cauthy-auth 0.28.1 → 0.31.0

package/dist/styles.css

@@ -158,6 +158,14 @@
   border: 1px solid var(--cauthy-input-border);
 }
 
+/* A provider's logo, before "Continue with …". */
+:where([data-cauthy] .cauthy-providerIcon) {
+  flex: none;
+  width: 18px;
+  height: 18px;
+  object-fit: contain;
+}
+
 :where([data-cauthy] .cauthy-button:hover:not(:disabled)),
 :where([data-cauthy] .cauthy-providerButton:hover:not(:disabled)) {
   filter: brightness(0.94);

package/dist/svelte.d.mts

@@ -1,7 +1,7 @@
 import { SessionStore, SessionState, SessionStoreOptions } from './client.mjs';
 export { Account, AccountSession, AuthClient, AuthError, AuthMethods, AuthResult, Passkey, PasskeyKind, SSOConnection } from './client.mjs';
-import { i as PublicSession } from './system-CVBW_AV8.mjs';
-export { P as PermissionOf, f as Policy, R as RoleOf, k as SessionOrganization, m as SessionUser, p as can, r as definePolicy } from './system-CVBW_AV8.mjs';
+import { q as PublicSession } from './system-BrrJsrFW.mjs';
+export { P as PermissionOf, m as Policy, R as RoleOf, s as SessionOrganization, u as SessionUser, y as can, B as definePolicy } from './system-BrrJsrFW.mjs';
 import './theme.mjs';
 import './validate-sEXG82po.mjs';
 import 'jose';

package/dist/svelte.d.ts

@@ -1,7 +1,7 @@
 import { SessionStore, SessionState, SessionStoreOptions } from './client.js';
 export { Account, AccountSession, AuthClient, AuthError, AuthMethods, AuthResult, Passkey, PasskeyKind, SSOConnection } from './client.js';
-import { i as PublicSession } from './system-Bn8uckvQ.js';
-export { P as PermissionOf, f as Policy, R as RoleOf, k as SessionOrganization, m as SessionUser, p as can, r as definePolicy } from './system-Bn8uckvQ.js';
+import { q as PublicSession } from './system-BvvoNs2y.js';
+export { P as PermissionOf, m as Policy, R as RoleOf, s as SessionOrganization, u as SessionUser, y as can, B as definePolicy } from './system-BvvoNs2y.js';
 import './theme.js';
 import './validate-sEXG82po.js';
 import 'jose';

package/dist/svelte.js

@@ -282,6 +282,12 @@ function checkOrganization(value, required = false) {
   if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
   return null;
 }
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -366,11 +372,11 @@ function createAuthClient(options = {}) {
       if (res.ok) {
         const m = await res.json();
         if (m.password) policy = passwordPolicyOf(m.password);
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passwordSignIn: m.passwordSignIn !== false, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
+    return { providers: [], signUp: true, passwordSignIn: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -517,6 +523,20 @@ function createAuthClient(options = {}) {
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
+    async invitation(token) {
+      const bad = { ok: false, error: { code: "invalid_token", message: "This invitation is not valid, or it has expired." } };
+      if (typeof token !== "string" || token.trim() === "") return bad;
+      try {
+        const res = await doFetch(`${base}/invitation?token=${encodeURIComponent(token.trim())}`, { credentials: "same-origin", headers: { accept: "application/json" } });
+        const body = await res.json().catch(() => null);
+        if (res.ok && body?.invitation) return { ok: true, status: "ok", invitation: body.invitation };
+        const e = body?.error;
+        return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? "") } : UNAVAILABLE };
+      } catch {
+        return { ok: false, error: UNAVAILABLE };
+      }
+    },
+    acceptInvitation: (token, password) => post("/invitation/accept", { token, password }, checkNewPassword(password, policy)),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
       async list(system) {
@@ -534,7 +554,23 @@ function createAuthClient(options = {}) {
       add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
       setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
       remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
-      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null),
+      rename: (id, name) => post("/me/organizations/rename", { organizationId: id, name }, checkOrganizationName(name)),
+      archive: (id) => post("/me/organizations/archive", { organizationId: id }, null),
+      delete: (id) => post("/me/organizations/delete", { organizationId: id }, null),
+      async check(q) {
+        const organizationId = typeof q.organization === "string" ? q.organization : q.organization?.id ?? "";
+        const r = await post("/me/organizations/check", {
+          organizationId,
+          resource: q.resource,
+          action: q.action,
+          ...q.attributes !== void 0 ? { attributes: q.attributes } : {},
+          ...q.resourceId !== void 0 ? { resourceId: q.resourceId } : {},
+          ...q.ownerId !== void 0 ? { ownerId: q.ownerId } : {}
+        }, null);
+        if (!r.ok) return { allowed: false, reason: r.error.message, error: r.error };
+        return { allowed: r.allowed === true, reason: String(r.reason ?? ""), ...r.rule ? { rule: r.rule } : {} };
+      }
     },
     account: {
       async get() {
@@ -738,7 +774,9 @@ function can(organization, resource, action) {
   if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false;
   return organization.permissions.some((p) => matches(p, resource, action));
 }
-function definePolicy(roles) {
+function definePolicy(given) {
+  const roles = Array.isArray(given) ? given : given.roles;
+  const resources = Array.isArray(given) ? [] : given.catalog ?? [];
   const entry = (p) => `${p.resource}:${p.action}`;
   const byName = new Map(roles.map((r) => [r.role, r]));
   const split = (permission) => {
@@ -753,6 +791,12 @@ function definePolicy(roles) {
       ...r.inherits ? { inherits: [...r.inherits] } : {},
       ...r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}
     })),
+    catalog: resources.map((c) => ({
+      resource: c.resource,
+      ...c.description !== void 0 ? { description: c.description } : {},
+      actions: [...c.actions],
+      ...c.attributes ? { attributes: { ...c.attributes } } : {}
+    })),
     roleNames: roles.map((r) => r.role),
     permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],
     can(organization, permission) {
@@ -774,6 +818,11 @@ function definePolicy(roles) {
       };
       walk(role);
       return [...out];
+    },
+    // The types did the work; this only hands the question on, as a method of
+    // the asker so it keeps its `this`.
+    check(asker, ...args) {
+      return asker.check(...args);
     }
   };
 }