@wtfalch/auth 0.33.0 → 0.34.0

package/dist/auth.d.ts

@@ -151,6 +151,45 @@ export type PasskeySignInStart = {
     ok: false;
     error: SignInError;
 };
+/** What a fresh sign-in step needs the caller to do. `cookies` are always to be set, success or not. */
+export type FreshOutcome = {
+    ok: true;
+    cookies: SetCookie[];
+} | {
+    ok: false;
+    error: SignInError | 'other_person' | 'invalid_code';
+    cookies: SetCookie[];
+} | {
+    ok: false;
+    secondFactor: {
+        token: string;
+        methods: 'totp'[];
+    };
+    cookies: SetCookie[];
+} | {
+    ok: false;
+    hosted: true;
+    next?: string;
+    cookies: SetCookie[];
+};
+export type FreshStart = {
+    ok: true;
+    authRequestId: string;
+    loginHint: string;
+    passkey: boolean;
+    cookies: SetCookie[];
+} | {
+    ok: false;
+    hosted: true;
+    cookies: SetCookie[];
+};
+export type FreshPasskeyStart = {
+    ok: true;
+    options: unknown;
+    cookies: SetCookie[];
+} | Exclude<FreshOutcome, {
+    ok: true;
+}>;
 export interface Completed {
     location: string;
     cookies: SetCookie[];
@@ -425,6 +464,35 @@ export interface Auth {
     endSession(request: Request, key: string): Promise<void>;
     /** The auth request the issuer sent the browser here with. Refuses one for another application. */
     authRequest(id: string): Promise<AuthRequest>;
+    /**
+     * Starts a `prompt=login` auth request for whoever is signed in on `request`
+     * and seals its PKCE transaction in a cookie. Nothing redirects. `hosted`
+     * means the modal cannot be used: nobody is signed in, or the issuer did not
+     * start a request. The other four calls take the same `request` and the
+     * `authRequestId` this returned.
+     */
+    startFreshSignIn(request: Request, opts?: {
+        next?: string;
+    }): Promise<FreshStart>;
+    /** The password step. The email is the signed-in person's own, never an argument. */
+    finishFreshSignIn(request: Request, input: {
+        authRequestId: string;
+        password: string;
+    }): Promise<FreshOutcome>;
+    /** A passkey challenge for the signed-in person; `finishFreshPasskey` answers it. */
+    startFreshPasskey(request: Request, input: {
+        authRequestId: string;
+    }): Promise<FreshPasskeyStart>;
+    finishFreshPasskey(request: Request, input: {
+        authRequestId: string;
+        credential: unknown;
+    }): Promise<FreshOutcome>;
+    /** The code step after a `secondFactor` outcome. */
+    verifyFreshSecondFactor(request: Request, input: {
+        authRequestId: string;
+        token: string;
+        code: string;
+    }): Promise<FreshOutcome>;
     signIn(input: {
         authRequestId: string;
         email: string;

package/dist/auth.js

@@ -547,13 +547,13 @@ export function createAuth(input) {
      * An OIDC flow this app starts and finishes itself, for a person arriving
      * from an email rather than from a browser the app sent to the issuer.
      */
-    const serverFlow = async () => {
+    const serverFlow = async (authorization = {}) => {
         if (options().namespace && !(await sessions.bindingActive()))
             throw new AuthError('unavailable', 'the namespace binding is not active');
         const state = client.randomState();
         const nonce = client.randomNonce();
         const verifier = client.randomPKCECodeVerifier();
-        const target = await oidc().authorizationUrl(state, nonce, verifier);
+        const target = await oidc().authorizationUrl(state, nonce, verifier, authorization);
         const response = await options().fetch(target.href, {
             redirect: 'manual',
             signal: timeoutSignal(),
@@ -613,6 +613,187 @@ export function createAuth(input) {
             };
         }
     };
+    /**
+     * The fresh sign-in is the modal's version of `/auth/start` + `/auth/callback`:
+     * the same PKCE transaction, started and finished on the server, so the page
+     * never navigates. The transaction cookie holds the auth request id (`ar`),
+     * and every step refuses an id that is not that one.
+     */
+    const freshContext = async (request, authRequestId) => {
+        const { user } = await read(request, { refresh: false });
+        const transaction = await openTransaction(options(), cookieFrom(request.headers.get('cookie'), transactionCookieName(options())));
+        if (!user?.email)
+            return {
+                kind: 'refused',
+                outcome: { ok: false, hosted: true, next: transaction?.nx, cookies: [] },
+            };
+        if (!transaction || transaction.ar === undefined || transaction.ar !== authRequestId)
+            return { kind: 'refused', outcome: { ok: false, error: 'request', cookies: [] } };
+        return { kind: 'ready', user, email: user.email, transaction };
+    };
+    const startFreshSignIn = async (request, opts = {}) => {
+        const { user } = await read(request, { refresh: false });
+        const loginHint = user?.email ? safeLoginHint(user.email) : undefined;
+        if (!user || !loginHint)
+            return { ok: false, hosted: true, cookies: [] };
+        let flow;
+        try {
+            flow = await serverFlow({ prompt: 'login', loginHint });
+        }
+        catch (error) {
+            console.error('@wtfalch/auth: could not start a fresh sign-in', error instanceof Error ? error.name : 'unknown');
+            return { ok: false, hosted: true, cookies: [] };
+        }
+        const cookie = await sealTransaction(options(), {
+            st: flow.state,
+            nc: flow.nonce,
+            cv: flow.verifier,
+            nx: safeNextPath(opts.next, options().afterLogin),
+            ar: flow.id,
+        });
+        let passkey = false;
+        try {
+            await broker().startPasskeySignIn({ authRequestId: flow.id, email: user.email });
+            passkey = true;
+        }
+        catch (error) {
+            if (!(error instanceof BrokerError && error.status < 500)) {
+                console.error('@wtfalch/auth: could not check for a passkey', error instanceof Error ? error.name : 'unknown');
+            }
+        }
+        return { ok: true, authRequestId: flow.id, loginHint, passkey, cookies: [cookie] };
+    };
+    /** Turns what the broker said into the outcome the modal acts on. */
+    const freshFailure = (error, cookies = [], next) => {
+        if (error instanceof BrokerError) {
+            if (needsHostedLogin(error) || error.error === 'password_change_required')
+                return { ok: false, hosted: true, next, cookies };
+            if (error.error === 'second_factor_required') {
+                if (error.secondFactor?.methods.includes('totp'))
+                    return {
+                        ok: false,
+                        secondFactor: { token: error.secondFactor.token, methods: ['totp'] },
+                        cookies,
+                    };
+                return { ok: false, hosted: true, next, cookies };
+            }
+            if (error.error === 'invalid_code')
+                return { ok: false, error: 'invalid_code', cookies };
+            if (error.error === 'invalid')
+                return { ok: false, error: 'request', cookies };
+        }
+        else {
+            console.error('@wtfalch/auth: a fresh sign-in step failed', error instanceof Error ? error.name : 'unknown');
+        }
+        return { ok: false, error: signInError(error), cookies };
+    };
+    /**
+     * Exchanges the callback and, only when it is the same person, replaces the
+     * session. The check comes before the session is made, so another person's
+     * sign-in leaves no record behind in namespace mode either.
+     */
+    const completeFresh = async (request, callbackUrl, user, transaction) => {
+        const cleared = clearTransaction(options());
+        if (!validCallback(callbackUrl))
+            return { ok: false, error: 'request', cookies: [cleared] };
+        if (options().namespace && !(await sessions.bindingActive()))
+            return { ok: false, error: 'unavailable', cookies: [cleared] };
+        let tokens;
+        try {
+            tokens = await oidc().exchange(new URL(callbackUrl).searchParams, {
+                state: transaction.st,
+                nonce: transaction.nc,
+                codeVerifier: transaction.cv,
+            });
+        }
+        catch (error) {
+            console.error('@wtfalch/auth: the fresh sign-in could not be exchanged', error instanceof Error ? error.name : 'unknown');
+            return { ok: false, error: 'request', cookies: [cleared] };
+        }
+        if (String(tokens.claims.sub) !== user.id)
+            return { ok: false, error: 'other_person', cookies: [cleared] };
+        const session = await sessionCookie(tokens, request.headers);
+        await replacePreviousSession(request.headers.get('cookie'));
+        return { ok: true, cookies: [cleared, session] };
+    };
+    const finishFreshSignIn = async (request, input) => {
+        const context = await freshContext(request, input.authRequestId);
+        if (context.kind === 'refused')
+            return context.outcome;
+        let callbackUrl;
+        try {
+            callbackUrl = await broker().signIn({
+                authRequestId: input.authRequestId,
+                email: context.email,
+                password: input.password,
+                secondFactor: true,
+            });
+        }
+        catch (error) {
+            return freshFailure(error, [], context.transaction.nx);
+        }
+        return completeFresh(request, callbackUrl, context.user, context.transaction);
+    };
+    const startFreshPasskey = async (request, input) => {
+        const context = await freshContext(request, input.authRequestId);
+        if (context.kind === 'refused')
+            return context.outcome;
+        try {
+            const { sessionId, options: challenge } = await broker().startPasskeySignIn({
+                authRequestId: input.authRequestId,
+                email: context.email,
+            });
+            const cookie = await sealTransaction(options(), {
+                st: context.transaction.st,
+                nc: context.transaction.nc,
+                cv: context.transaction.cv,
+                nx: context.transaction.nx,
+                ar: input.authRequestId,
+                fp: sessionId,
+            });
+            return { ok: true, options: challenge, cookies: [cookie] };
+        }
+        catch (error) {
+            return freshFailure(error, [], context.transaction.nx);
+        }
+    };
+    const finishFreshPasskey = async (request, input) => {
+        const context = await freshContext(request, input.authRequestId);
+        if (context.kind === 'refused')
+            return context.outcome;
+        if (!context.transaction.fp)
+            return { ok: false, error: 'request', cookies: [] };
+        let callbackUrl;
+        try {
+            callbackUrl = await broker().finishPasskeySignIn({
+                authRequestId: input.authRequestId,
+                sessionId: context.transaction.fp,
+                credential: input.credential,
+                secondFactor: true,
+            });
+        }
+        catch (error) {
+            return freshFailure(error, [], context.transaction.nx);
+        }
+        return completeFresh(request, callbackUrl, context.user, context.transaction);
+    };
+    const verifyFreshSecondFactor = async (request, input) => {
+        const context = await freshContext(request, input.authRequestId);
+        if (context.kind === 'refused')
+            return context.outcome;
+        let callbackUrl;
+        try {
+            callbackUrl = await broker().verifySecondFactor({
+                authRequestId: input.authRequestId,
+                token: input.token,
+                code: input.code,
+            });
+        }
+        catch (error) {
+            return freshFailure(error, [], context.transaction.nx);
+        }
+        return completeFresh(request, callbackUrl, context.user, context.transaction);
+    };
     const resendVerification = (email, next) => quietly(() => broker().sendVerification(email, safeNextPath(next, '')));
     const requestPasswordReset = (email, next) => quietly(() => broker().sendReset(email, safeNextPath(next, '')));
     const sendLink = (email, next) => quietly(() => broker().sendLink(email, safeNextPath(next, '')));
@@ -1068,6 +1249,11 @@ export function createAuth(input) {
         sessions: listSessions,
         endSession,
         authRequest,
+        startFreshSignIn,
+        finishFreshSignIn,
+        startFreshPasskey,
+        finishFreshPasskey,
+        verifyFreshSecondFactor,
         signIn,
         setNewPassword,
         setNewPasswordHeadless,

package/dist/broker.d.ts

@@ -49,9 +49,19 @@ export declare class BrokerError extends Error {
     readonly detail?: string | undefined;
     /** Only `password_change_required` carries one: see `setNewPassword`. */
     readonly changeToken?: string | undefined;
+    /** Only `second_factor_required` carries these: see `Broker.signIn`'s `secondFactor`. */
+    readonly secondFactor?: {
+        token: string;
+        methods: string[];
+    } | undefined;
     constructor(status: number, error: string, detail?: string | undefined, 
     /** Only `password_change_required` carries one: see `setNewPassword`. */
-    changeToken?: string | undefined);
+    changeToken?: string | undefined, 
+    /** Only `second_factor_required` carries these: see `Broker.signIn`'s `secondFactor`. */
+    secondFactor?: {
+        token: string;
+        methods: string[];
+    } | undefined);
 }
 /**
  * The privileged half, over HTTP. The app holds a key that reaches its own
@@ -76,10 +86,16 @@ export declare class Broker {
         password: string;
     }>;
     authRequest(id: string): Promise<AuthRequest>;
+    /**
+     * `secondFactor: true` asks the service to answer 403 `second_factor_required`
+     * (a token to send to `verifySecondFactor`) where it would otherwise answer
+     * `hosted_login_required` only because of an enrolled one-time-code factor.
+     */
     signIn(input: {
         authRequestId: string;
         email: string;
         password: string;
+        secondFactor?: true;
     }): Promise<string>;
     /** The call after `password_change_required`: no old password, only the token that sign-in answered with. */
     setNewPassword(input: {
@@ -113,6 +129,13 @@ export declare class Broker {
         authRequestId: string;
         sessionId: string;
         credential: unknown;
+        secondFactor?: true;
+    }): Promise<string>;
+    /** The code half of a `second_factor_required` answer; finishes the auth request like `signIn`. */
+    verifySecondFactor(input: {
+        authRequestId: string;
+        token: string;
+        code: string;
     }): Promise<string>;
     followLink(input: {
         authRequestId: string;

package/dist/broker.js

@@ -4,14 +4,18 @@ export class BrokerError extends Error {
     error;
     detail;
     changeToken;
+    secondFactor;
     constructor(status, error, detail, 
     /** Only `password_change_required` carries one: see `setNewPassword`. */
-    changeToken) {
+    changeToken, 
+    /** Only `second_factor_required` carries these: see `Broker.signIn`'s `secondFactor`. */
+    secondFactor) {
         super(detail ?? error);
         this.status = status;
         this.error = error;
         this.detail = detail;
         this.changeToken = changeToken;
+        this.secondFactor = secondFactor;
         this.name = 'BrokerError';
     }
 }
@@ -53,7 +57,14 @@ export class Broker {
             throw new BrokerError(response.status, 'unavailable', `non-JSON response from ${path}`);
         }
         if (!response.ok) {
-            throw new BrokerError(response.status, String(data.error ?? 'unavailable'), data.message, typeof data.changeToken === 'string' ? data.changeToken : undefined);
+            throw new BrokerError(response.status, String(data.error ?? 'unavailable'), data.message, typeof data.changeToken === 'string' ? data.changeToken : undefined, data.error === 'second_factor_required' && typeof data.token === 'string'
+                ? {
+                    token: data.token,
+                    methods: Array.isArray(data.methods)
+                        ? data.methods.filter((m) => typeof m === 'string')
+                        : [],
+                }
+                : undefined);
         }
         return data;
     }
@@ -75,6 +86,11 @@ export class Broker {
     authRequest(id) {
         return this.call('GET', '/auth-request', { id });
     }
+    /**
+     * `secondFactor: true` asks the service to answer 403 `second_factor_required`
+     * (a token to send to `verifySecondFactor`) where it would otherwise answer
+     * `hosted_login_required` only because of an enrolled one-time-code factor.
+     */
     async signIn(input) {
         const { callbackUrl } = await this.call('POST', '/sign-in', input);
         return callbackUrl;
@@ -113,6 +129,11 @@ export class Broker {
         const { callbackUrl } = await this.call('POST', '/passkey/finish', input);
         return callbackUrl;
     }
+    /** The code half of a `second_factor_required` answer; finishes the auth request like `signIn`. */
+    async verifySecondFactor(input) {
+        const { callbackUrl } = await this.call('POST', '/second-factor/verify', input);
+        return callbackUrl;
+    }
     async followLink(input) {
         const { callbackUrl } = await this.call('POST', '/link/follow', input);
         return callbackUrl;

package/dist/cookies.d.ts

@@ -19,6 +19,10 @@ export interface TransactionPayload extends JWTPayload {
     nx: string;
     /** The leg was a silent pass (`prompt=none`): an error coming back falls back to interactive sign-in. */
     sl?: true;
+    /** A fresh sign-in started by `startFreshSignIn`: the auth request this transaction belongs to. */
+    ar?: string;
+    /** The passkey challenge's session id, set by `startFreshPasskey`. */
+    fp?: string;
 }
 export interface CookieAttributes {
     path: '/';

package/dist/fresh.d.ts

@@ -0,0 +1,14 @@
+/** Client-safe: no imports, so a client component can use it without pulling in the server. */
+/** What a server action returns instead of redirecting when the person must sign in again. */
+export type FreshSignInAsk = {
+    kind: 'fresh-sign-in';
+    maxAge: number;
+};
+export declare function isFreshSignInAsk(value: unknown): value is FreshSignInAsk;
+/**
+ * Runs `run`; when it answers an ask, waits for `ask()` (the app's modal, `true`
+ * once the person signed in again) and runs it once more. A cancelled modal
+ * returns the ask. The second answer is returned as it is, so a second ask
+ * reaches the caller instead of looping.
+ */
+export declare function withFreshSignIn<T>(run: () => Promise<T>, ask: () => Promise<boolean>): Promise<T | FreshSignInAsk>;

package/dist/fresh.js

@@ -0,0 +1,21 @@
+/** Client-safe: no imports, so a client component can use it without pulling in the server. */
+export function isFreshSignInAsk(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const { kind, maxAge } = value;
+    return kind === 'fresh-sign-in' && typeof maxAge === 'number' && Number.isFinite(maxAge);
+}
+/**
+ * Runs `run`; when it answers an ask, waits for `ask()` (the app's modal, `true`
+ * once the person signed in again) and runs it once more. A cancelled modal
+ * returns the ask. The second answer is returned as it is, so a second ask
+ * reaches the caller instead of looping.
+ */
+export async function withFreshSignIn(run, ask) {
+    const first = await run();
+    if (!isFreshSignInAsk(first))
+        return first;
+    if (!(await ask()))
+        return first;
+    return run();
+}

package/dist/next.d.ts

@@ -1,6 +1,7 @@
 import { type NextRequest, NextResponse } from 'next/server';
 import { type Auth, type AuthRequest, type ChangePasswordResult, type DeletePasskeyResult, type EmailChangeResult, type GateRules, type Intent, type MaxAge, type NewUser, type Passkey, type PasskeyRegistrationResult, type PasskeyRegistrationStart, type PasskeySignInStart, type Prompt, type QrPollStatus, type ResetError, type SetNewPasswordError, type SetNewPasswordResult, type SignInError, type SignUpError, type User } from './auth.js';
 import type { AuthEvent, AuthOptions } from './config.js';
+import type { FreshSignInAsk } from './fresh.js';
 import type { SessionRecord } from './sessions.js';
 type SearchParams = Record<string, string | string[] | undefined>;
 export interface QrSignIn {
@@ -9,6 +10,22 @@ export interface QrSignIn {
     expiresIn: number;
     interval: number;
 }
+/** What each step of the modal answers; see `NextAuth.startFreshSignIn`. Never a redirect. */
+export type FreshResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: SignInError | 'other_person' | 'invalid_code';
+} | {
+    ok: false;
+    secondFactor: {
+        token: string;
+        methods: 'totp'[];
+    };
+} | {
+    ok: false;
+    fallbackUrl: string;
+};
 export interface NextAuth {
     auth: Auth;
     /** `export const { GET, POST } = handlers` from app/auth/[...auth]/route.ts. */
@@ -41,6 +58,62 @@ export interface NextAuth {
         next?: string;
         searchParams?: SearchParams | Promise<SearchParams>;
     }) => Promise<User>;
+    /**
+     * `requireFreshUser` for a server action: the user when they authenticated
+     * within `maxAge` seconds, otherwise an `ask` for the action to return to
+     * its client, which opens the sign-in modal (`withFreshSignIn` in
+     * `@wtfalch/auth/fresh`). Never redirects. Throws `AuthError('unauthenticated')`
+     * for nobody, as `startPasskeyRegistration` does.
+     */
+    freshUserOrAsk: (maxAge: MaxAge) => Promise<{
+        fresh: true;
+        user: User;
+    } | {
+        fresh: false;
+        ask: FreshSignInAsk;
+    }>;
+    /**
+     * Step 1 of the modal, for a server action. Starts a `prompt=login` auth
+     * request for the signed-in person and keeps its PKCE transaction in the
+     * sealed transaction cookie. `fallbackUrl` is where `requireFreshUser` would
+     * have sent them: the modal cannot be used, so the app does what it did
+     * before. `next` is where that fallback returns to.
+     */
+    startFreshSignIn: (opts?: {
+        next?: string;
+    }) => Promise<{
+        ok: true;
+        authRequestId: string;
+        loginHint: string;
+        passkey: boolean;
+    } | {
+        ok: false;
+        fallbackUrl: string;
+    }>;
+    /** The password step. On `ok` the session cookie is already replaced; nothing redirects. */
+    finishFreshSignIn: (input: {
+        authRequestId: string;
+        password: string;
+    }) => Promise<FreshResult>;
+    /** A passkey challenge: answer it with `@wtfalch/auth/passkey`'s `getPasskey`, then `finishFreshPasskey`. */
+    startFreshPasskey: (input: {
+        authRequestId: string;
+    }) => Promise<{
+        ok: true;
+        options: unknown;
+    } | Exclude<FreshResult, {
+        ok: true;
+    }>>;
+    finishFreshPasskey: (input: {
+        authRequestId: string;
+        credential: unknown;
+    }) => Promise<FreshResult>;
+    /** The code step after a `secondFactor` result. */
+    verifyFreshSecondFactor: (input: {
+        authRequestId: string;
+        token: string;
+        code: string;
+    }) => Promise<FreshResult>;
     /**
      * For the app's login and register pages: the auth request the issuer sent
      * the browser with, or a redirect that starts one. Pass the page's searchParams.
@@ -184,4 +257,4 @@ export interface NextAuth {
     }>;
 }
 export declare function nextAuth(options: AuthOptions): NextAuth;
-export type { Auth, AuthEvent, AuthOptions, AuthRequest, ChangePasswordResult, DeletePasskeyResult, EmailChangeResult, GateRules, Intent, MaxAge, NewUser, Passkey, PasskeyRegistrationResult, PasskeyRegistrationStart, PasskeySignInStart, SetNewPasswordError, SetNewPasswordResult, Prompt, QrPollStatus, SessionRecord, User, };
+export type { FreshSignInAsk, Auth, AuthEvent, AuthOptions, AuthRequest, ChangePasswordResult, DeletePasskeyResult, EmailChangeResult, GateRules, Intent, MaxAge, NewUser, Passkey, PasskeyRegistrationResult, PasskeyRegistrationStart, PasskeySignInStart, SetNewPasswordError, SetNewPasswordResult, Prompt, QrPollStatus, SessionRecord, User, };

package/dist/next.js

@@ -163,6 +163,91 @@ export function nextAuth(options) {
         }
         return new Request('http://localhost/', { headers: requestHeaders });
     };
+    const freshUserOrAsk = async (maxAge) => {
+        const store = await cookies();
+        const { user, unavailable } = await auth.readCookie(store.get(auth.sessionCookieName)?.value, {
+            refresh: false,
+        });
+        if (unavailable)
+            throw new AuthError('unavailable', 'Sign-in is unavailable for this workspace');
+        if (!user)
+            throw new AuthError('unauthenticated', 'sign in to continue');
+        if (auth.fresh(user, maxAge))
+            return { fresh: true, user };
+        return { fresh: false, ask: { kind: 'fresh-sign-in', maxAge } };
+    };
+    // Where requireFreshUser would send them. `max_age=0` because the modal does not know the bound the action wanted.
+    const freshFallback = (next) => auth.startUrl(marked(next), 'login', undefined, 0);
+    const setAll = async (set) => {
+        const store = await cookies();
+        for (const c of set)
+            store.set(c.name, c.value, c.attributes);
+    };
+    const freshResult = async (outcome) => {
+        await setAll(outcome.cookies);
+        if (outcome.ok)
+            return { ok: true };
+        if ('hosted' in outcome)
+            return { ok: false, fallbackUrl: freshFallback(outcome.next) };
+        if ('secondFactor' in outcome)
+            return { ok: false, secondFactor: outcome.secondFactor };
+        return { ok: false, error: outcome.error };
+    };
+    // A server action's argument is whatever the client sent: every field is checked where it is read.
+    const text = (value, max) => typeof value === 'string' && value.length > 0 && value.length <= max ? value : null;
+    const refused = { ok: false, error: 'request' };
+    const startFreshSignIn = async (opts) => {
+        const next = typeof opts?.next === 'string' ? opts.next : undefined;
+        const result = await auth.startFreshSignIn(await requestFromCookies(), { next });
+        await setAll(result.cookies);
+        if (!result.ok)
+            return { ok: false, fallbackUrl: freshFallback(next) };
+        return {
+            ok: true,
+            authRequestId: result.authRequestId,
+            loginHint: result.loginHint,
+            passkey: result.passkey,
+        };
+    };
+    const finishFreshSignIn = async (input) => {
+        const authRequestId = text(input?.authRequestId, 256);
+        const password = text(input?.password, 1024);
+        if (!authRequestId || !password)
+            return refused;
+        return freshResult(await auth.finishFreshSignIn(await requestFromCookies(), { authRequestId, password }));
+    };
+    const startFreshPasskey = async (input) => {
+        const authRequestId = text(input?.authRequestId, 256);
+        if (!authRequestId)
+            return refused;
+        const result = await auth.startFreshPasskey(await requestFromCookies(), { authRequestId });
+        if (result.ok) {
+            await setAll(result.cookies);
+            return { ok: true, options: result.options };
+        }
+        return freshResult(result);
+    };
+    const finishFreshPasskey = async (input) => {
+        const authRequestId = text(input?.authRequestId, 256);
+        if (!authRequestId || typeof input.credential !== 'object' || input.credential === null)
+            return refused;
+        return freshResult(await auth.finishFreshPasskey(await requestFromCookies(), {
+            authRequestId,
+            credential: input.credential,
+        }));
+    };
+    const verifyFreshSecondFactor = async (input) => {
+        const authRequestId = text(input?.authRequestId, 256);
+        const token = text(input?.token, 2048);
+        const code = text(input?.code, 32);
+        if (!authRequestId || !token || !code)
+            return refused;
+        return freshResult(await auth.verifyFreshSecondFactor(await requestFromCookies(), {
+            authRequestId,
+            token,
+            code,
+        }));
+    };
     const startPasskeyRegistration = async () => auth.startPasskeyRegistration(await requestFromCookies());
     const finishPasskeyRegistration = async (input) => auth.finishPasskeyRegistration(await requestFromCookies(), input);
     const startEmailChange = async (email) => auth.startEmailChange(await requestFromCookies(), email);
@@ -281,6 +366,12 @@ export function nextAuth(options) {
         getUser,
         requireUser,
         requireFreshUser,
+        freshUserOrAsk,
+        startFreshSignIn,
+        finishFreshSignIn,
+        startFreshPasskey,
+        finishFreshPasskey,
+        verifyFreshSecondFactor,
         authRequest,
         signIn,
         setNewPassword,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Sign in against a self-hosted ZITADEL issuer: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",
@@ -22,6 +22,10 @@
       "types": "./dist/browser.d.ts",
       "default": "./dist/browser.js"
     },
+    "./fresh": {
+      "types": "./dist/fresh.d.ts",
+      "default": "./dist/fresh.js"
+    },
     "./passkey": {
       "types": "./dist/passkey-browser.d.ts",
       "default": "./dist/passkey-browser.js"