@things-factory/auth-ui 10.1.205 → 10.1.208

package/dist-client/utils/audit-words.js

@@ -33,7 +33,9 @@ export function actionWords(t, action) {
     const change = action.kind === 'user.status' && action.detail
         ? ` ${statusWords(t, action.detail.from)} → ${statusWords(t, action.detail.to)}`
         : '';
-    return `${kind}${change}${failed}${times}`;
+    /* A password sign-in is the usual one and says nothing more; a passkey says so (ADR-0156). */
+    const method = action.kind === 'auth.signin' && action.detail?.method === 'passkey' ? ` (${t('audit.method.passkey')})` : '';
+    return `${kind}${method}${change}${failed}${times}`;
 }
 /**
  * A request's actions in one line - refusals and errors first, then events, then the doors passed.

package/dist-client/utils/audit-words.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-words.js","sourceRoot":"","sources":["../../client/utils/audit-words.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,CAAY,EAAE,IAAoB;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI;aACR,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5D,IAAI,CAAC,KAAK,CAAC,CAAA;IAChB,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7C,OAAO,GAAG,CAAC,CAAC,sBAAsB,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,IAAI,SAAS,EAAE,CAAA;AAC1F,CAAC;AAED,SAAS,WAAW,CAAC,CAAY,EAAE,MAAe;IAChD,OAAO,CAAC,CAAC,SAAS,MAAM,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,MAAsB;IAC9D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAEhE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACnF,OAAO,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,KAAK,EAAE,CAAA;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7G,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM;QAC5C,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAChF,CAAC,CAAC,EAAE,CAAA;IACR,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,EAAE,CAAA;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,OAAyB;IACjE,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAE,EAAE,CACxC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1G,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;SACrC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;SACrC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACrD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;IACzC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;AAC1B,CAAC","sourcesContent":["/**\n * How the audit screen says what an audit row holds (ADR-0141 §6). The rows hold codes; the screen\n * shows words. Pure, so the words are tested without a screen.\n */\n\ntype Translate = (key: string, options?: Record<string, unknown>) => string\n\nexport interface AuditActionRow {\n  kind: string\n  door?: string | null\n  decision?: string | null\n  outcome?: string | null\n  code?: string | null\n  count?: number | null\n  objectId?: string | null\n  detail?: Record<string, unknown> | null\n}\n\n/** The door in words: the category's name and the declared axis - `payroll:query` → 「급여 query」. */\nexport function doorWords(t: Translate, door?: string | null): string {\n  if (!door) return ''\n  if (!door.includes(':')) {\n    return door\n      .split('+')\n      .map(part => t(`audit.door.${part}`, { defaultValue: part }))\n      .join(' · ')\n  }\n  const [category, privilege] = door.split(':')\n  return `${t(`privilege.category.${category}`, { defaultValue: category })} ${privilege}`\n}\n\nfunction statusWords(t: Translate, status: unknown) {\n  return t(`label.${status}-user`, { defaultValue: String(status ?? '') })\n}\n\n/** One action in words, with how many times when more than once. */\nexport function actionWords(t: Translate, action: AuditActionRow): string {\n  const times = (action.count ?? 1) > 1 ? ` ×${action.count}` : ''\n\n  if (action.kind === 'door.check') {\n    const refused = action.decision === 'denied' ? ` ${t('audit.outcome.denied')}` : ''\n    return `${doorWords(t, action.door)}${refused}${times}`\n  }\n  if (action.kind === 'door.result') {\n    return action.outcome === 'error' ? `${doorWords(t, action.door)} ${t('audit.outcome.error')}${times}` : ''\n  }\n\n  const kind = t(`audit.kind.${action.kind}`, { defaultValue: action.kind })\n  const failed = action.outcome === 'error' ? ` ${t('audit.outcome.failed')}` : ''\n  const change =\n    action.kind === 'user.status' && action.detail\n      ? ` ${statusWords(t, action.detail.from)} → ${statusWords(t, action.detail.to)}`\n      : ''\n  return `${kind}${change}${failed}${times}`\n}\n\n/**\n * A request's actions in one line - refusals and errors first, then events, then the doors passed.\n * A door passed and its result say the same thing twice, so only an error result is shown.\n */\nexport function recordWords(t: Translate, actions: AuditActionRow[]): string {\n  const weight = (action: AuditActionRow) =>\n    action.decision === 'denied' || action.outcome === 'error' ? 0 : action.kind.startsWith('door.') ? 2 : 1\n  return [...actions]\n    .sort((a, b) => weight(a) - weight(b))\n    .map(action => actionWords(t, action))\n    .filter(Boolean)\n    .join(', ')\n}\n\n/** The last `days` days up to `now`. */\nexport function lastDays(days: number, now = new Date()): { from: Date; to: Date } {\n  const from = new Date(now)\n  from.setHours(0, 0, 0, 0)\n  from.setDate(from.getDate() - (days - 1))\n  return { from, to: now }\n}\n"]}
+{"version":3,"file":"audit-words.js","sourceRoot":"","sources":["../../client/utils/audit-words.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAeH,mGAAmG;AACnG,MAAM,UAAU,SAAS,CAAC,CAAY,EAAE,IAAoB;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI;aACR,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5D,IAAI,CAAC,KAAK,CAAC,CAAA;IAChB,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7C,OAAO,GAAG,CAAC,CAAC,sBAAsB,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,IAAI,SAAS,EAAE,CAAA;AAC1F,CAAC;AAED,SAAS,WAAW,CAAC,CAAY,EAAE,MAAe;IAChD,OAAO,CAAC,CAAC,SAAS,MAAM,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,MAAsB;IAC9D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAEhE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACnF,OAAO,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,KAAK,EAAE,CAAA;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,qBAAqB,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7G,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM;QAC5C,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAChF,CAAC,CAAC,EAAE,CAAA;IACR,8FAA8F;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5H,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,EAAE,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,CAAY,EAAE,OAAyB;IACjE,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAE,EAAE,CACxC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1G,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;SACrC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;SACrC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACrD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;IACzC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;AAC1B,CAAC","sourcesContent":["/**\n * How the audit screen says what an audit row holds (ADR-0141 §6). The rows hold codes; the screen\n * shows words. Pure, so the words are tested without a screen.\n */\n\ntype Translate = (key: string, options?: Record<string, unknown>) => string\n\nexport interface AuditActionRow {\n  kind: string\n  door?: string | null\n  decision?: string | null\n  outcome?: string | null\n  code?: string | null\n  count?: number | null\n  objectId?: string | null\n  detail?: Record<string, unknown> | null\n}\n\n/** The door in words: the category's name and the declared axis - `payroll:query` → 「급여 query」. */\nexport function doorWords(t: Translate, door?: string | null): string {\n  if (!door) return ''\n  if (!door.includes(':')) {\n    return door\n      .split('+')\n      .map(part => t(`audit.door.${part}`, { defaultValue: part }))\n      .join(' · ')\n  }\n  const [category, privilege] = door.split(':')\n  return `${t(`privilege.category.${category}`, { defaultValue: category })} ${privilege}`\n}\n\nfunction statusWords(t: Translate, status: unknown) {\n  return t(`label.${status}-user`, { defaultValue: String(status ?? '') })\n}\n\n/** One action in words, with how many times when more than once. */\nexport function actionWords(t: Translate, action: AuditActionRow): string {\n  const times = (action.count ?? 1) > 1 ? ` ×${action.count}` : ''\n\n  if (action.kind === 'door.check') {\n    const refused = action.decision === 'denied' ? ` ${t('audit.outcome.denied')}` : ''\n    return `${doorWords(t, action.door)}${refused}${times}`\n  }\n  if (action.kind === 'door.result') {\n    return action.outcome === 'error' ? `${doorWords(t, action.door)} ${t('audit.outcome.error')}${times}` : ''\n  }\n\n  const kind = t(`audit.kind.${action.kind}`, { defaultValue: action.kind })\n  const failed = action.outcome === 'error' ? ` ${t('audit.outcome.failed')}` : ''\n  const change =\n    action.kind === 'user.status' && action.detail\n      ? ` ${statusWords(t, action.detail.from)} → ${statusWords(t, action.detail.to)}`\n      : ''\n  /* A password sign-in is the usual one and says nothing more; a passkey says so (ADR-0156). */\n  const method = action.kind === 'auth.signin' && action.detail?.method === 'passkey' ? ` (${t('audit.method.passkey')})` : ''\n  return `${kind}${method}${change}${failed}${times}`\n}\n\n/**\n * A request's actions in one line - refusals and errors first, then events, then the doors passed.\n * A door passed and its result say the same thing twice, so only an error result is shown.\n */\nexport function recordWords(t: Translate, actions: AuditActionRow[]): string {\n  const weight = (action: AuditActionRow) =>\n    action.decision === 'denied' || action.outcome === 'error' ? 0 : action.kind.startsWith('door.') ? 2 : 1\n  return [...actions]\n    .sort((a, b) => weight(a) - weight(b))\n    .map(action => actionWords(t, action))\n    .filter(Boolean)\n    .join(', ')\n}\n\n/** The last `days` days up to `now`. */\nexport function lastDays(days: number, now = new Date()): { from: Date; to: Date } {\n  const from = new Date(now)\n  from.setHours(0, 0, 0, 0)\n  from.setDate(from.getDate() - (days - 1))\n  return { from, to: now }\n}\n"]}

package/dist-client/utils/audit-words.test.js

@@ -6,6 +6,7 @@ const WORDS = {
     'audit.outcome.error': '오류',
     'audit.outcome.failed': '실패',
     'audit.kind.auth.signin': '로그인',
+    'audit.method.passkey': '패스키',
     'audit.kind.role.grant': '역할 부여',
     'audit.kind.user.status': '계정 상태',
     'label.activated-user': '정상',
@@ -29,6 +30,11 @@ describe('the audit screen says what a row holds', () => {
         expect(actionWords(t, { kind: 'auth.signin', outcome: 'error', code: 'user not found' })).toBe('로그인 실패');
         expect(actionWords(t, { kind: 'user.status', detail: { from: 'activated', to: 'locked' } })).toBe('계정 상태 정상 → 잠김');
     });
+    it('a passkey sign-in says so; a password sign-in says nothing more', () => {
+        expect(actionWords(t, { kind: 'auth.signin', outcome: 'ok', detail: { method: 'passkey' } })).toBe('로그인 (패스키)');
+        expect(actionWords(t, { kind: 'auth.signin', outcome: 'error', detail: { method: 'passkey' } })).toBe('로그인 (패스키) 실패');
+        expect(actionWords(t, { kind: 'auth.signin', outcome: 'ok', detail: { method: 'password' } })).toBe('로그인');
+    });
     it('a request reads refusals first, then events, then doors passed', () => {
         expect(recordWords(t, [
             { kind: 'door.check', door: 'payroll:query', decision: 'granted' },

package/dist-client/utils/audit-words.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-words.test.js","sourceRoot":"","sources":["../../client/utils/audit-words.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE7E,MAAM,KAAK,GAA2B;IACpC,4BAA4B,EAAE,IAAI;IAClC,kBAAkB,EAAE,SAAS;IAC7B,sBAAsB,EAAE,IAAI;IAC5B,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,IAAI;IAC5B,wBAAwB,EAAE,KAAK;IAC/B,uBAAuB,EAAE,OAAO;IAChC,wBAAwB,EAAE,OAAO;IACjC,sBAAsB,EAAE,IAAI;IAC5B,mBAAmB,EAAE,IAAI;CAC1B,CAAA;AACD,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,OAAa,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,YAAY,IAAI,GAAG,CAAA;AAEpF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5H,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9F,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxG,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CACJ,WAAW,CAAC,CAAC,EAAE;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE;YAClE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7D,EAAE,IAAI,EAAE,YAAY,EAAE;YACtB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACrE,CAAC,CACH,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACzC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACjD,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { actionWords, doorWords, lastDays, recordWords } from './audit-words'\n\nconst WORDS: Record<string, string> = {\n  'privilege.category.payroll': '급여',\n  'audit.door.super': '시스템 소유자',\n  'audit.outcome.denied': '거절',\n  'audit.outcome.error': '오류',\n  'audit.outcome.failed': '실패',\n  'audit.kind.auth.signin': '로그인',\n  'audit.kind.role.grant': '역할 부여',\n  'audit.kind.user.status': '계정 상태',\n  'label.activated-user': '정상',\n  'label.locked-user': '잠김'\n}\nconst t = (key: string, options?: any) => WORDS[key] ?? options?.defaultValue ?? key\n\ndescribe('the audit screen says what a row holds', () => {\n  it('a door is its category in words and the declared axis', () => {\n    expect(doorWords(t, 'payroll:query')).toBe('급여 query')\n    expect(doorWords(t, 'super')).toBe('시스템 소유자')\n    expect(doorWords(t, 'unknown-category:query')).toBe('unknown-category query')\n  })\n\n  it('a refusal says so, with how many times', () => {\n    expect(actionWords(t, { kind: 'door.check', door: 'payroll:query', decision: 'denied', count: 3 })).toBe('급여 query 거절 ×3')\n  })\n\n  it('a result is shown only when it failed - passing already said it ran', () => {\n    expect(actionWords(t, { kind: 'door.result', door: 'payroll:query', outcome: 'ok' })).toBe('')\n    expect(actionWords(t, { kind: 'door.result', door: 'payroll:query', outcome: 'error' })).toBe('급여 query 오류')\n  })\n\n  it('an event in words, a status change with both states', () => {\n    expect(actionWords(t, { kind: 'auth.signin', outcome: 'error', code: 'user not found' })).toBe('로그인 실패')\n    expect(actionWords(t, { kind: 'user.status', detail: { from: 'activated', to: 'locked' } })).toBe('계정 상태 정상 → 잠김')\n  })\n\n  it('a request reads refusals first, then events, then doors passed', () => {\n    expect(\n      recordWords(t, [\n        { kind: 'door.check', door: 'payroll:query', decision: 'granted' },\n        { kind: 'door.result', door: 'payroll:query', outcome: 'ok' },\n        { kind: 'role.grant' },\n        { kind: 'door.check', door: 'payroll:mutation', decision: 'denied' }\n      ])\n    ).toBe('급여 mutation 거절, 역할 부여, 급여 query')\n  })\n\n  it('the last seven days start at midnight six days back', () => {\n    const now = new Date(2026, 9, 19, 15, 30)\n    const { from, to } = lastDays(7, now)\n    expect(from).toEqual(new Date(2026, 9, 13, 0, 0))\n    expect(to).toBe(now)\n  })\n})\n"]}
+{"version":3,"file":"audit-words.test.js","sourceRoot":"","sources":["../../client/utils/audit-words.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE7E,MAAM,KAAK,GAA2B;IACpC,4BAA4B,EAAE,IAAI;IAClC,kBAAkB,EAAE,SAAS;IAC7B,sBAAsB,EAAE,IAAI;IAC5B,qBAAqB,EAAE,IAAI;IAC3B,sBAAsB,EAAE,IAAI;IAC5B,wBAAwB,EAAE,KAAK;IAC/B,sBAAsB,EAAE,KAAK;IAC7B,uBAAuB,EAAE,OAAO;IAChC,wBAAwB,EAAE,OAAO;IACjC,sBAAsB,EAAE,IAAI;IAC5B,mBAAmB,EAAE,IAAI;CAC1B,CAAA;AACD,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,OAAa,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,YAAY,IAAI,GAAG,CAAA;AAEpF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC7C,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5H,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9F,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC9G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxG,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACpH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC/G,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACrH,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CACJ,WAAW,CAAC,CAAC,EAAE;YACb,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE;YAClE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7D,EAAE,IAAI,EAAE,YAAY,EAAE;YACtB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACrE,CAAC,CACH,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACzC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACjD,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { actionWords, doorWords, lastDays, recordWords } from './audit-words'\n\nconst WORDS: Record<string, string> = {\n  'privilege.category.payroll': '급여',\n  'audit.door.super': '시스템 소유자',\n  'audit.outcome.denied': '거절',\n  'audit.outcome.error': '오류',\n  'audit.outcome.failed': '실패',\n  'audit.kind.auth.signin': '로그인',\n  'audit.method.passkey': '패스키',\n  'audit.kind.role.grant': '역할 부여',\n  'audit.kind.user.status': '계정 상태',\n  'label.activated-user': '정상',\n  'label.locked-user': '잠김'\n}\nconst t = (key: string, options?: any) => WORDS[key] ?? options?.defaultValue ?? key\n\ndescribe('the audit screen says what a row holds', () => {\n  it('a door is its category in words and the declared axis', () => {\n    expect(doorWords(t, 'payroll:query')).toBe('급여 query')\n    expect(doorWords(t, 'super')).toBe('시스템 소유자')\n    expect(doorWords(t, 'unknown-category:query')).toBe('unknown-category query')\n  })\n\n  it('a refusal says so, with how many times', () => {\n    expect(actionWords(t, { kind: 'door.check', door: 'payroll:query', decision: 'denied', count: 3 })).toBe('급여 query 거절 ×3')\n  })\n\n  it('a result is shown only when it failed - passing already said it ran', () => {\n    expect(actionWords(t, { kind: 'door.result', door: 'payroll:query', outcome: 'ok' })).toBe('')\n    expect(actionWords(t, { kind: 'door.result', door: 'payroll:query', outcome: 'error' })).toBe('급여 query 오류')\n  })\n\n  it('an event in words, a status change with both states', () => {\n    expect(actionWords(t, { kind: 'auth.signin', outcome: 'error', code: 'user not found' })).toBe('로그인 실패')\n    expect(actionWords(t, { kind: 'user.status', detail: { from: 'activated', to: 'locked' } })).toBe('계정 상태 정상 → 잠김')\n  })\n\n  it('a passkey sign-in says so; a password sign-in says nothing more', () => {\n    expect(actionWords(t, { kind: 'auth.signin', outcome: 'ok', detail: { method: 'passkey' } })).toBe('로그인 (패스키)')\n    expect(actionWords(t, { kind: 'auth.signin', outcome: 'error', detail: { method: 'passkey' } })).toBe('로그인 (패스키) 실패')\n    expect(actionWords(t, { kind: 'auth.signin', outcome: 'ok', detail: { method: 'password' } })).toBe('로그인')\n  })\n\n  it('a request reads refusals first, then events, then doors passed', () => {\n    expect(\n      recordWords(t, [\n        { kind: 'door.check', door: 'payroll:query', decision: 'granted' },\n        { kind: 'door.result', door: 'payroll:query', outcome: 'ok' },\n        { kind: 'role.grant' },\n        { kind: 'door.check', door: 'payroll:mutation', decision: 'denied' }\n      ])\n    ).toBe('급여 mutation 거절, 역할 부여, 급여 query')\n  })\n\n  it('the last seven days start at midnight six days back', () => {\n    const now = new Date(2026, 9, 19, 15, 30)\n    const { from, to } = lastDays(7, now)\n    expect(from).toEqual(new Date(2026, 9, 13, 0, 0))\n    expect(to).toBe(now)\n  })\n})\n"]}

package/dist-client/utils/passkey.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The rules the passkey screens follow (ADR-0156), apart from the screens so they are tested.
+ */
+/**
+ * A label for a passkey made here - the system and the browser, 「macOS · Chrome」. The person can
+ * rename it; this is only what the list shows until they do.
+ */
+export declare function deviceLabel(userAgent: string): string;
+export type SigninAnswer = {
+    outcome: 'signed-in';
+    redirectURL: string;
+} | {
+    outcome: 'refused';
+    message: string;
+};
+/**
+ * What the passkey sign-in answered. A refusal comes back as 401 with the refusal, already in the
+ * person's language, as a plain-text body (`authenticate401Middleware`). Never throws.
+ */
+export declare function readSigninAnswer(response: Response): Promise<SigninAnswer>;
+/**
+ * The browser said no: the person closed the prompt, or let it time out. Nothing to report - they
+ * know. Other errors are worth a word.
+ */
+export declare function wasCancelled(error: any): boolean;
+/** The authenticator already holds one of this person's passkeys for this site. */
+export declare function alreadyRegistered(error: any): boolean;
+/** Where 「do not ask again on this device」 is kept - per browser, per person. */
+export declare function offerDeclinedKey(username: string): string;
+/**
+ * Whether the offer screen has anything to offer. It needs an authenticator built into this device -
+ * a person on someone else's computer is not asked to put a passkey on it - and the person must not
+ * have said no on this browser.
+ */
+export declare function shouldOffer({ platformAuthenticator, declined }: {
+    platformAuthenticator: boolean;
+    declined: boolean;
+}): boolean;

package/dist-client/utils/passkey.js

@@ -0,0 +1,84 @@
+/**
+ * The rules the passkey screens follow (ADR-0156), apart from the screens so they are tested.
+ */
+/**
+ * A label for a passkey made here - the system and the browser, 「macOS · Chrome」. The person can
+ * rename it; this is only what the list shows until they do.
+ */
+export function deviceLabel(userAgent) {
+    const system = /iPhone/.test(userAgent)
+        ? 'iPhone'
+        : /iPad/.test(userAgent)
+            ? 'iPad'
+            : /Android/.test(userAgent)
+                ? 'Android'
+                : /Windows/.test(userAgent)
+                    ? 'Windows'
+                    : /Mac OS X|Macintosh/.test(userAgent)
+                        ? 'macOS'
+                        : /CrOS/.test(userAgent)
+                            ? 'ChromeOS'
+                            : /Linux/.test(userAgent)
+                                ? 'Linux'
+                                : '';
+    /* Order matters: Edge and Opera say Chrome too, Chrome says Safari too. */
+    const browser = /Edg\//.test(userAgent)
+        ? 'Edge'
+        : /OPR\//.test(userAgent)
+            ? 'Opera'
+            : /SamsungBrowser\//.test(userAgent)
+                ? 'Samsung Internet'
+                : /Firefox\/|FxiOS\//.test(userAgent)
+                    ? 'Firefox'
+                    : /Chrome\/|CriOS\//.test(userAgent)
+                        ? 'Chrome'
+                        : /Safari\//.test(userAgent)
+                            ? 'Safari'
+                            : '';
+    return [system, browser].filter(Boolean).join(' · ');
+}
+/**
+ * What the passkey sign-in answered. A refusal comes back as 401 with the refusal, already in the
+ * person's language, as a plain-text body (`authenticate401Middleware`). Never throws.
+ */
+export async function readSigninAnswer(response) {
+    let body = '';
+    try {
+        body = await response.text();
+    }
+    catch { }
+    if (response.ok) {
+        try {
+            const parsed = JSON.parse(body);
+            if (parsed?.verified === true && typeof parsed.redirectURL === 'string') {
+                return { outcome: 'signed-in', redirectURL: parsed.redirectURL };
+            }
+        }
+        catch { }
+    }
+    return { outcome: 'refused', message: body.trim() };
+}
+/**
+ * The browser said no: the person closed the prompt, or let it time out. Nothing to report - they
+ * know. Other errors are worth a word.
+ */
+export function wasCancelled(error) {
+    return error?.name === 'NotAllowedError' || error?.name === 'AbortError' || error?.code === 'ERROR_CEREMONY_ABORTED';
+}
+/** The authenticator already holds one of this person's passkeys for this site. */
+export function alreadyRegistered(error) {
+    return error?.name === 'InvalidStateError' || error?.code === 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED';
+}
+/** Where 「do not ask again on this device」 is kept - per browser, per person. */
+export function offerDeclinedKey(username) {
+    return `passkey-offer-declined:${username}`;
+}
+/**
+ * Whether the offer screen has anything to offer. It needs an authenticator built into this device -
+ * a person on someone else's computer is not asked to put a passkey on it - and the person must not
+ * have said no on this browser.
+ */
+export function shouldOffer({ platformAuthenticator, declined }) {
+    return platformAuthenticator && !declined;
+}
+//# sourceMappingURL=passkey.js.map

package/dist-client/utils/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../client/utils/passkey.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QACrC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACtB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;gBACzB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;oBACzB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;wBACpC,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;4BACtB,CAAC,CAAC,UAAU;4BACZ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;gCACvB,CAAC,CAAC,OAAO;gCACT,CAAC,CAAC,EAAE,CAAA;IAElB,2EAA2E;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QACrC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YACvB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;gBAClC,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;oBACnC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC;wBAClC,CAAC,CAAC,QAAQ;wBACV,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;4BAC1B,CAAC,CAAC,QAAQ;4BACV,CAAC,CAAC,EAAE,CAAA;IAEhB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACtD,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAkB;IACvD,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC/B,IAAI,MAAM,EAAE,QAAQ,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACxE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;YAClE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAU;IACrC,OAAO,KAAK,EAAE,IAAI,KAAK,iBAAiB,IAAI,KAAK,EAAE,IAAI,KAAK,YAAY,IAAI,KAAK,EAAE,IAAI,KAAK,wBAAwB,CAAA;AACtH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,KAAU;IAC1C,OAAO,KAAK,EAAE,IAAI,KAAK,mBAAmB,IAAI,KAAK,EAAE,IAAI,KAAK,2CAA2C,CAAA;AAC3G,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,0BAA0B,QAAQ,EAAE,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,EAAE,qBAAqB,EAAE,QAAQ,EAAyD;IACpH,OAAO,qBAAqB,IAAI,CAAC,QAAQ,CAAA;AAC3C,CAAC","sourcesContent":["/**\n * The rules the passkey screens follow (ADR-0156), apart from the screens so they are tested.\n */\n\n/**\n * A label for a passkey made here - the system and the browser, 「macOS · Chrome」. The person can\n * rename it; this is only what the list shows until they do.\n */\nexport function deviceLabel(userAgent: string): string {\n  const system = /iPhone/.test(userAgent)\n    ? 'iPhone'\n    : /iPad/.test(userAgent)\n      ? 'iPad'\n      : /Android/.test(userAgent)\n        ? 'Android'\n        : /Windows/.test(userAgent)\n          ? 'Windows'\n          : /Mac OS X|Macintosh/.test(userAgent)\n            ? 'macOS'\n            : /CrOS/.test(userAgent)\n              ? 'ChromeOS'\n              : /Linux/.test(userAgent)\n                ? 'Linux'\n                : ''\n\n  /* Order matters: Edge and Opera say Chrome too, Chrome says Safari too. */\n  const browser = /Edg\\//.test(userAgent)\n    ? 'Edge'\n    : /OPR\\//.test(userAgent)\n      ? 'Opera'\n      : /SamsungBrowser\\//.test(userAgent)\n        ? 'Samsung Internet'\n        : /Firefox\\/|FxiOS\\//.test(userAgent)\n          ? 'Firefox'\n          : /Chrome\\/|CriOS\\//.test(userAgent)\n            ? 'Chrome'\n            : /Safari\\//.test(userAgent)\n              ? 'Safari'\n              : ''\n\n  return [system, browser].filter(Boolean).join(' · ')\n}\n\nexport type SigninAnswer = { outcome: 'signed-in'; redirectURL: string } | { outcome: 'refused'; message: string }\n\n/**\n * What the passkey sign-in answered. A refusal comes back as 401 with the refusal, already in the\n * person's language, as a plain-text body (`authenticate401Middleware`). Never throws.\n */\nexport async function readSigninAnswer(response: Response): Promise<SigninAnswer> {\n  let body = ''\n  try {\n    body = await response.text()\n  } catch {}\n\n  if (response.ok) {\n    try {\n      const parsed = JSON.parse(body)\n      if (parsed?.verified === true && typeof parsed.redirectURL === 'string') {\n        return { outcome: 'signed-in', redirectURL: parsed.redirectURL }\n      }\n    } catch {}\n  }\n\n  return { outcome: 'refused', message: body.trim() }\n}\n\n/**\n * The browser said no: the person closed the prompt, or let it time out. Nothing to report - they\n * know. Other errors are worth a word.\n */\nexport function wasCancelled(error: any): boolean {\n  return error?.name === 'NotAllowedError' || error?.name === 'AbortError' || error?.code === 'ERROR_CEREMONY_ABORTED'\n}\n\n/** The authenticator already holds one of this person's passkeys for this site. */\nexport function alreadyRegistered(error: any): boolean {\n  return error?.name === 'InvalidStateError' || error?.code === 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED'\n}\n\n/** Where 「do not ask again on this device」 is kept - per browser, per person. */\nexport function offerDeclinedKey(username: string): string {\n  return `passkey-offer-declined:${username}`\n}\n\n/**\n * Whether the offer screen has anything to offer. It needs an authenticator built into this device -\n * a person on someone else's computer is not asked to put a passkey on it - and the person must not\n * have said no on this browser.\n */\nexport function shouldOffer({ platformAuthenticator, declined }: { platformAuthenticator: boolean; declined: boolean }): boolean {\n  return platformAuthenticator && !declined\n}\n"]}

package/dist-client/utils/passkey.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/passkey.test.js

@@ -0,0 +1,75 @@
+import { alreadyRegistered, deviceLabel, offerDeclinedKey, readSigninAnswer, shouldOffer, wasCancelled } from './passkey';
+/** Just enough of `Response` for the reader. */
+function response({ ok = true, status = 200, body = '', unreadable = false } = {}) {
+    return {
+        ok,
+        status,
+        text: async () => {
+            if (unreadable)
+                throw new TypeError('body already consumed');
+            return body;
+        }
+    };
+}
+describe('a label for a passkey made here', () => {
+    it.each([
+        ['Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36', 'macOS · Chrome'],
+        ['Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15', 'macOS · Safari'],
+        ['Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.0.0', 'Windows · Edge'],
+        ['Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1', 'iPhone · Safari'],
+        ['Mozilla/5.0 (Linux; Android 14; SM-S918N) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36', 'Android · Samsung Internet'],
+        ['Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0', 'Linux · Firefox']
+    ])('%s', (userAgent, label) => {
+        expect(deviceLabel(userAgent)).toBe(label);
+    });
+    it('says nothing it cannot tell', () => {
+        expect(deviceLabel('curl/8.0')).toBe('');
+    });
+});
+describe('what the passkey sign-in answered', () => {
+    it('signed in, with where to go next', async () => {
+        expect(await readSigninAnswer(response({ body: '{"verified":true,"redirectURL":"/auth/checkin?redirect_to=%2F"}' }))).toEqual({
+            outcome: 'signed-in',
+            redirectURL: '/auth/checkin?redirect_to=%2F'
+        });
+    });
+    it("a refusal carries the server's words, already in the person's language", async () => {
+        expect(await readSigninAnswer(response({ ok: false, status: 401, body: '계정이 잠겨 있습니다.' }))).toEqual({
+            outcome: 'refused',
+            message: '계정이 잠겨 있습니다.'
+        });
+    });
+    it('an answer that is ok but not a sign-in is not taken for one', async () => {
+        expect((await readSigninAnswer(response({ body: '{"verified":false}' }))).outcome).toBe('refused');
+        expect((await readSigninAnswer(response({ body: '<html>' }))).outcome).toBe('refused');
+        expect((await readSigninAnswer(response({ ok: false, status: 401, body: '{"verified":true,"redirectURL":"/x"}' }))).outcome).toBe('refused');
+    });
+    it('an unreadable body is a refusal with nothing to say, never a throw', async () => {
+        expect(await readSigninAnswer(response({ unreadable: true }))).toEqual({ outcome: 'refused', message: '' });
+    });
+});
+describe('what the browser said', () => {
+    it('a closed or cancelled prompt is not an error worth reporting', () => {
+        expect(wasCancelled({ name: 'NotAllowedError' })).toBe(true);
+        expect(wasCancelled({ name: 'AbortError' })).toBe(true);
+        expect(wasCancelled({ code: 'ERROR_CEREMONY_ABORTED' })).toBe(true);
+        expect(wasCancelled({ name: 'SecurityError' })).toBe(false);
+        expect(wasCancelled(undefined)).toBe(false);
+    });
+    it('an authenticator that already holds this person’s passkey', () => {
+        expect(alreadyRegistered({ name: 'InvalidStateError' })).toBe(true);
+        expect(alreadyRegistered({ code: 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED' })).toBe(true);
+        expect(alreadyRegistered({ name: 'NotAllowedError' })).toBe(false);
+    });
+});
+describe('the offer after a password sign-in', () => {
+    it('is made only on a device with its own authenticator, to a person who has not said no here', () => {
+        expect(shouldOffer({ platformAuthenticator: true, declined: false })).toBe(true);
+        expect(shouldOffer({ platformAuthenticator: false, declined: false })).toBe(false);
+        expect(shouldOffer({ platformAuthenticator: true, declined: true })).toBe(false);
+    });
+    it('a no is kept per person on this browser', () => {
+        expect(offerDeclinedKey('kim')).not.toBe(offerDeclinedKey('lee'));
+    });
+});
+//# sourceMappingURL=passkey.test.js.map

package/dist-client/utils/passkey.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.test.js","sourceRoot":"","sources":["../../client/utils/passkey.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAEzH,gDAAgD;AAChD,SAAS,QAAQ,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,GAAG,KAAK,EAAE,GAAG,EAAE;IAC/E,OAAO;QACL,EAAE;QACF,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,IAAI,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAA;YAC5D,OAAO,IAAI,CAAA;QACb,CAAC;KACqB,CAAA;AAC1B,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,uHAAuH,EAAE,gBAAgB,CAAC;QAC3I,CAAC,uHAAuH,EAAE,gBAAgB,CAAC;QAC3I,CAAC,+HAA+H,EAAE,gBAAgB,CAAC;QACnJ,CAAC,yIAAyI,EAAE,iBAAiB,CAAC;QAC9J,CAAC,4IAA4I,EAAE,4BAA4B,CAAC;QAC5K,CAAC,wEAAwE,EAAE,iBAAiB,CAAC;KAC9F,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,iEAAiE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5H,OAAO,EAAE,WAAW;YACpB,WAAW,EAAE,+BAA+B;SAC7C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACjG,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,cAAc;SACxB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClG,MAAM,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtF,MAAM,CAAC,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9I,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,CAAC,MAAM,gBAAgB,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;IAC7G,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5D,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnE,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3D,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnE,MAAM,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3F,MAAM,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChF,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClF,MAAM,CAAC,WAAW,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { alreadyRegistered, deviceLabel, offerDeclinedKey, readSigninAnswer, shouldOffer, wasCancelled } from './passkey'\n\n/** Just enough of `Response` for the reader. */\nfunction response({ ok = true, status = 200, body = '', unreadable = false } = {}): Response {\n  return {\n    ok,\n    status,\n    text: async () => {\n      if (unreadable) throw new TypeError('body already consumed')\n      return body\n    }\n  } as unknown as Response\n}\n\ndescribe('a label for a passkey made here', () => {\n  it.each([\n    ['Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36', 'macOS · Chrome'],\n    ['Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15', 'macOS · Safari'],\n    ['Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Edg/141.0.0.0', 'Windows · Edge'],\n    ['Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1', 'iPhone · Safari'],\n    ['Mozilla/5.0 (Linux; Android 14; SM-S918N) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36', 'Android · Samsung Internet'],\n    ['Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0', 'Linux · Firefox']\n  ])('%s', (userAgent, label) => {\n    expect(deviceLabel(userAgent)).toBe(label)\n  })\n\n  it('says nothing it cannot tell', () => {\n    expect(deviceLabel('curl/8.0')).toBe('')\n  })\n})\n\ndescribe('what the passkey sign-in answered', () => {\n  it('signed in, with where to go next', async () => {\n    expect(await readSigninAnswer(response({ body: '{\"verified\":true,\"redirectURL\":\"/auth/checkin?redirect_to=%2F\"}' }))).toEqual({\n      outcome: 'signed-in',\n      redirectURL: '/auth/checkin?redirect_to=%2F'\n    })\n  })\n\n  it(\"a refusal carries the server's words, already in the person's language\", async () => {\n    expect(await readSigninAnswer(response({ ok: false, status: 401, body: '계정이 잠겨 있습니다.' }))).toEqual({\n      outcome: 'refused',\n      message: '계정이 잠겨 있습니다.'\n    })\n  })\n\n  it('an answer that is ok but not a sign-in is not taken for one', async () => {\n    expect((await readSigninAnswer(response({ body: '{\"verified\":false}' }))).outcome).toBe('refused')\n    expect((await readSigninAnswer(response({ body: '<html>' }))).outcome).toBe('refused')\n    expect((await readSigninAnswer(response({ ok: false, status: 401, body: '{\"verified\":true,\"redirectURL\":\"/x\"}' }))).outcome).toBe('refused')\n  })\n\n  it('an unreadable body is a refusal with nothing to say, never a throw', async () => {\n    expect(await readSigninAnswer(response({ unreadable: true }))).toEqual({ outcome: 'refused', message: '' })\n  })\n})\n\ndescribe('what the browser said', () => {\n  it('a closed or cancelled prompt is not an error worth reporting', () => {\n    expect(wasCancelled({ name: 'NotAllowedError' })).toBe(true)\n    expect(wasCancelled({ name: 'AbortError' })).toBe(true)\n    expect(wasCancelled({ code: 'ERROR_CEREMONY_ABORTED' })).toBe(true)\n    expect(wasCancelled({ name: 'SecurityError' })).toBe(false)\n    expect(wasCancelled(undefined)).toBe(false)\n  })\n\n  it('an authenticator that already holds this person’s passkey', () => {\n    expect(alreadyRegistered({ name: 'InvalidStateError' })).toBe(true)\n    expect(alreadyRegistered({ code: 'ERROR_AUTHENTICATOR_PREVIOUSLY_REGISTERED' })).toBe(true)\n    expect(alreadyRegistered({ name: 'NotAllowedError' })).toBe(false)\n  })\n})\n\ndescribe('the offer after a password sign-in', () => {\n  it('is made only on a device with its own authenticator, to a person who has not said no here', () => {\n    expect(shouldOffer({ platformAuthenticator: true, declined: false })).toBe(true)\n    expect(shouldOffer({ platformAuthenticator: false, declined: false })).toBe(false)\n    expect(shouldOffer({ platformAuthenticator: true, declined: true })).toBe(false)\n  })\n\n  it('a no is kept per person on this browser', () => {\n    expect(offerDeclinedKey('kim')).not.toBe(offerDeclinedKey('lee'))\n  })\n})\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/auth-ui",
-  "version": "10.1.205",
+  "version": "10.1.208",
   "main": "dist-server/index.js",
   "browser": "dist-client/index.js",
   "things-factory": true,
@@ -40,11 +40,11 @@
     "@operato/shell": "^10.29.39",
     "@operato/styles": "^10.0.0",
     "@operato/utils": "^10.29.39",
-    "@things-factory/auth-base": "^10.1.205",
-    "@things-factory/component-ui": "^10.1.205",
-    "@things-factory/more-base": "^10.1.205",
+    "@things-factory/auth-base": "^10.1.208",
+    "@things-factory/component-ui": "^10.1.208",
+    "@things-factory/more-base": "^10.1.208",
     "base64url": "^3.0.1",
     "clipboard": "^2.0.6"
   },
-  "gitHead": "7311492aa5eaa00993c0325053f5f7ae8b1fb024"
+  "gitHead": "ffc1ceaa9471b9f4a9b86f46c3021f2fed72d17d"
 }

package/translations/en.json

@@ -1,6 +1,7 @@
 {
   "button.accept invitation": "accept invitation",
   "button.activate": "activate",
+  "button.add passkey": "Add a passkey",
   "button.add what it can do": "Add what it can do",
   "button.close": "Close",
   "button.confirm": "confirm",
@@ -13,15 +14,18 @@
   "button.delete this appliance": "delete this appliance",
   "button.delete user": "delete user",
   "button.detail": "detail",
+  "button.do not ask on this device": "Don't ask on this device",
   "button.drop": "Take away",
   "button.edit privileges": "Edit privileges",
   "button.generate new access token": "generate new access token",
   "button.generate new secret": "generate new secret",
   "button.go to home": "go to home",
   "button.hide": "hide",
+  "button.later": "Later",
   "button.logout": "logout",
   "button.name it yourself": "name it yourself",
   "button.register": "register",
+  "button.register on this device": "Register on this device",
   "button.remove from domain": "Remove from domain",
   "button.remove owner": "remove owner",
   "button.renew access token": "renew access token",
@@ -29,11 +33,11 @@
   "button.reveal": "reveal",
   "button.revoke credential": "revoke credential",
   "button.save": "save",
-  "button.security-key registration": "security key registration",
   "button.show-all": "Show all",
   "button.show-orphans-only": "Show orphans only",
   "button.sign in": "sign in",
   "button.sign_in": "sign in",
+  "button.signin with passkey": "sign in with a passkey",
   "button.stand it here": "stand it here",
   "button.submit": "submit",
   "button.terminate contract": "terminate",
@@ -143,6 +147,7 @@
   "label.locked-user": "locked",
   "label.login_history": "login history",
   "label.ours": "Ours",
+  "label.passkey": "Passkey",
   "label.password": "password",
   "label.privilege": "privilege",
   "label.protected-request-ip": "safe request IP",
@@ -244,6 +249,7 @@
   "text.no domain available": "no domain available",
   "text.no one holds this role yet": "No one holds this role yet.",
   "text.no other user yet": "no other user yet",
+  "text.no passkey yet": "No passkeys yet.",
   "text.no privilege declared in this deployment": "No privilege is declared in this deployment yet, so there is nothing to grant.",
   "text.no privilege granted": "grants nothing",
   "text.no role assigned": "no role assigned",
@@ -273,6 +279,7 @@
   "text.registered roles": "registered roles",
   "text.remaining time": "{days} days {hours} hours {mins} mins {secs} seconds remain",
   "text.remove the role from x people first": "To delete this role, first take it away from the {x} people who hold it.",
+  "text.removed passkey cannot sign in": "Once {{name}} is removed it can no longer sign you in.",
   "text.revoking stops every token this appliance holds": "this appliance stops being able to reach the system from the next request. nothing it holds keeps working, and issuing a new access token is the only way back.",
   "text.role belongs to x domain and is edited there": "This role is defined in {x} and can only be edited there. It is shown here because it can be granted here.",
   "text.role_management": "role management",
@@ -345,7 +352,9 @@
   "title.open attributes view": "open attributes view",
   "title.owner_transfer": "owner transfer",
   "title.partners": "partners",
+  "title.passkey offer": "Add a passkey",
   "title.protected-privileges": "protected privileges",
+  "title.remove passkey": "Remove passkey",
   "title.reset password": "reset password",
   "title.role privileges": "Role privileges",
   "title.secure-ip-list": "secured IP list",
@@ -413,6 +422,11 @@
   "access-request.text.denied lately": "denied on {at}: {reason}. to ask again, write what has changed.",
   "access-request.button.request": "request access…",
   "text.parent roles are changed by the parent domain": "roles of the parent domain can be changed only by someone who decides roles there.",
+  "text.passkey added on": "Added {{date}}",
+  "text.passkey already on this device": "This device already has your passkey.",
+  "text.passkey last used on": "last used {{date}}",
+  "text.passkey name": "Passkey name",
+  "text.passkey offer": "With a passkey on this device you sign in with your fingerprint, face or device PIN instead of a password. A passkey on your phone signs you in on other computers too.",
   "access-request.issue.role-belongs-to-parent": "{role} belongs to the parent domain - only someone who decides roles there can give it.",
   "access-request.dock.intro title": "decide access requests with the assistant",
   "access-request.dock.intro subtitle": "it reads the waiting requests and drafts decisions; you press the card.",
@@ -451,6 +465,7 @@
   "audit.outcome.denied": "Refused",
   "audit.outcome.error": "Error",
   "audit.outcome.failed": "Failed",
+  "audit.method.passkey": "passkey",
   "audit.button.all-people": "All people",
   "audit.button.all-privileges": "All privileges",
   "audit.health.failures": "{count} not recorded (since {since})",
@@ -477,6 +492,7 @@
   "audit.kind.password.reset-by-admin": "Password reset",
   "audit.kind.credential.issue": "Credential reissued",
   "audit.kind.webauthn.register": "Passkey registered",
+  "audit.kind.webauthn.remove": "Passkey removed",
   "audit.kind.role.grant": "Role granted",
   "audit.kind.role.revoke": "Role revoked",
   "audit.kind.role.privilege.add": "Privilege added to role",

package/translations/es.json

@@ -1,6 +1,7 @@
 {
   "button.accept invitation": "aceptar invitación",
   "button.activate": "activar",
+  "button.add passkey": "Añadir una llave de acceso",
   "button.add what it can do": "Añadir lo que puede hacer",
   "button.close": "Cerrar",
   "button.confirm": "confirmar",
@@ -13,15 +14,18 @@
   "button.delete this appliance": "eliminar este dispositivo",
   "button.delete user": "eliminar usuario",
   "button.detail": "detalle",
+  "button.do not ask on this device": "No volver a preguntar en este dispositivo",
   "button.drop": "Quitar",
   "button.edit privileges": "Editar privilegios",
   "button.generate new access token": "generar nuevo token de acceso",
   "button.generate new secret": "generar nuevo secreto",
   "button.go to home": "ir al inicio",
   "button.hide": "ocultar",
+  "button.later": "Más tarde",
   "button.logout": "cerrar sesión",
   "button.name it yourself": "asignar nombre manualmente",
   "button.register": "registrar",
+  "button.register on this device": "Registrar en este dispositivo",
   "button.remove from domain": "Quitar del dominio",
   "button.remove owner": "quitar propietario",
   "button.renew access token": "renovar token de acceso",
@@ -29,11 +33,11 @@
   "button.reveal": "mostrar",
   "button.revoke credential": "revocar credencial",
   "button.save": "guardar",
-  "button.security-key registration": "registro de llave de seguridad",
   "button.show-all": "Mostrar todo",
   "button.show-orphans-only": "Mostrar solo huérfanos",
   "button.sign in": "iniciar sesión",
   "button.sign_in": "iniciar sesión",
+  "button.signin with passkey": "Iniciar sesión con una llave de acceso",
   "button.stand it here": "colocarlo aquí",
   "button.submit": "enviar",
   "button.terminate contract": "rescindir",
@@ -143,6 +147,7 @@
   "label.locked-user": "bloqueado",
   "label.login_history": "historial de inicio de sesión",
   "label.ours": "Propios",
+  "label.passkey": "Llave de acceso",
   "label.password": "contraseña",
   "label.privilege": "privilegio",
   "label.protected-request-ip": "IP de solicitud segura",
@@ -244,6 +249,7 @@
   "text.no domain available": "no hay ningún dominio disponible",
   "text.no one holds this role yet": "Nadie tiene este rol todavía.",
   "text.no other user yet": "todavía no hay otros usuarios",
+  "text.no passkey yet": "Aún no hay llaves de acceso.",
   "text.no privilege declared in this deployment": "Todavía no se ha declarado ningún privilegio en esta implantación, así que no hay nada que conceder.",
   "text.no privilege granted": "no concede nada",
   "text.no role assigned": "sin rol asignado",
@@ -273,6 +279,7 @@
   "text.registered roles": "roles registrados",
   "text.remaining time": "quedan {days} días {hours} horas {mins} minutos {secs} segundos",
   "text.remove the role from x people first": "Para eliminar este rol, quíteselo primero a las {x} personas que lo tienen.",
+  "text.removed passkey cannot sign in": "Después de eliminar {{name}} ya no podrás iniciar sesión con ella.",
   "text.revoking stops every token this appliance holds": "este dispositivo dejará de poder acceder al sistema a partir de la siguiente solicitud. nada de lo que tiene seguirá funcionando, y la única forma de recuperar el acceso es emitir un nuevo token de acceso.",
   "text.role belongs to x domain and is edited there": "Este rol está definido en {x} y solo se puede editar allí. Se muestra aquí porque se puede conceder aquí.",
   "text.role_management": "gestión de roles",
@@ -345,7 +352,9 @@
   "title.open attributes view": "abrir vista de atributos",
   "title.owner_transfer": "transferencia de propiedad",
   "title.partners": "socios",
+  "title.passkey offer": "Añadir una llave de acceso",
   "title.protected-privileges": "privilegios protegidos",
+  "title.remove passkey": "Eliminar llave de acceso",
   "title.reset password": "restablecer contraseña",
   "title.role privileges": "Privilegios del rol",
   "title.secure-ip-list": "lista de IP seguras",
@@ -413,6 +422,11 @@
   "access-request.text.denied lately": "rechazada el {at}: {reason}. para volver a solicitarlo, indique qué ha cambiado.",
   "access-request.button.request": "solicitar acceso…",
   "text.parent roles are changed by the parent domain": "los roles del dominio principal solo los puede cambiar quien decide los roles allí.",
+  "text.passkey added on": "Añadida el {{date}}",
+  "text.passkey already on this device": "Este dispositivo ya tiene tu llave de acceso.",
+  "text.passkey last used on": "último uso el {{date}}",
+  "text.passkey name": "Nombre de la llave de acceso",
+  "text.passkey offer": "Con una llave de acceso en este dispositivo inicias sesión con tu huella, tu cara o el PIN del dispositivo en lugar de la contraseña. Una llave de acceso en tu teléfono también te permite iniciar sesión en otros ordenadores.",
   "access-request.issue.role-belongs-to-parent": "{role} pertenece al dominio principal - solo quien decide los roles allí puede concederlo.",
   "access-request.dock.intro title": "resuelva solicitudes de acceso con el asistente",
   "access-request.dock.intro subtitle": "lee las solicitudes pendientes y redacta las decisiones; usted pulsa la tarjeta.",
@@ -451,6 +465,7 @@
   "audit.outcome.denied": "Rechazado",
   "audit.outcome.error": "Error",
   "audit.outcome.failed": "Fallido",
+  "audit.method.passkey": "llave de acceso",
   "audit.button.all-people": "Todas las personas",
   "audit.button.all-privileges": "Todos los privilegios",
   "audit.health.failures": "{count} sin registrar (desde {since})",
@@ -477,6 +492,7 @@
   "audit.kind.password.reset-by-admin": "Restablecimiento de contraseña",
   "audit.kind.credential.issue": "Credencial reemitida",
   "audit.kind.webauthn.register": "Llave de acceso registrada",
+  "audit.kind.webauthn.remove": "Llave de acceso eliminada",
   "audit.kind.role.grant": "Rol concedido",
   "audit.kind.role.revoke": "Rol retirado",
   "audit.kind.role.privilege.add": "Privilegio añadido al rol",