cauthy-auth 0.18.0 → 0.20.0

package/dist/client.d.mts

@@ -100,12 +100,34 @@ interface AuthMethods {
      * forms show it themselves.
      */
     captchaSiteKey?: string;
+    /**
+     * Whether the workspace signs some people in through their company's SSO,
+     * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
+     */
+    sso: boolean;
+}
+/** A company's sign-in (an SSO connection of the workspace). */
+interface SSOConnection {
+    /** What `signIn.sso({ connection })` takes. */
+    id: string;
+    /** The company's name, for "Continue with …". */
+    name: string;
+    /** The address can sign in no other way: a password, link or provider answers `sso_required`. */
+    enforced: boolean;
 }
+/**
+ * What holds a passkey, as its authenticator says: a security key (a YubiKey),
+ * one synced across the person's devices (iCloud Keychain, Google Password
+ * Manager), one on a single device (Windows Hello), or unknown (made before
+ * Cauthy kept this).
+ */
+type PasskeyKind = 'security_key' | 'synced' | 'device' | 'unknown';
 /** A passkey of the signed-in account. Moments are UTC. */
 interface Passkey {
     id: string;
     /** What the person called it ("My laptop"), or "". */
     name: string;
+    kind: PasskeyKind;
     createdAt: string;
     /** When it last signed the person in, or null. */
     lastUsedAt: string | null;
@@ -279,10 +301,14 @@ interface AccountClient {
      * Makes a passkey on this device, on this page: the browser asks the person
      * for their fingerprint, face or screen lock. An account with a password
      * proves it again first. `cancelled`: the person closed the browser's prompt.
+     * `kind` sends the browser straight to one: `'device'`, this device's
+     * fingerprint, face or screen lock; `'security_key'`, a security key.
+     * Without it, the browser offers all.
      */
     addPasskey(form?: {
         password?: string;
         name?: string;
+        kind?: 'device' | 'security_key';
     }): Promise<AuthResult<'added', {
         passkey: Passkey;
     }>>;
@@ -400,6 +426,38 @@ interface AuthClient {
         social(provider: string, options?: {
             returnTo?: string;
         }): void;
+        /**
+         * Which company's sign-in a work address uses, if any (`found`), or
+         * `none`. It says so of the address's domain, never whether the address
+         * has an account.
+         */
+        ssoDiscover(form: {
+            email: string;
+        }): Promise<AuthResult<'found', {
+            connection: SSOConnection;
+        }> | AuthResult<'none'>>;
+        /**
+         * Sends the browser to the person's company (found by `email`, or named
+         * by `connection`); it comes back signed in, at `returnTo`. A sign-in the
+         * company refused comes back with `?auth_error=`. Any other way of
+         * signing in answers `sso_required` for an address its company holds to
+         * SSO: send it here then.
+         */
+        sso(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): void;
+        /** Where `sso` sends the browser, for a plain link. */
+        ssoUrl(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): string;
         /** Where `social` sends the browser, for a plain link. */
         socialUrl(provider: string, options?: {
             returnTo?: string;
@@ -458,4 +516,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -100,12 +100,34 @@ interface AuthMethods {
      * forms show it themselves.
      */
     captchaSiteKey?: string;
+    /**
+     * Whether the workspace signs some people in through their company's SSO,
+     * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
+     */
+    sso: boolean;
+}
+/** A company's sign-in (an SSO connection of the workspace). */
+interface SSOConnection {
+    /** What `signIn.sso({ connection })` takes. */
+    id: string;
+    /** The company's name, for "Continue with …". */
+    name: string;
+    /** The address can sign in no other way: a password, link or provider answers `sso_required`. */
+    enforced: boolean;
 }
+/**
+ * What holds a passkey, as its authenticator says: a security key (a YubiKey),
+ * one synced across the person's devices (iCloud Keychain, Google Password
+ * Manager), one on a single device (Windows Hello), or unknown (made before
+ * Cauthy kept this).
+ */
+type PasskeyKind = 'security_key' | 'synced' | 'device' | 'unknown';
 /** A passkey of the signed-in account. Moments are UTC. */
 interface Passkey {
     id: string;
     /** What the person called it ("My laptop"), or "". */
     name: string;
+    kind: PasskeyKind;
     createdAt: string;
     /** When it last signed the person in, or null. */
     lastUsedAt: string | null;
@@ -279,10 +301,14 @@ interface AccountClient {
      * Makes a passkey on this device, on this page: the browser asks the person
      * for their fingerprint, face or screen lock. An account with a password
      * proves it again first. `cancelled`: the person closed the browser's prompt.
+     * `kind` sends the browser straight to one: `'device'`, this device's
+     * fingerprint, face or screen lock; `'security_key'`, a security key.
+     * Without it, the browser offers all.
      */
     addPasskey(form?: {
         password?: string;
         name?: string;
+        kind?: 'device' | 'security_key';
     }): Promise<AuthResult<'added', {
         passkey: Passkey;
     }>>;
@@ -400,6 +426,38 @@ interface AuthClient {
         social(provider: string, options?: {
             returnTo?: string;
         }): void;
+        /**
+         * Which company's sign-in a work address uses, if any (`found`), or
+         * `none`. It says so of the address's domain, never whether the address
+         * has an account.
+         */
+        ssoDiscover(form: {
+            email: string;
+        }): Promise<AuthResult<'found', {
+            connection: SSOConnection;
+        }> | AuthResult<'none'>>;
+        /**
+         * Sends the browser to the person's company (found by `email`, or named
+         * by `connection`); it comes back signed in, at `returnTo`. A sign-in the
+         * company refused comes back with `?auth_error=`. Any other way of
+         * signing in answers `sso_required` for an address its company holds to
+         * SSO: send it here then.
+         */
+        sso(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): void;
+        /** Where `sso` sends the browser, for a plain link. */
+        ssoUrl(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): string;
         /** Where `social` sends the browser, for a plain link. */
         socialUrl(provider: string, options?: {
             returnTo?: string;
@@ -458,4 +516,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -345,6 +345,11 @@ function createAuthClient(options = {}) {
   }
   const linkUrl = (provider, o = {}) => `${base}/me/identities/link/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const socialUrl = (provider, o = {}) => `${base}/sign-in/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
+  const ssoUrl = (target, o = {}) => {
+    const q = new URLSearchParams("connection" in target ? { connection: target.connection } : { email: target.email.trim() });
+    if (o.returnTo) q.set("return_to", o.returnTo);
+    return `${base}/sign-in/sso?${q}`;
+  };
   const passkeyUrl = (o = {}) => {
     const q = new URLSearchParams({ method: "passkey" });
     if (o.returnTo) q.set("return_to", o.returnTo);
@@ -356,11 +361,11 @@ function createAuthClient(options = {}) {
       const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
       if (res.ok) {
         const m = await res.json();
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false };
+    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -458,6 +463,11 @@ function createAuthClient(options = {}) {
       socialUrl,
       social(provider, o) {
         window.location.assign(socialUrl(provider, o));
+      },
+      ssoDiscover: (f) => post("/sign-in/sso/discover", { email: f.email.trim() }, checkEmail(f.email)),
+      ssoUrl,
+      sso(target, o) {
+        window.location.assign(ssoUrl(target, o));
       }
     },
     signUp: {
@@ -516,7 +526,7 @@ function createAuthClient(options = {}) {
       },
       addPasskey(f = {}) {
         if (!canUsePasskeys()) return Promise.resolve({ ok: false, error: { code: "passkey_unavailable", message: "This browser cannot make passkeys." } });
-        return ceremony("/me/passkeys/add/begin", "/me/passkeys/add/finish", { password: f.password ?? "" }, makePasskey, { name: f.name ?? "" });
+        return ceremony("/me/passkeys/add/begin", "/me/passkeys/add/finish", { password: f.password ?? "", ...f.kind ? { kind: f.kind } : {} }, makePasskey, { name: f.name ?? "" });
       },
       removePasskey: (id) => post("/me/passkeys/remove", { id }, null)
     },