cauthy-auth 0.28.1 → 0.31.0

package/dist/react.mjs

@@ -283,6 +283,12 @@ function checkOrganization(value, required = false) {
   if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
   return null;
 }
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -367,11 +373,11 @@ function createAuthClient(options = {}) {
       if (res.ok) {
         const m = await res.json();
         if (m.password) policy = passwordPolicyOf(m.password);
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passwordSignIn: m.passwordSignIn !== false, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
+    return { providers: [], signUp: true, passwordSignIn: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -518,6 +524,20 @@ function createAuthClient(options = {}) {
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
+    async invitation(token) {
+      const bad = { ok: false, error: { code: "invalid_token", message: "This invitation is not valid, or it has expired." } };
+      if (typeof token !== "string" || token.trim() === "") return bad;
+      try {
+        const res = await doFetch(`${base}/invitation?token=${encodeURIComponent(token.trim())}`, { credentials: "same-origin", headers: { accept: "application/json" } });
+        const body = await res.json().catch(() => null);
+        if (res.ok && body?.invitation) return { ok: true, status: "ok", invitation: body.invitation };
+        const e = body?.error;
+        return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? "") } : UNAVAILABLE };
+      } catch {
+        return { ok: false, error: UNAVAILABLE };
+      }
+    },
+    acceptInvitation: (token, password) => post("/invitation/accept", { token, password }, checkNewPassword(password, policy)),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
       async list(system) {
@@ -535,7 +555,23 @@ function createAuthClient(options = {}) {
       add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
       setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
       remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
-      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null),
+      rename: (id, name) => post("/me/organizations/rename", { organizationId: id, name }, checkOrganizationName(name)),
+      archive: (id) => post("/me/organizations/archive", { organizationId: id }, null),
+      delete: (id) => post("/me/organizations/delete", { organizationId: id }, null),
+      async check(q) {
+        const organizationId = typeof q.organization === "string" ? q.organization : q.organization?.id ?? "";
+        const r = await post("/me/organizations/check", {
+          organizationId,
+          resource: q.resource,
+          action: q.action,
+          ...q.attributes !== void 0 ? { attributes: q.attributes } : {},
+          ...q.resourceId !== void 0 ? { resourceId: q.resourceId } : {},
+          ...q.ownerId !== void 0 ? { ownerId: q.ownerId } : {}
+        }, null);
+        if (!r.ok) return { allowed: false, reason: r.error.message, error: r.error };
+        return { allowed: r.allowed === true, reason: String(r.reason ?? ""), ...r.rule ? { rule: r.rule } : {} };
+      }
     },
     account: {
       async get() {
@@ -631,7 +667,9 @@ function can(organization, resource, action) {
   if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
   return organization.permissions.some((p) => matches(p, resource, action));
 }
-function definePolicy(roles) {
+function definePolicy(given) {
+  const roles = Array.isArray(given) ? given : given.roles;
+  const resources = Array.isArray(given) ? [] : given.catalog ?? [];
   const entry = (p) => `${p.resource}:${p.action}`;
   const byName = new Map(roles.map((r) => [r.role, r]));
   const split = (permission) => {
@@ -646,6 +684,12 @@ function definePolicy(roles) {
       ...r.inherits ? { inherits: [...r.inherits] } : {},
       ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
     })),
+    catalog: resources.map((c) => ({
+      resource: c.resource,
+      ...c.description !== void 0 ? { description: c.description } : {},
+      actions: [...c.actions],
+      ...c.attributes ? { attributes: { ...c.attributes } } : {}
+    })),
     roleNames: roles.map((r) => r.role),
     permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
     can(organization, permission) {
@@ -667,6 +711,11 @@ function definePolicy(roles) {
       };
       walk(role);
       return [...out];
+    },
+    // The types did the work; this only hands the question on, as a method of
+    // the asker so it keeps its `this`.
+    check(asker, ...args) {
+      return asker.check(...args);
     }
   };
 }
@@ -725,6 +774,13 @@ var TEXTS = {
     passwordChanged: "Your password was changed. You can sign in with it now.",
     confirming: "Confirming your address\u2026",
     emailConfirmed: "Your address is confirmed. You can sign in now.",
+    invitedTo: "You've been invited to {workspace}",
+    invitedToOrganization: "You've been invited to {organization} on {workspace}",
+    invitedAs: "You will sign in as {email}.",
+    choosePassword: "Choose a password",
+    acceptInvite: "Accept and sign in",
+    openingInvitation: "Opening your invitation\u2026",
+    invitationInvalid: "This invitation is not valid: it was already used, or it has expired. Ask whoever invited you to send it again.",
     profile: "Profile",
     save: "Save",
     saved: "Saved.",
@@ -785,11 +841,22 @@ var TEXTS = {
     memberLeaveConfirm: "Leave {org}? You will need an invitation to come back.",
     memberInviteAgain: "Send the invitation again",
     memberInvitationSent: "The invitation is on its way.",
+    organization: "Organization",
+    organizationRename: "Rename",
+    organizationRenamed: "The organization is now called {name}.",
+    organizationArchive: "Archive",
+    organizationArchiveConfirm: "Archive {org}? Its members will no longer reach it, and only the workspace can restore it.",
+    organizationArchived: "{org} was archived.",
+    organizationDelete: "Delete organization",
+    organizationDeleteConfirm: "Delete {org} for good? Its members lose it and this cannot be undone.",
+    organizationDeleted: "{org} was deleted.",
     yes: "Yes",
     cancel: "Cancel",
     errors: {
       not_allowed: "Your role in this organization does not allow that.",
       last_manager: "Somebody else must manage the members first: give that role to another member.",
+      last_owner: "An organization keeps at least one owner: make another member owner first.",
+      organization_not_found: "That organization no longer exists.",
       already_member: "That person already belongs to the organization. Change their role instead.",
       unknown_role: "Choose one of the roles offered.",
       user_not_active: "That account is disabled.",
@@ -828,7 +895,9 @@ var TEXTS = {
       invalid_assertion: "Your company's answer could not be checked. Try again.",
       provisioning_disabled: "Your company's sign-in worked, but this workspace has no account for you. Ask its admin to add you.",
       connection_inactive: "Your company's sign-in is turned off for this workspace.",
-      invalid_grant: "That sign-in expired. Try again."
+      invalid_grant: "That sign-in expired. Try again.",
+      password_disabled: "This workspace does not sign in with a password. Use one of the other ways.",
+      passkeys_disabled: "Passkeys are turned off for this workspace."
     }
   },
   es: {
@@ -881,6 +950,13 @@ var TEXTS = {
     passwordChanged: "Tu contrase\xF1a se cambi\xF3. Ya puedes entrar con ella.",
     confirming: "Confirmando tu correo\u2026",
     emailConfirmed: "Tu correo qued\xF3 confirmado. Ya puedes entrar.",
+    invitedTo: "Te invitaron a {workspace}",
+    invitedToOrganization: "Te invitaron a {organization} en {workspace}",
+    invitedAs: "Vas a entrar como {email}.",
+    choosePassword: "Elige una contrase\xF1a",
+    acceptInvite: "Aceptar y entrar",
+    openingInvitation: "Abriendo tu invitaci\xF3n\u2026",
+    invitationInvalid: "Esta invitaci\xF3n no es v\xE1lida: ya se us\xF3 o venci\xF3. P\xEDdele a quien te invit\xF3 que te la env\xEDe de nuevo.",
     profile: "Perfil",
     save: "Guardar",
     saved: "Guardado.",
@@ -941,11 +1017,22 @@ var TEXTS = {
     memberLeaveConfirm: "\xBFSalir de {org}? Necesitar\xE1s una invitaci\xF3n para volver.",
     memberInviteAgain: "Enviar la invitaci\xF3n de nuevo",
     memberInvitationSent: "La invitaci\xF3n va en camino.",
+    organization: "Organizaci\xF3n",
+    organizationRename: "Cambiar nombre",
+    organizationRenamed: "La organizaci\xF3n ahora se llama {name}.",
+    organizationArchive: "Archivar",
+    organizationArchiveConfirm: "\xBFArchivar {org}? Sus miembros ya no podr\xE1n entrar y solo el espacio de trabajo puede restaurarla.",
+    organizationArchived: "{org} qued\xF3 archivada.",
+    organizationDelete: "Eliminar organizaci\xF3n",
+    organizationDeleteConfirm: "\xBFEliminar {org} para siempre? Sus miembros la pierden y no se puede deshacer.",
+    organizationDeleted: "{org} qued\xF3 eliminada.",
     yes: "S\xED",
     cancel: "Cancelar",
     errors: {
       not_allowed: "Tu rol en esta organizaci\xF3n no permite eso.",
       last_manager: "Primero alguien m\xE1s debe administrar los miembros: dale ese rol a otro miembro.",
+      last_owner: "Una organizaci\xF3n conserva al menos un propietario: primero haz propietario a otro miembro.",
+      organization_not_found: "Esa organizaci\xF3n ya no existe.",
       already_member: "Esa persona ya pertenece a la organizaci\xF3n. Cambia su rol.",
       unknown_role: "Escoge uno de los roles ofrecidos.",
       user_not_active: "Esa cuenta est\xE1 desactivada.",
@@ -984,7 +1071,9 @@ var TEXTS = {
       invalid_assertion: "No se pudo verificar la respuesta de tu empresa. Intenta de nuevo.",
       provisioning_disabled: "El ingreso con tu empresa funcion\xF3, pero este workspace no tiene una cuenta para ti. P\xEDdele a su admin que te agregue.",
       connection_inactive: "El inicio de sesi\xF3n de tu empresa est\xE1 apagado en este workspace.",
-      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo."
+      invalid_grant: "Ese ingreso venci\xF3. Intenta de nuevo.",
+      password_disabled: "En este workspace no se entra con contrase\xF1a. Usa una de las otras formas.",
+      passkeys_disabled: "Las llaves de acceso est\xE1n desactivadas en este workspace."
     }
   }
 };
@@ -1179,23 +1268,16 @@ function useMailedToken(name, open) {
     open(takeToken(name));
   }, []);
 }
-function SignIn(props) {
-  const auth = useAuth();
-  const f = useForm(props);
-  const [methods, setMethods] = useState(null);
-  const [email, setEmail] = useState("");
-  const [password, setPassword] = useState("");
+function SecondStepForm(p) {
+  const { f, auth } = p;
   const [code, setCode] = useState("");
-  const [step, setStep] = useState("password");
-  const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
   const [phoneWay, setPhoneWay] = useState(null);
   const [phoneSent, setPhoneSent] = useState("");
   useEffect(() => {
-    if (step !== "code") return;
     void auth.signIn.mfaMethods().then((r) => {
       if (r.ok) setPhoneWay({ totp: r.totp, phone: r.phone, push: r.push, email: r.email });
     });
-  }, [step]);
+  }, []);
   const sendEmail = async () => {
     f.setBusy(true);
     f.setError(null);
@@ -1231,6 +1313,55 @@ function SignIn(props) {
     if (!r.ok) return f.setError(r.error);
     setPhoneSent(r.sentTo);
   };
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.signIn.mfa({ code });
+    f.setBusy(false);
+    if (!r.ok) return f.setError(r.error);
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const to = phoneWay?.phone?.number ?? "";
+  return /* @__PURE__ */ jsxs("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.email ? f.t.codeHelpEmail.replace("{to}", phoneWay.email.to) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
+    general && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    phoneWay?.email && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendEmail(), children: f.t.sendEmailAgain }),
+    pushNumber > 0 ? /* @__PURE__ */ jsxs("div", { className: f.cx("notice"), role: "status", "aria-live": "polite", children: [
+      /* @__PURE__ */ jsx("p", { children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
+      /* @__PURE__ */ jsx("p", { style: { fontSize: 48, fontWeight: 700, margin: "4px 0", textAlign: "center" }, children: pushNumber }),
+      /* @__PURE__ */ jsx("p", { children: f.t.pushWaiting })
+    ] }) : phoneWay?.push && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("button"), onClick: () => void sendPush(), children: f.t.pushSend }),
+    phoneWay?.phone && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendCode(), children: (phoneWay.phone.channel === "whatsapp" ? f.t.sendCodeWhatsapp : f.t.sendCodeSms).replace("{to}", to) }),
+    /* @__PURE__ */ jsx(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
+    /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
+  ] });
+}
+function ProviderButtons(p) {
+  const { f } = p;
+  return /* @__PURE__ */ jsx(Fragment, { children: p.providers.map((provider) => /* @__PURE__ */ jsxs(f.Button, { type: "button", className: f.cx("providerButton"), onClick: () => p.onPick(provider.id), children: [
+    provider.iconUrl && /* @__PURE__ */ jsx("img", { src: provider.iconUrl, alt: "", width: 18, height: 18, className: f.cx("providerIcon") }),
+    f.t.continueWith,
+    " ",
+    provider.name
+  ] }, provider.id)) });
+}
+function signInOffers(methods) {
+  const password = methods?.passwordSignIn !== false;
+  return { password, email: password || methods?.magicLink === true || methods?.sso === true, passkey: methods?.passkey === true };
+}
+function SignIn(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [methods, setMethods] = useState(null);
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [code, setCode] = useState("");
+  const [step, setStep] = useState("password");
+  const challenge = useChallenge(methods?.captchaSiteKey, props.locale);
+  const offers = signInOffers(methods);
+  const passwordOn = offers.password;
   const autofill = useRef(null);
   const [offer, setOffer] = useState(0);
   const [company, setCompany] = useState(null);
@@ -1282,10 +1413,18 @@ function SignIn(props) {
   const submit = async (e) => {
     e.preventDefault();
     autofill.current?.abort();
+    if (step === "password" && company?.enforced) {
+      f.setError(null);
+      return toCompany();
+    }
+    if (step === "password" && !passwordOn) {
+      if (company) return toCompany();
+      if (methods?.magicLink) return sendLink();
+      return;
+    }
     f.setBusy(true);
     f.setError(null);
-    if (step === "password" && company?.enforced) return toCompany();
-    const r = step === "code" ? await auth.signIn.mfa({ code }) : step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
+    const r = step === "sent" ? await auth.signIn.emailCode({ code }) : await auth.signIn.email({ email, password, captchaToken: challenge.token });
     f.setBusy(false);
     if (step === "password") challenge.renew();
     if (!r.ok && r.error.code === "sso_required") return toCompany();
@@ -1319,6 +1458,7 @@ function SignIn(props) {
     setStep("sent");
   };
   const general = f.error && !f.error.field ? f.error : null;
+  const asksEmail = offers.email;
   if (step === "opening") return /* @__PURE__ */ jsx("div", { className: f.cx("form"), ...f.root, "aria-busy": "true" });
   if (step === "sent") {
     return /* @__PURE__ */ jsxs("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
@@ -1329,39 +1469,20 @@ function SignIn(props) {
       /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
     ] });
   }
-  if (step === "code") {
-    const to = phoneWay?.phone?.number ?? "";
-    return /* @__PURE__ */ jsxs("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
-      /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: phoneSent ? f.t.codeSent.replace("{to}", phoneSent) : phoneWay?.email ? f.t.codeHelpEmail.replace("{to}", phoneWay.email.to) : phoneWay?.phone && !phoneWay.totp ? f.t.codeHelpPhone : f.t.codeHelp }),
-      general && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-      phoneWay?.email && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendEmail(), children: f.t.sendEmailAgain }),
-      pushNumber > 0 ? /* @__PURE__ */ jsxs("div", { className: f.cx("notice"), role: "status", "aria-live": "polite", children: [
-        /* @__PURE__ */ jsx("p", { children: f.t.pushPick.replace("{n}", String(pushNumber)) }),
-        /* @__PURE__ */ jsx("p", { style: { fontSize: 48, fontWeight: 700, margin: "4px 0", textAlign: "center" }, children: pushNumber }),
-        /* @__PURE__ */ jsx("p", { children: f.t.pushWaiting })
-      ] }) : phoneWay?.push && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("button"), onClick: () => void sendPush(), children: f.t.pushSend }),
-      phoneWay?.phone && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendCode(), children: (phoneWay.phone.channel === "whatsapp" ? f.t.sendCodeWhatsapp : f.t.sendCodeSms).replace("{to}", to) }),
-      /* @__PURE__ */ jsx(Field, { f, name: "code", type: "text", label: f.t.code, value: code, autoComplete: "one-time-code", required: true, onChange: setCode }),
-      /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.verify })
-    ] });
-  }
+  if (step === "code") return /* @__PURE__ */ jsx(SecondStepForm, { f, auth });
   return /* @__PURE__ */ jsxs("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
     general && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
-    (methods?.providers ?? []).map((p) => /* @__PURE__ */ jsxs(f.Button, { type: "button", className: f.cx("providerButton"), onClick: () => auth.signIn.social(p.id, { returnTo: props.returnTo }), children: [
-      f.t.continueWith,
-      " ",
-      p.name
-    ] }, p.id)),
-    methods?.passkey && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
-    ((methods?.providers.length ?? 0) > 0 || methods?.passkey) && /* @__PURE__ */ jsx("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
-    /* @__PURE__ */ jsx(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
+    /* @__PURE__ */ jsx(ProviderButtons, { f, providers: methods?.providers ?? [], onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+    offers.passkey && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void usePasskey(), children: f.t.usePasskey }),
+    asksEmail && ((methods?.providers.length ?? 0) > 0 || offers.passkey) && /* @__PURE__ */ jsx("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
+    asksEmail && /* @__PURE__ */ jsx(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: methods?.passkeyHere ? "username webauthn" : "username", required: true, onChange: setEmail }),
     company && /* @__PURE__ */ jsxs(f.Button, { type: "button", disabled: f.busy, className: f.cx(company.enforced ? "button" : "providerButton"), onClick: toCompany, children: [
       f.t.continueWith,
       " ",
       company.name
     ] }),
     company?.enforced && /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.ssoOnly }),
-    !company?.enforced && /* @__PURE__ */ jsxs(Fragment, { children: [
+    !company?.enforced && passwordOn && /* @__PURE__ */ jsxs(Fragment, { children: [
       /* @__PURE__ */ jsx(
         Field,
         {
@@ -1379,6 +1500,7 @@ function SignIn(props) {
       challenge.node,
       /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signIn })
     ] }),
+    !company?.enforced && !passwordOn && methods?.magicLink && challenge.node,
     methods?.magicLink && !company?.enforced && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void sendLink(), children: f.t.emailMeALink }),
     methods?.signUp !== false && props.links?.signUp && /* @__PURE__ */ jsxs("p", { className: f.cx("footer"), children: [
       f.t.noAccount,
@@ -1438,14 +1560,30 @@ function SignUp(props) {
     f.done();
   };
   const general = f.error && !f.error.field ? f.error : null;
+  const passwordOn = methods?.passwordSignIn !== false;
+  const providers = auth.session?.user.isAnonymous === true || methods?.organization?.required ? [] : methods?.providers ?? [];
   if (sent) {
     return /* @__PURE__ */ jsxs("div", { className: f.cx("form"), ...f.root, children: [
       /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.checkEmail }),
       props.links?.signIn && /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn })
     ] });
   }
+  const footer = props.links?.signIn && /* @__PURE__ */ jsxs("p", { className: f.cx("footer"), children: [
+    f.t.haveAccount,
+    " ",
+    /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.signIn })
+  ] });
+  if (!passwordOn) {
+    return /* @__PURE__ */ jsxs("div", { className: f.cx("form"), ...f.root, children: [
+      general && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+      /* @__PURE__ */ jsx(ProviderButtons, { f, providers, onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+      footer
+    ] });
+  }
   return /* @__PURE__ */ jsxs("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
     general && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ jsx(ProviderButtons, { f, providers, onPick: (id) => auth.signIn.social(id, { returnTo: props.returnTo }) }),
+    providers.length > 0 && /* @__PURE__ */ jsx("p", { className: f.cx("separator"), children: f.t.orWithEmail }),
     methods?.organization?.ask && /* @__PURE__ */ jsx(Field, { f, name: "organization", type: "text", label: f.t.company, value: organization, autoComplete: "organization", required: methods.organization.required, onChange: setOrganization }),
     /* @__PURE__ */ jsx(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "name", onChange: setName }),
     /* @__PURE__ */ jsx(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "username", required: true, onChange: setEmail }),
@@ -1471,11 +1609,7 @@ function SignUp(props) {
     ] }, p.key)),
     challenge.node,
     /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.signUp }),
-    props.links?.signIn && /* @__PURE__ */ jsxs("p", { className: f.cx("footer"), children: [
-      f.t.haveAccount,
-      " ",
-      /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.signIn })
-    ] })
+    footer
   ] });
 }
 function ForgotPassword(props) {
@@ -1572,6 +1706,62 @@ function VerifyEmail(props) {
     state !== "confirming" && props.links?.signIn && /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn })
   ] });
 }
+function AcceptInvite(props) {
+  const auth = useAuth();
+  const f = useForm(props);
+  const [token, setToken] = useState("");
+  const [invitation, setInvitation] = useState(null);
+  const [state, setState] = useState("opening");
+  const [password, setPassword] = useState("");
+  usePasswordPolicy(f, useMethods(auth));
+  useMailedToken("token", (t) => {
+    if (!t) return setState("invalid");
+    setToken(t);
+    void auth.invitation(t).then((r) => {
+      if (r.ok) {
+        setInvitation(r.invitation);
+        return setState("ready");
+      }
+      if (r.error.code !== "invalid_token") f.setError(r.error);
+      setState("invalid");
+    });
+  });
+  const submit = async (e) => {
+    e.preventDefault();
+    f.setBusy(true);
+    f.setError(null);
+    const r = await auth.acceptInvitation(token, password);
+    f.setBusy(false);
+    if (!r.ok) {
+      if (r.error.code === "invalid_token") return setState("invalid");
+      return f.setError(r.error);
+    }
+    if (r.status === "mfa_required") return setState("code");
+    f.done();
+  };
+  const general = f.error && !f.error.field ? f.error : null;
+  const back = props.links?.signIn && /* @__PURE__ */ jsx("a", { className: f.cx("link"), href: props.links.signIn, children: f.t.backToSignIn });
+  if (state === "opening") {
+    return /* @__PURE__ */ jsx("div", { className: f.cx("form"), ...f.root, "aria-busy": "true", children: /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.openingInvitation }) });
+  }
+  if (state === "invalid") {
+    return /* @__PURE__ */ jsxs("div", { className: f.cx("form"), ...f.root, children: [
+      /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: general ? f.say(general) : f.t.invitationInvalid }),
+      back
+    ] });
+  }
+  if (state === "code") return /* @__PURE__ */ jsx(SecondStepForm, { f, auth });
+  const workspace = invitation?.workspace ?? "";
+  const heading = invitation?.organization ? f.t.invitedToOrganization.replace("{organization}", invitation.organization).replace("{workspace}", workspace) : f.t.invitedTo.replace("{workspace}", workspace);
+  return /* @__PURE__ */ jsxs("form", { className: f.cx("form"), ...f.root, onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ jsx("h2", { className: f.cx("heading"), children: heading }),
+    /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.invitedAs.replace("{email}", invitation?.email ?? "") }),
+    general && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ jsx("input", { type: "email", name: "username", autoComplete: "username", value: invitation?.email ?? "", readOnly: true, hidden: true }),
+    /* @__PURE__ */ jsx(Field, { f, name: "password", type: "password", label: f.t.choosePassword, value: password, autoComplete: "new-password", required: true, onChange: setPassword, hint: f.passwordRule }),
+    /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.acceptInvite })
+  ] });
+}
 function useSection(props) {
   const f = useForm({ ...props, unstyled: true });
   const [done, setDone] = useState(null);
@@ -1622,32 +1812,52 @@ function Account(props) {
     ] })
   ] });
 }
+var OWNER = "owner";
+function memberActions(seat, m) {
+  const reachable = m.role !== OWNER || seat.role === OWNER;
+  return {
+    changeRole: seat.can.manageMembers && reachable,
+    // Leaving is anybody's; removing somebody else is cauthy:members:remove.
+    remove: m.you || seat.can.removeMembers && reachable,
+    inviteAgain: seat.can.manageMembers && m.invited
+  };
+}
+function rolesToGive(seat, roles) {
+  return seat.role === OWNER ? roles : roles.filter((c) => c.role !== OWNER);
+}
 function OrganizationMembers(props) {
   const auth = useAuth();
   const { root } = useForm(props);
   const { f, done, setDone, run } = useSection(props);
-  const problem = f.error && f.error.field !== "email" ? f.error : null;
+  const problem = f.error && f.error.field !== "email" && f.error.field !== "name" ? f.error : null;
   const [seat, setSeat] = useState(void 0);
   const [members, setMembers] = useState(null);
   const [roles, setRoles] = useState([]);
   const [email, setEmail] = useState("");
   const [role, setRole] = useState("");
+  const [name, setName] = useState("");
   const [asking, setAsking] = useState(null);
+  const [gone, setGone] = useState(null);
   const id = props.organizationId;
   const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleDateString());
   const load = async () => {
     const [list, people, choices] = await Promise.all([auth.organizations.list(), auth.organizations.members(id), auth.organizations.roles(id)]);
-    setSeat(list.find((o) => o.id === id) ?? null);
+    const mine = list.find((o) => o.id === id) ?? null;
+    setSeat(mine);
+    if (mine) setName(mine.name);
     setMembers(people);
     setRoles(choices ?? []);
-    if (choices && choices.length > 0 && !choices.some((c) => c.role === role)) setRole(choices[0].role);
+    const offered = mine ? rolesToGive(mine, choices ?? []) : [];
+    if (offered.length > 0 && !offered.some((c) => c.role === role)) setRole(offered[0].role);
   };
   useEffect(() => {
     void load();
   }, [id]);
+  if (gone !== null) return /* @__PURE__ */ jsx("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ jsx("p", { role: "status", className: f.cx("notice"), children: gone }) });
   if (seat === void 0) return /* @__PURE__ */ jsx("div", { className: f.cx("account"), ...root, "aria-busy": "true" });
   if (seat === null) return /* @__PURE__ */ jsx("div", { className: f.cx("account"), ...root, children: /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.organizationMissing }) });
   const manage = seat.can.manageMembers;
+  const giveable = rolesToGive(seat, roles);
   const label = (r) => roles.find((c) => c.role === r)?.name || r;
   const add = async (e) => {
     e.preventDefault();
@@ -1672,6 +1882,25 @@ function OrganizationMembers(props) {
     const r = await run(() => auth.organizations.inviteAgain(id, m.userId, { locale: props.locale }));
     if (r.ok) setDone(f.t.memberInvitationSent);
   };
+  const rename = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.organizations.rename(id, name));
+    if (!r.ok) return;
+    setSeat(r.organization);
+    setName(r.organization.name);
+    setDone(f.t.organizationRenamed.replace("{name}", r.organization.name));
+  };
+  const close = async (how) => {
+    setAsking(null);
+    const r = await run(() => how === "archive" ? auth.organizations.archive(id) : auth.organizations.delete(id));
+    if (r.ok) setGone((how === "archive" ? f.t.organizationArchived : f.t.organizationDeleted).replace("{org}", seat.name));
+  };
+  const confirming = (text2, label2, yes) => /* @__PURE__ */ jsxs("span", { role: "group", "aria-label": label2, children: [
+    /* @__PURE__ */ jsx("span", { children: text2 }),
+    " ",
+    /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: yes, children: f.t.yes }),
+    /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
+  ] });
   return /* @__PURE__ */ jsxs("div", { className: f.cx("account"), ...root, children: [
     /* @__PURE__ */ jsxs("section", { className: f.cx("section"), children: [
       /* @__PURE__ */ jsxs("h2", { className: f.cx("heading"), children: [
@@ -1682,23 +1911,14 @@ function OrganizationMembers(props) {
       problem && /* @__PURE__ */ jsx("p", { role: "alert", className: f.cx("error"), children: f.say(problem) }),
       members === null ? /* @__PURE__ */ jsxs(Fragment, { children: [
         /* @__PURE__ */ jsx("p", { className: f.cx("notice"), children: f.t.membersHidden }),
-        auth.session && (asking === auth.session.user.id ? /* @__PURE__ */ jsxs("span", { role: "group", "aria-label": f.t.memberLeave, children: [
-          /* @__PURE__ */ jsx("span", { children: f.t.memberLeaveConfirm.replace("{org}", seat.name) }),
-          " ",
-          /* @__PURE__ */ jsx(
-            f.Button,
-            {
-              type: "button",
-              disabled: f.busy,
-              className: f.cx("providerButton"),
-              onClick: () => void remove({ userId: auth.session.user.id, you: true }),
-              children: f.t.yes
-            }
-          ),
-          /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
-        ] }) : /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(auth.session.user.id), children: f.t.memberLeave }))
+        auth.session && (asking === auth.session.user.id ? confirming(
+          f.t.memberLeaveConfirm.replace("{org}", seat.name),
+          f.t.memberLeave,
+          () => void remove({ userId: auth.session.user.id, you: true })
+        ) : /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(auth.session.user.id), children: f.t.memberLeave }))
       ] }) : /* @__PURE__ */ jsx("ul", { className: f.cx("sessions"), children: members.map((m) => {
         const who = m.name || m.email;
+        const may = memberActions(seat, m);
         return /* @__PURE__ */ jsxs("li", { className: f.cx("session"), children: [
           /* @__PURE__ */ jsxs("span", { children: [
             who,
@@ -1710,7 +1930,7 @@ function OrganizationMembers(props) {
             when(m.since)
           ] }),
           " ",
-          manage && roles.length > 0 ? /* @__PURE__ */ jsx(
+          may.changeRole && giveable.length > 0 ? /* @__PURE__ */ jsx(
             "select",
             {
               "aria-label": `${f.t.memberRole}: ${who}`,
@@ -1718,31 +1938,41 @@ function OrganizationMembers(props) {
               value: m.role,
               disabled: f.busy,
               onChange: (e) => void change(m, e.target.value),
-              children: roles.map((c) => /* @__PURE__ */ jsx("option", { value: c.role, children: c.name || c.role }, c.role))
+              children: (giveable.some((c) => c.role === m.role) ? giveable : [...roles.filter((c) => c.role === m.role), ...giveable]).map((c) => /* @__PURE__ */ jsx("option", { value: c.role, children: c.name || c.role }, c.role))
             }
           ) : /* @__PURE__ */ jsx("span", { children: label(m.role) }),
           " ",
-          asking === m.userId ? /* @__PURE__ */ jsxs("span", { role: "group", "aria-label": m.you ? f.t.memberLeave : f.t.memberRemove, children: [
-            /* @__PURE__ */ jsx("span", { children: m.you ? f.t.memberLeaveConfirm.replace("{org}", seat.name) : f.t.memberRemoveConfirm.replace("{who}", who) }),
-            " ",
-            /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void remove(m), children: f.t.yes }),
-            /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(null), children: f.t.cancel })
-          ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-            manage && m.invited && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
-            (manage || m.you) && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(m.userId), children: m.you ? f.t.memberLeave : f.t.memberRemove })
+          asking === m.userId ? confirming(
+            m.you ? f.t.memberLeaveConfirm.replace("{org}", seat.name) : f.t.memberRemoveConfirm.replace("{who}", who),
+            m.you ? f.t.memberLeave : f.t.memberRemove,
+            () => void remove(m)
+          ) : /* @__PURE__ */ jsxs(Fragment, { children: [
+            may.inviteAgain && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void inviteAgain(m), children: f.t.memberInviteAgain }),
+            may.remove && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking(m.userId), children: m.you ? f.t.memberLeave : f.t.memberRemove })
           ] })
         ] }, m.userId);
       }) }),
       done && /* @__PURE__ */ jsx("p", { role: "status", className: f.cx("notice"), children: done })
     ] }),
-    manage && roles.length > 0 && /* @__PURE__ */ jsxs("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
+    manage && giveable.length > 0 && /* @__PURE__ */ jsxs("form", { className: f.cx("section"), onSubmit: add, noValidate: true, children: [
       /* @__PURE__ */ jsx("h2", { className: f.cx("heading"), children: f.t.memberAdd }),
       /* @__PURE__ */ jsx(Field, { f, name: "email", type: "email", label: f.t.email, value: email, autoComplete: "off", required: true, onChange: setEmail }),
       /* @__PURE__ */ jsxs("label", { className: f.cx("field"), children: [
         /* @__PURE__ */ jsx("span", { className: f.cx("label"), children: f.t.memberRole }),
-        /* @__PURE__ */ jsx("select", { name: "role", className: f.cx("input"), value: role, onChange: (e) => setRole(e.target.value), children: roles.map((c) => /* @__PURE__ */ jsx("option", { value: c.role, children: c.name || c.role }, c.role)) })
+        /* @__PURE__ */ jsx("select", { name: "role", className: f.cx("input"), value: role, onChange: (e) => setRole(e.target.value), children: giveable.map((c) => /* @__PURE__ */ jsx("option", { value: c.role, children: c.name || c.role }, c.role)) })
       ] }),
       /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.memberAdd })
+    ] }),
+    (seat.can.update || seat.can.archive || seat.can.delete) && /* @__PURE__ */ jsxs("section", { className: f.cx("section"), children: [
+      /* @__PURE__ */ jsx("h2", { className: f.cx("heading"), children: f.t.organization }),
+      seat.can.update && /* @__PURE__ */ jsxs("form", { onSubmit: rename, noValidate: true, children: [
+        /* @__PURE__ */ jsx(Field, { f, name: "name", type: "text", label: f.t.name, value: name, autoComplete: "organization", required: true, onChange: setName }),
+        /* @__PURE__ */ jsx(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.organizationRename })
+      ] }),
+      asking === "archive" ? confirming(f.t.organizationArchiveConfirm.replace("{org}", seat.name), f.t.organizationArchive, () => void close("archive")) : asking === "delete" ? confirming(f.t.organizationDeleteConfirm.replace("{org}", seat.name), f.t.organizationDelete, () => void close("delete")) : /* @__PURE__ */ jsxs(Fragment, { children: [
+        seat.can.archive && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking("archive"), children: f.t.organizationArchive }),
+        seat.can.delete && /* @__PURE__ */ jsx(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => setAsking("delete"), children: f.t.organizationDelete })
+      ] })
     ] })
   ] });
 }
@@ -2179,6 +2409,8 @@ function useAuth() {
         googleOneTap: (o) => then(client.signIn.googleOneTap(o))
       },
       signUp: { email: (f) => then(client.signUp.email(f)) },
+      // The invited person is signed in once they accept.
+      acceptInvitation: (token, password) => then(client.acceptInvitation(token, password)),
       signOut: () => then(client.signOut()),
       account: {
         ...client.account,
@@ -2196,6 +2428,7 @@ function useAuth() {
   }, [basePath, refresh, session, status]);
 }
 export {
+  AcceptInvite,
   Account,
   CauthyProvider,
   ForgotPassword,