@wtfalch/auth 0.4.0 → 0.5.0

package/README.md

@@ -87,6 +87,11 @@ stops one subdomain writing a session the next one trusts. Single sign-on comes
 from the **issuer's** session instead — each origin takes its own token from
 it, and the person is asked for credentials once.
 
+`silentSignInAvailable()` is what a caller draws from: with no session it
+cannot otherwise tell *about to leave for the issuer* from *asked already, and
+here we are*, and the first case paints a sign-in screen at somebody on their
+way to being signed in.
+
 **Every silent attempt happens at most once per tab**, because an issuer
 answering `login_required` returns the person to a page whose load would ask
 again. `forget()` sets the same mark, so a sign-out does not undo itself.

package/dist/auth.d.ts

@@ -86,6 +86,26 @@ export interface Auth {
     verify(request: Request): Promise<Response>;
     /** GET {basePath}/link?sessionId=&code= : the sign-in link from an email, on any device. */
     link(request: Request): Promise<Response>;
+    /**
+     * The same link as data, for a caller that is not the browser holding it.
+     *
+     * `link` answers a browser: it redirects and sets a cookie. A client with no
+     * browser of its own -- a desktop app, a CLI -- cannot be signed in that way,
+     * and its server was otherwise left to call `link` and scrape `Set-Cookie`
+     * off the Response, which is reaching around this interface for something it
+     * should be able to ask for. `complete` and `resetPassword` already return
+     * the session this way; this is the third of the same shape.
+     *
+     * The cookies come back unset. Whoever calls this decides where the session
+     * goes, and for a headless client that is deliberately not the browser: the
+     * cookie name is fixed, so setting it would overwrite whatever website
+     * session the person already had in the tab they clicked from.
+     */
+    followLink(input: {
+        sessionId: string;
+        code: string;
+        next?: string;
+    }): Promise<SignedIn>;
     /** Emails a fresh verification link. Says nothing about whether the address exists. */
     resendVerification(email: string, next?: string): Promise<void>;
     /** Emails a password-reset link to {basePath}/reset?userId=&code=. Says nothing about whether the address exists. */

package/dist/auth.js

@@ -258,20 +258,31 @@ export function createAuth(input) {
             return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
         }
     };
+    const followLink = async ({ sessionId, code, next, }) => {
+        try {
+            const flow = await serverFlow();
+            const completed = await finishOrHandoff(() => broker().followLink({ authRequestId: flow.id, sessionId, code }), flow, safeNextPath(next, options().afterLogin));
+            return { ok: true, ...completed };
+        }
+        catch (error) {
+            if (error instanceof BrokerError && error.status < 500) {
+                return { ok: false, error: 'invalid_code', message: error.detail ?? error.error };
+            }
+            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+        }
+    };
     const link = async (request) => {
         const params = new URL(request.url).searchParams;
         const sessionId = params.get('sessionId');
         const code = params.get('code');
         if (!sessionId || !code)
             return failed('link', []);
-        try {
-            const flow = await serverFlow();
-            const { location, cookies } = await finishOrHandoff(() => broker().followLink({ authRequestId: flow.id, sessionId, code }), flow, safeNextPath(params.get('next'), options().afterLogin));
-            return redirect(location, cookies);
-        }
-        catch {
-            return failed('link', []);
-        }
+        const result = await followLink({
+            sessionId,
+            code,
+            next: params.get('next') ?? undefined,
+        });
+        return result.ok ? redirect(result.location, result.cookies) : failed('link', []);
     };
     const signIn = async ({ authRequestId, email, password, }) => {
         try {
@@ -333,6 +344,7 @@ export function createAuth(input) {
         logout,
         verify,
         link,
+        followLink,
         resendVerification,
         requestPasswordReset,
         resetPassword,

package/dist/browser.d.ts

@@ -81,6 +81,18 @@ export interface BrowserAuth {
     /** The session this tab holds, or null. Expiry is checked with a minute of
      *  slack: a token that dies mid-request is worse than one renewed early. */
     currentSession(): BrowserSession | null;
+    /**
+     * Whether a silent attempt is still available in this tab: no session held,
+     * and none tried.
+     *
+     * A caller needs this to know what to *draw*. "No session" alone cannot
+     * tell "about to leave for the issuer" from "asked already, and here we
+     * are" -- and drawing a sign-in screen in the first case shows somebody a
+     * screen saying they are not signed in, for as long as the redirect takes,
+     * on their way to being let in. It was a third of a second on the estate's
+     * mail client, and it was the thing people noticed.
+     */
+    silentSignInAvailable(): boolean;
     /**
      * Ask the issuer to authorise without interacting, if it has not been asked
      * in this tab already. Returns false when there was nothing to try — a

package/dist/browser.js

@@ -116,12 +116,12 @@ export function createBrowserAuth(options) {
             return null;
         }
     };
+    const silentSignInAvailable = () => !currentSession() && !store.get(TRIED);
     return {
         currentSession,
+        silentSignInAvailable,
         async trySilentSignIn(returnTo = window.location.pathname) {
-            if (currentSession())
-                return false;
-            if (store.get(TRIED))
+            if (!silentSignInAvailable())
                 return false;
             store.set(TRIED, '1');
             await authorize('none', returnTo);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",