cauthy-auth 0.20.0 → 0.23.0

package/dist/index.js

@@ -837,7 +837,8 @@ function createCauthy(given = {}) {
           emailVerified: b.email_verified === true,
           restricted: b.restricted === true,
           ...typeof b.email_verify_by === "string" ? { emailVerifyBy: b.email_verify_by } : {},
-          ...typeof b.locale === "string" && b.locale !== "" ? { locale: b.locale } : {}
+          ...typeof b.locale === "string" && b.locale !== "" ? { locale: b.locale } : {},
+          ...b.anonymous === true ? { isAnonymous: true } : {}
         }
       };
     } catch {
@@ -1046,6 +1047,32 @@ function createCauthy(given = {}) {
     createdAt: String(d?.created_at ?? ""),
     lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null
   });
+  const UUID = /^[0-9a-f-]{36}$/i;
+  const seatOf = (d) => ({
+    id: String(d?.id ?? ""),
+    system: String(d?.system ?? ""),
+    name: String(d?.name ?? ""),
+    kind: String(d?.kind ?? ""),
+    role: String(d?.role ?? ""),
+    can: { readMembers: d?.can?.read_members === true, manageMembers: d?.can?.manage_members === true }
+  });
+  const orgMemberOf = (d) => ({
+    userId: String(d?.user_id ?? ""),
+    email: String(d?.email ?? ""),
+    name: String(d?.name ?? ""),
+    role: String(d?.role ?? ""),
+    status: String(d?.status ?? ""),
+    invited: d?.invited === true,
+    manager: d?.manager === true,
+    you: d?.you === true,
+    since: String(d?.since ?? "")
+  });
+  const orgRoleOf = (d) => ({
+    role: String(d?.role ?? ""),
+    name: String(d?.name ?? ""),
+    description: String(d?.description ?? ""),
+    manager: d?.manager === true
+  });
   const agentOf = (d) => ({
     id: String(d?.id ?? ""),
     name: String(d?.agent?.name ?? ""),
@@ -1164,6 +1191,9 @@ function createCauthy(given = {}) {
       "/me/mfa/phone/remove",
       "/sign-in/mfa/methods",
       "/sign-in/mfa/send",
+      "/sign-in/mfa/push",
+      "/sign-in/mfa/push/events",
+      "/sign-in/mfa/push/finish",
       "/me/sessions",
       "/me/sessions/end",
       "/me/email",
@@ -1181,8 +1211,17 @@ function createCauthy(given = {}) {
       "/me/passkeys/add/finish",
       "/me/passkeys/remove",
       "/me/agents",
-      "/me/agents/disconnect"
-    ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/") || route === "/sign-in/sso" || route === "/sign-in/sso/discover" || route === "/sso/callback";
+      "/me/agents/disconnect",
+      "/sign-in/anonymous",
+      "/me/upgrade",
+      "/me/organizations",
+      "/me/organizations/members",
+      "/me/organizations/roles",
+      "/me/organizations/members/add",
+      "/me/organizations/members/role",
+      "/me/organizations/members/remove",
+      "/me/organizations/members/invite"
+    ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/") || route.startsWith("/me/upgrade/social/") || route === "/sign-in/sso" || route === "/sign-in/sso/discover" || route === "/sso/callback";
     if (!own) return null;
     if (tenant === "") {
       return problem(500, "not_configured", "cauthy-auth: tenant (CAUTHY_TENANT) is required for the application's own sign-in screens");
@@ -1270,10 +1309,19 @@ function createCauthy(given = {}) {
       const clear = writeCookie(stepCookie, "", attrs(request, 0));
       const back = step?.returnTo ?? afterSignIn;
       const failedTo = (code2) => redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code2)}`, [clear]);
-      if (step === null || step.kind !== "social" && step.kind !== "link" || step.provider !== provider || url.searchParams.get("state") !== step.token) return failedTo("state_mismatch");
+      if (step === null || step.kind !== "social" && step.kind !== "link" && step.kind !== "upgrade" || step.provider !== provider || url.searchParams.get("state") !== step.token) return failedTo("state_mismatch");
       const code = url.searchParams.get("code");
       if (!code) return failedTo(url.searchParams.get("error") === "access_denied" ? "cancelled" : "provider_refused");
       const q = new URLSearchParams({ code, state: step.token, redirect_uri: `${originOf(request)}${basePath}/callback/${provider}` });
+      if (step.kind === "upgrade") {
+        const mine = await signedInAs(request);
+        if ("response" in mine) return failedTo("unauthenticated");
+        const done2 = await ask(request, "GET", `/v1/auth/anonymous/upgrade/${provider}/callback?${q}`, void 0, void 0, mine.token);
+        if (done2.error) return failedTo(done2.error.code);
+        const s2 = await stored(done2.data);
+        if (s2 === null) return failedTo("unavailable");
+        return redirect(back, [...await write(request, s2, readCookies(request.headers.get("cookie"))), clear]);
+      }
       if (step.kind === "link") {
         const mine = await signedInAs(request);
         if ("response" in mine) return failedTo("unauthenticated");
@@ -1289,6 +1337,19 @@ function createCauthy(given = {}) {
       if (s === null) return failedTo("unavailable");
       return redirect(back, [...await write(request, s, readCookies(request.headers.get("cookie"))), clear]);
     }
+    if (route.startsWith("/me/upgrade/social/") && !post) {
+      const provider = providerIn(route.slice("/me/upgrade/social/".length));
+      if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
+      const mine = await signedInAs(request);
+      if ("response" in mine) return failed2("unauthenticated");
+      const callback2 = `${basePath}/callback/${provider}`;
+      const started = await ask(request, "GET", `/v1/auth/anonymous/upgrade/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback2}`)}`, void 0, callback2, mine.token);
+      if (started.error || typeof started.data?.redirect_url !== "string") return failed2(started.error?.code ?? "provider_unavailable");
+      const step = { kind: "upgrade", token: String(started.data.state ?? ""), provider, returnTo };
+      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS))]);
+    }
     if (route.startsWith("/me/identities/link/") && !post) {
       const provider = providerIn(route.slice("/me/identities/link/".length));
       if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
@@ -1326,6 +1387,24 @@ function createCauthy(given = {}) {
       const list = Array.isArray(res.data) ? res.data : [];
       return json({ agents: list.map(agentOf) }, 200, mine.headers);
     }
+    if ((route === "/me/organizations" || route === "/me/organizations/members" || route === "/me/organizations/roles") && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      let path = "/v1/auth/me/organizations";
+      if (route !== "/me/organizations") {
+        const id = url.searchParams.get("id") ?? "";
+        if (!UUID.test(id)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        path += `/${id}/${route.endsWith("/roles") ? "roles" : "members"}`;
+      } else if (url.searchParams.get("system")) {
+        path += `?system=${encodeURIComponent(url.searchParams.get("system"))}`;
+      }
+      const res = await ask(request, "GET", path, void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      if (route === "/me/organizations") return json({ organizations: list.map(seatOf) }, 200, mine.headers);
+      if (route === "/me/organizations/roles") return json({ roles: list.map(orgRoleOf) }, 200, mine.headers);
+      return json({ members: list.map(orgMemberOf) }, 200, mine.headers);
+    }
     if (route === "/me/mfa/factors" && !post) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
@@ -1344,6 +1423,28 @@ function createCauthy(given = {}) {
       }
       return json({ account: accountOf(res.data) }, 200, mine.headers);
     }
+    if (route === "/sign-in/mfa/push/events" && !post) {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      let upstream;
+      try {
+        upstream = await doFetch(`${issuer}/v1/auth/mfa/push/events`, {
+          headers: { "x-tenant-key": tenant, "x-mfa-token": step.token, accept: "text/event-stream" },
+          signal: request.signal
+        });
+      } catch {
+        return problem(503, "unavailable", "Cauthy could not be reached.");
+      }
+      if (!upstream.ok || !upstream.body) {
+        const b2 = await upstream.json().catch(() => null);
+        return problem(upstream.status, String(b2?.errors?.[0]?.code ?? "error"), String(b2?.errors?.[0]?.message ?? "The request could not be completed."));
+      }
+      return new Response(upstream.body, {
+        status: 200,
+        headers: { "content-type": "text/event-stream", "cache-control": "no-cache, no-store", "x-accel-buffering": "no" }
+      });
+    }
     if (!post) return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
     if (!ownRequest(request)) return problem(403, "cross_site", "This request did not come from this application.");
     if (route === "/sign-out") {
@@ -1368,6 +1469,12 @@ function createCauthy(given = {}) {
       const c = res.data?.connection;
       return json(c ? { status: "found", connection: { id: String(c.slug ?? ""), name: String(c.display_name ?? ""), enforced: c.enforced === true } } : { status: "none" });
     }
+    if (route === "/sign-in/anonymous") {
+      if (!post) return new Response("Method not allowed", { status: 405, headers: { allow: "POST" } });
+      const res = await ask(request, "POST", "/v1/auth/anonymous", {});
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data);
+    }
     if (route === "/sign-in/email") {
       const bad = firstProblem(checkEmail(b.email), checkPassword(b.password));
       if (bad) return invalid(bad);
@@ -1389,6 +1496,19 @@ function createCauthy(given = {}) {
       if (res.error) return problem(res.status, res.error.code, res.error.message, "code");
       return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
     }
+    if (route === "/sign-in/mfa/push" || route === "/sign-in/mfa/push/finish") {
+      const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
+      const step = sealed ? await unseal(sealed, await key) : null;
+      if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
+      if (route === "/sign-in/mfa/push") {
+        const res2 = await ask(request, "POST", "/v1/auth/mfa/push", { mfa_token: step.token });
+        if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
+        return json({ status: "sent", number: Number(res2.data?.number ?? 0) });
+      }
+      const res = await ask(request, "POST", "/v1/auth/mfa/challenge", { mfa_token: step.token, push: true });
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
+    }
     if (route === "/sign-in/mfa/methods" || route === "/sign-in/mfa/send") {
       const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
       const step = sealed ? await unseal(sealed, await key) : null;
@@ -1397,7 +1517,13 @@ function createCauthy(given = {}) {
         const res2 = await ask(request, "POST", "/v1/auth/mfa/methods", { mfa_token: step.token });
         if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
         const p = res2.data?.phone;
-        return json({ status: "ok", totp: res2.data?.totp === true, phone: p ? { number: String(p.number ?? ""), channel: String(p.channel ?? "sms") } : null });
+        const push = res2.data?.push;
+        return json({
+          status: "ok",
+          totp: res2.data?.totp === true,
+          phone: p ? { number: String(p.number ?? ""), channel: String(p.channel ?? "sms") } : null,
+          push: push ? { devices: Number(push.devices ?? 0) } : null
+        });
       }
       const res = await ask(request, "POST", "/v1/auth/mfa/send", { mfa_token: step.token });
       if (res.error) return problem(res.status, res.error.code, res.error.message);
@@ -1531,6 +1657,53 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res);
         return json({ status: "removed", id }, 200, mine.headers);
       }
+      if (route === "/me/upgrade") {
+        const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password));
+        if (bad) return invalid(bad);
+        const res = await as("/v1/auth/anonymous/upgrade", { email: String(b.email).trim(), password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "" });
+        if (res.error) return refused(res, res.error.code === "weak_password" ? "password" : "email");
+        return signedIn(request, res.data);
+      }
+      if (route.startsWith("/me/organizations/members/")) {
+        const org = typeof b.organizationId === "string" ? b.organizationId : "";
+        if (!UUID.test(org)) return problem(400, "invalid_organization", "Say which organization.", void 0, mine.headers);
+        const base = `/v1/auth/me/organizations/${org}/members`;
+        if (route === "/me/organizations/members/add") {
+          const bad = checkEmail(b.email);
+          if (bad) return invalid(bad);
+          const role = typeof b.role === "string" ? b.role : "";
+          if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
+          const res = await as(base, {
+            email: String(b.email).trim(),
+            role,
+            name: typeof b.name === "string" ? b.name.trim() : "",
+            client_id: clientId,
+            ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {}
+          });
+          if (res.error) return refused(res, res.error.code === "unknown_role" ? "role" : "email");
+          return json({ status: "added", member: orgMemberOf(res.data) }, 200, mine.headers);
+        }
+        const user = typeof b.userId === "string" ? b.userId : "";
+        if (!UUID.test(user)) return problem(400, "invalid_member", "Say which member.", void 0, mine.headers);
+        if (route === "/me/organizations/members/role") {
+          const role = typeof b.role === "string" ? b.role : "";
+          if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
+          const res = await as(`${base}/${user}`, { role }, "PUT");
+          if (res.error) return refused(res, "role");
+          return json({ status: "changed", userId: user, role }, 200, mine.headers);
+        }
+        if (route === "/me/organizations/members/remove") {
+          const res = await as(`${base}/${user}`, void 0, "DELETE");
+          if (res.error) return refused(res);
+          orgCache.delete(mine.token);
+          return json({ status: "removed", userId: user }, 200, mine.headers);
+        }
+        if (route === "/me/organizations/members/invite") {
+          const res = await as(`${base}/${user}/invite`, { client_id: clientId, ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} });
+          if (res.error) return refused(res);
+          return json({ status: "sent", userId: user }, 200, mine.headers);
+        }
+      }
       if (route === "/me/agents/disconnect") {
         const id = typeof b.id === "string" ? b.id : "";
         if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, "invalid_agent", "Say which agent to disconnect.", void 0, mine.headers);