@wtfalch/auth 0.23.0 → 0.25.0

package/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import { type JWTPayload } from 'jose';
+import type { JWTPayload } from 'jose';
 import { type AuthRequest, type NewUser, type PeoplePage } from './broker.js';
 import { type AccessTokenResult, type AuthOptions } from './config.js';
 import { type SetCookie } from './cookies.js';
@@ -28,7 +28,7 @@ export interface User {
     claims: JWTPayload;
 }
 export interface ReadResult {
-    /** A cookie exists for another binding/revision or cannot be opened. Do not auto-switch. */
+    /** @deprecated Never set. A cookie that cannot be opened (another binding's, an older revision's) reads as no session. */
     accountChanged?: true;
     /** Namespace mode: the binding is suspended or its status cannot be confirmed. Do not start a sign-in. */
     unavailable?: true;
@@ -287,6 +287,8 @@ export interface Auth {
         givenName: string;
         familyName: string;
         next?: string;
+        /** See `NewUser['personalEmail']`. */
+        personalEmail?: string;
     }): Promise<{
         userId: string;
         invited: boolean;
@@ -323,7 +325,7 @@ export interface Auth {
      * `maxAge` becomes OIDC `max_age`: the issuer re-authenticates anybody whose
      * last authentication is older than that many seconds.
      */
-    startUrl(next?: string | null, intent?: Intent, prompt?: Prompt, maxAge?: MaxAge): string;
+    startUrl(next?: string | null, intent?: Intent, prompt?: Prompt, maxAge?: MaxAge, loginHint?: string): string;
     /**
      * Whether `user` authenticated within `maxAge` seconds. A user with no
      * `authTime` is never fresh: the issuer only has to send the claim when the
@@ -419,8 +421,8 @@ export interface Auth {
     /**
      * Starts registering a passkey on this app's own domain, for whoever is
      * signed in on `request` -- never for a stranger. Throws `AuthError` when
-     * nobody is: `account_changed`/`unavailable` exactly as `read` reports
-     * them, `unauthenticated` otherwise.
+     * nobody is: `unavailable` exactly as `read` reports it,
+     * `unauthenticated` otherwise.
      */
     startPasskeyRegistration(request: Request): Promise<PasskeyRegistrationStart>;
     /** The second half of `startPasskeyRegistration`. Same signed-in requirement. */

package/dist/auth.js

@@ -1,12 +1,12 @@
-import { errors } from 'jose';
 import * as client from 'openid-client';
 import { Broker, BrokerError } from './broker.js';
 import { resolveOptions, } from './config.js';
 import { clearQrTransaction, clearSession, clearTransaction, cookieFrom, openQrTransaction, openRecord, openSession, openSilent, openTransaction, qrTransactionCookieName, sealQrTransaction, sealSession, sealSilent, sealTransaction, sessionCookieName, silentCookieName, transactionCookieName, } from './cookies.js';
 import { namespaceSessions } from './namespace-session.js';
-import { AuthError, ORG_CLAIM, Oidc, isOAuthRefusal, scopeFor } from './oidc.js';
+import { AuthError, ORG_CLAIM, Oidc, isOAuthRefusal, rejected, scopeFor, } from './oidc.js';
 import { pollDeviceToken, requestDeviceAuthorization } from './qr.js';
-import { safeNextPath } from './redirect.js';
+import { safeLoginHint, safeNextPath } from './redirect.js';
+import { expiryOf, issuedAtOf, timeoutSignal } from './util.js';
 export function createAuth(input) {
     // Resolved on first use so `next build`, which imports every route module, needs none of the values set.
     let resolved = null;
@@ -77,9 +77,19 @@ export function createAuth(input) {
         return brokerInstance;
     };
     const sessions = namespaceSessions({ options, oidc, broker });
-    const sessionCookie = (tokens, requestHeaders) => options().namespace
-        ? sessions.create(tokens, requestHeaders)
-        : sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+    // Every way in ends here, so this is the one place that reports a sign-in.
+    const sessionCookie = async (tokens, requestHeaders) => {
+        const cookie = options().namespace
+            ? await sessions.create(tokens, requestHeaders)
+            : await sealSession(options(), { idt: tokens.idToken, rt: tokens.refreshToken });
+        const email = tokens.claims.email;
+        emit({
+            type: 'signIn',
+            email: typeof email === 'string' ? email : '',
+            userId: String(tokens.claims.sub),
+        });
+        return cookie;
+    };
     /**
      * Signing in again replaces this binding's previous session outright: in
      * namespace mode, ends whatever session record `cookieHeader` already
@@ -94,7 +104,7 @@ export function createAuth(input) {
             .catch((error) => console.error('@wtfalch/auth: could not end the replaced session', error));
     };
     const unavailable = () => new Response('Sign-in is unavailable for this workspace', { status: 503 });
-    const startUrl = (next, intent = 'login', prompt, maxAge) => {
+    const startUrl = (next, intent = 'login', prompt, maxAge, loginHint) => {
         const url = new URL(`${options().basePath}/start`, options().appUrl);
         const path = safeNextPath(next, '');
         if (path)
@@ -107,6 +117,9 @@ export function createAuth(input) {
             assertMaxAge(maxAge);
             url.searchParams.set('max_age', String(maxAge));
         }
+        const hint = safeLoginHint(loginHint);
+        if (hint)
+            url.searchParams.set('login_hint', hint);
         return url.href;
     };
     const fresh = (user, maxAge) => {
@@ -128,7 +141,8 @@ export function createAuth(input) {
         const silent = (await openSilent(options(), cookieFrom(request.headers.get('cookie'), silentCookieName(options())))) === 'try' &&
             !params.has('intent') &&
             !params.has('prompt') &&
-            !params.has('max_age');
+            !params.has('max_age') &&
+            !params.has('login_hint');
         const state = client.randomState();
         const nonce = client.randomNonce();
         const codeVerifier = client.randomPKCECodeVerifier();
@@ -136,6 +150,7 @@ export function createAuth(input) {
             create: params.get('intent') === 'register',
             prompt: silent ? 'none' : promptFrom(params.get('prompt')),
             maxAge: maxAgeFrom(params.get('max_age')),
+            loginHint: safeLoginHint(params.get('login_hint')),
         });
         const transaction = await sealTransaction(options(), {
             st: state,
@@ -263,9 +278,7 @@ export function createAuth(input) {
             // `sessions.end` reaches the store, which can be briefly unreachable --
             // and a sign-out that 500s over that leaves the browser's own cookie
             // standing, which is worse than the record surviving a moment longer.
-            const status = await sessions.end(value).catch(() => 'ended');
-            if (status === 'changed')
-                return new Response('Account changed', { status: 409 });
+            await sessions.end(value).catch(() => { });
             return endIssuerSession(idToken, [clearSession(options())]);
         }
         const session = await openSession(options(), value);
@@ -330,8 +343,6 @@ export function createAuth(input) {
             const result = await sessions.read(value);
             if (result.kind === 'user')
                 return { user: boundUser(result.claims), cookies: [] };
-            if (result.kind === 'changed')
-                return { user: null, cookies: [], accountChanged: true };
             if (result.kind === 'unavailable')
                 return { user: null, cookies: [], unavailable: true };
             return { user: null, cookies: [] };
@@ -384,11 +395,9 @@ export function createAuth(input) {
         const isPublic = url.pathname === options().basePath ||
             url.pathname.startsWith(`${options().basePath}/`) ||
