@tempoxyz/auth 0.0.0-pr-87.sha-bc40370 → 0.0.0-pr-87.sha-226d5ea

package/dist/Actions.d.ts

@@ -4,6 +4,7 @@
  * every flow shares sit at the top level.
  * @module
  */
+import { Authentication } from 'ox/webauthn';
 import type { Account } from 'viem/tempo';
 import type { Auth } from './Auth.ts';
 import type { Authorization } from './Authorization.ts';
@@ -20,7 +21,12 @@ export * as redirect from './actions/redirect.ts';
 /**
  * Authorizes the app for a user already signed in to Tempo Auth, from any app. Returns
  * `undefined` without a session, so the app shows sign-in. The key must fit Tempo Auth's headless
- * ceiling.
+ * ceiling. An `account` the call names becomes the app's account for its later requests, such as
+ * the one the user chose from a sign-in's account step.
+ *
+ * A passkey-owned account signs the key with a passkey prompt on the page, when the page is the
+ * app's own on Tempo's domain. Elsewhere the call throws a `RequestError` with reason
+ * `webauthn_required`, and `Actions.redirect.start` authorizes the key on Tempo Auth's pages.
  *
  * @example
  * ```ts
@@ -38,7 +44,8 @@ export declare namespace authorize {
         accessKey?: Account.Account | undefined;
         /**
          * The address of the user's Tempo Account the key acts for, such as the one the user chose from
-         * a sign-in's account step. Takes the place of `accessKey`'s `access`.
+         * a sign-in's account step. Takes the place of `accessKey`'s `access`, and becomes the app's
+         * account for its later requests that name none.
          */
         account?: `0x${string}` | undefined;
         /**
@@ -47,6 +54,12 @@ export declare namespace authorize {
          * `tempo-auth:sign` scope may send one.
          */
         challenge?: string | undefined;
+        /**
+         * Runs the WebAuthn ceremony in place of `navigator.credentials.get`, for a passkey-owned
+         * account, such as a native passkey module. Its assertion must report a web origin on the
+         * relying party's domain that the app registered.
+         */
+        getFn?: Authentication.sign.Options['getFn'] | undefined;
         /** What the key may do. It must fit the headless ceiling, which fills what it leaves out. */
         permissions?: Permissions<chainId> | undefined;
     };

package/dist/Actions.js

@@ -1,3 +1,10 @@
+/**
+ * Tempo Auth's actions. Each takes an instance from `Auth.create`. Each sign-in flow has its own
+ * namespace, `oauth` holds the standard OAuth endpoints for tokens an app holds, and the actions
+ * every flow shares sit at the top level.
+ * @module
+ */
+import { Authentication } from 'ox/webauthn';
 import * as AccessKey from './internal/accessKey.js';
 import * as Api from './internal/api.js';
 import { request } from './internal/request.js';
@@ -12,7 +19,12 @@ export * as redirect from './actions/redirect.js';
 /**
  * Authorizes the app for a user already signed in to Tempo Auth, from any app. Returns
  * `undefined` without a session, so the app shows sign-in. The key must fit Tempo Auth's headless
- * ceiling.
+ * ceiling. An `account` the call names becomes the app's account for its later requests, such as
+ * the one the user chose from a sign-in's account step.
+ *
+ * A passkey-owned account signs the key with a passkey prompt on the page, when the page is the
+ * app's own on Tempo's domain. Elsewhere the call throws a `RequestError` with reason
+ * `webauthn_required`, and `Actions.redirect.start` authorizes the key on Tempo Auth's pages.
  *
  * @example
  * ```ts
@@ -28,17 +40,28 @@ export async function authorize(auth, options = {}) {
     if (!session.user)
         return undefined;
     const key = await AccessKey.resolve(options.accessKey);
-    const response = await Api.post(auth, '/v1/authorize', {
-        json: request(auth, {
-            accessKey: key.accessKey,
-            account: options.account,
-            challenge: options.challenge,
-            permissions: options.permissions,
-        }),
+    const json = request(auth, {
+        accessKey: key.accessKey,
+        account: options.account,
+        challenge: options.challenge,
+        permissions: options.permissions,
     });
+    const response = await Api.post(auth, '/v1/authorize', { json });
     if (response.status === 401)
         return undefined;
-    return Api.authorization(await Api.json(response), key);
+    const body = await Api.json(response);
+    if (!('step' in body))
+        return Api.authorization(body, key);
+    // The step's challenge is the key's digest, so the repeated request carries the signature.
+    const deserialized = Authentication.deserializeOptions(body.step.options);
+    const assertion = Authentication.serializeResponse(await Authentication.sign(
+    // ox reads `getFn` beside request options at runtime, which its types admit only beside a challenge.
+    options.getFn
+        ? { ...deserialized, getFn: options.getFn }
+        : deserialized));
+    return Api.authorization(await Api.json(await Api.post(auth, '/v1/authorize', {
+        json: { ...json, passkey: { assertion } },
+    })), key);
 }
 /**
  * Exchanges a refresh token for new tokens. Refresh tokens rotate, so store the new one.

