cauthy-auth 0.19.0 → 0.20.0

package/dist/react.mjs

@@ -231,6 +231,11 @@ function createAuthClient(options = {}) {
   }
   const linkUrl = (provider, o = {}) => `${base}/me/identities/link/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const socialUrl = (provider, o = {}) => `${base}/sign-in/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
+  const ssoUrl = (target, o = {}) => {
+    const q = new URLSearchParams("connection" in target ? { connection: target.connection } : { email: target.email.trim() });
+    if (o.returnTo) q.set("return_to", o.returnTo);
+    return `${base}/sign-in/sso?${q}`;
+  };
   const passkeyUrl = (o = {}) => {
     const q = new URLSearchParams({ method: "passkey" });
     if (o.returnTo) q.set("return_to", o.returnTo);
@@ -242,11 +247,11 @@ function createAuthClient(options = {}) {
       const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
       if (res.ok) {
         const m = await res.json();
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false };
+    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -344,6 +349,11 @@ function createAuthClient(options = {}) {
       socialUrl,
       social(provider, o) {
         window.location.assign(socialUrl(provider, o));
+      },
+      ssoDiscover: (f) => post("/sign-in/sso/discover", { email: f.email.trim() }, checkEmail(f.email)),
+      ssoUrl,
+      sso(target, o) {
+        window.location.assign(ssoUrl(target, o));
       }
     },
     signUp: {
@@ -564,6 +574,7 @@ var TEXTS = {
     linkWith: "Link",
     unlink: "Unlink",
     linked: "The account was linked.",
+    ssoOnly: "Your company signs you in to this account.",
     errors: {
       required: "This is required.",
       invalid_email: "That does not look like an email address.",
@@ -592,7 +603,15 @@ var TEXTS = {
       captcha_failed: "The check that you are not a bot did not pass. Try it again.",
       passkey_failed: "The passkey could not be used. Try again, or sign in another way.",
       passkey_exists: "This device already has a passkey for your account.",
-      passkey_unavailable: "Passkeys cannot be used here."
+      passkey_unavailable: "Passkeys cannot be used here.",
+      sso_required: "This address signs in through its company.",
+      sso_not_found: "No company sign-in answers for this address.",
+      sso_failed: "The sign-in with your company could not be completed. Try again.",
+      sso_unavailable: "Your company's sign-in cannot be reached right now. Try again in a moment.",
+      invalid_assertion: "Your company's answer could not be checked. Try again.",
+      provisioning_disabled: "Your company's sign-in worked, but this workspace has no account for you. Ask its admin to add you.",
+      connection_inactive: "Your company's sign-in is turned off for this workspace.",
+      invalid_grant: "That sign-in expired. Try again."
     }
   },
   es: {
@@ -679,6 +698,7 @@ var TEXTS = {
     linkWith: "Vincular",
     unlink: "Desvincular",
     linked: "La cuenta qued\xF3 vinculada.",
+    ssoOnly: "A esta cuenta entras con el inicio de sesi\xF3n de tu empresa.",
     errors: {
       required: "Este dato es obligatorio.",
       invalid_email: "Eso no parece un correo.",
@@ -707,7 +727,15 @@ var TEXTS = {
       captcha_failed: "La verificaci\xF3n de que no eres un robot no pas\xF3. Int\xE9ntalo de nuevo.",
       passkey_failed: "No se pudo usar la llave de acceso. Intenta de nuevo o entra de otra forma.",
       passkey_exists: "Este dispositivo ya tiene una llave de acceso de tu cuenta.",
-      passkey_unavailable: "Aqu\xED no se pueden usar llaves de acceso."
+      passkey_unavailable: "Aqu\xED no se pueden usar llaves de acceso.",
+      sso_required: "Este correo entra con el inicio de sesi\xF3n de su empresa.",
+      sso_not_found: "Ninguna empresa usa inicio de sesi\xF3n propio con este correo.",
+      sso_failed: "No se pudo completar el ingreso con tu empresa. Intenta de nuevo.",
+      sso_unavailable: "Ahora no se puede llegar al inicio de sesi\xF3n de tu empresa. Intenta en un momento.",
+      invalid_assertion: "No se pudo verificar la respuesta de tu empresa. Intenta de nuevo.",
+      provisioning_disabled: "El ingreso con tu empresa funcion\xF3, pero este workspace no tiene una cuenta para ti. P\xEDdele a su admin que te agregue.",
+      connection_inactive: "El inicio de sesi\xF3n de tu empresa est\xE1 apagado en este workspace.",
+      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo."
     }
   }
 };
@@ -900,6 +928,25 @@ function SignIn(props) {
   };
   const autofill = useRef(null);
   const [offer, setOffer] = useState(0);
+  const [company, setCompany] = useState(null);
+  useEffect(() => {
+    if (!methods?.sso || checkEmail(email) !== null) return setCompany(null);
+    let current = true;
+    const t = setTimeout(() => {
+      void auth.signIn.ssoDiscover({ email }).then((r) => {
+        if (current) setCompany(r.ok && r.status === "found" ? r.connection : null);
+      });
+    }, 350);
+    return () => {
+      current = false;
+      clearTimeout(t);
+    };
+  }, [email, methods]);
+  const toCompany = () => {
+    autofill.current?.abort();
+    f.setBusy(true);
+    auth.signIn.sso({ email }, { returnTo: props.returnTo });
+  };
   useEffect(() => {
     void auth.methods().then(setMethods);
     const back = returnedError();
@@ -932,9 +979,11 @@ function SignIn(props) {
     autofill.current?.abort();
     f.setBusy(true);
     f.setError(null);
+    if (step === "password" && company?.enforced) return toCompany();
     const r = step === "code" ? await auth.signIn.mfa({ code }) : step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
     f.setBusy(false);
     if (step === "password") challenge.renew();
+    if (!r.ok && r.error.code === "sso_required") return toCompany();
     if (!r.ok) {
       setOffer((n) => n + 1);
       return f.setError(r.error);
@@ -960,6 +1009,7 @@ function SignIn(props) {
     const r = await auth.signIn.magicLink({ email, captchaToken: challenge.token, create: props.createAccounts, returnTo: props.returnTo });
     f.setBusy(false);
     challenge.renew();
+    if (!r.ok && r.error.code === "sso_required") return toCompany();
     if (!r.ok) return f.setError(r.error);
     setStep("sent");
   };
@@ -994,23 +1044,31 @@ function SignIn(props) {
     methods?.passkey && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
     ((methods?.providers.length ?? 0) > 0 || methods?.passkey) && /* @__PURE__ */ jsx("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
     /* @__PURE__ */ jsx(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
-    /* @__PURE__ */ jsx(
-      Field,
-      {
-        f,
-        name: "password",
-        type: "password",
-        label: f.t.password,
-        value: password,
-        autoComplete: "current-password",
-        required: true,
-        onChange: setPassword,
-        aside: props.links?.forgotPassword ? /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
-      }
-    ),
-    challenge.node,
-    /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn }),
-    methods?.magicLink && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
+    company && /* @__PURE__ */ jsxs(f.Button, { type: "button", disabled: f.busy, className: f.cx(company.enforced ? "button" : "providerButton"), onClick: toCompany, children: [
+      f.t.continueWith,
+      " ",
+      company.name
+    ] }),
+    company?.enforced && /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.ssoOnly }),
+    !company?.enforced && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx(
+        Field,
+        {
+          f,
+          name: "password",
+          type: "password",
+          label: f.t.password,
+          value: password,
+          autoComplete: "current-password",
+          required: true,
+          onChange: setPassword,
+          aside: props.links?.forgotPassword ? /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.forgotPassword, children: f.t.forgotPassword }) : void 0
+        }
+      ),
+      challenge.node,
+      /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn })
+    ] }),
+    methods?.magicLink && !company?.enforced && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
     methods?.signUp !== false && props.links?.signUp && /* @__PURE__ */ jsxs("p", { className: f.cx("footer"), children: [
       f.t.noAccount,
       " ",