             matches(rules.public, url.pathname);
-        const { user, cookies, accountChanged, unavailable } = await read(request);
+        const { user, cookies, unavailable } = await read(request);
         if (user || isPublic)
             return { kind: 'next', user, cookies };
-        if (accountChanged)
-            return { kind: 'deny', cookies, reason: 'account_changed' };
         if (unavailable)
             return { kind: 'deny', cookies, reason: 'unavailable' };
         if (!isNavigation(request))
@@ -406,13 +415,11 @@ export function createAuth(input) {
     /**
      * The person signed in on `request`, for the passkey routes -- never a
      * stranger. Adapts `requireUser`'s reasons for a caller that throws rather
-     * than redirects: `account_changed`/`unavailable` are read's own, and
+     * than redirects: `unavailable` is read's own, and
      * plain absence becomes `unauthenticated`, which read has no reason for.
      */
     const currentUser = async (request) => {
-        const { user, accountChanged, unavailable } = await read(request, { refresh: false });
-        if (accountChanged)
-            throw new AuthError('account_changed', 'Choose an account to continue');
+        const { user, unavailable } = await read(request, { refresh: false });
         if (unavailable)
             throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
         if (!user)
@@ -479,8 +486,13 @@ export function createAuth(input) {
         const nonce = client.randomNonce();
         const verifier = client.randomPKCECodeVerifier();
         const target = await oidc().authorizationUrl(state, nonce, verifier);
-        const response = await options().fetch(target.href, { redirect: 'manual' });
+        const response = await options().fetch(target.href, {
+            redirect: 'manual',
+            signal: timeoutSignal(),
+        });
         const location = response.headers.get('location');
+        // Only the Location header is wanted; an unread body would hold the socket.
+        response.body?.cancel().catch(() => undefined);
         if (options().namespace &&
             location &&
             new URL(location, options().issuer).origin !== options().namespace?.loginOrigin)
@@ -503,7 +515,9 @@ export function createAuth(input) {
         return { location: new URL(next, options().appUrl).href, cookies: [cookie] };
     };
     const hostedUrl = (id) => {
-        const url = new URL('/login', options().namespace?.loginOrigin ?? options().issuer);
+        const url = options().namespace
+            ? new URL('/login', options().namespace?.loginOrigin)
+            : new URL('login', options().signInBase);
         url.searchParams.set('authRequest', id);
         return url.href;
     };
@@ -535,7 +549,13 @@ export function createAuth(input) {
     const requestPasswordReset = (email, next) => quietly(() => broker().sendReset(email, safeNextPath(next, '')));
     const sendLink = (email, next) => quietly(() => broker().sendLink(email, safeNextPath(next, '')));
     const invite = async (input) => {
-        const result = await broker().invite({ ...input, next: safeNextPath(input.next, '') });
+        const result = await broker().invite({
+            email: input.email,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            next: safeNextPath(input.next, ''),
+            personalEmail: input.personalEmail,
+        });
         emit({ type: 'invite', email: input.email, userId: result.userId, invited: result.invited });
         return result;
     };
@@ -611,14 +631,11 @@ export function createAuth(input) {
     const signIn = async ({ authRequestId, email, password, }) => {
         try {
             const redirectTo = await broker().signIn({ authRequestId, email, password });
-            emit({ type: 'signIn', email });
             return { ok: true, redirectTo };
         }
         catch (error) {
-            if (needsHostedLogin(error)) {
-                emit({ type: 'signIn', email });
+            if (needsHostedLogin(error))
                 return { ok: true, redirectTo: hostedUrl(authRequestId), hosted: true };
-            }
             const change = changeRequired(error);
             if (change)
                 return change;
@@ -657,7 +674,6 @@ export function createAuth(input) {
         try {
             const flow = await serverFlow();
             const completed = await finishOrHandoff(() => broker().signIn({ authRequestId: flow.id, email, password }), flow, safeNextPath(next, options().afterLogin), requestHeaders);
-            emit({ type: 'signIn', email });
             return { ok: true, ...completed };
         }
         catch (error) {
@@ -683,26 +699,7 @@ export function createAuth(input) {
             return { ok: true, ...completed };
         }
         catch (error) {
-            if (error instanceof BrokerError && error.error === 'email_taken') {
-                return { ok: false, error: 'email_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'registration_closed') {
-                return { ok: false, error: 'registration_closed', message: error.detail ?? error.error };
-            }
-            // Both carry a sentence about the name, for the form to show as it is.
-            if (error instanceof BrokerError && error.error === 'username_taken') {
-                return { ok: false, error: 'username_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'username_invalid') {
-                return { ok: false, error: 'username_invalid', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'request') {
-                return { ok: false, error: 'request', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.status < 500) {
-                return { ok: false, error: 'invalid', message: error.detail ?? error.error };
-            }
-            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+            return signUpFailure(error);
         }
     };
     const signUp = async ({ authRequestId, ...user }) => {
@@ -719,26 +716,7 @@ export function createAuth(input) {
             const change = changeRequired(error);
             if (change)
                 return { ...change, message: 'choose a new password to continue' };
-            if (error instanceof BrokerError && error.error === 'email_taken') {
-                return { ok: false, error: 'email_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'registration_closed') {
-                return { ok: false, error: 'registration_closed', message: error.detail ?? error.error };
-            }
-            // Both carry a sentence about the name, for the form to show as it is.
-            if (error instanceof BrokerError && error.error === 'username_taken') {
-                return { ok: false, error: 'username_taken', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'username_invalid') {
-                return { ok: false, error: 'username_invalid', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.error === 'request') {
-                return { ok: false, error: 'request', message: error.detail ?? error.error };
-            }
-            if (error instanceof BrokerError && error.status < 500) {
-                return { ok: false, error: 'invalid', message: error.detail ?? error.error };
-            }
-            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+            return signUpFailure(error);
         }
     };
     const startPasskeyRegistration = async (request) => {
@@ -799,7 +777,11 @@ export function createAuth(input) {
     const changePassword = async (request, input) => {
         const user = await currentFreshUser(request);
         try {
-            await broker().changePassword({ userId: user.id, ...input });
+            await broker().changePassword({
+                userId: user.id,
+                currentPassword: input.currentPassword,
+                newPassword: input.newPassword,
+            });
             return { ok: true };
         }
         catch (error) {
@@ -855,7 +837,7 @@ export function createAuth(input) {
         if (options().namespace && !(await sessions.bindingActive()))
             throw new AuthError('unavailable', 'the namespace binding is not active');
         const device = await requestDeviceAuthorization(options(), scopeFor(options().organizationId, options().extraScopes));
-        const cookie = await sealQrTransaction(options(), { dc: device.deviceCode, iv: device.interval }, device.expiresIn);
+        const cookie = await sealQrTransaction(options(), { dc: device.deviceCode }, device.expiresIn);
         return {
             url: qrVerificationUrl(options(), device.verificationUriComplete),
             userCode: device.userCode,
@@ -1025,28 +1007,6 @@ function matches(rule, pathname) {
         return pathname === entry;
     });
 }
-function expiryOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.exp === 'number' ? json.exp : null;
-    }
-    catch {
-        return null;
-    }
-}
-// Age, not time left: a disabled or revoked account must not ride out a
-// long-lived token just because it still has plenty of time on the clock.
-function issuedAtOf(idToken) {
-    try {
-        const [, payload] = idToken.split('.');
-        const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));
-        return typeof json.iat === 'number' ? json.iat : null;
-    }
-    catch {
-        return null;
-    }
-}
 const PROMPTS = ['select_account', 'login'];
 function promptFrom(raw) {
     return PROMPTS.includes(raw ?? '') ? raw : undefined;
@@ -1110,15 +1070,6 @@ function userFrom(claims) {
     };
 }
 // The token itself is bad, as opposed to the keys being unreachable or rotating.
-function rejected(error) {
-    return (error instanceof AuthError ||
-        error instanceof errors.JWTExpired ||
-        error instanceof errors.JWTClaimValidationFailed ||
-        error instanceof errors.JWSSignatureVerificationFailed ||
-        error instanceof errors.JWSInvalid ||
-        error instanceof errors.JWTInvalid ||
-        error instanceof errors.JOSEAlgNotAllowed);
-}
 function isNavigation(request) {
     const mode = request.headers.get('sec-fetch-mode');
     if (mode && mode !== 'navigate')
@@ -1172,6 +1123,23 @@ function signInError(error) {
         return 'invalid_credentials';
     return 'unavailable';
 }
+/** The sign-up refusals the broker can name, each with its own sentence for the form to show as it is. */
+function signUpFailure(error) {
+    if (error instanceof BrokerError) {
+        const message = error.detail ?? error.error;
+        switch (error.error) {
+            case 'email_taken':
+            case 'registration_closed':
+            case 'username_taken':
+            case 'username_invalid':
+            case 'request':
+                return { ok: false, error: error.error, message };
+        }
+        if (error.status < 500)
+            return { ok: false, error: 'invalid', message };
+    }
+    return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+}
 function reasonOf(error) {
     if (error instanceof AuthError)
         return error.reason;

package/dist/broker.js

@@ -1,3 +1,4 @@
+import { timeoutSignal } from './util.js';
 export class BrokerError extends Error {
     status;
     error;
@@ -34,7 +35,7 @@ export class Broker {
                 url.searchParams.set(k, String(v));
         const response = await this.options.fetch(url.href, {
             method,
-            signal,
+            signal: timeoutSignal(signal),
             headers: {
                 authorization: `Bearer ${this.options.appKey}`,
                 'content-type': 'application/json',
@@ -84,8 +85,16 @@ export class Broker {
         return callbackUrl;
     }
     async signUp(input) {
+        // Named fields: `input` can come from a form a client controls.
         const { callbackUrl } = await this.call('POST', '/sign-up', {
-            ...input,
+            authRequestId: input.authRequestId,
+            email: input.email,
+            password: input.password,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            username: input.username,
+            changeRequired: input.changeRequired,
+            personalEmail: input.personalEmail,
         });
         return callbackUrl;
     }
@@ -113,7 +122,13 @@ export class Broker {
         return callbackUrl;
     }
     invite(input) {
-        return this.call('POST', '/invite', input);
+        return this.call('POST', '/invite', {
+            email: input.email,
+            givenName: input.givenName,
+            familyName: input.familyName,
+            next: input.next,
+            personalEmail: input.personalEmail,
+        });
     }
     sendLink(email, next) {
         return this.call('POST', '/link/send', { email, next });
@@ -148,7 +163,11 @@ export class Broker {
         return this.call('POST', '/email/change/complete', { userId, code });
     }
     changePassword(input) {
-        return this.call('POST', '/password/change', input);
+        return this.call('POST', '/password/change', {
+            userId: input.userId,
+            currentPassword: input.currentPassword,
+            newPassword: input.newPassword,
+        });
     }
     passkeys(userId) {
         return this.call('GET', '/passkeys', { userId });
@@ -158,14 +177,26 @@ export class Broker {
     }
     /** A public client revoking its own token: no key, no service. */
     async revoke(refreshToken) {
-        await this.options.fetch(`${this.options.issuer}/oauth/v2/revoke`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/x-www-form-urlencoded' },
-            body: new URLSearchParams({
-                token: refreshToken,
-                token_type_hint: 'refresh_token',
-                client_id: this.options.clientId,
-            }),
-        });
+        let response;
+        try {
+            response = await this.options.fetch(`${this.options.issuer}/oauth/v2/revoke`, {
+                method: 'POST',
+                signal: timeoutSignal(),
+                headers: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    token: refreshToken,
+                    token_type_hint: 'refresh_token',
+                    client_id: this.options.clientId,
+                }),
+            });
+        }
+        catch (error) {
+            console.error('@wtfalch/auth: the revoke request failed', error instanceof Error ? error.name : 'unknown');
+            throw error;
+        }
+        if (!response.ok) {
+            console.error('@wtfalch/auth: the issuer refused to revoke a refresh token', response.status);
+            throw new BrokerError(response.status, 'unavailable', 'the issuer did not revoke the token');
+        }
     }
 }

package/dist/browser.d.ts

@@ -125,8 +125,9 @@ export type RefreshOutcome = {
     kind: 'no-refresh-token';
 }
 /**
- * The issuer refused rotation, or this operation was cancelled. An issuer
- * refusal drops the held session because the old refresh token was spent.
+ * The issuer refused rotation, or this operation was cancelled. A 4xx other
+ * than 429 drops the held session because the old refresh token was spent;
+ * a 429 or 5xx keeps it.
  * Cancellation discards the old response and preserves any newer session.
  */
  | {
@@ -160,7 +161,9 @@ export interface BrowserAuth {
     trySilentSignIn(returnTo?: string): Promise<boolean>;
     /** Leave for the issuer, expecting to be asked for credentials. Does not
      *  return. */
-    signIn(returnTo?: string): Promise<void>;
+    signIn(returnTo?: string, opts?: {
+        loginHint?: string;
+    }): Promise<void>;
     /** Finish the flow at the callback path. */
     completeSignIn(search?: string): Promise<SignInOutcome>;
     /**

package/dist/browser.js

@@ -1,4 +1,6 @@
 import { createNamespaceBrowserAuth } from './namespace-browser.js';
+import { safeLoginHint } from './redirect.js';
+import { base64url, decodeJwtPayload, timeoutSignal } from './util.js';
 const TOKEN = 'wtfalch.auth.token';
 const VERIFIER = 'wtfalch.auth.verifier';
 /** CSRF protection on the callback: checked before the code exchange, never persisted past it. */
@@ -36,12 +38,6 @@ const defaultStore = {
         }
     },
 };
-function base64url(bytes) {
-    return btoa(String.fromCharCode(...new Uint8Array(bytes)))
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=+$/, '');
-}
 async function challengeFor(verifier) {
     const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
     return base64url(digest);
@@ -52,22 +48,6 @@ function verifier() {
     // too -- a random, unguessable token is exactly what each of the three is.
     return base64url(crypto.getRandomValues(new Uint8Array(32)).buffer);
 }
-/** The payload of a JWT, read without verifying its signature -- the ID token here comes straight
- *  from the token endpoint over TLS, which OIDC Core 1.0 3.1.3.7 allows in place of a signature
- *  check for the authorization code flow. Never used to trust a claim from anywhere else. */
-function decodeJwtPayload(jwt) {
-    try {
-        const part = jwt.split('.')[1];
-        if (!part)
-            return null;
-        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
-        const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
-        return JSON.parse(atob(padded));
-    }
-    catch {
-        return null;
-    }
-}
 function publicSession(session) {
     const { refreshToken, ...rest } = session;
     return rest;
@@ -137,7 +117,7 @@ export function createBrowserAuth(options) {
         error: 'This refresh was cancelled',
     });
     const open = options.open ?? ((url) => window.location.assign(url));
-    const authorize = async (prompt, returnTo) => {
+    const authorize = async (prompt, returnTo, loginHint) => {
         const generation = ++coordinator.generation;
         const proof = verifier();
         const state = verifier();
@@ -175,6 +155,9 @@ export function createBrowserAuth(options) {
         url.searchParams.set('nonce', nonce);
         if (prompt)
             url.searchParams.set('prompt', prompt);
+        const hint = safeLoginHint(loginHint);
+        if (hint)
+            url.searchParams.set('login_hint', hint);
         if (!current(generation))
             return false;
         await open(url.toString());
@@ -208,6 +191,7 @@ export function createBrowserAuth(options) {
             return { kind: 'no-refresh-token' };
         const response = await fetch(`${options.issuer}/oauth/v2/token`, {
             method: 'POST',
+            signal: timeoutSignal(),
             headers: { 'content-type': 'application/x-www-form-urlencoded' },
             body: new URLSearchParams({
                 grant_type: 'refresh_token',
@@ -219,10 +203,13 @@ export function createBrowserAuth(options) {
             return cancelledRefresh();
         if (!response.ok) {
             const body = await response.text();
+            // A 5xx or 429 says the issuer is struggling, not that the grant is gone: keep the session for the next try.
+            const definitive = response.status >= 400 && response.status < 500 && response.status !== 429;
             return mutate(async () => {
                 if (!current(generation))
                     return cancelledRefresh();
-                await store.drop(tokenKey);
+                if (definitive)
+                    await store.drop(tokenKey);
                 if (!current(generation))
                     return cancelledRefresh();
                 return {
@@ -261,8 +248,8 @@ export function createBrowserAuth(options) {
                 return false;
             return authorize('none', returnTo);
         },
-        async signIn(returnTo = window.location.pathname) {
-            await authorize(undefined, returnTo);
+        async signIn(returnTo = window.location.pathname, opts) {
+            await authorize(undefined, returnTo, opts?.loginHint);
         },
         async completeSignIn(search = window.location.search) {
             const generation = coordinator.generation;
@@ -318,6 +305,7 @@ export function createBrowserAuth(options) {
                 };
             const response = await fetch(`${options.issuer}/oauth/v2/token`, {
                 method: 'POST',
+                signal: timeoutSignal(),
                 headers: { 'content-type': 'application/x-www-form-urlencoded' },
                 body: new URLSearchParams({
                     grant_type: 'authorization_code',

