@softr/sdk 0.0.24 → 0.0.26-alpha-0

package/dist/auth/methods/magicLink.js

@@ -0,0 +1,53 @@
+import { assert, panic } from "../../assertions.js";
+import { writeCookies } from "../../cookies.js";
+import { sessionConfig } from "../config.js";
+import { makePlatform } from "../platform.js";
+import { makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie } from "../session.js";
+import { authError } from "./utils.js";
+
+//#region src/auth/methods/magicLink.ts
+/**
+* Signs a visitor in with the token from a magic link they followed.
+*
+* The token keeps working after it is used, so anyone holding the link can sign
+* in as that visitor. Never log it, and redirect away from the URL that carried
+* it.
+*
+*/
+async function signInWithMagicLink(credentials) {
+	const result = await makePlatform(sessionConfig().applicationId).signInWithMagicLink(credentials);
+	if (!result.ok) {
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status === 400 || result.status === 401) return authError("invalidCredentials", result.message);
+		if (result.status >= 500) panic(`Expected magic-link sign-in to succeed, but got ${result.status}: ` + result.message);
+		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app signs people in with a magic link.`);
+	}
+	if (result.data.status === "MFA_REQUIRED") {
+		const { mfa } = result.data;
+		assert(mfa, "Expected a challenge from magic-link sign-in, but got none");
+		writeCookies([makePendingAuthCookie(mfa.challengeToken)]);
+		return {
+			success: true,
+			data: {
+				status: "authenticatorRequired",
+				step: mfa.action === "VERIFICATION_REQUIRED" ? "verify" : mfa.action === "SETUP_REQUIRED" ? "setup" : "setupOptional"
+			}
+		};
+	}
+	const { session } = result.data;
+	assert(session, "Expected a session from magic-link sign-in, but got none");
+	writeCookies([makeSessionTokenCookie(session.jwt), makeSessionDataCookie({
+		user: session.user,
+		permissions: session.permissions
+	}, session.jwt)]);
+	return {
+		success: true,
+		data: {
+			status: "signedIn",
+			user: session.user
+		}
+	};
+}
+
+//#endregion
+export { signInWithMagicLink };

package/dist/auth/methods/password.d.ts

@@ -5,17 +5,31 @@ import { AuthError, Result } from "./utils.js";
 
 /**
  * Signs a visitor in with an email and password.
+ *
+ * A `signedIn` result means the visitor is signed in. An app that also asks for
+ * an authenticator app answers `authenticatorRequired` instead, naming the step
+ * to send them to next.
  */
 declare function signIn(credentials: {
   email: string;
   password: string;
-}): Promise<Result<User, AuthError>>;
+}): Promise<Result<{
+  status: "signedIn";
+  user: User;
+} | {
+  status: "authenticatorRequired";
+  /**
+   * `verify`: they have an authenticator app and owe a code.
+   * `setup`: the app requires one and they have none yet.
+   * `setupOptional`: same, except they may skip it instead.
+   */
+  step: "verify" | "setup" | "setupOptional";
+}, AuthError>>;
 /**
- * Signs the visitor out and clears the session cookies.
+ * Signs the visitor out.
  *
- * This revokes **every** outstanding session for that user in this app, on every
- * device: the platform stamps `tokensInvalidatedAt` and rejects anything issued
- * before it. There is no per-device sign-out.
+ * This ends **every** session that user has in this app, on every device. There
+ * is no per-device sign-out.
  */
 declare function signOut(): Promise<void>;
 //#endregion

package/dist/auth/methods/password.js

@@ -1,44 +1,65 @@
-import { panic, softAssert } from "../../assertions.js";
+import { assert, panic, softAssert } from "../../assertions.js";
 import { writeCookies } from "../../cookies.js";
 import { sessionConfig } from "../config.js";
 import { makePlatform } from "../platform.js";
-import { clearSession, makeSessionDataCookie, makeSessionTokenCookie, readSessionToken } from "../session.js";
+import { clearPendingAuth, clearSession, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie, readSessionToken } from "../session.js";
 import { authError } from "./utils.js";
 
 //#region src/auth/methods/password.ts
 /**
 * Signs a visitor in with an email and password.
+*
+* A `signedIn` result means the visitor is signed in. An app that also asks for
+* an authenticator app answers `authenticatorRequired` instead, naming the step
+* to send them to next.
 */
 async function signIn(credentials) {
 	const result = await makePlatform(sessionConfig().applicationId).tokens(credentials);
 	if (!result.ok) {
-		if (result.status === 401 || result.status === 429) return authError(result.status === 401 ? "invalidCredentials" : "tooManyAttempts", result.message);
-		if (result.status >= 500) panic(result.message);
+		if (result.status === 401) return authError("invalidCredentials", result.message);
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status >= 500) panic(`Expected sign-in to succeed, but got ${result.status}: ` + result.message);
 		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app allows sign-in.`);
 	}
-	const { jwt, user, permissions } = result.data;
-	writeCookies([makeSessionTokenCookie(jwt), makeSessionDataCookie({
-		user,
-		permissions
-	}, jwt)]);
+	if (result.data.status === "MFA_REQUIRED") {
+		const { mfa } = result.data;
+		assert(mfa, "Expected a challenge from sign-in, but got none");
+		writeCookies([makePendingAuthCookie(mfa.challengeToken)]);
+		return {
+			success: true,
+			data: {
+				status: "authenticatorRequired",
+				step: mfa.action === "VERIFICATION_REQUIRED" ? "verify" : mfa.action === "SETUP_REQUIRED" ? "setup" : "setupOptional"
+			}
+		};
+	}
+	const { session } = result.data;
+	assert(session, "Expected a session from sign-in, but got none");
+	writeCookies([makeSessionTokenCookie(session.jwt), makeSessionDataCookie({
+		user: session.user,
+		permissions: session.permissions
+	}, session.jwt)]);
+	clearPendingAuth();
 	return {
 		success: true,
-		data: user
+		data: {
+			status: "signedIn",
+			user: session.user
+		}
 	};
 }
 /**
-* Signs the visitor out and clears the session cookies.
+* Signs the visitor out.
 *
-* This revokes **every** outstanding session for that user in this app, on every
-* device: the platform stamps `tokensInvalidatedAt` and rejects anything issued
-* before it. There is no per-device sign-out.
+* This ends **every** session that user has in this app, on every device. There
+* is no per-device sign-out.
 */
 async function signOut() {
 	const token = readSessionToken();
 	clearSession();
 	if (!token) return;
 	const result = await makePlatform(sessionConfig().applicationId).signOut(token);
-	softAssert(result.ok || result.status < 500, () => `Could not revoke the session (${result.status}). This browser is signed out, but other devices may still be.`);
+	softAssert(result.ok || result.status < 500, () => `Expected sign-out to succeed, but got ${result.status}. This browser is signed out, other devices may not be.`);
 }
 
 //#endregion

package/dist/auth/methods/signup.d.ts

@@ -13,25 +13,33 @@ declare function signUp(details: {
   name?: string;
 }): Promise<Result<null, AuthError>>;
 /**
- * Finishes sign-up flow with the emailed code and signs the visitor in.
+ * Finishes a sign-up with the emailed code, creating the account and signing
+ * the visitor in.
  *
- * The platform splits on how the app is configured: a code-only app creates the
- * user on the second `sign-up` request and answers with a token, while a
- * password app answers it with an empty 200 and expects the password on
- * `users/new`.
+ * `password` is what the account is created with. Leave it out only for an app
+ * that signs people in with an emailed code. An app expecting a password
+ * rejects a sign-up without one, and the other way round.
+ *
+ * A `signedIn` result means the visitor is signed in. An app that also asks for
+ * an authenticator app answers `authenticatorRequired` instead, naming the step
+ * to send them to next.
  */
 declare function confirmSignUp(details: {
   email: string;
-  /**
-   * What `users/new` creates the account with, and unused on a code-only app,
-   * which never reaches that request.
-   *
-   * TODO: temporary in one respect — it is spent a second time on the
-   * 400-after-create workaround below, which goes away with the platform fix.
-   */
-  password: string;
   code: string;
   name?: string;
-}): Promise<Result<User, AuthError>>;
+  password?: string;
+}): Promise<Result<{
+  status: "signedIn";
+  user: User;
+} | {
+  status: "authenticatorRequired";
+  /**
+   * `verify`: they have an authenticator app and owe a code.
+   * `setup`: the app requires one and they have none yet.
+   * `setupOptional`: same, except they may skip it instead.
+   */
+  step: "verify" | "setup" | "setupOptional";
+}, AuthError>>;
 //#endregion
 export { confirmSignUp, signUp };

package/dist/auth/methods/signup.js

@@ -1,10 +1,9 @@
-import { panic, todo } from "../../assertions.js";
+import { assert, panic } from "../../assertions.js";
 import { writeCookies } from "../../cookies.js";
 import { sessionConfig } from "../config.js";
 import { makePlatform } from "../platform.js";
-import { makeSessionDataCookie, makeSessionTokenCookie } from "../session.js";
+import { clearPendingAuth, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie } from "../session.js";
 import { authError } from "./utils.js";
-import { signIn } from "./password.js";
 
