@tempoxyz/auth 0.0.0-pr-47.sha-e4eead6 → 0.0.0-pr-44.sha-110ca2b

package/README.md

@@ -241,6 +241,8 @@ try {
 | `storage`      | Where `redirect.start` keeps its state, without serializing it. Defaults to IndexedDB           |
 | `fetch`        | Calls Tempo Auth. Defaults to the global `fetch`                                                |
 
+The actions call version 1 of Tempo Auth's JSON API, under `/v1`. [API versions](../../docs/versioning.md) describes versions and the deprecation policy.
+
 ### `Actions`
 
 Each sign-in flow has its own namespace. The actions every flow shares sit at the top level. Every action that creates a key also takes optional `accessKey` and `permissions`.

package/dist/Actions.js

@@ -19,13 +19,13 @@ export * as tempoAccount from './actions/tempoAccount.js';
  */
 export async function authorize(auth, options = {}) {
     // Checking the session first answers a visitor without one with no failed request.
-    const session = await Api.json(await (auth.fetch ?? fetch)(new URL('/api/auth/session', auth.url), {
+    const session = await Api.json(await (auth.fetch ?? fetch)(new URL(`${Api.prefix}/auth/session`, auth.url), {
         credentials: 'include',
     }));
     if (!session.user)
         return undefined;
     const key = await AccessKey.resolve(options.accessKey);
-    const response = await Api.post(auth, '/api/authorize', {
+    const response = await Api.post(auth, `${Api.prefix}/authorize`, {
         json: request(auth, {
             accessKey: key.accessKey,
             permissions: options.permissions,
@@ -61,5 +61,5 @@ export async function refresh(auth, options) {
  */
 export async function signOut(auth) {
     // A JSON body keeps the request out of Tempo Auth's CSRF check for cross-site form posts.
-    await Api.json(await Api.post(auth, '/api/auth/logout', { json: {} }));
+    await Api.json(await Api.post(auth, `${Api.prefix}/auth/logout`, { json: {} }));
 }

package/dist/actions/device.js

@@ -15,7 +15,7 @@ import { request } from '../internal/request.js';
  */
 export async function authorize(auth, options) {
     const key = await AccessKey.resolve(options.accessKey);
-    const code = await Api.json(await Api.post(auth, '/api/device/authorize', {
+    const code = await Api.json(await Api.post(auth, `${Api.prefix}/device/authorize`, {
         json: {
             device: options.device,
             keyAuthorization: request(auth, {
@@ -30,7 +30,7 @@ export async function authorize(auth, options) {
         const deadline = Date.now() + code.expires_in * 1000;
         while (Date.now() < deadline) {
             await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-            const response = await Api.post(auth, '/api/device/token', {
+            const response = await Api.post(auth, `${Api.prefix}/device/token`, {
                 json: { device_code: code.device_code },
             });
             const body = (await response.json());

package/dist/actions/email.js

@@ -10,7 +10,7 @@ import { request } from '../internal/request.js';
  * ```
  */
 export async function sendCode(auth, options) {
-    await Api.json(await Api.post(auth, '/api/auth/code', { json: options }));
+    await Api.json(await Api.post(auth, `${Api.prefix}/auth/code`, { json: options }));
 }
 /**
  * Signs the user in with the code they were emailed, and authorizes the app in the same call.
@@ -25,7 +25,7 @@ export async function sendCode(auth, options) {
 export async function signIn(auth, options) {
     const { code, email, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
-    const body = await Api.json(await Api.post(auth, '/api/auth/code/verify', {
+    const body = await Api.json(await Api.post(auth, `${Api.prefix}/auth/code/verify`, {
         json: {
             authorize: request(auth, { accessKey: key.accessKey, permissions }),
             code,

package/dist/actions/provider.js

@@ -9,7 +9,7 @@ import * as Api from '../internal/api.js';
  * ```
  */
 export async function list(auth) {
-    const { providers } = await Api.json(await (auth.fetch ?? fetch)(new URL('/api/auth/providers', auth.url)));
+    const { providers } = await Api.json(await (auth.fetch ?? fetch)(new URL(`${Api.prefix}/auth/providers`, auth.url)));
     return providers;
 }
 /**
@@ -25,7 +25,7 @@ export async function list(auth) {
 export function signIn(auth, options) {
     const url = 'url' in options
         ? new URL(options.url)
-        : new URL(`/api/auth/oauth/${options.provider}`, auth.url);
+        : new URL(`${Api.prefix}/auth/oauth/${options.provider}`, auth.url);
     url.searchParams.set('return_to', options.returnTo ?? window.location.href);
     window.location.assign(url);
 }

package/dist/actions/redirect.js

@@ -99,6 +99,14 @@ export async function createUrl(auth, options = {}) {
 export async function handleCallback(auth, options) {
     const { redirectUri, state, verifier, ...material } = options.pending;
     const params = new URL(options.url).searchParams;
+    // State comes first, so a forged link cannot supply the error an app shows.
+    if (params.get('state') !== state)
+        throw new RequestError({
+            code: 'invalid_request',
+            field: 'state',
+            message: 'Invalid `state` in the callback URL. Start sign-in again from this app.',
+            status: 400,
+        });
     const code = params.get('code');
     if (!code)
         throw new RequestError({
@@ -108,13 +116,6 @@ export async function handleCallback(auth, options) {
                 'Missing `code` in the callback URL. Start sign-in again.',
             status: 400,
         });
-    if (params.get('state') !== state)
-        throw new RequestError({
-            code: 'invalid_request',
-            field: 'state',
-            message: 'Invalid `state` in the callback URL. Start sign-in again from this app.',
-            status: 400,
-        });
     const body = await Api.token(auth, {
         code,
         code_verifier: verifier,

package/dist/actions/tempoAccount.js

@@ -12,7 +12,7 @@ import * as Api from '../internal/api.js';
  * ```
  */
 export async function create(auth) {
-    const { address } = await Api.json(await Api.post(auth, '/api/account/tempo', { json: {} }));
+    const { address } = await Api.json(await Api.post(auth, `${Api.prefix}/account/tempo`, { json: {} }));
     return { address };
 }
 /**
@@ -24,7 +24,7 @@ export async function create(auth) {
  * ```
  */
 export async function list(auth) {
-    const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL('/api/account', auth.url), {
+    const { tempo } = await Api.json(await (auth.fetch ?? fetch)(new URL(`${Api.prefix}/account`, auth.url), {
         credentials: 'include',
     }));
     return tempo.map(({ address }) => ({ address }));

package/dist/internal/api.d.ts

@@ -37,6 +37,11 @@ export declare function error(body: Partial<ErrorBody>, options: {
 export declare function post(auth: Auth, path: string, options: {
     json?: unknown;
 }): Promise<Response>;
+/**
+ * The path prefix of the Tempo Auth API version the package calls. Every JSON route starts with it,
+ * and the OAuth endpoints under `/oauth2` do not.
+ */
+export declare const prefix = "/v1";
 /**
  * Calls Tempo Auth's OAuth token endpoint, adding the client and any secret. It forwards standard
  * OAuth form posts to WorkOS.

package/dist/internal/api.js

@@ -60,6 +60,11 @@ export function post(auth, path, options) {
         method: 'POST',
     });
 }
+/**
+ * The path prefix of the Tempo Auth API version the package calls. Every JSON route starts with it,
+ * and the OAuth endpoints under `/oauth2` do not.
+ */
+export const prefix = '/v1';
 /**
  * Calls Tempo Auth's OAuth token endpoint, adding the client and any secret. It forwards standard
  * OAuth form posts to WorkOS.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-47.sha-e4eead6",
+  "version": "0.0.0-pr-44.sha-110ca2b",
   "description": "Signs users in to Tempo through Tempo Auth, and returns viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {