@tempoxyz/auth 0.0.0-pr-69.sha-9e4a67c → 0.0.0-pr-71.sha-7895262

package/dist/Actions.d.ts

@@ -12,6 +12,7 @@ import type { Tokens } from './Tokens.ts';
 export * as device from './actions/device.ts';
 export * as email from './actions/email.ts';
 export * as oauth from './actions/oauth.ts';
+export * as passkey from './actions/passkey.ts';
 export * as provider from './actions/provider.ts';
 export * as redirect from './actions/redirect.ts';
 export * as tempoAccount from './actions/tempoAccount.ts';

package/dist/Actions.js

@@ -4,6 +4,7 @@ import { request } from './internal/request.js';
 export * as device from './actions/device.js';
 export * as email from './actions/email.js';
 export * as oauth from './actions/oauth.js';
+export * as passkey from './actions/passkey.js';
 export * as provider from './actions/provider.js';
 export * as redirect from './actions/redirect.js';
 export * as tempoAccount from './actions/tempoAccount.js';

package/dist/Decorator.d.ts

@@ -82,7 +82,10 @@ export declare namespace tempoAuth {
             email: {
                 /** `Actions.email.sendCode`. */
                 sendCode: (options: Actions.email.sendCode.Options) => Promise<void>;
-                /** `Actions.email.signIn`, which sets the client's account unless it returns a step. */
+                /**
+                 * `Actions.email.signIn`, which sets the client's account unless it returns a step. A step
+                 * that another sign-in or a sign-out overtook throws {@link SupersededError}.
+                 */
                 signIn: <const id extends number = chainId>(options: Actions.email.signIn.Options<id>) => Promise<Actions.email.signIn.ReturnType<id>>;
             };
             /** The instance the members call `Actions` with. */
@@ -95,6 +98,13 @@ export declare namespace tempoAuth {
                 /** `Actions.oauth.userInfo`. */
                 userInfo: (options: Actions.oauth.userInfo.Options) => Promise<User>;
             };
+            passkey: {
+                /**
+                 * `Actions.passkey.signIn`, which sets the client's account unless it returns a step. A step
+                 * that another sign-in or a sign-out overtook throws {@link SupersededError}.
+                 */
+                signIn: <const id extends number = chainId>(options?: Actions.passkey.signIn.Options<id>) => Promise<Actions.passkey.signIn.ReturnType<id>>;
+            };
             provider: {
                 /** `Actions.provider.list`. */
                 list: () => Promise<Actions.provider.list.ReturnType>;

