@seamless-auth/react 0.18.0 → 0.18.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @seamless-auth/react
 
+## 0.18.1
+
+### Patch Changes
+
+- 15ed347: The SMS terms modal now lists `support@fellscode.com` as the opt-out and support contact.
+- f21867d: OAuth sign-in now carries the state binding the auth server returns from `POST /oauth/:providerId/start` back to the callback. The session actions `startOAuthLogin` and `finishOAuthLogin` (and so `useAuth()` in React and React Native, and the Angular, Vue and Svelte bindings) store the binding with its state, attach it to the matching callback, and clear it afterwards, so apps that call these actions directly need no code change. The binding is kept in `sessionStorage` under `seamless:oauth:binding` in a browser and in memory elsewhere, and is never sent to the provider or put in a URL. `startOAuthSignIn` passes it explicitly when an in-app browser hands the callback back, and now refuses a callback whose state is not the one it started.
+
+  `StartOAuthLoginResult` gains an optional `binding` and `FinishOAuthLoginInput` an optional `binding`. Older auth servers return no binding and are unaffected. Auth API 0.19.x with fells-code/seamless-auth-api#463 refuses a callback without the binding, so upgrade this SDK before or with that API release.
+
+- Updated dependencies [f21867d]
+  - @seamless-auth/client@0.7.1
+
 ## 0.18.0
 
 ### Minor Changes

package/README.md

@@ -574,6 +574,14 @@ function OAuthCallback() {
 }
 ```
 
+Auth servers that bind the OAuth state to the client that started sign-in (API 0.19.x with
+fells-code/seamless-auth-api#463) return a `binding` from `startOAuthLogin` and refuse a callback
+without it (`400`, `Invalid OAuth state`). The `useAuth()` actions handle this for you:
+`startOAuthLogin` keeps the binding in `sessionStorage` under `seamless:oauth:binding`, keyed to its
+`state`, and `finishOAuthLogin` sends it with the matching callback and then clears it. Only pass
+`binding` yourself if you start and finish on different `useAuth()` instances or with the headless
+client, and keep it out of URLs: it goes to your auth server, never to the provider.
+
 Some callback failures are the user's to fix, so the API returns a stable `code` alongside the error
 message. `getOAuthErrorCode()` narrows it to the codes this SDK knows about and returns `undefined`
 for everything else, so unexpected failures keep your generic message:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/react",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "A drop-in authentication solution for modern React applications.",
   "type": "module",
   "exports": {
@@ -56,8 +56,8 @@
     }
   },
   "dependencies": {
-    "@seamless-auth/client": "^0.7.0",
-    "@seamless-auth/types": "^0.28.0",
+    "@seamless-auth/client": "^0.7.1",
+    "@seamless-auth/types": "^0.29.0",
     "@simplewebauthn/browser": "^13.1.0",
     "libphonenumber-js": "^1.12.7"
   },