package/dist/Decorator.d.ts

@@ -73,11 +73,6 @@ export declare namespace tempoAuth {
             account: {
                 /** `Actions.account.get`. */
                 get: () => Promise<Actions.account.get.ReturnType>;
-                /**
-                 * `Actions.account.select`, which empties the client's account until the app authorizes
-                 * the selected one.
-                 */
-                select: (options: Actions.account.select.Options) => Promise<void>;
             };
             /**
              * `Actions.authorize`, which sets the client's account, or empties it when the user has no

package/dist/Decorator.js

@@ -100,13 +100,6 @@ export function tempoAuth(options) {
             auth: {
                 account: {
                     get: () => Actions.account.get(auth),
-                    // The client stops signing as the previous account, which the app reauthorizes for the
-                    // selected one.
-                    async select(options) {
-                        const change = begin();
-                        await Actions.account.select(auth, options).catch(change.fail);
-                        await change.apply(undefined);
-                    },
                 },
                 async authorize(options = {}) {
                     const change = begin();

package/dist/actions/account.d.ts

@@ -1,13 +1,13 @@
 /**
- * Reads and selects the signed-in user's Tempo Account for the app, with its realm.
+ * Reads the signed-in user's Tempo Account for the app, with its realm.
  * @module
  */
 import type { Auth } from '../Auth.ts';
 import type { TempoAccount } from '../TempoAccount.ts';
 /**
- * Returns the signed-in user's Tempo Account for the app: the one they selected at sign-in, or else
- * their oldest in the app's realms, with its `realm`. A user with no account in the app's realms
- * receives one in its first.
+ * Returns the signed-in user's Tempo Account for the app, with its `realm`: the one selected at
+ * sign-in or last named in `Actions.authorize`, or else their oldest in the app's realms. A user
+ * with no account in the app's realms receives one in its first.
  *
  * @example
  * ```ts
@@ -20,23 +20,3 @@ export declare namespace get {
     /** The user's Tempo Account for the app. */
     type ReturnType = TempoAccount;
 }
-/**
- * Selects one of the signed-in user's Tempo Accounts as the app's, after a sign-in's account step.
- * The app's requests that name no account use it until sign-out or the app's next sign-in.
- *
- * @example
- * ```ts
- * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result && result.step.type === 'account') {
- *   const [chosen] = result.step.accounts
- *   await Actions.account.select(auth, { address: chosen!.address })
- * }
- * ```
- */
-export declare function select(auth: Auth, options: select.Options): Promise<void>;
-export declare namespace select {
-    type Options = {
-        /** The address of one of the user's accounts, as the account step lists it. */
-        address: `0x${string}`;
-    };
-}

package/dist/actions/account.js

@@ -1,8 +1,8 @@
 import * as Api from '../internal/api.js';
 /**
- * Returns the signed-in user's Tempo Account for the app: the one they selected at sign-in, or else
- * their oldest in the app's realms, with its `realm`. A user with no account in the app's realms
- * receives one in its first.
+ * Returns the signed-in user's Tempo Account for the app, with its `realm`: the one selected at
+ * sign-in or last named in `Actions.authorize`, or else their oldest in the app's realms. A user
+ * with no account in the app's realms receives one in its first.
  *
  * @example
  * ```ts
@@ -15,21 +15,3 @@ export async function get(auth) {
     // Tempo Auth lists the account the app uses first, and always lists one.
     return Api.tempoAccount(tempo[0]);
 }
-/**
- * Selects one of the signed-in user's Tempo Accounts as the app's, after a sign-in's account step.
- * The app's requests that name no account use it until sign-out or the app's next sign-in.
- *
- * @example
- * ```ts
- * const result = await Actions.email.signIn(auth, { code, email })
- * if ('step' in result && result.step.type === 'account') {
- *   const [chosen] = result.step.accounts
- *   await Actions.account.select(auth, { address: chosen!.address })
- * }
- * ```
- */
-export async function select(auth, options) {
-    await Api.json(await Api.post(auth, '/v1/auth/account', {
-        json: { account: options.address, client_id: auth.clientId },
-    }));
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-87.sha-bc40370",
+  "version": "0.0.0-pr-87.sha-226d5ea",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {