@seamless-auth/react-native 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @seamless-auth/react-native
 
+## 0.3.3
+
+### Patch Changes
+
+- f21867d: OAuth sign-in now carries the state binding the auth server returns from `POST /oauth/:providerId/start` back to the callback. The session actions `startOAuthLogin` and `finishOAuthLogin` (and so `useAuth()` in React and React Native, and the Angular, Vue and Svelte bindings) store the binding with its state, attach it to the matching callback, and clear it afterwards, so apps that call these actions directly need no code change. The binding is kept in `sessionStorage` under `seamless:oauth:binding` in a browser and in memory elsewhere, and is never sent to the provider or put in a URL. `startOAuthSignIn` passes it explicitly when an in-app browser hands the callback back, and now refuses a callback whose state is not the one it started.
+
+  `StartOAuthLoginResult` gains an optional `binding` and `FinishOAuthLoginInput` an optional `binding`. Older auth servers return no binding and are unaffected. Auth API 0.19.x with fells-code/seamless-auth-api#463 refuses a callback without the binding, so upgrade this SDK before or with that API release.
+
+- Updated dependencies [f21867d]
+  - @seamless-auth/client@0.7.1
+
 ## 0.3.2
 
 ### Patch Changes

package/README.md

@@ -153,6 +153,13 @@ it with `ports.oauthRedirect.open(url, redirectUri)`, which resolves with the
 callback's `code` and `state`, and finish with `finishOAuthLogin`.
 `redirectUri` must be registered with the provider and allowed by the auth API.
 
+Newer auth servers also return a `binding` from `startOAuthLogin` and refuse a
+callback without it. The session actions keep it in memory with its `state` and
+send it from `finishOAuthLogin`, so this needs nothing from you. If you finish
+with another client, pass `binding` yourself, and check that the callback's
+`state` matches the one `startOAuthLogin` returned. Never put the binding in a
+URL or send it to the provider.
+
 ## License
 
 Apache-2.0. See [LICENSE](LICENSE).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/react-native",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Headless React Native binding for Seamless Auth: provider, hooks, and the native ports for passkeys, secure token storage, and in-app browser OAuth.",
   "type": "module",
   "exports": {
@@ -45,8 +45,8 @@
     "react": "^18.0.0 || ^19.0.0"
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.7.0",
-    "@seamless-auth/types": "^0.28.0"
+    "@seamless-auth/client": "^0.7.1",
+    "@seamless-auth/types": "^0.29.0"
   },
   "sideEffects": false
 }