cauthy-auth 0.26.0 → 0.27.1

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-DGAy45G2.js';
 export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PermissionOf, e as Permitted, f as Policy, g as PolicyPermission, h as PolicyRole, i as PublicSession, j as PushPolicyOptions, R as RoleOf, S as Session, k as SessionOrganization, l as SessionStatus, m as SessionUser, n as SystemKey, o as SystemOptions, p as can, q as createSystem, r as definePolicy, s as policySource, t as pullPolicy, u as pushPolicy } from './system-DTIeDXDP.js';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.js';
-export { A as AuthField, F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.js';
+export { A as AuthField, F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-YbEfIzfl.js';
 import { JWTVerifyGetKey } from 'jose';
 
 interface ConnectOptions {
@@ -33,10 +33,16 @@ interface Connected {
     /** Shown this once: Cauthy keeps only its hash. */
     clientSecret: string;
     redirectUris: string[];
+    /**
+     * The subscription to events, when `eventsUrl` was given. Its `secret` signs
+     * the HMAC header (X-Cauthy-Signature) and is shown this once; `auth.webhook`
+     * does not need it, as it verifies by Cauthy's published keys.
+     */
     webhook: {
         id: string;
         url: string;
         events: string[];
+        secret: string;
     } | null;
     /**
      * Everything the application sets: what Cauthy answered, plus CAUTHY_SECRET,

package/dist/index.js

@@ -543,7 +543,9 @@ function createSystem(given = {}) {
   async function fail(res, what) {
     const body = await res.json().catch(() => null);
     const first = body?.errors?.[0];
-    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+    const code = typeof body?.error === "string" ? body.error : first?.code;
+    const message = typeof body?.error === "string" ? body.error_description : first?.message;
+    throw new CauthyApiError(res.status, code ?? "error", `Cauthy refused ${what} (${res.status}): ${message ?? res.statusText}`);
   }
   let held;
   let asking;
@@ -653,8 +655,8 @@ function createSystem(given = {}) {
 }
 
 // src/validate.ts
-var MIN_PASSWORD = 8;
-var MAX_PASSWORD = 256;
+var MIN_PASSWORD = 12;
+var MAX_PASSWORD = 128;
 var MAX_NAME = 120;
 var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function checkEmail(value) {
@@ -1249,6 +1251,8 @@ function createCauthy(given = {}) {
       "/sign-in/mfa/push/finish",
       "/me/sessions",
       "/me/sessions/end",
+      "/me/legal",
+      "/me/legal/accept",
       "/me/email",
       "/me/identities",
       "/me/identities/unlink",
@@ -1307,6 +1311,8 @@ function createCauthy(given = {}) {
         passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true,
         // A company's sign-in, found by the person's work address.
         sso: Array.isArray(sso.data) && sso.data.some((c) => c?.discoverable === true),
+        // The terms a sign-up accepts and the consents it answers, when the workspace asks any.
+        ...settings.data?.legal ? { legal: legalOf(settings.data.legal) } : {},
         ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}
       });
     }
@@ -1467,11 +1473,15 @@ function createCauthy(given = {}) {
       if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
       return json(factorsOf(res.data), 200, mine.headers);
     }
-    if ((route === "/me" || route === "/me/sessions") && !post) {
+    if ((route === "/me" || route === "/me/sessions" || route === "/me/legal") && !post) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
-      const res = await ask(request, "GET", route === "/me" ? "/v1/auth/me" : "/v1/auth/me/sessions", void 0, void 0, mine.token);
+      const res = await ask(request, "GET", route === "/me" ? "/v1/auth/me" : route === "/me/legal" ? "/v1/auth/me/legal" : "/v1/auth/me/sessions", void 0, void 0, mine.token);
       if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      if (route === "/me/legal") {
+        const list = Array.isArray(res.data?.pending) ? res.data.pending : [];
+        return json({ pending: list.map((d) => ({ kind: String(d.kind ?? ""), version: String(d.version ?? ""), url: String(d.url ?? "") })) }, 200, mine.headers);
+      }
       if (route === "/me/sessions") {
         const list = Array.isArray(res.data) ? res.data : [];
         return json({ sessions: list.map((x) => ({ device: String(x.device ?? ""), ip: String(x.ip ?? ""), createdAt: String(x.created_at ?? ""), expiresAt: String(x.expires_at ?? "") })) }, 200, mine.headers);
@@ -1597,7 +1607,8 @@ function createCauthy(given = {}) {
       if (bad) return invalid(bad);
       const email = String(b.email).trim();
       const organization = typeof b.organization === "string" && b.organization.trim() !== "" ? { organization: { name: b.organization.trim() } } : {};
-      const made = await ask(request, "POST", "/v1/auth/register", { email, password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "", ...organization }, pages.verifyEmail);
+      const legal = { ...b.acceptLegal === true ? { accept_legal: true } : {}, ...b.consents && typeof b.consents === "object" ? { consents: b.consents } : {} };
+      const made = await ask(request, "POST", "/v1/auth/register", { email, password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "", ...organization, ...legal }, pages.verifyEmail);
       if (made.error) return problem(made.status, made.error.code, made.error.message);
       if (made.data?.verification_required === true) return json({ status: "verification_required", email });
       const res = await ask(request, "POST", "/v1/auth/login", { email, password: b.password });
@@ -1628,6 +1639,12 @@ function createCauthy(given = {}) {
         }
         return json({ status: "saved", account: accountOf(res.data) }, 200, h);
       }
+      if (route === "/me/legal/accept") {
+        const kinds = Array.isArray(b.kinds) ? b.kinds.filter((k) => typeof k === "string") : [];
+        const res = await as("/v1/auth/me/legal/accept", { kinds });
+        if (res.error) return refused(res);
+        return json({ status: "accepted" }, 200, mine.headers);
+      }
       if (route === "/me/password") {
         const bad = checkNewPassword(b.newPassword);
         if (bad) return problem(400, bad.code, bad.message, "newPassword");
@@ -1927,6 +1944,14 @@ function createCauthy(given = {}) {
     options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName }
   };
 }
+function legalOf(raw) {
+  const documents = Array.isArray(raw?.documents) ? raw.documents : [];
+  const purposes = Array.isArray(raw?.consent_purposes) ? raw.consent_purposes : [];
+  return {
+    documents: documents.map((d) => ({ kind: String(d.kind ?? ""), version: String(d.version ?? ""), url: String(d.url ?? "") })),
+    consentPurposes: purposes.map((p) => ({ key: String(p.key ?? ""), label: String(p.label ?? ""), required: p.required === true }))
+  };
+}
 
 // src/permissions.ts
 function matches(entry, resource, action) {