@wtfalch/auth 0.4.1 → 0.5.0

package/dist/auth.d.ts

@@ -86,6 +86,26 @@ export interface Auth {
     verify(request: Request): Promise<Response>;
     /** GET {basePath}/link?sessionId=&code= : the sign-in link from an email, on any device. */
     link(request: Request): Promise<Response>;
+    /**
+     * The same link as data, for a caller that is not the browser holding it.
+     *
+     * `link` answers a browser: it redirects and sets a cookie. A client with no
+     * browser of its own -- a desktop app, a CLI -- cannot be signed in that way,
+     * and its server was otherwise left to call `link` and scrape `Set-Cookie`
+     * off the Response, which is reaching around this interface for something it
+     * should be able to ask for. `complete` and `resetPassword` already return
+     * the session this way; this is the third of the same shape.
+     *
+     * The cookies come back unset. Whoever calls this decides where the session
+     * goes, and for a headless client that is deliberately not the browser: the
+     * cookie name is fixed, so setting it would overwrite whatever website
+     * session the person already had in the tab they clicked from.
+     */
+    followLink(input: {
+        sessionId: string;
+        code: string;
+        next?: string;
+    }): Promise<SignedIn>;
     /** Emails a fresh verification link. Says nothing about whether the address exists. */
     resendVerification(email: string, next?: string): Promise<void>;
     /** Emails a password-reset link to {basePath}/reset?userId=&code=. Says nothing about whether the address exists. */

package/dist/auth.js

@@ -258,20 +258,31 @@ export function createAuth(input) {
             return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
         }
     };
+    const followLink = async ({ sessionId, code, next, }) => {
+        try {
+            const flow = await serverFlow();
+            const completed = await finishOrHandoff(() => broker().followLink({ authRequestId: flow.id, sessionId, code }), flow, safeNextPath(next, options().afterLogin));
+            return { ok: true, ...completed };
+        }
+        catch (error) {
+            if (error instanceof BrokerError && error.status < 500) {
+                return { ok: false, error: 'invalid_code', message: error.detail ?? error.error };
+            }
+            return { ok: false, error: 'unavailable', message: 'the sign-in service did not answer' };
+        }
+    };
     const link = async (request) => {
         const params = new URL(request.url).searchParams;
         const sessionId = params.get('sessionId');
         const code = params.get('code');
         if (!sessionId || !code)
             return failed('link', []);
-        try {
-            const flow = await serverFlow();
-            const { location, cookies } = await finishOrHandoff(() => broker().followLink({ authRequestId: flow.id, sessionId, code }), flow, safeNextPath(params.get('next'), options().afterLogin));
-            return redirect(location, cookies);
-        }
-        catch {
-            return failed('link', []);
-        }
+        const result = await followLink({
+            sessionId,
+            code,
+            next: params.get('next') ?? undefined,
+        });
+        return result.ok ? redirect(result.location, result.cookies) : failed('link', []);
     };
     const signIn = async ({ authRequestId, email, password, }) => {
         try {
@@ -333,6 +344,7 @@ export function createAuth(input) {
         logout,
         verify,
         link,
+        followLink,
         resendVerification,
         requestPasswordReset,
         resetPassword,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",