cauthy-auth 0.16.0 → 0.18.0

package/dist/index.mjs

@@ -1083,12 +1083,12 @@ function createCauthy(given = {}) {
     if (r.session === null) return { response: problem(401, "unauthenticated", "Sign in first.", void 0, headers) };
     return { token: r.session.accessToken, kept: r.cookies.length === 0 ? (await read(request)).value : null, headers };
   }
-  async function signedIn(request, tokens, extra = []) {
+  async function signedIn(request, tokens, extra = [], more = {}) {
     const s = await stored(tokens);
     if (s === null) return problem(502, "unavailable", "Sign-in is unavailable right now. Try again in a moment.");
     const h = new Headers();
     for (const c of [...await write(request, s, readCookies(request.headers.get("cookie"))), ...extra]) h.append("set-cookie", c);
-    return json({ status: "signed_in", session: await toPublic(toSession(s)) }, 200, h);
+    return json({ status: "signed_in", session: await toPublic(toSession(s)), ...more }, 200, h);
   }
   let lookCache = null;
   async function ownRoute(request, url, route) {
@@ -1469,7 +1469,8 @@ function createCauthy(given = {}) {
       return json({ status: "verified" });
     }
     if (route === "/sign-in/passkey/begin") {
-      const res = await ask(request, "POST", "/v1/auth/webauthn/login/begin", {});
+      const email = typeof b.email === "string" && checkEmail(b.email) === null ? b.email.trim() : "";
+      const res = await ask(request, "POST", "/v1/auth/webauthn/login/begin", email !== "" ? { email } : {});
       if (res.error) return problem(res.status, res.error.code, res.error.message);
       const step = { kind: "passkey", token: String(res.data?.session_id ?? ""), returnTo: afterSignIn };
       return json(
@@ -1507,8 +1508,10 @@ function createCauthy(given = {}) {
       if (bad) return invalid(bad);
       if (pages.signIn === void 0) return problem(500, "not_configured", "cauthy-auth: pages.signIn is required for sign-in links: it is the page the link opens");
       const email = String(b.email).trim();
-      await ask(request, "POST", "/v1/auth/magic-link/request", { email }, pages.signIn);
-      const step = { kind: "code", token: email, returnTo: afterSignIn };
+      const back = typeof b.returnTo === "string" ? localPath(b.returnTo, afterSignIn) : afterSignIn;
+      const page = back === afterSignIn ? pages.signIn : `${pages.signIn}${pages.signIn.includes("?") ? "&" : "?"}return_to=${encodeURIComponent(back)}`;
+      await ask(request, "POST", "/v1/auth/magic-link/request", { email, ...b.create === true ? { create_account: true } : {} }, page);
+      const step = { kind: "code", token: email, returnTo: back };
       return json({ status: "sent" }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
     }
     if (route === "/sign-in/email-code") {
@@ -1519,7 +1522,7 @@ function createCauthy(given = {}) {
       if (step === null || step.kind !== "code") return problem(400, "step_expired", "Ask for a new link: this one was asked for too long ago.");
       const res = await ask(request, "POST", "/v1/auth/magic-link/verify-code", { email: step.token, code: String(b.code).trim() });
       if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
-      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
+      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))], { returnTo: step.returnTo });
     }
     if (route === "/sign-in/magic-link/verify") {
       if (!isToken(b.token)) return badLink();