cauthy-auth 0.11.0 → 0.13.0

package/dist/index.mjs

@@ -985,6 +985,11 @@ function createCauthy(given = {}) {
   }
   const STEP_SECONDS = 600;
   const PASSKEY_SECONDS = 300;
+  const factorsOf = (d) => ({
+    totp: d?.totp === true,
+    phone: d?.phone ? { number: String(d.phone.number ?? ""), channel: String(d.phone.channel ?? "sms") } : null,
+    phoneChannels: Array.isArray(d?.phone_channels) ? d.phone_channels.map(String) : []
+  });
   const isCredential = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.id === "string" && typeof v.response === "object";
   const passkeyOf = (d) => ({
     id: String(d?.id ?? ""),
@@ -1035,6 +1040,9 @@ function createCauthy(given = {}) {
           ...clientId ? { "x-cauthy-client-id": clientId } : {},
           ...await passedOn(request),
           ...bearer2 ? { authorization: `Bearer ${bearer2}` } : {},
+          // The answer to the workspace's Turnstile challenge, from the
+          // person's browser: Cauthy checks it at the doors that ask for it.
+          ...request.headers.get("x-cauthy-captcha") ? { "x-captcha-token": request.headers.get("x-cauthy-captcha") } : {},
           ...request.headers.get("accept-language") ? { "accept-language": request.headers.get("accept-language") } : {},
           // The language the application says its person reads, over the browser's.
           ...request.headers.get("x-cauthy-locale") ? { "x-cauthy-locale": request.headers.get("x-cauthy-locale") } : {},
@@ -1092,6 +1100,12 @@ function createCauthy(given = {}) {
       "/me/mfa/verify",
       "/me/mfa/disable",
       "/me/mfa/recovery-codes",
+      "/me/mfa/factors",
+      "/me/mfa/phone",
+      "/me/mfa/phone/verify",
+      "/me/mfa/phone/remove",
+      "/sign-in/mfa/methods",
+      "/sign-in/mfa/send",
       "/me/sessions",
       "/me/sessions/end",
       "/me/email",
@@ -1102,6 +1116,8 @@ function createCauthy(given = {}) {
       "/look",
       "/sign-in/passkey/begin",
       "/sign-in/passkey/finish",
+      "/sign-in/google-one-tap/begin",
+      "/sign-in/google-one-tap",
       "/me/passkeys",
       "/me/passkeys/add/begin",
       "/me/passkeys/add/finish",
@@ -1133,7 +1149,8 @@ function createCauthy(given = {}) {
         magicLink: settings.data?.allow_magic_link === true && pages.signIn !== void 0,
         passkey: place.error ? true : here || place.data?.on_cauthy === true,
         passkeyHere: here,
-        passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true
+        passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true,
+        ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}
       });
     }
     if (route.startsWith("/sign-in/social/") && !post) {
@@ -1203,6 +1220,13 @@ function createCauthy(given = {}) {
       const list = Array.isArray(res.data) ? res.data : [];
       return json({ passkeys: list.map(passkeyOf) }, 200, mine.headers);
     }
+    if (route === "/me/mfa/factors" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/mfa/factors", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      return json(factorsOf(res.data), 200, mine.headers);
+    }
     if ((route === "/me" || route === "/me/sessions") && !post) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
@@ -1251,6 +1275,20 @@ function createCauthy(given = {}) {
       if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
       return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
     }
+    if (route === "/sign-in/mfa/methods" || route === "/sign-in/mfa/send") {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      if (route === "/sign-in/mfa/methods") {
+        const res2 = await ask(request, "POST", "/v1/auth/mfa/methods", { mfa_token: step.token });
+        if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
+        const p = res2.data?.phone;
+        return json({ status: "ok", totp: res2.data?.totp === true, phone: p ? { number: String(p.number ?? ""), channel: String(p.channel ?? "sms") } : null });
+      }
+      const res = await ask(request, "POST", "/v1/auth/mfa/send", { mfa_token: step.token });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "sms") });
+    }
     if (route === "/sign-up/email") {
       const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password));
       if (bad) return invalid(bad);
@@ -1309,6 +1347,23 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res, "code");
         return json({ status: "enabled", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
       }
+      if (route === "/me/mfa/phone") {
+        const res = await as("/v1/auth/mfa/phone", { phone: typeof b.phone === "string" ? b.phone : "", channel: typeof b.channel === "string" ? b.channel : "sms", password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : res.error.code === "validation_error" ? "phone" : void 0);
+        return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "") }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/phone/verify") {
+        const bad = checkCode(b.code);
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/mfa/phone/verify", { code: String(b.code).trim() });
+        if (res.error) return refused(res, "code");
+        return json({ status: "enabled", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/phone/remove") {
+        const res = await as("/v1/auth/mfa/phone/remove", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        return json({ status: "removed" }, 200, mine.headers);
+      }
       if (route === "/me/mfa/disable") {
         const res = await as("/v1/auth/me/mfa/disable", { password });
         if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
@@ -1410,6 +1465,17 @@ function createCauthy(given = {}) {
       }
       return signedIn(request, res.data, [clear]);
     }
+    if (route === "/sign-in/google-one-tap/begin") {
+      const res = await ask(request, "POST", "/v1/auth/google/one-tap/begin", {});
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return json({ status: "started", clientId: String(res.data?.client_id ?? ""), nonce: String(res.data?.nonce ?? "") });
+    }
+    if (route === "/sign-in/google-one-tap") {
+      if (typeof b.credential !== "string" || b.credential === "") return problem(400, "bad_request", "Send the credential Google gave the page.");
+      const res = await ask(request, "POST", "/v1/auth/google/one-tap", { credential: b.credential });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data);
+    }
     if (route === "/sign-in/magic-link") {
       const bad = checkEmail(b.email);
       if (bad) return invalid(bad);