@supabase/auth-js 2.116.0 → 2.117.0-canary.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/auth-js",
-  "version": "2.116.0",
+  "version": "2.117.0-canary.0",
   "private": false,
   "description": "Official SDK for Supabase Auth",
   "keywords": [

package/src/GoTrueClient.ts

@@ -6803,9 +6803,34 @@ export default class GoTrueClient {
    * 2. Prompts user via navigator.credentials.get()
    * 3. Verifies credential with server and creates session
    *
+   * Pass `options.mediation: 'conditional'` to use WebAuthn Conditional UI
+   * (passkey autofill) instead of the modal picker; the value is forwarded to
+   * `navigator.credentials.get()` unchanged.
+   *
+   * The challenge fetched in step 1 expires after the server's
+   * GOTRUE_WEBAUTHN_CHALLENGE_EXPIRY_DURATION (5 minutes by default). With
+   * `mediation: 'conditional'` the autofill prompt can stay pending for longer
+   * than that: the browser ceremony then still succeeds, but verification fails
+   * with `error_code: "webauthn_challenge_expired"`. Recover by calling
+   * `signInWithPasskey()` again. It fetches a fresh challenge and, unless you
+   * passed your own `options.signal`, cancels the pending ceremony first, so
+   * the browser never sees two concurrent WebAuthn requests; the earlier call
+   * resolves with a `WebAuthnError` whose code is `ERROR_CEREMONY_ABORTED`. If
+   * you pass your own `signal`, abort it before retrying.
+   *
    * Requires `auth.experimental.passkey: true`.
    *
    * @category Auth
+   *
+   * @example Sign in with Conditional UI (passkey autofill)
+   * ```js
+   * // <input autocomplete="username webauthn" /> somewhere on the page
+   * const { data, error } = await supabase.auth.signInWithPasskey({
+   *   options: {
+   *     mediation: 'conditional'
+   *   }
+   * });
+   * ```
    */
   async signInWithPasskey(
     credentials?: SignInWithPasskeyCredentials
@@ -6833,6 +6858,7 @@ export default class GoTrueClient {
       const { data: credential, error: credentialError } = await getCredential({
         publicKey: publicKeyOptions,
         signal,
+        mediation: credentials?.options?.mediation,
       })
       if (credentialError || !credential) {
         return this._returnResult({

package/src/lib/error-codes.ts

@@ -37,6 +37,7 @@ export type ErrorCode =
   | 'mfa_factor_not_found'
   | 'mfa_ip_address_mismatch'
   | 'mfa_challenge_expired'
+  | 'webauthn_challenge_expired'
   | 'mfa_verification_failed'
   | 'mfa_verification_rejected'
   | 'insufficient_aal'

package/src/lib/types.ts

@@ -3141,6 +3141,7 @@ export type PasskeyMetadata = {
 export type PasskeyAuthenticationOptionsResponse = {
   challenge_id: string
   options: ServerCredentialRequestOptions
+  /** Timestamp in UNIX seconds when this challenge will no longer be usable. */
   expires_at: number
 }
 
@@ -3164,6 +3165,33 @@ export type SignInWithPasskeyCredentials = {
   options?: {
     captchaToken?: string
     signal?: AbortSignal
+    /**
+     * Forwarded to `navigator.credentials.get()` as `mediation`.
+     *
+     * Use `'conditional'` to opt into WebAuthn Conditional UI, where the browser
+     * offers passkeys through the autofill prompt instead of a modal picker. The
+     * page also needs an input with `autocomplete="username webauthn"`.
+     *
+     * When omitted the browser's default (modal) behavior is used.
+     *
+     * Note that the server-side challenge expires (5 minutes by default) while
+     * the autofill prompt can stay pending indefinitely; if the user picks a
+     * passkey after that, verification fails with
+     * `error_code: "webauthn_challenge_expired"` and the app should call
+     * `signInWithPasskey()` again. See `signInWithPasskey` for details.
+     *
+     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get#mediation MDN - mediation}
+     *
+     * @example
+     * ```ts
+     * const credentials: SignInWithPasskeyCredentials = {
+     *   options: {
+     *     mediation: 'conditional'
+     *   }
+     * }
+     * ```
+     */
+    mediation?: CredentialMediationRequirement
   }
 }
 

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.116.0'
+export const version = '2.117.0-canary.0'