@supabase/auth-js 2.116.0 → 2.117.0-canary.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supabase/auth-js",
-  "version": "2.116.0",
+  "version": "2.117.0-canary.1",
   "private": false,
   "description": "Official SDK for Supabase Auth",
   "keywords": [

package/src/GoTrueAdminApi.ts

@@ -5,7 +5,7 @@ import {
   _request,
   _userResponse,
 } from './lib/fetch'
-import { assertPasskeyExperimentalEnabled, resolveFetch, validateUUID } from './lib/helpers'
+import { resolveFetch, validateUUID } from './lib/helpers'
 import {
   AdminUserAttributes,
   GenerateLinkParams,
@@ -56,8 +56,6 @@ export default class GoTrueAdminApi {
 
   /**
    * Contains all passkey administration methods.
-   *
-   * Requires `auth.experimental.passkey: true`; otherwise all methods throw.
    */
   passkey: GoTrueAdminPasskeyApi
 
@@ -1208,13 +1206,10 @@ export default class GoTrueAdminApi {
    * Lists all passkeys for a user.
    *
    * This function should only be called on a server. Never expose your secret key in the browser.
-   *
-   * Requires `auth.experimental.passkey: true`.
    */
   private async _adminListPasskeys(
     params: AuthPasskeyAdminListParams
   ): Promise<AuthPasskeyListResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     validateUUID(params.userId)
 
     try {
@@ -1236,13 +1231,10 @@ export default class GoTrueAdminApi {
    * Deletes a user's passkey.
    *
    * This function should only be called on a server. Never expose your secret key in the browser.
-   *
-   * Requires `auth.experimental.passkey: true`.
    */
   private async _adminDeletePasskey(
     params: AuthPasskeyAdminDeleteParams
   ): Promise<AuthPasskeyDeleteResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     validateUUID(params.userId)
     validateUUID(params.passkeyId)
 

package/src/GoTrueClient.ts

@@ -38,7 +38,6 @@ import {
 } from './lib/fetch'
 import {
   appendFlowIdToRedirectTo,
-  assertPasskeyExperimentalEnabled,
   assertRecoveryCodesExperimentalEnabled,
   decodeJWT,
   deepClone,
@@ -263,8 +262,6 @@ export default class GoTrueClient {
   /**
    * Namespace for passkey methods.
    * Includes lower-level two-step registration/authentication and passkey management.
-   *
-   * Requires `auth.experimental.passkey: true`; otherwise all methods throw.
    */
   passkey: AuthPasskeyApi
   /**
@@ -6803,14 +6800,36 @@ export default class GoTrueClient {
    * 2. Prompts user via navigator.credentials.get()
    * 3. Verifies credential with server and creates session
    *
-   * Requires `auth.experimental.passkey: true`.
+   * Pass `options.mediation: 'conditional'` to use WebAuthn Conditional UI
+   * (passkey autofill) instead of the modal picker; the value is forwarded to
+   * `navigator.credentials.get()` unchanged.
+   *
+   * The challenge fetched in step 1 expires after the server's
+   * GOTRUE_WEBAUTHN_CHALLENGE_EXPIRY_DURATION (5 minutes by default). With
+   * `mediation: 'conditional'` the autofill prompt can stay pending for longer
+   * than that: the browser ceremony then still succeeds, but verification fails
+   * with `error_code: "webauthn_challenge_expired"`. Recover by calling
+   * `signInWithPasskey()` again. It fetches a fresh challenge and, unless you
+   * passed your own `options.signal`, cancels the pending ceremony first, so
+   * the browser never sees two concurrent WebAuthn requests; the earlier call
+   * resolves with a `WebAuthnError` whose code is `ERROR_CEREMONY_ABORTED`. If
+   * you pass your own `signal`, abort it before retrying.
    *
    * @category Auth
+   *
+   * @example Sign in with Conditional UI (passkey autofill)
+   * ```js
+   * // <input autocomplete="username webauthn" /> somewhere on the page
+   * const { data, error } = await supabase.auth.signInWithPasskey({
+   *   options: {
+   *     mediation: 'conditional'
+   *   }
+   * });
+   * ```
    */
   async signInWithPasskey(
     credentials?: SignInWithPasskeyCredentials
   ): Promise<AuthPasskeyAuthenticationVerifyResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       if (!browserSupportsWebAuthn()) {
         return this._returnResult({
@@ -6833,6 +6852,7 @@ export default class GoTrueClient {
       const { data: credential, error: credentialError } = await getCredential({
         publicKey: publicKeyOptions,
         signal,
+        mediation: credentials?.options?.mediation,
       })
       if (credentialError || !credential) {
         return this._returnResult({
@@ -6861,14 +6881,13 @@ export default class GoTrueClient {
    * 2. Prompts user via navigator.credentials.create()
    * 3. Verifies credential with server
    *
-   * Requires an active session. Requires `auth.experimental.passkey: true`.
+   * Requires an active session.
    *
    * @category Auth
    */
   async registerPasskey(
     credentials?: RegisterPasskeyCredentials
   ): Promise<AuthPasskeyRegistrationVerifyResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       if (!browserSupportsWebAuthn()) {
         return this._returnResult({
@@ -6916,7 +6935,6 @@ export default class GoTrueClient {
    * Returns WebAuthn credential creation options to pass to navigator.credentials.create().
    */
   private async _startPasskeyRegistration(): Promise<AuthPasskeyRegistrationOptionsResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       return await this._useSession(async (result) => {
         const {
@@ -6959,7 +6977,6 @@ export default class GoTrueClient {
   private async _verifyPasskeyRegistration(
     params: VerifyPasskeyRegistrationParams
   ): Promise<AuthPasskeyRegistrationVerifyResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       return await this._useSession(async (result) => {
         const {
@@ -7005,7 +7022,6 @@ export default class GoTrueClient {
   private async _startPasskeyAuthentication(
     params?: StartPasskeyAuthenticationParams
   ): Promise<AuthPasskeyAuthenticationOptionsResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       const { data, error } = await _request(
         this.fetch,
@@ -7037,7 +7053,6 @@ export default class GoTrueClient {
   private async _verifyPasskeyAuthentication(
     params: VerifyPasskeyAuthenticationParams
   ): Promise<AuthPasskeyAuthenticationVerifyResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       const { data, error } = await _request(
         this.fetch,
@@ -7072,7 +7087,6 @@ export default class GoTrueClient {
    * List all passkeys for the current user.
    */
   private async _listPasskeys(): Promise<AuthPasskeyListResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       return await this._useSession(async (result) => {
         const {
@@ -7107,7 +7121,6 @@ export default class GoTrueClient {
    * Update a passkey.
    */
   private async _updatePasskey(params: PasskeyUpdateParams): Promise<AuthPasskeyUpdateResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       return await this._useSession(async (result) => {
         const {
@@ -7147,7 +7160,6 @@ export default class GoTrueClient {
    * Delete a passkey.
    */
   private async _deletePasskey(params: PasskeyDeleteParams): Promise<AuthPasskeyDeleteResponse> {
-    assertPasskeyExperimentalEnabled(this.experimental)
     try {
       return await this._useSession(async (result) => {
         const {

package/src/lib/error-codes.ts

@@ -37,6 +37,7 @@ export type ErrorCode =
   | 'mfa_factor_not_found'
   | 'mfa_ip_address_mismatch'
   | 'mfa_challenge_expired'
+  | 'webauthn_challenge_expired'
   | 'mfa_verification_failed'
   | 'mfa_verification_rejected'
   | 'insufficient_aal'

package/src/lib/helpers.ts

@@ -569,14 +569,6 @@ export function validateUUID(str: string) {
   }
 }
 
-export function assertPasskeyExperimentalEnabled(experimental: { passkey?: boolean }): void {
-  if (!experimental.passkey) {
-    throw new Error(
-      '@supabase/auth-js: the passkey API is experimental and disabled by default. Enable it by passing `auth: { experimental: { passkey: true } }` to createClient (or to the GoTrueClient constructor).'
-    )
-  }
-}
-
 export function assertRecoveryCodesExperimentalEnabled(experimental: {
   recoveryCodes?: boolean
 }): void {

package/src/lib/types.ts

@@ -181,13 +181,14 @@ export type GoTrueClientOptions = {
 
 export type ExperimentalFeatureFlags = {
   /**
-   * Enables passkey support:
-   *   - `auth.signInWithPasskey()`, `auth.registerPasskey()`
-   *   - `auth.passkey.*`
-   *   - `auth.admin.passkey.*`
+   * Previously required to enable the passkey API (`auth.signInWithPasskey()`,
+   * `auth.registerPasskey()`, `auth.passkey.*`, `auth.admin.passkey.*`).
    *
-   * Defaults to `false`. Calling any passkey method while this flag is
-   * disabled throws a descriptive error at call time.
+   * Passkeys are now enabled by default and this flag is ignored. It is kept
+   * only so existing code that sets it keeps compiling and will be removed in
+   * the next major version.
+   *
+   * @deprecated Passkeys are enabled by default; this flag has no effect.
    */
   passkey?: boolean
   /**
@@ -3141,6 +3142,7 @@ export type PasskeyMetadata = {
 export type PasskeyAuthenticationOptionsResponse = {
   challenge_id: string
   options: ServerCredentialRequestOptions
+  /** Timestamp in UNIX seconds when this challenge will no longer be usable. */
   expires_at: number
 }
 
@@ -3164,6 +3166,33 @@ export type SignInWithPasskeyCredentials = {
   options?: {
     captchaToken?: string
     signal?: AbortSignal
+    /**
+     * Forwarded to `navigator.credentials.get()` as `mediation`.
+     *
+     * Use `'conditional'` to opt into WebAuthn Conditional UI, where the browser
+     * offers passkeys through the autofill prompt instead of a modal picker. The
+     * page also needs an input with `autocomplete="username webauthn"`.
+     *
+     * When omitted the browser's default (modal) behavior is used.
+     *
+     * Note that the server-side challenge expires (5 minutes by default) while
+     * the autofill prompt can stay pending indefinitely; if the user picks a
+     * passkey after that, verification fails with
+     * `error_code: "webauthn_challenge_expired"` and the app should call
+     * `signInWithPasskey()` again. See `signInWithPasskey` for details.
+     *
+     * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/CredentialsContainer/get#mediation MDN - mediation}
+     *
+     * @example
+     * ```ts
+     * const credentials: SignInWithPasskeyCredentials = {
+     *   options: {
+     *     mediation: 'conditional'
+     *   }
+     * }
+     * ```
+     */
+    mediation?: CredentialMediationRequirement
   }
 }
 

package/src/lib/version.ts

@@ -4,4 +4,4 @@
 // - Debugging and support (identifying which version is running)
 // - Telemetry and logging (version reporting in errors/analytics)
 // - Ensuring build artifacts match the published package version
-export const version = '2.116.0'
+export const version = '2.117.0-canary.1'