@sparkvault/sdk-mobile 0.3.0 → 0.3.2

package/src/identity-dialog.tsx

@@ -81,6 +81,11 @@ export function SparkVaultIdentityDialog({
     () => getMethodsForIdentity(config, identityType, passkeyProvider),
     [config, identityType, passkeyProvider]
   );
+  const methodsWithoutIdentity = useMemo(
+    () => getMethodsWithoutIdentity(config, passkeyProvider),
+    [config, passkeyProvider]
+  );
+  const visibleMethods = allowedTypes.length > 0 ? methodsForIdentity : methodsWithoutIdentity;
 
   useEffect(() => {
     onSuccessRef.current = onSuccess;
@@ -110,8 +115,16 @@ export function SparkVaultIdentityDialog({
       .then((nextConfig) => {
         if (cancelled || !isActiveSession(sessionRef, sessionId)) return;
         setConfig(nextConfig);
-        setIdentityType(resolveInitialIdentityType(initialIdentity, initialIdentityType, normalizeAllowedTypes(nextConfig)));
-        setStep('identity');
+        const nextAllowedTypes = normalizeAllowedTypes(nextConfig);
+        setIdentityType(resolveInitialIdentityType(initialIdentity, initialIdentityType, nextAllowedTypes));
+        if (nextAllowedTypes.length > 0) {
+          setStep('identity');
+        } else if (getMethodsWithoutIdentity(nextConfig, passkeyProvider).length > 0) {
+          setStep('methods');
+        } else {
+          setError('No supported sign-in methods are enabled for this app.');
+          setStep('error');
+        }
       })
       .catch((err: unknown) => {
         if (cancelled || !isActiveSession(sessionRef, sessionId)) return;
@@ -124,7 +137,7 @@ export function SparkVaultIdentityDialog({
     return () => {
       cancelled = true;
     };
-  }, [client, initialIdentity, initialIdentityType, visible]);
+  }, [client, initialIdentity, initialIdentityType, passkeyProvider, visible]);
 
   useEffect(() => {
     if (!expiresAt || step !== 'totp') {
@@ -193,10 +206,7 @@ export function SparkVaultIdentityDialog({
     }
   }, [client, identity, identityType, reportError]);
 
-  const runPasskey = useCallback(async (
-    targetIdentity = identity,
-    targetIdentityType = identityType
-  ) => {
+  const runPasskey = useCallback(async () => {
     if (!passkeyProvider) {
       setError('Passkeys are not available in this app.');
       return;
@@ -215,7 +225,7 @@ export function SparkVaultIdentityDialog({
       }
       if (!isActiveSession(sessionRef, sessionId)) return;
 
-      const challenge = await client.auth.getPasskeyAuthOptions(targetIdentity, targetIdentityType);
+      const challenge = await client.auth.getPasskeyAuthOptions();
       if (!isActiveSession(sessionRef, sessionId)) return;
       const credential = await passkeyProvider.authenticate(challenge.options);
       if (!isActiveSession(sessionRef, sessionId)) return;
@@ -233,7 +243,7 @@ export function SparkVaultIdentityDialog({
         setIsBusy(false);
       }
     }
-  }, [client, finishWithToken, identity, identityType, passkeyProvider, reportError]);
+  }, [client, finishWithToken, passkeyProvider, reportError]);
 
   const handleIdentitySubmit = useCallback(async () => {
     if (isBusy) return;
@@ -259,18 +269,12 @@ export function SparkVaultIdentityDialog({
     const sessionId = sessionRef.current;
 
     try {
-      if (availableMethods.includes('passkey')) {
-        const { hasPasskey } = await client.auth.checkPasskeyStatus(normalizedIdentity, nextIdentityType);
-        if (!isActiveSession(sessionRef, sessionId)) return;
-        if (hasPasskey) {
-          await runPasskey(normalizedIdentity, nextIdentityType);
-          return;
+      if (availableMethods.length === 1) {
+        if (availableMethods[0] === 'passkey') {
+          await runPasskey();
+        } else {
+          await sendTotp(availableMethods[0], normalizedIdentity, nextIdentityType);
         }
-      }
-
-      const totpMethods = availableMethods.filter((method) => method !== 'passkey');
-      if (totpMethods.length === 1) {
-        await sendTotp(totpMethods[0], normalizedIdentity, nextIdentityType);
         return;
       }
 
@@ -283,7 +287,7 @@ export function SparkVaultIdentityDialog({
         setIsBusy(false);
       }
     }
-  }, [allowedTypes, client, config, identity, isBusy, passkeyProvider, reportError, runPasskey, sendTotp]);
+  }, [allowedTypes, config, identity, isBusy, passkeyProvider, reportError, runPasskey, sendTotp]);
 
   const handleMethodSelect = useCallback(async (method: SupportedMethodId) => {
     if (method === 'passkey') {
@@ -341,8 +345,16 @@ export function SparkVaultIdentityDialog({
       .then((nextConfig) => {
         if (!isActiveSession(sessionRef, sessionId)) return;
         setConfig(nextConfig);
-        setIdentityType(resolveInitialIdentityType(initialIdentity, initialIdentityType, normalizeAllowedTypes(nextConfig)));
-        setStep('identity');
+        const nextAllowedTypes = normalizeAllowedTypes(nextConfig);
+        setIdentityType(resolveInitialIdentityType(initialIdentity, initialIdentityType, nextAllowedTypes));
+        if (nextAllowedTypes.length > 0) {
+          setStep('identity');
+        } else if (getMethodsWithoutIdentity(nextConfig, passkeyProvider).length > 0) {
+          setStep('methods');
+        } else {
+          setError('No supported sign-in methods are enabled for this app.');
+          setStep('error');
+        }
       })
       .catch((err: unknown) => {
         if (!isActiveSession(sessionRef, sessionId)) return;
@@ -354,7 +366,7 @@ export function SparkVaultIdentityDialog({
           setIsBusy(false);
         }
       });
-  }, [client, initialIdentity, initialIdentityType, reportError]);
+  }, [client, initialIdentity, initialIdentityType, passkeyProvider, reportError]);
 
   const headerLogo = getHeaderLogo(branding, effectiveTheme);
   const companyName = branding?.companyName || 'SparkVault';
@@ -446,9 +458,9 @@ export function SparkVaultIdentityDialog({
             {step === 'methods' && (
               <View style={styles.body}>
                 <Text style={[styles.title, { color: colors.text }]}>Choose a method</Text>
-                <Text style={[styles.subtitle, { color: colors.muted }]}>{identity}</Text>
+                {identity ? <Text style={[styles.subtitle, { color: colors.muted }]}>{identity}</Text> : null}
                 <View style={styles.methodList}>
-                  {methodsForIdentity.map((method) => (
+                  {visibleMethods.map((method) => (
                     <Pressable
                       key={method}
                       accessibilityRole="button"
@@ -471,7 +483,9 @@ export function SparkVaultIdentityDialog({
                   ))}
                 </View>
                 {error ? <Text style={[styles.error, { color: colors.error }]}>{error}</Text> : null}
-                <TextButton label="Use a different identity" colors={colors} onPress={() => setStep('identity')} />
+                {allowedTypes.length > 0 ? (
+                  <TextButton label="Use a different identity" colors={colors} onPress={() => setStep('identity')} />
+                ) : null}
               </View>
             )}
 
@@ -493,7 +507,7 @@ export function SparkVaultIdentityDialog({
                   loading={isBusy}
                   onPress={runPasskey}
                 />
-                {fallbackTotpMethod(methodsForIdentity) ? (
+                {allowedTypes.length > 0 && fallbackTotpMethod(methodsForIdentity) ? (
                   <TextButton
                     label={fallbackLabel(fallbackTotpMethod(methodsForIdentity)!)}
                     colors={colors}
@@ -631,8 +645,9 @@ function TextButton({
 }
 
 function normalizeAllowedTypes(config: IdentityConfig | null): IdentityType[] {
-  const allowed = config?.allowedIdentityTypes?.filter((type): type is IdentityType => type === 'email' || type === 'phone');
-  return allowed && allowed.length > 0 ? allowed : ['email'];
+  if (!config) return ['email'];
+  if (!config.allowedIdentityTypes) return ['email'];
+  return config.allowedIdentityTypes.filter((type): type is IdentityType => type === 'email' || type === 'phone');
 }
 
 function resolveInitialIdentityType(
@@ -653,12 +668,22 @@ function getMethodsForIdentity(
   const configuredMethods = config?.methods ?? ['totp_email'];
   return configuredMethods.filter((method): method is SupportedMethodId => {
     if (!SUPPORTED_METHODS.has(method)) return false;
-    if (method === 'passkey') return identityType === 'email' && Boolean(passkeyProvider);
+    if (method === 'passkey') return Boolean(passkeyProvider);
     if (method === 'totp_email') return identityType === 'email';
     return identityType === 'phone';
   });
 }
 
+function getMethodsWithoutIdentity(
+  config: IdentityConfig | null,
+  passkeyProvider?: MobilePasskeyProvider
+): SupportedMethodId[] {
+  const configuredMethods = config?.methods ?? [];
+  return configuredMethods.filter((method): method is SupportedMethodId => (
+    method === 'passkey' && Boolean(passkeyProvider)
+  ));
+}
+
 function parseIdentity(
   value: string,
   allowedTypes: IdentityType[]

package/src/ingots.ts

@@ -66,6 +66,34 @@ interface IngotUploadInitResponse {
   size_bytes?: number;
 }
 
+interface IngotAuditLogEntry {
+  id?: string;
+  log_id?: string;
+  event_id?: string;
+  event_type?: string;
+  action?: string;
+  actor?: {
+    email?: string;
+    id?: string;
+    user_id?: string;
+    api_key_id?: string;
+  };
+  actor_email?: string;
+  actor_id?: string;
+  identity?: string;
+  ip_address?: string;
+  user_agent?: string;
+  timestamp?: number;
+  created_at?: number;
+}
+
+interface IngotAuditLogsResponse {
+  entries?: IngotAuditLogEntry[];
+  logs?: IngotAuditLogEntry[];
+  cursor?: string;
+  next_cursor?: string;
+}
+
 export class MobileIngotsClient {
   private static readonly INGOT_STATUS_POLL_MAX = 10;
   private static readonly INGOT_STATUS_POLL_MS = 1000;
@@ -422,29 +450,36 @@ export class MobileIngotsClient {
     if (options?.cursor) params.append('cursor', options.cursor);
 
     const query = params.toString();
-    const response = await this.http.get<{ logs: IngotAccessLog[]; next_cursor?: string }>(
+    const response = await this.http.get<IngotAuditLogsResponse>(
       query
-        ? `/vaults/${vaultId}/ingots/${ingotId}/access-logs?${query}`
-        : `/vaults/${vaultId}/ingots/${ingotId}/access-logs`,
+        ? `/vaults/${vaultId}/ingots/${ingotId}/audit-logs?${query}`
+        : `/vaults/${vaultId}/ingots/${ingotId}/audit-logs`,
       { vat }
     );
-    return response.data;
+    const entries = response.data.entries ?? response.data.logs ?? [];
+    return {
+      logs: entries.map(entry => this.toAccessLog(entry)),
+      next_cursor: response.data.cursor ?? response.data.next_cursor,
+    };
   }
 
   async getAccessStats(vaultId: string, ingotId: string, vat: string): Promise<IngotAccessStats> {
     validateVaultId(vaultId);
     validateIngotId(ingotId);
-    const response = await this.http.get<IngotAccessStats>(
-      `/vaults/${vaultId}/ingots/${ingotId}/access-stats`,
-      { vat }
-    );
-    return response.data;
+    const ingot = await this.get(vaultId, ingotId, vat);
+    return {
+      total_downloads: ingot.access_count ?? 0,
+      last_accessed_at: ingot.last_accessed_at ?? ingot.accessed_at,
+    };
   }
 
   async purgeAccessLogs(vaultId: string, ingotId: string, vat: string): Promise<void> {
     validateVaultId(vaultId);
     validateIngotId(ingotId);
-    await this.http.delete(`/vaults/${vaultId}/ingots/${ingotId}/access-logs`, { vat });
+    void vat;
+    throw new SparkVaultValidationError(
+      'Ingot audit logs are read-only. Configure vault access-log retention to expire old entries.'
+    );
   }
 
   private async createIngotUpload(options: {
@@ -498,6 +533,28 @@ export class MobileIngotsClient {
     throw new SparkVaultMobileError(`Upload failed: ingot status is ${ingot?.status ?? 'unknown'}`);
   }
 
+  private toAccessLog(entry: IngotAuditLogEntry): IngotAccessLog {
+    const eventType = entry.event_type ?? entry.action ?? '';
+    const action = eventType.includes('download') ? 'download' : 'view';
+    const actor = entry.actor;
+    return {
+      log_id: entry.log_id ?? entry.event_id ?? entry.id ?? String(entry.timestamp ?? entry.created_at ?? ''),
+      action,
+      identity:
+        actor?.email ??
+        entry.actor_email ??
+        entry.identity ??
+        actor?.id ??
+        actor?.user_id ??
+        actor?.api_key_id ??
+        entry.actor_id ??
+        'Unknown',
+      ip_address: entry.ip_address ?? '',
+      user_agent: entry.user_agent ?? '',
+      timestamp: entry.timestamp ?? entry.created_at ?? 0,
+    };
+  }
+
   private async verifyDownloadedFile(
     fileDownloader: MobileFileDownloader,
     preferredUri: string,

package/src/types.ts

@@ -55,6 +55,7 @@ export interface SparkVaultAccount {
 }
 
 export type IdentityType = 'email' | 'phone';
+export type VerifiedIdentityType = IdentityType | 'social';
 
 export type IdentityMethodId =
   | 'totp_email'
@@ -112,7 +113,7 @@ export interface IdentityTokenClaims {
   nbf?: number;
   jti?: string;
   identity: string;
-  identity_type: IdentityType;
+  identity_type: VerifiedIdentityType;
   verified_at: number;
   method: string;
 }
@@ -120,7 +121,7 @@ export interface IdentityTokenClaims {
 export interface IdentityVerifyResult {
   token: string;
   identity: string;
-  identityType: IdentityType;
+  identityType: VerifiedIdentityType;
   method?: string;
   redirect?: string;
   jwksUri: string;
@@ -195,10 +196,11 @@ export interface PasskeyAuthOptions {
   challenge: string;
   timeout: number;
   rpId: string;
-  allowCredentials?: {
+  allowCredentials?: Array<{
     id: string;
     type: 'public-key';
-  }[];
+    transports?: string[];
+  }>;
   userVerification: 'required' | 'preferred' | 'discouraged';
 }
 
@@ -226,6 +228,7 @@ export interface PasskeyRegisterOptions {
   authenticatorSelection: {
     userVerification: 'required' | 'preferred' | 'discouraged';
     residentKey: 'required' | 'preferred' | 'discouraged';
+    requireResidentKey?: boolean;
   };
 }
 
@@ -329,6 +332,7 @@ export interface Ingot {
   folder_id?: string | null;
   created_at: number;
   accessed_at?: number;
+  last_accessed_at?: number;
   access_count?: number;
   expires_at?: number;
 }
@@ -372,7 +376,7 @@ export interface IngotAccessLog {
 
 export interface IngotAccessStats {
   total_downloads: number;
-  unique_visitors: number;
+  unique_visitors?: number;
   last_accessed_at?: number;
 }
 

package/src/vaults.ts

@@ -19,6 +19,49 @@ export interface SharingConfig {
   enabled_at: number | null;
 }
 
+export interface UploadConfig {
+  vault_id: string;
+  upload_portal_enabled: boolean;
+  upload_portal_enabled_at: number | null;
+  upload_widget_enabled: boolean;
+  upload_widget_enabled_at: number | null;
+  max_size_bytes: number | null;
+  notification_email: string | null;
+  portal_url?: string;
+}
+
+export interface UploadPortalEnabled {
+  vault_id: string;
+  upload_portal_enabled: true;
+  enabled_at: number;
+  portal_url: string;
+}
+
+export interface UploadWidgetEnabled {
+  vault_id: string;
+  upload_widget_enabled: true;
+  enabled_at: number;
+}
+
+export interface UploadPortalDisabled {
+  vault_id: string;
+  upload_portal_enabled: false;
+  disabled_at: number;
+}
+
+export interface UploadWidgetDisabled {
+  vault_id: string;
+  upload_widget_enabled: false;
+  disabled_at: number;
+}
+
+export interface UploadConfigUpdate {
+  vault_id: string;
+  max_size_bytes: number;
+  notification_email: string | null;
+  updated_at: number;
+}
+
 export class MobileVaultsClient {
   private readonly http: MobileHttpClient;
 
@@ -180,92 +223,63 @@ export class MobileVaultsClient {
     return response.data;
   }
 
-  async getUploadConfig(vaultId: string): Promise<{
-    vault_id: string;
-    public_upload_enabled: boolean;
-    upload_url: string | null;
-    max_size_bytes: number | null;
-    notification_email: string | null;
-    enabled_at: number | null;
-  }> {
+  async getUploadConfig(vaultId: string): Promise<UploadConfig> {
     validateVaultId(vaultId);
-    const response = await this.http.get<{
-      vault_id: string;
-      public_upload_enabled: boolean;
-      upload_url: string | null;
-      max_size_bytes: number | null;
-      notification_email: string | null;
-      enabled_at: number | null;
-    }>(`/vaults/${vaultId}/upload`);
+    const response = await this.http.get<UploadConfig>(`/vaults/${vaultId}/upload`);
     return response.data;
   }
 
-  async enableUpload(
-    vaultId: string,
-    vmk: string | null,
-    options?: {
-      max_size_bytes?: number;
-      notification_email?: string;
-    }
-  ): Promise<{
-    vault_id: string;
-    public_upload_enabled: boolean;
-    upload_url: string;
-    max_size_bytes: number;
-    notification_email: string | null;
-    enabled_at: number;
-  }> {
+  async enableUploadPortal(vaultId: string, vmk: string): Promise<UploadPortalEnabled> {
     validateVaultId(vaultId);
-    const response = await this.http.post<{
-      vault_id: string;
-      public_upload_enabled: boolean;
-      upload_url: string;
-      max_size_bytes: number;
-      notification_email: string | null;
-      enabled_at: number;
-    }>(`/vaults/${vaultId}/upload/enable`, {
+    const response = await this.http.post<UploadPortalEnabled>(`/vaults/${vaultId}/upload/portal/enable`, {
       vmk,
-      max_size_bytes: options?.max_size_bytes ?? null,
-      notification_email: options?.notification_email ?? null,
     });
     return response.data;
   }
 
-  async disableUpload(vaultId: string): Promise<{
-    vault_id: string;
-    public_upload_enabled: false;
-    disabled_at: number;
-  }> {
+  async disableUploadPortal(vaultId: string): Promise<UploadPortalDisabled> {
     validateVaultId(vaultId);
-    const response = await this.http.post<{
-      vault_id: string;
-      public_upload_enabled: false;
-      disabled_at: number;
-    }>(`/vaults/${vaultId}/upload/disable`);
+    const response = await this.http.post<UploadPortalDisabled>(`/vaults/${vaultId}/upload/portal/disable`);
+    return response.data;
+  }
+
+  async enableUploadWidget(vaultId: string, vmk: string): Promise<UploadWidgetEnabled> {
+    validateVaultId(vaultId);
+    const response = await this.http.post<UploadWidgetEnabled>(`/vaults/${vaultId}/upload/widget/enable`, {
+      vmk,
+    });
     return response.data;
   }
 
+  async disableUploadWidget(vaultId: string): Promise<UploadWidgetDisabled> {
+    validateVaultId(vaultId);
+    const response = await this.http.post<UploadWidgetDisabled>(`/vaults/${vaultId}/upload/widget/disable`);
+    return response.data;
+  }
+
+  /**
+   * @deprecated Use enableUploadPortal() or enableUploadWidget().
+   */
+  async enableUpload(vaultId: string, vmk: string): Promise<UploadPortalEnabled> {
+    return this.enableUploadPortal(vaultId, vmk);
+  }
+
+  /**
+   * @deprecated Use disableUploadPortal() or disableUploadWidget().
+   */
+  async disableUpload(vaultId: string): Promise<UploadPortalDisabled> {
+    return this.disableUploadPortal(vaultId);
+  }
+
   async updateUploadConfig(
     vaultId: string,
     config: {
       max_size_bytes?: number;
       notification_email?: string | null;
     }
-  ): Promise<{
-    vault_id: string;
-    public_upload_enabled: boolean;
-    max_size_bytes: number;
-    notification_email: string | null;
-    updated_at: number;
-  }> {
+  ): Promise<UploadConfigUpdate> {
     validateVaultId(vaultId);
-    const response = await this.http.put<{
-      vault_id: string;
-      public_upload_enabled: boolean;
-      max_size_bytes: number;
-      notification_email: string | null;
-      updated_at: number;
-    }>(`/vaults/${vaultId}/upload`, config);
+    const response = await this.http.put<UploadConfigUpdate>(`/vaults/${vaultId}/upload`, config);
     return response.data;
   }
 }