cauthy-auth 0.18.0 → 0.20.0

package/dist/react.mjs

@@ -231,6 +231,11 @@ function createAuthClient(options = {}) {
   }
   const linkUrl = (provider, o = {}) => `${base}/me/identities/link/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const socialUrl = (provider, o = {}) => `${base}/sign-in/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
+  const ssoUrl = (target, o = {}) => {
+    const q = new URLSearchParams("connection" in target ? { connection: target.connection } : { email: target.email.trim() });
+    if (o.returnTo) q.set("return_to", o.returnTo);
+    return `${base}/sign-in/sso?${q}`;
+  };
   const passkeyUrl = (o = {}) => {
     const q = new URLSearchParams({ method: "passkey" });
     if (o.returnTo) q.set("return_to", o.returnTo);
@@ -242,11 +247,11 @@ function createAuthClient(options = {}) {
       const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
       if (res.ok) {
         const m = await res.json();
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false };
+    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -344,6 +349,11 @@ function createAuthClient(options = {}) {
       socialUrl,
       social(provider, o) {
         window.location.assign(socialUrl(provider, o));
+      },
+      ssoDiscover: (f) => post("/sign-in/sso/discover", { email: f.email.trim() }, checkEmail(f.email)),
+      ssoUrl,
+      sso(target, o) {
+        window.location.assign(ssoUrl(target, o));
       }
     },
     signUp: {
@@ -402,7 +412,7 @@ function createAuthClient(options = {}) {
       },
       addPasskey(f = {}) {
         if (!canUsePasskeys()) return Promise.resolve({ ok: false, error: { code: "passkey_unavailable", message: "This browser cannot make passkeys." } });
-        return ceremony("/me/passkeys/add/begin", "/me/passkeys/add/finish", { password: f.password ?? "" }, makePasskey, { name: f.name ?? "" });
+        return ceremony("/me/passkeys/add/begin", "/me/passkeys/add/finish", { password: f.password ?? "", ...f.kind ? { kind: f.kind } : {} }, makePasskey, { name: f.name ?? "" });
       },
       removePasskey: (id) => post("/me/passkeys/remove", { id }, null)
     },
@@ -543,6 +553,9 @@ var TEXTS = {
     passkeyName: "A name for this device (optional)",
     addPasskey: "Add a passkey on this device",
     removePasskey: "Remove",
+    addPasskeyDevice: "Add this device (fingerprint or face)",
+    addSecurityKey: "Add a security key",
+    passkeyKinds: { security_key: "Security key", synced: "Synced across your devices", device: "On this device only" },
     passkeyAdded: "The passkey was added. Next time, sign in with it.",
     passkeyUnnamed: "Passkey",
     sessions: "Where you are signed in",
@@ -561,6 +574,7 @@ var TEXTS = {
     linkWith: "Link",
     unlink: "Unlink",
     linked: "The account was linked.",
+    ssoOnly: "Your company signs you in to this account.",
     errors: {
       required: "This is required.",
       invalid_email: "That does not look like an email address.",
@@ -589,7 +603,15 @@ var TEXTS = {
       captcha_failed: "The check that you are not a bot did not pass. Try it again.",
       passkey_failed: "The passkey could not be used. Try again, or sign in another way.",
       passkey_exists: "This device already has a passkey for your account.",
-      passkey_unavailable: "Passkeys cannot be used here."
+      passkey_unavailable: "Passkeys cannot be used here.",
+      sso_required: "This address signs in through its company.",
+      sso_not_found: "No company sign-in answers for this address.",
+      sso_failed: "The sign-in with your company could not be completed. Try again.",
+      sso_unavailable: "Your company's sign-in cannot be reached right now. Try again in a moment.",
+      invalid_assertion: "Your company's answer could not be checked. Try again.",
+      provisioning_disabled: "Your company's sign-in worked, but this workspace has no account for you. Ask its admin to add you.",
+      connection_inactive: "Your company's sign-in is turned off for this workspace.",
+      invalid_grant: "That sign-in expired. Try again."
     }
   },
   es: {
@@ -655,6 +677,9 @@ var TEXTS = {
     passkeyName: "Un nombre para este dispositivo (opcional)",
     addPasskey: "Agregar una llave en este dispositivo",
     removePasskey: "Quitar",
+    addPasskeyDevice: "Agregar este dispositivo (huella o rostro)",
+    addSecurityKey: "Agregar una llave f\xEDsica",
+    passkeyKinds: { security_key: "Llave f\xEDsica", synced: "Sincronizada entre tus dispositivos", device: "Solo en un dispositivo" },
     passkeyAdded: "La llave de acceso qued\xF3 agregada. La pr\xF3xima vez, entra con ella.",
     passkeyUnnamed: "Llave de acceso",
     sessions: "D\xF3nde tienes la sesi\xF3n abierta",
@@ -673,6 +698,7 @@ var TEXTS = {
     linkWith: "Vincular",
     unlink: "Desvincular",
     linked: "La cuenta qued\xF3 vinculada.",
+    ssoOnly: "A esta cuenta entras con el inicio de sesi\xF3n de tu empresa.",
     errors: {
       required: "Este dato es obligatorio.",
       invalid_email: "Eso no parece un correo.",
@@ -701,7 +727,15 @@ var TEXTS = {
       captcha_failed: "La verificaci\xF3n de que no eres un robot no pas\xF3. Int\xE9ntalo de nuevo.",
       passkey_failed: "No se pudo usar la llave de acceso. Intenta de nuevo o entra de otra forma.",
       passkey_exists: "Este dispositivo ya tiene una llave de acceso de tu cuenta.",
-      passkey_unavailable: "Aqu\xED no se pueden usar llaves de acceso."
+      passkey_unavailable: "Aqu\xED no se pueden usar llaves de acceso.",
+      sso_required: "Este correo entra con el inicio de sesi\xF3n de su empresa.",
+      sso_not_found: "Ninguna empresa usa inicio de sesi\xF3n propio con este correo.",
+      sso_failed: "No se pudo completar el ingreso con tu empresa. Intenta de nuevo.",
+      sso_unavailable: "Ahora no se puede llegar al inicio de sesi\xF3n de tu empresa. Intenta en un momento.",
+      invalid_assertion: "No se pudo verificar la respuesta de tu empresa. Intenta de nuevo.",
+      provisioning_disabled: "El ingreso con tu empresa funcion\xF3, pero este workspace no tiene una cuenta para ti. P\xEDdele a su admin que te agregue.",
+      connection_inactive: "El inicio de sesi\xF3n de tu empresa est\xE1 apagado en este workspace.",
+      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo."
     }
   }
 };
@@ -894,6 +928,25 @@ function SignIn(props) {
   };
   const autofill = useRef(null);
   const [offer, setOffer] = useState(0);
+  const [company, setCompany] = useState(null);
+  useEffect(() => {
+    if (!methods?.sso || checkEmail(email) !== null) return setCompany(null);
+    let current = true;
+    const t = setTimeout(() => {
+      void auth.signIn.ssoDiscover({ email }).then((r) => {
+        if (current) setCompany(r.ok && r.status === "found" ? r.connection : null);
+      });
+    }, 350);
+    return () => {
+      current = false;
+      clearTimeout(t);
+    };
+  }, [email, methods]);
+  const toCompany = () => {
+    autofill.current?.abort();
+    f.setBusy(true);
+    auth.signIn.sso({ email }, { returnTo: props.returnTo });
+  };
   useEffect(() => {
     void auth.methods().then(setMethods);
     const back = returnedError();
@@ -926,9 +979,11 @@ function SignIn(props) {
     autofill.current?.abort();
     f.setBusy(true);
     f.setError(null);
+    if (step === "password" && company?.enforced) return toCompany();
     const r = step === "code" ? await auth.signIn.mfa({ code }) : step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
     f.setBusy(false);
     if (step === "password") challenge.renew();
+    if (!r.ok && r.error.code === "sso_required") return toCompany();
     if (!r.ok) {
       setOffer((n) => n + 1);
       return f.setError(r.error);
@@ -954,6 +1009,7 @@ function SignIn(props) {
     const r = await auth.signIn.magicLink({ email, captchaToken: challenge.token, create: props.createAccounts, returnTo: props.returnTo });
     f.setBusy(false);
     challenge.renew();
+    if (!r.ok && r.error.code === "sso_required") return toCompany();
     if (!r.ok) return f.setError(r.error);
     setStep("sent");
   };
@@ -988,23 +1044,31 @@ function SignIn(props) {
     methods?.passkey && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
     ((methods?.providers.length ?? 0) > 0 || methods?.passkey) && /* @__PURE__ */ jsx("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
     /* @__PURE__ */ jsx(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
-    /* @__PURE__ */ jsx(
-      Field,
-      {
-        f,
-        name: "password",
-        type: "password",
-        label: f.t.password,
-        value: password,
-        autoComplete: "current-password",
-        required: true,
-        onChange: setPassword,
-        aside: props.links?.forgotPassword ? /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
-      }
-    ),
-    challenge.node,
-    /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn }),
-    methods?.magicLink && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
+    company && /* @__PURE__ */ jsxs(f.Button, { type: "button", disabled: f.busy, className: f.cx(company.enforced ? "button" : "providerButton"), onClick: toCompany, children: [
+      f.t.continueWith,
+      " ",
+      company.name
+    ] }),
+    company?.enforced && /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.ssoOnly }),
+    !company?.enforced && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx(
+        Field,
+        {
+          f,
+          name: "password",
+          type: "password",
+          label: f.t.password,
+          value: password,
+          autoComplete: "current-password",
+          required: true,
+          onChange: setPassword,
+          aside: props.links?.forgotPassword ? /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
+        }
+      ),
+      challenge.node,
+      /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn })
+    ] }),
+    methods?.magicLink && !company?.enforced && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
     methods?.signUp !== false && props.links?.signUp && /* @__PURE__ */ jsxs("p", { className: f.cx("footer"), children: [
       f.t.noAccount,
       " ",
@@ -1230,9 +1294,9 @@ function PasskeysPart({ props, account, accountUrl, when }) {
       /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: accountUrl, children: f.t.managePasskeys })
     ] });
   }
-  const add = async (e) => {
-    e.preventDefault();
-    const r = await run(() => auth.account.addPasskey({ name, password }));
+  const add = async (e, kind = "device") => {
+    e?.preventDefault();
+    const r = await run(() => auth.account.addPasskey({ name, password, kind }));
     if (!r.ok) {
       if (r.error.code === "cancelled") f.setError(null);
       return;
@@ -1252,6 +1316,7 @@ function PasskeysPart({ props, account, accountUrl, when }) {
     general && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
     list.length === 0 ? /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.noPasskeys }) : /* @__PURE__ */ jsx("ul", { className: f.cx("sessions"), children: list.map((p) => /* @__PURE__ */ jsxs("li", { className: f.cx("session"), children: [
       p.name || f.t.passkeyUnnamed,
+      p.kind !== "unknown" ? ` \xB7 ${f.t.passkeyKinds[p.kind]}` : "",
       " \xB7 ",
       when(p.createdAt),
       " ",
@@ -1259,7 +1324,8 @@ function PasskeysPart({ props, account, accountUrl, when }) {
     ] }, p.id)) }),
     /* @__PURE__ */ jsx(Field, { f, name: "name", type: "text", label: f.t.passkeyName, value: name, autoComplete: "off", onChange: setName }),
     account.hasPassword && /* @__PURE__ */ jsx(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
-    /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.addPasskey }),
+    /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.addPasskeyDevice }),
+    /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void add(null, "security_key"), children: f.t.addSecurityKey }),
     done && /* @__PURE__ */ jsx("p", { role: "status", className: f.cx("notice"), children: done })
   ] });
 }