cauthy-auth 0.27.0 → 0.28.0

package/dist/validate-sEXG82po.d.mts

@@ -0,0 +1,66 @@
+type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code' | 'organization';
+/** A value of a form that cannot be sent as it is. */
+interface FieldProblem {
+    field: AuthField;
+    /**
+     * Stable, for translating: `required`, `invalid_email`, `too_short`,
+     * `too_long`, and for a new password the rule of the workspace it fails:
+     * `needs_lowercase`, `needs_uppercase`, `needs_digit`, `needs_symbol`,
+     * `needs_classes`.
+     */
+    code: 'required' | 'invalid_email' | PasswordReason;
+    message: string;
+}
+/** The shortest password Cauthy takes by default: a workspace's policy may ask otherwise (`methods().password`). */
+declare const MIN_PASSWORD = 12;
+/** A kind of character a workspace's password policy can ask for. */
+type PasswordClass = 'lowercase' | 'uppercase' | 'digit' | 'symbol';
+/** Why a new password is refused: the API's `weak_password` `meta.reasons`. */
+type PasswordReason = 'too_short' | 'too_long' | 'needs_lowercase' | 'needs_uppercase' | 'needs_digit' | 'needs_symbol' | 'needs_classes' | 'breached';
+/**
+ * What a new password must be in the workspace, as `methods().password` says
+ * it. Length is counted in bytes of UTF-8, as Cauthy counts it. A symbol is
+ * any character that is neither a letter nor a digit, a space included.
+ */
+interface PasswordPolicy {
+    min: number;
+    max: number;
+    /** The kinds the password must each carry at least once. */
+    requires: PasswordClass[];
+    /** At least this many of the four kinds; 0 asks none. */
+    min_classes: number;
+    /** Cauthy refuses a password found in a published breach (checked by Cauthy alone). */
+    reject_breached: boolean;
+}
+/** The policy of a workspace that set none: what every one asked before they could choose. */
+declare const DEFAULT_PASSWORD_POLICY: PasswordPolicy;
+/**
+ * A password policy as Cauthy sent it — `{ min_length, max_length, … }` from
+ * the sign-in settings, or `{ min, max, … }` from `methods()` — made safe to
+ * use: the defaults where nothing is said, and never outside 8–128.
+ */
+declare function passwordPolicyOf(raw: unknown): PasswordPolicy;
+/**
+ * Every rule of the policy a new password fails, as the API names them;
+ * empty when it meets them all. Whether it was in a breach only Cauthy knows.
+ */
+declare function passwordProblems(value: string, policy?: PasswordPolicy): PasswordReason[];
+/** The languages the rule is said in. */
+type PasswordLocale = 'en' | 'es';
+/** What a new password must be, said for the person choosing it: "Between 12 and 128 characters. Include a digit." */
+declare function describePasswordPolicy(policy?: PasswordPolicy, locale?: PasswordLocale): string;
+/** Why a new password was refused, rule by rule, for the person who typed it. */
+declare function explainPasswordProblems(reasons: readonly string[], policy?: PasswordPolicy, locale?: PasswordLocale): string;
+declare function checkEmail(value: unknown): FieldProblem | null;
+/** A password being typed to sign in: only that there is one. */
+declare function checkPassword(value: unknown): FieldProblem | null;
+/**
+ * A password being chosen for a new account, or a new one for an account.
+ * Held to the workspace's policy when it is given (`methods().password`),
+ * otherwise to the defaults: 12 to 128 characters.
+ */
+declare function checkNewPassword(value: unknown, policy?: PasswordPolicy | null): FieldProblem | null;
+declare function checkName(value: unknown): FieldProblem | null;
+declare function checkCode(value: unknown): FieldProblem | null;
+
+export { type AuthField as A, DEFAULT_PASSWORD_POLICY as D, type FieldProblem as F, MIN_PASSWORD as M, type PasswordClass as P, type PasswordLocale as a, type PasswordPolicy as b, type PasswordReason as c, checkCode as d, checkEmail as e, checkName as f, checkNewPassword as g, checkPassword as h, describePasswordPolicy as i, explainPasswordProblems as j, passwordProblems as k, passwordPolicyOf as p };

package/dist/validate-sEXG82po.d.ts

@@ -0,0 +1,66 @@
+type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code' | 'organization';
+/** A value of a form that cannot be sent as it is. */
+interface FieldProblem {
+    field: AuthField;
+    /**
+     * Stable, for translating: `required`, `invalid_email`, `too_short`,
+     * `too_long`, and for a new password the rule of the workspace it fails:
+     * `needs_lowercase`, `needs_uppercase`, `needs_digit`, `needs_symbol`,
+     * `needs_classes`.
+     */
+    code: 'required' | 'invalid_email' | PasswordReason;
+    message: string;
+}
+/** The shortest password Cauthy takes by default: a workspace's policy may ask otherwise (`methods().password`). */
+declare const MIN_PASSWORD = 12;
+/** A kind of character a workspace's password policy can ask for. */
+type PasswordClass = 'lowercase' | 'uppercase' | 'digit' | 'symbol';
+/** Why a new password is refused: the API's `weak_password` `meta.reasons`. */
+type PasswordReason = 'too_short' | 'too_long' | 'needs_lowercase' | 'needs_uppercase' | 'needs_digit' | 'needs_symbol' | 'needs_classes' | 'breached';
+/**
+ * What a new password must be in the workspace, as `methods().password` says
+ * it. Length is counted in bytes of UTF-8, as Cauthy counts it. A symbol is
+ * any character that is neither a letter nor a digit, a space included.
+ */
+interface PasswordPolicy {
+    min: number;
+    max: number;
+    /** The kinds the password must each carry at least once. */
+    requires: PasswordClass[];
+    /** At least this many of the four kinds; 0 asks none. */
+    min_classes: number;
+    /** Cauthy refuses a password found in a published breach (checked by Cauthy alone). */
+    reject_breached: boolean;
+}
+/** The policy of a workspace that set none: what every one asked before they could choose. */
+declare const DEFAULT_PASSWORD_POLICY: PasswordPolicy;
+/**
+ * A password policy as Cauthy sent it — `{ min_length, max_length, … }` from
+ * the sign-in settings, or `{ min, max, … }` from `methods()` — made safe to
+ * use: the defaults where nothing is said, and never outside 8–128.
+ */
+declare function passwordPolicyOf(raw: unknown): PasswordPolicy;
+/**
+ * Every rule of the policy a new password fails, as the API names them;
+ * empty when it meets them all. Whether it was in a breach only Cauthy knows.
+ */
+declare function passwordProblems(value: string, policy?: PasswordPolicy): PasswordReason[];
+/** The languages the rule is said in. */
+type PasswordLocale = 'en' | 'es';
+/** What a new password must be, said for the person choosing it: "Between 12 and 128 characters. Include a digit." */
+declare function describePasswordPolicy(policy?: PasswordPolicy, locale?: PasswordLocale): string;
+/** Why a new password was refused, rule by rule, for the person who typed it. */
+declare function explainPasswordProblems(reasons: readonly string[], policy?: PasswordPolicy, locale?: PasswordLocale): string;
+declare function checkEmail(value: unknown): FieldProblem | null;
+/** A password being typed to sign in: only that there is one. */
+declare function checkPassword(value: unknown): FieldProblem | null;
+/**
+ * A password being chosen for a new account, or a new one for an account.
+ * Held to the workspace's policy when it is given (`methods().password`),
+ * otherwise to the defaults: 12 to 128 characters.
+ */
+declare function checkNewPassword(value: unknown, policy?: PasswordPolicy | null): FieldProblem | null;
+declare function checkName(value: unknown): FieldProblem | null;
+declare function checkCode(value: unknown): FieldProblem | null;
+
+export { type AuthField as A, DEFAULT_PASSWORD_POLICY as D, type FieldProblem as F, MIN_PASSWORD as M, type PasswordClass as P, type PasswordLocale as a, type PasswordPolicy as b, type PasswordReason as c, checkCode as d, checkEmail as e, checkName as f, checkNewPassword as g, checkPassword as h, describePasswordPolicy as i, explainPasswordProblems as j, passwordProblems as k, passwordPolicyOf as p };

package/dist/vue.d.mts

@@ -4,7 +4,7 @@ export { Account, AccountSession, AuthError, AuthMethods, AuthResult, Passkey, P
 import { i as PublicSession } from './system-BxMsSIu1.mjs';
 export { P as PermissionOf, f as Policy, R as RoleOf, k as SessionOrganization, m as SessionUser, p as can, r as definePolicy } from './system-BxMsSIu1.mjs';
 import './theme.mjs';
-import './validate-BTRit1O1.mjs';
+import './validate-sEXG82po.mjs';
 import 'jose';
 
 interface CauthyVueSession extends Pick<SessionStore, 'refresh' | 'signIn' | 'signOut' | 'accountUrl' | 'basePath'> {

package/dist/vue.d.ts

@@ -4,7 +4,7 @@ export { Account, AccountSession, AuthError, AuthMethods, AuthResult, Passkey, P
 import { i as PublicSession } from './system-DTIeDXDP.js';
 export { P as PermissionOf, f as Policy, R as RoleOf, k as SessionOrganization, m as SessionUser, p as can, r as definePolicy } from './system-DTIeDXDP.js';
 import './theme.js';
-import './validate-BTRit1O1.js';
+import './validate-sEXG82po.js';
 import 'jose';
 
 interface CauthyVueSession extends Pick<SessionStore, 'refresh' | 'signIn' | 'signOut' | 'accountUrl' | 'basePath'> {

package/dist/vue.js

@@ -147,9 +147,113 @@ function fromWire(wire) {
 }
 
 // src/validate.ts
-var MIN_PASSWORD = 8;
-var MAX_PASSWORD = 256;
+var MIN_PASSWORD = 12;
+var MAX_PASSWORD = 128;
+var FLOOR_PASSWORD = 8;
 var MAX_NAME = 120;
+var CLASSES = ["lowercase", "uppercase", "digit", "symbol"];
+var DEFAULT_PASSWORD_POLICY = Object.freeze({ min: MIN_PASSWORD, max: MAX_PASSWORD, requires: [], min_classes: 0, reject_breached: false });
+var int = (v, fallback) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : fallback;
+function passwordPolicyOf(raw) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  const min = Math.min(Math.max(int(r.min ?? r.min_length, MIN_PASSWORD) || MIN_PASSWORD, FLOOR_PASSWORD), MAX_PASSWORD);
+  const max = Math.max(Math.min(int(r.max ?? r.max_length, MAX_PASSWORD) || MAX_PASSWORD, MAX_PASSWORD), min);
+  const asked = Array.isArray(r.requires) ? r.requires : [];
+  return {
+    min,
+    max,
+    requires: CLASSES.filter((c) => asked.includes(c)),
+    min_classes: Math.min(Math.max(int(r.min_classes ?? r.minClasses, 0), 0), CLASSES.length),
+    reject_breached: (r.reject_breached ?? r.rejectBreached) === true
+  };
+}
+function utf8Length(v) {
+  let n = 0;
+  for (const ch of v) {
+    const c = ch.codePointAt(0);
+    n += c < 128 ? 1 : c < 2048 ? 2 : c < 65536 ? 3 : 4;
+  }
+  return n;
+}
+function classesOf(v) {
+  const has = /* @__PURE__ */ new Set();
+  for (const ch of v) {
+    if (/\p{Ll}/u.test(ch)) has.add("lowercase");
+    else if (/\p{Lu}/u.test(ch)) has.add("uppercase");
+    else if (/\p{Nd}/u.test(ch)) has.add("digit");
+    else if (!/\p{L}/u.test(ch)) has.add("symbol");
+  }
+  return has;
+}
+function passwordProblems(value, policy = DEFAULT_PASSWORD_POLICY) {
+  const p = passwordPolicyOf(policy);
+  const out = [];
+  const length = utf8Length(value);
+  if (length < p.min) out.push("too_short");
+  if (length > p.max) out.push("too_long");
+  const has = classesOf(value);
+  for (const c of p.requires) if (!has.has(c)) out.push(`needs_${c}`);
+  if (p.min_classes > 0 && CLASSES.filter((c) => has.has(c)).length < p.min_classes) out.push("needs_classes");
+  return out;
+}
+var RULES = {
+  en: {
+    between: "Between {min} and {max} characters.",
+    requires: "Include {kinds}.",
+    and: "and",
+    classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+    breached: "Passwords found in known data breaches are not accepted.",
+    kinds: { lowercase: "a lowercase letter", uppercase: "an uppercase letter", digit: "a digit", symbol: "a symbol" },
+    reasons: {
+      too_short: "Use at least {min} characters.",
+      too_long: "Use at most {max} characters.",
+      needs_lowercase: "Include a lowercase letter.",
+      needs_uppercase: "Include an uppercase letter.",
+      needs_digit: "Include a digit.",
+      needs_symbol: "Include a symbol.",
+      needs_classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+      breached: "This password appears in a known data breach. Choose a different one."
+    }
+  },
+  es: {
+    between: "Entre {min} y {max} caracteres.",
+    requires: "Incluye {kinds}.",
+    and: "y",
+    classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+    breached: "No se aceptan contrase\xF1as que aparecen en filtraciones de datos conocidas.",
+    kinds: { lowercase: "una min\xFAscula", uppercase: "una may\xFAscula", digit: "un n\xFAmero", symbol: "un s\xEDmbolo" },
+    reasons: {
+      too_short: "Usa al menos {min} caracteres.",
+      too_long: "Usa como m\xE1ximo {max} caracteres.",
+      needs_lowercase: "Incluye una min\xFAscula.",
+      needs_uppercase: "Incluye una may\xFAscula.",
+      needs_digit: "Incluye un n\xFAmero.",
+      needs_symbol: "Incluye un s\xEDmbolo.",
+      needs_classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+      breached: "Esta contrase\xF1a aparece en una filtraci\xF3n de datos conocida. Elige otra."
+    }
+  }
+};
+var fill = (s, p) => s.replace("{min}", String(p.min)).replace("{max}", String(p.max)).replace("{n}", String(p.min_classes));
+function describePasswordPolicy(policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const parts = [fill(t.between, p)];
+  if (p.requires.length > 0) {
+    const kinds = p.requires.map((c) => t.kinds[c]);
+    const listed = kinds.length === 1 ? kinds[0] : `${kinds.slice(0, -1).join(", ")} ${t.and} ${kinds[kinds.length - 1]}`;
+    parts.push(t.requires.replace("{kinds}", listed));
+  }