package/dist/Decorator.js

@@ -54,42 +54,66 @@ export function tempoAuth(options) {
         // sign-in or sign-out completed after it began, so a stale result never replaces a newer one,
         // and a sign-in still pending at sign-out never signs the client back in.
         let version = 0;
+        // The version the latest sign-out produced, while no change has followed it.
+        let signedOut;
         /**
-         * Begins an operation that changes the client's account, and returns the function that applies
-         * its result: the account to sign with, or `undefined` to stop signing. Applying an account that
-         * a newer change overtook throws {@link SupersededError}, so the caller never holds an
-         * authorization the client does not sign with.
+         * Begins an operation that changes the client's account. `apply` applies its result: the
+         * account to sign with, or `undefined` to stop signing. `check` accepts a result that changes
+         * no account, such as a step. Applying an account, or checking a step, that a newer change
+         * overtook throws {@link SupersededError}, so the caller never holds a result the client's
+         * newer state contradicts. `fail` rethrows the operation's error, or throws `SupersededError`
+         * when a newer change overtook it, so the caller never acts on a stale refusal. A sign-in
+         * refused after its code or passkey verified already set a server session, which `fail` ends.
          */
         const begin = () => {
             const started = version;
-            return (account) => {
-                if (version !== started) {
-                    if (account)
-                        throw new SupersededError();
-                    return;
-                }
-                state.account = account;
-                version++;
+            // A sign-in that finishes after sign-out may have set a new server session, so it ends that
+            // session again, unless a newer change already followed the sign-out.
+            const superseded = async () => {
+                if (signedOut === version)
+                    await Actions.signOut(auth);
+                return new SupersededError();
+            };
+            return {
+                async apply(account) {
+                    if (version !== started) {
+                        if (account)
+                            throw await superseded();
+                        return;
+                    }
+                    state.account = account;
+                    version++;
+                },
+                async check() {
+                    if (version !== started)
+                        throw await superseded();
+                },
+                // An arrow function, which `catch` takes unbound.
+                fail: async (error) => {
+                    if (version !== started)
+                        throw await superseded();
+                    throw error;
+                },
             };
         };
         return {
             auth: {
                 async authorize(options = {}) {
-                    const apply = begin();
+                    const change = begin();
                     const authorization = await Actions.authorize(auth, options);
                     // Without a session, the client stops signing as the user it last authorized.
-                    apply(authorization?.account);
+                    await change.apply(authorization?.account);
                     return authorization;
                 },
                 device: {
                     async authorize(options = {}) {
-                        const apply = begin();
+                        const change = begin();
                         const device = await Actions.device.authorize(auth, options);
                         return {
                             ...device,
                             async wait() {
                                 const authorization = await device.wait();
-                                apply(authorization.account);
+                                await change.apply(authorization.account);
                                 return authorization;
                             },
                         };
@@ -98,10 +122,14 @@ export function tempoAuth(options) {
                 email: {
                     sendCode: (options) => Actions.email.sendCode(auth, options),
                     async signIn(options) {
-                        const apply = begin();
-                        const result = await Actions.email.signIn(auth, options);
-                        if (!('step' in result))
-                            apply(result.account);
+                        const change = begin();
+                        const result = await Actions.email
+                            .signIn(auth, options)
+                            .catch(change.fail);
+                        if ('step' in result)
+                            await change.check();
+                        else
+                            await change.apply(result.account);
                         return result;
                     },
                 },
@@ -111,24 +139,37 @@ export function tempoAuth(options) {
                     jwks: () => Actions.oauth.jwks(auth),
                     userInfo: (options) => Actions.oauth.userInfo(auth, options),
                 },
+                passkey: {
+                    async signIn(options = {}) {
+                        const change = begin();
+                        const result = await Actions.passkey
+                            .signIn(auth, options)
+                            .catch(change.fail);
+                        if ('step' in result)
+                            await change.check();
+                        else
+                            await change.apply(result.account);
+                        return result;
+                    },
+                },
                 provider: {
                     list: () => Actions.provider.list(auth),
                     signIn: (options) => Actions.provider.signIn(auth, options),
                 },
                 redirect: {
                     async complete(options = {}) {
-                        const apply = begin();
+                        const change = begin();
                         const authorization = await Actions.redirect.complete(auth, options);
                         // `undefined` means the page is not a callback, which says nothing about the session.
                         if (authorization)
-                            apply(authorization.account);
+                            await change.apply(authorization.account);
                         return authorization;
                     },
                     createUrl: (options = {}) => Actions.redirect.createUrl(auth, options),
                     async handleCallback(options) {
-                        const apply = begin();
+                        const change = begin();
                         const authorization = await Actions.redirect.handleCallback(auth, options);
-                        apply(authorization.account);
+                        await change.apply(authorization.account);
                         return authorization;
                     },
                     start: (options = {}) => Actions.redirect.start(auth, options),
@@ -138,7 +179,8 @@ export function tempoAuth(options) {
                     // A sign-in stored before `Key.chainId` existed gains it here.
                     const key = Key.from(authorization.key);
                     const account = Key.toAccount(key, options);
-                    begin()(account);
+                    state.account = account;
+                    version++;
                     return { ...authorization, account, key };
                 },
                 async signOut() {
@@ -146,6 +188,7 @@ export function tempoAuth(options) {
                     // pending is discarded, since the user asked to leave.
                     state.account = undefined;
                     version++;
+                    signedOut = version;
                     await Actions.signOut(auth);
                 },
                 tempoAccount: {

package/dist/actions/email.d.ts

@@ -44,6 +44,11 @@ export declare namespace signIn {
         code: string;
         /** The address the code was sent to. */
         email: string;
+        /**
+         * The `link` from `Actions.passkey.signIn`'s email step, which links that wallet.tempo passkey
+         * to the user.
+         */
+        link?: string | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };

package/dist/actions/email.js

@@ -23,13 +23,14 @@ export async function sendCode(auth, options) {
  * ```
  */
 export async function signIn(auth, options) {
-    const { code, email, permissions } = options;
+    const { code, email, link, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
     const body = await Api.json(await Api.post(auth, '/v1/auth/code/verify', {
         json: {
             authorize: request(auth, { accessKey: key.accessKey, permissions }),
             code,
             email,
+            ...(link ? { link } : {}),
         },
     }));
     if ('step' in body)

package/dist/actions/passkey.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Signs the user in with a passkey from the app's own sign-in form. The browser offers every passkey
+ * it holds for Tempo's domain, so the app needs no email first.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import type { Account } from 'viem/tempo';
+import type { Auth } from '../Auth.ts';
+import type { Authorization } from '../Authorization.ts';
+import type { Permissions } from '../Permissions.ts';
+/**
+ * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
+ * for a wallet.tempo passkey whose account has no email: the app signs the user in with
+ * `Actions.email.signIn`, passing the step's `link`, which links the passkey. Throws a `RequestError` with reason
+ * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
+ * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
+ * the user is already signed in.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.passkey.signIn(auth)
+ * if ('step' in result) showEmailForm()
+ * ```
+ */
+export declare function signIn<const chainId extends number = number>(auth: Auth, options?: signIn.Options<chainId>): Promise<signIn.ReturnType<chainId>>;
+export declare namespace signIn {
+    type Options<chainId extends number = number> = {
+        /**
+         * The key to authorize, as a Viem account. Its `access` names the Tempo Account, which
+         * defaults to the user's first. Defaults to a new key.
+         */
+        accessKey?: Account.Account | undefined;
+        /**
+         * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, such as a native passkey
+         * module. Its assertion must report a web origin on the relying party's domain that the app
+         * registered, so an Android app's facet origin is refused. A native app's session stays in its
+         * own `fetch`, so after `webauthn_required` it authorizes the key through
+         * `Actions.redirect.createUrl` in the system browser, where the user signs in again.
+         */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
+        /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
+        permissions?: Permissions<chainId> | undefined;
+    };
+    /** The step a wallet.tempo passkey without an email needs: an emailed code, which links it. */
+    type EmailStep = {
+        /** Passed as `link` to `Actions.email.signIn`, which links the passkey to that user. */
+        link: string;
+        /** The kind of step. */
+        type: 'email';
+    };
+    /** The authorization, or the email step. */
+    type ReturnType<chainId extends number = number> = Authorization<chainId> | {
+        step: EmailStep;
+    };
+}

package/dist/actions/passkey.js

@@ -0,0 +1,41 @@
+/**
+ * Signs the user in with a passkey from the app's own sign-in form. The browser offers every passkey
+ * it holds for Tempo's domain, so the app needs no email first.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
+import * as AccessKey from '../internal/accessKey.js';
+import * as Api from '../internal/api.js';
+import { request } from '../internal/request.js';
+/**
+ * Signs the user in with a passkey, and authorizes the app in the same call. Returns the email step
+ * for a wallet.tempo passkey whose account has no email: the app signs the user in with
+ * `Actions.email.signIn`, passing the step's `link`, which links the passkey. Throws a `RequestError` with reason
+ * `webauthn_required` when a passkey owns the Tempo Account the key acts for, since a passkey signs a
+ * key authorization only on Tempo Auth's pages. `Actions.redirect.start` authorizes it there, where
+ * the user is already signed in.
+ *
+ * @example
+ * ```ts
+ * const result = await Actions.passkey.signIn(auth)
+ * if ('step' in result) showEmailForm()
+ * ```
+ */
+export async function signIn(auth, options = {}) {
+    const { getFn, permissions } = options;
+    const key = await AccessKey.resolve(options.accessKey);
+    const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', { json: {} }));
+    const deserialized = Authentication.deserializeOptions(requested.options);
+    const assertion = Authentication.serializeResponse(await Authentication.sign(
+    // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+    getFn ? { ...deserialized, getFn } : deserialized));
+    const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', {
+        json: {
+            assertion,
+            authorize: request(auth, { accessKey: key.accessKey, permissions }),
+        },
+    }));
+    if ('step' in body)
+        return { step: body.step };
+    return Api.authorization(body.authorization, key);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-69.sha-9e4a67c",
+  "version": "0.0.0-pr-71.sha-7895262",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {