token = "";
+      try {
+        const parsed = JSON.parse(typeof body?.error?.message === "string" ? body.error.message : "{}");
+        token = typeof parsed.challenge_token === "string" && parsed.challenge_token.length <= 256 ? parsed.challenge_token : "";
+      } catch {
+        token = "";
+      }
+      if (!token) return null;
+      return {
+        status: 401,
+        mfaRequired: true,
+        error: "We emailed a 6-digit code to your reader account's address. Enter it to finish connecting your sign-in.",
+        cookies: [{ name: cookieName, value: token, maxAge: 600 }]
+      };
+    }
+    case "LOGIN_CHALLENGE_INVALID":
+      return { status: 401, mfaRequired: true, error: "That code is incorrect or expired. Check the most recent email, or start over for a new code.", cookies: [] };
+    case "CHALLENGE_RATE_LIMITED":
+      return { status: 429, mfaRequired: true, error: "Please wait a minute before asking for another code.", cookies: [] };
+    case "LOGIN_CHALLENGE_LOCKED":
+      return { status: 429, error: "Too many incorrect codes. Reset your reader account password to continue.", cookies: [{ name: cookieName, value: "", maxAge: 0 }] };
+    default:
+      return null;
+  }
+}
 async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
@@ -378,9 +408,16 @@ async function linkAccount(config, input) {
   if (mfaCode && (mfaCode.length > 32 || !/^[A-Za-z0-9-]+$/.test(mfaCode))) {
     return { ok: false, status: 400, error: "Enter the code exactly as your authenticator app shows it.", cookies: [], mfaRequired: true };
   }
+  const emailChallenge = input.cookies(c.names.linkCode) || "";
+  const linkBody = emailChallenge && mfaCode ? { challenge_id: challengeId, password, challenge_token: emailChallenge, challenge_code: mfaCode } : { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} };
   try {
-    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} } });
+    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: linkBody });
     if (failed(response)) {
+      const emailCode = linkEmailCodeFailure(errorCode(response), response, c.names.linkCode);
+      if (emailCode) {
+        emit(c, { name: "reader_signin_failed", properties: { reason: "mfa_required", mode: "interactive" } });
+        return { ok: false, ...emailCode };
+      }
       const specific = linkFailureMessage(errorCode(response));
       if (specific) {
         emit(c, { name: "reader_signin_failed", properties: { reason: specific.mfaRequired ? "mfa_required" : "link_invalid", mode: "interactive" } });
@@ -391,7 +428,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {

package/dist/reader-sso.d.cts

@@ -23,6 +23,8 @@ type ReaderSsoCookieNames = {
     signedOut: string;
     /** A verified session waiting for the reader to choose between two accounts. */
     pending: string;
+    /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
+    linkCode: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;

package/dist/reader-sso.d.ts

@@ -23,6 +23,8 @@ type ReaderSsoCookieNames = {
     signedOut: string;
     /** A verified session waiting for the reader to choose between two accounts. */
     pending: string;
+    /** Linking onto an unconfirmed account: the platform's emailed-code challenge token (10 minutes). */
+    linkCode: string;
 };
 /** Cookie names derived from a `__Host-` prefix, e.g. `__Host-media` → `__Host-media-reader`. */
 declare function readerSsoCookieNames(prefix: string): ReaderSsoCookieNames;

package/dist/reader-sso.js

@@ -19,7 +19,8 @@ function readerSsoCookieNames(prefix) {
     newsletter: `${prefix}-newsletter`,
     ssoChecked: `${prefix}-sso-checked`,
     signedOut: `${prefix}-signed-out`,
-    pending: `${prefix}-sso-pending`
+    pending: `${prefix}-sso-pending`,
+    linkCode: `${prefix}-link-code`
   };
 }
 var readerSsoCookieOptions = { httpOnly: true, secure: true, sameSite: "lax", path: "/" };
@@ -350,6 +351,35 @@ function linkFailureMessage(code) {
       return null;
   }
 }
+function linkEmailCodeFailure(code, response, cookieName) {
+  switch (code) {
+    case "LOGIN_CHALLENGE_REQUIRED": {
+      const body = response.body;
+      let token = "";
+      try {
+        const parsed = JSON.parse(typeof body?.error?.message === "string" ? body.error.message : "{}");
+        token = typeof parsed.challenge_token === "string" && parsed.challenge_token.length <= 256 ? parsed.challenge_token : "";
+      } catch {
+        token = "";
+      }
+      if (!token) return null;
+      return {
+        status: 401,
+        mfaRequired: true,
+        error: "We emailed a 6-digit code to your reader account's address. Enter it to finish connecting your sign-in.",
+        cookies: [{ name: cookieName, value: token, maxAge: 600 }]
+      };
+    }
+    case "LOGIN_CHALLENGE_INVALID":
+      return { status: 401, mfaRequired: true, error: "That code is incorrect or expired. Check the most recent email, or start over for a new code.", cookies: [] };
+    case "CHALLENGE_RATE_LIMITED":
+      return { status: 429, mfaRequired: true, error: "Please wait a minute before asking for another code.", cookies: [] };
+    case "LOGIN_CHALLENGE_LOCKED":
+      return { status: 429, error: "Too many incorrect codes. Reset your reader account password to continue.", cookies: [{ name: cookieName, value: "", maxAge: 0 }] };
+    default:
+      return null;
+  }
+}
 async function linkAccount(config, input) {
   const c = resolve(config);
   const challengeId = typeof input.challenge_id === "string" && CHALLENGE_ID.test(input.challenge_id) ? input.challenge_id : "";
@@ -363,9 +393,16 @@ async function linkAccount(config, input) {
   if (mfaCode && (mfaCode.length > 32 || !/^[A-Za-z0-9-]+$/.test(mfaCode))) {
     return { ok: false, status: 400, error: "Enter the code exactly as your authenticator app shows it.", cookies: [], mfaRequired: true };
   }
+  const emailChallenge = input.cookies(c.names.linkCode) || "";
+  const linkBody = emailChallenge && mfaCode ? { challenge_id: challengeId, password, challenge_token: emailChallenge, challenge_code: mfaCode } : { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} };
   try {
-    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: { challenge_id: challengeId, password, ...mfaCode ? { mfa_code: mfaCode } : {} } });
+    const response = await c.request("/v1/auth/oauth/ledvery/link", { method: "POST", body: linkBody });
     if (failed(response)) {
+      const emailCode = linkEmailCodeFailure(errorCode(response), response, c.names.linkCode);
+      if (emailCode) {
+        emit(c, { name: "reader_signin_failed", properties: { reason: "mfa_required", mode: "interactive" } });
+        return { ok: false, ...emailCode };
+      }
       const specific = linkFailureMessage(errorCode(response));
       if (specific) {
         emit(c, { name: "reader_signin_failed", properties: { reason: specific.mfaRequired ? "mfa_required" : "link_invalid", mode: "interactive" } });
@@ -376,7 +413,7 @@ async function linkAccount(config, input) {
     }
     const session = issuedSession(response, c.now());
     const flow = { digest: "", subscribe: input.subscribe === true, expires: 0, returnTo: next, mode: "interactive", provider: void 0 };
-    const result = await establish(c, { session, flow, method: "link", cookies: [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
+    const result = await establish(c, { session, flow, method: "link", cookies: emailChallenge ? [clear(c.names.linkCode)] : [], input, negativeCache: { name: c.names.ssoChecked, value: "1", maxAge: READER_SSO_NEGATIVE_CACHE_SECONDS } });
     if (result.kind === "signed-in") emit(c, { name: "reader_account_linked", properties: {} });
     return result.kind === "signed-in" ? { ok: true, switch: false, cookies: result.cookies, token: result.token, expiresAt: result.expiresAt, user: result.user, location: result.location } : { ok: true, switch: true, cookies: result.cookies, location: result.location };
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalemule/news-publication",
-  "version": "0.0.86",
+  "version": "0.0.87",
   "description": "Shared server framework for ScaleMule local news publications. Walnut Creek Times is the broadsheet default; each paper supplies its own identity and feature flags.",
   "type": "module",
   "bin": {