cauthy-auth 0.17.0 → 0.19.0

package/dist/react.d.mts

@@ -266,11 +266,19 @@ interface AuthMethods {
      */
     captchaSiteKey?: string;
 }
+/**
+ * What holds a passkey, as its authenticator says: a security key (a YubiKey),
+ * one synced across the person's devices (iCloud Keychain, Google Password
+ * Manager), one on a single device (Windows Hello), or unknown (made before
+ * Cauthy kept this).
+ */
+type PasskeyKind = 'security_key' | 'synced' | 'device' | 'unknown';
 /** A passkey of the signed-in account. Moments are UTC. */
 interface Passkey {
     id: string;
     /** What the person called it ("My laptop"), or "". */
     name: string;
+    kind: PasskeyKind;
     createdAt: string;
     /** When it last signed the person in, or null. */
     lastUsedAt: string | null;
@@ -444,10 +452,14 @@ interface AccountClient {
      * Makes a passkey on this device, on this page: the browser asks the person
      * for their fingerprint, face or screen lock. An account with a password
      * proves it again first. `cancelled`: the person closed the browser's prompt.
+     * `kind` sends the browser straight to one: `'device'`, this device's
+     * fingerprint, face or screen lock; `'security_key'`, a security key.
+     * Without it, the browser offers all.
      */
     addPasskey(form?: {
         password?: string;
         name?: string;
+        kind?: 'device' | 'security_key';
     }): Promise<AuthResult<'added', {
         passkey: Passkey;
     }>>;
@@ -517,11 +529,14 @@ interface AuthClient {
          * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
          * to Cauthy's page for that step alone and comes back signed in, at
          * `returnTo`: then the answer is `redirected`. `cancelled`: the person
-         * closed the browser's prompt.
+         * closed the browser's prompt. `email`, when the person typed it: the
+         * browser is told which passkeys are theirs, so a security key that did
+         * not keep its passkey (one made before cauthy-auth 0.18.0) is found too.
          */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
+            email?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'redirected'>>;
@@ -684,7 +699,11 @@ interface AuthTexts {
     passkeysHelp: string;
     noPasskeys: string;
     passkeyName: string;
+    /** @deprecated Unused since 0.19.0: the account screen offers `addPasskeyDevice` and `addSecurityKey`. */
     addPasskey: string;
+    addPasskeyDevice: string;
+    addSecurityKey: string;
+    passkeyKinds: Record<'security_key' | 'synced' | 'device', string>;
     removePasskey: string;
     passkeyAdded: string;
     passkeyUnnamed: string;
@@ -853,4 +872,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, type ConnectedAgent, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, type Passkey, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };
+export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, type ConnectedAgent, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, type Passkey, type PasskeyKind, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };

package/dist/react.d.ts

@@ -266,11 +266,19 @@ interface AuthMethods {
      */
     captchaSiteKey?: string;
 }
+/**
+ * What holds a passkey, as its authenticator says: a security key (a YubiKey),
+ * one synced across the person's devices (iCloud Keychain, Google Password
+ * Manager), one on a single device (Windows Hello), or unknown (made before
+ * Cauthy kept this).
+ */
+type PasskeyKind = 'security_key' | 'synced' | 'device' | 'unknown';
 /** A passkey of the signed-in account. Moments are UTC. */
 interface Passkey {
     id: string;
     /** What the person called it ("My laptop"), or "". */
     name: string;
+    kind: PasskeyKind;
     createdAt: string;
     /** When it last signed the person in, or null. */
     lastUsedAt: string | null;
@@ -444,10 +452,14 @@ interface AccountClient {
      * Makes a passkey on this device, on this page: the browser asks the person
      * for their fingerprint, face or screen lock. An account with a password
      * proves it again first. `cancelled`: the person closed the browser's prompt.
+     * `kind` sends the browser straight to one: `'device'`, this device's
+     * fingerprint, face or screen lock; `'security_key'`, a security key.
+     * Without it, the browser offers all.
      */
     addPasskey(form?: {
         password?: string;
         name?: string;
+        kind?: 'device' | 'security_key';
     }): Promise<AuthResult<'added', {
         passkey: Passkey;
     }>>;
@@ -517,11 +529,14 @@ interface AuthClient {
          * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
          * to Cauthy's page for that step alone and comes back signed in, at
          * `returnTo`: then the answer is `redirected`. `cancelled`: the person
-         * closed the browser's prompt.
+         * closed the browser's prompt. `email`, when the person typed it: the
+         * browser is told which passkeys are theirs, so a security key that did
+         * not keep its passkey (one made before cauthy-auth 0.18.0) is found too.
          */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
+            email?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }> | AuthResult<'redirected'>>;
@@ -684,7 +699,11 @@ interface AuthTexts {
     passkeysHelp: string;
     noPasskeys: string;
     passkeyName: string;
+    /** @deprecated Unused since 0.19.0: the account screen offers `addPasskeyDevice` and `addSecurityKey`. */
     addPasskey: string;
+    addPasskeyDevice: string;
+    addSecurityKey: string;
+    passkeyKinds: Record<'security_key' | 'synced' | 'device', string>;
     removePasskey: string;
     passkeyAdded: string;
     passkeyUnnamed: string;
@@ -853,4 +872,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, type ConnectedAgent, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, type Passkey, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };
+export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, type ConnectedAgent, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, type Passkey, type PasskeyKind, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };

package/dist/react.js

@@ -309,7 +309,8 @@ function createAuthClient(options = {}) {
       async passkey(o) {
         const m = await methods();
         if (m.passkeyHere && canUsePasskeys()) {
-          const r = await ceremony("/sign-in/passkey/begin", "/sign-in/passkey/finish", {}, getPasskey);
+          const email = o?.email?.trim() ?? "";
+          const r = await ceremony("/sign-in/passkey/begin", "/sign-in/passkey/finish", email !== "" && checkEmail(email) === null ? { email } : {}, getPasskey);
           if (r.ok || r.error.code !== "passkey_unavailable" || !m.passkeyOnCauthy) return r;
         } else if (!m.passkeyOnCauthy) {
           return { ok: false, error: { code: "passkey_unavailable", message: "Passkeys cannot be used here." } };
@@ -438,7 +439,7 @@ function createAuthClient(options = {}) {
       },
       addPasskey(f = {}) {
         if (!canUsePasskeys()) return Promise.resolve({ ok: false, error: { code: "passkey_unavailable", message: "This browser cannot make passkeys." } });
-        return ceremony("/me/passkeys/add/begin", "/me/passkeys/add/finish", { password: f.password ?? "" }, makePasskey, { name: f.name ?? "" });
+        return ceremony("/me/passkeys/add/begin", "/me/passkeys/add/finish", { password: f.password ?? "", ...f.kind ? { kind: f.kind } : {} }, makePasskey, { name: f.name ?? "" });
       },
       removePasskey: (id) => post("/me/passkeys/remove", { id }, null)
     },
@@ -579,6 +580,9 @@ var TEXTS = {
     passkeyName: "A name for this device (optional)",
     addPasskey: "Add a passkey on this device",
     removePasskey: "Remove",
+    addPasskeyDevice: "Add this device (fingerprint or face)",
+    addSecurityKey: "Add a security key",
+    passkeyKinds: { security_key: "Security key", synced: "Synced across your devices", device: "On this device only" },
     passkeyAdded: "The passkey was added. Next time, sign in with it.",
     passkeyUnnamed: "Passkey",
     sessions: "Where you are signed in",
@@ -691,6 +695,9 @@ var TEXTS = {
     passkeyName: "Un nombre para este dispositivo (opcional)",
     addPasskey: "Agregar una llave en este dispositivo",
     removePasskey: "Quitar",
+    addPasskeyDevice: "Agregar este dispositivo (huella o rostro)",
+    addSecurityKey: "Agregar una llave f\xEDsica",
+    passkeyKinds: { security_key: "Llave f\xEDsica", synced: "Sincronizada entre tus dispositivos", device: "Solo en un dispositivo" },
     passkeyAdded: "La llave de acceso qued\xF3 agregada. La pr\xF3xima vez, entra con ella.",
     passkeyUnnamed: "Llave de acceso",
     sessions: "D\xF3nde tienes la sesi\xF3n abierta",
@@ -976,7 +983,7 @@ function SignIn(props) {
     autofill.current?.abort();
     f.setBusy(true);
     f.setError(null);
-    const r = await auth.signIn.passkey({ returnTo: props.returnTo, locale: props.locale });
+    const r = await auth.signIn.passkey({ returnTo: props.returnTo, locale: props.locale, email });
     if (r.ok && r.status === "redirected") return;
     f.setBusy(false);
     if (!r.ok) setOffer((n) => n + 1);
@@ -1266,9 +1273,9 @@ function PasskeysPart({ props, account, accountUrl, when }) {
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: accountUrl, children: f.t.managePasskeys })
     ] });
   }
-  const add = async (e) => {
-    e.preventDefault();
-    const r = await run(() => auth.account.addPasskey({ name, password }));
+  const add = async (e, kind = "device") => {
+    e?.preventDefault();
+    const r = await run(() => auth.account.addPasskey({ name, password, kind }));
     if (!r.ok) {
       if (r.error.code === "cancelled") f.setError(null);
       return;
@@ -1288,6 +1295,7 @@ function PasskeysPart({ props, account, accountUrl, when }) {
     general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
     list.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.noPasskeys }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: list.map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
       p.name || f.t.passkeyUnnamed,
+      p.kind !== "unknown" ? ` \xB7 ${f.t.passkeyKinds[p.kind]}` : "",
       " \xB7 ",
       when(p.createdAt),
       " ",
@@ -1295,7 +1303,8 @@ function PasskeysPart({ props, account, accountUrl, when }) {
     ] }, p.id)) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "name", type: "text", label: f.t.passkeyName, value: name, autoComplete: "off", onChange: setName }),
     account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.addPasskey }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.addPasskeyDevice }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void add(null, "security_key"), children: f.t.addSecurityKey }),
     done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
   ] });
 }