cauthy-auth 0.11.0 → 0.13.0

package/dist/react.d.mts

@@ -212,6 +212,12 @@ type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code';
 
 /** Whether this browser can use a passkey at all. */
 declare function canUsePasskeys(): boolean;
+/**
+ * Whether this browser offers passkeys in the autofill of a field marked
+ * `autocomplete="username webauthn"`, so the person picks one without
+ * looking for a button.
+ */
+declare function canAutofillPasskeys(): Promise<boolean>;
 
 /** What went wrong, in a form the screen can show. */
 interface AuthError {
@@ -252,6 +258,13 @@ interface AuthMethods {
      * page that cannot, or a browser that refuses to here, sends the person.
      */
     passkeyOnCauthy: boolean;
+    /**
+     * The workspace's Cloudflare Turnstile site key, when it asks for the
+     * challenge: signing in, creating an account, and asking for a sign-in link
+     * or a new password then take its answer (`captchaToken`). The ready-made
+     * forms show it themselves.
+     */
+    captchaSiteKey?: string;
 }
 /** A passkey of the signed-in account. Moments are UTC. */
 interface Passkey {
@@ -293,6 +306,17 @@ interface LinkedIdentity {
     /** When it was linked, in UTC (ISO 8601). */
     linkedAt: string;
 }
+/** How an account takes its second step. */
+interface SecondStep {
+    totp: boolean;
+    /** The phone codes are sent to, masked (`+57 ••• ••• 4567`). */
+    phone: {
+        number: string;
+        channel: string;
+    } | null;
+    /** The ways the workspace sends codes to phones. */
+    phoneChannels: string[];
+}
 interface AccountClient {
     /** The account, or null when nobody is signed in. */
     get(): Promise<Account$1 | null>;
@@ -331,6 +355,30 @@ interface AccountClient {
         }): Promise<AuthResult<'renewed', {
             recoveryCodes: string[];
         }>>;
+        /**
+         * How the account takes its second step: an authenticator app, a phone
+         * (masked), and the ways the workspace sends codes to phones (`sms`,
+         * `whatsapp`; none when it has no Twilio account for it).
+         */
+        factors(): Promise<SecondStep | null>;
+        /** Adds a phone as the second step: a code is sent to it, for `verifyPhone`. */
+        addPhone(form: {
+            phone: string;
+            channel: 'sms' | 'whatsapp';
+            password: string;
+        }): Promise<AuthResult<'sent', {
+            sentTo: string;
+            channel: string;
+        }>>;
+        /** Proves the phone with the code it received. `recoveryCodes` come with a first second step, shown this once. */
+        verifyPhone(form: {
+            code: string;
+        }): Promise<AuthResult<'enabled', {
+            recoveryCodes: string[];
+        }>>;
+        removePhone(form: {
+            password: string;
+        }): Promise<AuthResult<'removed'>>;
     };
     /**
      * Asks to sign in with another address. Nothing changes yet: the new address
@@ -387,6 +435,7 @@ interface AuthClient {
         email(form: {
             email: string;
             password: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'mfa_required'>>;
@@ -396,9 +445,23 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
+        /** While the second step is asked for: whether the account has an authenticator app, and the phone (masked) a code can be sent to. */
+        mfaMethods(): Promise<AuthResult<'ok', {
+            totp: boolean;
+            phone: {
+                number: string;
+                channel: string;
+            } | null;
+        }>>;
+        /** Sends a code to the account's phone, by SMS or WhatsApp; `mfa` takes it. A few per sign-in. */
+        mfaSendCode(): Promise<AuthResult<'sent', {
+            sentTo: string;
+            channel: string;
+        }>>;
         /** Mails a link that signs the person in. The answer is the same whether or not the address has an account. */
         magicLink(form: {
             email: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'sent'>>;
         /** Signs in with the token the mailed link opened the page with (`ml_token`). */
         magicLinkVerify(form: {
@@ -426,6 +489,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'redirected'>>;
+        /**
+         * Offers the person's passkeys in the browser's autofill of the email
+         * field, which must carry `autocomplete="username webauthn"`, and signs in
+         * with the one they pick. It waits until they pick one or `signal`
+         * aborts: abort it before calling `passkey` or sending the form.
+         * `cancelled`: aborted, or this browser or page cannot (then there is
+         * nothing to offer, and the passkey button still works).
+         */
+        passkeyAutofill(options?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /**
+         * Google One Tap: Google's prompt over the page offers the Google account
+         * the browser already has, and signs in with it in one tap, as the Google
+         * sign-in does (the same account). Needs the workspace's Google sign-in,
+         * and the page's address among the Google client's authorized JavaScript
+         * origins. Waits until the person picks an account or closes the prompt
+         * (`cancelled`), or `signal` aborts. `one_tap_unavailable`: the workspace
+         * has no Google sign-in.
+         */
+        googleOneTap(options?: {
+            signal?: AbortSignal;
+            context?: 'signin' | 'signup' | 'use';
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
         /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
@@ -446,6 +537,7 @@ interface AuthClient {
             email: string;
             password: string;
             name?: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'verification_required', {
@@ -455,6 +547,7 @@ interface AuthClient {
     /** Mails a link to choose a new password. The answer is the same whether or not the address has an account. */
     forgotPassword(form: {
         email: string;
+        captchaToken?: string;
     }): Promise<AuthResult<'sent'>>;
     /** Sets the new password, with the token the mailed link opened the page with (`token`). */
     resetPassword(form: {
@@ -508,6 +601,20 @@ interface AuthTexts {
     sendLink: string;
     linkSent: string;
     codeHelp: string;
+    /** The second step when it is a phone only. */
+    codeHelpPhone: string;
+    /** "{to}" is the phone, masked. */
+    sendCodeSms: string;
+    sendCodeWhatsapp: string;
+    codeSent: string;
+    phone: string;
+    phoneHelp: string;
+    phoneOn: string;
+    phoneOff: string;
+    addPhone: string;
+    removePhone: string;
+    bySms: string;
+    byWhatsapp: string;
     verify: string;
     checkEmail: string;
     backToSignIn: string;
@@ -623,6 +730,21 @@ interface AuthFormProps {
     };
 }
 declare function SignIn(props: AuthFormProps): react.JSX.Element;
+interface GoogleOneTapProps {
+    /** Where to go once signed in. Without it (and without `onSuccess`), the page stays and its session updates. */
+    returnTo?: string;
+    /** Called once signed in, instead of going to `returnTo`. */
+    onSuccess?: () => void;
+    /** The prompt's words: sign in (default), sign up, or use the application. */
+    context?: 'signin' | 'signup' | 'use';
+}
+/**
+ * Google One Tap: put it on any page, and a person who is not signed in sees
+ * Google's prompt with the Google account the browser has; one tap signs them
+ * in. It draws nothing of its own, and shows nothing to somebody signed in or
+ * where the workspace has no Google sign-in.
+ */
+declare function GoogleOneTap(props: GoogleOneTapProps): null;
 declare function SignUp(props: AuthFormProps): react.JSX.Element;
 declare function ForgotPassword(props: AuthFormProps): react.JSX.Element;
 /** The page a "choose a new password" link opens: `pages.resetPassword`. */
@@ -685,4 +807,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, type JsonValue, type LinkedIdentity, type Passkey, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };
+export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, type Passkey, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };

package/dist/react.d.ts

@@ -212,6 +212,12 @@ type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code';
 
 /** Whether this browser can use a passkey at all. */
 declare function canUsePasskeys(): boolean;
+/**
+ * Whether this browser offers passkeys in the autofill of a field marked
+ * `autocomplete="username webauthn"`, so the person picks one without
+ * looking for a button.
+ */
+declare function canAutofillPasskeys(): Promise<boolean>;
 
 /** What went wrong, in a form the screen can show. */
 interface AuthError {
@@ -252,6 +258,13 @@ interface AuthMethods {
      * page that cannot, or a browser that refuses to here, sends the person.
      */
     passkeyOnCauthy: boolean;
+    /**
+     * The workspace's Cloudflare Turnstile site key, when it asks for the
+     * challenge: signing in, creating an account, and asking for a sign-in link
+     * or a new password then take its answer (`captchaToken`). The ready-made
+     * forms show it themselves.
+     */
+    captchaSiteKey?: string;
 }
 /** A passkey of the signed-in account. Moments are UTC. */
 interface Passkey {
@@ -293,6 +306,17 @@ interface LinkedIdentity {
     /** When it was linked, in UTC (ISO 8601). */
     linkedAt: string;
 }
+/** How an account takes its second step. */
+interface SecondStep {
+    totp: boolean;
+    /** The phone codes are sent to, masked (`+57 ••• ••• 4567`). */
+    phone: {
+        number: string;
+        channel: string;
+    } | null;
+    /** The ways the workspace sends codes to phones. */
+    phoneChannels: string[];
+}
 interface AccountClient {
     /** The account, or null when nobody is signed in. */
     get(): Promise<Account$1 | null>;
@@ -331,6 +355,30 @@ interface AccountClient {
         }): Promise<AuthResult<'renewed', {
             recoveryCodes: string[];
         }>>;
+        /**
+         * How the account takes its second step: an authenticator app, a phone
+         * (masked), and the ways the workspace sends codes to phones (`sms`,
+         * `whatsapp`; none when it has no Twilio account for it).
+         */
+        factors(): Promise<SecondStep | null>;
+        /** Adds a phone as the second step: a code is sent to it, for `verifyPhone`. */
+        addPhone(form: {
+            phone: string;
+            channel: 'sms' | 'whatsapp';
+            password: string;
+        }): Promise<AuthResult<'sent', {
+            sentTo: string;
+            channel: string;
+        }>>;
+        /** Proves the phone with the code it received. `recoveryCodes` come with a first second step, shown this once. */
+        verifyPhone(form: {
+            code: string;
+        }): Promise<AuthResult<'enabled', {
+            recoveryCodes: string[];
+        }>>;
+        removePhone(form: {
+            password: string;
+        }): Promise<AuthResult<'removed'>>;
     };
     /**
      * Asks to sign in with another address. Nothing changes yet: the new address
@@ -387,6 +435,7 @@ interface AuthClient {
         email(form: {
             email: string;
             password: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'mfa_required'>>;
@@ -396,9 +445,23 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
+        /** While the second step is asked for: whether the account has an authenticator app, and the phone (masked) a code can be sent to. */
+        mfaMethods(): Promise<AuthResult<'ok', {
+            totp: boolean;
+            phone: {
+                number: string;
+                channel: string;
+            } | null;
+        }>>;
+        /** Sends a code to the account's phone, by SMS or WhatsApp; `mfa` takes it. A few per sign-in. */
+        mfaSendCode(): Promise<AuthResult<'sent', {
+            sentTo: string;
+            channel: string;
+        }>>;
         /** Mails a link that signs the person in. The answer is the same whether or not the address has an account. */
         magicLink(form: {
             email: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'sent'>>;
         /** Signs in with the token the mailed link opened the page with (`ml_token`). */
         magicLinkVerify(form: {
@@ -426,6 +489,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'redirected'>>;
+        /**
+         * Offers the person's passkeys in the browser's autofill of the email
+         * field, which must carry `autocomplete="username webauthn"`, and signs in
+         * with the one they pick. It waits until they pick one or `signal`
+         * aborts: abort it before calling `passkey` or sending the form.
+         * `cancelled`: aborted, or this browser or page cannot (then there is
+         * nothing to offer, and the passkey button still works).
+         */
+        passkeyAutofill(options?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
+        /**
+         * Google One Tap: Google's prompt over the page offers the Google account
+         * the browser already has, and signs in with it in one tap, as the Google
+         * sign-in does (the same account). Needs the workspace's Google sign-in,
+         * and the page's address among the Google client's authorized JavaScript
+         * origins. Waits until the person picks an account or closes the prompt
+         * (`cancelled`), or `signal` aborts. `one_tap_unavailable`: the workspace
+         * has no Google sign-in.
+         */
+        googleOneTap(options?: {
+            signal?: AbortSignal;
+            context?: 'signin' | 'signup' | 'use';
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
         /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
@@ -446,6 +537,7 @@ interface AuthClient {
             email: string;
             password: string;
             name?: string;
+            captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'verification_required', {
@@ -455,6 +547,7 @@ interface AuthClient {
     /** Mails a link to choose a new password. The answer is the same whether or not the address has an account. */
     forgotPassword(form: {
         email: string;
+        captchaToken?: string;
     }): Promise<AuthResult<'sent'>>;
     /** Sets the new password, with the token the mailed link opened the page with (`token`). */
     resetPassword(form: {
@@ -508,6 +601,20 @@ interface AuthTexts {
     sendLink: string;
     linkSent: string;
     codeHelp: string;
+    /** The second step when it is a phone only. */
+    codeHelpPhone: string;
+    /** "{to}" is the phone, masked. */
+    sendCodeSms: string;
+    sendCodeWhatsapp: string;
+    codeSent: string;
+    phone: string;
+    phoneHelp: string;
+    phoneOn: string;
+    phoneOff: string;
+    addPhone: string;
+    removePhone: string;
+    bySms: string;
+    byWhatsapp: string;
     verify: string;
     checkEmail: string;
     backToSignIn: string;
@@ -623,6 +730,21 @@ interface AuthFormProps {
     };
 }
 declare function SignIn(props: AuthFormProps): react.JSX.Element;
+interface GoogleOneTapProps {
+    /** Where to go once signed in. Without it (and without `onSuccess`), the page stays and its session updates. */
+    returnTo?: string;
+    /** Called once signed in, instead of going to `returnTo`. */
+    onSuccess?: () => void;
+    /** The prompt's words: sign in (default), sign up, or use the application. */
+    context?: 'signin' | 'signup' | 'use';
+}
+/**
+ * Google One Tap: put it on any page, and a person who is not signed in sees
+ * Google's prompt with the Google account the browser has; one tap signs them
+ * in. It draws nothing of its own, and shows nothing to somebody signed in or
+ * where the workspace has no Google sign-in.
+ */
+declare function GoogleOneTap(props: GoogleOneTapProps): null;
 declare function SignUp(props: AuthFormProps): react.JSX.Element;
 declare function ForgotPassword(props: AuthFormProps): react.JSX.Element;
 /** The page a "choose a new password" link opens: `pages.resetPassword`. */
@@ -685,4 +807,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, type JsonValue, type LinkedIdentity, type Passkey, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };
+export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, type Passkey, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };