@stackframe/stack 2.6.12 → 2.6.15

package/dist/lib/stack-app.d.mts

@@ -176,6 +176,7 @@ type Auth = {
         accessToken: string | null;
         refreshToken: string | null;
     }>;
+    registerPasskey(): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>>;
 };
 /**
  * ```
@@ -218,6 +219,7 @@ type BaseUser = {
      */
     readonly hasPassword: boolean;
     readonly otpAuthEnabled: boolean;
+    readonly passkeyAuthEnabled: boolean;
     readonly isMultiFactorRequired: boolean;
     /**
      * A shorthand method to update multiple fields of the user at once.
@@ -297,6 +299,7 @@ type UserUpdateOptions = {
     totpMultiFactorSecret?: Uint8Array | null;
     profileImageUrl?: string | null;
     otpAuthEnabled?: boolean;
+    passkeyAuthEnabled?: boolean;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string, options?: {
@@ -380,6 +383,7 @@ type ProjectConfig = {
     readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
+    readonly passkeyEnabled: boolean;
     readonly clientTeamCreationEnabled: boolean;
     readonly clientUserDeletionEnabled: boolean;
     readonly oauthProviders: OAuthProviderConfig[];
@@ -392,6 +396,7 @@ type AdminProjectConfig = {
     readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
+    readonly passkeyEnabled: boolean;
     readonly clientTeamCreationEnabled: boolean;
     readonly clientUserDeletionEnabled: boolean;
     readonly legacyGlobalJwtSigning: boolean;
@@ -439,6 +444,7 @@ type AdminProjectConfigUpdateOptions = {
     signUpEnabled?: boolean;
     credentialEnabled?: boolean;
     magicLinkEnabled?: boolean;
+    passkeyEnabled?: boolean;
     clientTeamCreationEnabled?: boolean;
     clientUserDeletionEnabled?: boolean;
     allowLocalhost?: boolean;
@@ -509,7 +515,7 @@ type Team = {
     clientReadOnlyMetadata: any;
     inviteUser(options: {
         email: string;
-    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
+    }): Promise<void>;
     listUsers(): Promise<TeamUser[]>;
     useUsers(): TeamUser[];
     update(update: TeamUpdateOptions): Promise<void>;
@@ -537,7 +543,7 @@ type ServerTeam = {
     addUser(userId: string): Promise<void>;
     inviteUser(options: {
         email: string;
-    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
+    }): Promise<void>;
     removeUser(userId: string): Promise<void>;
 } & Team;
 type ServerTeamCreateOptions = TeamCreateOptions;
@@ -600,6 +606,7 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         password: string;
         noRedirect?: boolean;
     }): Promise<Result<undefined, KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"]>>;
+    signInWithPasskey(): Promise<Result<undefined, KnownErrors["PasskeyAuthenticationFailed"] | KnownErrors["InvalidTotpCode"] | KnownErrors["PasskeyWebAuthnError"]>>;
     callOAuthCallback(): Promise<boolean>;
     sendForgotPasswordEmail(email: string): Promise<Result<undefined, KnownErrors["UserNotFound"]>>;
     sendMagicLinkEmail(email: string): Promise<Result<{

package/dist/lib/stack-app.d.ts

@@ -176,6 +176,7 @@ type Auth = {
         accessToken: string | null;
         refreshToken: string | null;
     }>;
+    registerPasskey(): Promise<Result<undefined, KnownErrors["PasskeyRegistrationFailed"] | KnownErrors["PasskeyWebAuthnError"]>>;
 };
 /**
  * ```
@@ -218,6 +219,7 @@ type BaseUser = {
      */
     readonly hasPassword: boolean;
     readonly otpAuthEnabled: boolean;
+    readonly passkeyAuthEnabled: boolean;
     readonly isMultiFactorRequired: boolean;
     /**
      * A shorthand method to update multiple fields of the user at once.
@@ -297,6 +299,7 @@ type UserUpdateOptions = {
     totpMultiFactorSecret?: Uint8Array | null;
     profileImageUrl?: string | null;
     otpAuthEnabled?: boolean;
+    passkeyAuthEnabled?: boolean;
 };
 type ServerBaseUser = {
     setPrimaryEmail(email: string, options?: {
@@ -380,6 +383,7 @@ type ProjectConfig = {
     readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
+    readonly passkeyEnabled: boolean;
     readonly clientTeamCreationEnabled: boolean;
     readonly clientUserDeletionEnabled: boolean;
     readonly oauthProviders: OAuthProviderConfig[];
@@ -392,6 +396,7 @@ type AdminProjectConfig = {
     readonly signUpEnabled: boolean;
     readonly credentialEnabled: boolean;
     readonly magicLinkEnabled: boolean;
+    readonly passkeyEnabled: boolean;
     readonly clientTeamCreationEnabled: boolean;
     readonly clientUserDeletionEnabled: boolean;
     readonly legacyGlobalJwtSigning: boolean;
@@ -439,6 +444,7 @@ type AdminProjectConfigUpdateOptions = {
     signUpEnabled?: boolean;
     credentialEnabled?: boolean;
     magicLinkEnabled?: boolean;
+    passkeyEnabled?: boolean;
     clientTeamCreationEnabled?: boolean;
     clientUserDeletionEnabled?: boolean;
     allowLocalhost?: boolean;
@@ -509,7 +515,7 @@ type Team = {
     clientReadOnlyMetadata: any;
     inviteUser(options: {
         email: string;
-    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
+    }): Promise<void>;
     listUsers(): Promise<TeamUser[]>;
     useUsers(): TeamUser[];
     update(update: TeamUpdateOptions): Promise<void>;
@@ -537,7 +543,7 @@ type ServerTeam = {
     addUser(userId: string): Promise<void>;
     inviteUser(options: {
         email: string;
-    }): Promise<Result<undefined, KnownErrors["TeamPermissionRequired"]>>;
+    }): Promise<void>;
     removeUser(userId: string): Promise<void>;
 } & Team;
 type ServerTeamCreateOptions = TeamCreateOptions;
@@ -600,6 +606,7 @@ type StackClientApp<HasTokenStore extends boolean = boolean, ProjectId extends s
         password: string;
         noRedirect?: boolean;
     }): Promise<Result<undefined, KnownErrors["UserEmailAlreadyExists"] | KnownErrors["PasswordRequirementsNotMet"]>>;
+    signInWithPasskey(): Promise<Result<undefined, KnownErrors["PasskeyAuthenticationFailed"] | KnownErrors["InvalidTotpCode"] | KnownErrors["PasskeyWebAuthnError"]>>;
     callOAuthCallback(): Promise<boolean>;
     sendForgotPasswordEmail(email: string): Promise<Result<undefined, KnownErrors["UserNotFound"]>>;
     sendMagicLinkEmail(email: string): Promise<Result<{

package/dist/lib/stack-app.js

@@ -38,6 +38,7 @@ __export(stack_app_exports, {
   stackAppInternalsSymbol: () => stackAppInternalsSymbol
 });
 module.exports = __toCommonJS(stack_app_exports);
+var import_browser = require("@simplewebauthn/browser");
 var import_stack_sc = require("@stackframe/stack-sc");
 var import_stack_shared = require("@stackframe/stack-shared");
 var import_production_mode = require("@stackframe/stack-shared/dist/helpers/production-mode");
@@ -63,7 +64,7 @@ var import_url = require("../utils/url");
 var import_auth = require("./auth");
 var import_cookie = require("./cookie");
 var NextNavigation = (0, import_compile_time.scrambleDuringCompileTime)(NextNavigationUnscrambled);
-var clientVersion = "js @stackframe/stack@2.6.12";
+var clientVersion = "js @stackframe/stack@2.6.15";
 function getUrls(partial) {
   const handler = partial.handler ?? "/handler";
   const home = partial.home ?? "/";
@@ -542,6 +543,7 @@ var _StackClientAppImpl = class __StackClientAppImpl {
         signUpEnabled: crud.config.sign_up_enabled,
         credentialEnabled: crud.config.credential_enabled,
         magicLinkEnabled: crud.config.magic_link_enabled,
+        passkeyEnabled: crud.config.passkey_enabled,
         clientTeamCreationEnabled: crud.config.client_team_creation_enabled,
         clientUserDeletionEnabled: crud.config.client_user_deletion_enabled,
         oauthProviders: crud.config.enabled_oauth_providers.map((p) => ({
@@ -573,7 +575,7 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       clientMetadata: crud.client_metadata,
       clientReadOnlyMetadata: crud.client_read_only_metadata,
       async inviteUser(options) {
-        return await app._interface.sendTeamInvitation({
+        await app._interface.sendTeamInvitation({
           teamId: crud.id,
           email: options.email,
           session: app._getSession(),
@@ -638,6 +640,31 @@ var _StackClientAppImpl = class __StackClientAppImpl {
         const tokens = await this.currentSession.getTokens();
         return tokens;
       },
+      async registerPasskey() {
+        const initiationResult = await app._interface.initiatePasskeyRegistration({}, session);
+        if (initiationResult.status !== "ok") {
+          return import_results.Result.error(new import_stack_shared.KnownErrors.PasskeyRegistrationFailed("Failed to get initiation options for passkey registration"));
+        }
+        const { options_json, code } = initiationResult.data;
+        if (options_json.rp.id !== "THIS_VALUE_WILL_BE_REPLACED.example.com") {
+          throw new import_errors.StackAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options_json.rp.id}`);
+        }
+        options_json.rp.id = window.location.hostname;
+        let attResp;
+        try {
+          attResp = await (0, import_browser.startRegistration)({ optionsJSON: options_json });
+          debugger;
+        } catch (error) {
+          if (error instanceof import_browser.WebAuthnError) {
+            return import_results.Result.error(new import_stack_shared.KnownErrors.PasskeyWebAuthnError(error.message, error.name));
+          } else {
+            return import_results.Result.error(new import_stack_shared.KnownErrors.PasskeyRegistrationFailed("Failed to start passkey registration"));
+          }
+        }
+        const registrationResult = await app._interface.registerPasskey({ credential: attResp, code }, session);
+        await app._refreshUser(session);
+        return registrationResult;
+      },
       signOut() {
         return app._signOut(session);
       }
@@ -660,6 +687,7 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       emailAuthEnabled: crud.auth_with_email,
       otpAuthEnabled: crud.otp_auth_enabled,
       oauthProviders: crud.oauth_providers,
+      passkeyAuthEnabled: crud.passkey_auth_enabled,
       selectedTeam: crud.selected_team && this._clientTeamFromCrud(crud.selected_team),
       isMultiFactorRequired: crud.requires_totp_mfa,
       toClientJson() {
@@ -1146,6 +1174,38 @@ var _StackClientAppImpl = class __StackClientAppImpl {
       return import_results.Result.error(result.error);
     }
   }
+  async signInWithPasskey() {
+    this._ensurePersistentTokenStore();
+    let result;
+    try {
+      result = await this._catchMfaRequiredError(async () => {
+        const initiationResult = await this._interface.initiatePasskeyAuthentication({}, this._getSession());
+        if (initiationResult.status !== "ok") {
+          return import_results.Result.error(new import_stack_shared.KnownErrors.PasskeyAuthenticationFailed("Failed to get initiation options for passkey authentication"));
+        }
+        const { options_json, code } = initiationResult.data;
+        if (options_json.rpId !== "THIS_VALUE_WILL_BE_REPLACED.example.com") {
+          throw new import_errors.StackAssertionError(`Expected returned RP ID from server to equal sentinel, but found ${options_json.rpId}`);
+        }
+        options_json.rpId = window.location.hostname;
+        const authentication_response = await (0, import_browser.startAuthentication)({ optionsJSON: options_json });
+        return await this._interface.signInWithPasskey({ authentication_response, code });
+      });
+    } catch (error) {
+      if (error instanceof import_browser.WebAuthnError) {
+        return import_results.Result.error(new import_stack_shared.KnownErrors.PasskeyWebAuthnError(error.message, error.name));
+      } else {
+        return import_results.Result.error(new import_stack_shared.KnownErrors.PasskeyAuthenticationFailed("Failed to sign in with passkey"));
+      }
+    }
+    if (result.status === "ok") {
+      await this._signInToAccountWithTokens(result.data);
+      await this.redirectToAfterSignIn({ replace: true });
+      return import_results.Result.ok(void 0);
+    } else {
+      return import_results.Result.error(result.error);
+    }
+  }
   async callOAuthCallback() {
     this._ensurePersistentTokenStore();
     let result;
@@ -1596,7 +1656,7 @@ var _StackServerAppImpl = class extends _StackClientAppImpl {
         await app._serverTeamMemberProfilesCache.refresh([crud.id]);
       },
       async inviteUser(options) {
-        return await app._interface.sendTeamInvitation({
+        await app._interface.sendTeamInvitation({
           teamId: crud.id,
           email: options.email,
           session: null,
@@ -1800,6 +1860,7 @@ var _StackAdminAppImpl = class extends _StackServerAppImpl {
         signUpEnabled: data.config.sign_up_enabled,
         credentialEnabled: data.config.credential_enabled,
         magicLinkEnabled: data.config.magic_link_enabled,
+        passkeyEnabled: data.config.passkey_enabled,
         legacyGlobalJwtSigning: data.config.legacy_global_jwt_signing,
         clientTeamCreationEnabled: data.config.client_team_creation_enabled,
         clientUserDeletionEnabled: data.config.client_user_deletion_enabled,
@@ -2019,7 +2080,8 @@ function userUpdateOptionsToCrud(options) {
     selected_team_id: options.selectedTeamId,
     totp_secret_base64: options.totpMultiFactorSecret != null ? (0, import_bytes.encodeBase64)(options.totpMultiFactorSecret) : options.totpMultiFactorSecret,
     profile_image_url: options.profileImageUrl,
-    otp_auth_enabled: options.otpAuthEnabled
+    otp_auth_enabled: options.otpAuthEnabled,
+    passkey_auth_enabled: options.passkeyAuthEnabled
   };
 }
 function serverUserUpdateOptionsToCrud(options) {
@@ -2082,6 +2144,7 @@ function adminProjectUpdateOptionsToCrud(options) {
       sign_up_enabled: options.config?.signUpEnabled,
       credential_enabled: options.config?.credentialEnabled,
       magic_link_enabled: options.config?.magicLinkEnabled,
+      passkey_enabled: options.config?.passkeyEnabled,
       allow_localhost: options.config?.allowLocalhost,
       create_team_on_sign_up: options.config?.createTeamOnSignUp,
       client_team_creation_enabled: options.config?.clientTeamCreationEnabled,