@wtfalch/auth 0.14.0 → 0.15.0

package/dist/auth.d.ts

@@ -131,15 +131,21 @@ export interface Completed {
     location: string;
     cookies: SetCookie[];
 }
-/** A person signed in from a link rather than from a flow the browser started. */
-export type SignedIn = {
+/**
+ * A person signed in without the browser driving the flow -- from a link, a
+ * password reset, or headless credentials. `E` is whichever entry point's
+ * own error vocabulary applies: `ResetError` for a link or reset code (the
+ * default, so `followLink` and `resetPassword` are unchanged), `SignInError`
+ * for a password.
+ */
+export type SignedIn<E = ResetError> = {
     ok: true;
     location: string;
     cookies: SetCookie[];
     hosted?: true;
 } | {
     ok: false;
-    error: ResetError;
+    error: E;
     message: string;
 };
 export interface QrSignInStart {
@@ -202,6 +208,21 @@ export interface Auth {
         code: string;
         next?: string;
     }, requestHeaders?: Headers): Promise<SignedIn>;
+    /**
+     * `signIn` as data, for a caller with no browser to carry through the OIDC
+     * redirect -- a CLI, a desktop app, or a server signing in on a person's
+     * behalf. There is no `authRequestId` to receive, because this runs its
+     * own transaction and finishes it itself: `ok: true` already carries the
+     * session, with no `complete()` call left to make. The same two checks as
+     * `followLink` apply -- an `ok: true` with an empty `cookies` means the
+     * issuer handed off to hosted login, and the cookie name is fixed, so the
+     * caller decides where the session goes.
+     */
+    signInWithPassword(input: {
+        email: string;
+        password: string;
+        next?: string;
+    }, requestHeaders?: Headers): Promise<SignedIn<SignInError>>;
     /** Emails a fresh verification link. Says nothing about whether the address exists. */
     resendVerification(email: string, next?: string): Promise<void>;
     /** Emails a password-reset link to {basePath}/reset?userId=&code=. Says nothing about whether the address exists. */

package/dist/auth.js

@@ -541,6 +541,25 @@ export function createAuth(input) {
             return { ok: false, error: signInError(error) };
         }
     };
+    const signInWithPassword = async ({ email, password, next }, requestHeaders) => {
+        try {
+            const flow = await serverFlow();
+            const completed = await finishOrHandoff(() => broker().signIn({ authRequestId: flow.id, email, password }), flow, safeNextPath(next, options().afterLogin), requestHeaders);
+            emit({ type: 'signIn', email });
+            return { ok: true, ...completed };
+        }
+        catch (error) {
+            const code = signInError(error);
+            // `signInError` collapses everything the broker can say into one of
+            // four codes; only a real `BrokerError` carries a sentence worth
+            // showing; a transient failure gets the same generic message every
+            // other headless entry point uses for `unavailable`.
+            const message = code !== 'unavailable' && error instanceof BrokerError
+                ? (error.detail ?? error.error)
+                : 'the sign-in service did not answer';
+            return { ok: false, error: code, message };
+        }
+    };
     const signUp = async ({ authRequestId, ...user }) => {
         try {
             const redirectTo = await broker().signUp({ authRequestId, ...user });
@@ -814,6 +833,7 @@ export function createAuth(input) {
         endSession,
         authRequest,
         signIn,
+        signInWithPassword,
         signUp,
         startPasskeyRegistration,
         finishPasskeyRegistration,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",