cauthy-auth 0.11.0 → 0.13.0

package/dist/client.d.ts

@@ -6,6 +6,12 @@ import 'jose';
 
 /** Whether this browser can use a passkey at all. */
 declare function canUsePasskeys(): boolean;
+/**
+ * Whether this browser offers passkeys in the autofill of a field marked
+ * `autocomplete="username webauthn"`, so the person picks one without
+ * looking for a button.
+ */
+declare function canAutofillPasskeys(): Promise<boolean>;
 
 interface SessionState {
     /** The signed-in person and their organizations, or null. */
@@ -87,6 +93,13 @@ interface AuthMethods {
      * page that cannot, or a browser that refuses to here, sends the person.
      */
     passkeyOnCauthy: boolean;
+    /**
+     * The workspace's Cloudflare Turnstile site key, when it asks for the
+     * challenge: signing in, creating an account, and asking for a sign-in link
+     * or a new password then take its answer (`captchaToken`). The ready-made
+     * forms show it themselves.
+     */
+    captchaSiteKey?: string;
 }
 /** A passkey of the signed-in account. Moments are UTC. */
 interface Passkey {
@@ -128,6 +141,17 @@ interface LinkedIdentity {
     /** When it was linked, in UTC (ISO 8601). */
     linkedAt: string;
 }
+/** How an account takes its second step. */
+interface SecondStep {
+    totp: boolean;
+    /** The phone codes are sent to, masked (`+57 ••• ••• 4567`). */
+    phone: {
+        number: string;
+        channel: string;
+    } | null;
+    /** The ways the workspace sends codes to phones. */
+    phoneChannels: string[];
+}
 interface AccountClient {
     /** The account, or null when nobody is signed in. */
     get(): Promise<Account | null>;
@@ -166,6 +190,30 @@ interface AccountClient {
         }): Promise<AuthResult<'renewed', {
             recoveryCodes: string[];
         }>>;
+        /**
+         * How the account takes its second step: an authenticator app, a phone
+         * (masked), and the ways the workspace sends codes to phones (`sms`,
+         * `whatsapp`; none when it has no Twilio account for it).
+         */
+        factors(): Promise<SecondStep | null>;
+        /** Adds a phone as the second step: a code is sent to it, for `verifyPhone`. */
+        addPhone(form: {
+            phone: string;
+            channel: 'sms' | 'whatsapp';
+            password: string;
+        }): Promise<AuthResult<'sent', {
+            sentTo: string;
+            channel: string;
+        }>>;
+        /** Proves the phone with the code it received. `recoveryCodes` come with a first second step, shown this once. */
+        verifyPhone(form: {
+            code: string;
+        }): Promise<AuthResult<'enabled', {
+            recoveryCodes: string[];
+        }>>;
+        removePhone(form: {
+            password: string;
+        }): Promise<AuthResult<'removed'>>;
     };
     /**
      * Asks to sign in with another address. Nothing changes yet: the new address
@@ -222,6 +270,7 @@ interface AuthClient {
         email(form: {
             email: string;
             password: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'mfa_required'>>;
@@ -231,9 +280,23 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
+        /** While the second step is asked for: whether the account has an authenticator app, and the phone (masked) a code can be sent to. */
+        mfaMethods(): Promise<AuthResult<'ok', {
+            totp: boolean;
+            phone: {
+                number: string;
+                channel: string;
+            } | null;
+        }>>;
+        /** Sends a code to the account's phone, by SMS or WhatsApp; `mfa` takes it. A few per sign-in. */
+        mfaSendCode(): Promise<AuthResult<'sent', {
+            sentTo: string;
+            channel: string;
+        }>>;
         /** Mails a link that signs the person in. The answer is the same whether or not the address has an account. */
         magicLink(form: {
             email: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'sent'>>;
         /** Signs in with the token the mailed link opened the page with (`ml_token`). */
         magicLinkVerify(form: {
@@ -261,6 +324,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'redirected'>>;
+        /**
+         * Offers the person's passkeys in the browser's autofill of the email
+         * field, which must carry `autocomplete="username webauthn"`, and signs in
+         * with the one they pick. It waits until they pick one or `signal`
+         * aborts: abort it before calling `passkey` or sending the form.
+         * `cancelled`: aborted, or this browser or page cannot (then there is
+         * nothing to offer, and the passkey button still works).
+         */
+        passkeyAutofill(options?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /**
+         * Google One Tap: Google's prompt over the page offers the Google account
+         * the browser already has, and signs in with it in one tap, as the Google
+         * sign-in does (the same account). Needs the workspace's Google sign-in,
+         * and the page's address among the Google client's authorized JavaScript
+         * origins. Waits until the person picks an account or closes the prompt
+         * (`cancelled`), or `signal` aborts. `one_tap_unavailable`: the workspace
+         * has no Google sign-in.
+         */
+        googleOneTap(options?: {
+            signal?: AbortSignal;
+            context?: 'signin' | 'signup' | 'use';
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
         /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
@@ -281,6 +372,7 @@ interface AuthClient {
             email: string;
             password: string;
             name?: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'verification_required', {
@@ -290,6 +382,7 @@ interface AuthClient {
     /** Mails a link to choose a new password. The answer is the same whether or not the address has an account. */
     forgotPassword(form: {
         email: string;
+        captchaToken?: string;
     }): Promise<AuthResult<'sent'>>;
     /** Sets the new password, with the token the mailed link opened the page with (`token`). */
     resetPassword(form: {
@@ -326,4 +419,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type Passkey, type SessionState, type SessionStore, type SessionStoreOptions, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type Passkey, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   MIN_PASSWORD: () => MIN_PASSWORD,
+  canAutofillPasskeys: () => canAutofillPasskeys,
   canUsePasskeys: () => canUsePasskeys,
   checkCode: () => checkCode,
   checkEmail: () => checkEmail,
@@ -36,6 +37,15 @@ module.exports = __toCommonJS(client_exports);
 function canUsePasskeys() {
   return typeof window !== "undefined" && typeof window.PublicKeyCredential === "function" && typeof navigator !== "undefined" && typeof navigator.credentials?.get === "function";
 }
+async function canAutofillPasskeys() {
+  if (!canUsePasskeys()) return false;
+  const pkc = window.PublicKeyCredential;
+  try {
+    return typeof pkc.isConditionalMediationAvailable === "function" && await pkc.isConditionalMediationAvailable() === true;
+  } catch {
+    return false;
+  }
+}
 function bytes(text2) {
   const b64 = text2.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(text2.length / 4) * 4, "=");
   const bin = atob(b64);
@@ -51,9 +61,9 @@ function text(buf) {
   return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 var withId = (list) => (list ?? []).map((c) => ({ ...c, id: bytes(c.id) }));
-async function getPasskey(options) {
+async function getPasskey(options, how = {}) {
   const publicKey = { ...options, challenge: bytes(options.challenge), allowCredentials: withId(options.allowCredentials) };
-  const cred = await navigator.credentials.get({ publicKey });
+  const cred = await navigator.credentials.get({ publicKey, ...how });
   if (cred === null) throw new DOMException("No passkey was chosen.", "NotAllowedError");
   const r = cred.response;
   return {
@@ -281,6 +291,24 @@ function createSessionStore(options = {}) {
 }
 
 // src/client.ts
+var googleScript = null;
+function loadGoogleIdentity() {
+  const ready = () => window.google?.accounts?.id;
+  if (ready()) return Promise.resolve(ready());
+  googleScript ??= new Promise((resolve, reject) => {
+    const script = document.createElement("script");
+    script.src = "https://accounts.google.com/gsi/client";
+    script.async = true;
+    script.onload = () => ready() ? resolve(ready()) : reject(new Error("google identity services did not load"));
+    script.onerror = () => {
+      googleScript = null;
+      reject(new Error("google identity services did not load"));
+    };
+    document.head.appendChild(script);
+  });
+  return googleScript;
+}
+var PASSKEY_SECONDS = 300;
 var UNAVAILABLE = { code: "unavailable", message: "Sign-in is unavailable right now. Try again in a moment." };
 function createAuthClient(options = {}) {
   const base = (options.basePath ?? "/api/auth").replace(/\/+$/, "");
@@ -289,13 +317,13 @@ function createAuthClient(options = {}) {
     const said = typeof options.locale === "function" ? options.locale() : options.locale;
     return (said ?? (typeof document === "undefined" ? "" : document.documentElement?.lang) ?? "").trim();
   };
-  async function post(path, form, bad) {
+  async function post(path, form, bad, captchaToken) {
     if (bad) return { ok: false, error: { code: bad.code, message: bad.message, field: bad.field } };
     try {
       const res = await doFetch(`${base}${path}`, {
         method: "POST",
         credentials: "same-origin",
-        headers: { "content-type": "application/json", accept: "application/json", ...locale() ? { "x-cauthy-locale": locale() } : {} },
+        headers: { "content-type": "application/json", accept: "application/json", ...locale() ? { "x-cauthy-locale": locale() } : {}, ...captchaToken ? { "x-cauthy-captcha": captchaToken } : {} },
         body: JSON.stringify(form)
       });
       const body = await res.json().catch(() => null);
@@ -347,9 +375,11 @@ function createAuthClient(options = {}) {
   }
   return {
     signIn: {
-      email: (f) => post("/sign-in/email", { email: f.email, password: f.password }, firstProblem(checkEmail(f.email), checkPassword(f.password))),
+      email: (f) => post("/sign-in/email", { email: f.email, password: f.password }, firstProblem(checkEmail(f.email), checkPassword(f.password)), f.captchaToken),
       mfa: (f) => post("/sign-in/mfa", { code: f.code }, checkCode(f.code)),
-      magicLink: (f) => post("/sign-in/magic-link", { email: f.email }, checkEmail(f.email)),
+      mfaMethods: () => post("/sign-in/mfa/methods", {}, null),
+      mfaSendCode: () => post("/sign-in/mfa/send", {}, null),
+      magicLink: (f) => post("/sign-in/magic-link", { email: f.email }, checkEmail(f.email), f.captchaToken),
       magicLinkVerify: (f) => post("/sign-in/magic-link/verify", { token: f.token }, null),
       emailCode: (f) => post("/sign-in/email-code", { code: f.code }, checkCode(f.code)),
       passkeyUrl,
@@ -364,15 +394,75 @@ function createAuthClient(options = {}) {
         window.location.assign(passkeyUrl(o));
         return { ok: true, status: "redirected" };
       },
+      async passkeyAutofill(o = {}) {
+        const cancelled = { ok: false, error: { code: "cancelled", message: "No passkey was chosen." } };
+        const m = await methods();
+        if (!m.passkeyHere || !await canAutofillPasskeys()) return cancelled;
+        for (; ; ) {
+          if (o.signal?.aborted) return cancelled;
+          const begun = await post("/sign-in/passkey/begin", {}, null);
+          if (!begun.ok) return begun;
+          const renew = new AbortController();
+          const stop = () => renew.abort();
+          o.signal?.addEventListener("abort", stop, { once: true });
+          const timer = setTimeout(stop, (PASSKEY_SECONDS - 30) * 1e3);
+          let credential;
+          try {
+            credential = await getPasskey(begun.options, { mediation: "conditional", signal: renew.signal });
+          } catch (e) {
+            if (o.signal?.aborted) return cancelled;
+            if (renew.signal.aborted) continue;
+            return { ok: false, error: ceremonyError(e) };
+          } finally {
+            clearTimeout(timer);
+            o.signal?.removeEventListener("abort", stop);
+          }
+          return post("/sign-in/passkey/finish", { credential }, null);
+        }
+      },
+      async googleOneTap(o = {}) {
+        const cancelled = { ok: false, error: { code: "cancelled", message: "No Google account was chosen." } };
+        if (typeof window === "undefined" || o.signal?.aborted) return cancelled;
+        const begun = await post("/sign-in/google-one-tap/begin", {}, null);
+        if (!begun.ok) return begun;
+        let gis;
+        try {
+          gis = await loadGoogleIdentity();
+        } catch {
+          return { ok: false, error: { code: "unavailable", message: "Google could not be reached. Try again, or sign in another way." } };
+        }
+        const credential = await new Promise((done) => {
+          o.signal?.addEventListener("abort", () => {
+            gis.cancel();
+            done(null);
+          }, { once: true });
+          gis.initialize({
+            client_id: begun.clientId,
+            nonce: begun.nonce,
+            context: o.context ?? "signin",
+            callback: (r) => done(r.credential ?? null),
+            auto_select: false,
+            cancel_on_tap_outside: true,
+            itp_support: true,
+            use_fedcm_for_prompt: true
+          });
+          gis.prompt((moment) => {
+            if (moment.isNotDisplayed?.() || moment.isSkippedMoment?.()) done(null);
+            else if (moment.isDismissedMoment?.() && moment.getDismissedReason?.() !== "credential_returned") done(null);
+          });
+        });
+        if (credential === null) return cancelled;
+        return post("/sign-in/google-one-tap", { credential }, null);
+      },
       socialUrl,
       social(provider, o) {
         window.location.assign(socialUrl(provider, o));
       }
     },
     signUp: {
-      email: (f) => post("/sign-up/email", { email: f.email, password: f.password, name: f.name }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password)))
+      email: (f) => post("/sign-up/email", { email: f.email, password: f.password, name: f.name }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password)), f.captchaToken)
     },
-    forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email)),
+    forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
     signOut: () => post("/sign-out", {}, null),
@@ -390,7 +480,14 @@ function createAuthClient(options = {}) {
         setup: (f) => post("/me/mfa/setup", { password: f.password }, null),
         verify: (f) => post("/me/mfa/verify", { code: f.code }, checkCode(f.code)),
         disable: (f) => post("/me/mfa/disable", { password: f.password }, null),
-        recoveryCodes: (f) => post("/me/mfa/recovery-codes", { password: f.password }, null)
+        recoveryCodes: (f) => post("/me/mfa/recovery-codes", { password: f.password }, null),
+        async factors() {
+          const body = await read("/me/mfa/factors");
+          return body && typeof body.totp === "boolean" ? body : null;
+        },
+        addPhone: (f) => post("/me/mfa/phone", { phone: f.phone, channel: f.channel, password: f.password }, null),
+        verifyPhone: (f) => post("/me/mfa/phone/verify", { code: f.code }, checkCode(f.code)),
+        removePhone: (f) => post("/me/mfa/phone/remove", { password: f.password }, null)
       },
       changeEmail: (f) => post("/me/email", { email: f.email, password: f.password }, checkEmail(f.email)),
       async identities() {
@@ -436,6 +533,7 @@ function createAuthClient(options = {}) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   MIN_PASSWORD,
+  canAutofillPasskeys,
   canUsePasskeys,
   checkCode,
   checkEmail,