cauthy-auth 0.12.0 → 0.14.0

package/dist/index.mjs

@@ -985,6 +985,11 @@ function createCauthy(given = {}) {
   }
   const STEP_SECONDS = 600;
   const PASSKEY_SECONDS = 300;
+  const factorsOf = (d) => ({
+    totp: d?.totp === true,
+    phone: d?.phone ? { number: String(d.phone.number ?? ""), channel: String(d.phone.channel ?? "sms") } : null,
+    phoneChannels: Array.isArray(d?.phone_channels) ? d.phone_channels.map(String) : []
+  });
   const isCredential = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.id === "string" && typeof v.response === "object";
   const passkeyOf = (d) => ({
     id: String(d?.id ?? ""),
@@ -992,6 +997,15 @@ function createCauthy(given = {}) {
     createdAt: String(d?.created_at ?? ""),
     lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null
   });
+  const agentOf = (d) => ({
+    id: String(d?.id ?? ""),
+    name: String(d?.agent?.name ?? ""),
+    redirectHost: String(d?.agent?.redirect_host ?? ""),
+    resource: { name: String(d?.resource?.name ?? ""), uri: String(d?.resource?.uri ?? "") },
+    scopes: Array.isArray(d?.scopes) ? d.scopes.map((s) => ({ name: String(s?.name ?? ""), description: String(s?.description ?? "") })) : [],
+    connectedAt: String(d?.created_at ?? ""),
+    lastUsedAt: String(d?.last_used_at ?? "")
+  });
   const problem = (status2, code, message, field, headers) => json({ error: { code, message, ...field ? { field } : {} } }, status2, headers);
   const invalid = (p) => problem(400, p.code, p.message, p.field);
   function ownRequest(request) {
@@ -1035,6 +1049,9 @@ function createCauthy(given = {}) {
           ...clientId ? { "x-cauthy-client-id": clientId } : {},
           ...await passedOn(request),
           ...bearer2 ? { authorization: `Bearer ${bearer2}` } : {},
+          // The answer to the workspace's Turnstile challenge, from the
+          // person's browser: Cauthy checks it at the doors that ask for it.
+          ...request.headers.get("x-cauthy-captcha") ? { "x-captcha-token": request.headers.get("x-cauthy-captcha") } : {},
           ...request.headers.get("accept-language") ? { "accept-language": request.headers.get("accept-language") } : {},
           // The language the application says its person reads, over the browser's.
           ...request.headers.get("x-cauthy-locale") ? { "x-cauthy-locale": request.headers.get("x-cauthy-locale") } : {},
@@ -1092,6 +1109,12 @@ function createCauthy(given = {}) {
       "/me/mfa/verify",
       "/me/mfa/disable",
       "/me/mfa/recovery-codes",
+      "/me/mfa/factors",
+      "/me/mfa/phone",
+      "/me/mfa/phone/verify",
+      "/me/mfa/phone/remove",
+      "/sign-in/mfa/methods",
+      "/sign-in/mfa/send",
       "/me/sessions",
       "/me/sessions/end",
       "/me/email",
@@ -1107,7 +1130,9 @@ function createCauthy(given = {}) {
       "/me/passkeys",
       "/me/passkeys/add/begin",
       "/me/passkeys/add/finish",
-      "/me/passkeys/remove"
+      "/me/passkeys/remove",
+      "/me/agents",
+      "/me/agents/disconnect"
     ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/");
     if (!own) return null;
     if (tenant === "") {
@@ -1135,7 +1160,8 @@ function createCauthy(given = {}) {
         magicLink: settings.data?.allow_magic_link === true && pages.signIn !== void 0,
         passkey: place.error ? true : here || place.data?.on_cauthy === true,
         passkeyHere: here,
-        passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true
+        passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true,
+        ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}
       });
     }
     if (route.startsWith("/sign-in/social/") && !post) {
@@ -1205,6 +1231,21 @@ function createCauthy(given = {}) {
       const list = Array.isArray(res.data) ? res.data : [];
       return json({ passkeys: list.map(passkeyOf) }, 200, mine.headers);
     }
+    if (route === "/me/agents" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/me/agents", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      return json({ agents: list.map(agentOf) }, 200, mine.headers);
+    }
+    if (route === "/me/mfa/factors" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/mfa/factors", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      return json(factorsOf(res.data), 200, mine.headers);
+    }
     if ((route === "/me" || route === "/me/sessions") && !post) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
@@ -1253,6 +1294,20 @@ function createCauthy(given = {}) {
       if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
       return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
     }
+    if (route === "/sign-in/mfa/methods" || route === "/sign-in/mfa/send") {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      if (route === "/sign-in/mfa/methods") {
+        const res2 = await ask(request, "POST", "/v1/auth/mfa/methods", { mfa_token: step.token });
+        if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
+        const p = res2.data?.phone;
+        return json({ status: "ok", totp: res2.data?.totp === true, phone: p ? { number: String(p.number ?? ""), channel: String(p.channel ?? "sms") } : null });
+      }
+      const res = await ask(request, "POST", "/v1/auth/mfa/send", { mfa_token: step.token });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "sms") });
+    }
     if (route === "/sign-up/email") {
       const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password));
       if (bad) return invalid(bad);
@@ -1311,6 +1366,23 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res, "code");
         return json({ status: "enabled", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
       }
+      if (route === "/me/mfa/phone") {
+        const res = await as("/v1/auth/mfa/phone", { phone: typeof b.phone === "string" ? b.phone : "", channel: typeof b.channel === "string" ? b.channel : "sms", password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : res.error.code === "validation_error" ? "phone" : void 0);
+        return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "") }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/phone/verify") {
+        const bad = checkCode(b.code);
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/mfa/phone/verify", { code: String(b.code).trim() });
+        if (res.error) return refused(res, "code");
+        return json({ status: "enabled", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
+      }
+      if (route === "/me/mfa/phone/remove") {
+        const res = await as("/v1/auth/mfa/phone/remove", { password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
+        return json({ status: "removed" }, 200, mine.headers);
+      }
       if (route === "/me/mfa/disable") {
         const res = await as("/v1/auth/me/mfa/disable", { password });
         if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
@@ -1363,6 +1435,13 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res);
         return json({ status: "removed", id }, 200, mine.headers);
       }
+      if (route === "/me/agents/disconnect") {
+        const id = typeof b.id === "string" ? b.id : "";
+        if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, "invalid_agent", "Say which agent to disconnect.", void 0, mine.headers);
+        const res = await as(`/v1/auth/me/agents/${id}`, void 0, "DELETE");
+        if (res.error) return refused(res);
+        return json({ status: "disconnected", id }, 200, mine.headers);
+      }
       if (route === "/me/sessions/end") {
         const res = await as("/v1/auth/me/sessions", void 0, "DELETE");
         if (res.error) return refused(res);