@seamless-auth/react-native 0.3.3 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @seamless-auth/react-native
 
+## 0.4.0
+
+### Minor Changes
+
+- 44854d0: Add the auth API v0.20 recovery primitives to the client and the session store.
+  - Recovery codes: `getRecoveryCodeStatus()`, `generateRecoveryCodes()` and `redeemRecoveryCode(code)`. Replacing an existing set needs a fresh step-up; the `403` it answers without one is recognized by `isStepUpRequired()`, and `generateRecoveryCodesWithStepUp()` runs the step-up and tries again.
+  - Self-service account recovery: `startAccountRecovery(channel)`, `verifyAccountRecovery(code)`, `getAccountRecoveryStatus()`, `completeAccountRecovery()`, `cancelAccountRecovery(cancelToken)`, and for a signed-in owner `listAccountRecoveryRequests()` and `cancelAccountRecoveryRequest(id)`.
+  - Recovery sessions: redeeming a code or completing a recovery issues a session that can only enroll a factor. `isRecoverySession()` on the client and `recoverySession` in the session state report it, and the session actions `redeemRecoveryCode` and `completeAccountRecovery` sign in with it. After a passkey registration or TOTP enrollment made from a recovery session the client refreshes the session (`POST /refresh`), so the new access token drops the recovery claim the adapters' guards refuse.
+  - Flows for every binding: `loadRecoveryOptions()`, `recoveryCancelTokenFromHash()`, `cancelRecoveryFromLink()`, `recoveryErrorMessage()`, `recoveryCodesText()`, `passkeyKind()` and `passkeyDisplayName()`, plus `getRecoveryErrorCode()` and `isEnrollmentRequired()`.
+  - Bearer transport routes each recovery route with the credential the auth API's adapter manifest gives it.
+
+  Needs an auth API with account recovery (v0.20) and a server adapter that proxies its manifest routes.
+
+### Patch Changes
+
+- e5e6680: The bearer redirect guard now works on React Native. Its `fetch` follows redirects itself and never sets `response.redirected`, so a response that a redirect took to another origin was handed back as if it came from the API. A bearer request now rejects with `UntrustedRedirectError` whenever the response's final URL differs from the one requested and is not on `apiHost` or `trustedOrigins`. On React Native this detects such a redirect after it happened rather than preventing it, so the token may already have been sent on the followed hop.
+- e5e6680: The bearer `POST /refresh` no longer follows a redirect. It is sent with `redirect: 'manual'`, and any `3xx` answer, a redirect the browser hides, or a response that a platform followed to an origin outside `apiHost` and `trustedOrigins` (as React Native's `fetch` does) is refused with `UntrustedRedirectError`. The held session is cleared, because it can no longer be renewed through that server. Before, a redirect on the refresh route resent the refresh token to the redirect target.
+- e5e6680: The OAuth redirect ports now open only an `https` authorization URL, or `http` on `localhost`, `127.0.0.1` or `[::1]` for local development. The browser port (`createBrowserOAuthRedirect`) and the React Native port (`createWebBrowserOAuthRedirect`) throw the new `UnsafeAuthorizationUrlError` for anything else, such as a `javascript:` or `data:` URL in any letter case or with embedded tabs, and never navigate to it. `startOAuthSignIn`, which every bundled sign-in screen uses, reports that as a provider that could not start. A custom `OAuthRedirectPort` can use the new `assertNavigableAuthorizationUrl(url)`. Auth API 0.19.4 already refuses to store or return such a URL, so this guards against an older or misconfigured server.
+- dc52b23: Update `@seamless-auth/types` to 0.31.0, the contract for auth server v0.20.
+- a5956b0: Update `@seamless-auth/types` to 0.33.0. `AccountRecoveryRequest`, `AccountRecoveryRequestsResult` and `RecoveryErrorCode` now alias the upstream shapes, and `RecoveryErrorCode` gains `enrollment_required`.
+
+  The recovery session flag is now read from the `recovery` field of `/users/me` as well, so `isRecoverySession()` and the session state's `recoverySession` survive a reload, a background revalidation and `initialSession`. A restored recovery session is sent to enrollment by the bundled sign-in screen, and the session is refreshed after a passkey or TOTP enrollment made from it.
+
+- Updated dependencies [e5e6680]
+- Updated dependencies [e5e6680]
+- Updated dependencies [e5e6680]
+- Updated dependencies [44854d0]
+- Updated dependencies [e5e6680]
+- Updated dependencies [8dbd3d8]
+- Updated dependencies [8dbd3d8]
+- Updated dependencies [8dbd3d8]
+- Updated dependencies [dc52b23]
+- Updated dependencies [a5956b0]
+  - @seamless-auth/client@0.8.0
+
 ## 0.3.3
 
 ### Patch Changes

package/README.md

@@ -100,7 +100,10 @@ under the adapter's mount (`/auth/sessions`) is sent as an adapter call. The
 token goes only to `apiHost` and the origins in the provider's `trustedOrigins`
 prop; any other origin rejects with `UntrustedOriginError` before anything is
 sent. A response that a redirect took to any other origin rejects with
-`UntrustedRedirectError`, and the client never follows such a redirect itself:
+`UntrustedRedirectError`, and the client never follows such a redirect itself.
+React Native's `fetch` follows redirects before the client sees the response,
+though, so this detects a redirect to another origin after it happened rather
+than preventing it, and the token may already have been sent on that hop:
 
 ```ts
 const authorizedFetch = useAuthorizedFetch();
@@ -117,6 +120,12 @@ passkey step.
 Every method returns a `SeamlessAuthResult`: `{ data, error: null }` or
 `{ data: null, error }`. Nothing throws for a failed request.
 
+Account recovery comes from `@seamless-auth/client` as well: `useAuth()` carries
+`recoverySession`, `redeemRecoveryCode(code)` and `completeAccountRecovery()`, and the
+client has the recovery code and account recovery methods. After a passkey is enrolled
+from a recovery session the client refreshes the stored tokens, so the new access token
+no longer carries the recovery claim. See the client README for the full list.
+
 ### Passkeys
 
 Native passkeys need the relying party to be an associated domain of the app:
@@ -152,6 +161,9 @@ poll, and this one is not.
 it with `ports.oauthRedirect.open(url, redirectUri)`, which resolves with the
 callback's `code` and `state`, and finish with `finishOAuthLogin`.
 `redirectUri` must be registered with the provider and allowed by the auth API.
+The port opens only an `https` authorization URL (`http` only on a loopback
+host) and otherwise throws `UnsafeAuthorizationUrlError` without opening a
+browser.
 
 Newer auth servers also return a `binding` from `startOAuthLogin` and refuse a
 callback without it. The session actions keep it in memory with its `state` and

package/dist/index.js

@@ -1,2 +1,2 @@
-import{jsx as e}from"react/jsx-runtime";import{createAuthSession as t,createMemoryTokenStorage as r,loadLoginMethods as s,detectPasskeySupport as n,PasskeyCeremonyError as o}from"@seamless-auth/client";export{FALLBACK_LOGIN_METHODS,PasskeyCeremonyError,SeamlessAuthError,UntrustedOriginError,UntrustedRedirectError,createSeamlessAuthClient,encodePrfSalt,extractPasskeyPrfResult,getOAuthErrorCode,getPasskeyPolicyErrorCode,getWebAuthnErrorDetail,hasNonPasskeyLoginMethod,hasScopedRole,isUnauthenticated,roleGrantsAccess}from"@seamless-auth/client";import{createContext as a,useContext as i,useMemo as c,useSyncExternalStore as l,useEffect as u,useState as d}from"react";const h=a(void 0),y=()=>{const e=i(h);if(!e)throw new Error("useAuth must be used within an AuthProvider");return e},p=({children:s,apiHost:n,basePath:o,magicLinkRedirectUri:a,ports:i,fetch:d,trustedOrigins:y})=>{const{passkeys:p,oauthRedirect:f,tokenStorage:g}=i,m=y?JSON.stringify(y):void 0,k=c(()=>t({apiHost:n,magicLinkRedirectUri:a,passkeys:p,transport:{mode:"bearer",basePath:o,tokenStorage:g??r(),fetch:d,trustedOrigins:m?JSON.parse(m):void 0},detectPreviousSignIn:!1}),[n,o,a,p,g,d,m]),S=l(k.subscribe,k.getState,k.getState);u(()=>{k.actions.refreshSession()},[k]);const w=c(()=>({...S,...k.actions,apiHost:n,magicLinkRedirectUri:a,client:k.client,ports:{passkeys:p,oauthRedirect:f,tokenStorage:g}}),[S,k,n,a,p,f,g]);return e(h.Provider,{value:w,children:s})};function f(e,t){const r="ios"===e.OS?"iOS":"android"===e.OS?"Android":e.OS;return{friendlyName:t??`${r} device`,platform:e.OS,browser:"native",deviceInfo:`${r} ${String(e.Version)}`}}const g=()=>y().client,m=()=>y().client.authorizedFetch,k=()=>{const e=g(),[t,r]=d(null),[n,o]=d(!0);return u(()=>{let t=!0;return s(e).then(e=>{t&&(e&&r(e),o(!1))}),()=>{t=!1}},[e]),{loginMethods:t,loading:n}},S=()=>{const{ports:e}=y(),[t,r]=d(!1),[s,o]=d(!0);return u(()=>{let t=!0;return n(e.passkeys).then(e=>{t&&(r(e),o(!1))}),()=>{t=!1}},[e.passkeys]),{passkeySupported:t,loading:s}};function w(e){const t=e,r="string"==typeof t?.code?t.code:void 0,s="string"==typeof t?.name?t.name:"UnknownError",n="string"==typeof t?.message?t.message:"Passkey ceremony failed.",a=/cancel|abort|dismiss|NotAllowed|UserCancelled|1001/i.test(`${s} ${r??""} ${n}`)?"NotAllowedError":/InvalidState|exists|excluded|already/i.test(`${s} ${r??""} ${n}`)?"InvalidStateError":s;return new o(a,n,r??a,e)}function A(e){return{isSupported:()=>e.isSupported(),isPlatformAuthenticatorAvailable:async()=>e.isSupported(),async create(t){let r;try{r=await e.create(t)}catch(e){throw w(e)}if(!r)throw new o("NotAllowedError","Passkey registration was cancelled.");return r},async get(t){let r;try{r=await e.get(t)}catch(e){throw w(e)}if(!r)throw new o("NotAllowedError","Passkey sign-in was cancelled.");return r}}}function O(e,t={}){const r=t.key??"seamless-auth.session";return{async get(){try{const s=await e.getItemAsync(r,t.storeOptions);if(!s)return null;const n=JSON.parse(s);if(n&&"object"==typeof n&&"string"==typeof n.accessToken&&"string"==typeof n.refreshToken){const{accessToken:e,refreshToken:t}=n;return{accessToken:e,refreshToken:t}}return null}catch{return null}},async set(s){try{await e.setItemAsync(r,JSON.stringify({accessToken:s.accessToken,refreshToken:s.refreshToken}),t.storeOptions)}catch{}},async remove(){try{await e.deleteItemAsync(r,t.storeOptions)}catch{}}}}function P(e){let t;try{t=new URL(e).searchParams}catch{const r=e.split("?")[1];if(!r)return null;t=new URLSearchParams(r.split("#")[0])}const r=t.get("code"),s=t.get("state");return r&&s?{code:r,state:s}:null}function v(e,t){return{async open(r,s){const n=await e.openAuthSessionAsync(r,s,t);if("success"!==n.type||!n.url)return{type:"cancelled"};const o=P(n.url);return o?{type:"callback",...o}:{type:"cancelled"}}}}export{p as AuthProvider,A as createNativePasskeyPort,O as createSecureStoreTokenStorage,v as createWebBrowserOAuthRedirect,f as describeDevice,P as parseOAuthCallbackUrl,y as useAuth,g as useAuthClient,m as useAuthorizedFetch,k as useLoginMethods,S as usePasskeySupport};
+import{jsx as e}from"react/jsx-runtime";import{createAuthSession as t,createMemoryTokenStorage as r,loadLoginMethods as s,detectPasskeySupport as n,PasskeyCeremonyError as o,assertNavigableAuthorizationUrl as a}from"@seamless-auth/client";export{FALLBACK_LOGIN_METHODS,PasskeyCeremonyError,SeamlessAuthError,UntrustedOriginError,UntrustedRedirectError,createSeamlessAuthClient,encodePrfSalt,extractPasskeyPrfResult,getOAuthErrorCode,getPasskeyPolicyErrorCode,getWebAuthnErrorDetail,hasNonPasskeyLoginMethod,hasScopedRole,isUnauthenticated,roleGrantsAccess}from"@seamless-auth/client";import{createContext as i,useContext as c,useMemo as l,useSyncExternalStore as u,useEffect as d,useState as h}from"react";const y=i(void 0),p=()=>{const e=c(y);if(!e)throw new Error("useAuth must be used within an AuthProvider");return e},f=({children:s,apiHost:n,basePath:o,magicLinkRedirectUri:a,ports:i,fetch:c,trustedOrigins:h})=>{const{passkeys:p,oauthRedirect:f,tokenStorage:g}=i,m=h?JSON.stringify(h):void 0,k=l(()=>t({apiHost:n,magicLinkRedirectUri:a,passkeys:p,transport:{mode:"bearer",basePath:o,tokenStorage:g??r(),fetch:c,trustedOrigins:m?JSON.parse(m):void 0},detectPreviousSignIn:!1}),[n,o,a,p,g,c,m]),S=u(k.subscribe,k.getState,k.getState);d(()=>{k.actions.refreshSession()},[k]);const w=l(()=>({...S,...k.actions,apiHost:n,magicLinkRedirectUri:a,client:k.client,ports:{passkeys:p,oauthRedirect:f,tokenStorage:g}}),[S,k,n,a,p,f,g]);return e(y.Provider,{value:w,children:s})};function g(e,t){const r="ios"===e.OS?"iOS":"android"===e.OS?"Android":e.OS;return{friendlyName:t??`${r} device`,platform:e.OS,browser:"native",deviceInfo:`${r} ${String(e.Version)}`}}const m=()=>p().client,k=()=>p().client.authorizedFetch,S=()=>{const e=m(),[t,r]=h(null),[n,o]=h(!0);return d(()=>{let t=!0;return s(e).then(e=>{t&&(e&&r(e),o(!1))}),()=>{t=!1}},[e]),{loginMethods:t,loading:n}},w=()=>{const{ports:e}=p(),[t,r]=h(!1),[s,o]=h(!0);return d(()=>{let t=!0;return n(e.passkeys).then(e=>{t&&(r(e),o(!1))}),()=>{t=!1}},[e.passkeys]),{passkeySupported:t,loading:s}};function A(e){const t=e,r="string"==typeof t?.code?t.code:void 0,s="string"==typeof t?.name?t.name:"UnknownError",n="string"==typeof t?.message?t.message:"Passkey ceremony failed.",a=/cancel|abort|dismiss|NotAllowed|UserCancelled|1001/i.test(`${s} ${r??""} ${n}`)?"NotAllowedError":/InvalidState|exists|excluded|already/i.test(`${s} ${r??""} ${n}`)?"InvalidStateError":s;return new o(a,n,r??a,e)}function O(e){return{isSupported:()=>e.isSupported(),isPlatformAuthenticatorAvailable:async()=>e.isSupported(),async create(t){let r;try{r=await e.create(t)}catch(e){throw A(e)}if(!r)throw new o("NotAllowedError","Passkey registration was cancelled.");return r},async get(t){let r;try{r=await e.get(t)}catch(e){throw A(e)}if(!r)throw new o("NotAllowedError","Passkey sign-in was cancelled.");return r}}}function P(e,t={}){const r=t.key??"seamless-auth.session";return{async get(){try{const s=await e.getItemAsync(r,t.storeOptions);if(!s)return null;const n=JSON.parse(s);if(n&&"object"==typeof n&&"string"==typeof n.accessToken&&"string"==typeof n.refreshToken){const{accessToken:e,refreshToken:t}=n;return{accessToken:e,refreshToken:t}}return null}catch{return null}},async set(s){try{await e.setItemAsync(r,JSON.stringify({accessToken:s.accessToken,refreshToken:s.refreshToken}),t.storeOptions)}catch{}},async remove(){try{await e.deleteItemAsync(r,t.storeOptions)}catch{}}}}function v(e){let t;try{t=new URL(e).searchParams}catch{const r=e.split("?")[1];if(!r)return null;t=new URLSearchParams(r.split("#")[0])}const r=t.get("code"),s=t.get("state");return r&&s?{code:r,state:s}:null}function E(e,t){return{async open(r,s){a(r);const n=await e.openAuthSessionAsync(r,s,t);if("success"!==n.type||!n.url)return{type:"cancelled"};const o=v(n.url);return o?{type:"callback",...o}:{type:"cancelled"}}}}export{f as AuthProvider,O as createNativePasskeyPort,P as createSecureStoreTokenStorage,E as createWebBrowserOAuthRedirect,g as describeDevice,v as parseOAuthCallbackUrl,p as useAuth,m as useAuthClient,k as useAuthorizedFetch,S as useLoginMethods,w as usePasskeySupport};
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../src/AuthProvider.tsx","../src/deviceInfo.ts","../src/hooks/useAuthClient.ts","../src/hooks/useAuthorizedFetch.ts","../src/hooks/useLoginMethods.ts","../src/hooks/usePasskeySupport.ts","../src/ports/nativePasskeys.ts","../src/ports/secureStoreTokenStorage.ts","../src/ports/webBrowserOAuthRedirect.ts"],"sourcesContent":[null,null,null,null,null,null,null,null,null],"names":["AuthContext","createContext","undefined","useAuth","context","useContext","Error","AuthProvider","children","apiHost","basePath","magicLinkRedirectUri","ports","fetch","fetchImpl","trustedOrigins","passkeys","oauthRedirect","tokenStorage","trustedOriginsKey","JSON","stringify","session","useMemo","createAuthSession","transport","mode","createMemoryTokenStorage","parse","detectPreviousSignIn","state","useSyncExternalStore","subscribe","getState","useEffect","actions","refreshSession","value","client","_jsx","Provider","describeDevice","platform","friendlyName","os","OS","browser","deviceInfo","String","Version","useAuthClient","useAuthorizedFetch","authorizedFetch","useLoginMethods","authClient","loginMethods","setLoginMethods","useState","loading","setLoading","active","loadLoginMethods","then","methods","usePasskeySupport","passkeySupported","setPasskeySupported","detectPasskeySupport","supported","toCeremonyError","thrown","error","code","rawName","name","message","test","PasskeyCeremonyError","createNativePasskeyPort","native","isSupported","isPlatformAuthenticatorAvailable","async","create","optionsJSON","result","get","createSecureStoreTokenStorage","store","options","key","raw","getItemAsync","storeOptions","parsed","accessToken","refreshToken","set","tokens","setItemAsync","remove","deleteItemAsync","parseOAuthCallbackUrl","url","params","URL","searchParams","query","split","URLSearchParams","createWebBrowserOAuthRedirect","open","authorizationUrl","redirectUri","openAuthSessionAsync","type","callback"],"mappings":"6pBA6CA,MAAMA,EAAcC,OAA2CC,GAElDC,EAAU,KACrB,MAAMC,EAAUC,EAAWL,GAC3B,IAAKI,EACH,MAAM,IAAIE,MAAM,+CAElB,OAAOF,GA2BIG,EAA4C,EACvDC,WACAC,UACAC,WACAC,uBACAC,QACAC,MAAOC,EACPC,qBAEA,MAAMC,SAAEA,EAAQC,cAAEA,EAAaC,aAAEA,GAAiBN,EAE5CO,EAAoBJ,EAAiBK,KAAKC,UAAUN,QAAkBb,EAEtEoB,EAAUC,EACd,IACEC,EAAkB,CAChBf,UACAE,uBACAK,WACAS,UAAW,CACTC,KAAM,SACNhB,WACAQ,aAAcA,GAAgBS,IAC9Bd,MAAOC,EACPC,eAAgBI,EACXC,KAAKQ,MAAMT,QACZjB,GAIN2B,sBAAsB,IAE1B,CACEpB,EACAC,EACAC,EACAK,EACAE,EACAJ,EACAK,IAIEW,EAAQC,EACZT,EAAQU,UACRV,EAAQW,SACRX,EAAQW,UAMVC,EAAU,KACHZ,EAAQa,QAAQC,kBACpB,CAACd,IAEJ,MAAMe,EAAQd,EACZ,KAAA,IACKO,KACAR,EAAQa,QACX1B,UACAE,uBACA2B,OAAQhB,EAAQgB,OAChB1B,MAAO,CAAEI,WAAUC,gBAAeC,kBAEpC,CAACY,EAAOR,EAASb,EAASE,EAAsBK,EAAUC,EAAeC,IAG3E,OAAOqB,EAACvC,EAAYwC,SAAQ,CAACH,MAAOA,EAAK7B,SAAGA,KC5HxC,SAAUiC,EACdC,EACAC,GAEA,MAAMC,EACY,QAAhBF,EAASG,GAAe,MAAwB,YAAhBH,EAASG,GAAmB,UAAYH,EAASG,GAEnF,MAAO,CACLF,aAAcA,GAAgB,GAAGC,WACjCF,SAAUA,EAASG,GACnBC,QAAS,SACTC,WAAY,GAAGH,KAAMI,OAAON,EAASO,WAEzC,CCxBO,MAAMC,EAAgB,IAAM/C,IAAUmC,OCAhCa,EAAqB,IAAMhD,IAAUmC,OAAOc,gBCU5CC,EAAkB,KAC7B,MAAMC,EAAaJ,KACZK,EAAcC,GAAmBC,EAA+B,OAChEC,EAASC,GAAcF,GAAS,GAmBvC,OAjBAvB,EAAU,KACR,IAAI0B,GAAS,EAWb,OATKC,EAAiBP,GAAYQ,KAAKC,IAChCH,IAEDG,GACFP,EAAgBO,GAElBJ,GAAW,MAGN,KACLC,GAAS,IAEV,CAACN,IAEG,CAAEC,eAAcG,YChCZM,EAAoB,KAC/B,MAAMpD,MAAEA,GAAUT,KACX8D,EAAkBC,GAAuBT,GAAS,IAClDC,EAASC,GAAcF,GAAS,GAiBvC,OAfAvB,EAAU,KACR,IAAI0B,GAAS,EASb,OAPKO,EAAqBvD,EAAMI,UAAU8C,KAAKM,IACzCR,IACFM,EAAoBE,GACpBT,GAAW,MAIR,KACLC,GAAS,IAEV,CAAChD,EAAMI,WAEH,CAAEiD,mBAAkBP,YCG7B,SAASW,EAAgBC,GACvB,MAAMC,EAAQD,EACRE,EAA8B,iBAAhBD,GAAOC,KAAoBD,EAAMC,UAAOtE,EACtDuE,EAAiC,iBAAhBF,GAAOG,KAAoBH,EAAMG,KAAO,eACzDC,EACsB,iBAAnBJ,GAAOI,QAAuBJ,EAAMI,QAAU,2BAKjDD,EAHY,sDAGKE,KAAK,GAAGH,KAAWD,GAAQ,MAAMG,KACpD,kBAHc,wCAIJC,KAAK,GAAGH,KAAWD,GAAQ,MAAMG,KACzC,oBACAF,EAEN,OAAO,IAAII,EAAqBH,EAAMC,EAASH,GAAQE,EAAMJ,EAC/D,CAeM,SAAUQ,EACdC,GAEA,MAAO,CACLC,YAAa,IAAMD,EAAOC,cAI1BC,iCAAkCC,SAAYH,EAAOC,cAErD,YAAMG,CAAOC,GACX,IAAIC,EACJ,IACEA,QAAgBN,EAAOI,OACrBC,EAEJ,CAAE,MAAOb,GACP,MAAMF,EAAgBE,EACxB,CACA,IAAKc,EACH,MAAM,IAAIR,EACR,kBACA,uCAGJ,OAAOQ,CACT,EAEA,SAAMC,CAAIF,GACR,IAAIC,EACJ,IACEA,QAAgBN,EAAOO,IACrBF,EAEJ,CAAE,MAAOb,GACP,MAAMF,EAAgBE,EACxB,CACA,IAAKc,EACH,MAAM,IAAIR,EACR,kBACA,kCAGJ,OAAOQ,CACT,EAEJ,UCxEgBE,EACdC,EACAC,EAA0C,IAE1C,MAAMC,EAAMD,EAAQC,KAnBF,wBAqBlB,MAAO,CACL,SAAMJ,GACJ,IACE,MAAMK,QAAYH,EAAMI,aAAaF,EAAKD,EAAQI,cAClD,IAAKF,EAAK,OAAO,KAEjB,MAAMG,EAAkB1E,KAAKQ,MAAM+D,GACnC,GACEG,GACkB,iBAAXA,GACyC,iBAAxCA,EAAwBC,aACiB,iBAAzCD,EAAwBE,aAChC,CACA,MAAMD,YAAEA,EAAWC,aAAEA,GAAiBF,EACtC,MAAO,CAAEC,cAAaC,eACxB,CACA,OAAO,IACT,CAAE,MACA,OAAO,IACT,CACF,EAEA,SAAMC,CAAIC,GACR,UACQV,EAAMW,aACVT,EACAtE,KAAKC,UAAU,CACb0E,YAAaG,EAAOH,YACpBC,aAAcE,EAAOF,eAEvBP,EAAQI,aAEZ,CAAE,MAGF,CACF,EAEA,YAAMO,GACJ,UACQZ,EAAMa,gBAAgBX,EAAKD,EAAQI,aAC3C,CAAE,MAEF,CACF,EAEJ,CCrEM,SAAUS,EACdC,GAEA,IAAIC,EACJ,IACEA,EAAS,IAAIC,IAAIF,GAAKG,YACxB,CAAE,MAGA,MAAMC,EAAQJ,EAAIK,MAAM,KAAK,GAC7B,IAAKD,EAAO,OAAO,KACnBH,EAAS,IAAIK,gBAAgBF,EAAMC,MAAM,KAAK,GAChD,CAEA,MAAMpC,EAAOgC,EAAOlB,IAAI,QAClBxD,EAAQ0E,EAAOlB,IAAI,SACzB,OAAOd,GAAQ1C,EAAQ,CAAE0C,OAAM1C,SAAU,IAC3C,CAeM,SAAUgF,EACdhE,EACA2C,GAEA,MAAO,CACL,UAAMsB,CAAKC,EAAkBC,GAC3B,MAAM5B,QAAevC,EAAQoE,qBAC3BF,EACAC,EACAxB,GAGF,GAAoB,YAAhBJ,EAAO8B,OAAuB9B,EAAOkB,IACvC,MAAO,CAAEY,KAAM,aAGjB,MAAMC,EAAWd,EAAsBjB,EAAOkB,KAC9C,OAAOa,EAAW,CAAED,KAAM,cAAeC,GAAa,CAAED,KAAM,YAChE,EAEJ"}