 //#region src/auth/methods/signup.ts
 /**
@@ -13,11 +12,13 @@ import { signIn } from "./password.js";
 * User only exists once `confirmSignUp` returns the code.
 */
 async function signUp(details) {
-	const result = await makePlatform(sessionConfig().applicationId).signUp(signUpBody(details));
+	const result = await makePlatform(sessionConfig().applicationId).sendSignUpCode(details);
 	if (!result.ok) {
-		if (result.status >= 500) panic(result.message);
 		if (result.status === 409) return authError("emailTaken", result.message);
-		return authError("invalidDetails", result.message);
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status === 400) return authError("invalidDetails", result.message);
+		if (result.status >= 500) panic(`Expected the sign-up code to be emailed, but got ${result.status}: ` + result.message);
+		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app allows sign-up.`);
 	}
 	return {
 		success: true,
@@ -25,63 +26,56 @@ async function signUp(details) {
 	};
 }
 /**
-* Finishes sign-up flow with the emailed code and signs the visitor in.
+* Finishes a sign-up with the emailed code, creating the account and signing
+* the visitor in.
 *
-* The platform splits on how the app is configured: a code-only app creates the
-* user on the second `sign-up` request and answers with a token, while a
-* password app answers it with an empty 200 and expects the password on
-* `users/new`.
+* `password` is what the account is created with. Leave it out only for an app
+* that signs people in with an emailed code. An app expecting a password
+* rejects a sign-up without one, and the other way round.
+*
+* A `signedIn` result means the visitor is signed in. An app that also asks for
+* an authenticator app answers `authenticatorRequired` instead, naming the step
+* to send them to next.
 */
 async function confirmSignUp(details) {
 	const platform = makePlatform(sessionConfig().applicationId);
-	const verified = await platform.signUp({
-		...signUpBody(details),
-		token: details.code
+	const { password,...rest } = details;
+	const result = password === void 0 ? await platform.signUpWithCode(rest) : await platform.signUpWithPassword({
+		...rest,
+		password
 	});
-	if (!verified.ok) {
-		if (verified.status >= 500) panic(verified.message);
-		if (verified.status === 409) return authError("emailTaken", verified.message);
-		return authError("invalidCode", verified.message);
+	if (!result.ok) {
+		if (result.status === 409) return authError("emailTaken", result.message);
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status === 400 || result.status === 401) return authError("invalidCode", result.message);
+		if (result.status >= 500) panic(`Expected sign-up to succeed, but got ${result.status}: ` + result.message);
+		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app allows sign-up.`);
 	}
-	let token = verified.data?.jwt;
-	if (!token) {
-		const created = await platform.new({
-			...signUpBody(details),
-			password: details.password,
-			token: details.code
-		});
-		if (created.ok) token = created.data?.jwt;
-		else {
-			if (created.status >= 500) panic(created.message);
-			if (created.status === 409) return authError("emailTaken", created.message);
-			const signedIn = await signIn({
-				email: details.email,
-				password: details.password
-			});
-			if (!signedIn.success) return authError("invalidCode", created.message);
-			return signedIn;
-		}
+	if (result.data.status === "MFA_REQUIRED") {
+		const { mfa } = result.data;
+		assert(mfa, "Expected a challenge from sign-up, but got none");
+		writeCookies([makePendingAuthCookie(mfa.challengeToken)]);
+		return {
+			success: true,
+			data: {
+				status: "authenticatorRequired",
+				step: mfa.action === "VERIFICATION_REQUIRED" ? "verify" : mfa.action === "SETUP_REQUIRED" ? "setup" : "setupOptional"
+			}
+		};
 	}
-	if (!token) todo("The sign-up returned no session token. This app is configured for a sign-up flow the SDK cannot finish yet.");
-	const result = await platform.session(token);
-	if (!result.ok) panic(result.message);
-	const session = result.data;
-	if (session.user === null) panic("Session token issued, but no user could be resolved for it.");
-	writeCookies([makeSessionTokenCookie(token), makeSessionDataCookie(session, token)]);
+	const { session } = result.data;
+	assert(session, "Expected a session from sign-up, but got none");
+	writeCookies([makeSessionTokenCookie(session.jwt), makeSessionDataCookie({
+		user: session.user,
+		permissions: session.permissions
+	}, session.jwt)]);
+	clearPendingAuth();
 	return {
 		success: true,
-		data: session.user
-	};
-}
-/**
-* `name` is dropped when absent rather than sent as `undefined`: the platform's
-* validator runs on whatever key is present, and an explicit null is not the
-* same request as no name at all.
-*/
-function signUpBody(details) {
-	return details.name === void 0 ? { email: details.email } : {
-		email: details.email,
-		name: details.name
+		data: {
+			status: "signedIn",
+			user: session.user
+		}
 	};
 }
 

package/dist/auth/methods/social.d.ts

@@ -0,0 +1,35 @@
+import { User } from "../user.js";
+import { AuthError, Result } from "./utils.js";
+
+//#region src/auth/methods/social.d.ts
+
+/**
+ * Signs a visitor in with a Google token the browser obtained, creating their
+ * account the first time.
+ *
+ * Pass the id token Google Identity Services handed the page. An access token
+ * is rejected, and so is a token minted for another app. `fullName` names a
+ * first-time visitor and does nothing for one who already has an account.
+ *
+ * A `signedIn` result means the visitor is signed in. An app that also asks for
+ * an authenticator app answers `authenticatorRequired` instead, naming the step
+ * to send them to next.
+ */
+declare function signInWithGoogle(credentials: {
+  email: string;
+  token: string;
+  fullName?: string;
+}): Promise<Result<{
+  status: "signedIn";
+  user: User;
+} | {
+  status: "authenticatorRequired";
+  /**
+   * `verify`: they have an authenticator app and owe a code.
+   * `setup`: the app requires one and they have none yet.
+   * `setupOptional`: same, except they may skip it instead.
+   */
+  step: "verify" | "setup" | "setupOptional";
+}, AuthError>>;
+//#endregion
+export { signInWithGoogle };

package/dist/auth/methods/social.js

@@ -0,0 +1,58 @@
+import { assert, panic } from "../../assertions.js";
+import { writeCookies } from "../../cookies.js";
+import { sessionConfig } from "../config.js";
+import { makePlatform } from "../platform.js";
+import { clearPendingAuth, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie } from "../session.js";
+import { authError } from "./utils.js";
+
+//#region src/auth/methods/social.ts
+/**
+* Signs a visitor in with a Google token the browser obtained, creating their
+* account the first time.
+*
+* Pass the id token Google Identity Services handed the page. An access token
+* is rejected, and so is a token minted for another app. `fullName` names a
+* first-time visitor and does nothing for one who already has an account.
+*
+* A `signedIn` result means the visitor is signed in. An app that also asks for
+* an authenticator app answers `authenticatorRequired` instead, naming the step
+* to send them to next.
+*/
+async function signInWithGoogle(credentials) {
+	const result = await makePlatform(sessionConfig().applicationId).signInWithGoogle(credentials);
+	if (!result.ok) {
+		if (result.status === 429) return authError("tooManyAttempts", result.message);
+		if (result.status === 400 || result.status === 401) return authError("invalidCredentials", result.message);
+		if (result.status >= 500) panic(`Expected Google sign-in to succeed, but got ${result.status}: ` + result.message);
+		throw new Error(`${result.message}. Check SOFTR_APPLICATION_ID and that the app allows Google sign-in.`);
+	}
+	if (result.data.status === "MFA_REQUIRED") {
+		const { mfa } = result.data;
+		assert(mfa, "Expected a challenge from Google sign-in, but got none");
+		writeCookies([makePendingAuthCookie(mfa.challengeToken)]);
+		return {
+			success: true,
+			data: {
+				status: "authenticatorRequired",
+				step: mfa.action === "VERIFICATION_REQUIRED" ? "verify" : mfa.action === "SETUP_REQUIRED" ? "setup" : "setupOptional"
+			}
+		};
+	}
+	const { session } = result.data;
+	assert(session, "Expected a session from Google sign-in, but got none");
+	writeCookies([makeSessionTokenCookie(session.jwt), makeSessionDataCookie({
+		user: session.user,
+		permissions: session.permissions
+	}, session.jwt)]);
+	clearPendingAuth();
+	return {
+		success: true,
+		data: {
+			status: "signedIn",
+			user: session.user
+		}
+	};
+}
+
+//#endregion
+export { signInWithGoogle };

package/dist/auth/methods/utils.d.ts

@@ -10,6 +10,6 @@ type AuthError = {
   code: AuthErrorCode;
   message: string;
 };
-type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode";
+type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode" | "notAuthenticated";
 //#endregion
 export { AuthError, Result };

package/dist/auth/permissions.d.ts

@@ -1,4 +1,3 @@
-import { DatasourcePermissions } from "../types.js";
 import { z } from "zod";
 
 //#region src/auth/permissions.d.ts
@@ -9,9 +8,15 @@ import { z } from "zod";
  * Rendering hints, not enforcement: every data request is authorized again
  * server-side, and these may go stale between the two.
  */
+type DatasourcePermissions = {
+  read: boolean;
+  create: boolean;
+  update: boolean;
+  delete: boolean;
+};
 type Permissions = {
   /** Keyed by datasource id. */
   datasources: Record<string, DatasourcePermissions>;
 };
 //#endregion
-export { Permissions };
+export { DatasourcePermissions, Permissions };