cauthy-auth 0.10.0 → 0.12.0

package/dist/react.d.mts

@@ -210,6 +210,15 @@ interface PublicSession {
 
 type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code';
 
+/** Whether this browser can use a passkey at all. */
+declare function canUsePasskeys(): boolean;
+/**
+ * Whether this browser offers passkeys in the autofill of a field marked
+ * `autocomplete="username webauthn"`, so the person picks one without
+ * looking for a button.
+ */
+declare function canAutofillPasskeys(): Promise<boolean>;
+
 /** What went wrong, in a form the screen can show. */
 interface AuthError {
     /** Stable, for translating: `invalid_credentials`, `invalid_email`, `too_short`, `email_taken`, `unavailable`… */
@@ -235,8 +244,29 @@ interface AuthMethods {
     /** Whether people may create an account themselves. */
     signUp: boolean;
     magicLink: boolean;
-    /** Whether to offer a passkey. It is asked for on Cauthy's page: the person goes there for that step and comes back signed in. */
+    /** Whether to offer a passkey. */
     passkey: boolean;
+    /**
+     * Whether the passkey is used on this page itself. False: `signIn.passkey`
+     * sends the person to Cauthy's page for that step alone, and they come back
+     * signed in. That happens only when this page is outside the domain the
+     * workspace's passkeys belong to.
+     */
+    passkeyHere: boolean;
+    /**
+     * Whether Cauthy's page can use the passkey, for that step alone: where a
+     * page that cannot, or a browser that refuses to here, sends the person.
+     */
+    passkeyOnCauthy: boolean;
+}
+/** A passkey of the signed-in account. Moments are UTC. */
+interface Passkey {
+    id: string;
+    /** What the person called it ("My laptop"), or "". */
+    name: string;
+    createdAt: string;
+    /** When it last signed the person in, or null. */
+    lastUsedAt: string | null;
 }
 /** A person's own account, as their account screen shows it. */
 interface Account$1 {
@@ -340,6 +370,22 @@ interface AccountClient {
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
     signOutEverywhere(): Promise<AuthResult<'signed_out'>>;
+    /** The account's passkeys. */
+    passkeys(): Promise<Passkey[]>;
+    /**
+     * Makes a passkey on this device, on this page: the browser asks the person
+     * for their fingerprint, face or screen lock. An account with a password
+     * proves it again first. `cancelled`: the person closed the browser's prompt.
+     */
+    addPasskey(form?: {
+        password?: string;
+        name?: string;
+    }): Promise<AuthResult<'added', {
+        passkey: Passkey;
+    }>>;
+    removePasskey(id: string): Promise<AuthResult<'removed', {
+        id: string;
+    }>>;
 }
 interface AuthClient {
     signIn: {
@@ -372,12 +418,49 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** Sends the browser to Cauthy's page to use a passkey; it comes back signed in, at `returnTo`. */
+        /**
+         * Signs in with a passkey, on this page: the browser asks the person for
+         * their fingerprint, face or screen lock. When this page cannot use the
+         * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
+         * to Cauthy's page for that step alone and comes back signed in, at
+         * `returnTo`: then the answer is `redirected`. `cancelled`: the person
+         * closed the browser's prompt.
