cauthy-auth 0.25.0 → 0.26.0

package/dist/index.js

@@ -1243,6 +1243,7 @@ function createCauthy(given = {}) {
       "/me/mfa/phone/remove",
       "/sign-in/mfa/methods",
       "/sign-in/mfa/send",
+      "/sign-in/mfa/email",
       "/sign-in/mfa/push",
       "/sign-in/mfa/push/events",
       "/sign-in/mfa/push/finish",
@@ -1536,7 +1537,8 @@ function createCauthy(given = {}) {
       if (res.error) return problem(res.status, res.error.code, res.error.message);
       if (res.data?.mfa_required === true) {
         const step = { kind: "mfa", token: String(res.data.mfa_token ?? ""), returnTo: afterSignIn };
-        return json({ status: "mfa_required" }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
+        const how = res.data.mfa_method === "email" ? { method: "email" } : {};
+        return json({ status: "mfa_required", ...how }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
       }
       return signedIn(request, res.data);
     }
@@ -1563,7 +1565,7 @@ function createCauthy(given = {}) {
       if (res.error) return problem(res.status, res.error.code, res.error.message);
       return signedIn(request, res.data, [writeCookie(stepCookie, "", attrs(request, 0))]);
     }
-    if (route === "/sign-in/mfa/methods" || route === "/sign-in/mfa/send") {
+    if (route === "/sign-in/mfa/methods" || route === "/sign-in/mfa/send" || route === "/sign-in/mfa/email") {
       const sealed = readCookies(request.headers.get("cookie")).get(stepCookie);
       const step = sealed ? await unseal(sealed, await key) : null;
       if (step === null || step.kind !== "mfa") return problem(400, "step_expired", "Sign in again: the code was asked for too long ago.");
@@ -1572,13 +1574,20 @@ function createCauthy(given = {}) {
         if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
         const p = res2.data?.phone;
         const push = res2.data?.push;
+        const mail = res2.data?.email;
         return json({
           status: "ok",
           totp: res2.data?.totp === true,
           phone: p ? { number: String(p.number ?? ""), channel: String(p.channel ?? "sms") } : null,
-          push: push ? { devices: Number(push.devices ?? 0) } : null
+          push: push ? { devices: Number(push.devices ?? 0) } : null,
+          email: mail ? { to: String(mail.to ?? "") } : null
         });
       }
+      if (route === "/sign-in/mfa/email") {
+        const res2 = await ask(request, "POST", "/v1/auth/mfa/email", { mfa_token: step.token });
+        if (res2.error) return problem(res2.status, res2.error.code, res2.error.message);
+        return json({ status: "sent", sentTo: String(res2.data?.sent_to ?? "") });
+      }
       const res = await ask(request, "POST", "/v1/auth/mfa/send", { mfa_token: step.token });
       if (res.error) return problem(res.status, res.error.code, res.error.message);
       return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "sms") });