cauthy-auth 0.27.0 → 0.28.0

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-XkIbG5gE.mjs';
 export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PermissionOf, e as Permitted, f as Policy, g as PolicyPermission, h as PolicyRole, i as PublicSession, j as PushPolicyOptions, R as RoleOf, S as Session, k as SessionOrganization, l as SessionStatus, m as SessionUser, n as SystemKey, o as SystemOptions, p as can, q as createSystem, r as definePolicy, s as policySource, t as pullPolicy, u as pushPolicy } from './system-BxMsSIu1.mjs';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.mjs';
-export { A as AuthField, F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.mjs';
+export { A as AuthField, D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, b as PasswordPolicy, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.mjs';
 import { JWTVerifyGetKey } from 'jose';
 
 interface ConnectOptions {
@@ -33,10 +33,16 @@ interface Connected {
     /** Shown this once: Cauthy keeps only its hash. */
     clientSecret: string;
     redirectUris: string[];
+    /**
+     * The subscription to events, when `eventsUrl` was given. Its `secret` signs
+     * the HMAC header (X-Cauthy-Signature) and is shown this once; `auth.webhook`
+     * does not need it, as it verifies by Cauthy's published keys.
+     */
     webhook: {
         id: string;
         url: string;
         events: string[];
+        secret: string;
     } | null;
     /**
      * Everything the application sets: what Cauthy answered, plus CAUTHY_SECRET,

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-DGAy45G2.js';
 export { C as CauthyApiError, a as CauthyConfigError, b as CauthyOptions, c as CauthySystem, J as JsonValue, N as NewMember, O as Organization, d as OrganizationMember, P as PermissionOf, e as Permitted, f as Policy, g as PolicyPermission, h as PolicyRole, i as PublicSession, j as PushPolicyOptions, R as RoleOf, S as Session, k as SessionOrganization, l as SessionStatus, m as SessionUser, n as SystemKey, o as SystemOptions, p as can, q as createSystem, r as definePolicy, s as policySource, t as pullPolicy, u as pushPolicy } from './system-DTIeDXDP.js';
 export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, StackmythTokens, ThemeFont, ThemeTexts, pushTheme, themeFromStackmyth, tokensFromStackmyth } from './theme.js';
-export { A as AuthField, F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-BTRit1O1.js';
+export { A as AuthField, D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, b as PasswordPolicy, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.js';
 import { JWTVerifyGetKey } from 'jose';
 
 interface ConnectOptions {
@@ -33,10 +33,16 @@ interface Connected {
     /** Shown this once: Cauthy keeps only its hash. */
     clientSecret: string;
     redirectUris: string[];
+    /**
+     * The subscription to events, when `eventsUrl` was given. Its `secret` signs
+     * the HMAC header (X-Cauthy-Signature) and is shown this once; `auth.webhook`
+     * does not need it, as it verifies by Cauthy's published keys.
+     */
     webhook: {
         id: string;
         url: string;
         events: string[];
+        secret: string;
     } | null;
     /**
      * Everything the application sets: what Cauthy answered, plus CAUTHY_SECRET,

package/dist/index.js

@@ -24,6 +24,7 @@ __export(src_exports, {
   CauthyConfigError: () => CauthyConfigError,
   CauthyTokenError: () => CauthyTokenError,
   CauthyWebhookError: () => CauthyWebhookError,
+  DEFAULT_PASSWORD_POLICY: () => DEFAULT_PASSWORD_POLICY,
   MIN_PASSWORD: () => MIN_PASSWORD,
   can: () => can,
   checkCode: () => checkCode,
@@ -35,6 +36,10 @@ __export(src_exports, {
   createCauthy: () => createCauthy,
   createSystem: () => createSystem,
   definePolicy: () => definePolicy,
+  describePasswordPolicy: () => describePasswordPolicy,
+  explainPasswordProblems: () => explainPasswordProblems,
+  passwordPolicyOf: () => passwordPolicyOf,
+  passwordProblems: () => passwordProblems,
   policySource: () => policySource,
   pullPolicy: () => pullPolicy,
   pushPolicy: () => pushPolicy,
@@ -543,7 +548,9 @@ function createSystem(given = {}) {
   async function fail(res, what) {
     const body = await res.json().catch(() => null);
     const first = body?.errors?.[0];
-    throw new CauthyApiError(res.status, first?.code ?? "error", `Cauthy refused ${what} (${res.status}): ${first?.message ?? res.statusText}`);
+    const code = typeof body?.error === "string" ? body.error : first?.code;
+    const message = typeof body?.error === "string" ? body.error_description : first?.message;
+    throw new CauthyApiError(res.status, code ?? "error", `Cauthy refused ${what} (${res.status}): ${message ?? res.statusText}`);
   }
   let held;
   let asking;
@@ -653,9 +660,113 @@ function createSystem(given = {}) {
 }
 
 // src/validate.ts
-var MIN_PASSWORD = 8;
-var MAX_PASSWORD = 256;
+var MIN_PASSWORD = 12;
+var MAX_PASSWORD = 128;
+var FLOOR_PASSWORD = 8;
 var MAX_NAME = 120;
+var CLASSES = ["lowercase", "uppercase", "digit", "symbol"];
+var DEFAULT_PASSWORD_POLICY = Object.freeze({ min: MIN_PASSWORD, max: MAX_PASSWORD, requires: [], min_classes: 0, reject_breached: false });
+var int = (v, fallback) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : fallback;
+function passwordPolicyOf(raw) {
+  const r = raw && typeof raw === "object" ? raw : {};
+  const min = Math.min(Math.max(int(r.min ?? r.min_length, MIN_PASSWORD) || MIN_PASSWORD, FLOOR_PASSWORD), MAX_PASSWORD);
+  const max = Math.max(Math.min(int(r.max ?? r.max_length, MAX_PASSWORD) || MAX_PASSWORD, MAX_PASSWORD), min);
+  const asked = Array.isArray(r.requires) ? r.requires : [];
+  return {
+    min,
+    max,
+    requires: CLASSES.filter((c) => asked.includes(c)),
+    min_classes: Math.min(Math.max(int(r.min_classes ?? r.minClasses, 0), 0), CLASSES.length),
+    reject_breached: (r.reject_breached ?? r.rejectBreached) === true
+  };
+}
+function utf8Length(v) {
+  let n = 0;
+  for (const ch of v) {
+    const c = ch.codePointAt(0);
+    n += c < 128 ? 1 : c < 2048 ? 2 : c < 65536 ? 3 : 4;
+  }
+  return n;
+}
+function classesOf(v) {
+  const has = /* @__PURE__ */ new Set();
+  for (const ch of v) {
+    if (/\p{Ll}/u.test(ch)) has.add("lowercase");
+    else if (/\p{Lu}/u.test(ch)) has.add("uppercase");
+    else if (/\p{Nd}/u.test(ch)) has.add("digit");
+    else if (!/\p{L}/u.test(ch)) has.add("symbol");
+  }
+  return has;
+}
+function passwordProblems(value, policy = DEFAULT_PASSWORD_POLICY) {
+  const p = passwordPolicyOf(policy);
+  const out2 = [];
+  const length = utf8Length(value);
+  if (length < p.min) out2.push("too_short");
+  if (length > p.max) out2.push("too_long");
+  const has = classesOf(value);
+  for (const c of p.requires) if (!has.has(c)) out2.push(`needs_${c}`);
+  if (p.min_classes > 0 && CLASSES.filter((c) => has.has(c)).length < p.min_classes) out2.push("needs_classes");
+  return out2;
+}
+var RULES = {
+  en: {
+    between: "Between {min} and {max} characters.",
+    requires: "Include {kinds}.",
+    and: "and",
+    classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+    breached: "Passwords found in known data breaches are not accepted.",
+    kinds: { lowercase: "a lowercase letter", uppercase: "an uppercase letter", digit: "a digit", symbol: "a symbol" },
+    reasons: {
+      too_short: "Use at least {min} characters.",
+      too_long: "Use at most {max} characters.",
+      needs_lowercase: "Include a lowercase letter.",
+      needs_uppercase: "Include an uppercase letter.",
+      needs_digit: "Include a digit.",
+      needs_symbol: "Include a symbol.",
+      needs_classes: "Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.",
+      breached: "This password appears in a known data breach. Choose a different one."
+    }
+  },
+  es: {
+    between: "Entre {min} y {max} caracteres.",
+    requires: "Incluye {kinds}.",
+    and: "y",
+    classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+    breached: "No se aceptan contrase\xF1as que aparecen en filtraciones de datos conocidas.",
+    kinds: { lowercase: "una min\xFAscula", uppercase: "una may\xFAscula", digit: "un n\xFAmero", symbol: "un s\xEDmbolo" },
+    reasons: {
+      too_short: "Usa al menos {min} caracteres.",
+      too_long: "Usa como m\xE1ximo {max} caracteres.",
+      needs_lowercase: "Incluye una min\xFAscula.",
+      needs_uppercase: "Incluye una may\xFAscula.",
+      needs_digit: "Incluye un n\xFAmero.",
+      needs_symbol: "Incluye un s\xEDmbolo.",
+      needs_classes: "Usa al menos {n} de estos tipos: min\xFAsculas, may\xFAsculas, n\xFAmeros, s\xEDmbolos.",
+      breached: "Esta contrase\xF1a aparece en una filtraci\xF3n de datos conocida. Elige otra."
+    }
+  }
+};
+var fill = (s, p) => s.replace("{min}", String(p.min)).replace("{max}", String(p.max)).replace("{n}", String(p.min_classes));
+function describePasswordPolicy(policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const parts = [fill(t.between, p)];
+  if (p.requires.length > 0) {
+    const kinds = p.requires.map((c) => t.kinds[c]);
+    const listed = kinds.length === 1 ? kinds[0] : `${kinds.slice(0, -1).join(", ")} ${t.and} ${kinds[kinds.length - 1]}`;
+    parts.push(t.requires.replace("{kinds}", listed));
+  }
+  if (p.min_classes > 0) parts.push(fill(t.classes, p));
+  if (p.reject_breached) parts.push(t.breached);
+  return parts.join(" ");
+}
+function explainPasswordProblems(reasons, policy = DEFAULT_PASSWORD_POLICY, locale = "en") {
+  const p = passwordPolicyOf(policy);
+  const t = RULES[locale] ?? RULES.en;
+  const said = reasons.filter((r) => r in t.reasons).map((r) => fill(t.reasons[r], p));
+  return said.length > 0 ? said.join(" ") : describePasswordPolicy(p, locale);
+}
 var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function checkEmail(value) {
   const v = typeof value === "string" ? value.trim() : "";
@@ -668,13 +779,12 @@ function checkPassword(value) {
   if (value.length > MAX_PASSWORD) return { field: "password", code: "too_long", message: "That password is too long." };
   return null;
 }
-function checkNewPassword(value) {
-  const basic = checkPassword(value);
-  if (basic) return basic;
-  if (value.length < MIN_PASSWORD) {
-    return { field: "password", code: "too_short", message: `Use at least ${MIN_PASSWORD} characters.` };
-  }
-  return null;
+function checkNewPassword(value, policy) {
+  if (typeof value !== "string" || value === "") return { field: "password", code: "required", message: "Enter your password." };
+  const p = policy ? passwordPolicyOf(policy) : DEFAULT_PASSWORD_POLICY;
+  const reasons = passwordProblems(value, p);
+  if (reasons.length === 0) return null;
+  return { field: "password", code: reasons[0], message: explainPasswordProblems(reasons, p) };
 }
 function checkName(value) {
   if (value === void 0 || value === null || value === "") return null;
@@ -1133,7 +1243,7 @@ function createCauthy(given = {}) {
     connectedAt: String(d?.created_at ?? ""),
     lastUsedAt: String(d?.last_used_at ?? "")
   });
-  const problem = (status2, code, message, field, headers) => json({ error: { code, message, ...field ? { field } : {} } }, status2, headers);
+  const problem = (status2, code, message, field, headers, reasons) => json({ error: { code, message, ...field ? { field } : {}, ...reasons && reasons.length > 0 ? { reasons } : {} } }, status2, headers);
   const invalid = (p) => problem(400, p.code, p.message, p.field);
   function ownRequest(request) {
     const origin = request.headers.get("origin");
@@ -1191,7 +1301,8 @@ function createCauthy(given = {}) {
       const b = res.status === 204 || res.status === 202 ? null : await res.json().catch(() => null);
       if (res.ok) return { status: res.status, data: b?.data ?? b };
       const first = b?.errors?.[0];
-      return { status: res.status, data: null, error: { code: String(first?.code ?? "error"), message: String(first?.message ?? "The request could not be completed.") } };
+      const reasons = Array.isArray(first?.meta?.reasons) ? first.meta.reasons.map(String) : void 0;
+      return { status: res.status, data: null, error: { code: String(first?.code ?? "error"), message: String(first?.message ?? "The request could not be completed."), ...reasons ? { reasons } : {} } };
     } catch {
       return { status: 503, data: null, error: { code: "unavailable", message: "Sign-in is unavailable right now. Try again in a moment." } };
     }
@@ -1219,6 +1330,19 @@ function createCauthy(given = {}) {
     return json({ status: "signed_in", session: await toPublic(toSession(s)), ...more }, 200, h);
   }
   let lookCache = null;
+  let policyCache = null;
+  const keepPolicy = (settings) => {
+    policyCache = { until: Date.now() + LOOK_TTL_MS, policy: settings.error || !settings.data?.password_policy ? null : passwordPolicyOf(settings.data.password_policy) };
+    return policyCache.policy;
+  };
+  async function workspacePolicy(request) {
+    if (policyCache !== null && policyCache.until >= Date.now()) return policyCache.policy;
+    return keepPolicy(await ask(request, "GET", "/v1/auth/settings"));
+  }
+  async function newPasswordProblem(request, value) {
+    const policy = await workspacePolicy(request);
+    return checkNewPassword(value, policy ?? { min: 8, max: 128, requires: [], min_classes: 0, reject_breached: false });
+  }
   async function ownRoute(request, url, route) {
     const post = request.method === "POST";
     const own = [
@@ -1296,6 +1420,7 @@ function createCauthy(given = {}) {
         ask(request, "GET", "/v1/auth/sso/connections")
       ]);
       const list = Array.isArray(providers.data) ? providers.data : [];
+      const password = keepPolicy(settings);
       const here = place.data?.here === true;
       return json({
         providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? "") })).filter((p) => p.id !== ""),
@@ -1311,7 +1436,9 @@ function createCauthy(given = {}) {
         sso: Array.isArray(sso.data) && sso.data.some((c) => c?.discoverable === true),
         // The terms a sign-up accepts and the consents it answers, when the workspace asks any.
         ...settings.data?.legal ? { legal: legalOf(settings.data.legal) } : {},
-        ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}
+        ...settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {},
+        // What a new password must be: for the form to say it and check it.