+         */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
-        }): void;
-        /** Where `passkey` sends the browser, for a plain link. */
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }> | AuthResult<'redirected'>>;
+        /**
+         * Offers the person's passkeys in the browser's autofill of the email
+         * field, which must carry `autocomplete="username webauthn"`, and signs in
+         * with the one they pick. It waits until they pick one or `signal`
+         * aborts: abort it before calling `passkey` or sending the form.
+         * `cancelled`: aborted, or this browser or page cannot (then there is
+         * nothing to offer, and the passkey button still works).
+         */
+        passkeyAutofill(options?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /**
+         * Google One Tap: Google's prompt over the page offers the Google account
+         * the browser already has, and signs in with it in one tap, as the Google
+         * sign-in does (the same account). Needs the workspace's Google sign-in,
+         * and the page's address among the Google client's authorized JavaScript
+         * origins. Waits until the person picks an account or closes the prompt
+         * (`cancelled`), or `signal` aborts. `one_tap_unavailable`: the workspace
+         * has no Google sign-in.
+         */
+        googleOneTap(options?: {
+            signal?: AbortSignal;
+            context?: 'signin' | 'signup' | 'use';
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
             locale?: string;
@@ -489,6 +572,13 @@ interface AuthTexts {
     keepCodes: string;
     passkeys: string;
     managePasskeys: string;
+    passkeysHelp: string;
+    noPasskeys: string;
+    passkeyName: string;
+    addPasskey: string;
+    removePasskey: string;
+    passkeyAdded: string;
+    passkeyUnnamed: string;
     sessions: string;
     signOutEverywhere: string;
     unknownDevice: string;
@@ -567,6 +657,21 @@ interface AuthFormProps {
     };
 }
 declare function SignIn(props: AuthFormProps): react.JSX.Element;
+interface GoogleOneTapProps {
+    /** Where to go once signed in. Without it (and without `onSuccess`), the page stays and its session updates. */
+    returnTo?: string;
+    /** Called once signed in, instead of going to `returnTo`. */
+    onSuccess?: () => void;
+    /** The prompt's words: sign in (default), sign up, or use the application. */
+    context?: 'signin' | 'signup' | 'use';
+}
+/**
+ * Google One Tap: put it on any page, and a person who is not signed in sees
+ * Google's prompt with the Google account the browser has; one tap signs them
+ * in. It draws nothing of its own, and shows nothing to somebody signed in or
+ * where the workspace has no Google sign-in.
+ */
+declare function GoogleOneTap(props: GoogleOneTapProps): null;
 declare function SignUp(props: AuthFormProps): react.JSX.Element;
 declare function ForgotPassword(props: AuthFormProps): react.JSX.Element;
 /** The page a "choose a new password" link opens: `pages.resetPassword`. */
@@ -629,4 +734,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, type JsonValue, type LinkedIdentity, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, createAuthClient, definePolicy, useAuth, useSession };
+export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, type Passkey, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };

package/dist/react.d.ts

@@ -210,6 +210,15 @@ interface PublicSession {
 
 type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code';
 
+/** Whether this browser can use a passkey at all. */
+declare function canUsePasskeys(): boolean;
+/**
+ * Whether this browser offers passkeys in the autofill of a field marked
+ * `autocomplete="username webauthn"`, so the person picks one without
+ * looking for a button.
+ */
+declare function canAutofillPasskeys(): Promise<boolean>;
+
 /** What went wrong, in a form the screen can show. */
 interface AuthError {
     /** Stable, for translating: `invalid_credentials`, `invalid_email`, `too_short`, `email_taken`, `unavailable`… */
@@ -235,8 +244,29 @@ interface AuthMethods {
     /** Whether people may create an account themselves. */
     signUp: boolean;
     magicLink: boolean;
-    /** Whether to offer a passkey. It is asked for on Cauthy's page: the person goes there for that step and comes back signed in. */
+    /** Whether to offer a passkey. */
     passkey: boolean;
+    /**
+     * Whether the passkey is used on this page itself. False: `signIn.passkey`
+     * sends the person to Cauthy's page for that step alone, and they come back
+     * signed in. That happens only when this page is outside the domain the
+     * workspace's passkeys belong to.
+     */
+    passkeyHere: boolean;
+    /**
+     * Whether Cauthy's page can use the passkey, for that step alone: where a
+     * page that cannot, or a browser that refuses to here, sends the person.
+     */
+    passkeyOnCauthy: boolean;
+}
+/** A passkey of the signed-in account. Moments are UTC. */
+interface Passkey {
+    id: string;
+    /** What the person called it ("My laptop"), or "". */
+    name: string;
+    createdAt: string;
+    /** When it last signed the person in, or null. */
+    lastUsedAt: string | null;
 }
 /** A person's own account, as their account screen shows it. */
 interface Account$1 {
@@ -340,6 +370,22 @@ interface AccountClient {
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
     signOutEverywhere(): Promise<AuthResult<'signed_out'>>;
+    /** The account's passkeys. */
+    passkeys(): Promise<Passkey[]>;
+    /**
+     * Makes a passkey on this device, on this page: the browser asks the person
+     * for their fingerprint, face or screen lock. An account with a password
+     * proves it again first. `cancelled`: the person closed the browser's prompt.
+     */
+    addPasskey(form?: {
+        password?: string;
+        name?: string;
+    }): Promise<AuthResult<'added', {
+        passkey: Passkey;
+    }>>;
+    removePasskey(id: string): Promise<AuthResult<'removed', {
+        id: string;
+    }>>;
 }
 interface AuthClient {
     signIn: {
@@ -372,12 +418,49 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** Sends the browser to Cauthy's page to use a passkey; it comes back signed in, at `returnTo`. */
+        /**
+         * Signs in with a passkey, on this page: the browser asks the person for
+         * their fingerprint, face or screen lock. When this page cannot use the
+         * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
+         * to Cauthy's page for that step alone and comes back signed in, at
+         * `returnTo`: then the answer is `redirected`. `cancelled`: the person
+         * closed the browser's prompt.
+         */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
-        }): void;
-        /** Where `passkey` sends the browser, for a plain link. */
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }> | AuthResult<'redirected'>>;
+        /**
+         * Offers the person's passkeys in the browser's autofill of the email
+         * field, which must carry `autocomplete="username webauthn"`, and signs in
+         * with the one they pick. It waits until they pick one or `signal`
+         * aborts: abort it before calling `passkey` or sending the form.
+         * `cancelled`: aborted, or this browser or page cannot (then there is
+         * nothing to offer, and the passkey button still works).
+         */
+        passkeyAutofill(options?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /**
+         * Google One Tap: Google's prompt over the page offers the Google account
+         * the browser already has, and signs in with it in one tap, as the Google
+         * sign-in does (the same account). Needs the workspace's Google sign-in,
+         * and the page's address among the Google client's authorized JavaScript
+         * origins. Waits until the person picks an account or closes the prompt
+         * (`cancelled`), or `signal` aborts. `one_tap_unavailable`: the workspace
+         * has no Google sign-in.
+         */
+        googleOneTap(options?: {
+            signal?: AbortSignal;
+            context?: 'signin' | 'signup' | 'use';
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
             locale?: string;
@@ -489,6 +572,13 @@ interface AuthTexts {
     keepCodes: string;
     passkeys: string;
     managePasskeys: string;
+    passkeysHelp: string;
+    noPasskeys: string;
+    passkeyName: string;
+    addPasskey: string;
+    removePasskey: string;
+    passkeyAdded: string;
+    passkeyUnnamed: string;
     sessions: string;
     signOutEverywhere: string;
     unknownDevice: string;
@@ -567,6 +657,21 @@ interface AuthFormProps {
     };
 }
 declare function SignIn(props: AuthFormProps): react.JSX.Element;
+interface GoogleOneTapProps {
+    /** Where to go once signed in. Without it (and without `onSuccess`), the page stays and its session updates. */
+    returnTo?: string;
+    /** Called once signed in, instead of going to `returnTo`. */
+    onSuccess?: () => void;
+    /** The prompt's words: sign in (default), sign up, or use the application. */
+    context?: 'signin' | 'signup' | 'use';
+}
+/**
+ * Google One Tap: put it on any page, and a person who is not signed in sees
+ * Google's prompt with the Google account the browser has; one tap signs them
+ * in. It draws nothing of its own, and shows nothing to somebody signed in or
+ * where the workspace has no Google sign-in.
+ */
+declare function GoogleOneTap(props: GoogleOneTapProps): null;
 declare function SignUp(props: AuthFormProps): react.JSX.Element;
 declare function ForgotPassword(props: AuthFormProps): react.JSX.Element;
 /** The page a "choose a new password" link opens: `pages.resetPassword`. */
@@ -629,4 +734,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, type JsonValue, type LinkedIdentity, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, createAuthClient, definePolicy, useAuth, useSession };
+export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, type Passkey, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };