cauthy-auth 0.26.0 → 0.27.1

package/dist/cli.js

@@ -928,7 +928,9 @@ function createSystem(given = {}) {
   async function fail2(res, what) {
     const body = await res.json().catch(() => null);
     const first = body?.errors?.[0];
-    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+    const code = typeof body?.error === "string" ? body.error : first?.code;
+    const message = typeof body?.error === "string" ? body.error_description : first?.message;
+    throw new CauthyApiError(res.status, code ?? "error", `Cauthy refused ${what} (${res.status}): ${message ?? res.statusText}`);
   }
   let held;
   let asking;

package/dist/client.d.mts

@@ -1,7 +1,7 @@
 import { CauthyTheme } from './theme.mjs';
 import { i as PublicSession } from './system-BxMsSIu1.mjs';
-import { A as AuthField } from './validate-BTRit1O1.mjs';
-export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.mjs';
+import { A as AuthField } from './validate-YbEfIzfl.mjs';
+export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-YbEfIzfl.mjs';
 import 'jose';
 
 /** Whether this browser can use a passkey at all. */
@@ -110,6 +110,30 @@ interface AuthMethods {
      * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
      */
     sso: boolean;
+    /**
+     * Set when the workspace asks something of a sign-up: the legal documents
+     * to accept (the terms, the privacy policy: show the links and a box, send
+     * `acceptLegal: true`) and the consents to ask (one box each, sent as
+     * `consents`; a required one must be ticked). The ready-made form shows them.
+     */
+    legal?: {
+        documents: {
+            kind: string;
+            version: string;
+            url: string;
+        }[];
+        consentPurposes: {
+            key: string;
+            label: string;
+            required: boolean;
+        }[];
+    };
+}
+/** A legal document the person owes: not yet accepted in its current version. */
+interface PendingLegal {
+    kind: string;
+    version: string;
+    url: string;
 }
 /** A company's sign-in (an SSO connection of the workspace). */
 interface SSOConnection {
@@ -290,6 +314,18 @@ interface AccountClient {
     }): Promise<AuthResult<'changed', {
         signedIn: boolean;
     }>>;
+    /**
+     * The legal documents the person has not accepted in their current version
+     * (a new version of the terms, say): show them and call `acceptLegal`.
+     * Nothing stops the person meanwhile; the application decides what waits.
+     */
+    legal(): Promise<AuthResult<'ok', {
+        pending: PendingLegal[];
+    }>>;
+    /** Records the person's acceptance of the documents in force (the kinds named, or every one). */
+    acceptLegal(form?: {
+        kinds?: string[];
+    }): Promise<AuthResult<'accepted'>>;
     mfa: {
         /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
         setup(form: {
@@ -617,12 +653,17 @@ interface AuthClient {
         }): string;
     };
     signUp: {
-        /** `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in. */
+        /**
+         * `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in.
+         * `acceptLegal` and `consents` answer what `methods().legal` asks; a sign-up that leaves them out is refused.
+         */
         email(form: {
             email: string;
             password: string;
             name?: string;
             organization?: string;
+            acceptLegal?: boolean;
+            consents?: Record<string, boolean>;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -675,4 +716,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -1,7 +1,7 @@
 import { CauthyTheme } from './theme.js';
 import { i as PublicSession } from './system-DTIeDXDP.js';
-import { A as AuthField } from './validate-BTRit1O1.js';
-export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.js';
+import { A as AuthField } from './validate-YbEfIzfl.js';
+export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-YbEfIzfl.js';
 import 'jose';
 
 /** Whether this browser can use a passkey at all. */
@@ -110,6 +110,30 @@ interface AuthMethods {
      * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
      */
     sso: boolean;
+    /**
+     * Set when the workspace asks something of a sign-up: the legal documents
+     * to accept (the terms, the privacy policy: show the links and a box, send
+     * `acceptLegal: true`) and the consents to ask (one box each, sent as
+     * `consents`; a required one must be ticked). The ready-made form shows them.
+     */
+    legal?: {
+        documents: {
+            kind: string;
+            version: string;
+            url: string;
+        }[];
+        consentPurposes: {
+            key: string;
+            label: string;
+            required: boolean;
+        }[];
+    };
+}
+/** A legal document the person owes: not yet accepted in its current version. */
+interface PendingLegal {
+    kind: string;
+    version: string;
+    url: string;
 }
 /** A company's sign-in (an SSO connection of the workspace). */
 interface SSOConnection {
@@ -290,6 +314,18 @@ interface AccountClient {
     }): Promise<AuthResult<'changed', {
         signedIn: boolean;
     }>>;
+    /**
+     * The legal documents the person has not accepted in their current version
+     * (a new version of the terms, say): show them and call `acceptLegal`.
+     * Nothing stops the person meanwhile; the application decides what waits.
+     */
+    legal(): Promise<AuthResult<'ok', {
+        pending: PendingLegal[];
+    }>>;
+    /** Records the person's acceptance of the documents in force (the kinds named, or every one). */
+    acceptLegal(form?: {
+        kinds?: string[];
+    }): Promise<AuthResult<'accepted'>>;
     mfa: {
         /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
         setup(form: {
@@ -617,12 +653,17 @@ interface AuthClient {
         }): string;
     };
     signUp: {
-        /** `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in. */
+        /**
+         * `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in.
+         * `acceptLegal` and `consents` answer what `methods().legal` asks; a sign-up that leaves them out is refused.
+         */
         email(form: {
             email: string;
             password: string;
             name?: string;
             organization?: string;
+            acceptLegal?: boolean;
+            consents?: Record<string, boolean>;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -675,4 +716,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -151,8 +151,8 @@ function fromWire(wire) {
 }
 
 // src/validate.ts
-var MIN_PASSWORD = 8;
-var MAX_PASSWORD = 256;
+var MIN_PASSWORD = 12;
+var MAX_PASSWORD = 128;
 var MAX_NAME = 120;
 var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function checkEmail(value) {
@@ -519,7 +519,7 @@ function createAuthClient(options = {}) {
     signUp: {
       email: (f) => post(
         "/sign-up/email",
-        { email: f.email, password: f.password, name: f.name, organization: f.organization },
+        { email: f.email, password: f.password, name: f.name, organization: f.organization, acceptLegal: f.acceptLegal, consents: f.consents },
         firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password), checkOrganization(f.organization)),
         f.captchaToken
       )
@@ -552,6 +552,12 @@ function createAuthClient(options = {}) {
         return body && typeof body.account === "object" ? body.account : null;
       },
       update: (f) => post("/me", { name: f.name }, checkName(f.name)),
+      async legal() {
+        const body = await read("/me/legal");
+        if (!body) return { ok: false, error: { code: "not_signed_in", message: "Nobody is signed in." } };
+        return { ok: true, status: "ok", pending: Array.isArray(body.pending) ? body.pending : [] };
+      },
+      acceptLegal: (f = {}) => post("/me/legal/accept", { kinds: f.kinds ?? [] }, null),
       changePassword: (f) => {
         const bad = checkNewPassword(f.newPassword);
         return post("/me/password", { password: f.password, newPassword: f.newPassword }, bad ? { ...bad, field: "newPassword" } : null);