@startsimpli/auth 0.4.28 → 0.4.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.28",
+  "version": "0.4.29",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/__tests__/auth-functions.test.ts

@@ -119,6 +119,54 @@ describe('CSRF not required for signin/register (endpoints are @csrf_exempt)', (
     expect(headers['X-CSRFToken']).toBeUndefined();
   });
 
+  it('signInWithCredentials threads the login target (app) into the body when provided (qxv2.5)', async () => {
+    mockFetch.mockImplementation(() =>
+      Promise.resolve({
+        ok: true,
+        status: 200,
+        json: async () => ({ access: VALID_TOKEN, user: { id: '1', email: 'a@b.com' } }),
+      }),
+    );
+
+    await signInWithCredentials('test@test.com', 'password', 'foundry');
+
+    const tokenCall = mockFetch.mock.calls.find(
+      (c: unknown[]) =>
+        typeof c[0] === 'string' &&
+        (c[0] as string).includes('/auth/token/') &&
+        !(c[0] as string).includes('refresh'),
+    );
+    expect(tokenCall).toBeDefined();
+    expect(JSON.parse(tokenCall![1]!.body as string)).toEqual({
+      email: 'test@test.com',
+      password: 'password',
+      app: 'foundry',
+    });
+  });
+
+  it('signInWithCredentials omits app from the body when not provided (qxv2.5)', async () => {
+    mockFetch.mockImplementation(() =>
+      Promise.resolve({
+        ok: true,
+        status: 200,
+        json: async () => ({ access: VALID_TOKEN, user: { id: '1', email: 'a@b.com' } }),
+      }),
+    );
+
+    await signInWithCredentials('test@test.com', 'password');
+
+    const tokenCall = mockFetch.mock.calls.find(
+      (c: unknown[]) =>
+        typeof c[0] === 'string' &&
+        (c[0] as string).includes('/auth/token/') &&
+        !(c[0] as string).includes('refresh'),
+    );
+    expect(JSON.parse(tokenCall![1]!.body as string)).toEqual({
+      email: 'test@test.com',
+      password: 'password',
+    });
+  });
+
   it('registerAccount does not fetch or send CSRF token', async () => {
     mockFetch.mockImplementation(() => {
       return Promise.resolve({

package/src/client/functions.ts

@@ -330,7 +330,10 @@ function parseAuthResponse(data: unknown): { access?: string; user?: AuthUser }
 
 // --- Auth functions ---
 
-export async function signInWithCredentials(email: string, password: string) {
+export async function signInWithCredentials(email: string, password: string, app?: string) {
+  // `app` is the login target (qxv2.5): the central mint scopes the token's
+  // audience to it (control plane => first-party for a foundry owner; tenant =>
+  // tenant aud). Server-validated; omitted => current home-org behavior.
   // No CSRF needed — Django's /auth/token/ is @csrf_exempt (JWT endpoint)
   const response = await fetchWithTimeout(resolveAuthUrl(AUTH_PATHS.TOKEN), {
     method: 'POST',
@@ -338,7 +341,7 @@ export async function signInWithCredentials(email: string, password: string) {
       'Content-Type': 'application/json',
     },
     credentials: 'include',
-    body: JSON.stringify({ email, password }),
+    body: JSON.stringify(app ? { email, password, app } : { email, password }),
   });
 
   const data = await response.json().catch(() => ({}));