@wtfalch/auth 0.4.0 → 0.4.1

package/README.md

@@ -87,6 +87,11 @@ stops one subdomain writing a session the next one trusts. Single sign-on comes
 from the **issuer's** session instead — each origin takes its own token from
 it, and the person is asked for credentials once.
 
+`silentSignInAvailable()` is what a caller draws from: with no session it
+cannot otherwise tell *about to leave for the issuer* from *asked already, and
+here we are*, and the first case paints a sign-in screen at somebody on their
+way to being signed in.
+
 **Every silent attempt happens at most once per tab**, because an issuer
 answering `login_required` returns the person to a page whose load would ask
 again. `forget()` sets the same mark, so a sign-out does not undo itself.

package/dist/browser.d.ts

@@ -81,6 +81,18 @@ export interface BrowserAuth {
     /** The session this tab holds, or null. Expiry is checked with a minute of
      *  slack: a token that dies mid-request is worse than one renewed early. */
     currentSession(): BrowserSession | null;
+    /**
+     * Whether a silent attempt is still available in this tab: no session held,
+     * and none tried.
+     *
+     * A caller needs this to know what to *draw*. "No session" alone cannot
+     * tell "about to leave for the issuer" from "asked already, and here we
+     * are" -- and drawing a sign-in screen in the first case shows somebody a
+     * screen saying they are not signed in, for as long as the redirect takes,
+     * on their way to being let in. It was a third of a second on the estate's
+     * mail client, and it was the thing people noticed.
+     */
+    silentSignInAvailable(): boolean;
     /**
      * Ask the issuer to authorise without interacting, if it has not been asked
      * in this tab already. Returns false when there was nothing to try — a

package/dist/browser.js

@@ -116,12 +116,12 @@ export function createBrowserAuth(options) {
             return null;
         }
     };
+    const silentSignInAvailable = () => !currentSession() && !store.get(TRIED);
     return {
         currentSession,
+        silentSignInAvailable,
         async trySilentSignIn(returnTo = window.location.pathname) {
-            if (currentSession())
-                return false;
-            if (store.get(TRIED))
+            if (!silentSignInAvailable())
                 return false;
             store.set(TRIED, '1');
             await authorize('none', returnTo);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",