cauthy-auth 0.18.0 → 0.20.0

package/dist/index.mjs

@@ -994,6 +994,7 @@ function createCauthy(given = {}) {
   const passkeyOf = (d) => ({
     id: String(d?.id ?? ""),
     name: String(d?.nickname ?? ""),
+    kind: ["security_key", "synced", "device"].includes(d?.kind) ? d.kind : "unknown",
     createdAt: String(d?.created_at ?? ""),
     lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null
   });
@@ -1133,7 +1134,7 @@ function createCauthy(given = {}) {
       "/me/passkeys/remove",
       "/me/agents",
       "/me/agents/disconnect"
-    ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/");
+    ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/") || route === "/sign-in/sso" || route === "/sign-in/sso/discover" || route === "/sso/callback";
     if (!own) return null;
     if (tenant === "") {
       return problem(500, "not_configured", "cauthy-auth: tenant (CAUTHY_TENANT) is required for the application's own sign-in screens");
@@ -1146,10 +1147,11 @@ function createCauthy(given = {}) {
       return json(lookCache.look);
     }
     if (route === "/methods" && !post) {
-      const [providers, settings, place] = await Promise.all([
+      const [providers, settings, place, sso] = await Promise.all([
         ask(request, "GET", "/v1/auth/social/providers"),
         ask(request, "GET", "/v1/auth/settings"),
-        ask(request, "GET", `/v1/auth/webauthn/place?origin=${encodeURIComponent(originOf(request))}`)
+        ask(request, "GET", `/v1/auth/webauthn/place?origin=${encodeURIComponent(originOf(request))}`),
+        ask(request, "GET", "/v1/auth/sso/connections")
       ]);
       const list = Array.isArray(providers.data) ? providers.data : [];
       const here = place.data?.here === true;
@@ -1161,9 +1163,46 @@ function createCauthy(given = {}) {
         passkey: place.error ? true : here || place.data?.on_cauthy === true,
         passkeyHere: here,
         passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true,
+        // A company's sign-in, found by the person's work address.
+        sso: Array.isArray(sso.data) && sso.data.some((c) => c?.discoverable === true),
         ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}
       });
     }
+    if (route === "/sign-in/sso" && !post) {
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
+      const email = (url.searchParams.get("email") ?? "").trim();
+      const connection = (url.searchParams.get("connection") ?? "").trim();
+      if (email === "" && connection === "") return failed2("sso_not_found");
+      const verifier = random(48);
+      const challenge = b64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+      const callback2 = `${basePath}/sso/callback`;
+      const started = await ask(request, "POST", "/v1/auth/sso/start", {
+        ...connection ? { connection } : { email },
+        redirect_uri: `${originOf(request)}${callback2}`,
+        code_challenge: challenge
+      }, callback2);
+      if (started.error || typeof started.data?.redirect_url !== "string") return failed2(started.error?.code ?? "sso_unavailable");
+      const step = { kind: "sso", token: verifier, returnTo };
+      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS))]);
+    }
+    if (route === "/sso/callback" && !post) {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      const clear = writeCookie(stepCookie, "", attrs(request, 0));
+      const back = step?.returnTo ?? afterSignIn;
+      const failedTo = (code2) => redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code2)}`, [clear]);
+      if (step === null || step.kind !== "sso") return failedTo("state_mismatch");
+      const refused = url.searchParams.get("error");
+      if (refused) return failedTo(refused);
+      const code = url.searchParams.get("code");
+      if (!code) return failedTo("sso_failed");
+      const done = await ask(request, "POST", "/v1/auth/sso/token", { code, redirect_uri: `${originOf(request)}${basePath}/sso/callback`, code_verifier: step.token });
+      if (done.error) return failedTo(done.error.code);
+      const s = await stored(done.data);
+      if (s === null) return failedTo("unavailable");
+      return redirect(back, [...await write(request, s, readCookies(request.headers.get("cookie"))), clear]);
+    }
     if (route.startsWith("/sign-in/social/") && !post) {
       const provider = providerIn(route.slice("/sign-in/social/".length));
       if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
@@ -1273,6 +1312,14 @@ function createCauthy(given = {}) {
     }
     const b = await body(request);
     if (b === null) return problem(400, "bad_request", "Send the form as JSON.");
+    if (route === "/sign-in/sso/discover") {
+      const bad = checkEmail(b.email);
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/sso/discover", { email: String(b.email).trim() });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      const c = res.data?.connection;
+      return json(c ? { status: "found", connection: { id: String(c.slug ?? ""), name: String(c.display_name ?? ""), enforced: c.enforced === true } } : { status: "none" });
+    }
     if (route === "/sign-in/email") {
       const bad = firstProblem(checkEmail(b.email), checkPassword(b.password));
       if (bad) return invalid(bad);
@@ -1409,7 +1456,8 @@ function createCauthy(given = {}) {
         return json({ status: "unlinked", provider }, 200, mine.headers);
       }
       if (route === "/me/passkeys/add/begin") {
-        const res = await as("/v1/auth/webauthn/register/begin", { password });
+        const kind = b.kind === "device" || b.kind === "security_key" ? b.kind : "";
+        const res = await as("/v1/auth/webauthn/register/begin", { password, ...kind ? { kind } : {} });
         if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
         const step = { kind: "enrol", token: String(res.data?.session_id ?? ""), returnTo: afterSignIn };
         const h = new Headers(mine.headers);