@structured-id/ui-core 4.7.1 → 4.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@structured-id/ui-core",
-  "version": "4.7.1",
+  "version": "4.8.0",
   "type": "module",
   "publishConfig": {
     "access": "public",
@@ -42,7 +42,7 @@
     "@protobuf-ts/grpcweb-transport": "^2.11.1",
     "@protobuf-ts/runtime": "^2.11.1",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "@structured-id/proto": "^0.6.0",
+    "@structured-id/proto": "^0.8.0",
     "@structured-world/structured-email-address-ts": "^0.0.22",
     "@structured-world/structured-public-domains": "0.0.x",
     "libphonenumber-js": "^1.13.15"

package/src/composables/useBffAuth.test.ts

@@ -6,6 +6,16 @@ import { GrantOutcome } from "@structured-id/proto/sid/v1/authn/application_sess
 const host = vi.hoisted(() => ({
   getApplicationSession: vi.fn(),
   endApplicationSession: vi.fn(),
+  /** The base URL of the transport last made. */
+  transportBase: undefined as string | undefined,
+}));
+
+vi.mock("@protobuf-ts/grpcweb-transport", () => ({
+  GrpcWebFetchTransport: class {
+    constructor(options: { baseUrl: string }) {
+      host.transportBase = options.baseUrl;
+    }
+  },
 }));
 
 vi.mock("@structured-id/proto/sid/v1/authn/application_session.client", () => ({
@@ -40,6 +50,27 @@ const LIVE = {
   csrfToken: "token-1",
 };
 
+describe("the session service's address", () => {
+  // The host serves a page's calls only under its API mount: a call at the
+  // root is refused, and the page cannot read a session it has.
+  it("is the API mount of the page's own origin", () => {
+    initBff("");
+    expect(host.transportBase).toBe("/api");
+  });
+
+  it("is the API mount of a configured host", () => {
+    initBff("https://host.sid.example.com");
+    expect(host.transportBase).toBe("https://host.sid.example.com/api");
+  });
+
+  it("is the API mount of a host named for one call", async () => {
+    initBff("");
+    host.getApplicationSession.mockReturnValue(answers(LIVE));
+    await checkBffSession("https://other.sid.example.com");
+    expect(host.transportBase).toBe("https://other.sid.example.com/api");
+  });
+});
+
 describe("checkBffSession", () => {
   beforeEach(() => {
     vi.clearAllMocks();

package/src/composables/useBffAuth.ts

@@ -43,10 +43,13 @@ let _session: ApplicationSessionServiceClient | null = null;
  */
 let _csrfToken: string | null = null;
 
-/** The session service at `baseUrl`; the cookie never travels to another origin. */
+/**
+ * The session service of the host at `baseUrl`, under the `/api` mount that
+ * serves a page's calls; the cookie never travels to another origin.
+ */
 function sessionClient(baseUrl: string): ApplicationSessionServiceClient {
   const transport: RpcTransport = new GrpcWebFetchTransport({
-    baseUrl,
+    baseUrl: `${baseUrl}/api`,
     fetchInit: { credentials: "same-origin" },
   });
   return new ApplicationSessionServiceClient(transport);

package/src/profile/composables/useAuth.test.ts

@@ -126,6 +126,8 @@ describe("createAuth prewarm", () => {
     api.loginFinish.mockResolvedValue({
       sessionId: "s",
       expiresIn: 60n,
+      secondFactors: [],
+      enrollableFactors: [],
     });
   });
 
@@ -688,6 +690,8 @@ describe("createAuth login", () => {
     api.loginFinish.mockResolvedValue({
       sessionId: "sess-1",
       expiresIn: BigInt(3600),
+      secondFactors: [],
+      enrollableFactors: [],
     });
   });
 

package/src/utils/rpcRefusal.ts

@@ -186,6 +186,7 @@ export const REFUSAL_TEXTS: Readonly<
   [ErrorReason.INVALID_STATE]: "This cannot be done in its current state.",
   [ErrorReason.FEATURE_NOT_CONFIGURED]:
     "This feature is not configured; an administrator can enable it.",
+  [ErrorReason.REGISTRATION_DISABLED]: "Registration is closed right now.",
   [ErrorReason.RATE_LIMIT_EXCEEDED]: "Too many attempts; try again later.",
   [ErrorReason.QUOTA_EXCEEDED]: "A limit is reached; remove something first.",
   [ErrorReason.CONCURRENT_MODIFICATION]: