@stackframe/stack 2.5.16 → 2.5.18

package/dist/lib/stack-app.d.mts

@@ -7,6 +7,7 @@ import { TeamPermissionDefinitionsCrud } from '@stackframe/stack-shared/dist/int
 import { InternalSession } from '@stackframe/stack-shared/dist/sessions';
 import { ReadonlyJson } from '@stackframe/stack-shared/dist/utils/json';
 import { ProviderType } from '@stackframe/stack-shared/dist/utils/oauth';
+import { Result } from '@stackframe/stack-shared/dist/utils/results';
 
 type RequestLike = {
     headers: {
@@ -32,6 +33,7 @@ type HandlerUrls = {
     oauthCallback: string;
     magicLinkCallback: string;
     accountSettings: string;
+    teamInvitation: string;
     error: string;
 };
 type OAuthScopesOnSignIn = {
@@ -193,9 +195,13 @@ type BaseUser = {
      * Whether the user has a password set.
      */
     readonly hasPassword: boolean;
+    /**
+     * @deprecated
+     */
     readonly oauthProviders: readonly {
         id: string;
     }[];
+    readonly isMultiFactorRequired: boolean;
     /**
      * A shorthand method to update multiple fields of the user at once.
      */
@@ -250,6 +256,7 @@ type UserUpdateOptions = {
     displayName?: string;
     clientMetadata?: ReadonlyJson;
     selectedTeamId?: string | null;
+    totpMultiFactorSecret?: Uint8Array | null;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string, options?: {
@@ -291,8 +298,15 @@ type ServerUserUpdateOptions = {
     serverMetadata?: ReadonlyJson;
     password?: string;
 } & UserUpdateOptions;
+type ServerUserCreateOptions = {
+    primaryEmail: string;
+    password: string;
+    displayName?: string;
+    primaryEmailVerified?: boolean;
+};
 type Project = {
     readonly id: string;
+    readonly displayName: string;
     readonly config: ProjectConfig;
 };
 type AdminProject = {
@@ -320,6 +334,7 @@ type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'>
     displayName: string;
 };
 type ProjectConfig = {
+    readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
     readonly oauthProviders: OAuthProviderConfig[];
@@ -328,6 +343,7 @@ type OAuthProviderConfig = {
     readonly id: string;
 };
 type AdminProjectConfig = {
+    readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
     readonly allowLocalhost: boolean;
@@ -370,6 +386,7 @@ type AdminProjectConfigUpdateOptions = {
         handlerPath: string;
     }[];
     oauthProviders?: AdminOAuthProviderConfig[];
+    signUpEnabled?: boolean;
     credentialEnabled?: boolean;
     magicLinkEnabled?: boolean;
     allowLocalhost?: boolean;
@@ -420,6 +437,9 @@ type Team = {
     id: string;
     displayName: string;
     profileImageUrl: string | null;
+    inviteUser(options: {
+        email: string;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
 };
 type TeamCreateOptions = {
     displayName: string;
@@ -432,6 +452,9 @@ type ServerTeam = {
     update(update: ServerTeamUpdateOptions): Promise<void>;
     delete(): Promise<void>;
     addUser(userId: string): Promise<void>;
+    inviteUser(options: {
+        email: string;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
     removeUser(userId: string): Promise<void>;
 } & Team;
 type ServerTeamCreateOptions = TeamCreateOptions;
@@ -500,6 +523,11 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         password: string;
     }): Promise<KnownErrors["VerificationCodeError"] | void>;
     verifyPasswordResetCode(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
+    verifyTeamInvitationCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    acceptTeamInvitation(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    getTeamInvitationDetails(code: string): Promise<Result<{
+        teamDisplayName: string;
+    }, KnownErrors["VerificationCodeError"]>>;
     verifyEmail(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
     signInWithMagicLink(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
     redirectToOAuthCallback(): Promise<void>;
@@ -535,6 +563,7 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
      * @deprecated use `getUser()` instead
      */
     getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+    createUser(options: ServerUserCreateOptions): Promise<ServerUser>;
     useUser(options: GetUserOptions<HasTokenStore> & {
         or: 'redirect';
     }): ProjectCurrentServerUser<ProjectId>;

package/dist/lib/stack-app.d.ts

@@ -7,6 +7,7 @@ import { TeamPermissionDefinitionsCrud } from '@stackframe/stack-shared/dist/int
 import { InternalSession } from '@stackframe/stack-shared/dist/sessions';
 import { ReadonlyJson } from '@stackframe/stack-shared/dist/utils/json';
 import { ProviderType } from '@stackframe/stack-shared/dist/utils/oauth';
+import { Result } from '@stackframe/stack-shared/dist/utils/results';
 
 type RequestLike = {
     headers: {
@@ -32,6 +33,7 @@ type HandlerUrls = {
     oauthCallback: string;
     magicLinkCallback: string;
     accountSettings: string;
+    teamInvitation: string;
     error: string;
 };
 type OAuthScopesOnSignIn = {
@@ -193,9 +195,13 @@ type BaseUser = {
      * Whether the user has a password set.
      */
     readonly hasPassword: boolean;
+    /**
+     * @deprecated
+     */
     readonly oauthProviders: readonly {
         id: string;
     }[];
+    readonly isMultiFactorRequired: boolean;
     /**
      * A shorthand method to update multiple fields of the user at once.
      */
@@ -250,6 +256,7 @@ type UserUpdateOptions = {
     displayName?: string;
     clientMetadata?: ReadonlyJson;
     selectedTeamId?: string | null;
+    totpMultiFactorSecret?: Uint8Array | null;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string, options?: {
@@ -291,8 +298,15 @@ type ServerUserUpdateOptions = {
     serverMetadata?: ReadonlyJson;
     password?: string;
 } & UserUpdateOptions;
+type ServerUserCreateOptions = {
+    primaryEmail: string;
+    password: string;
+    displayName?: string;
+    primaryEmailVerified?: boolean;
+};
 type Project = {
     readonly id: string;
+    readonly displayName: string;
     readonly config: ProjectConfig;
 };
 type AdminProject = {
@@ -320,6 +334,7 @@ type AdminProjectCreateOptions = Omit<AdminProjectUpdateOptions, 'displayName'>
     displayName: string;
 };
 type ProjectConfig = {
+    readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
     readonly oauthProviders: OAuthProviderConfig[];
@@ -328,6 +343,7 @@ type OAuthProviderConfig = {
     readonly id: string;
 };
 type AdminProjectConfig = {
+    readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
     readonly allowLocalhost: boolean;
@@ -370,6 +386,7 @@ type AdminProjectConfigUpdateOptions = {
         handlerPath: string;
     }[];
     oauthProviders?: AdminOAuthProviderConfig[];
+    signUpEnabled?: boolean;
     credentialEnabled?: boolean;
     magicLinkEnabled?: boolean;
     allowLocalhost?: boolean;
@@ -420,6 +437,9 @@ type Team = {
     id: string;
     displayName: string;
     profileImageUrl: string | null;
+    inviteUser(options: {
+        email: string;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
 };
 type TeamCreateOptions = {
     displayName: string;
@@ -432,6 +452,9 @@ type ServerTeam = {
     update(update: ServerTeamUpdateOptions): Promise<void>;
     delete(): Promise<void>;
     addUser(userId: string): Promise<void>;
+    inviteUser(options: {
+        email: string;
+    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
     removeUser(userId: string): Promise<void>;
 } & Team;
 type ServerTeamCreateOptions = TeamCreateOptions;
@@ -500,6 +523,11 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         password: string;
     }): Promise<KnownErrors["VerificationCodeError"] | void>;
     verifyPasswordResetCode(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
+    verifyTeamInvitationCode(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    acceptTeamInvitation(code: string): Promise<Result<undefined, KnownErrors["VerificationCodeError"]>>;
+    getTeamInvitationDetails(code: string): Promise<Result<{
+        teamDisplayName: string;
+    }, KnownErrors["VerificationCodeError"]>>;
     verifyEmail(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
     signInWithMagicLink(code: string): Promise<KnownErrors["VerificationCodeError"] | void>;
     redirectToOAuthCallback(): Promise<void>;
@@ -535,6 +563,7 @@ type StackServerApp<HasTokenStore extends boolean = boolean, ProjectId extends s
      * @deprecated use `getUser()` instead
      */
     getServerUser(): Promise<ProjectCurrentServerUser<ProjectId> | null>;
+    createUser(options: ServerUserCreateOptions): Promise<ServerUser>;
     useUser(options: GetUserOptions<HasTokenStore> & {
         or: 'redirect';
     }): ProjectCurrentServerUser<ProjectId>;

package/dist/lib/stack-app.js

@@ -42,6 +42,7 @@ var import_stack_sc = require("@stackframe/stack-sc");
 var import_stack_shared = require("@stackframe/stack-shared");
 var import_production_mode = require("@stackframe/stack-shared/dist/helpers/production-mode");
 var import_sessions = require("@stackframe/stack-shared/dist/sessions");
+var import_bytes = require("@stackframe/stack-shared/dist/utils/bytes");
 var import_caches = require("@stackframe/stack-shared/dist/utils/caches");
 var import_compile_time = require("@stackframe/stack-shared/dist/utils/compile-time");
 var import_env = require("@stackframe/stack-shared/dist/utils/env");
@@ -62,7 +63,7 @@ var import_url = require("../utils/url");
 var import_auth = require("./auth");
 var import_cookie = require("./cookie");
 var NextNavigation = (0, import_compile_time.scrambleDuringCompileTime)(NextNavigationUnscrambled);
-var clientVersion = "js @stackframe/stack@2.5.16";
+var clientVersion = "js @stackframe/stack@2.5.18";
 function getUrls(partial) {
   const handler = partial.handler ?? "/handler";
   const home = partial.home ?? "/";
@@ -83,6 +84,7 @@ function getUrls(partial) {
     home,
     accountSettings: `${handler}/account-settings`,
     error: `${handler}/error`,
+    teamInvitation: `${handler}/team-invitation`,
     ...(0, import_objects.filterUndefined)(partial)
   };
 }
@@ -517,7 +519,9 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   _clientProjectFromCrud(crud) {
     return {
       id: crud.id,
+      displayName: crud.display_name,
       config: {
+        signUpEnabled: crud.config.sign_up_enabled,
         credentialEnabled: crud.config.credential_enabled,
         magicLinkEnabled: crud.config.magic_link_enabled,
         oauthProviders: crud.config.enabled_oauth_providers.map((p) => ({
@@ -532,10 +536,19 @@ var _StackClientAppImpl = class __StackClientAppImpl {
     };
   }
   _clientTeamFromCrud(crud) {
+    const app = this;
     return {
       id: crud.id,
       displayName: crud.display_name,
-      profileImageUrl: crud.profile_image_url
+      profileImageUrl: crud.profile_image_url,
+      async inviteUser(options) {
+        return await app._interface.sendTeamInvitation({
+          teamId: crud.id,
+          email: options.email,
+          session: app._getSession(),
+          callbackUrl: (0, import_url.constructRedirectUrl)(app.urls.teamInvitation)
+        });
+      }
     };
   }
   _createAuth(session) {
@@ -581,6 +594,7 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       emailAuthEnabled: crud.auth_with_email,
       oauthProviders: crud.oauth_providers,
       selectedTeam: crud.selected_team && this._clientTeamFromCrud(crud.selected_team),
+      isMultiFactorRequired: crud.requires_totp_mfa,
       toClientJson() {
         return crud;
       }
@@ -652,17 +666,17 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       async hasPermission(scope, permissionId) {
         return await this.getPermission(scope, permissionId) !== null;
       },
-      update(update) {
-        return app._updateClientUser(update, session);
+      async update(update) {
+        return await app._updateClientUser(update, session);
       },
-      sendVerificationEmail() {
+      async sendVerificationEmail() {
         if (!crud?.primary_email) {
           throw new import_errors.StackAssertionError("User does not have a primary email");
         }
-        return app._sendVerificationEmail(crud.primary_email, session);
+        return await app._sendVerificationEmail(crud.primary_email, session);
       },
-      updatePassword(options) {
-        return app._updatePassword(options, session);
+      async updatePassword(options) {
+        return await app._updatePassword(options, session);
       }
     };
   }
@@ -796,6 +810,9 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   async redirectToError(options) {
     return await this._redirectToHandler("error", options);
   }
+  async redirectToTeamInvitation(options) {
+    return await this._redirectToHandler("teamInvitation", options);
+  }
   async sendForgotPasswordEmail(email) {
     const redirectUrl = (0, import_url.constructRedirectUrl)(this.urls.passwordReset);
     const error = await this._interface.sendForgotPasswordEmail(email, redirectUrl);
@@ -813,6 +830,42 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   async verifyPasswordResetCode(code) {
     return await this._interface.verifyPasswordResetCode(code);
   }
+  async verifyTeamInvitationCode(code) {
+    const result = await this._interface.acceptTeamInvitation({
+      type: "check",
+      code,
+      session: this._getSession()
+    });
+    if (result.status === "ok") {
+      return import_results.Result.ok(void 0);
+    } else {
+      return import_results.Result.error(result.error);
+    }
+  }
+  async acceptTeamInvitation(code) {
+    const result = await this._interface.acceptTeamInvitation({
+      type: "use",
+      code,
+      session: this._getSession()
+    });
+    if (result.status === "ok") {
+      return import_results.Result.ok(void 0);
+    } else {
+      return import_results.Result.error(result.error);
+    }
+  }
+  async getTeamInvitationDetails(code) {
+    const result = await this._interface.acceptTeamInvitation({
+      type: "details",
+      code,
+      session: this._getSession()
+    });
+    if (result.status === "ok") {
+      return import_results.Result.ok({ teamDisplayName: result.data.team_display_name });
+    } else {
+      return import_results.Result.error(result.error);
+    }
+  }
   async verifyEmail(code) {
     return await this._interface.verifyEmail(code);
   }
@@ -880,7 +933,31 @@ var _StackClientAppImpl = class __StackClientAppImpl {
   async signInWithCredential(options) {
     this._ensurePersistentTokenStore();
     const session = this._getSession();
-    const result = await this._interface.signInWithCredential(options.email, options.password, session);
+    let result;
+    try {
+      result = await this._interface.signInWithCredential(options.email, options.password, session);
+    } catch (e) {
+      if (options.__experimental_mfa && e instanceof import_stack_shared.KnownErrors.MultiFactorAuthenticationRequired) {
+        const otp = prompt("Please enter the six-digit TOTP code from your authenticator app.");
+        try {
+          if (!otp) {
+            throw new import_stack_shared.KnownErrors.InvalidTotpCode();
+          }
+          result = await this._interface.totpMfa(
+            e.details?.attempt_code ?? (0, import_errors.throwErr)("attempt code missing"),
+            otp,
+            session
+          );
+        } catch (e2) {
+          if (e2 instanceof import_stack_shared.KnownErrors.InvalidTotpCode) {
+            return e2;
+          }
+          throw e2;
+        }
+      } else {
+        throw e;
+      }
+    }
     if (!(result instanceof import_stack_shared.KnownError)) {
       await this._signInToAccountWithTokens(result);
       return await this.redirectToAfterSignIn({ replace: true });
@@ -1079,7 +1156,7 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
       return await this._interface.listServerTeamUsers(teamId);
     });
     this._serverTeamUserPermissionsCache = createCache(async ([teamId, userId, recursive]) => {
-      return await this._interface.listServerTeamMemberPermissions({ teamId, userId, recursive });
+      return await this._interface.listServerTeamPermissions({ teamId, userId, recursive }, null);
     });
     this._serverUserOAuthConnectionAccessTokensCache = createCache(
       async ([userId, providerId, scope]) => {
@@ -1268,9 +1345,22 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
           userId
         });
         await app._serverTeamUsersCache.refresh([crud.id]);
+      },
+      async inviteUser(options) {
+        return await app._interface.sendTeamInvitation({
+          teamId: crud.id,
+          email: options.email,
+          session: null,
+          callbackUrl: (0, import_url.constructRedirectUrl)(app.urls.teamInvitation)
+        });
       }
     };
   }
+  async createUser(options) {
+    const crud = await this._interface.createServerUser(serverUserCreateOptionsToCrud(options));
+    await this._refreshUsers();
+    return this._serverUserFromCrud(crud);
+  }
   async getUser(options) {
     this._ensurePersistentTokenStore(options?.tokenStore);
     const session = this._getSession(options?.tokenStore);
@@ -1448,6 +1538,7 @@ var _StackAdminAppImpl = class extends _StackServerAppImpl {
       isProductionMode: data.is_production_mode,
       config: {
         id: data.config.id,
+        signUpEnabled: data.config.sign_up_enabled,
         credentialEnabled: data.config.credential_enabled,
         magicLinkEnabled: data.config.magic_link_enabled,
         allowLocalhost: data.config.allow_localhost,
@@ -1628,7 +1719,8 @@ function userUpdateOptionsToCrud(options) {
   return {
     display_name: options.displayName,
     client_metadata: options.clientMetadata,
-    selected_team_id: options.selectedTeamId
+    selected_team_id: options.selectedTeamId,
+    totp_secret_base64: options.totpMultiFactorSecret != null ? (0, import_bytes.encodeBase64)(options.totpMultiFactorSecret) : options.totpMultiFactorSecret
   };
 }
 function serverUserUpdateOptionsToCrud(options) {
@@ -1640,7 +1732,17 @@ function serverUserUpdateOptionsToCrud(options) {
     selected_team_id: options.selectedTeamId,
     primary_email_auth_enabled: options.primaryEmailAuthEnabled,
     primary_email_verified: options.primaryEmailVerified,
-    password: options.password
+    password: options.password,
+    totp_secret_base64: options.totpMultiFactorSecret != null ? (0, import_bytes.encodeBase64)(options.totpMultiFactorSecret) : options.totpMultiFactorSecret
+  };
+}
+function serverUserCreateOptionsToCrud(options) {
+  return {
+    primary_email: options.primaryEmail,
+    password: options.password,
+    primary_email_auth_enabled: true,
+    display_name: options.displayName,
+    primary_email_verified: options.primaryEmailVerified
   };
 }
 function adminProjectUpdateOptionsToCrud(options) {
@@ -1674,6 +1776,7 @@ function adminProjectUpdateOptionsToCrud(options) {
         sender_name: options.config.emailConfig.senderName,
         sender_email: options.config.emailConfig.senderEmail
       }),
+      sign_up_enabled: options.config?.signUpEnabled,
       credential_enabled: options.config?.credentialEnabled,
       magic_link_enabled: options.config?.magicLinkEnabled,
       allow_localhost: options.config?.allowLocalhost,