cauthy-auth 0.24.3 → 0.26.0

package/dist/client.d.mts

@@ -1,7 +1,7 @@
 import { CauthyTheme } from './theme.mjs';
 import { i as PublicSession } from './system-BxMsSIu1.mjs';
-import { A as AuthField } from './validate-B_iC-4y8.mjs';
-export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.mjs';
+import { A as AuthField } from './validate-BTRit1O1.mjs';
+export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.mjs';
 import 'jose';
 
 /** Whether this browser can use a passkey at all. */
@@ -78,6 +78,11 @@ interface AuthMethods {
     }[];
     /** Whether people may create an account themselves. */
     signUp: boolean;
+    /** Set when the application's system makes an organization per sign-up: the form asks the company's name. */
+    organization?: {
+        ask: boolean;
+        required: boolean;
+    };
     magicLink: boolean;
     /** Whether to offer a passkey. */
     passkey: boolean;
@@ -425,21 +430,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
+        /**
+         * With address and password. `mfa_required`: ask for the code and call
+         * `signIn.mfa`. `method: 'email'` says the code was just mailed to the
+         * account's address (it has no factor of its own and the workspace, or
+         * the sign-in's risk, asked a second step): say so, and offer
+         * `mfaSendEmail` for another.
+         */
         email(form: {
             email: string;
             password: string;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
-        }> | AuthResult<'mfa_required'>>;
-        /** The second step: the code of the authenticator app, or a recovery code. */
+        }> | AuthResult<'mfa_required', {
+            method?: 'email';
+        }>>;
+        /** The second step: the code of the authenticator app, the phone, the email, or a recovery code. */
         mfa(form: {
             code: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** While the second step is asked for: whether the account has an authenticator app, the phone (masked) a code can be sent to, and phones that approve sign-ins. */
+        /**
+         * While the second step is asked for: whether the account has an
+         * authenticator app, the phone (masked) a code can be sent to, phones
+         * that approve sign-ins, and the address (masked) a code went to when
+         * the step is by email.
+         */
         mfaMethods(): Promise<AuthResult<'ok', {
             totp: boolean;
             phone: {
@@ -449,6 +467,13 @@ interface AuthClient {
             push: {
                 devices: number;
             } | null;
+            email: {
+                to: string;
+            } | null;
+        }>>;
+        /** Mails the sign-in's code again, when its second step is by email; `mfa` takes it. A few per sign-in. */
+        mfaSendEmail(): Promise<AuthResult<'sent', {
+            sentTo: string;
         }>>;
         /**
          * Sends a push to the account's phones (the application's app, with
@@ -597,6 +622,7 @@ interface AuthClient {
             email: string;
             password: string;
             name?: string;
+            organization?: string;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -615,9 +641,12 @@ interface AuthClient {
         password: string;
     }): Promise<AuthResult<'changed'>>;
     /** Confirms the address, with the token the mailed link opened the page with (`token`). */
+    /** Confirms the address a mailed link is for. The person is signed in from the link when their account asks no second step. */
     verifyEmail(form: {
         token: string;
-    }): Promise<AuthResult<'verified'>>;
+    }): Promise<AuthResult<'verified'> | AuthResult<'signed_in', {
+        session: PublicSession;
+    }>>;
     signOut(): Promise<AuthResult<'signed_out'>>;
     /** The signed-in person's own account. */
     account: AccountClient;

package/dist/client.d.ts

@@ -1,7 +1,7 @@
 import { CauthyTheme } from './theme.js';
 import { i as PublicSession } from './system-DTIeDXDP.js';
-import { A as AuthField } from './validate-B_iC-4y8.js';
-export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.js';
+import { A as AuthField } from './validate-BTRit1O1.js';
+export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.js';
 import 'jose';
 
 /** Whether this browser can use a passkey at all. */
@@ -78,6 +78,11 @@ interface AuthMethods {
     }[];
     /** Whether people may create an account themselves. */
     signUp: boolean;
+    /** Set when the application's system makes an organization per sign-up: the form asks the company's name. */
+    organization?: {
+        ask: boolean;
+        required: boolean;
+    };
     magicLink: boolean;
     /** Whether to offer a passkey. */
     passkey: boolean;
@@ -425,21 +430,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
+        /**
+         * With address and password. `mfa_required`: ask for the code and call
+         * `signIn.mfa`. `method: 'email'` says the code was just mailed to the
+         * account's address (it has no factor of its own and the workspace, or
+         * the sign-in's risk, asked a second step): say so, and offer
+         * `mfaSendEmail` for another.
+         */
         email(form: {
             email: string;
             password: string;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
-        }> | AuthResult<'mfa_required'>>;
-        /** The second step: the code of the authenticator app, or a recovery code. */
+        }> | AuthResult<'mfa_required', {
+            method?: 'email';
+        }>>;
+        /** The second step: the code of the authenticator app, the phone, the email, or a recovery code. */
         mfa(form: {
             code: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** While the second step is asked for: whether the account has an authenticator app, the phone (masked) a code can be sent to, and phones that approve sign-ins. */
+        /**
+         * While the second step is asked for: whether the account has an
+         * authenticator app, the phone (masked) a code can be sent to, phones
+         * that approve sign-ins, and the address (masked) a code went to when
+         * the step is by email.
+         */
         mfaMethods(): Promise<AuthResult<'ok', {
             totp: boolean;
             phone: {
@@ -449,6 +467,13 @@ interface AuthClient {
             push: {
                 devices: number;
             } | null;
+            email: {
+                to: string;
+            } | null;
+        }>>;
+        /** Mails the sign-in's code again, when its second step is by email; `mfa` takes it. A few per sign-in. */
+        mfaSendEmail(): Promise<AuthResult<'sent', {
+            sentTo: string;
         }>>;
         /**
          * Sends a push to the account's phones (the application's app, with
@@ -597,6 +622,7 @@ interface AuthClient {
             email: string;
             password: string;
             name?: string;
+            organization?: string;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -615,9 +641,12 @@ interface AuthClient {
         password: string;
     }): Promise<AuthResult<'changed'>>;
     /** Confirms the address, with the token the mailed link opened the page with (`token`). */
+    /** Confirms the address a mailed link is for. The person is signed in from the link when their account asks no second step. */
     verifyEmail(form: {
         token: string;
-    }): Promise<AuthResult<'verified'>>;
+    }): Promise<AuthResult<'verified'> | AuthResult<'signed_in', {
+        session: PublicSession;
+    }>>;
     signOut(): Promise<AuthResult<'signed_out'>>;
     /** The signed-in person's own account. */
     account: AccountClient;

package/dist/client.js

@@ -179,6 +179,13 @@ function checkName(value) {
   if (typeof value !== "string" || value.trim().length > MAX_NAME) return { field: "name", code: "too_long", message: `Use at most ${MAX_NAME} characters.` };
   return null;
 }
+var MAX_ORGANIZATION = 120;
+function checkOrganization(value, required = false) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return required ? { field: "organization", code: "required", message: "Enter your company's name." } : null;
+  if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -393,6 +400,7 @@ function createAuthClient(options = {}) {
       mfa: (f) => post("/sign-in/mfa", { code: f.code }, checkCode(f.code)),
       mfaMethods: () => post("/sign-in/mfa/methods", {}, null),
       mfaSendCode: () => post("/sign-in/mfa/send", {}, null),
+      mfaSendEmail: () => post("/sign-in/mfa/email", {}, null),
       mfaPush: () => post("/sign-in/mfa/push", {}, null),
       async mfaPushWait(o = {}) {
         const status = await new Promise((resolve) => {
@@ -509,7 +517,12 @@ function createAuthClient(options = {}) {
       }
     },
     signUp: {
-      email: (f) => post("/sign-up/email", { email: f.email, password: f.password, name: f.name }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password)), f.captchaToken)
+      email: (f) => post(
+        "/sign-up/email",
+        { email: f.email, password: f.password, name: f.name, organization: f.organization },
+        firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password), checkOrganization(f.organization)),
+        f.captchaToken
+      )
     },
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password)),