@tempoxyz/auth 0.0.0-pr-74.sha-74a7fa4 → 0.0.0-pr-74.sha-7c7ca79

package/dist/actions/passkey.d.ts

@@ -10,9 +10,10 @@ import type { Auth } from '../Auth.ts';
 import type { Authorization } from '../Authorization.ts';
 import type { Permissions } from '../Permissions.ts';
 /**
- * Signs the user in with a passkey, and authorizes the app in the same call. The passkey's one
- * assertion also signs the app's key when that passkey owns the Tempo Account, since the
- * ceremony's challenge is the key's digest. Returns the email step for a wallet.tempo passkey whose
+ * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
+ * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
+ * the ceremony's challenge is the key's digest. A native app, which sends no `Origin`, signs in
+ * with a random challenge and authorizes as a headless sign-in does. Returns the email step for a wallet.tempo passkey whose
  * account has no email: the app signs the user in with `Actions.email.signIn`, passing the step's
  * `link`, which links the passkey, and the same `accessKey` and `challenge`, which this call does
  * not authorize. Throws a `RequestError` with reason `webauthn_required` when another passkey owns

package/dist/actions/passkey.js

@@ -9,9 +9,10 @@ import * as AccessKey from '../internal/accessKey.js';
 import * as Api from '../internal/api.js';
 import { request } from '../internal/request.js';
 /**
- * Signs the user in with a passkey, and authorizes the app in the same call. The passkey's one
- * assertion also signs the app's key when that passkey owns the Tempo Account, since the
- * ceremony's challenge is the key's digest. Returns the email step for a wallet.tempo passkey whose
+ * Signs the user in with a passkey, and authorizes the app in the same call. On a page, the
+ * passkey's one assertion also signs the app's key when that passkey owns the Tempo Account, since
+ * the ceremony's challenge is the key's digest. A native app, which sends no `Origin`, signs in
+ * with a random challenge and authorizes as a headless sign-in does. Returns the email step for a wallet.tempo passkey whose
  * account has no email: the app signs the user in with `Actions.email.signIn`, passing the step's
  * `link`, which links the passkey, and the same `accessKey` and `challenge`, which this call does
  * not authorize. Throws a `RequestError` with reason `webauthn_required` when another passkey owns
@@ -27,21 +28,24 @@ import { request } from '../internal/request.js';
 export async function signIn(auth, options = {}) {
     const { challenge, getFn, permissions } = options;
     const key = await AccessKey.resolve(options.accessKey);
-    // The request goes with the options, so the challenge is its key's digest.
+    const authorize = request(auth, {
+        accessKey: key.accessKey,
+        challenge,
+        permissions,
+    });
+    // A page sends the request with the options, so the challenge is its key's digest. A native app
+    // sends no `Origin` to bind one-tap to, so it sends the request with the assertion instead.
+    const native = !/^https?:/.test(authorize.redirect_uri);
     const requested = await Api.json(await Api.post(auth, '/v1/auth/passkey/options', {
-        json: {
-            authorize: request(auth, {
-                accessKey: key.accessKey,
-                challenge,
-                permissions,
-            }),
-        },
+        json: native ? {} : { authorize },
     }));
     const deserialized = Authentication.deserializeOptions(requested.options);
     const assertion = Authentication.serializeResponse(await Authentication.sign(
     // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
     getFn ? { ...deserialized, getFn } : deserialized));
-    const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', { json: { assertion } }));
+    const body = await Api.json(await Api.post(auth, '/v1/auth/passkey/verify', {
+        json: native ? { assertion, authorize } : { assertion },
+    }));
     if ('step' in body)
         return { step: body.step };
     return Api.authorization(body.authorization, key);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-74.sha-74a7fa4",
+  "version": "0.0.0-pr-74.sha-7c7ca79",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {