@tempoxyz/auth 0.0.0-pr-66.sha-278d6ea → 0.0.0-pr-66.sha-8d0e9ba

package/dist/Decorator.d.ts

@@ -38,7 +38,8 @@ export declare class ChainRequiredError extends Error {
 /**
  * Returns a Viem client extension that adds Tempo Auth's actions as `client.auth`. Each member calls
  * the action of the same name in `Actions` with one instance, whose `chainId` is the client's chain.
- * Each sign-in sets the client's account to the authorization's, and `signOut` empties it. Throws
+ * Each sign-in sets the client's account to the authorization's, unless another sign-in or a
+ * sign-out completed after it began, and `signOut` empties it at once. Throws
  * {@link ChainRequiredError} for a client without a chain, and {@link AccountRequiredError} for one
  * whose account is not an `Auth.account()`.
  *
@@ -63,7 +64,7 @@ export declare namespace tempoAuth {
         auth: {
             /**
              * `Actions.authorize`, which sets the client's account, or empties it when the user has no
-             * session. A sign-in or sign-out that completes first keeps its account.
+             * session.
              */
             authorize: <const id extends number = chainId>(options?: Actions.authorize.Options<id>) => Promise<Actions.authorize.ReturnType<id>>;
             device: {
@@ -114,7 +115,10 @@ export declare namespace tempoAuth {
                 /** The stored key, with or without its `chainId`. */
                 key: Key.from.Value<id>;
             }, options?: Key.toAccount.Options) => Authorization<id>;
-            /** `Actions.signOut`, which empties the client's account, even when the request fails. */
+            /**
+             * `Actions.signOut`, which empties the client's account before the request, even when it
+             * fails, and discards any sign-in still pending.
+             */
             signOut: () => Promise<void>;
             tempoAccount: {
                 /** `Actions.tempoAccount.create`. */

package/dist/Decorator.js

@@ -19,7 +19,8 @@ export class ChainRequiredError extends Error {
 /**
  * Returns a Viem client extension that adds Tempo Auth's actions as `client.auth`. Each member calls
  * the action of the same name in `Actions` with one instance, whose `chainId` is the client's chain.
- * Each sign-in sets the client's account to the authorization's, and `signOut` empties it. Throws
+ * Each sign-in sets the client's account to the authorization's, unless another sign-in or a
+ * sign-out completed after it began, and `signOut` empties it at once. Throws
  * {@link ChainRequiredError} for a client without a chain, and {@link AccountRequiredError} for one
  * whose account is not an `Auth.account()`.
  *
@@ -39,41 +40,53 @@ export function tempoAuth(options) {
         if (!state)
             throw new AccountRequiredError();
         const auth = Auth.create({ ...options, chainId: client.chain.id });
-        // Counts changes to the client's account, so a session check that a sign-in or sign-out
-        // overtook leaves the newer account in place.
+        // Counts changes to the client's account. Each sign-in applies its result only when no other
+        // sign-in or sign-out completed after it began, so a stale result never replaces a newer one,
+        // and a sign-in still pending at sign-out never signs the client back in.
         let version = 0;
-        /** Sets the client's account to the authorization's, and returns the authorization. */
-        const set = (authorization) => {
-            if (authorization) {
-                state.account = authorization.account;
+        /**
+         * Begins an operation that changes the client's account, and returns the function that applies
+         * its result: the account to sign with, or `undefined` to stop signing.
+         */
+        const begin = () => {
+            const started = version;
+            return (account) => {
+                if (version !== started)
+                    return;
+                state.account = account;
                 version++;
-            }
-            return authorization;
+            };
         };
         return {
             auth: {
                 async authorize(options = {}) {
-                    const started = version;
+                    const apply = begin();
                     const authorization = await Actions.authorize(auth, options);
-                    if (version !== started)
-                        return authorization;
                     // Without a session, the client stops signing as the user it last authorized.
-                    if (!authorization)
-                        state.account = undefined;
-                    return set(authorization);
+                    apply(authorization?.account);
+                    return authorization;
                 },
                 device: {
                     async authorize(options = {}) {
+                        const apply = begin();
                         const device = await Actions.device.authorize(auth, options);
-                        return { ...device, wait: async () => set(await device.wait()) };
+                        return {
+                            ...device,
+                            async wait() {
+                                const authorization = await device.wait();
+                                apply(authorization.account);
+                                return authorization;
+                            },
+                        };
                     },
                 },
                 email: {
                     sendCode: (options) => Actions.email.sendCode(auth, options),
                     async signIn(options) {
+                        const apply = begin();
                         const result = await Actions.email.signIn(auth, options);
                         if (!('step' in result))
-                            set(result);
+                            apply(result.account);
                         return result;
                     },
                 },
@@ -88,30 +101,37 @@ export function tempoAuth(options) {
                     signIn: (options) => Actions.provider.signIn(auth, options),
                 },
                 redirect: {
-                    complete: async (options = {}) => set(await Actions.redirect.complete(auth, options)),
+                    async complete(options = {}) {
+                        const apply = begin();
+                        const authorization = await Actions.redirect.complete(auth, options);
+                        // `undefined` means the page is not a callback, which says nothing about the session.
+                        if (authorization)
+                            apply(authorization.account);
+                        return authorization;
+                    },
                     createUrl: (options = {}) => Actions.redirect.createUrl(auth, options),
-                    handleCallback: async (options) => set(await Actions.redirect.handleCallback(auth, options)),
+                    async handleCallback(options) {
+                        const apply = begin();
+                        const authorization = await Actions.redirect.handleCallback(auth, options);
+                        apply(authorization.account);
+                        return authorization;
+                    },
                     start: (options = {}) => Actions.redirect.start(auth, options),
                 },
                 refresh: (options) => Actions.refresh(auth, options),
                 restore: (authorization, options = {}) => {
                     // A sign-in stored before `Key.chainId` existed gains it here.
                     const key = Key.from(authorization.key);
-                    return set({
-                        ...authorization,
-                        account: Key.toAccount(key, options),
-                        key,
-                    });
+                    const account = Key.toAccount(key, options);
+                    begin()(account);
+                    return { ...authorization, account, key };
                 },
                 async signOut() {
-                    // The client stops signing even when the request fails, since the user asked to leave.
-                    try {
-                        await Actions.signOut(auth);
-                    }
-                    finally {
-                        state.account = undefined;
-                        version++;
-                    }
+                    // The client stops signing at once, even when the request fails, and any sign-in still
+                    // pending is discarded, since the user asked to leave.
+                    state.account = undefined;
+                    version++;
+                    await Actions.signOut(auth);
                 },
                 tempoAccount: {
                     create: () => Actions.tempoAccount.create(auth),

package/dist/actions/oauth.d.ts

@@ -53,7 +53,9 @@ export declare namespace introspect {
  * import { createLocalJWKSet, jwtVerify } from 'jose'
  *
  * const keys = createLocalJWKSet(await Actions.oauth.jwks(auth))
- * const { payload } = await jwtVerify(accessToken, keys, { issuer })
+ * const { payload } = await jwtVerify(accessToken, keys, { audience, issuer })
+ * // Every app's token carries the same audience, so an API also allows each app by `client_id`.
+ * if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
  * ```
  */
 export declare function jwks(auth: Auth): Promise<jwks.ReturnType>;

package/dist/actions/oauth.js

@@ -43,7 +43,9 @@ export async function introspect(auth, options) {
  * import { createLocalJWKSet, jwtVerify } from 'jose'
  *
  * const keys = createLocalJWKSet(await Actions.oauth.jwks(auth))
- * const { payload } = await jwtVerify(accessToken, keys, { issuer })
+ * const { payload } = await jwtVerify(accessToken, keys, { audience, issuer })
+ * // Every app's token carries the same audience, so an API also allows each app by `client_id`.
+ * if (!allowedClientIds.includes(String(payload.client_id))) throw forbidden()
  * ```
  */
 export async function jwks(auth) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-66.sha-278d6ea",
+  "version": "0.0.0-pr-66.sha-8d0e9ba",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {