cauthy-auth 0.10.0 → 0.12.0

package/dist/svelte.d.mts

@@ -1,5 +1,5 @@
 import { SessionStore, SessionState, SessionStoreOptions } from './client.mjs';
-export { Account, AccountSession, AuthClient, AuthError, AuthMethods, AuthResult } from './client.mjs';
+export { Account, AccountSession, AuthClient, AuthError, AuthMethods, AuthResult, Passkey } from './client.mjs';
 import { i as PublicSession } from './system-ZD_Wa8Bm.mjs';
 export { P as PermissionOf, f as Policy, R as RoleOf, k as SessionOrganization, m as SessionUser, p as can, r as definePolicy } from './system-ZD_Wa8Bm.mjs';
 import './theme.mjs';

package/dist/svelte.d.ts

@@ -1,5 +1,5 @@
 import { SessionStore, SessionState, SessionStoreOptions } from './client.js';
-export { Account, AccountSession, AuthClient, AuthError, AuthMethods, AuthResult } from './client.js';
+export { Account, AccountSession, AuthClient, AuthError, AuthMethods, AuthResult, Passkey } from './client.js';
 import { i as PublicSession } from './system-DhRr_WxR.js';
 export { P as PermissionOf, f as Policy, R as RoleOf, k as SessionOrganization, m as SessionUser, p as can, r as definePolicy } from './system-DhRr_WxR.js';
 import './theme.js';

package/dist/svelte.js

@@ -26,6 +26,82 @@ __export(svelte_exports, {
 });
 module.exports = __toCommonJS(svelte_exports);
 
+// src/passkey.ts
+function canUsePasskeys() {
+  return typeof window !== "undefined" && typeof window.PublicKeyCredential === "function" && typeof navigator !== "undefined" && typeof navigator.credentials?.get === "function";
+}
+async function canAutofillPasskeys() {
+  if (!canUsePasskeys()) return false;
+  const pkc = window.PublicKeyCredential;
+  try {
+    return typeof pkc.isConditionalMediationAvailable === "function" && await pkc.isConditionalMediationAvailable() === true;
+  } catch {
+    return false;
+  }
+}
+function bytes(text2) {
+  const b64 = text2.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(text2.length / 4) * 4, "=");
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out.buffer;
+}
+function text(buf) {
+  if (!buf) return null;
+  const view = new Uint8Array(buf);
+  let bin = "";
+  for (let i = 0; i < view.byteLength; i++) bin += String.fromCharCode(view[i]);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var withId = (list) => (list ?? []).map((c) => ({ ...c, id: bytes(c.id) }));
+async function getPasskey(options, how = {}) {
+  const publicKey = { ...options, challenge: bytes(options.challenge), allowCredentials: withId(options.allowCredentials) };
+  const cred = await navigator.credentials.get({ publicKey, ...how });
+  if (cred === null) throw new DOMException("No passkey was chosen.", "NotAllowedError");
+  const r = cred.response;
+  return {
+    id: cred.id,
+    rawId: text(cred.rawId),
+    type: cred.type,
+    response: {
+      authenticatorData: text(r.authenticatorData),
+      clientDataJSON: text(r.clientDataJSON),
+      signature: text(r.signature),
+      userHandle: text(r.userHandle)
+    },
+    clientExtensionResults: cred.getClientExtensionResults?.() ?? {}
+  };
+}
+async function makePasskey(options) {
+  const publicKey = {
+    ...options,
+    challenge: bytes(options.challenge),
+    user: { ...options.user, id: bytes(options.user.id) },
+    excludeCredentials: withId(options.excludeCredentials)
+  };
+  const cred = await navigator.credentials.create({ publicKey });
+  if (cred === null) throw new DOMException("No passkey was made.", "NotAllowedError");
+  const r = cred.response;
+  return {
+    id: cred.id,
+    rawId: text(cred.rawId),
+    type: cred.type,
+    response: {
+      clientDataJSON: text(r.clientDataJSON),
+      attestationObject: text(r.attestationObject),
+      transports: typeof r.getTransports === "function" ? r.getTransports() : []
+    },
+    clientExtensionResults: cred.getClientExtensionResults?.() ?? {}
+  };
+}
+function ceremonyError(e) {
+  const name = e instanceof Error || e instanceof DOMException ? e.name : "";
+  if (name === "NotAllowedError" || name === "AbortError") return { code: "cancelled", message: "The passkey was not used. Try again when you are ready." };
+  if (name === "InvalidStateError") return { code: "passkey_exists", message: "This device already has a passkey for this account." };
+  if (name === "SecurityError") return { code: "passkey_unavailable", message: "Passkeys cannot be used on this page." };
+  return { code: "passkey_failed", message: "The passkey could not be used. Try again, or sign in another way." };
+}
+
 // src/theme.ts
 function fromWire(wire) {
   const names = {
@@ -100,6 +176,24 @@ function firstProblem(...checks) {
 }
 
 // src/client.ts
+var googleScript = null;
+function loadGoogleIdentity() {
+  const ready = () => window.google?.accounts?.id;
+  if (ready()) return Promise.resolve(ready());
+  googleScript ??= new Promise((resolve, reject) => {
+    const script = document.createElement("script");
+    script.src = "https://accounts.google.com/gsi/client";
+    script.async = true;
+    script.onload = () => ready() ? resolve(ready()) : reject(new Error("google identity services did not load"));
+    script.onerror = () => {
+      googleScript = null;
+      reject(new Error("google identity services did not load"));
+    };
+    document.head.appendChild(script);
+  });
+  return googleScript;
+}
+var PASSKEY_SECONDS = 300;
 var UNAVAILABLE = { code: "unavailable", message: "Sign-in is unavailable right now. Try again in a moment." };
 function createAuthClient(options = {}) {
   const base = (options.basePath ?? "/api/auth").replace(/\/+$/, "");
@@ -142,6 +236,28 @@ function createAuthClient(options = {}) {
     if (o.locale) q.set("locale", o.locale);
     return `${base}/login?${q}`;
   };
+  async function methods() {
+    try {
+      const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
+      if (res.ok) {
+        const m = await res.json();
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true };
+      }
+    } catch {
+    }
+    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false };
+  }
+  async function ceremony(begin, finish, form, run, more = {}) {
+    const begun = await post(begin, form, null);
+    if (!begun.ok) return begun;
+    let credential;
+    try {
+      credential = await run(begun.options);
+    } catch (e) {
+      return { ok: false, error: ceremonyError(e) };
+    }
+    return post(finish, { credential, ...more }, null);
+  }
   return {
     signIn: {
       email: (f) => post("/sign-in/email", { email: f.email, password: f.password }, firstProblem(checkEmail(f.email), checkPassword(f.password))),
@@ -150,8 +266,76 @@ function createAuthClient(options = {}) {
       magicLinkVerify: (f) => post("/sign-in/magic-link/verify", { token: f.token }, null),
       emailCode: (f) => post("/sign-in/email-code", { code: f.code }, checkCode(f.code)),
       passkeyUrl,
-      passkey(o) {
+      async passkey(o) {
+        const m = await methods();
+        if (m.passkeyHere && canUsePasskeys()) {
+          const r = await ceremony("/sign-in/passkey/begin", "/sign-in/passkey/finish", {}, getPasskey);
+          if (r.ok || r.error.code !== "passkey_unavailable" || !m.passkeyOnCauthy) return r;
+        } else if (!m.passkeyOnCauthy) {
+          return { ok: false, error: { code: "passkey_unavailable", message: "Passkeys cannot be used here." } };
+        }
         window.location.assign(passkeyUrl(o));
+        return { ok: true, status: "redirected" };
+      },
+      async passkeyAutofill(o = {}) {
+        const cancelled = { ok: false, error: { code: "cancelled", message: "No passkey was chosen." } };
+        const m = await methods();
+        if (!m.passkeyHere || !await canAutofillPasskeys()) return cancelled;
+        for (; ; ) {
+          if (o.signal?.aborted) return cancelled;
+          const begun = await post("/sign-in/passkey/begin", {}, null);
+          if (!begun.ok) return begun;
+          const renew = new AbortController();
+          const stop = () => renew.abort();
+          o.signal?.addEventListener("abort", stop, { once: true });
+          const timer = setTimeout(stop, (PASSKEY_SECONDS - 30) * 1e3);
+          let credential;
+          try {
+            credential = await getPasskey(begun.options, { mediation: "conditional", signal: renew.signal });
+          } catch (e) {
+            if (o.signal?.aborted) return cancelled;
+            if (renew.signal.aborted) continue;
+            return { ok: false, error: ceremonyError(e) };
+          } finally {
+            clearTimeout(timer);
+            o.signal?.removeEventListener("abort", stop);
+          }
+          return post("/sign-in/passkey/finish", { credential }, null);
+        }
+      },
+      async googleOneTap(o = {}) {
+        const cancelled = { ok: false, error: { code: "cancelled", message: "No Google account was chosen." } };
+        if (typeof window === "undefined" || o.signal?.aborted) return cancelled;
+        const begun = await post("/sign-in/google-one-tap/begin", {}, null);
+        if (!begun.ok) return begun;
+        let gis;
+        try {
+          gis = await loadGoogleIdentity();
+        } catch {
+          return { ok: false, error: { code: "unavailable", message: "Google could not be reached. Try again, or sign in another way." } };
+        }
+        const credential = await new Promise((done) => {
+          o.signal?.addEventListener("abort", () => {
+            gis.cancel();
+            done(null);
+          }, { once: true });
+          gis.initialize({
+            client_id: begun.clientId,
+            nonce: begun.nonce,
+            context: o.context ?? "signin",
+            callback: (r) => done(r.credential ?? null),
+            auto_select: false,
+            cancel_on_tap_outside: true,
+            itp_support: true,
+            use_fedcm_for_prompt: true
+          });
+          gis.prompt((moment) => {
+            if (moment.isNotDisplayed?.() || moment.isSkippedMoment?.()) done(null);
+            else if (moment.isDismissedMoment?.() && moment.getDismissedReason?.() !== "credential_returned") done(null);
+          });
+        });
+        if (credential === null) return cancelled;
+        return post("/sign-in/google-one-tap", { credential }, null);
       },
       socialUrl,
       social(provider, o) {
@@ -195,7 +379,16 @@ function createAuthClient(options = {}) {
         const body = await read("/me/sessions");
         return body && Array.isArray(body.sessions) ? body.sessions : [];
       },
-      signOutEverywhere: () => post("/me/sessions/end", {}, null)
+      signOutEverywhere: () => post("/me/sessions/end", {}, null),
+      async passkeys() {
+        const body = await read("/me/passkeys");
+        return body && Array.isArray(body.passkeys) ? body.passkeys : [];
+      },
+      addPasskey(f = {}) {
+        if (!canUsePasskeys()) return Promise.resolve({ ok: false, error: { code: "passkey_unavailable", message: "This browser cannot make passkeys." } });
+        return ceremony("/me/passkeys/add/begin", "/me/passkeys/add/finish", { password: f.password ?? "" }, makePasskey, { name: f.name ?? "" });
+      },
+      removePasskey: (id) => post("/me/passkeys/remove", { id }, null)
     },
     async getSession() {
       try {
@@ -210,14 +403,7 @@ function createAuthClient(options = {}) {
       looked ??= read("/look").then((wire) => wire && typeof wire === "object" ? fromWire(wire) : null);
       return looked;
     },
-    async methods() {
-      try {
-        const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
-        if (res.ok) return await res.json();
-      } catch {
-      }
-      return { providers: [], signUp: true, magicLink: false, passkey: false };
-    }
+    methods
   };
 }
 
@@ -313,7 +499,8 @@ function createSessionStore(options = {}) {
         email: (f) => then(client.signIn.email(f)),
         mfa: (f) => then(client.signIn.mfa(f)),
         magicLinkVerify: (f) => then(client.signIn.magicLinkVerify(f)),
-        emailCode: (f) => then(client.signIn.emailCode(f))
+        emailCode: (f) => then(client.signIn.emailCode(f)),
+        passkey: (o) => then(client.signIn.passkey(o))
       },
       signUp: { email: (f) => then(client.signUp.email(f)) },
       signOut: () => then(client.signOut()),