cauthy-auth 0.25.0 → 0.27.0

package/dist/client.d.mts

@@ -110,6 +110,30 @@ interface AuthMethods {
      * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
      */
     sso: boolean;
+    /**
+     * Set when the workspace asks something of a sign-up: the legal documents
+     * to accept (the terms, the privacy policy: show the links and a box, send
+     * `acceptLegal: true`) and the consents to ask (one box each, sent as
+     * `consents`; a required one must be ticked). The ready-made form shows them.
+     */
+    legal?: {
+        documents: {
+            kind: string;
+            version: string;
+            url: string;
+        }[];
+        consentPurposes: {
+            key: string;
+            label: string;
+            required: boolean;
+        }[];
+    };
+}
+/** A legal document the person owes: not yet accepted in its current version. */
+interface PendingLegal {
+    kind: string;
+    version: string;
+    url: string;
 }
 /** A company's sign-in (an SSO connection of the workspace). */
 interface SSOConnection {
@@ -290,6 +314,18 @@ interface AccountClient {
     }): Promise<AuthResult<'changed', {
         signedIn: boolean;
     }>>;
+    /**
+     * The legal documents the person has not accepted in their current version
+     * (a new version of the terms, say): show them and call `acceptLegal`.
+     * Nothing stops the person meanwhile; the application decides what waits.
+     */
+    legal(): Promise<AuthResult<'ok', {
+        pending: PendingLegal[];
+    }>>;
+    /** Records the person's acceptance of the documents in force (the kinds named, or every one). */
+    acceptLegal(form?: {
+        kinds?: string[];
+    }): Promise<AuthResult<'accepted'>>;
     mfa: {
         /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
         setup(form: {
@@ -430,21 +466,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
+        /**
+         * With address and password. `mfa_required`: ask for the code and call
+         * `signIn.mfa`. `method: 'email'` says the code was just mailed to the
+         * account's address (it has no factor of its own and the workspace, or
+         * the sign-in's risk, asked a second step): say so, and offer
+         * `mfaSendEmail` for another.
+         */
         email(form: {
             email: string;
             password: string;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
-        }> | AuthResult<'mfa_required'>>;
-        /** The second step: the code of the authenticator app, or a recovery code. */
+        }> | AuthResult<'mfa_required', {
+            method?: 'email';
+        }>>;
+        /** The second step: the code of the authenticator app, the phone, the email, or a recovery code. */
         mfa(form: {
             code: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** While the second step is asked for: whether the account has an authenticator app, the phone (masked) a code can be sent to, and phones that approve sign-ins. */
+        /**
+         * While the second step is asked for: whether the account has an
+         * authenticator app, the phone (masked) a code can be sent to, phones
+         * that approve sign-ins, and the address (masked) a code went to when
+         * the step is by email.
+         */
         mfaMethods(): Promise<AuthResult<'ok', {
             totp: boolean;
             phone: {
@@ -454,6 +503,13 @@ interface AuthClient {
             push: {
                 devices: number;
             } | null;
+            email: {
+                to: string;
+            } | null;
+        }>>;
+        /** Mails the sign-in's code again, when its second step is by email; `mfa` takes it. A few per sign-in. */
+        mfaSendEmail(): Promise<AuthResult<'sent', {
+            sentTo: string;
         }>>;
         /**
          * Sends a push to the account's phones (the application's app, with
@@ -597,12 +653,17 @@ interface AuthClient {
         }): string;
     };
     signUp: {
-        /** `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in. */
+        /**
+         * `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in.
+         * `acceptLegal` and `consents` answer what `methods().legal` asks; a sign-up that leaves them out is refused.
+         */
         email(form: {
             email: string;
             password: string;
             name?: string;
             organization?: string;
+            acceptLegal?: boolean;
+            consents?: Record<string, boolean>;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -655,4 +716,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -110,6 +110,30 @@ interface AuthMethods {
      * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
      */
     sso: boolean;
+    /**
+     * Set when the workspace asks something of a sign-up: the legal documents
+     * to accept (the terms, the privacy policy: show the links and a box, send
+     * `acceptLegal: true`) and the consents to ask (one box each, sent as
+     * `consents`; a required one must be ticked). The ready-made form shows them.
+     */
+    legal?: {
+        documents: {
+            kind: string;
+            version: string;
+            url: string;
+        }[];
+        consentPurposes: {
+            key: string;
+            label: string;
+            required: boolean;
+        }[];
+    };
+}
+/** A legal document the person owes: not yet accepted in its current version. */
+interface PendingLegal {
+    kind: string;
+    version: string;
+    url: string;
 }
 /** A company's sign-in (an SSO connection of the workspace). */
 interface SSOConnection {
@@ -290,6 +314,18 @@ interface AccountClient {
     }): Promise<AuthResult<'changed', {
         signedIn: boolean;
     }>>;
+    /**
+     * The legal documents the person has not accepted in their current version
+     * (a new version of the terms, say): show them and call `acceptLegal`.
+     * Nothing stops the person meanwhile; the application decides what waits.
+     */
+    legal(): Promise<AuthResult<'ok', {
+        pending: PendingLegal[];
+    }>>;
+    /** Records the person's acceptance of the documents in force (the kinds named, or every one). */
+    acceptLegal(form?: {
+        kinds?: string[];
+    }): Promise<AuthResult<'accepted'>>;
     mfa: {
         /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
         setup(form: {
@@ -430,21 +466,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
+        /**
+         * With address and password. `mfa_required`: ask for the code and call
+         * `signIn.mfa`. `method: 'email'` says the code was just mailed to the
+         * account's address (it has no factor of its own and the workspace, or
+         * the sign-in's risk, asked a second step): say so, and offer
+         * `mfaSendEmail` for another.
+         */
         email(form: {
             email: string;
             password: string;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
-        }> | AuthResult<'mfa_required'>>;
-        /** The second step: the code of the authenticator app, or a recovery code. */
+        }> | AuthResult<'mfa_required', {
+            method?: 'email';
+        }>>;
+        /** The second step: the code of the authenticator app, the phone, the email, or a recovery code. */
         mfa(form: {
             code: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** While the second step is asked for: whether the account has an authenticator app, the phone (masked) a code can be sent to, and phones that approve sign-ins. */
+        /**
+         * While the second step is asked for: whether the account has an
+         * authenticator app, the phone (masked) a code can be sent to, phones
+         * that approve sign-ins, and the address (masked) a code went to when
+         * the step is by email.
+         */
         mfaMethods(): Promise<AuthResult<'ok', {
             totp: boolean;
             phone: {
@@ -454,6 +503,13 @@ interface AuthClient {
             push: {
                 devices: number;
             } | null;
+            email: {
+                to: string;
+            } | null;
+        }>>;
+        /** Mails the sign-in's code again, when its second step is by email; `mfa` takes it. A few per sign-in. */
+        mfaSendEmail(): Promise<AuthResult<'sent', {
+            sentTo: string;
         }>>;
         /**
          * Sends a push to the account's phones (the application's app, with
@@ -597,12 +653,17 @@ interface AuthClient {
         }): string;
     };
     signUp: {
-        /** `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in. */
+        /**
+         * `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in.
+         * `acceptLegal` and `consents` answer what `methods().legal` asks; a sign-up that leaves them out is refused.
+         */
         email(form: {
             email: string;
             password: string;
             name?: string;
             organization?: string;
+            acceptLegal?: boolean;
+            consents?: Record<string, boolean>;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -655,4 +716,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -400,6 +400,7 @@ function createAuthClient(options = {}) {
       mfa: (f) => post("/sign-in/mfa", { code: f.code }, checkCode(f.code)),
       mfaMethods: () => post("/sign-in/mfa/methods", {}, null),
       mfaSendCode: () => post("/sign-in/mfa/send", {}, null),
+      mfaSendEmail: () => post("/sign-in/mfa/email", {}, null),
       mfaPush: () => post("/sign-in/mfa/push", {}, null),
       async mfaPushWait(o = {}) {
         const status = await new Promise((resolve) => {
@@ -518,7 +519,7 @@ function createAuthClient(options = {}) {
     signUp: {
       email: (f) => post(
         "/sign-up/email",
-        { email: f.email, password: f.password, name: f.name, organization: f.organization },
+        { email: f.email, password: f.password, name: f.name, organization: f.organization, acceptLegal: f.acceptLegal, consents: f.consents },
         firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password), checkOrganization(f.organization)),
         f.captchaToken
       )
@@ -551,6 +552,12 @@ function createAuthClient(options = {}) {
         return body && typeof body.account === "object" ? body.account : null;
       },
       update: (f) => post("/me", { name: f.name }, checkName(f.name)),
+      async legal() {
+        const body = await read("/me/legal");
+        if (!body) return { ok: false, error: { code: "not_signed_in", message: "Nobody is signed in." } };
+        return { ok: true, status: "ok", pending: Array.isArray(body.pending) ? body.pending : [] };
+      },
+      acceptLegal: (f = {}) => post("/me/legal/accept", { kinds: f.kinds ?? [] }, null),
       changePassword: (f) => {
         const bad = checkNewPassword(f.newPassword);
         return post("/me/password", { password: f.password, newPassword: f.newPassword }, bad ? { ...bad, field: "newPassword" } : null);