cauthy-auth 0.19.0 → 0.22.0

package/dist/{cauthy-Bn3iv50y.d.ts → cauthy-DGAy45G2.d.ts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-DhRr_WxR.js';
+import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-DTIeDXDP.js';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/{cauthy-C29HCvag.d.mts → cauthy-XkIbG5gE.d.mts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-ZD_Wa8Bm.mjs';
+import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-BxMsSIu1.mjs';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/client.d.mts

@@ -1,5 +1,5 @@
 import { CauthyTheme } from './theme.mjs';
-import { i as PublicSession } from './system-ZD_Wa8Bm.mjs';
+import { i as PublicSession } from './system-BxMsSIu1.mjs';
 import { A as AuthField } from './validate-B_iC-4y8.mjs';
 export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.mjs';
 import 'jose';
@@ -100,6 +100,20 @@ interface AuthMethods {
      * forms show it themselves.
      */
     captchaSiteKey?: string;
+    /**
+     * Whether the workspace signs some people in through their company's SSO,
+     * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
+     */
+    sso: boolean;
+}
+/** A company's sign-in (an SSO connection of the workspace). */
+interface SSOConnection {
+    /** What `signIn.sso({ connection })` takes. */
+    id: string;
+    /** The company's name, for "Continue with …". */
+    name: string;
+    /** The address can sign in no other way: a password, link or provider answers `sso_required`. */
+    enforced: boolean;
 }
 /**
  * What holds a passkey, as its authenticator says: a security key (a YubiKey),
@@ -149,6 +163,82 @@ interface ConnectedAgent {
     connectedAt: string;
     lastUsedAt: string;
 }
+/** An organization the person belongs to, with what their role lets them do with its people. */
+interface OrganizationSeat {
+    id: string;
+    /** The client system it is of (`pondari`). */
+    system: string;
+    name: string;
+    kind: string;
+    /** The person's role in it. */
+    role: string;
+    /** Cauthy's member powers, from the system's catalog: cauthy:members read and manage. */
+    can: {
+        readMembers: boolean;
+        manageMembers: boolean;
+    };
+}
+/** A person of an organization, as a member who may see them reads it. */
+interface OrganizationPerson {
+    userId: string;
+    email: string;
+    name: string;
+    role: string;
+    /** The account's: `active`, `suspended`… A disabled member is still listed. */
+    status: string;
+    /** Invited and not yet accepted. */
+    invited: boolean;
+    /** Manages the organization's members. */
+    manager: boolean;
+    /** The signed-in person. */
+    you: boolean;
+    /** UTC, ISO 8601. */
+    since: string;
+}
+/** A role of the organization's system, as the catalog names it. */
+interface OrganizationRoleChoice {
+    role: string;
+    name: string;
+    description: string;
+    /** Holding it manages the organization's members. */
+    manager: boolean;
+}
+/**
+ * The signed-in person's organizations, and their people. Seeing them needs
+ * cauthy:members read in the person's role; changing them needs manage. Cauthy
+ * decides, with the person's own session: the application authorizes nothing.
+ */
+interface OrganizationsClient {
+    /** The organizations the person belongs to; one system's only with `system`. */
+    list(system?: string): Promise<OrganizationSeat[]>;
+    /** The people of one, or null when the person may not see them. */
+    members(organizationId: string): Promise<OrganizationPerson[] | null>;
+    /** The roles a member may be given, or null when the person may not see them. */
+    roles(organizationId: string): Promise<OrganizationRoleChoice[] | null>;
+    /** Adds a person by their address; an address with no account gets one and its invitation. */
+    add(organizationId: string, form: {
+        email: string;
+        role: string;
+        name?: string;
+        locale?: string;
+    }): Promise<AuthResult<'added', {
+        member: OrganizationPerson;
+    }>>;
+    setRole(organizationId: string, userId: string, role: string): Promise<AuthResult<'changed', {
+        userId: string;
+        role: string;
+    }>>;
+    /** Removes a member; the person themself may always leave. */
+    remove(organizationId: string, userId: string): Promise<AuthResult<'removed', {
+        userId: string;
+    }>>;
+    /** Sends a member's invitation again. */
+    inviteAgain(organizationId: string, userId: string, form?: {
+        locale?: string;
+    }): Promise<AuthResult<'sent', {
+        userId: string;
+    }>>;
+}
 interface AccountSession {
     /** "Mac · Chrome", or "" when the browser did not say. */
     device: string;
@@ -271,6 +361,26 @@ interface AccountClient {
     unlink(provider: string): Promise<AuthResult<'unlinked', {
         provider: string;
     }>>;
+    /**
+     * A guest becomes an account of their own with an address and a password —
+     * the same id, so what they did stays theirs. `email_taken`: the address has
+     * an account already; offer to sign in with it.
+     */
+    upgrade(form: {
+        email: string;
+        password: string;
+        name?: string;
+    }): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }>>;
+    /** Where a guest goes to become the account of a provider's address (Google…). */
+    upgradeUrl(provider: string, options?: {
+        returnTo?: string;
+    }): string;
+    /** Sends a guest to `upgradeUrl`; they come back signed in as the account. */
+    upgradeWith(provider: string, options?: {
+        returnTo?: string;
+    }): void;
     /** Where the account is signed in. */
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
@@ -304,6 +414,17 @@ interface AccountClient {
 }
 interface AuthClient {
     signIn: {
+        /**
+         * A guest session, before the visitor signs up: the application keeps what
+         * they do under `session.user.id`, and `account.upgrade` (or
+         * `account.upgradeWith`) makes it their account, same id. Only where the
+         * workspace allows guests (`anonymous_disabled` otherwise).
+         */
+        anonymously(form?: {
+            captchaToken?: string;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
         /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
         email(form: {
             email: string;
@@ -412,6 +533,38 @@ interface AuthClient {
         social(provider: string, options?: {
             returnTo?: string;
         }): void;
+        /**
+         * Which company's sign-in a work address uses, if any (`found`), or
+         * `none`. It says so of the address's domain, never whether the address
+         * has an account.
+         */
+        ssoDiscover(form: {
+            email: string;
+        }): Promise<AuthResult<'found', {
+            connection: SSOConnection;
+        }> | AuthResult<'none'>>;
+        /**
+         * Sends the browser to the person's company (found by `email`, or named
+         * by `connection`); it comes back signed in, at `returnTo`. A sign-in the
+         * company refused comes back with `?auth_error=`. Any other way of
+         * signing in answers `sso_required` for an address its company holds to
+         * SSO: send it here then.
+         */
+        sso(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): void;
+        /** Where `sso` sends the browser, for a plain link. */
+        ssoUrl(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): string;
         /** Where `social` sends the browser, for a plain link. */
         socialUrl(provider: string, options?: {
             returnTo?: string;
@@ -447,6 +600,8 @@ interface AuthClient {
     signOut(): Promise<AuthResult<'signed_out'>>;
     /** The signed-in person's own account. */
     account: AccountClient;
+    /** The signed-in person's organizations, and their people. */
+    organizations: OrganizationsClient;
     /** Who is signed in, or null. */
     getSession(): Promise<PublicSession | null>;
     methods(): Promise<AuthMethods>;
@@ -470,4 +625,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { CauthyTheme } from './theme.js';
-import { i as PublicSession } from './system-DhRr_WxR.js';
+import { i as PublicSession } from './system-DTIeDXDP.js';
 import { A as AuthField } from './validate-B_iC-4y8.js';
 export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.js';
 import 'jose';
@@ -100,6 +100,20 @@ interface AuthMethods {
      * forms show it themselves.
      */
     captchaSiteKey?: string;
+    /**
+     * Whether the workspace signs some people in through their company's SSO,
+     * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
+     */
+    sso: boolean;
+}
+/** A company's sign-in (an SSO connection of the workspace). */
+interface SSOConnection {
+    /** What `signIn.sso({ connection })` takes. */
+    id: string;
+    /** The company's name, for "Continue with …". */
+    name: string;
+    /** The address can sign in no other way: a password, link or provider answers `sso_required`. */
+    enforced: boolean;
 }
 /**
  * What holds a passkey, as its authenticator says: a security key (a YubiKey),
@@ -149,6 +163,82 @@ interface ConnectedAgent {
     connectedAt: string;
     lastUsedAt: string;
 }
+/** An organization the person belongs to, with what their role lets them do with its people. */
+interface OrganizationSeat {
+    id: string;
+    /** The client system it is of (`pondari`). */
+    system: string;
+    name: string;
+    kind: string;
+    /** The person's role in it. */
+    role: string;
+    /** Cauthy's member powers, from the system's catalog: cauthy:members read and manage. */
+    can: {
+        readMembers: boolean;
+        manageMembers: boolean;
+    };
+}
+/** A person of an organization, as a member who may see them reads it. */
+interface OrganizationPerson {
+    userId: string;
+    email: string;
+    name: string;
+    role: string;
+    /** The account's: `active`, `suspended`… A disabled member is still listed. */
+    status: string;
+    /** Invited and not yet accepted. */
+    invited: boolean;
+    /** Manages the organization's members. */
+    manager: boolean;
+    /** The signed-in person. */
+    you: boolean;
+    /** UTC, ISO 8601. */
+    since: string;
+}
+/** A role of the organization's system, as the catalog names it. */
+interface OrganizationRoleChoice {
+    role: string;
+    name: string;
+    description: string;
+    /** Holding it manages the organization's members. */
+    manager: boolean;
+}
+/**
+ * The signed-in person's organizations, and their people. Seeing them needs
+ * cauthy:members read in the person's role; changing them needs manage. Cauthy
+ * decides, with the person's own session: the application authorizes nothing.
+ */
+interface OrganizationsClient {
+    /** The organizations the person belongs to; one system's only with `system`. */
+    list(system?: string): Promise<OrganizationSeat[]>;
+    /** The people of one, or null when the person may not see them. */
+    members(organizationId: string): Promise<OrganizationPerson[] | null>;
+    /** The roles a member may be given, or null when the person may not see them. */
+    roles(organizationId: string): Promise<OrganizationRoleChoice[] | null>;
+    /** Adds a person by their address; an address with no account gets one and its invitation. */
+    add(organizationId: string, form: {
+        email: string;
+        role: string;
+        name?: string;
+        locale?: string;
+    }): Promise<AuthResult<'added', {
+        member: OrganizationPerson;
+    }>>;
+    setRole(organizationId: string, userId: string, role: string): Promise<AuthResult<'changed', {
+        userId: string;
+        role: string;
+    }>>;
+    /** Removes a member; the person themself may always leave. */
+    remove(organizationId: string, userId: string): Promise<AuthResult<'removed', {
+        userId: string;
+    }>>;
+    /** Sends a member's invitation again. */
+    inviteAgain(organizationId: string, userId: string, form?: {
+        locale?: string;
+    }): Promise<AuthResult<'sent', {
+        userId: string;
+    }>>;
+}
 interface AccountSession {
     /** "Mac · Chrome", or "" when the browser did not say. */
     device: string;
@@ -271,6 +361,26 @@ interface AccountClient {
     unlink(provider: string): Promise<AuthResult<'unlinked', {
         provider: string;
     }>>;
+    /**
+     * A guest becomes an account of their own with an address and a password —
+     * the same id, so what they did stays theirs. `email_taken`: the address has
+     * an account already; offer to sign in with it.
+     */
+    upgrade(form: {
+        email: string;
+        password: string;
+        name?: string;
+    }): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }>>;
+    /** Where a guest goes to become the account of a provider's address (Google…). */
+    upgradeUrl(provider: string, options?: {
+        returnTo?: string;
+    }): string;
+    /** Sends a guest to `upgradeUrl`; they come back signed in as the account. */
+    upgradeWith(provider: string, options?: {
+        returnTo?: string;
+    }): void;
     /** Where the account is signed in. */
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
@@ -304,6 +414,17 @@ interface AccountClient {
 }
 interface AuthClient {
     signIn: {
+        /**
+         * A guest session, before the visitor signs up: the application keeps what
+         * they do under `session.user.id`, and `account.upgrade` (or
+         * `account.upgradeWith`) makes it their account, same id. Only where the
+         * workspace allows guests (`anonymous_disabled` otherwise).
+         */
+        anonymously(form?: {
+            captchaToken?: string;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
         /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
         email(form: {
             email: string;
@@ -412,6 +533,38 @@ interface AuthClient {
         social(provider: string, options?: {
             returnTo?: string;
         }): void;
+        /**
+         * Which company's sign-in a work address uses, if any (`found`), or
+         * `none`. It says so of the address's domain, never whether the address
+         * has an account.
+         */
+        ssoDiscover(form: {
+            email: string;
+        }): Promise<AuthResult<'found', {
+            connection: SSOConnection;
+        }> | AuthResult<'none'>>;
+        /**
+         * Sends the browser to the person's company (found by `email`, or named
+         * by `connection`); it comes back signed in, at `returnTo`. A sign-in the
+         * company refused comes back with `?auth_error=`. Any other way of
+         * signing in answers `sso_required` for an address its company holds to
+         * SSO: send it here then.
+         */
+        sso(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): void;
+        /** Where `sso` sends the browser, for a plain link. */
+        ssoUrl(target: {
+            email: string;
+        } | {
+            connection: string;
+        }, options?: {
+            returnTo?: string;
+        }): string;
         /** Where `social` sends the browser, for a plain link. */
         socialUrl(provider: string, options?: {
             returnTo?: string;
@@ -447,6 +600,8 @@ interface AuthClient {
     signOut(): Promise<AuthResult<'signed_out'>>;
     /** The signed-in person's own account. */
     account: AccountClient;
+    /** The signed-in person's organizations, and their people. */
+    organizations: OrganizationsClient;
     /** Who is signed in, or null. */
     getSession(): Promise<PublicSession | null>;
     methods(): Promise<AuthMethods>;
@@ -470,4 +625,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -343,8 +343,14 @@ function createAuthClient(options = {}) {
       return null;
     }
   }
+  const upgradeUrl = (provider, o = {}) => `${base}/me/upgrade/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const linkUrl = (provider, o = {}) => `${base}/me/identities/link/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const socialUrl = (provider, o = {}) => `${base}/sign-in/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
+  const ssoUrl = (target, o = {}) => {
+    const q = new URLSearchParams("connection" in target ? { connection: target.connection } : { email: target.email.trim() });
+    if (o.returnTo) q.set("return_to", o.returnTo);
+    return `${base}/sign-in/sso?${q}`;
+  };
   const passkeyUrl = (o = {}) => {
     const q = new URLSearchParams({ method: "passkey" });
     if (o.returnTo) q.set("return_to", o.returnTo);
@@ -356,11 +362,11 @@ function createAuthClient(options = {}) {
       const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
       if (res.ok) {
         const m = await res.json();
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false };
+    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -375,6 +381,7 @@ function createAuthClient(options = {}) {
   }
   return {
     signIn: {
+      anonymously: (f = {}) => post("/sign-in/anonymous", {}, null, f.captchaToken),
       email: (f) => post("/sign-in/email", { email: f.email, password: f.password }, firstProblem(checkEmail(f.email), checkPassword(f.password)), f.captchaToken),
       mfa: (f) => post("/sign-in/mfa", { code: f.code }, checkCode(f.code)),
       mfaMethods: () => post("/sign-in/mfa/methods", {}, null),
@@ -458,6 +465,11 @@ function createAuthClient(options = {}) {
       socialUrl,
       social(provider, o) {
         window.location.assign(socialUrl(provider, o));
+      },
+      ssoDiscover: (f) => post("/sign-in/sso/discover", { email: f.email.trim() }, checkEmail(f.email)),
+      ssoUrl,
+      sso(target, o) {
+        window.location.assign(ssoUrl(target, o));
       }
     },
     signUp: {
@@ -467,6 +479,24 @@ function createAuthClient(options = {}) {
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
     signOut: () => post("/sign-out", {}, null),
+    organizations: {
+      async list(system) {
+        const body = await read(`/me/organizations${system ? `?system=${encodeURIComponent(system)}` : ""}`);
+        return body && Array.isArray(body.organizations) ? body.organizations : [];
+      },
+      async members(id) {
+        const body = await read(`/me/organizations/members?id=${encodeURIComponent(id)}`);
+        return body && Array.isArray(body.members) ? body.members : null;
+      },
+      async roles(id) {
+        const body = await read(`/me/organizations/roles?id=${encodeURIComponent(id)}`);
+        return body && Array.isArray(body.roles) ? body.roles : null;
+      },
+      add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
+      setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
+      remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+    },
     account: {
       async get() {
         const body = await read("/me");
@@ -505,6 +535,11 @@ function createAuthClient(options = {}) {
         return body && Array.isArray(body.sessions) ? body.sessions : [];
       },
       signOutEverywhere: () => post("/me/sessions/end", {}, null),
+      upgrade: (f) => post("/me/upgrade", { email: f.email, password: f.password, name: f.name ?? "" }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password))),
+      upgradeUrl,
+      upgradeWith(provider, o) {
+        window.location.assign(upgradeUrl(provider, o));
+      },
       async agents() {
         const body = await read("/me/agents");
         return body && Array.isArray(body.agents) ? body.agents : [];