+  if (p.min_classes > 0) parts.push(fill(t.classes, p));
+  if (p.reject_breached) parts.push(t.breached);
+  return parts.join(" ");
+}
+function explainPasswordProblems(reasons, policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const said = reasons.filter((r) => r in t.reasons).map((r) => fill(t.reasons[r], p));
+  return said.length > 0 ? said.join(" ") : describePasswordPolicy(p, locale);
+}
 var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function checkEmail(value) {
   const v = typeof value === "string" ? value.trim() : "";
@@ -162,13 +266,12 @@ function checkPassword(value) {
   if (value.length > MAX_PASSWORD) return { field: "password", code: "too_long", message: "That password is too long." };
   return null;
 }
-function checkNewPassword(value) {
-  const basic = checkPassword(value);
-  if (basic) return basic;
-  if (value.length < MIN_PASSWORD) {
-    return { field: "password", code: "too_short", message: `Use at least ${MIN_PASSWORD} characters.` };
-  }
-  return null;
+function checkNewPassword(value, policy) {
+  if (typeof value !== "string" || value === "") return { field: "password", code: "required", message: "Enter your password." };
+  const p = policy ? passwordPolicyOf(policy) : DEFAULT_PASSWORD_POLICY;
+  const reasons = passwordProblems(value, p);
+  if (reasons.length === 0) return null;
+  return { field: "password", code: reasons[0], message: explainPasswordProblems(reasons, p) };
 }
 function checkName(value) {
   if (value === void 0 || value === null || value === "") return null;
@@ -231,7 +334,7 @@ function createAuthClient(options = {}) {
       const body = await res.json().catch(() => null);
       if (res.ok && body && typeof body.status === "string") return { ok: true, ...body };
       const e = body?.error;
-      return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? ""), ...e.field ? { field: e.field } : {} } : UNAVAILABLE };
+      return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? ""), ...e.field ? { field: e.field } : {}, ...Array.isArray(e.reasons) ? { reasons: e.reasons.map(String) } : {} } : UNAVAILABLE };
     } catch {
       return { ok: false, error: UNAVAILABLE };
     }
@@ -259,12 +362,14 @@ function createAuthClient(options = {}) {
     if (o.locale) q.set("locale", o.locale);
     return `${base}/login?${q}`;
   };
+  let policy;
   async function methods() {
     try {
       const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
       if (res.ok) {
         const m = await res.json();
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        if (m.password) policy = passwordPolicyOf(m.password);
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
@@ -408,12 +513,12 @@ function createAuthClient(options = {}) {
       email: (f) => post(
         "/sign-up/email",
         { email: f.email, password: f.password, name: f.name, organization: f.organization, acceptLegal: f.acceptLegal, consents: f.consents },
-        firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password), checkOrganization(f.organization)),
+        firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password, policy), checkOrganization(f.organization)),
         f.captchaToken
       )
     },
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
-    resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password)),
+    resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
@@ -447,7 +552,7 @@ function createAuthClient(options = {}) {
       },
       acceptLegal: (f = {}) => post("/me/legal/accept", { kinds: f.kinds ?? [] }, null),
       changePassword: (f) => {
-        const bad = checkNewPassword(f.newPassword);
+        const bad = checkNewPassword(f.newPassword, policy);
         return post("/me/password", { password: f.password, newPassword: f.newPassword }, bad ? { ...bad, field: "newPassword" } : null);
       },
       mfa: {
@@ -478,7 +583,7 @@ function createAuthClient(options = {}) {
         return body && Array.isArray(body.sessions) ? body.sessions : [];
       },
       signOutEverywhere: () => post("/me/sessions/end", {}, null),
-      upgrade: (f) => post("/me/upgrade", { email: f.email, password: f.password, name: f.name ?? "" }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password))),
+      upgrade: (f) => post("/me/upgrade", { email: f.email, password: f.password, name: f.name ?? "" }, firstProblem(checkName(f.name), checkEmail(f.email), checkNewPassword(f.password, policy))),
       upgradeUrl,
       upgradeWith(provider, o) {
         window.location.assign(upgradeUrl(provider, o));