package/dist/config.d.ts

@@ -8,9 +8,12 @@ import type { SessionStore } from './sessions.js';
  * to offer there; `invite` calls the broker's own endpoint, which returns
  * one.
  */
-export type AuthEvent = {
+export type AuthEvent = 
+/** A session was established, by any method: password, passkey, link, reset, QR or the hosted login. `email` is empty when the id token carries none. */
+{
     type: 'signIn';
     email: string;
+    userId: string;
 } | {
     type: 'signUp';
     email: string;
@@ -93,6 +96,15 @@ export interface AuthOptions {
     cookieSecret?: string | undefined;
     /** e.g. https://auth.example.com. Required -- there is no estate-wide default. */
     issuer: string | undefined;
+    /**
+     * Where the hosted login lives, when it is not at the issuer's origin: an
+     * app that proxies the login under its own address passes e.g.
+     * `https://agora.example.com/sign-in`, and the hosted login URL becomes
+     * `https://agora.example.com/sign-in/login`. https, or http for localhost
+     * only; no query, fragment or credentials. Default: the issuer's origin,
+     * which is what the SDK has always used.
+     */
+    signInBase?: string;
     /** Where the routes are mounted. Default /auth. */
     basePath?: string;
     /** Default /. */
@@ -147,6 +159,8 @@ export interface ResolvedOptions {
      */
     readonly cookieKey: Uint8Array;
     issuer: string;
+    /** Absolute, always ends with "/": `new URL('login', signInBase)` is the hosted login. */
+    signInBase: string;
     basePath: string;
     afterLogin: string;
     afterLogout: string;

package/dist/config.js

@@ -47,6 +47,7 @@ export function resolveOptions(options) {
             return cookieKey;
         },
         issuer,
+        signInBase: parseSignInBase(options.signInBase, issuer),
         basePath,
         afterLogin: options.afterLogin ?? '/',
         afterLogout: options.afterLogout ?? '/',
@@ -91,6 +92,25 @@ function parseAppUrl(raw) {
     }
     return url;
 }
+function parseSignInBase(raw, issuer) {
+    if (raw === undefined)
+        return `${new URL(issuer).origin}/`;
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new Error(`@wtfalch/auth: signInBase must be an absolute URL, got "${raw}"`);
+    }
+    const local = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local)) {
+        throw new Error(`@wtfalch/auth: signInBase must be https (http only for localhost), got "${raw}"`);
+    }
+    if (raw.includes('?') || raw.includes('#') || url.username || url.password) {
+        throw new Error(`@wtfalch/auth: signInBase takes no query, fragment or credentials, got "${raw}"`);
+    }
+    return url.href.endsWith('/') ? url.href : `${url.href}/`;
+}
 function decodeKey(secret) {
     required(secret, 'cookieSecret');
     let bytes = new Uint8Array(0);