@tempoxyz/auth 0.0.0-pr-102.sha-c8a03d9 → 0.0.0-pr-104.sha-7e92695

package/dist/Actions.js

@@ -7,6 +7,7 @@
 import { Authentication } from 'ox/webauthn';
 import * as AccessKey from './internal/accessKey.js';
 import * as Api from './internal/api.js';
+import * as Link from './internal/link.js';
 import { request } from './internal/request.js';
 export * as account from './actions/account.js';
 export * as device from './actions/device.js';
@@ -39,7 +40,12 @@ export async function authorize(auth, options = {}) {
     }));
     if (!session.user)
         return undefined;
-    const key = await AccessKey.resolve(options.accessKey);
+    // A passkey sign-in's account step kept the key its assertion signed, which Tempo Auth
+    // authorizes with no second assertion when the passkey's account is chosen.
+    const kept = options.accessKey
+        ? undefined
+        : await Link.get(auth, { link: Link.account });
+    const key = kept ?? (await AccessKey.resolve(options.accessKey));
     const json = request(auth, {
         accessKey: key.accessKey,
         account: options.account,
@@ -49,6 +55,9 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', { json });
     if (response.status === 401)
         return undefined;
+    // A failed removal keeps the stale key, which the next account step replaces.
+    if (kept)
+        await Link.release(auth, { link: Link.account }).catch(() => undefined);
     const body = await Api.json(response);
     if (!('step' in body))
         return Api.authorization(body, key);

package/dist/Auth.d.ts

@@ -48,12 +48,6 @@ export type Auth = {
     fetch?: typeof globalThis.fetch | undefined;
     /** Where Tempo Auth redirects back to. Defaults to the page's origin in a browser. */
     redirectUri?: string | undefined;
-    /**
-     * The URL of the API that the app's access tokens are for, which becomes their `aud` (RFC 8707).
-     * It must be a resource indicator that Tempo Issuer registers. Without one, `aud` is the
-     * environment's client ID.
-     */
-    resource?: string | undefined;
     /** The scopes the app's tokens carry. */
     scope: string;
     /**

package/dist/actions/passkey.js

@@ -57,13 +57,18 @@ export async function signIn(auth, options = {}) {
         json: native ? { assertion, authorize } : { assertion },
     }));
     if ('step' in body) {
-        if (body.step.type === 'account')
+        if (body.step.type === 'account') {
+            // Choosing the passkey's account authorizes the key its assertion already signed, once
+            // `Actions.authorize` sends that key again.
+            if (!native && !options.accessKey)
+                await Link.keep(auth, { link: Link.account, material: key.material });
             return {
                 step: {
                     accounts: body.step.accounts.map(Api.tempoAccount),
                     type: 'account',
                 },
             };
+        }
         // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
         // library generated waits for it in `storage`.
         if (body.step.signed && !options.accessKey)

package/dist/internal/api.d.ts

@@ -59,8 +59,8 @@ export declare function post(auth: Auth, path: string, options: {
     json: unknown;
 }): Promise<Response>;
 /**
- * Calls Tempo Auth's OAuth token endpoint, adding the client, any secret, and any resource. It
- * forwards standard OAuth form posts to WorkOS, which binds the audience here, on every request.
+ * Calls Tempo Auth's OAuth token endpoint, adding the client and any secret. It forwards standard
+ * OAuth form posts to WorkOS.
  */
 export declare function token(auth: Auth, body: Record<string, string>): Promise<TokenResponse>;
 /** Reads the account's address, the type of its owner, which the API lists first, and its realm. */

package/dist/internal/api.js

@@ -58,8 +58,8 @@ export function post(auth, path, options) {
     });
 }
 /**
- * Calls Tempo Auth's OAuth token endpoint, adding the client, any secret, and any resource. It
- * forwards standard OAuth form posts to WorkOS, which binds the audience here, on every request.
+ * Calls Tempo Auth's OAuth token endpoint, adding the client and any secret. It forwards standard
+ * OAuth form posts to WorkOS.
  */
 export async function token(auth, body) {
     return json(await (auth.fetch ?? fetch)(new URL('/oauth2/token', auth.url), {
@@ -67,7 +67,6 @@ export async function token(auth, body) {
             ...body,
             client_id: auth.clientId,
             ...(auth.clientSecret ? { client_secret: auth.clientSecret } : {}),
-            ...(auth.resource === undefined ? {} : { resource: auth.resource }),
         }),
         method: 'POST',
     }));

package/dist/internal/link.d.ts

@@ -1,6 +1,8 @@
 import type { Auth } from '../Auth.ts';
 import type * as Key from '../Key.ts';
 import * as AccessKey from './accessKey.ts';
+/** The `link` a key waits under after an account step, which names no link of its own. */
+export declare const account = "account";
 /**
  * Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. Only the
  * link's digest is stored, since the link links the passkey for whoever sends it with a code.

package/dist/internal/link.js

@@ -1,12 +1,15 @@
 /**
  * Keeps a new key that a one-tap passkey sign-in signed, until the emailed-code sign-in that sends
- * its email step's `link` returns the key's authorization.
+ * its email step's `link`, or the `Actions.authorize` after its account step, returns the key's
+ * authorization.
  * @module
  */
 import { Bytes, Hash } from 'ox';
 import * as AccessKey from './accessKey.js';
 import * as Store from './store.js';
-/** Where the key waits in `storage`. A later email step replaces it. */
+/** The `link` a key waits under after an account step, which names no link of its own. */
+export const account = 'account';
+/** Where the key waits in `storage`. A later email or account step replaces it. */
 const storageKey = 'tempo-auth:passkey-link';
 /**
  * Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. Only the

package/dist/internal/request.d.ts

@@ -29,6 +29,5 @@ export declare function request(auth: Auth, options: {
         scopes: readonly Account.z_KeyAuthorization.Scope<`0x${string}`>[] | undefined;
     };
     redirect_uri: string;
-    resource?: string;
     scope: string;
 };

package/dist/internal/request.js

@@ -29,7 +29,6 @@ export function request(auth, options) {
             scopes: permissions.scopes,
         },
         redirect_uri: auth.redirectUri ?? `${globalThis.location?.origin ?? auth.url}/`,
-        ...(auth.resource === undefined ? {} : { resource: auth.resource }),
         scope: auth.scope,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-102.sha-c8a03d9",
+  "version": "0.0.0-pr-104.sha-7e92695",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {