@turnkey/sdk-react 5.1.0 → 5.2.1

package/CHANGELOG.md

@@ -1,9 +1,35 @@
 # @turnkey/sdk-react
 
+## 5.2.1
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @turnkey/crypto@2.4.0
+  - @turnkey/sdk-browser@5.2.1
+  - @turnkey/sdk-server@4.1.1
+  - @turnkey/wallet-stamper@1.0.4
+
+## 5.2.0
+
+### Minor Changes
+
+- [#632](https://github.com/tkhq/sdk/pull/632) [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a) Author [@amircheikh](https://github.com/amircheikh) - Added optional `socialLinking` boolean to the `authConfig`. If true, this will enable social linking for new Google <-> Gmail users. For more information on social linking, visit [our docs](https://docs.turnkey.com/authentication/social-logins#social-linking).
+
+### Patch Changes
+
+- Updated dependencies [[`5afbe51`](https://github.com/tkhq/sdk/commit/5afbe51949bdd1997fad083a4c1e4272ff7409dc), [`10ee5c5`](https://github.com/tkhq/sdk/commit/10ee5c524b477ce998e4fc635152cd101ae5a9cc), [`a38a6e3`](https://github.com/tkhq/sdk/commit/a38a6e36dc2bf9abdea64bc817d1cad95b8a289a), [`40c4035`](https://github.com/tkhq/sdk/commit/40c40359ec7096d0bca39ffc93e89361b3b11a1a), [`593de2d`](https://github.com/tkhq/sdk/commit/593de2d9404ec8cf53426f9cf832c13eefa3fbf2)]:
+  - @turnkey/sdk-browser@5.2.0
+  - @turnkey/wallet-stamper@1.0.4
+  - @turnkey/crypto@2.4.0
+  - @turnkey/sdk-server@4.1.0
+
 ## 5.1.0
 
 ### Minor Changes
 
+- Update @turnkey/sdk-types readme and install dependency in packages with common types
+
 - [#650](https://github.com/tkhq/sdk/pull/650) [`27fe590`](https://github.com/tkhq/sdk/commit/27fe590cdc3eb6a8cde093eeefda2ee1cdc79412) Author [@turnekybc](https://github.com/turnekybc) - Update @turnkey/sdk-types readme and install dependency in packages with common types
 
 ### Patch Changes

package/README.md

@@ -121,6 +121,7 @@ function AuthPage() {
     googleEnabled: true,
     appleEnabled: false,
     facebookEnabled: false,
+    socialLinking: true, // Enable social linking
     sessionLengthSeconds: 3600, //1 hour r/w session
   };
 

package/dist/components/auth/Auth.d.ts

@@ -20,6 +20,7 @@ interface AuthProps {
         googleEnabled: boolean;
         walletEnabled: boolean;
         openOAuthInPage?: boolean;
+        socialLinking?: boolean;
         sessionLengthSeconds?: number;
         googleClientId?: string;
         appleClientId?: string;

package/dist/components/auth/Auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../../src/components/auth/Auth.tsx"],"names":[],"mappings":"AAGA,OAAO,KAA8B,MAAM,OAAO,CAAC;AAcnD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI3E,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAoCD,UAAU,SAAS;IACjB,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,CAAC;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,YAAY,EAAE,OAAO,CAAC;QACtB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,aAAa,EAAE,OAAO,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,CAAC,EAAE,eAAe,CAAC,4BAA4B,CAAC,CAAC;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,QAAA,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CA4pB7B,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../../src/components/auth/Auth.tsx"],"names":[],"mappings":"AAGA,OAAO,KAA8B,MAAM,OAAO,CAAC;AAenD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI3E,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAoCD,UAAU,SAAS;IACjB,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,UAAU,EAAE;QACV,YAAY,EAAE,OAAO,CAAC;QACtB,cAAc,EAAE,OAAO,CAAC;QACxB,YAAY,EAAE,OAAO,CAAC;QACtB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;QACzB,aAAa,EAAE,OAAO,CAAC;QACvB,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,CAAC,EAAE,eAAe,CAAC,4BAA4B,CAAC,CAAC;IACnE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,QAAA,MAAM,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,CAquB7B,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/components/auth/Auth.js

@@ -7,6 +7,7 @@ var jsxRuntime = require('react/jsx-runtime');
 var Auth_module = require('./Auth.module.css.js');
 var React = require('react');
 var PhoneInput = require('./PhoneInput.js');
+var jwtDecode = require('jwt-decode');
 var Google = require('./Google.js');
 var Apple = require('./Apple.js');
 var Facebook = require('./Facebook.js');
@@ -226,44 +227,97 @@ const Auth = ({
     }
     setLoading(undefined);
   };
-  const handleOAuthLogin = async (credential, providerName) => {
+  const handleOAuthLogin = async (credential, providerName, socialLinking = false) => {
     const pubKey = await indexedDbClient?.getPublicKey();
     if (!pubKey) {
       return;
     }
     setOauthLoading(providerName);
-    const createSuborgData = {
-      oauthProviders: [{
-        providerName,
-        oidcToken: credential
-      }]
+    const oauthProviders = [{
+      providerName,
+      oidcToken: credential
+    }];
+    let createSuborgData = {
+      oauthProviders,
+      ...(customAccounts && {
+        customAccounts
+      })
     };
-    if (customAccounts) {
-      createSuborgData.customAccounts = customAccounts;
-    }
-    const resp = await sdkServer.server.getOrCreateSuborg({
-      filterType: constants.FilterType.OidcToken,
-      filterValue: credential,
-      additionalData: createSuborgData
-    });
-    const suborgIds = resp?.subOrganizationIds;
-    if (!suborgIds || suborgIds.length === 0) {
+    const completeLogin = async suborgID => {
+      const sessionResponse = await sdkServer.server.oauthLogin({
+        suborgID,
+        oidcToken: credential,
+        publicKey: pubKey,
+        sessionLengthSeconds: authConfig.sessionLengthSeconds
+      });
+      if (sessionResponse?.session) {
+        await indexedDbClient.loginWithSession(sessionResponse.session);
+        return onAuthSuccess();
+      }
       onError(constants.authErrors.oauth.loginFailed);
-      return;
+    };
+    // Non-social-linking path: getOrCreateSuborg then login
+    if (!socialLinking) {
+      const resp = await sdkServer.server.getOrCreateSuborg({
+        filterType: constants.FilterType.OidcToken,
+        filterValue: credential,
+        additionalData: createSuborgData
+      });
+      const suborgIds = resp?.subOrganizationIds;
+      if (!suborgIds?.length) {
+        return onError(constants.authErrors.oauth.loginFailed);
+      }
+      return completeLogin(suborgIds[0]);
     }
-    const suborgId = suborgIds[0];
-    const sessionResponse = await sdkServer.server.oauthLogin({
-      suborgID: suborgId,
-      oidcToken: credential,
-      publicKey: pubKey,
-      sessionLengthSeconds: authConfig.sessionLengthSeconds
-    });
-    if (sessionResponse && sessionResponse.session) {
-      await indexedDbClient.loginWithSession(sessionResponse.session);
-      await onAuthSuccess();
-    } else {
-      onError(constants.authErrors.oauth.loginFailed);
+    // Social-linking path
+    // See if there's already a suborg tied to this token
+    const oidcOrgIds = (await sdkServer.server.getSuborgs({
+      filterType: constants.FilterType.OidcToken,
+      filterValue: credential
+    }))?.organizationIds;
+    let orgId = oidcOrgIds?.[0];
+    // If not, try to link by verified email (Google only)
+    if (!orgId) {
+      const {
+        email: oidcEmail,
+        iss
+      } = jwtDecode.jwtDecode(credential) || {};
+      createSuborgData = {
+        email: oidcEmail,
+        oauthProviders,
+        ...(customAccounts && {
+          customAccounts
+        })
+      };
+      if (oidcEmail && iss === "https://accounts.google.com") {
+        const emailOrgIds = (await sdkServer.server.getVerifiedSuborgs({
+          filterType: constants.FilterType.Email,
+          filterValue: oidcEmail
+        }))?.organizationIds;
+        if (emailOrgIds?.[0]) {
+          orgId = emailOrgIds[0];
+          // attach this new OIDC provider to the existing user
+          const userId = (await sdkServer.server.getUsers({
+            organizationId: orgId
+          }))?.users?.[0]?.userId;
+          if (!userId) {
+            return onError(constants.authErrors.oauth.loginFailed);
+          }
+          await sdkServer.server.createOauthProviders({
+            organizationId: orgId,
+            userId,
+            oauthProviders
+          });
+        } else {
+          // No orgs with the email. Create brand new suborg
+          orgId = (await sdkServer.server.createSuborg(createSuborgData))?.subOrganizationId;
+        }
+      } else {
+        // Non-Google or no email in OIDC. Create new suborg
+        orgId = (await sdkServer.server.createSuborg(createSuborgData))?.subOrganizationId;
+      }
     }
+    return orgId ? completeLogin(orgId) : onError(constants.authErrors.oauth.loginFailed);
   };
   const handleLoginWithWallet = async () => {
     setLoading("wallet");
@@ -341,17 +395,17 @@ const Auth = ({
         layout: layout,
         clientId: authConfig.googleClientId ?? process.env.NEXT_PUBLIC_GOOGLE_CLIENT_ID,
         openInPage: authConfig.openOAuthInPage,
-        onSuccess: response => handleOAuthLogin(response.idToken, "Google")
+        onSuccess: response => handleOAuthLogin(response.idToken, "Google", authConfig.socialLinking)
       }), appleEnabled && jsxRuntime.jsx(Apple.default, {
         layout: layout,
         clientId: authConfig.appleClientId ?? process.env.NEXT_PUBLIC_APPLE_CLIENT_ID,
         openInPage: authConfig.openOAuthInPage,
-        onSuccess: response => handleOAuthLogin(response.idToken, "Apple")
+        onSuccess: response => handleOAuthLogin(response.idToken, "Apple") // No need to pass socialLinking for Apple. It's not supported
       }), facebookEnabled && jsxRuntime.jsx(Facebook.default, {
         layout: layout,
         clientId: authConfig.facebookClientId ?? process.env.NEXT_PUBLIC_FACEBOOK_CLIENT_ID,
         openInPage: authConfig.openOAuthInPage,
-        onSuccess: response => handleOAuthLogin(response.id_token, "Facebook")
+        onSuccess: response => handleOAuthLogin(response.id_token, "Facebook") // No need to pass socialLinking for Facebook. It's not supported
       })]
     });
   };