cauthy-auth 0.26.0 → 0.27.1

package/dist/react.d.mts

@@ -277,6 +277,30 @@ interface AuthMethods {
      * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
      */
     sso: boolean;
+    /**
+     * Set when the workspace asks something of a sign-up: the legal documents
+     * to accept (the terms, the privacy policy: show the links and a box, send
+     * `acceptLegal: true`) and the consents to ask (one box each, sent as
+     * `consents`; a required one must be ticked). The ready-made form shows them.
+     */
+    legal?: {
+        documents: {
+            kind: string;
+            version: string;
+            url: string;
+        }[];
+        consentPurposes: {
+            key: string;
+            label: string;
+            required: boolean;
+        }[];
+    };
+}
+/** A legal document the person owes: not yet accepted in its current version. */
+interface PendingLegal {
+    kind: string;
+    version: string;
+    url: string;
 }
 /** A company's sign-in (an SSO connection of the workspace). */
 interface SSOConnection {
@@ -457,6 +481,18 @@ interface AccountClient {
     }): Promise<AuthResult<'changed', {
         signedIn: boolean;
     }>>;
+    /**
+     * The legal documents the person has not accepted in their current version
+     * (a new version of the terms, say): show them and call `acceptLegal`.
+     * Nothing stops the person meanwhile; the application decides what waits.
+     */
+    legal(): Promise<AuthResult<'ok', {
+        pending: PendingLegal[];
+    }>>;
+    /** Records the person's acceptance of the documents in force (the kinds named, or every one). */
+    acceptLegal(form?: {
+        kinds?: string[];
+    }): Promise<AuthResult<'accepted'>>;
     mfa: {
         /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
         setup(form: {
@@ -784,12 +820,17 @@ interface AuthClient {
         }): string;
     };
     signUp: {
-        /** `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in. */
+        /**
+         * `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in.
+         * `acceptLegal` and `consents` answer what `methods().legal` asks; a sign-up that leaves them out is refused.
+         */
         email(form: {
             email: string;
             password: string;
             name?: string;
             organization?: string;
+            acceptLegal?: boolean;
+            consents?: Record<string, boolean>;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -857,6 +898,11 @@ interface AuthTexts {
     createAccount: string;
     /** The label of the company's name, asked when the application's system makes an organization per sign-up. */
     company: string;
+    /** The legal box: "I have read and accept" + "the Terms of Service" + "and" + "the Privacy Policy", linked. */
+    iAccept: string;
+    and: string;
+    termsOfService: string;
+    privacyPolicy: string;
     haveAccount: string;
     sendLink: string;
     linkSent: string;
@@ -960,7 +1006,7 @@ interface AuthTexts {
     /** By error code; one missing shows what the server said. */
     errors: Record<string, string>;
 }
-type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'notice' | 'separator' | 'footer' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
+type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'notice' | 'separator' | 'footer' | 'check' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
 interface AuthFormProps {
     /** The language of the built-in sentences. Default: `en`. */
     locale?: 'en' | 'es';

package/dist/react.d.ts

@@ -277,6 +277,30 @@ interface AuthMethods {
      * found by their work address (`signIn.ssoDiscover`, `signIn.sso`).
      */
     sso: boolean;
+    /**
+     * Set when the workspace asks something of a sign-up: the legal documents
+     * to accept (the terms, the privacy policy: show the links and a box, send
+     * `acceptLegal: true`) and the consents to ask (one box each, sent as
+     * `consents`; a required one must be ticked). The ready-made form shows them.
+     */
+    legal?: {
+        documents: {
+            kind: string;
+            version: string;
+            url: string;
+        }[];
+        consentPurposes: {
+            key: string;
+            label: string;
+            required: boolean;
+        }[];
+    };
+}
+/** A legal document the person owes: not yet accepted in its current version. */
+interface PendingLegal {
+    kind: string;
+    version: string;
+    url: string;
 }
 /** A company's sign-in (an SSO connection of the workspace). */
 interface SSOConnection {
@@ -457,6 +481,18 @@ interface AccountClient {
     }): Promise<AuthResult<'changed', {
         signedIn: boolean;
     }>>;
+    /**
+     * The legal documents the person has not accepted in their current version
+     * (a new version of the terms, say): show them and call `acceptLegal`.
+     * Nothing stops the person meanwhile; the application decides what waits.
+     */
+    legal(): Promise<AuthResult<'ok', {
+        pending: PendingLegal[];
+    }>>;
+    /** Records the person's acceptance of the documents in force (the kinds named, or every one). */
+    acceptLegal(form?: {
+        kinds?: string[];
+    }): Promise<AuthResult<'accepted'>>;
     mfa: {
         /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
         setup(form: {
@@ -784,12 +820,17 @@ interface AuthClient {
         }): string;
     };
     signUp: {
-        /** `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in. */
+        /**
+         * `verification_required`: the account exists and must open the link Cauthy mailed before it can sign in.
+         * `acceptLegal` and `consents` answer what `methods().legal` asks; a sign-up that leaves them out is refused.
+         */
         email(form: {
             email: string;
             password: string;
             name?: string;
             organization?: string;
+            acceptLegal?: boolean;
+            consents?: Record<string, boolean>;
             captchaToken?: string;
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
@@ -857,6 +898,11 @@ interface AuthTexts {
     createAccount: string;
     /** The label of the company's name, asked when the application's system makes an organization per sign-up. */
     company: string;
+    /** The legal box: "I have read and accept" + "the Terms of Service" + "and" + "the Privacy Policy", linked. */
+    iAccept: string;
+    and: string;
+    termsOfService: string;
+    privacyPolicy: string;
     haveAccount: string;
     sendLink: string;
     linkSent: string;
@@ -960,7 +1006,7 @@ interface AuthTexts {
     /** By error code; one missing shows what the server said. */
     errors: Record<string, string>;
 }
-type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'notice' | 'separator' | 'footer' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
+type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'notice' | 'separator' | 'footer' | 'check' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
 interface AuthFormProps {
     /** The language of the built-in sentences. Default: `en`. */
     locale?: 'en' | 'es';

package/dist/react.js

@@ -183,8 +183,8 @@ function fromWire(wire) {
 }
 
 // src/validate.ts
-var MIN_PASSWORD = 8;
-var MAX_PASSWORD = 256;
+var MIN_PASSWORD = 12;
+var MAX_PASSWORD = 128;
 var MAX_NAME = 120;
 var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function checkEmail(value) {
@@ -443,7 +443,7 @@ function createAuthClient(options = {}) {
     signUp: {
       email: (f) => post(
         "/sign-up/email",
-        { email: f.email, password: f.password, name: f.name, organization: f.organization },
+        { email: f.email, password: f.password, name: f.name, organization: f.organization, acceptLegal: f.acceptLegal, consents: f.consents },
         firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password), checkOrganization(f.organization)),
         f.captchaToken
       )
@@ -476,6 +476,12 @@ function createAuthClient(options = {}) {
         return body && typeof body.account === "object" ? body.account : null;
       },
       update: (f) => post("/me", { name: f.name }, checkName(f.name)),
+      async legal() {
+        const body = await read("/me/legal");
+        if (!body) return { ok: false, error: { code: "not_signed_in", message: "Nobody is signed in." } };
+        return { ok: true, status: "ok", pending: Array.isArray(body.pending) ? body.pending : [] };
+      },
+      acceptLegal: (f = {}) => post("/me/legal/accept", { kinds: f.kinds ?? [] }, null),
       changePassword: (f) => {
         const bad = checkNewPassword(f.newPassword);
         return post("/me/password", { password: f.password, newPassword: f.newPassword }, bad ? { ...bad, field: "newPassword" } : null);
@@ -616,6 +622,10 @@ var TEXTS = {
     noAccount: "No account yet?",
     createAccount: "Create one",
     haveAccount: "Already have an account?",
+    iAccept: "I have read and accept",
+    and: "and",
+    termsOfService: "the Terms of Service",
+    privacyPolicy: "the Privacy Policy",
     sendLink: "Send the link",
     linkSent: "If that address has an account, a link to choose a new password is on its way.",
     codeHelp: "Enter the code from your authenticator app, or a recovery code.",
@@ -718,7 +728,7 @@ var TEXTS = {
       user_not_active: "That account is disabled.",
       required: "This is required.",
       invalid_email: "That does not look like an email address.",
-      too_short: "Use at least 8 characters.",
+      too_short: `Use at least ${MIN_PASSWORD} characters.`,
       invalid_credentials: "The address or the password is not right.",
       unavailable: "Sign-in is unavailable right now. Try again in a moment.",
       state_mismatch: "That sign-in could not be completed. Try again.",
@@ -768,6 +778,10 @@ var TEXTS = {
     noAccount: "\xBFNo tienes cuenta?",
     createAccount: "Crear una",
     haveAccount: "\xBFYa tienes cuenta?",
+    iAccept: "He le\xEDdo y acepto",
+    and: "y",
+    termsOfService: "los T\xE9rminos del servicio",
+    privacyPolicy: "la Pol\xEDtica de privacidad",
     sendLink: "Enviar el enlace",
     linkSent: "Si ese correo tiene una cuenta, ya va en camino un enlace para elegir una contrase\xF1a nueva.",
     codeHelp: "Escribe el c\xF3digo de tu aplicaci\xF3n de autenticaci\xF3n, o un c\xF3digo de recuperaci\xF3n.",
@@ -870,7 +884,7 @@ var TEXTS = {
       user_not_active: "Esa cuenta est\xE1 desactivada.",
       required: "Este dato es obligatorio.",
       invalid_email: "Eso no parece un correo.",
-      too_short: "Usa al menos 8 caracteres.",
+      too_short: `Usa al menos ${MIN_PASSWORD} caracteres.`,
       invalid_credentials: "El correo o la contrase\xF1a no son correctos.",
       unavailable: "No se puede entrar en este momento. Intenta de nuevo en un momento.",
       state_mismatch: "No se pudo completar el ingreso. Intenta de nuevo.",
@@ -1315,11 +1329,21 @@ function SignUp(props) {
   const [sent, setSent] = (0, import_react.useState)(false);
   const methods = useMethods(auth);
   const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
+  const [acceptLegal, setAcceptLegal] = (0, import_react.useState)(false);
+  const [consents, setConsents] = (0, import_react.useState)({});
+  const legal = methods?.legal;
   const submit = async (e) => {
     e.preventDefault();
     f.setBusy(true);
     f.setError(null);
-    const r = auth.session?.user.isAnonymous === true ? await auth.account.upgrade({ name, email, password }) : await auth.signUp.email({ name, email, password, ...methods?.organization?.ask ? { organization } : {}, captchaToken: challenge.token });
+    const r = auth.session?.user.isAnonymous === true ? await auth.account.upgrade({ name, email, password }) : await auth.signUp.email({
+      name,
+      email,
+      password,
+      ...methods?.organization?.ask ? { organization } : {},
+      ...legal ? { acceptLegal, consents } : {},
+      captchaToken: challenge.token
+    });
     f.setBusy(false);
     challenge.renew();
     if (!r.ok) return f.setError(r.error);
@@ -1339,6 +1363,25 @@ function SignUp(props) {
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "name", onChange: setName }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.password, value: password, autoComplete: "new-password", required: true, onChange: setPassword }),
+    legal && legal.documents.length > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("check"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", name: "acceptLegal", checked: acceptLegal, required: true, onChange: (e) => setAcceptLegal(e.target.checked) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
+        f.t.iAccept,
+        " ",
+        legal.documents.map((d, i) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
+          i > 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+            f.t.and,
+            " "
+          ] }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", { className: f.cx("link"), href: d.url, target: "_blank", rel: "noopener", children: d.kind === "terms" ? f.t.termsOfService : f.t.privacyPolicy }),
+          " "
+        ] }, d.kind))
+      ] })
+    ] }),
+    legal?.consentPurposes.map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: f.cx("check"), children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", name: `consent_${p.key}`, checked: consents[p.key] === true, required: p.required, onChange: (e) => setConsents({ ...consents, [p.key]: e.target.checked }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: p.label })
+    ] }, p.key)),
     challenge.node,
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signUp }),
     props.links?.signIn && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("p", { className: f.cx("footer"), children: [