cauthy-auth 0.19.0 → 0.20.0

package/dist/client.d.mts

@@ -100,6 +100,20 @@ interface AuthMethods {
      * forms show it themselves.
      */
     captchaSiteKey?: string;
+    /**
+     * Whether the workspace signs some people in through their company's SSO,
+     * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
+     */
+    sso: boolean;
+}
+/** A company's sign-in (an SSO connection of the workspace). */
+interface SSOConnection {
+    /** What `signIn.sso({ connection })` takes. */
+    id: string;
+    /** The company's name, for "Continue with …". */
+    name: string;
+    /** The address can sign in no other way: a password, link or provider answers `sso_required`. */
+    enforced: boolean;
 }
 /**
  * What holds a passkey, as its authenticator says: a security key (a YubiKey),
@@ -412,6 +426,38 @@ interface AuthClient {
         social(provider: string, options?: {
             returnTo?: string;
         }): void;
+        /**
+         * Which company's sign-in a work address uses, if any (`found`), or
+         * `none`. It says so of the address's domain, never whether the address
+         * has an account.
+         */
+        ssoDiscover(form: {
+            email: string;
+        }): Promise<AuthResult<'found', {
+            connection: SSOConnection;
+        }> | AuthResult<'none'>>;
+        /**
+         * Sends the browser to the person's company (found by `email`, or named
+         * by `connection`); it comes back signed in, at `returnTo`. A sign-in the
+         * company refused comes back with `?auth_error=`. Any other way of
+         * signing in answers `sso_required` for an address its company holds to
+         * SSO: send it here then.
+         */
+        sso(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): void;
+        /** Where `sso` sends the browser, for a plain link. */
+        ssoUrl(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): string;
         /** Where `social` sends the browser, for a plain link. */
         socialUrl(provider: string, options?: {
             returnTo?: string;
@@ -470,4 +516,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -100,6 +100,20 @@ interface AuthMethods {
      * forms show it themselves.
      */
     captchaSiteKey?: string;
+    /**
+     * Whether the workspace signs some people in through their company's SSO,
+     * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
+     */
+    sso: boolean;
+}
+/** A company's sign-in (an SSO connection of the workspace). */
+interface SSOConnection {
+    /** What `signIn.sso({ connection })` takes. */
+    id: string;
+    /** The company's name, for "Continue with …". */
+    name: string;
+    /** The address can sign in no other way: a password, link or provider answers `sso_required`. */
+    enforced: boolean;
 }
 /**
  * What holds a passkey, as its authenticator says: a security key (a YubiKey),
@@ -412,6 +426,38 @@ interface AuthClient {
         social(provider: string, options?: {
             returnTo?: string;
         }): void;
+        /**
+         * Which company's sign-in a work address uses, if any (`found`), or
+         * `none`. It says so of the address's domain, never whether the address
+         * has an account.
+         */
+        ssoDiscover(form: {
+            email: string;
+        }): Promise<AuthResult<'found', {
+            connection: SSOConnection;
+        }> | AuthResult<'none'>>;
+        /**
+         * Sends the browser to the person's company (found by `email`, or named
+         * by `connection`); it comes back signed in, at `returnTo`. A sign-in the
+         * company refused comes back with `?auth_error=`. Any other way of
+         * signing in answers `sso_required` for an address its company holds to
+         * SSO: send it here then.
+         */
+        sso(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): void;
+        /** Where `sso` sends the browser, for a plain link. */
+        ssoUrl(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): string;
         /** Where `social` sends the browser, for a plain link. */
         socialUrl(provider: string, options?: {
             returnTo?: string;
@@ -470,4 +516,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -345,6 +345,11 @@ function createAuthClient(options = {}) {
   }
   const linkUrl = (provider, o = {}) => `${base}/me/identities/link/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const socialUrl = (provider, o = {}) => `${base}/sign-in/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
+  const ssoUrl = (target, o = {}) => {
+    const q = new URLSearchParams("connection" in target ? { connection: target.connection } : { email: target.email.trim() });
+    if (o.returnTo) q.set("return_to", o.returnTo);
+    return `${base}/sign-in/sso?${q}`;
+  };
   const passkeyUrl = (o = {}) => {
     const q = new URLSearchParams({ method: "passkey" });
     if (o.returnTo) q.set("return_to", o.returnTo);
@@ -356,11 +361,11 @@ function createAuthClient(options = {}) {
       const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
       if (res.ok) {
         const m = await res.json();
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false };
+    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -458,6 +463,11 @@ function createAuthClient(options = {}) {
       socialUrl,
       social(provider, o) {
         window.location.assign(socialUrl(provider, o));
+      },
+      ssoDiscover: (f) => post("/sign-in/sso/discover", { email: f.email.trim() }, checkEmail(f.email)),
+      ssoUrl,
+      sso(target, o) {
+        window.location.assign(ssoUrl(target, o));
       }
     },
     signUp: {