cauthy-auth 0.16.0 → 0.18.0

package/dist/react.d.mts

@@ -484,10 +484,19 @@ interface AuthClient {
             sentTo: string;
             channel: string;
         }>>;
-        /** Mails a link that signs the person in. The answer is the same whether or not the address has an account. */
+        /**
+         * Mails a link (and a code) that signs the person in. The answer is the
+         * same whether or not the address has an account. `create`: an address
+         * with no account gets one when the link or code is used, if the
+         * workspace accepts new accounts — one screen signs people in and up.
+         * `returnTo` (a path of this site) travels in the link: the page it opens
+         * gets it as `?return_to=`, and `emailCode` answers it.
+         */
         magicLink(form: {
             email: string;
             captchaToken?: string;
+            create?: boolean;
+            returnTo?: string;
         }): Promise<AuthResult<'sent'>>;
         /** Signs in with the token the mailed link opened the page with (`ml_token`). */
         magicLinkVerify(form: {
@@ -500,6 +509,7 @@ interface AuthClient {
             code: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
+            returnTo?: string;
         }>>;
         /**
          * Signs in with a passkey, on this page: the browser asks the person for
@@ -507,11 +517,14 @@ interface AuthClient {
          * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
          * to Cauthy's page for that step alone and comes back signed in, at
          * `returnTo`: then the answer is `redirected`. `cancelled`: the person
-         * closed the browser's prompt.
+         * closed the browser's prompt. `email`, when the person typed it: the
+         * browser is told which passkeys are theirs, so a security key that did
+         * not keep its passkey (one made before cauthy-auth 0.18.0) is found too.
          */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
+            email?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'redirected'>>;
@@ -709,6 +722,12 @@ interface AuthFormProps {
     onSuccess?: () => void;
     /** Where to go after signing in, and where a provider returns to. Default: `/`. */
     returnTo?: string;
+    /**
+     * `<SignIn />`: a sign-in link sent to an address with no account makes
+     * one when it is used (if the workspace accepts new accounts), so this one
+     * screen signs people in and up alike. Default: off.
+     */
+    createAccounts?: boolean;
     /** Paths of the application's other screens, for the links between them. */
     links?: {
         signIn?: string;

package/dist/react.d.ts

@@ -484,10 +484,19 @@ interface AuthClient {
             sentTo: string;
             channel: string;
         }>>;
-        /** Mails a link that signs the person in. The answer is the same whether or not the address has an account. */
+        /**
+         * Mails a link (and a code) that signs the person in. The answer is the
+         * same whether or not the address has an account. `create`: an address
+         * with no account gets one when the link or code is used, if the
+         * workspace accepts new accounts — one screen signs people in and up.
+         * `returnTo` (a path of this site) travels in the link: the page it opens
+         * gets it as `?return_to=`, and `emailCode` answers it.
+         */
         magicLink(form: {
             email: string;
             captchaToken?: string;
+            create?: boolean;
+            returnTo?: string;
         }): Promise<AuthResult<'sent'>>;
         /** Signs in with the token the mailed link opened the page with (`ml_token`). */
         magicLinkVerify(form: {
@@ -500,6 +509,7 @@ interface AuthClient {
             code: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
+            returnTo?: string;
         }>>;
         /**
          * Signs in with a passkey, on this page: the browser asks the person for
@@ -507,11 +517,14 @@ interface AuthClient {
          * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
          * to Cauthy's page for that step alone and comes back signed in, at
          * `returnTo`: then the answer is `redirected`. `cancelled`: the person
-         * closed the browser's prompt.
+         * closed the browser's prompt. `email`, when the person typed it: the
+         * browser is told which passkeys are theirs, so a security key that did
+         * not keep its passkey (one made before cauthy-auth 0.18.0) is found too.
          */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
+            email?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'redirected'>>;
@@ -709,6 +722,12 @@ interface AuthFormProps {
     onSuccess?: () => void;
     /** Where to go after signing in, and where a provider returns to. Default: `/`. */
     returnTo?: string;
+    /**
+     * `<SignIn />`: a sign-in link sent to an address with no account makes
+     * one when it is used (if the workspace accepts new accounts), so this one
+     * screen signs people in and up alike. Default: off.
+     */
+    createAccounts?: boolean;
     /** Paths of the application's other screens, for the links between them. */
     links?: {
         signIn?: string;

package/dist/react.js

@@ -302,14 +302,15 @@ function createAuthClient(options = {}) {
       mfa: (f) => post("/sign-in/mfa", { code: f.code }, checkCode(f.code)),
       mfaMethods: () => post("/sign-in/mfa/methods", {}, null),
       mfaSendCode: () => post("/sign-in/mfa/send", {}, null),
-      magicLink: (f) => post("/sign-in/magic-link", { email: f.email }, checkEmail(f.email), f.captchaToken),
+      magicLink: (f) => post("/sign-in/magic-link", { email: f.email, ...f.create ? { create: true } : {}, ...f.returnTo ? { returnTo: f.returnTo } : {} }, checkEmail(f.email), f.captchaToken),
       magicLinkVerify: (f) => post("/sign-in/magic-link/verify", { token: f.token }, null),
       emailCode: (f) => post("/sign-in/email-code", { code: f.code }, checkCode(f.code)),
       passkeyUrl,
       async passkey(o) {
         const m = await methods();
         if (m.passkeyHere && canUsePasskeys()) {
-          const r = await ceremony("/sign-in/passkey/begin", "/sign-in/passkey/finish", {}, getPasskey);
+          const email = o?.email?.trim() ?? "";
+          const r = await ceremony("/sign-in/passkey/begin", "/sign-in/passkey/finish", email !== "" && checkEmail(email) === null ? { email } : {}, getPasskey);
           if (r.ok || r.error.code !== "passkey_unavailable" || !m.passkeyOnCauthy) return r;
         } else if (!m.passkeyOnCauthy) {
           return { ok: false, error: { code: "passkey_unavailable", message: "Passkeys cannot be used here." } };
@@ -836,6 +837,9 @@ function useMethods(auth) {
   }, []);
   return methods;
 }
+function sitePath(to) {
+  return to && to.startsWith("/") && !to.startsWith("//") && !to.includes("\\") ? to : void 0;
+}
 function useForm(props) {
   const t = { ...TEXTS[props.locale ?? "en"], ...props.texts, errors: { ...TEXTS[props.locale ?? "en"].errors, ...props.texts?.errors } };
   const cx = (slot) => props.classNames?.[slot] ?? `cauthy-${slot}`;
@@ -844,9 +848,9 @@ function useForm(props) {
   const [error, setError] = (0, import_react.useState)(null);
   const [busy, setBusy] = (0, import_react.useState)(false);
   const say = (e) => t.errors[e.code] ?? e.message;
-  const done = () => {
+  const done = (to) => {
     if (props.onSuccess) props.onSuccess();
-    else window.location.assign(props.returnTo ?? "/");
+    else window.location.assign(sitePath(to) ?? props.returnTo ?? "/");
   };
   const root = useRoot(props);
   return { t, cx, Button, Input, error, setError, busy, setBusy, say, done, root };
@@ -936,7 +940,7 @@ function SignIn(props) {
     if (!token) return;
     setStep("opening");
     void auth.signIn.magicLinkVerify({ token }).then((r) => {
-      if (r.ok) return f.done();
+      if (r.ok) return f.done(new URLSearchParams(window.location.search).get("return_to") ?? void 0);
       f.setError(r.error);
       setStep("password");
     });
@@ -967,13 +971,13 @@ function SignIn(props) {
       return f.setError(r.error);
     }
     if (r.status === "mfa_required") return setStep("code");
-    f.done();
+    f.done("returnTo" in r && typeof r.returnTo === "string" ? r.returnTo : void 0);
   };
   const usePasskey = async () => {
     autofill.current?.abort();
     f.setBusy(true);
     f.setError(null);
-    const r = await auth.signIn.passkey({ returnTo: props.returnTo, locale: props.locale });
+    const r = await auth.signIn.passkey({ returnTo: props.returnTo, locale: props.locale, email });
     if (r.ok && r.status === "redirected") return;
     f.setBusy(false);
     if (!r.ok) setOffer((n) => n + 1);
@@ -984,7 +988,7 @@ function SignIn(props) {
     autofill.current?.abort();
     f.setBusy(true);
     f.setError(null);
-    const r = await auth.signIn.magicLink({ email, captchaToken: challenge.token });
+    const r = await auth.signIn.magicLink({ email, captchaToken: challenge.token, create: props.createAccounts, returnTo: props.returnTo });
     f.setBusy(false);
     challenge.renew();
     if (!r.ok) return f.setError(r.error);