cauthy-auth 0.27.0 → 0.28.0

package/dist/cli.js

@@ -928,7 +928,9 @@ function createSystem(given = {}) {
   async function fail2(res, what) {
     const body = await res.json().catch(() => null);
     const first = body?.errors?.[0];
-    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+    const code = typeof body?.error === "string" ? body.error : first?.code;
+    const message = typeof body?.error === "string" ? body.error_description : first?.message;
+    throw new CauthyApiError(res.status, code ?? "error", `Cauthy refused ${what} (${res.status}): ${message ?? res.statusText}`);
   }
   let held;
   let asking;

package/dist/client.d.mts

@@ -1,7 +1,7 @@
 import { CauthyTheme } from './theme.mjs';
 import { i as PublicSession } from './system-BxMsSIu1.mjs';
-import { A as AuthField } from './validate-BTRit1O1.mjs';
-export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.mjs';
+import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.mjs';
+export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.mjs';
 import 'jose';
 
 /** Whether this browser can use a passkey at all. */
@@ -61,6 +61,8 @@ interface AuthError {
     message: string;
     /** The input it is about, when it is about one. */
     field?: AuthField;
+    /** `weak_password`: the rules of the workspace's password policy it failed (`too_short`, `needs_digit`, …). */
+    reasons?: string[];
 }
 type AuthResult<S extends string, More = unknown> = ({
     ok: true;
@@ -128,6 +130,13 @@ interface AuthMethods {
             required: boolean;
         }[];
     };
+    /**
+     * What a new password must be in the workspace. Once `methods()` has
+     * answered, this client checks new passwords against it before sending
+     * them; until then, against the defaults (12 to 128 characters). Absent
+     * from a server that does not say.
+     */
+    password?: PasswordPolicy;
 }
 /** A legal document the person owes: not yet accepted in its current version. */
 interface PendingLegal {
@@ -716,4 +725,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -1,7 +1,7 @@
 import { CauthyTheme } from './theme.js';
 import { i as PublicSession } from './system-DTIeDXDP.js';
-import { A as AuthField } from './validate-BTRit1O1.js';
-export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.js';
+import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.js';
+export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.js';
 import 'jose';
 
 /** Whether this browser can use a passkey at all. */
@@ -61,6 +61,8 @@ interface AuthError {
     message: string;
     /** The input it is about, when it is about one. */
     field?: AuthField;
+    /** `weak_password`: the rules of the workspace's password policy it failed (`too_short`, `needs_digit`, …). */
+    reasons?: string[];
 }
 type AuthResult<S extends string, More = unknown> = ({
     ok: true;
@@ -128,6 +130,13 @@ interface AuthMethods {
             required: boolean;
         }[];
     };
+    /**
+     * What a new password must be in the workspace. Once `methods()` has
+     * answered, this client checks new passwords against it before sending
+     * them; until then, against the defaults (12 to 128 characters). Absent
+     * from a server that does not say.
+     */
+    password?: PasswordPolicy;
 }
 /** A legal document the person owes: not yet accepted in its current version. */
 interface PendingLegal {
@@ -716,4 +725,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/client.ts
 var client_exports = {};
 __export(client_exports, {
+  DEFAULT_PASSWORD_POLICY: () => DEFAULT_PASSWORD_POLICY,
   MIN_PASSWORD: () => MIN_PASSWORD,
   canAutofillPasskeys: () => canAutofillPasskeys,
   canUsePasskeys: () => canUsePasskeys,
@@ -29,7 +30,11 @@ __export(client_exports, {
   checkNewPassword: () => checkNewPassword,
   checkPassword: () => checkPassword,
   createAuthClient: () => createAuthClient,
-  createSessionStore: () => createSessionStore
+  createSessionStore: () => createSessionStore,
+  describePasswordPolicy: () => describePasswordPolicy,
+  explainPasswordProblems: () => explainPasswordProblems,
+  passwordPolicyOf: () => passwordPolicyOf,
+  passwordProblems: () => passwordProblems
 });
 module.exports = __toCommonJS(client_exports);
 
@@ -151,9 +156,113 @@ function fromWire(wire) {
 }
 
 // src/validate.ts
-var MIN_PASSWORD = 8;
-var MAX_PASSWORD = 256;
+var MIN_PASSWORD = 12;
+var MAX_PASSWORD = 128;
+var FLOOR_PASSWORD = 8;
 var MAX_NAME = 120;
+var CLASSES = ["lowercase", "uppercase", "digit", "symbol"];
+var DEFAULT_PASSWORD_POLICY = Object.freeze({ min: MIN_PASSWORD, max: MAX_PASSWORD, requires: [], min_classes: 0, reject_breached: false });
+var int = (v, fallback) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : fallback;
+function passwordPolicyOf(raw) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  const min = Math.min(Math.max(int(r.min ?? r.min_length, MIN_PASSWORD) || MIN_PASSWORD, FLOOR_PASSWORD), MAX_PASSWORD);
+  const max = Math.max(Math.min(int(r.max ?? r.max_length, MAX_PASSWORD) || MAX_PASSWORD, MAX_PASSWORD), min);
+  const asked = Array.isArray(r.requires) ? r.requires : [];
+  return {
+    min,
+    max,
+    requires: CLASSES.filter((c) => asked.includes(c)),
+    min_classes: Math.min(Math.max(int(r.min_classes ?? r.minClasses, 0), 0), CLASSES.length),
+    reject_breached: (r.reject_breached ?? r.rejectBreached) === true
+  };
+}
+function utf8Length(v) {
+  let n = 0;
+  for (const ch of v) {
+    const c = ch.codePointAt(0);
+    n += c < 128 ? 1 : c < 2048 ? 2 : c < 65536 ? 3 : 4;
+  }
+  return n;
+}
+function classesOf(v) {
+  const has = /* @__PURE__ */ new Set();
+  for (const ch of v) {
+    if (/\p{Ll}/u.test(ch)) has.add("lowercase");
+    else if (/\p{Lu}/u.test(ch)) has.add("uppercase");
+    else if (/\p{Nd}/u.test(ch)) has.add("digit");
+    else if (!/\p{L}/u.test(ch)) has.add("symbol");
+  }
+  return has;
+}
+function passwordProblems(value, policy = DEFAULT_PASSWORD_POLICY) {
+  const p = passwordPolicyOf(policy);
+  const out = [];
+  const length = utf8Length(value);
+  if (length < p.min) out.push("too_short");
+  if (length > p.max) out.push("too_long");
+  const has = classesOf(value);
+  for (const c of p.requires) if (!has.has(c)) out.push(`needs_${c}`);
+  if (p.min_classes > 0 && CLASSES.filter((c) => has.has(c)).length < p.min_classes) out.push("needs_classes");
+  return out;
+}
+var RULES = {
+  en: {
+    between: "Between {min} and {max} characters.",
+    requires: "Include {kinds}.",
+    and: "and",
+    classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+    breached: "Passwords found in known data breaches are not accepted.",
+    kinds: { lowercase: "a lowercase letter", uppercase: "an uppercase letter", digit: "a digit", symbol: "a symbol" },
+    reasons: {
+      too_short: "Use at least {min} characters.",
+      too_long: "Use at most {max} characters.",
+      needs_lowercase: "Include a lowercase letter.",
+      needs_uppercase: "Include an uppercase letter.",
+      needs_digit: "Include a digit.",
+      needs_symbol: "Include a symbol.",
+      needs_classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+      breached: "This password appears in a known data breach. Choose a different one."
+    }
+  },
+  es: {
+    between: "Entre {min} y {max} caracteres.",
+    requires: "Incluye {kinds}.",
+    and: "y",
+    classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+    breached: "No se aceptan contrase\xF1as que aparecen en filtraciones de datos conocidas.",
+    kinds: { lowercase: "una min\xFAscula", uppercase: "una may\xFAscula", digit: "un n\xFAmero", symbol: "un s\xEDmbolo" },
+    reasons: {
+      too_short: "Usa al menos {min} caracteres.",
+      too_long: "Usa como m\xE1ximo {max} caracteres.",
+      needs_lowercase: "Incluye una min\xFAscula.",
+      needs_uppercase: "Incluye una may\xFAscula.",
+      needs_digit: "Incluye un n\xFAmero.",
+      needs_symbol: "Incluye un s\xEDmbolo.",
+      needs_classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+      breached: "Esta contrase\xF1a aparece en una filtraci\xF3n de datos conocida. Elige otra."
+    }
+  }
+};
+var fill = (s, p) => s.replace("{min}", String(p.min)).replace("{max}", String(p.max)).replace("{n}", String(p.min_classes));
+function describePasswordPolicy(policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const parts = [fill(t.between, p)];
+  if (p.requires.length > 0) {
+    const kinds = p.requires.map((c) => t.kinds[c]);
+    const listed = kinds.length === 1 ? kinds[0] : `${kinds.slice(0, -1).join(", ")} ${t.and} ${kinds[kinds.length - 1]}`;
+    parts.push(t.requires.replace("{kinds}", listed));
+  }
+  if (p.min_classes > 0) parts.push(fill(t.classes, p));
+  if (p.reject_breached) parts.push(t.breached);
+  return parts.join(" ");
+}
+function explainPasswordProblems(reasons, policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const said = reasons.filter((r) => r in t.reasons).map((r) => fill(t.reasons[r], p));
+  return said.length > 0 ? said.join(" ") : describePasswordPolicy(p, locale);
+}
 var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function checkEmail(value) {
   const v = typeof value === "string" ? value.trim() : "";
@@ -166,13 +275,12 @@ function checkPassword(value) {
   if (value.length > MAX_PASSWORD) return { field: "password", code: "too_long", message: "That password is too long." };
   return null;
 }
-function checkNewPassword(value) {
-  const basic = checkPassword(value);
-  if (basic) return basic;
-  if (value.length < MIN_PASSWORD) {
-    return { field: "password", code: "too_short", message: `Use at least ${MIN_PASSWORD} characters.` };
-  }
-  return null;
+function checkNewPassword(value, policy) {
+  if (typeof value !== "string" || value === "") return { field: "password", code: "required", message: "Enter your password." };
+  const p = policy ? passwordPolicyOf(policy) : DEFAULT_PASSWORD_POLICY;
+  const reasons = passwordProblems(value, p);
+  if (reasons.length === 0) return null;
+  return { field: "password", code: reasons[0], message: explainPasswordProblems(reasons, p) };
 }
 function checkName(value) {
   if (value === void 0 || value === null || value === "") return null;
@@ -343,7 +451,7 @@ function createAuthClient(options = {}) {
       const body = await res.json().catch(() => null);
       if (res.ok && body && typeof body.status === "string") return { ok: true, ...body };
       const e = body?.error;
-      return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? ""), ...e.field ? { field: e.field } : {} } : UNAVAILABLE };
+      return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? ""), ...e.field ? { field: e.field } : {}, ...Array.isArray(e.reasons) ? { reasons: e.reasons.map(String) } : {} } : UNAVAILABLE };
     } catch {
       return { ok: false, error: UNAVAILABLE };
     }
@@ -371,12 +479,14 @@ function createAuthClient(options = {}) {
     if (o.locale) q.set("locale", o.locale);
     return `${base}/login?${q}`;
   };
+  let policy;
   async function methods() {
     try {
       const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
       if (res.ok) {
         const m = await res.json();
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        if (m.password) policy = passwordPolicyOf(m.password);
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
@@ -520,12 +630,12 @@ function createAuthClient(options = {}) {
       email: (f) => post(
         "/sign-up/email",
         { email: f.email, password: f.password, name: f.name, organization: f.organization, acceptLegal: f.acceptLegal, consents: f.consents },
-        firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password), checkOrganization(f.organization)),
+        firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password, policy), checkOrganization(f.organization)),
         f.captchaToken
       )
     },
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
-    resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password)),
+    resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
@@ -559,7 +669,7 @@ function createAuthClient(options = {}) {
       },
       acceptLegal: (f = {}) => post("/me/legal/accept", { kinds: f.kinds ?? [] }, null),
       changePassword: (f) => {
-        const bad = checkNewPassword(f.newPassword);
+        const bad = checkNewPassword(f.newPassword, policy);
         return post("/me/password", { password: f.password, newPassword: f.newPassword }, bad ? { ...bad, field: "newPassword" } : null);
       },
       mfa: {
@@ -590,7 +700,7 @@ function createAuthClient(options = {}) {
         return body && Array.isArray(body.sessions) ? body.sessions : [];
       },
       signOutEverywhere: () => post("/me/sessions/end", {}, null),
-      upgrade: (f) => post("/me/upgrade", { email: f.email, password: f.password, name: f.name ?? "" }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password))),
+      upgrade: (f) => post("/me/upgrade", { email: f.email, password: f.password, name: f.name ?? "" }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password, policy))),
       upgradeUrl,
       upgradeWith(provider, o) {
         window.location.assign(upgradeUrl(provider, o));
@@ -628,6 +738,7 @@ function createAuthClient(options = {}) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_PASSWORD_POLICY,
   MIN_PASSWORD,
   canAutofillPasskeys,
   canUsePasskeys,
@@ -637,6 +748,10 @@ function createAuthClient(options = {}) {
   checkNewPassword,
   checkPassword,
   createAuthClient,
-  createSessionStore
+  createSessionStore,
+  describePasswordPolicy,
+  explainPasswordProblems,
+  passwordPolicyOf,
+  passwordProblems
 });
 //# sourceMappingURL=client.js.map