@tempoxyz/auth 0.0.0-pr-97.sha-4799ea2 → 0.0.0-pr-95.sha-e7c03ef

package/dist/Actions.js

@@ -7,6 +7,7 @@
 import { Authentication } from 'ox/webauthn';
 import * as AccessKey from './internal/accessKey.js';
 import * as Api from './internal/api.js';
+import * as Link from './internal/link.js';
 import { request } from './internal/request.js';
 export * as account from './actions/account.js';
 export * as device from './actions/device.js';
@@ -39,7 +40,12 @@ export async function authorize(auth, options = {}) {
     }));
     if (!session.user)
         return undefined;
-    const key = await AccessKey.resolve(options.accessKey);
+    // A passkey sign-in's account step kept the key its assertion signed, which Tempo Auth
+    // authorizes with no second assertion when the passkey's account is chosen.
+    const kept = options.accessKey
+        ? undefined
+        : await Link.get(auth, { link: Link.account });
+    const key = kept ?? (await AccessKey.resolve(options.accessKey));
     const json = request(auth, {
         accessKey: key.accessKey,
         account: options.account,
@@ -49,6 +55,9 @@ export async function authorize(auth, options = {}) {
     const response = await Api.post(auth, '/v1/authorize', { json });
     if (response.status === 401)
         return undefined;
+    // A failed removal keeps the stale key, which the next account step replaces.
+    if (kept)
+        await Link.release(auth, { link: Link.account }).catch(() => undefined);
     const body = await Api.json(response);
     if (!('step' in body))
         return Api.authorization(body, key);

package/dist/actions/passkey.js

@@ -57,13 +57,18 @@ export async function signIn(auth, options = {}) {
         json: native ? { assertion, authorize } : { assertion },
     }));
     if ('step' in body) {
-        if (body.step.type === 'account')
+        if (body.step.type === 'account') {
+            // Choosing the passkey's account authorizes the key its assertion already signed, once
+            // `Actions.authorize` sends that key again.
+            if (!native && !options.accessKey)
+                await Link.keep(auth, { link: Link.account, material: key.material });
             return {
                 step: {
                     accounts: body.step.accounts.map(Api.tempoAccount),
                     type: 'account',
                 },
             };
+        }
         // The emailed-code sign-in that sends the link returns this key's authorization, so a key the
         // library generated waits for it in `storage`.
         if (body.step.signed && !options.accessKey)

package/dist/internal/link.d.ts

@@ -1,6 +1,8 @@
 import type { Auth } from '../Auth.ts';
 import type * as Key from '../Key.ts';
 import * as AccessKey from './accessKey.ts';
+/** The `link` a key waits under after an account step, which names no link of its own. */
+export declare const account = "account";
 /**
  * Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. Only the
  * link's digest is stored, since the link links the passkey for whoever sends it with a code.

package/dist/internal/link.js

@@ -1,12 +1,15 @@
 /**
  * Keeps a new key that a one-tap passkey sign-in signed, until the emailed-code sign-in that sends
- * its email step's `link` returns the key's authorization.
+ * its email step's `link`, or the `Actions.authorize` after its account step, returns the key's
+ * authorization.
  * @module
  */
 import { Bytes, Hash } from 'ox';
 import * as AccessKey from './accessKey.js';
 import * as Store from './store.js';
-/** Where the key waits in `storage`. A later email step replaces it. */
+/** The `link` a key waits under after an account step, which names no link of its own. */
+export const account = 'account';
+/** Where the key waits in `storage`. A later email or account step replaces it. */
 const storageKey = 'tempo-auth:passkey-link';
 /**
  * Keeps the key's material for `link`. Keeps nothing outside a browser without `storage`. Only the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tempoxyz/auth",
-  "version": "0.0.0-pr-97.sha-4799ea2",
+  "version": "0.0.0-pr-95.sha-e7c03ef",
   "description": "Signs users in to Tempo through Tempo Auth, and returns Viem access key accounts on their Tempo Accounts.",
   "type": "module",
   "exports": {