cauthy-auth 0.27.0 → 0.27.1

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-DGAy45G2.js';
 export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PermissionOf, e as Permitted, f as Policy, g as PolicyPermission, h as PolicyRole, i as PublicSession, j as PushPolicyOptions, R as RoleOf, S as Session, k as SessionOrganization, l as SessionStatus, m as SessionUser, n as SystemKey, o as SystemOptions, p as can, q as createSystem, r as definePolicy, s as policySource, t as pullPolicy, u as pushPolicy } from './system-DTIeDXDP.js';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.js';
-export { A as AuthField, F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.js';
+export { A as AuthField, F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-YbEfIzfl.js';
 import { JWTVerifyGetKey } from 'jose';
 
 interface ConnectOptions {
@@ -33,10 +33,16 @@ interface Connected {
     /** Shown this once: Cauthy keeps only its hash. */
     clientSecret: string;
     redirectUris: string[];
+    /**
+     * The subscription to events, when `eventsUrl` was given. Its `secret` signs
+     * the HMAC header (X-Cauthy-Signature) and is shown this once; `auth.webhook`
+     * does not need it, as it verifies by Cauthy's published keys.
+     */
     webhook: {
         id: string;
         url: string;
         events: string[];
+        secret: string;
     } | null;
     /**
      * Everything the application sets: what Cauthy answered, plus CAUTHY_SECRET,

package/dist/index.js

@@ -543,7 +543,9 @@ function createSystem(given = {}) {
   async function fail(res, what) {
     const body = await res.json().catch(() => null);
     const first = body?.errors?.[0];
-    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+    const code = typeof body?.error === "string" ? body.error : first?.code;
+    const message = typeof body?.error === "string" ? body.error_description : first?.message;
+    throw new CauthyApiError(res.status, code ?? "error", `Cauthy refused ${what} (${res.status}): ${message ?? res.statusText}`);
   }
   let held;
   let asking;
@@ -653,8 +655,8 @@ function createSystem(given = {}) {
 }
 
 // src/validate.ts
-var MIN_PASSWORD = 8;
-var MAX_PASSWORD = 256;
+var MIN_PASSWORD = 12;
+var MAX_PASSWORD = 128;
 var MAX_NAME = 120;
 var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function checkEmail(value) {