@wtfalch/auth 0.13.0 → 0.15.0

package/dist/auth.d.ts

@@ -131,15 +131,21 @@ export interface Completed {
     location: string;
     cookies: SetCookie[];
 }
-/** A person signed in from a link rather than from a flow the browser started. */
-export type SignedIn = {
+/**
+ * A person signed in without the browser driving the flow -- from a link, a
+ * password reset, or headless credentials. `E` is whichever entry point's
+ * own error vocabulary applies: `ResetError` for a link or reset code (the
+ * default, so `followLink` and `resetPassword` are unchanged), `SignInError`
+ * for a password.
+ */
+export type SignedIn<E = ResetError> = {
     ok: true;
     location: string;
     cookies: SetCookie[];
     hosted?: true;
 } | {
     ok: false;
-    error: ResetError;
+    error: E;
     message: string;
 };
 export interface QrSignInStart {
@@ -202,6 +208,21 @@ export interface Auth {
         code: string;
         next?: string;
     }, requestHeaders?: Headers): Promise<SignedIn>;
+    /**
+     * `signIn` as data, for a caller with no browser to carry through the OIDC
+     * redirect -- a CLI, a desktop app, or a server signing in on a person's
+     * behalf. There is no `authRequestId` to receive, because this runs its
+     * own transaction and finishes it itself: `ok: true` already carries the
+     * session, with no `complete()` call left to make. The same two checks as
+     * `followLink` apply -- an `ok: true` with an empty `cookies` means the
+     * issuer handed off to hosted login, and the cookie name is fixed, so the
+     * caller decides where the session goes.
+     */
+    signInWithPassword(input: {
+        email: string;
+        password: string;
+        next?: string;
+    }, requestHeaders?: Headers): Promise<SignedIn<SignInError>>;
     /** Emails a fresh verification link. Says nothing about whether the address exists. */
     resendVerification(email: string, next?: string): Promise<void>;
     /** Emails a password-reset link to {basePath}/reset?userId=&code=. Says nothing about whether the address exists. */

package/dist/auth.js

@@ -541,6 +541,25 @@ export function createAuth(input) {
             return { ok: false, error: signInError(error) };
         }
     };
+    const signInWithPassword = async ({ email, password, next }, requestHeaders) => {
+        try {
+            const flow = await serverFlow();
+            const completed = await finishOrHandoff(() => broker().signIn({ authRequestId: flow.id, email, password }), flow, safeNextPath(next, options().afterLogin), requestHeaders);
+            emit({ type: 'signIn', email });
+            return { ok: true, ...completed };
+        }
+        catch (error) {
+            const code = signInError(error);
+            // `signInError` collapses everything the broker can say into one of
+            // four codes; only a real `BrokerError` carries a sentence worth
+            // showing; a transient failure gets the same generic message every
+            // other headless entry point uses for `unavailable`.
+            const message = code !== 'unavailable' && error instanceof BrokerError
+                ? (error.detail ?? error.error)
+                : 'the sign-in service did not answer';
+            return { ok: false, error: code, message };
+        }
+    };
     const signUp = async ({ authRequestId, ...user }) => {
         try {
             const redirectTo = await broker().signUp({ authRequestId, ...user });
@@ -814,6 +833,7 @@ export function createAuth(input) {
         endSession,
         authRequest,
         signIn,
+        signInWithPassword,
         signUp,
         startPasskeyRegistration,
         finishPasskeyRegistration,

package/dist/namespace-session.js

@@ -248,11 +248,30 @@ export function namespaceSessions(deps) {
                 .catch(() => { });
             return stillValid ? leased : null;
         }
-        const committed = await store().advance(key, generation, {
-            payload: await seal(key, fresh),
-            expiresAt: now() + options().sessionMaxAge,
-            leaseUntil: null,
-        });
+        let committed;
+        try {
+            committed = await store().advance(key, generation, {
+                payload: await seal(key, fresh),
+                expiresAt: now() + options().sessionMaxAge,
+                leaseUntil: null,
+            });
+        }
+        catch (error) {
+            // The commit itself threw (a store outage): the lease is still held.
+            // Best-effort release it, as the still-valid path above already does,
+            // so the session does not stay locked out for up to LEASE_SECONDS, and
+            // revoke a rotated refresh token that was never stored.
+            await store()
+                .advance(key, generation, {
+                payload: record.payload,
+                expiresAt: record.expiresAt,
+                leaseUntil: null,
+            })
+                .catch(() => { });
+            if (fresh.refreshToken !== tokens.rt)
+                revokeToken(fresh.refreshToken);
+            throw error;
+        }
         if (!committed) {
             // Revoked while we asked, or our lease ran out and another request took
             // over. These tokens are kept nowhere, so they are not left live.
@@ -351,11 +370,31 @@ export function namespaceSessions(deps) {
             // does for the same case.
             throw error;
         }
-        const committed = await store().advance(key, generation, {
-            payload: await seal(key, fresh),
-            expiresAt: now() + options().sessionMaxAge,
-            leaseUntil: null,
-        });
+        let committed;
+        try {
+            committed = await store().advance(key, generation, {
+                payload: await seal(key, fresh),
+                expiresAt: now() + options().sessionMaxAge,
+                leaseUntil: null,
+            });
+        }
+        catch (error) {
+            // The commit itself threw (a store outage): the lease is still held.
+            // Best-effort release it, as the still-valid path in `refreshLeased`
+            // does, so the session does not stay locked out for up to
+            // LEASE_SECONDS, and revoke a rotated refresh token that was never
+            // stored.
+            await store()
+                .advance(key, generation, {
+                payload: record.payload,
+                expiresAt: record.expiresAt,
+                leaseUntil: null,
+            })
+                .catch(() => { });
+            if (fresh.refreshToken !== tokens.rt)
+                revokeToken(fresh.refreshToken);
+            throw error;
+        }
         if (!committed) {
             // Revoked while the grant was in flight, or the lease ran out and
             // another request took over. The fresh tokens are kept nowhere, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",