@softr/sdk 0.0.24 → 0.0.26-alpha-0

package/dist/auth/platform.js

@@ -22,18 +22,196 @@ function makePlatform(applicationId) {
 			method: "POST",
 			json: credentials
 		}, z.object({
-			jwt: z.string(),
-			user: userSchema,
-			permissions: permissionsSchema
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
+		sendSignInCode: (email) => request(`/v1/vibe/applications/${applicationId}/users/tokens/send-code`, {
+			method: "POST",
+			json: { email }
+		}, z.null()),
+		signInWithCode: (credentials) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-code`, {
+			method: "POST",
+			json: credentials
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
+		signInWithGoogle: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-google`, {
+			method: "POST",
+			json: body
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
 		})),
-		signUp: (body) => request(`/v1/applications/${applicationId}/users/sign-up`, {
+		signInWithMagicLink: (body) => request(`/v1/vibe/applications/${applicationId}/users/tokens/with-magic-link`, {
 			method: "POST",
 			json: body
-		}, z.object({ jwt: z.string().nullish() }).nullable()),
-		new: (body) => request(`/v1/applications/${applicationId}/users/new`, {
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
+		sendSignUpCode: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/send-code`, {
+			method: "POST",
+			json: body
+		}, z.null()),
+		signUpWithCode: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-code`, {
+			method: "POST",
+			json: body
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
+		signUpWithPassword: (body) => request(`/v1/vibe/applications/${applicationId}/users/sign-up/with-password`, {
 			method: "POST",
 			json: body
-		}, z.object({ jwt: z.string().nullish() }).nullable()),
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
+		authenticatorSetupInit: (token) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/init`, {
+			method: "POST",
+			token
+		}, z.object({
+			otpauthUri: z.string(),
+			qrPngBase64: z.string()
+		})),
+		authenticatorSetupComplete: (token, code) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/complete`, {
+			method: "POST",
+			token,
+			json: { code }
+		}, z.object({
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}),
+			backupCodes: z.array(z.string())
+		})),
+		authenticatorSetupDismiss: (token) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/setup/dismiss`, {
+			method: "POST",
+			token
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
+		authenticatorVerify: (token, body) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/totp/verify`, {
+			method: "POST",
+			token,
+			json: body
+		}, z.object({
+			status: z.enum(["AUTHENTICATED", "MFA_REQUIRED"]),
+			session: z.object({
+				jwt: z.string(),
+				user: userSchema,
+				permissions: permissionsSchema
+			}).nullish(),
+			mfa: z.object({
+				action: z.enum([
+					"VERIFICATION_REQUIRED",
+					"SETUP_REQUIRED",
+					"SETUP_OPTIONAL"
+				]),
+				challengeToken: z.string()
+			}).nullish()
+		})),
+		authenticatorSendResetCode: (token) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/reset/send-code`, {
+			method: "POST",
+			token
+		}, z.null()),
+		authenticatorReset: (token, code) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/reset`, {
+			method: "POST",
+			token,
+			json: { code }
+		}, z.null()),
+		authenticatorRemove: (token, code) => request(`/v1/vibe/applications/${applicationId}/users/authenticator/remove`, {
+			method: "POST",
+			token,
+			json: { code }
+		}, z.null()),
 		signOut: (token) => request(`/v1/applications/${applicationId}/users/sign-out`, {
 			method: "POST",
 			token

package/dist/auth/server.d.ts

@@ -1,5 +1,9 @@
+import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sendAuthenticatorResetCode, skipAuthenticatorSetup, startAuthenticatorSetup, verifyAuthenticator } from "./methods/authenticator.js";
+import { sendSignInCode, signInWithCode } from "./methods/code.js";
+import { signInWithMagicLink } from "./methods/magicLink.js";
 import { signIn, signOut } from "./methods/password.js";
 import { confirmSignUp, signUp } from "./methods/signup.js";
+import { signInWithGoogle } from "./methods/social.js";
 import "@tanstack/react-start/server-only";
 
 //#region src/auth/server.d.ts
@@ -12,6 +16,17 @@ declare const auth: {
   signOut: typeof signOut;
   signUp: typeof signUp;
   confirmSignUp: typeof confirmSignUp;
+  sendSignInCode: typeof sendSignInCode;
+  signInWithCode: typeof signInWithCode;
+  signInWithGoogle: typeof signInWithGoogle;
+  signInWithMagicLink: typeof signInWithMagicLink;
+  startAuthenticatorSetup: typeof startAuthenticatorSetup;
+  confirmAuthenticatorSetup: typeof confirmAuthenticatorSetup;
+  skipAuthenticatorSetup: typeof skipAuthenticatorSetup;
+  verifyAuthenticator: typeof verifyAuthenticator;
+  sendAuthenticatorResetCode: typeof sendAuthenticatorResetCode;
+  resetAuthenticator: typeof resetAuthenticator;
+  removeAuthenticator: typeof removeAuthenticator;
 };
 //#endregion
 export { auth };

