@spfn/auth 0.3.0-beta.23 → 0.3.0-beta.24

package/dist/index.d.ts

@@ -1,10 +1,11 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, b as RequestSignupLinkResult, C as ConfirmSignupLinkResult, c as RequestPasswordResetResult, d as ConfirmPasswordResetResult, L as LoginResult, e as StartDeviceAuthResult, D as DeviceAuthInfoResult, F as FinishPasskeyEnrollmentResult, f as PasskeySummary, T as TotpEnrolmentResult, g as ConfirmTotpResult, M as MfaStatus, h as RotateKeyResult, K as KeySummary, i as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, j as OAuthNativeResult, U as UserProfile, k as ProfileInfo, l as OAuth2ConsentView, n as OAuth2AuthorizationCodeIssued, o as OAuth2GrantSummary } from './machine-principals-CaEFq61K.js';
-export { A as AuthInitOptions, p as AuthSession, q as PERMISSION_CATEGORIES, r as PermissionCategory, V as VERIFICATION_PURPOSES, s as VERIFICATION_TARGET_TYPES, t as VerificationPurpose, u as VerificationTargetType } from './machine-principals-CaEFq61K.js';
+import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, b as RequestSignupLinkResult, C as ConfirmSignupLinkResult, c as RequestPasswordResetResult, d as ConfirmPasswordResetResult, L as LoginBindingFields, e as LoginResult, f as StartDeviceAuthResult, D as DeviceAuthInfoResult, F as FinishPasskeyEnrollmentResult, g as PasskeySummary, T as TotpEnrolmentResult, h as ConfirmTotpResult, M as MfaStatus, i as RotateKeyResult, K as KeySummary, j as RevokeAllKeysResult, k as SessionBindingResult, l as SessionRenewResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, n as OAuthNativeResult, U as UserProfile, o as ProfileInfo, p as OAuth2ConsentView, q as OAuth2AuthorizationCodeIssued, r as OAuth2GrantSummary } from './machine-principals-ZJd9anVT.js';
+export { A as AuthInitOptions, s as AuthSession, t as PERMISSION_CATEGORIES, u as PermissionCategory, V as VERIFICATION_PURPOSES, v as VERIFICATION_TARGET_TYPES, w as VerificationPurpose, x as VerificationTargetType } from './machine-principals-ZJd9anVT.js';
 import * as _simplewebauthn_server from '@simplewebauthn/server';
 import * as _spfn_core_route from '@spfn/core/route';
 import { HttpMethod } from '@spfn/core/route';
-export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, c as AccountDeletionRequestedBy, I as INVITATION_STATUSES, d as InvitationStatus, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, K as KeyAlgorithmType, h as KeyPlatformType, P as PURGE_STRATEGIES, i as PurgeStrategy, S as SOCIAL_PROVIDERS, j as SocialProvider, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
+import { S as SessionBindingType } from './types-CTdoTOxM.js';
+export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, c as AccountDeletionRequestedBy, I as INVITATION_STATUSES, d as InvitationStatus, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, K as KeyAlgorithmType, h as KeyPlatformType, P as PURGE_STRATEGIES, i as PurgeStrategy, j as SESSION_BINDINGS, k as SOCIAL_PROVIDERS, l as SocialProvider, U as USER_STATUSES, m as UserStatus } from './types-CTdoTOxM.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import 'drizzle-orm/pg-core';
 import '@spfn/core/event';
@@ -180,7 +181,7 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             deviceName: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
             platform: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ios" | "android" | "web" | "desktop">[]>>;
         }>;
-    }, RegisterResult>;
+    }, RegisterResult & LoginBindingFields>;
     login: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
             email: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
@@ -218,6 +219,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
     } | {
         email?: string | undefined;
         phone?: string | undefined;
+        sessionBinding?: "none" | "passkey" | undefined;
+        keyExpiresAtMillis?: number | undefined;
         status: "approved";
         userId: string;
         publicId: string;
@@ -394,6 +397,32 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         phoneVerified: boolean;
         hasPassword: boolean;
     }>;
+    setSessionBinding: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            mode: _sinclair_typebox.TUnion<[_sinclair_typebox.TLiteral<"passkey">, _sinclair_typebox.TLiteral<"none">]>;
+            response: _sinclair_typebox.TOptional<_sinclair_typebox.TUnknown>;
+            currentPassword: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, SessionBindingResult>;
+    getSessionBinding: _spfn_core_route.RouteDef<{}, {}, SessionBindingResult>;
+    sessionBindingDisableOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    sessionRenewOptions: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{}>;
+    }, {}, _simplewebauthn_server.PublicKeyCredentialRequestOptionsJSON>;
+    sessionRenewVerify: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            response: _sinclair_typebox.TUnknown;
+        }>;
+    }, {
+        body: _sinclair_typebox.TObject<{
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>>;
+        }>;
+    }, SessionRenewResult>;
     issueOneTimeToken: _spfn_core_route.RouteDef<{}, {}, IssueOneTimeTokenResult>;
     requestAccountDeletion: _spfn_core_route.RouteDef<{
         body: _sinclair_typebox.TObject<{
@@ -456,6 +485,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
         }>;
     }, {}, {
+        sessionBinding?: SessionBindingType;
+        keyExpiresAtMillis?: number;
         success: boolean;
         userId: string;
         keyId: string;
@@ -670,6 +701,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         emailVerifiedAt: Date | null;
         phoneVerifiedAt: Date | null;
         keyEpoch: number;
+        sessionBinding: "none" | "passkey";
+        sessionBindingChangedAt: Date | null;
         lastLoginAt: Date | null;
     }>;
     updateLocale: _spfn_core_route.RouteDef<{
@@ -843,4 +876,4 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
 }>>;
 type AuthRouter = typeof mainAuthRouter;
 
-export { type AuthRouter, BASE64_PATTERN, BUILTIN_PERMISSIONS, BUILTIN_ROLES, BUILTIN_ROLE_PERMISSIONS, type BuiltinPermissionName, type BuiltinRoleName, EMAIL_PATTERN, FINGERPRINT_PATTERN, PHONE_PATTERN, PermissionConfig, ProfileInfo, RoleConfig, UUID_PATTERN, UserProfile, authApi, routeMap as authRouteMap };
+export { type AuthRouter, BASE64_PATTERN, BUILTIN_PERMISSIONS, BUILTIN_ROLES, BUILTIN_ROLE_PERMISSIONS, type BuiltinPermissionName, type BuiltinRoleName, EMAIL_PATTERN, FINGERPRINT_PATTERN, PHONE_PATTERN, PermissionConfig, ProfileInfo, RoleConfig, SessionBindingType, UUID_PATTERN, UserProfile, authApi, routeMap as authRouteMap };

package/dist/index.js

@@ -12,12 +12,14 @@ import { ErrorRegistry } from "@spfn/core/errors";
 
 // src/errors/auth-errors.ts
 import {
+  BadRequestError,
   ValidationError,
   UnauthorizedError,
   ForbiddenError,
   ConflictError,
   NotFoundError,
-  HttpError
+  HttpError,
+  InternalServerError
 } from "@spfn/core/errors";
 var InvalidCredentialsError = class extends UnauthorizedError {
   constructor(data = {}) {
@@ -366,6 +368,56 @@ var LastRecoveryCredentialError = class extends ConflictError {
     this.name = "LastRecoveryCredentialError";
   }
 };
+var SessionRenewalRequiredError = class extends UnauthorizedError {
+  code = "SESSION_RENEWAL_REQUIRED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "This session needs renewing. Confirm with your passkey to continue.",
+      details: data.details
+    });
+    this.name = "SessionRenewalRequiredError";
+  }
+};
+var SessionRenewalRefusedError = class extends UnauthorizedError {
+  code = "SESSION_RENEWAL_REFUSED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "This session cannot be renewed. Sign in again.",
+      details: data.details
+    });
+    this.name = "SessionRenewalRefusedError";
+  }
+};
+var SessionContextChangedError = class extends UnauthorizedError {
+  code = "SESSION_CONTEXT_CHANGED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "This session was started in a different browser. Sign in again.",
+      details: data.details
+    });
+    this.name = "SessionContextChangedError";
+  }
+};
+var SessionBindingUnavailableError = class extends BadRequestError {
+  code = "SESSION_BINDING_UNAVAILABLE";
+  constructor(data = {}) {
+    super({
+      message: data.message || "Session binding needs a deployment where the backend can recognise the Next.js proxy. Configure proxy-guard (SPFN_PROXY_SIGNATURE_KEYS) and try again.",
+      details: data.details
+    });
+    this.name = "SessionBindingUnavailableError";
+  }
+};
+var SessionResealFailedError = class extends InternalServerError {
+  code = "SESSION_RESEAL_FAILED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "The setting was changed but this session could not be updated. Sign in again.",
+      details: data.details
+    });
+    this.name = "SessionResealFailedError";
+  }
+};
 var PasskeyConfigError = class extends HttpError {
   constructor(data) {
     super({
@@ -508,6 +560,11 @@ authErrorRegistry.append([
   RecentAuthenticationRequiredError,
   LastRecoveryCredentialError,
   PasskeyConfigError,
+  SessionBindingUnavailableError,
+  SessionRenewalRequiredError,
+  SessionRenewalRefusedError,
+  SessionContextChangedError,
+  SessionResealFailedError,
   OAuth2UnknownClientError,
   OAuth2RedirectUriMismatchError,
   OAuth2AuthorizeRedirectError,
@@ -554,6 +611,11 @@ var routeMap = {
   mfaStatus: { method: "GET", path: "/_auth/mfa/status" },
   mfaStepUp: { method: "POST", path: "/_auth/mfa/step-up" },
   mfaStepUpOptions: { method: "POST", path: "/_auth/mfa/step-up/options" },
+  setSessionBinding: { method: "POST", path: "/_auth/session/binding" },
+  getSessionBinding: { method: "GET", path: "/_auth/session/binding" },
+  sessionBindingDisableOptions: { method: "POST", path: "/_auth/session/binding/disable/options" },
+  sessionRenewOptions: { method: "POST", path: "/_auth/session/renew/options" },
+  sessionRenewVerify: { method: "POST", path: "/_auth/session/renew/verify" },
   passkeyRegisterOptions: { method: "POST", path: "/_auth/passkeys/register/options" },
   passkeyRegisterVerify: { method: "POST", path: "/_auth/passkeys/register/verify" },
   passkeyLoginOptions: { method: "POST", path: "/_auth/passkeys/login/options" },
@@ -740,6 +802,7 @@ var BUILTIN_ROLE_PERMISSIONS = {
 var KEY_ALGORITHM = ["ES256", "RS256"];
 var KEY_PLATFORM = ["ios", "android", "web", "desktop"];
 var KEY_DEVICE_NAME_MAX_LENGTH = 64;
+var SESSION_BINDINGS = ["none", "passkey"];
 var INVITATION_STATUSES = ["pending", "accepted", "expired", "cancelled"];
 var USER_STATUSES = ["active", "inactive", "suspended", "pending_deletion", "deleted"];
 var SOCIAL_PROVIDERS = ["google", "apple", "github", "kakao", "naver", "superself"];
@@ -3404,7 +3467,15 @@ var DeviceAuthPollResponseSchema = Type.Union([
     publicId: Type.String(),
     email: Type.Optional(Type.String()),
     phone: Type.Optional(Type.String()),
-    passwordChangeRequired: Type.Boolean()
+    passwordChangeRequired: Type.Boolean(),
+    // The approved branch is a `LoginResult` spread whole, so it carries the
+    // binding fields a sign-in can carry (#97). In practice it never does: a
+    // waiting device polls the backend directly, and a key is bound only on a
+    // request that reached it through the trusted Next.js proxy. Declared
+    // anyway, because the branch is whatever the login answered and the two
+    // must not be able to drift apart.
+    sessionBinding: Type.Optional(Type.Union(SESSION_BINDINGS.map((mode) => Type.Literal(mode)))),
+    keyExpiresAtMillis: Type.Optional(Type.Integer())
   })
 ], {
   description: "Pending, or the login the approval produced"