+{"version":3,"file":"index.js","sources":["../src/AuthProvider.tsx","../src/deviceInfo.ts","../src/hooks/useAuthClient.ts","../src/hooks/useAuthorizedFetch.ts","../src/hooks/useLoginMethods.ts","../src/hooks/usePasskeySupport.ts","../src/ports/nativePasskeys.ts","../src/ports/secureStoreTokenStorage.ts","../src/ports/webBrowserOAuthRedirect.ts"],"sourcesContent":[null,null,null,null,null,null,null,null,null],"names":["AuthContext","createContext","undefined","useAuth","context","useContext","Error","AuthProvider","children","apiHost","basePath","magicLinkRedirectUri","ports","fetch","fetchImpl","trustedOrigins","passkeys","oauthRedirect","tokenStorage","trustedOriginsKey","JSON","stringify","session","useMemo","createAuthSession","transport","mode","createMemoryTokenStorage","parse","detectPreviousSignIn","state","useSyncExternalStore","subscribe","getState","useEffect","actions","refreshSession","value","client","_jsx","Provider","describeDevice","platform","friendlyName","os","OS","browser","deviceInfo","String","Version","useAuthClient","useAuthorizedFetch","authorizedFetch","useLoginMethods","authClient","loginMethods","setLoginMethods","useState","loading","setLoading","active","loadLoginMethods","then","methods","usePasskeySupport","passkeySupported","setPasskeySupported","detectPasskeySupport","supported","toCeremonyError","thrown","error","code","rawName","name","message","test","PasskeyCeremonyError","createNativePasskeyPort","native","isSupported","isPlatformAuthenticatorAvailable","async","create","optionsJSON","result","get","createSecureStoreTokenStorage","store","options","key","raw","getItemAsync","storeOptions","parsed","accessToken","refreshToken","set","tokens","setItemAsync","remove","deleteItemAsync","parseOAuthCallbackUrl","url","params","URL","searchParams","query","split","URLSearchParams","createWebBrowserOAuthRedirect","open","authorizationUrl","redirectUri","assertNavigableAuthorizationUrl","openAuthSessionAsync","type","callback"],"mappings":"ksBA6CA,MAAMA,EAAcC,OAA2CC,GAElDC,EAAU,KACrB,MAAMC,EAAUC,EAAWL,GAC3B,IAAKI,EACH,MAAM,IAAIE,MAAM,+CAElB,OAAOF,GA2BIG,EAA4C,EACvDC,WACAC,UACAC,WACAC,uBACAC,QACAC,MAAOC,EACPC,qBAEA,MAAMC,SAAEA,EAAQC,cAAEA,EAAaC,aAAEA,GAAiBN,EAE5CO,EAAoBJ,EAAiBK,KAAKC,UAAUN,QAAkBb,EAEtEoB,EAAUC,EACd,IACEC,EAAkB,CAChBf,UACAE,uBACAK,WACAS,UAAW,CACTC,KAAM,SACNhB,WACAQ,aAAcA,GAAgBS,IAC9Bd,MAAOC,EACPC,eAAgBI,EACXC,KAAKQ,MAAMT,QACZjB,GAIN2B,sBAAsB,IAE1B,CACEpB,EACAC,EACAC,EACAK,EACAE,EACAJ,EACAK,IAIEW,EAAQC,EACZT,EAAQU,UACRV,EAAQW,SACRX,EAAQW,UAMVC,EAAU,KACHZ,EAAQa,QAAQC,kBACpB,CAACd,IAEJ,MAAMe,EAAQd,EACZ,KAAA,IACKO,KACAR,EAAQa,QACX1B,UACAE,uBACA2B,OAAQhB,EAAQgB,OAChB1B,MAAO,CAAEI,WAAUC,gBAAeC,kBAEpC,CAACY,EAAOR,EAASb,EAASE,EAAsBK,EAAUC,EAAeC,IAG3E,OAAOqB,EAACvC,EAAYwC,SAAQ,CAACH,MAAOA,EAAK7B,SAAGA,KC5HxC,SAAUiC,EACdC,EACAC,GAEA,MAAMC,EACY,QAAhBF,EAASG,GAAe,MAAwB,YAAhBH,EAASG,GAAmB,UAAYH,EAASG,GAEnF,MAAO,CACLF,aAAcA,GAAgB,GAAGC,WACjCF,SAAUA,EAASG,GACnBC,QAAS,SACTC,WAAY,GAAGH,KAAMI,OAAON,EAASO,WAEzC,CCxBO,MAAMC,EAAgB,IAAM/C,IAAUmC,OCAhCa,EAAqB,IAAMhD,IAAUmC,OAAOc,gBCU5CC,EAAkB,KAC7B,MAAMC,EAAaJ,KACZK,EAAcC,GAAmBC,EAA+B,OAChEC,EAASC,GAAcF,GAAS,GAmBvC,OAjBAvB,EAAU,KACR,IAAI0B,GAAS,EAWb,OATKC,EAAiBP,GAAYQ,KAAKC,IAChCH,IAEDG,GACFP,EAAgBO,GAElBJ,GAAW,MAGN,KACLC,GAAS,IAEV,CAACN,IAEG,CAAEC,eAAcG,YChCZM,EAAoB,KAC/B,MAAMpD,MAAEA,GAAUT,KACX8D,EAAkBC,GAAuBT,GAAS,IAClDC,EAASC,GAAcF,GAAS,GAiBvC,OAfAvB,EAAU,KACR,IAAI0B,GAAS,EASb,OAPKO,EAAqBvD,EAAMI,UAAU8C,KAAKM,IACzCR,IACFM,EAAoBE,GACpBT,GAAW,MAIR,KACLC,GAAS,IAEV,CAAChD,EAAMI,WAEH,CAAEiD,mBAAkBP,YCG7B,SAASW,EAAgBC,GACvB,MAAMC,EAAQD,EACRE,EAA8B,iBAAhBD,GAAOC,KAAoBD,EAAMC,UAAOtE,EACtDuE,EAAiC,iBAAhBF,GAAOG,KAAoBH,EAAMG,KAAO,eACzDC,EACsB,iBAAnBJ,GAAOI,QAAuBJ,EAAMI,QAAU,2BAKjDD,EAHY,sDAGKE,KAAK,GAAGH,KAAWD,GAAQ,MAAMG,KACpD,kBAHc,wCAIJC,KAAK,GAAGH,KAAWD,GAAQ,MAAMG,KACzC,oBACAF,EAEN,OAAO,IAAII,EAAqBH,EAAMC,EAASH,GAAQE,EAAMJ,EAC/D,CAeM,SAAUQ,EACdC,GAEA,MAAO,CACLC,YAAa,IAAMD,EAAOC,cAI1BC,iCAAkCC,SAAYH,EAAOC,cAErD,YAAMG,CAAOC,GACX,IAAIC,EACJ,IACEA,QAAgBN,EAAOI,OACrBC,EAEJ,CAAE,MAAOb,GACP,MAAMF,EAAgBE,EACxB,CACA,IAAKc,EACH,MAAM,IAAIR,EACR,kBACA,uCAGJ,OAAOQ,CACT,EAEA,SAAMC,CAAIF,GACR,IAAIC,EACJ,IACEA,QAAgBN,EAAOO,IACrBF,EAEJ,CAAE,MAAOb,GACP,MAAMF,EAAgBE,EACxB,CACA,IAAKc,EACH,MAAM,IAAIR,EACR,kBACA,kCAGJ,OAAOQ,CACT,EAEJ,UCxEgBE,EACdC,EACAC,EAA0C,IAE1C,MAAMC,EAAMD,EAAQC,KAnBF,wBAqBlB,MAAO,CACL,SAAMJ,GACJ,IACE,MAAMK,QAAYH,EAAMI,aAAaF,EAAKD,EAAQI,cAClD,IAAKF,EAAK,OAAO,KAEjB,MAAMG,EAAkB1E,KAAKQ,MAAM+D,GACnC,GACEG,GACkB,iBAAXA,GACyC,iBAAxCA,EAAwBC,aACiB,iBAAzCD,EAAwBE,aAChC,CACA,MAAMD,YAAEA,EAAWC,aAAEA,GAAiBF,EACtC,MAAO,CAAEC,cAAaC,eACxB,CACA,OAAO,IACT,CAAE,MACA,OAAO,IACT,CACF,EAEA,SAAMC,CAAIC,GACR,UACQV,EAAMW,aACVT,EACAtE,KAAKC,UAAU,CACb0E,YAAaG,EAAOH,YACpBC,aAAcE,EAAOF,eAEvBP,EAAQI,aAEZ,CAAE,MAGF,CACF,EAEA,YAAMO,GACJ,UACQZ,EAAMa,gBAAgBX,EAAKD,EAAQI,aAC3C,CAAE,MAEF,CACF,EAEJ,CClEM,SAAUS,EACdC,GAEA,IAAIC,EACJ,IACEA,EAAS,IAAIC,IAAIF,GAAKG,YACxB,CAAE,MAGA,MAAMC,EAAQJ,EAAIK,MAAM,KAAK,GAC7B,IAAKD,EAAO,OAAO,KACnBH,EAAS,IAAIK,gBAAgBF,EAAMC,MAAM,KAAK,GAChD,CAEA,MAAMpC,EAAOgC,EAAOlB,IAAI,QAClBxD,EAAQ0E,EAAOlB,IAAI,SACzB,OAAOd,GAAQ1C,EAAQ,CAAE0C,OAAM1C,SAAU,IAC3C,CAeM,SAAUgF,EACdhE,EACA2C,GAEA,MAAO,CACL,UAAMsB,CAAKC,EAAkBC,GAC3BC,EAAgCF,GAChC,MAAM3B,QAAevC,EAAQqE,qBAC3BH,EACAC,EACAxB,GAGF,GAAoB,YAAhBJ,EAAO+B,OAAuB/B,EAAOkB,IACvC,MAAO,CAAEa,KAAM,aAGjB,MAAMC,EAAWf,EAAsBjB,EAAOkB,KAC9C,OAAOc,EAAW,CAAED,KAAM,cAAeC,GAAa,CAAED,KAAM,YAChE,EAEJ"}

package/dist/ports/webBrowserOAuthRedirect.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthRedirectPort } from '@seamless-auth/client';
+import { type OAuthRedirectPort } from '@seamless-auth/client';
 /**
  * The part of `expo-web-browser` this port uses. Passed in rather than
  * imported, like the other native modules.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/react-native",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "Headless React Native binding for Seamless Auth: provider, hooks, and the native ports for passkeys, secure token storage, and in-app browser OAuth.",
   "type": "module",
   "exports": {
@@ -45,8 +45,8 @@
     "react": "^18.0.0 || ^19.0.0"
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.7.1",
-    "@seamless-auth/types": "^0.29.0"
+    "@seamless-auth/client": "^0.8.0",
+    "@seamless-auth/types": "^0.33.0"
   },
   "sideEffects": false
 }