package/dist/auth/server.js

@@ -1,5 +1,9 @@
+import { confirmAuthenticatorSetup, removeAuthenticator, resetAuthenticator, sendAuthenticatorResetCode, skipAuthenticatorSetup, startAuthenticatorSetup, verifyAuthenticator } from "./methods/authenticator.js";
+import { sendSignInCode, signInWithCode } from "./methods/code.js";
+import { signInWithMagicLink } from "./methods/magicLink.js";
 import { signIn, signOut } from "./methods/password.js";
 import { confirmSignUp, signUp } from "./methods/signup.js";
+import { signInWithGoogle } from "./methods/social.js";
 import "@tanstack/react-start/server-only";
 
 //#region src/auth/server.ts
@@ -10,7 +14,18 @@ const auth = {
 	signIn,
 	signOut,
 	signUp,
-	confirmSignUp
+	confirmSignUp,
+	sendSignInCode,
+	signInWithCode,
+	signInWithGoogle,
+	signInWithMagicLink,
+	startAuthenticatorSetup,
+	confirmAuthenticatorSetup,
+	skipAuthenticatorSetup,
+	verifyAuthenticator,
+	sendAuthenticatorResetCode,
+	resetAuthenticator,
+	removeAuthenticator
 };
 
 //#endregion

package/dist/auth/session.js

@@ -9,8 +9,14 @@ import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:
 //#region src/auth/session.ts
 const SESSION_TOKEN = "session_token";
 const SESSION_DATA = "session_data";
+const PENDING_AUTH = "pending_auth";
 const SESSION_DATA_TTL_SECONDS = 300;
 /**
+* How long a visitor has to answer a second factor. The platform expires the
+* challenge token itself. This only decides how long the browser carries it.
+*/
+const PENDING_AUTH_TTL_SECONDS = 600;
+/**
 * A browser refuses a `__Host-` cookie unless it is `Secure`, `Path=/` and free
 * of `Domain` — that last clause is the one worth having, since it stops a
 * sibling host planting a cookie of this name for us to honour.
@@ -67,10 +73,37 @@ function makeSessionDataCookie(session, sessionToken) {
 	});
 }
 /**
+* The challenge token from a sign-in that stopped at a second factor, or
+* `null`.
+*
+* It is a bearer credential scoped to the authenticator endpoints, so it stays
+* sealed in the jar the way a session token does, instead of passing through
+* the app.
+*/
+function readPendingAuthToken() {
+	const { name } = sessionCookie(PENDING_AUTH);
+	return openEnvelope(readRequestCookies()[name], PENDING_AUTH);
+}
+function makePendingAuthCookie(token) {
+	const { name, secure } = sessionCookie(PENDING_AUTH);
+	return serializeCookie(name, sealEnvelope(token, PENDING_AUTH), {
+		maxAge: PENDING_AUTH_TTL_SECONDS,
+		secure
+	});
+}
+/** Drops an outstanding challenge without touching the session. */
+function clearPendingAuth() {
+	clearCookies([PENDING_AUTH]);
+}
+/**
 * Writes rather than returns: a forgotten list would leave the session live.
 */
 function clearSession() {
-	clearCookies([SESSION_TOKEN, SESSION_DATA]);
+	clearCookies([
+		SESSION_TOKEN,
+		SESSION_DATA,
+		PENDING_AUTH
+	]);
 }
 const sessionDataSchema = z.object({
 	user: userSchema.nullable(),
@@ -163,4 +196,4 @@ function openEnvelope(raw, purpose) {
 }
 
 //#endregion
-export { clearSession, makeSessionDataCookie, makeSessionTokenCookie, readSessionData, readSessionToken };
+export { clearPendingAuth, clearSession, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie, readPendingAuthToken, readSessionData, readSessionToken };

package/dist/cli.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/cli.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { version } from "./package.js";
+import { fetchSoftrEnvInput, metadataSourceFromEnv } from "./codegen/fetch-metadata.js";
+import { renderSoftrEnv } from "./codegen/softr-env.js";
+import { writeFileSync } from "node:fs";
+import path from "node:path";
+
+//#region src/cli.ts
+const OUTPUT = "softr-env.d.ts";
+async function generate() {
+	writeFileSync(path.resolve(process.cwd(), OUTPUT), renderSoftrEnv(await fetchSoftrEnvInput(metadataSourceFromEnv()), version), "utf8");
+	console.log(`[softr] wrote ${OUTPUT}`);
+}
+const [command] = process.argv.slice(2);
+if (command === "generate") await generate();
+else {
+	console.error(command ? `softr-sdk: unknown command '${command}'` : "softr-sdk: no command given");
+	console.error("usage: softr-sdk generate");
+	process.exit(1);
+}
+
+//#endregion
+export {  };