cauthy-auth 0.25.0 → 0.27.0

package/dist/react.d.mts

@@ -277,6 +277,30 @@ interface AuthMethods {
      * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
      */
     sso: boolean;
+    /**
+     * Set when the workspace asks something of a sign-up: the legal documents
+     * to accept (the terms, the privacy policy: show the links and a box, send
+     * `acceptLegal: true`) and the consents to ask (one box each, sent as
+     * `consents`; a required one must be ticked). The ready-made form shows them.
+     */
+    legal?: {
+        documents: {
+            kind: string;
+            version: string;
+            url: string;
+        }[];
+        consentPurposes: {
+            key: string;
+            label: string;
+            required: boolean;
+        }[];
+    };
+}
+/** A legal document the person owes: not yet accepted in its current version. */
+interface PendingLegal {
+    kind: string;
+    version: string;
+    url: string;
 }
 /** A company's sign-in (an SSO connection of the workspace). */
 interface SSOConnection {
@@ -457,6 +481,18 @@ interface AccountClient {
     }): Promise<AuthResult<'changed', {
         signedIn: boolean;
     }>>;
+    /**
+     * The legal documents the person has not accepted in their current version
+     * (a new version of the terms, say): show them and call `acceptLegal`.
+     * Nothing stops the person meanwhile; the application decides what waits.
+     */
+    legal(): Promise<AuthResult<'ok', {
+        pending: PendingLegal[];
+    }>>;
+    /** Records the person's acceptance of the documents in force (the kinds named, or every one). */
+    acceptLegal(form?: {
+        kinds?: string[];
+    }): Promise<AuthResult<'accepted'>>;
     mfa: {
         /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
         setup(form: {
@@ -597,21 +633,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
+        /**
+         * With address and password. `mfa_required`: ask for the code and call
+         * `signIn.mfa`. `method: 'email'` says the code was just mailed to the
+         * account's address (it has no factor of its own and the workspace, or
+         * the sign-in's risk, asked a second step): say so, and offer
+         * `mfaSendEmail` for another.
+         */
         email(form: {
             email: string;
             password: string;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
-        }> | AuthResult<'mfa_required'>>;
-        /** The second step: the code of the authenticator app, or a recovery code. */
+        }> | AuthResult<'mfa_required', {
+            method?: 'email';
+        }>>;
+        /** The second step: the code of the authenticator app, the phone, the email, or a recovery code. */
         mfa(form: {
             code: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** While the second step is asked for: whether the account has an authenticator app, the phone (masked) a code can be sent to, and phones that approve sign-ins. */
+        /**
+         * While the second step is asked for: whether the account has an
+         * authenticator app, the phone (masked) a code can be sent to, phones
+         * that approve sign-ins, and the address (masked) a code went to when
+         * the step is by email.
+         */
         mfaMethods(): Promise<AuthResult<'ok', {
             totp: boolean;
             phone: {
@@ -621,6 +670,13 @@ interface AuthClient {
             push: {
                 devices: number;
             } | null;
+            email: {
+                to: string;
+            } | null;
+        }>>;
+        /** Mails the sign-in's code again, when its second step is by email; `mfa` takes it. A few per sign-in. */
+        mfaSendEmail(): Promise<AuthResult<'sent', {
+            sentTo: string;
         }>>;
         /**
          * Sends a push to the account's phones (the application's app, with
@@ -764,12 +820,17 @@ interface AuthClient {
         }): string;
     };
     signUp: {
-        /** `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in. */
+        /**
+         * `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in.
+         * `acceptLegal` and `consents` answer what `methods().legal` asks; a sign-up that leaves them out is refused.
+         */
         email(form: {
             email: string;
             password: string;
             name?: string;
             organization?: string;
+            acceptLegal?: boolean;
+            consents?: Record<string, boolean>;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -837,12 +898,20 @@ interface AuthTexts {
     createAccount: string;
     /** The label of the company's name, asked when the application's system makes an organization per sign-up. */
     company: string;
+    /** The legal box: "I have read and accept" + "the Terms of Service" + "and" + "the Privacy Policy", linked. */
+    iAccept: string;
+    and: string;
+    termsOfService: string;
+    privacyPolicy: string;
     haveAccount: string;
     sendLink: string;
     linkSent: string;
     codeHelp: string;
     /** The second step when it is a phone only. */
     codeHelpPhone: string;
+    /** The second step by email (the account has no factor): "{to}" is the address, masked. */
+    codeHelpEmail: string;
+    sendEmailAgain: string;
     /** "{to}" is the phone, masked. */
     sendCodeSms: string;
     sendCodeWhatsapp: string;
@@ -937,7 +1006,7 @@ interface AuthTexts {
     /** By error code; one missing shows what the server said. */
     errors: Record<string, string>;
 }
-type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'notice' | 'separator' | 'footer' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
+type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'notice' | 'separator' | 'footer' | 'check' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
 interface AuthFormProps {
     /** The language of the built-in sentences. Default: `en`. */
     locale?: 'en' | 'es';

package/dist/react.d.ts

@@ -277,6 +277,30 @@ interface AuthMethods {
      * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
      */
     sso: boolean;
+    /**
+     * Set when the workspace asks something of a sign-up: the legal documents
+     * to accept (the terms, the privacy policy: show the links and a box, send
+     * `acceptLegal: true`) and the consents to ask (one box each, sent as
+     * `consents`; a required one must be ticked). The ready-made form shows them.
+     */
+    legal?: {
+        documents: {
+            kind: string;
+            version: string;
+            url: string;
+        }[];
+        consentPurposes: {
+            key: string;
+            label: string;
+            required: boolean;
+        }[];
+    };
+}
+/** A legal document the person owes: not yet accepted in its current version. */
+interface PendingLegal {
+    kind: string;
+    version: string;
+    url: string;
 }
 /** A company's sign-in (an SSO connection of the workspace). */
 interface SSOConnection {
@@ -457,6 +481,18 @@ interface AccountClient {
     }): Promise<AuthResult<'changed', {
         signedIn: boolean;
     }>>;
+    /**
+     * The legal documents the person has not accepted in their current version
+     * (a new version of the terms, say): show them and call `acceptLegal`.
+     * Nothing stops the person meanwhile; the application decides what waits.
+     */
+    legal(): Promise<AuthResult<'ok', {
+        pending: PendingLegal[];
+    }>>;
+    /** Records the person's acceptance of the documents in force (the kinds named, or every one). */
+    acceptLegal(form?: {
+        kinds?: string[];
+    }): Promise<AuthResult<'accepted'>>;
     mfa: {
         /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
         setup(form: {
@@ -597,21 +633,34 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** With address and password. `mfa_required`: ask for the code and call `signIn.mfa`. */
+        /**
+         * With address and password. `mfa_required`: ask for the code and call
+         * `signIn.mfa`. `method: 'email'` says the code was just mailed to the
+         * account's address (it has no factor of its own and the workspace, or
+         * the sign-in's risk, asked a second step): say so, and offer
+         * `mfaSendEmail` for another.
+         */
         email(form: {
             email: string;
             password: string;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
-        }> | AuthResult<'mfa_required'>>;
-        /** The second step: the code of the authenticator app, or a recovery code. */
+        }> | AuthResult<'mfa_required', {
+            method?: 'email';
+        }>>;
+        /** The second step: the code of the authenticator app, the phone, the email, or a recovery code. */
         mfa(form: {
             code: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** While the second step is asked for: whether the account has an authenticator app, the phone (masked) a code can be sent to, and phones that approve sign-ins. */
+        /**
+         * While the second step is asked for: whether the account has an
+         * authenticator app, the phone (masked) a code can be sent to, phones
+         * that approve sign-ins, and the address (masked) a code went to when
+         * the step is by email.
+         */
         mfaMethods(): Promise<AuthResult<'ok', {
             totp: boolean;
             phone: {
@@ -621,6 +670,13 @@ interface AuthClient {
             push: {
                 devices: number;
             } | null;
+            email: {
+                to: string;
+            } | null;
+        }>>;
+        /** Mails the sign-in's code again, when its second step is by email; `mfa` takes it. A few per sign-in. */
+        mfaSendEmail(): Promise<AuthResult<'sent', {
+            sentTo: string;
         }>>;
         /**
          * Sends a push to the account's phones (the application's app, with
@@ -764,12 +820,17 @@ interface AuthClient {
         }): string;
     };
     signUp: {
-        /** `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in. */
+        /**
+         * `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in.
+         * `acceptLegal` and `consents` answer what `methods().legal` asks; a sign-up that leaves them out is refused.
+         */
         email(form: {
             email: string;
             password: string;
             name?: string;
             organization?: string;
+            acceptLegal?: boolean;
+            consents?: Record<string, boolean>;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -837,12 +898,20 @@ interface AuthTexts {
     createAccount: string;
     /** The label of the company's name, asked when the application's system makes an organization per sign-up. */
     company: string;
+    /** The legal box: "I have read and accept" + "the Terms of Service" + "and" + "the Privacy Policy", linked. */
+    iAccept: string;
+    and: string;
+    termsOfService: string;
+    privacyPolicy: string;
     haveAccount: string;
     sendLink: string;
     linkSent: string;
     codeHelp: string;
     /** The second step when it is a phone only. */
     codeHelpPhone: string;
+    /** The second step by email (the account has no factor): "{to}" is the address, masked. */
+    codeHelpEmail: string;
+    sendEmailAgain: string;
     /** "{to}" is the phone, masked. */
     sendCodeSms: string;
     sendCodeWhatsapp: string;
@@ -937,7 +1006,7 @@ interface AuthTexts {
     /** By error code; one missing shows what the server said. */
     errors: Record<string, string>;
 }
-type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'notice' | 'separator' | 'footer' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
+type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'notice' | 'separator' | 'footer' | 'check' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
 interface AuthFormProps {
     /** The language of the built-in sentences. Default: `en`. */
     locale?: 'en' | 'es';

package/dist/react.js

@@ -324,6 +324,7 @@ function createAuthClient(options = {}) {
       mfa: (f) => post("/sign-in/mfa", { code: f.code }, checkCode(f.code)),
       mfaMethods: () => post("/sign-in/mfa/methods", {}, null),
       mfaSendCode: () => post("/sign-in/mfa/send", {}, null),
+      mfaSendEmail: () => post("/sign-in/mfa/email", {}, null),
       mfaPush: () => post("/sign-in/mfa/push", {}, null),
       async mfaPushWait(o = {}) {
         const status = await new Promise((resolve) => {
@@ -442,7 +443,7 @@ function createAuthClient(options = {}) {
     signUp: {
       email: (f) => post(
         "/sign-up/email",
-        { email: f.email, password: f.password, name: f.name, organization: f.organization },
+        { email: f.email, password: f.password, name: f.name, organization: f.organization, acceptLegal: f.acceptLegal, consents: f.consents },
         firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password), checkOrganization(f.organization)),
         f.captchaToken
       )
@@ -475,6 +476,12 @@ function createAuthClient(options = {}) {
         return body && typeof body.account === "object" ? body.account : null;
       },
       update: (f) => post("/me", { name: f.name }, checkName(f.name)),
+      async legal() {
+        const body = await read("/me/legal");
+        if (!body) return { ok: false, error: { code: "not_signed_in", message: "Nobody is signed in." } };
+        return { ok: true, status: "ok", pending: Array.isArray(body.pending) ? body.pending : [] };
+      },
+      acceptLegal: (f = {}) => post("/me/legal/accept", { kinds: f.kinds ?? [] }, null),
       changePassword: (f) => {
         const bad = checkNewPassword(f.newPassword);
         return post("/me/password", { password: f.password, newPassword: f.newPassword }, bad ? { ...bad, field: "newPassword" } : null);
@@ -615,11 +622,17 @@ var TEXTS = {
     noAccount: "No account yet?",
     createAccount: "Create one",
     haveAccount: "Already have an account?",
+    iAccept: "I have read and accept",
+    and: "and",
+    termsOfService: "the Terms of Service",
+    privacyPolicy: "the Privacy Policy",
     sendLink: "Send the link",
     linkSent: "If that address has an account, a link to choose a new password is on its way.",
     codeHelp: "Enter the code from your authenticator app, or a recovery code.",
     verify: "Verify",
     codeHelpPhone: "We send a code to your phone. Ask for it, then type it here, or use a recovery code.",
+    codeHelpEmail: "We sent a code to {to}. Type it here.",
+    sendEmailAgain: "Send the code again",
     sendCodeSms: "Send a code by SMS to {to}",
     sendCodeWhatsapp: "Send a code by WhatsApp to {to}",
     codeSent: "We sent a code to {to}. Type it here.",
@@ -765,11 +778,17 @@ var TEXTS = {
     noAccount: "\xBFNo tienes cuenta?",
     createAccount: "Crear una",
     haveAccount: "\xBFYa tienes cuenta?",
+    iAccept: "He le\xEDdo y acepto",
+    and: "y",
+    termsOfService: "los T\xE9rminos del servicio",
+    privacyPolicy: "la Pol\xEDtica de privacidad",
     sendLink: "Enviar el enlace",
     linkSent: "Si ese correo tiene una cuenta, ya va en camino un enlace para elegir una contrase\xF1a nueva.",
     codeHelp: "Escribe el c\xF3digo de tu aplicaci\xF3n de autenticaci\xF3n, o un c\xF3digo de recuperaci\xF3n.",
     verify: "Verificar",
     codeHelpPhone: "Te enviamos un c\xF3digo a tu tel\xE9fono. P\xEDdelo y escr\xEDbelo aqu\xED, o usa un c\xF3digo de recuperaci\xF3n.",
+    codeHelpEmail: "Te enviamos un c\xF3digo a {to}. Escr\xEDbelo aqu\xED.",
+    sendEmailAgain: "Enviar el c\xF3digo de nuevo",
     sendCodeSms: "Enviar un c\xF3digo por SMS a {to}",
     sendCodeWhatsapp: "Enviar un c\xF3digo por WhatsApp a {to}",
     codeSent: "Te enviamos un c\xF3digo a {to}. Escr\xEDbelo aqu\xED.",
@@ -1088,9 +1107,17 @@ function SignIn(props) {
   (0, import_react.useEffect)(() => {
     if (step !== "code") return;
     void auth.signIn.mfaMethods().then((r) => {
-      if (r.ok) setPhoneWay({ totp: r.totp, phone: r.phone, push: r.push });
+      if (r.ok) setPhoneWay({ totp: r.totp, phone: r.phone, push: r.push, email: r.email });
     });
   }, [step]);
+  const sendEmail = async () => {
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.signIn.mfaSendEmail();
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    setPhoneSent(r.sentTo);
+  };
   const [pushNumber, setPushNumber] = (0, import_react.useState)(0);
   const pushWait = (0, import_react.useRef)(null);
   (0, import_react.useEffect)(() => () => pushWait.current?.abort(), []);
@@ -1219,8 +1246,9 @@ function SignIn(props) {
   if (step === "code") {
     const to = phoneWay?.phone?.number ?? "";
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.email ? f.t.codeHelpEmail.replace("{to}", phoneWay.email.to) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
       general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+      phoneWay?.email && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendEmail(), children: f.t.sendEmailAgain }),
       pushNumber > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: f.cx("notice"), role: "status", "aria-live": "polite", children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
         /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: { fontSize: 48, fontWeight: 700, margin: "4px 0", textAlign: "center" }, children: pushNumber }),
@@ -1301,11 +1329,21 @@ function SignUp(props) {
   const [sent, setSent] = (0, import_react.useState)(false);
   const methods = useMethods(auth);
   const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
+  const [acceptLegal, setAcceptLegal] = (0, import_react.useState)(false);
+  const [consents, setConsents] = (0, import_react.useState)({});
+  const legal = methods?.legal;
   const submit = async (e) => {
     e.preventDefault();
     f.setBusy(true);
     f.setError(null);
-    const r = auth.session?.user.isAnonymous === true ? await auth.account.upgrade({ name, email, password }) : await auth.signUp.email({ name, email, password, ...methods?.organization?.ask ? { organization } : {}, captchaToken: challenge.token });
+    const r = auth.session?.user.isAnonymous === true ? await auth.account.upgrade({ name, email, password }) : await auth.signUp.email({
+      name,
+      email,
+      password,
+      ...methods?.organization?.ask ? { organization } : {},
+      ...legal ? { acceptLegal, consents } : {},
+      captchaToken: challenge.token
+    });
     f.setBusy(false);
     challenge.renew();
     if (!r.ok) return f.setError(r.error);
@@ -1325,6 +1363,25 @@ function SignUp(props) {
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "name", onChange: setName }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.password, value: password, autoComplete: "new-password", required: true, onChange: setPassword }),
+    legal && legal.documents.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("check"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", name: "acceptLegal", checked: acceptLegal, required: true, onChange: (e) => setAcceptLegal(e.target.checked) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
+        f.t.iAccept,
+        " ",
+        legal.documents.map((d, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
+          i > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+            f.t.and,
+            " "
+          ] }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: d.url, target: "_blank", rel: "noopener", children: d.kind === "terms" ? f.t.termsOfService : f.t.privacyPolicy }),
+          " "
+        ] }, d.kind))
+      ] })
+    ] }),
+    legal?.consentPurposes.map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("check"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", name: `consent_${p.key}`, checked: consents[p.key] === true, required: p.required, onChange: (e) => setConsents({ ...consents, [p.key]: e.target.checked }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: p.label })
+    ] }, p.key)),
     challenge.node,
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signUp }),
     props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { className: f.cx("footer"), children: [