cauthy-auth 0.19.0 → 0.22.0

package/dist/index.js

@@ -837,7 +837,8 @@ function createCauthy(given = {}) {
           emailVerified: b.email_verified === true,
           restricted: b.restricted === true,
           ...typeof b.email_verify_by === "string" ? { emailVerifyBy: b.email_verify_by } : {},
-          ...typeof b.locale === "string" && b.locale !== "" ? { locale: b.locale } : {}
+          ...typeof b.locale === "string" && b.locale !== "" ? { locale: b.locale } : {},
+          ...b.anonymous === true ? { isAnonymous: true } : {}
         }
       };
     } catch {
@@ -1046,6 +1047,32 @@ function createCauthy(given = {}) {
     createdAt: String(d?.created_at ?? ""),
     lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null
   });
+  const UUID = /^[0-9a-f-]{36}$/i;
+  const seatOf = (d) => ({
+    id: String(d?.id ?? ""),
+    system: String(d?.system ?? ""),
+    name: String(d?.name ?? ""),
+    kind: String(d?.kind ?? ""),
+    role: String(d?.role ?? ""),
+    can: { readMembers: d?.can?.read_members === true, manageMembers: d?.can?.manage_members === true }
+  });
+  const orgMemberOf = (d) => ({
+    userId: String(d?.user_id ?? ""),
+    email: String(d?.email ?? ""),
+    name: String(d?.name ?? ""),
+    role: String(d?.role ?? ""),
+    status: String(d?.status ?? ""),
+    invited: d?.invited === true,
+    manager: d?.manager === true,
+    you: d?.you === true,
+    since: String(d?.since ?? "")
+  });
+  const orgRoleOf = (d) => ({
+    role: String(d?.role ?? ""),
+    name: String(d?.name ?? ""),
+    description: String(d?.description ?? ""),
+    manager: d?.manager === true
+  });
   const agentOf = (d) => ({
     id: String(d?.id ?? ""),
     name: String(d?.agent?.name ?? ""),
@@ -1181,8 +1208,17 @@ function createCauthy(given = {}) {
       "/me/passkeys/add/finish",
       "/me/passkeys/remove",
       "/me/agents",
-      "/me/agents/disconnect"
-    ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/");
+      "/me/agents/disconnect",
+      "/sign-in/anonymous",
+      "/me/upgrade",
+      "/me/organizations",
+      "/me/organizations/members",
+      "/me/organizations/roles",
+      "/me/organizations/members/add",
+      "/me/organizations/members/role",
+      "/me/organizations/members/remove",
+      "/me/organizations/members/invite"
+    ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/") || route.startsWith("/me/upgrade/social/") || route === "/sign-in/sso" || route === "/sign-in/sso/discover" || route === "/sso/callback";
     if (!own) return null;
     if (tenant === "") {
       return problem(500, "not_configured", "cauthy-auth: tenant (CAUTHY_TENANT) is required for the application's own sign-in screens");
@@ -1195,10 +1231,11 @@ function createCauthy(given = {}) {
       return json(lookCache.look);
     }
     if (route === "/methods" && !post) {
-      const [providers, settings, place] = await Promise.all([
+      const [providers, settings, place, sso] = await Promise.all([
         ask(request, "GET", "/v1/auth/social/providers"),
         ask(request, "GET", "/v1/auth/settings"),
-        ask(request, "GET", `/v1/auth/webauthn/place?origin=${encodeURIComponent(originOf(request))}`)
+        ask(request, "GET", `/v1/auth/webauthn/place?origin=${encodeURIComponent(originOf(request))}`),
+        ask(request, "GET", "/v1/auth/sso/connections")
       ]);
       const list = Array.isArray(providers.data) ? providers.data : [];
       const here = place.data?.here === true;
@@ -1210,9 +1247,46 @@ function createCauthy(given = {}) {
         passkey: place.error ? true : here || place.data?.on_cauthy === true,
         passkeyHere: here,
         passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true,
+        // A company's sign-in, found by the person's work address.
+        sso: Array.isArray(sso.data) && sso.data.some((c) => c?.discoverable === true),
         ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}
       });
     }
+    if (route === "/sign-in/sso" && !post) {
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
+      const email = (url.searchParams.get("email") ?? "").trim();
+      const connection = (url.searchParams.get("connection") ?? "").trim();
+      if (email === "" && connection === "") return failed2("sso_not_found");
+      const verifier = random(48);
+      const challenge = b64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+      const callback2 = `${basePath}/sso/callback`;
+      const started = await ask(request, "POST", "/v1/auth/sso/start", {
+        ...connection ? { connection } : { email },
+        redirect_uri: `${originOf(request)}${callback2}`,
+        code_challenge: challenge
+      }, callback2);
+      if (started.error || typeof started.data?.redirect_url !== "string") return failed2(started.error?.code ?? "sso_unavailable");
+      const step = { kind: "sso", token: verifier, returnTo };
+      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS))]);
+    }
+    if (route === "/sso/callback" && !post) {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      const clear = writeCookie(stepCookie, "", attrs(request, 0));
+      const back = step?.returnTo ?? afterSignIn;
+      const failedTo = (code2) => redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code2)}`, [clear]);
+      if (step === null || step.kind !== "sso") return failedTo("state_mismatch");
+      const refused = url.searchParams.get("error");
+      if (refused) return failedTo(refused);
+      const code = url.searchParams.get("code");
+      if (!code) return failedTo("sso_failed");
+      const done = await ask(request, "POST", "/v1/auth/sso/token", { code, redirect_uri: `${originOf(request)}${basePath}/sso/callback`, code_verifier: step.token });
+      if (done.error) return failedTo(done.error.code);
+      const s = await stored(done.data);
+      if (s === null) return failedTo("unavailable");
+      return redirect(back, [...await write(request, s, readCookies(request.headers.get("cookie"))), clear]);
+    }
     if (route.startsWith("/sign-in/social/") && !post) {
       const provider = providerIn(route.slice("/sign-in/social/".length));
       if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
@@ -1232,10 +1306,19 @@ function createCauthy(given = {}) {
       const clear = writeCookie(stepCookie, "", attrs(request, 0));
       const back = step?.returnTo ?? afterSignIn;
       const failedTo = (code2) => redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code2)}`, [clear]);
-      if (step === null || step.kind !== "social" && step.kind !== "link" || step.provider !== provider || url.searchParams.get("state") !== step.token) return failedTo("state_mismatch");
+      if (step === null || step.kind !== "social" && step.kind !== "link" && step.kind !== "upgrade" || step.provider !== provider || url.searchParams.get("state") !== step.token) return failedTo("state_mismatch");
       const code = url.searchParams.get("code");
       if (!code) return failedTo(url.searchParams.get("error") === "access_denied" ? "cancelled" : "provider_refused");
       const q = new URLSearchParams({ code, state: step.token, redirect_uri: `${originOf(request)}${basePath}/callback/${provider}` });
+      if (step.kind === "upgrade") {
+        const mine = await signedInAs(request);
+        if ("response" in mine) return failedTo("unauthenticated");
+        const done2 = await ask(request, "GET", `/v1/auth/anonymous/upgrade/${provider}/callback?${q}`, void 0, void 0, mine.token);
+        if (done2.error) return failedTo(done2.error.code);
+        const s2 = await stored(done2.data);
+        if (s2 === null) return failedTo("unavailable");
+        return redirect(back, [...await write(request, s2, readCookies(request.headers.get("cookie"))), clear]);
+      }
       if (step.kind === "link") {
         const mine = await signedInAs(request);
         if ("response" in mine) return failedTo("unauthenticated");
@@ -1251,6 +1334,19 @@ function createCauthy(given = {}) {
       if (s === null) return failedTo("unavailable");
       return redirect(back, [...await write(request, s, readCookies(request.headers.get("cookie"))), clear]);
     }
+    if (route.startsWith("/me/upgrade/social/") && !post) {
+      const provider = providerIn(route.slice("/me/upgrade/social/".length));
+      if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
+      const mine = await signedInAs(request);
+      if ("response" in mine) return failed2("unauthenticated");
+      const callback2 = `${basePath}/callback/${provider}`;
+      const started = await ask(request, "GET", `/v1/auth/anonymous/upgrade/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback2}`)}`, void 0, callback2, mine.token);
+      if (started.error || typeof started.data?.redirect_url !== "string") return failed2(started.error?.code ?? "provider_unavailable");
+      const step = { kind: "upgrade", token: String(started.data.state ?? ""), provider, returnTo };
+      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS))]);
+    }
     if (route.startsWith("/me/identities/link/") && !post) {
       const provider = providerIn(route.slice("/me/identities/link/".length));
       if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
@@ -1288,6 +1384,24 @@ function createCauthy(given = {}) {
       const list = Array.isArray(res.data) ? res.data : [];
       return json({ agents: list.map(agentOf) }, 200, mine.headers);
     }
+    if ((route === "/me/organizations" || route === "/me/organizations/members" || route === "/me/organizations/roles") && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      let path = "/v1/auth/me/organizations";
+      if (route !== "/me/organizations") {
+        const id = url.searchParams.get("id") ?? "";
+        if (!UUID.test(id)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        path += `/${id}/${route.endsWith("/roles") ? "roles" : "members"}`;
+      } else if (url.searchParams.get("system")) {
+        path += `?system=${encodeURIComponent(url.searchParams.get("system"))}`;
+      }
+      const res = await ask(request, "GET", path, void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      if (route === "/me/organizations") return json({ organizations: list.map(seatOf) }, 200, mine.headers);
+      if (route === "/me/organizations/roles") return json({ roles: list.map(orgRoleOf) }, 200, mine.headers);
+      return json({ members: list.map(orgMemberOf) }, 200, mine.headers);
+    }
     if (route === "/me/mfa/factors" && !post) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
@@ -1322,6 +1436,20 @@ function createCauthy(given = {}) {
     }
     const b = await body(request);
     if (b === null) return problem(400, "bad_request", "Send the form as JSON.");
+    if (route === "/sign-in/sso/discover") {
+      const bad = checkEmail(b.email);
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/sso/discover", { email: String(b.email).trim() });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      const c = res.data?.connection;
+      return json(c ? { status: "found", connection: { id: String(c.slug ?? ""), name: String(c.display_name ?? ""), enforced: c.enforced === true } } : { status: "none" });
+    }
+    if (route === "/sign-in/anonymous") {
+      if (!post) return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
+      const res = await ask(request, "POST", "/v1/auth/anonymous", {});
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data);
+    }
     if (route === "/sign-in/email") {
       const bad = firstProblem(checkEmail(b.email), checkPassword(b.password));
       if (bad) return invalid(bad);
@@ -1485,6 +1613,53 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res);
         return json({ status: "removed", id }, 200, mine.headers);
       }
+      if (route === "/me/upgrade") {
+        const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password));
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/anonymous/upgrade", { email: String(b.email).trim(), password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "" });
+        if (res.error) return refused(res, res.error.code === "weak_password" ? "password" : "email");
+        return signedIn(request, res.data);
+      }
+      if (route.startsWith("/me/organizations/members/")) {
+        const org = typeof b.organizationId === "string" ? b.organizationId : "";
+        if (!UUID.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        const base = `/v1/auth/me/organizations/${org}/members`;
+        if (route === "/me/organizations/members/add") {
+          const bad = checkEmail(b.email);
+          if (bad) return invalid(bad);
+          const role = typeof b.role === "string" ? b.role : "";
+          if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
+          const res = await as(base, {
+            email: String(b.email).trim(),
+            role,
+            name: typeof b.name === "string" ? b.name.trim() : "",
+            client_id: clientId,
+            ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {}
+          });
+          if (res.error) return refused(res, res.error.code === "unknown_role" ? "role" : "email");
+          return json({ status: "added", member: orgMemberOf(res.data) }, 200, mine.headers);
+        }
+        const user = typeof b.userId === "string" ? b.userId : "";
+        if (!UUID.test(user)) return problem(400, "invalid_member", "Say which member.", void 0, mine.headers);
+        if (route === "/me/organizations/members/role") {
+          const role = typeof b.role === "string" ? b.role : "";
+          if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
+          const res = await as(`${base}/${user}`, { role }, "PUT");
+          if (res.error) return refused(res, "role");
+          return json({ status: "changed", userId: user, role }, 200, mine.headers);
+        }
+        if (route === "/me/organizations/members/remove") {
+          const res = await as(`${base}/${user}`, void 0, "DELETE");
+          if (res.error) return refused(res);
+          orgCache.delete(mine.token);
+          return json({ status: "removed", userId: user }, 200, mine.headers);
+        }
+        if (route === "/me/organizations/members/invite") {
+          const res = await as(`${base}/${user}/invite`, { client_id: clientId, ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} });
+          if (res.error) return refused(res);
+          return json({ status: "sent", userId: user }, 200, mine.headers);
+        }
+      }
       if (route === "/me/agents/disconnect") {
         const id = typeof b.id === "string" ? b.id : "";
         if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, "invalid_agent", "Say which agent to disconnect.", void 0, mine.headers);