@tempoxyz/auth 0.0.0-pr-15.sha-cf4e7ec → 0.0.0-pr-16.sha-bc51738

package/README.md

@@ -52,12 +52,13 @@ The CLI device grant needs neither. It signs in as Tempo Auth's own `tempo-cli`
 
 Each sign-in creates a key for the app and asks Tempo Auth to authorize it on the user's Tempo Account. The `accessKey` option says what the key may do, with viem's `Expiry` and `Scopes` helpers:
 
-| Field     | Meaning                                                                       |
-| --------- | ----------------------------------------------------------------------------- |
-| `chainId` | The chain the key acts on, such as `tempoTestnet.id`                          |
-| `expiry`  | When the key expires, in Unix seconds, such as `Expiry.days(1)`               |
-| `limits`  | One-time spending limits per token, such as `[{ limit: 10_000_000n, token }]` |
-| `scopes`  | The calls the key may make, such as `[Scopes.tip20(token).transfer()]`        |
+| Field     | Meaning                                                                                      |
+| --------- | -------------------------------------------------------------------------------------------- |
+| `account` | Optional: which of the user's Tempo Accounts, from `getTempoAccounts`. Defaults to the first |
+| `chainId` | The chain the key acts on, such as `tempoTestnet.id`                                         |
+| `expiry`  | When the key expires, in Unix seconds, such as `Expiry.days(1)`                              |
+| `limits`  | One-time spending limits per token, such as `[{ limit: 10_000_000n, token }]`                |
+| `scopes`  | The calls the key may make, such as `[Scopes.tip20(token).transfer()]`                       |
 
 Flows without a Tempo Auth page (`authorize`, `verifyCode`) must stay within Tempo Auth's ceiling, about $1,000 per token. Flows with a page (`redirect`, `createAuthorizationUrl`, `authorizeDevice`) show the limits to the user, who approves them, so they may go beyond it.
 
