cauthy-auth 0.20.0 → 0.23.0

package/dist/{cauthy-Bn3iv50y.d.ts → cauthy-DGAy45G2.d.ts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-DhRr_WxR.js';
+import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-DTIeDXDP.js';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/{cauthy-C29HCvag.d.mts → cauthy-XkIbG5gE.d.mts}

@@ -1,4 +1,4 @@
-import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-ZD_Wa8Bm.mjs';
+import { J as JsonValue, S as Session, l as SessionStatus, k as SessionOrganization, c as CauthySystem, i as PublicSession, b as CauthyOptions } from './system-BxMsSIu1.mjs';
 import { JWTVerifyGetKey } from 'jose';
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */

package/dist/client.d.mts

@@ -1,5 +1,5 @@
 import { CauthyTheme } from './theme.mjs';
-import { i as PublicSession } from './system-ZD_Wa8Bm.mjs';
+import { i as PublicSession } from './system-BxMsSIu1.mjs';
 import { A as AuthField } from './validate-B_iC-4y8.mjs';
 export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.mjs';
 import 'jose';
@@ -163,6 +163,82 @@ interface ConnectedAgent {
     connectedAt: string;
     lastUsedAt: string;
 }
+/** An organization the person belongs to, with what their role lets them do with its people. */
+interface OrganizationSeat {
+    id: string;
+    /** The client system it is of (`pondari`). */
+    system: string;
+    name: string;
+    kind: string;
+    /** The person's role in it. */
+    role: string;
+    /** Cauthy's member powers, from the system's catalog: cauthy:members read and manage. */
+    can: {
+        readMembers: boolean;
+        manageMembers: boolean;
+    };
+}
+/** A person of an organization, as a member who may see them reads it. */
+interface OrganizationPerson {
+    userId: string;
+    email: string;
+    name: string;
+    role: string;
+    /** The account's: `active`, `suspended`… A disabled member is still listed. */
+    status: string;
+    /** Invited and not yet accepted. */
+    invited: boolean;
+    /** Manages the organization's members. */
+    manager: boolean;
+    /** The signed-in person. */
+    you: boolean;
+    /** UTC, ISO 8601. */
+    since: string;
+}
+/** A role of the organization's system, as the catalog names it. */
+interface OrganizationRoleChoice {
+    role: string;
+    name: string;
+    description: string;
+    /** Holding it manages the organization's members. */
+    manager: boolean;
+}
+/**
+ * The signed-in person's organizations, and their people. Seeing them needs
+ * cauthy:members read in the person's role; changing them needs manage. Cauthy
+ * decides, with the person's own session: the application authorizes nothing.
+ */
+interface OrganizationsClient {
+    /** The organizations the person belongs to; one system's only with `system`. */
+    list(system?: string): Promise<OrganizationSeat[]>;
+    /** The people of one, or null when the person may not see them. */
+    members(organizationId: string): Promise<OrganizationPerson[] | null>;
+    /** The roles a member may be given, or null when the person may not see them. */
+    roles(organizationId: string): Promise<OrganizationRoleChoice[] | null>;
+    /** Adds a person by their address; an address with no account gets one and its invitation. */
+    add(organizationId: string, form: {
+        email: string;
+        role: string;
+        name?: string;
+        locale?: string;
+    }): Promise<AuthResult<'added', {
+        member: OrganizationPerson;
+    }>>;
+    setRole(organizationId: string, userId: string, role: string): Promise<AuthResult<'changed', {
+        userId: string;
+        role: string;
+    }>>;
+    /** Removes a member; the person themself may always leave. */
+    remove(organizationId: string, userId: string): Promise<AuthResult<'removed', {
+        userId: string;
+    }>>;
+    /** Sends a member's invitation again. */
+    inviteAgain(organizationId: string, userId: string, form?: {
+        locale?: string;
+    }): Promise<AuthResult<'sent', {
+        userId: string;
+    }>>;
+}
 interface AccountSession {
     /** "Mac · Chrome", or "" when the browser did not say. */
     device: string;
@@ -285,6 +361,26 @@ interface AccountClient {
     unlink(provider: string): Promise<AuthResult<'unlinked', {
         provider: string;
     }>>;
+    /**
+     * A guest becomes an account of their own with an address and a password —
+     * the same id, so what they did stays theirs. `email_taken`: the address has
+     * an account already; offer to sign in with it.
+     */
+    upgrade(form: {
+        email: string;
+        password: string;
+        name?: string;
+    }): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }>>;
+    /** Where a guest goes to become the account of a provider's address (Google…). */
+    upgradeUrl(provider: string, options?: {
+        returnTo?: string;
+    }): string;
+    /** Sends a guest to `upgradeUrl`; they come back signed in as the account. */
+    upgradeWith(provider: string, options?: {
+        returnTo?: string;
+    }): void;
     /** Where the account is signed in. */
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
@@ -318,6 +414,17 @@ interface AccountClient {
 }
 interface AuthClient {
     signIn: {
+        /**
+         * A guest session, before the visitor signs up: the application keeps what
+         * they do under `session.user.id`, and `account.upgrade` (or
+         * `account.upgradeWith`) makes it their account, same id. Only where the
+         * workspace allows guests (`anonymous_disabled` otherwise).
+         */
+        anonymously(form?: {
+            captchaToken?: string;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
         /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
         email(form: {
             email: string;
@@ -332,13 +439,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** While the second step is asked for: whether the account has an authenticator app, and the phone (masked) a code can be sent to. */
+        /** While the second step is asked for: whether the account has an authenticator app, the phone (masked) a code can be sent to, and phones that approve sign-ins. */
         mfaMethods(): Promise<AuthResult<'ok', {
             totp: boolean;
             phone: {
                 number: string;
                 channel: string;
             } | null;
+            push: {
+                devices: number;
+            } | null;
+        }>>;
+        /**
+         * Sends a push to the account's phones (the application's app, with
+         * cauthy-expo): show `number`, which the person picks on the phone, then
+         * call `mfaPushWait`.
+         */
+        mfaPush(): Promise<AuthResult<'sent', {
+            number: number;
+        }>>;
+        /**
+         * Waits for the phone's answer, listening (server-sent events) rather than
+         * asking again and again, and signs in when it approves. `denied`: turned
+         * down on the phone; `expired`: nobody answered in time.
+         */
+        mfaPushWait(o?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
         }>>;
         /** Sends a code to the account's phone, by SMS or WhatsApp; `mfa` takes it. A few per sign-in. */
         mfaSendCode(): Promise<AuthResult<'sent', {
@@ -493,6 +621,8 @@ interface AuthClient {
     signOut(): Promise<AuthResult<'signed_out'>>;
     /** The signed-in person's own account. */
     account: AccountClient;
+    /** The signed-in person's organizations, and their people. */
+    organizations: OrganizationsClient;
     /** Who is signed in, or null. */
     getSession(): Promise<PublicSession | null>;
     methods(): Promise<AuthMethods>;
@@ -516,4 +646,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { CauthyTheme } from './theme.js';
-import { i as PublicSession } from './system-DhRr_WxR.js';
+import { i as PublicSession } from './system-DTIeDXDP.js';
 import { A as AuthField } from './validate-B_iC-4y8.js';
 export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.js';
 import 'jose';
@@ -163,6 +163,82 @@ interface ConnectedAgent {
     connectedAt: string;
     lastUsedAt: string;
 }
+/** An organization the person belongs to, with what their role lets them do with its people. */
+interface OrganizationSeat {
+    id: string;
+    /** The client system it is of (`pondari`). */
+    system: string;
+    name: string;
+    kind: string;
+    /** The person's role in it. */
+    role: string;
+    /** Cauthy's member powers, from the system's catalog: cauthy:members read and manage. */
+    can: {
+        readMembers: boolean;
+        manageMembers: boolean;
+    };
+}
+/** A person of an organization, as a member who may see them reads it. */
+interface OrganizationPerson {
+    userId: string;
+    email: string;
+    name: string;
+    role: string;
+    /** The account's: `active`, `suspended`… A disabled member is still listed. */
+    status: string;
+    /** Invited and not yet accepted. */
+    invited: boolean;
+    /** Manages the organization's members. */
+    manager: boolean;
+    /** The signed-in person. */
+    you: boolean;
+    /** UTC, ISO 8601. */
+    since: string;
+}
+/** A role of the organization's system, as the catalog names it. */
+interface OrganizationRoleChoice {
+    role: string;
+    name: string;
+    description: string;
+    /** Holding it manages the organization's members. */
+    manager: boolean;
+}
+/**
+ * The signed-in person's organizations, and their people. Seeing them needs
+ * cauthy:members read in the person's role; changing them needs manage. Cauthy
+ * decides, with the person's own session: the application authorizes nothing.
+ */
+interface OrganizationsClient {
+    /** The organizations the person belongs to; one system's only with `system`. */
+    list(system?: string): Promise<OrganizationSeat[]>;
+    /** The people of one, or null when the person may not see them. */
+    members(organizationId: string): Promise<OrganizationPerson[] | null>;
+    /** The roles a member may be given, or null when the person may not see them. */
+    roles(organizationId: string): Promise<OrganizationRoleChoice[] | null>;
+    /** Adds a person by their address; an address with no account gets one and its invitation. */
+    add(organizationId: string, form: {
+        email: string;
+        role: string;
+        name?: string;
+        locale?: string;
+    }): Promise<AuthResult<'added', {
+        member: OrganizationPerson;
+    }>>;
+    setRole(organizationId: string, userId: string, role: string): Promise<AuthResult<'changed', {
+        userId: string;
+        role: string;
+    }>>;
+    /** Removes a member; the person themself may always leave. */
+    remove(organizationId: string, userId: string): Promise<AuthResult<'removed', {
+        userId: string;
+    }>>;
+    /** Sends a member's invitation again. */
+    inviteAgain(organizationId: string, userId: string, form?: {
+        locale?: string;
+    }): Promise<AuthResult<'sent', {
+        userId: string;
+    }>>;
+}
 interface AccountSession {
     /** "Mac · Chrome", or "" when the browser did not say. */
     device: string;
@@ -285,6 +361,26 @@ interface AccountClient {
     unlink(provider: string): Promise<AuthResult<'unlinked', {
         provider: string;
     }>>;
+    /**
+     * A guest becomes an account of their own with an address and a password —
+     * the same id, so what they did stays theirs. `email_taken`: the address has
+     * an account already; offer to sign in with it.
+     */
+    upgrade(form: {
+        email: string;
+        password: string;
+        name?: string;
+    }): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }>>;
+    /** Where a guest goes to become the account of a provider's address (Google…). */
+    upgradeUrl(provider: string, options?: {
+        returnTo?: string;
+    }): string;
+    /** Sends a guest to `upgradeUrl`; they come back signed in as the account. */
+    upgradeWith(provider: string, options?: {
+        returnTo?: string;
+    }): void;
     /** Where the account is signed in. */
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
@@ -318,6 +414,17 @@ interface AccountClient {
 }
 interface AuthClient {
     signIn: {
+        /**
+         * A guest session, before the visitor signs up: the application keeps what
+         * they do under `session.user.id`, and `account.upgrade` (or
+         * `account.upgradeWith`) makes it their account, same id. Only where the
+         * workspace allows guests (`anonymous_disabled` otherwise).
+         */
+        anonymously(form?: {
+            captchaToken?: string;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }>>;
         /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
         email(form: {
             email: string;
@@ -332,13 +439,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** While the second step is asked for: whether the account has an authenticator app, and the phone (masked) a code can be sent to. */
+        /** While the second step is asked for: whether the account has an authenticator app, the phone (masked) a code can be sent to, and phones that approve sign-ins. */
         mfaMethods(): Promise<AuthResult<'ok', {
             totp: boolean;
             phone: {
                 number: string;
                 channel: string;
             } | null;
+            push: {
+                devices: number;
+            } | null;
+        }>>;
+        /**
+         * Sends a push to the account's phones (the application's app, with
+         * cauthy-expo): show `number`, which the person picks on the phone, then
+         * call `mfaPushWait`.
+         */
+        mfaPush(): Promise<AuthResult<'sent', {
+            number: number;
+        }>>;
+        /**
+         * Waits for the phone's answer, listening (server-sent events) rather than
+         * asking again and again, and signs in when it approves. `denied`: turned
+         * down on the phone; `expired`: nobody answered in time.
+         */
+        mfaPushWait(o?: {
+            signal?: AbortSignal;
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
         }>>;
         /** Sends a code to the account's phone, by SMS or WhatsApp; `mfa` takes it. A few per sign-in. */
         mfaSendCode(): Promise<AuthResult<'sent', {
@@ -493,6 +621,8 @@ interface AuthClient {
     signOut(): Promise<AuthResult<'signed_out'>>;
     /** The signed-in person's own account. */
     account: AccountClient;
+    /** The signed-in person's organizations, and their people. */
+    organizations: OrganizationsClient;
     /** Who is signed in, or null. */
     getSession(): Promise<PublicSession | null>;
     methods(): Promise<AuthMethods>;
@@ -516,4 +646,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -343,6 +343,7 @@ function createAuthClient(options = {}) {
       return null;
     }
   }
+  const upgradeUrl = (provider, o = {}) => `${base}/me/upgrade/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const linkUrl = (provider, o = {}) => `${base}/me/identities/link/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const socialUrl = (provider, o = {}) => `${base}/sign-in/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const ssoUrl = (target, o = {}) => {
@@ -380,10 +381,40 @@ function createAuthClient(options = {}) {
   }
   return {
     signIn: {
+      anonymously: (f = {}) => post("/sign-in/anonymous", {}, null, f.captchaToken),
       email: (f) => post("/sign-in/email", { email: f.email, password: f.password }, firstProblem(checkEmail(f.email), checkPassword(f.password)), f.captchaToken),
       mfa: (f) => post("/sign-in/mfa", { code: f.code }, checkCode(f.code)),
       mfaMethods: () => post("/sign-in/mfa/methods", {}, null),
       mfaSendCode: () => post("/sign-in/mfa/send", {}, null),
+      mfaPush: () => post("/sign-in/mfa/push", {}, null),
+      async mfaPushWait(o = {}) {
+        const status = await new Promise((resolve) => {
+          if (typeof EventSource !== "function") return resolve("approved");
+          const source = new EventSource(`${base}/sign-in/mfa/push/events`, { withCredentials: true });
+          const stop = (st) => {
+            source.close();
+            resolve(st);
+          };
+          o.signal?.addEventListener("abort", () => stop("aborted"));
+          source.addEventListener("status", (e) => {
+            const st = (() => {
+              try {
+                return String(JSON.parse(e.data).status);
+              } catch {
+                return "";
+              }
+            })();
+            if (st && st !== "pending") stop(st);
+          });
+          source.onerror = () => {
+            if (source.readyState === EventSource.CLOSED) stop("expired");
+          };
+        });
+        if (status === "aborted") return { ok: false, error: { code: "aborted", message: "Stopped waiting." } };
+        if (status === "denied") return { ok: false, error: { code: "push_denied", message: "The sign-in was turned down on the phone." } };
+        if (status === "expired") return { ok: false, error: { code: "push_expired", message: "Nobody answered on the phone in time." } };
+        return post("/sign-in/mfa/push/finish", {}, null);
+      },
       magicLink: (f) => post("/sign-in/magic-link", { email: f.email, ...f.create ? { create: true } : {}, ...f.returnTo ? { returnTo: f.returnTo } : {} }, checkEmail(f.email), f.captchaToken),
       magicLinkVerify: (f) => post("/sign-in/magic-link/verify", { token: f.token }, null),
       emailCode: (f) => post("/sign-in/email-code", { code: f.code }, checkCode(f.code)),
@@ -477,6 +508,24 @@ function createAuthClient(options = {}) {
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
     signOut: () => post("/sign-out", {}, null),
+    organizations: {
+      async list(system) {
+        const body = await read(`/me/organizations${system ? `?system=${encodeURIComponent(system)}` : ""}`);
+        return body && Array.isArray(body.organizations) ? body.organizations : [];
+      },
+      async members(id) {
+        const body = await read(`/me/organizations/members?id=${encodeURIComponent(id)}`);
+        return body && Array.isArray(body.members) ? body.members : null;
+      },
+      async roles(id) {
+        const body = await read(`/me/organizations/roles?id=${encodeURIComponent(id)}`);
+        return body && Array.isArray(body.roles) ? body.roles : null;
+      },
+      add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
+      setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
+      remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+    },
     account: {
       async get() {
         const body = await read("/me");
@@ -515,6 +564,11 @@ function createAuthClient(options = {}) {
         return body && Array.isArray(body.sessions) ? body.sessions : [];
       },
       signOutEverywhere: () => post("/me/sessions/end", {}, null),
+      upgrade: (f) => post("/me/upgrade", { email: f.email, password: f.password, name: f.name ?? "" }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password))),
+      upgradeUrl,
+      upgradeWith(provider, o) {
+        window.location.assign(upgradeUrl(provider, o));
+      },
       async agents() {
         const body = await read("/me/agents");
         return body && Array.isArray(body.agents) ? body.agents : [];