+        ...password ? { password } : {}
       });
     }
     if (route === "/sign-in/sso" && !post) {
@@ -1601,13 +1728,13 @@ function createCauthy(given = {}) {
       return json({ status: "sent", sentTo: String(res.data?.sent_to ?? ""), channel: String(res.data?.channel ?? "sms") });
     }
     if (route === "/sign-up/email") {
-      const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password), checkOrganization(b.organization));
+      const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password), checkOrganization(b.organization));
       if (bad) return invalid(bad);
       const email = String(b.email).trim();
       const organization = typeof b.organization === "string" && b.organization.trim() !== "" ? { organization: { name: b.organization.trim() } } : {};
       const legal = { ...b.acceptLegal === true ? { accept_legal: true } : {}, ...b.consents && typeof b.consents === "object" ? { consents: b.consents } : {} };
       const made = await ask(request, "POST", "/v1/auth/register", { email, password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "", ...organization, ...legal }, pages.verifyEmail);
-      if (made.error) return problem(made.status, made.error.code, made.error.message);
+      if (made.error) return problem(made.status, made.error.code, made.error.message, made.error.code === "weak_password" ? "password" : void 0, void 0, made.error.reasons);
       if (made.data?.verification_required === true) return json({ status: "verification_required", email });
       const res = await ask(request, "POST", "/v1/auth/login", { email, password: b.password });
       if (res.error || res.data?.mfa_required === true) return json({ status: "verification_required", email });
@@ -1623,7 +1750,7 @@ function createCauthy(given = {}) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
       const as = (path, payload, method = "POST") => ask(request, method, path, payload, void 0, mine.token);
-      const refused = (res, field) => problem(res.status, res.error.code, res.error.message, field, mine.headers);
+      const refused = (res, field) => problem(res.status, res.error.code, res.error.message, field, mine.headers, res.error.reasons);
       const password = typeof b.password === "string" ? b.password : "";
       if (route === "/me") {
         const bad = checkName(b.name);
@@ -1644,7 +1771,7 @@ function createCauthy(given = {}) {
         return json({ status: "accepted" }, 200, mine.headers);
       }
       if (route === "/me/password") {
-        const bad = checkNewPassword(b.newPassword);
+        const bad = await newPasswordProblem(request, b.newPassword);
         if (bad) return problem(400, bad.code, bad.message, "newPassword");
         const res = await as("/v1/auth/me/password", { current_password: password, new_password: b.newPassword });
         if (res.error) return refused(res, res.error.code === "wrong_password" ? "password" : res.error.code === "weak_password" ? "newPassword" : void 0);
@@ -1737,7 +1864,7 @@ function createCauthy(given = {}) {
         return json({ status: "removed", id }, 200, mine.headers);
       }
       if (route === "/me/upgrade") {
-        const bad = firstProblem(checkName(b.name), checkEmail(b.email), checkNewPassword(b.password));
+        const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password));
         if (bad) return invalid(bad);
         const res = await as("/v1/auth/anonymous/upgrade", { email: String(b.email).trim(), password: b.password, display_name: typeof b.name === "string" ? b.name.trim() : "" });
         if (res.error) return refused(res, res.error.code === "weak_password" ? "password" : "email");
@@ -1804,10 +1931,10 @@ function createCauthy(given = {}) {
     const badLink = () => problem(422, "invalid_token", "This link is not valid, or it has expired.");
     if (route === "/reset-password") {
       if (!isToken(b.token)) return badLink();
-      const bad = checkNewPassword(b.password);
+      const bad = await newPasswordProblem(request, b.password);
       if (bad) return invalid(bad);
       const res = await ask(request, "POST", "/v1/auth/password/change", { token: String(b.token), new_password: b.password });
-      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0, void 0, res.error.reasons);
       return json({ status: "changed" });
     }
     if (route === "/verify-email") {
@@ -2181,6 +2308,7 @@ async function verifyToken(from, options = {}) {
   CauthyConfigError,
   CauthyTokenError,
   CauthyWebhookError,
+  DEFAULT_PASSWORD_POLICY,
   MIN_PASSWORD,
   can,
   checkCode,
@@ -2192,6 +2320,10 @@ async function verifyToken(from, options = {}) {
   createCauthy,
   createSystem,
   definePolicy,
+  describePasswordPolicy,
+  explainPasswordProblems,
+  passwordPolicyOf,
+  passwordProblems,
   policySource,
   pullPolicy,
   pushPolicy,