@voult/core 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to `@voult/core` are documented here.
 
+## 0.3.1
+
+- New route `POST /user/password` (`{ password }`): a user who signed up with Google or GitHub adds a password, so email + password sign-in works too. Checked against the password rule before Voult is called.
+- New route `GET /user/activity?limit=20&skip=0`: the signed-in user's own audit log (sign-ins, MFA and password changes, …), newest first.
+- `@voult/express` and `@voult/next` get both with a fresh install (they depend on `^0.3.0`).
+
 ## 0.3.0
 
 - **Breaking: error codes are the Voult API's.** A failed request now answers with the API's catalog code (`INVALID_CREDENTIALS`, `USER_EXISTS`, `WEAK_PASSWORD`, see ERRORS.md) instead of the SDK's category (`AUTHENTICATION_ERROR`, `CONFLICT_ERROR`, `VALIDATION_ERROR`). Errors raised by the router itself keep their codes (`AUTHENTICATION_ERROR` for "Authentication required", `INVALID_JSON`, `PAYLOAD_TOO_LARGE`). If you branch on `code`, switch to the catalog codes; branching on `status` is unaffected.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voult/core",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "The Voult auth router on the Fetch API (Request \u2192 Response), shared by @voult/express and @voult/next",
   "type": "module",
   "main": "./src/index.js",

package/src/routes.js

@@ -9,6 +9,7 @@ import {
   getMfaStatus,
   regenerateMfaBackupCodes,
   revokeSession,
+  setPassword,
   setupMfa,
   unlinkOAuthProvider,
   refreshSession,
@@ -195,6 +196,16 @@ export const authRoutes = [
     json(await unlinkOAuthProvider(ctx.params.provider, ctx.client))
   ))],
 
+  // Signed up with Google/GitHub only: add a password, so email + password sign-in works too.
+  ['POST', '/user/password', authenticated(async (ctx) => json(await setPassword(ctx.body.password, ctx.client)))],
+
+  // The user's own activity (sign-ins, MFA and password changes, …), newest first. ?limit=&skip=
+  // (No SDK function for it yet, so the client calls the API path directly.)
+  ['GET', '/user/activity', authenticated(async (ctx) => json(await ctx.client.get('/api/audit-logs/me', {
+    requireAuth: true,
+    params: { limit: ctx.query('limit') ?? '20', skip: ctx.query('skip') ?? '0' },
+  })))],
+
   // Voult disables the account (it can be re-enabled), and this browser is signed out.
   ['DELETE', '/user/me', authenticated(async (ctx) => {
     const result = await deleteUser(ctx.client);