@@ -168,6 +169,19 @@ console.log(
 const authorization = await device.wait()
 ```
 
+## More Tempo Accounts
+
+A user starts with one Tempo Account and can have more. Add one, then name it in an access key's `account`:
+
+```ts
+const tempoAccount = await Actions.createTempoAccount(auth)
+const accounts = await Actions.getTempoAccounts(auth) // the default first
+
+await Actions.authorize(auth, {
+  accessKey: { ...accessKey, account: tempoAccount.address },
+})
+```
+
 ## Keep a sign-in
 
 `Authorization.key` is the app's key as JSON: the Tempo Account, the signed authorization, and the private key. Store it with the tokens, as securely as a session, and rebuild the account later with `Key.toAccount`.
@@ -219,7 +233,9 @@ try {
 | `authorize(auth, { accessKey })`                           | An `Authorization` for a user already signed in, or `undefined`            |
 | `authorizeDevice(auth, { accessKey, device })`             | The code to show and a `wait()` that resolves with an `Authorization`      |
 | `createAuthorizationUrl(auth, { accessKey, redirectUri })` | The `url` to send the browser to, and the `pending` state to keep          |
+| `createTempoAccount(auth)`                                 | Another Tempo Account for the signed-in user                               |
 | `getProviders(auth)`                                       | The OAuth providers Tempo Auth offers, as `{ id, name }`                   |
+| `getTempoAccounts(auth)`                                   | The signed-in user's Tempo Accounts, the default first                     |
 | `handleCallback(auth, { pending, url })`                   | The `Authorization` for a redirect's callback                              |
 | `handleRedirect(auth)`                                     | The `Authorization` when the page is a redirect's callback, or `undefined` |
 | `redirect(auth, { accessKey })`                            | Nothing. The browser leaves for Tempo Auth's pages                         |

package/dist/Actions.d.ts

@@ -1,4 +1,4 @@
-import { type AccessKey, type Auth, type Authorization, type Pending, type Provider, type Step, type Tokens } from './Auth.ts';
+import { type AccessKey, type Auth, type Authorization, type Pending, type Provider, type Step, type TempoAccount, type Tokens } from './Auth.ts';
 /**
  * Authorizes the app for a user already signed in to Tempo Auth, from any app. Returns
  * `undefined` without a session, so the app shows sign-in. The key must fit Tempo Auth's headless
@@ -81,6 +81,23 @@ export declare namespace createAuthorizationUrl {
         url: string;
     };
 }
+/**
+ * Creates another Tempo Account for the signed-in user, and returns it. Pass its `address` as an
+ * access key's `account` to authorize keys on it.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = await Actions.createTempoAccount(auth)
+ * await Actions.authorize(auth, {
+ *   accessKey: { ...accessKey, account: tempoAccount.address },
+ * })
+ * ```
+ */
+export declare function createTempoAccount(auth: Auth): Promise<createTempoAccount.ReturnType>;
+export declare namespace createTempoAccount {
+    /** The new account. */
+    type ReturnType = TempoAccount;
+}
 /**
  * Lists the OAuth providers Tempo Auth offers, for an app that shows its own sign-in buttons.
  *
@@ -99,6 +116,19 @@ export declare namespace getProviders {
         name: string;
     }[];
 }
+/**
+ * Lists the signed-in user's Tempo Accounts, their default first.
+ *
+ * @example
+ * ```ts
+ * const [account, ...others] = await Actions.getTempoAccounts(auth)
+ * ```
+ */
+export declare function getTempoAccounts(auth: Auth): Promise<getTempoAccounts.ReturnType>;
+export declare namespace getTempoAccounts {
+    /** The user's accounts, their default first. */
+    type ReturnType = readonly TempoAccount[];
+}
 /**
  * Finishes a sign-in redirect: checks its state, redeems the code with the PKCE verifier (and the
  * client secret, for a backend), and reads the key authorization from the callback URL.

package/dist/Actions.js

@@ -127,6 +127,22 @@ export async function createAuthorizationUrl(auth, options) {
     }).toString();
     return { pending, url: url.href };
 }
+/**
+ * Creates another Tempo Account for the signed-in user, and returns it. Pass its `address` as an
+ * access key's `account` to authorize keys on it.
+ *
+ * @example
+ * ```ts
+ * const tempoAccount = await Actions.createTempoAccount(auth)
+ * await Actions.authorize(auth, {
+ *   accessKey: { ...accessKey, account: tempoAccount.address },
+ * })
+ * ```
+ */
+export async function createTempoAccount(auth) {
+    const { address } = await json(await post(auth, '/api/account/tempo', { json: {} }));
+    return { address };
+}
 /**
  * Lists the OAuth providers Tempo Auth offers, for an app that shows its own sign-in buttons.
  *
@@ -140,6 +156,20 @@ export async function getProviders(auth) {
     const { providers } = await json(await (auth.fetch ?? fetch)(new URL('/api/auth/providers', auth.url)));
     return providers;
 }
+/**
+ * Lists the signed-in user's Tempo Accounts, their default first.
+ *
+ * @example
+ * ```ts
+ * const [account, ...others] = await Actions.getTempoAccounts(auth)
+ * ```
+ */
+export async function getTempoAccounts(auth) {
+    const { tempo } = await json(await (auth.fetch ?? fetch)(new URL('/api/account', auth.url), {
+        credentials: 'include',
+    }));
+    return tempo.map(({ address }) => ({ address }));
+}
 /**
  * Finishes a sign-in redirect: checks its state, redeems the code with the PKCE verifier (and the
  * client secret, for a backend), and reads the key authorization from the callback URL.

package/dist/Auth.d.ts

@@ -44,11 +44,18 @@ export type Auth = {
 };
 /** What an app's access key may do, as viem's `accessKey.signAuthorization` takes it. */
 export type AccessKey = Pick<KeyAuthorization.KeyAuthorization, 'limits' | 'scopes'> & {
+    /** The user's Tempo Account the key acts for, from `getTempoAccounts`. Defaults to their first. */
+    account?: `0x${string}` | undefined;
     /** The chain the key acts on, such as `tempoTestnet.id`. */
     chainId: number;
     /** Unix seconds. viem's `Expiry` builds one, such as `Expiry.days(1)`. */
     expiry: number;
 };
+/** One of the user's Tempo Accounts. */
+export type TempoAccount = {
+    /** The account's address, the same on every Tempo chain. */
+    address: `0x${string}`;
+};
 /** What every sign-in returns. */
 export type Authorization = {
     /** The app's access key, as a viem account acting for the user's Tempo Account. */

package/dist/internal/request.d.ts

@@ -13,6 +13,7 @@ export declare function request(auth: Auth, options: {
 }): {
     client_id: string;
     keyAuthorization: {
+        account?: `0x${string}`;
         address: `0x${string}`;
         chainId: `0x${string}`;
         expiry: number;

package/dist/internal/request.js

@@ -11,6 +11,7 @@ export function request(auth, options) {
     return {
         client_id: auth.clientId,
         keyAuthorization: {
+            ...(accessKey.account ? { account: accessKey.account } : {}),
             address: Account.fromSecp256k1(privateKey).address,
             chainId: Hex.fromNumber(accessKey.chainId),
             expiry: accessKey.expiry,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-15.sha-cf4e7ec",
+  "version": "0.0.0-pr-16.sha-bc51738",
   "description": "Signs users in to Tempo through Tempo Auth, and returns viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {