cauthy-auth 0.28.1 → 0.31.0

package/dist/client.d.mts

@@ -1,5 +1,6 @@
 import { CauthyTheme } from './theme.mjs';
-import { i as PublicSession } from './system-CVBW_AV8.mjs';
+import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-BrrJsrFW.mjs';
+export { h as CheckRule } from './system-BrrJsrFW.mjs';
 import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.mjs';
 export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.mjs';
 import 'jose';
@@ -73,11 +74,25 @@ type AuthResult<S extends string, More = unknown> = ({
 };
 /** What the screen may offer. */
 interface AuthMethods {
-    /** The providers the workspace signs people in with: `{ id: 'google', name: 'Google' }`. */
+    /**
+     * The providers the workspace signs people in with and has turned on:
+     * `{ id: 'google', name: 'Google', iconUrl: 'https://…/v1/social/icons/google.svg' }`.
+     * `iconUrl` is the provider's logo, served by Cauthy; absent from a Cauthy
+     * that does not serve logos.
+     */
     providers: {
         id: string;
         name: string;
+        iconUrl?: string;
     }[];
+    /**
+     * Whether the workspace signs people in with a password. False: the
+     * password field, "forgot your password" and a sign-up with a password are
+     * not offered, and Cauthy refuses them (`password_disabled`). True from a
+     * server that does not say. (`password` is something else: the policy a new
+     * password must meet.)
+     */
+    passwordSignIn: boolean;
     /** Whether people may create an account themselves. */
     signUp: boolean;
     /** Set when the application's system makes an organization per sign-up: the form asks the company's name. */
@@ -86,7 +101,7 @@ interface AuthMethods {
         required: boolean;
     };
     magicLink: boolean;
-    /** Whether to offer a passkey. */
+    /** Whether to offer a passkey. False when the workspace turned passkeys off. */
     passkey: boolean;
     /**
      * Whether the passkey is used on this page itself. False: `signIn.passkey`
@@ -138,6 +153,15 @@ interface AuthMethods {
      */
     password?: PasswordPolicy;
 }
+/** An invitation, as its page shows it before the person chooses a password. */
+interface Invitation {
+    /** The address invited: the account the person signs in as. */
+    email: string;
+    /** The workspace's name. */
+    workspace: string;
+    /** The organization the person was invited to, when there is one. */
+    organization?: string;
+}
 /** A legal document the person owes: not yet accepted in its current version. */
 interface PendingLegal {
     kind: string;
@@ -201,19 +225,29 @@ interface ConnectedAgent {
     connectedAt: string;
     lastUsedAt: string;
 }
-/** An organization the person belongs to, with what their role lets them do with its people. */
+/** An organization the person belongs to, with what their role lets them do with it and its people. */
 interface OrganizationSeat {
     id: string;
-    /** The client system it is of (`pondari`). */
+    /** The client system it is of (`acme-crm`). */
     system: string;
     name: string;
     kind: string;
     /** The person's role in it. */
     role: string;
-    /** Cauthy's member powers, from the system's catalog: cauthy:members read and manage. */
+    /**
+     * Cauthy's reserved powers, from the system's catalog. `manageMembers`
+     * (cauthy:members:manage) adds, invites and changes roles; removing another
+     * member is `removeMembers` (cauthy:members:remove), and anybody may leave.
+     * `update`, `archive` and `delete` are cauthy:organization's: rename it,
+     * archive it, delete it for good.
+     */
     can: {
         readMembers: boolean;
         manageMembers: boolean;
+        removeMembers: boolean;
+        update: boolean;
+        archive: boolean;
+        delete: boolean;
     };
 }
 /** A person of an organization, as a member who may see them reads it. */
@@ -243,8 +277,12 @@ interface OrganizationRoleChoice {
 }
 /**
  * The signed-in person's organizations, and their people. Seeing them needs
- * cauthy:members read in the person's role; changing them needs manage. Cauthy
- * decides, with the person's own session: the application authorizes nothing.
+ * cauthy:members read in the person's role; changing them needs manage, and
+ * removing someone needs remove. The organization itself is renamed, archived
+ * or deleted with cauthy:organization update, archive or delete. Only an
+ * `owner` gives the owner role or changes an owner, and the last owner stays
+ * (`last_owner`). Cauthy decides, with the person's own session: the
+ * application authorizes nothing.
  */
 interface OrganizationsClient {
     /** The organizations the person belongs to; one system's only with `system`. */
@@ -276,6 +314,31 @@ interface OrganizationsClient {
     }): Promise<AuthResult<'sent', {
         userId: string;
     }>>;
+    /** Gives the organization a new name (cauthy:organization update). */
+    rename(organizationId: string, name: string): Promise<AuthResult<'renamed', {
+        organization: OrganizationSeat;
+    }>>;
+    /** Archives the organization: its members no longer reach it, and only the workspace restores it. */
+    archive(organizationId: string): Promise<AuthResult<'archived', {
+        organizationId: string;
+    }>>;
+    /** Deletes the organization for good. */
+    delete(organizationId: string): Promise<AuthResult<'deleted', {
+        organizationId: string;
+    }>>;
+    /**
+     * Asks Cauthy, through the application's server, whether the person may do
+     * an action on a resource in the organization, with what its conditions
+     * read. A question that could not be asked is a no, with `error` saying why.
+     *
+     *   const r = await organizations.check({ organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })
+     *   if (r.allowed) showApprove()
+     */
+    check(question: CheckQuestion & {
+        organization: OrganizationRef;
+    }): Promise<CheckResult & {
+        error?: AuthError;
+    }>;
 }
 interface AccountSession {
     /** "Mac · Chrome", or "" when the browser did not say. */
@@ -690,7 +753,25 @@ interface AuthClient {
         token: string;
         password: string;
     }): Promise<AuthResult<'changed'>>;
-    /** Confirms the address, with the token the mailed link opened the page with (`token`). */
+    /**
+     * Who an invitation is for and to what, with the token the mailed link
+     * opened the page with (`token`). Reading it does not spend it.
+     * `invalid_token`: unknown, spent or expired.
+     */
+    invitation(token: string): Promise<AuthResult<'ok', {
+        invitation: Invitation;
+    }>>;
+    /**
+     * Accepts an invitation with the password the person chose (the workspace's
+     * policy, as for a sign-up) and signs them in. `mfa_required`: the account
+     * owes a second step; ask for the code and call `signIn.mfa`, as after
+     * `signIn.email`. A password refused leaves the invitation good.
+     */
+    acceptInvitation(token: string, password: string): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }> | AuthResult<'mfa_required', {
+        method?: 'email';
+    }>>;
     /** Confirms the address a mailed link is for. The person is signed in from the link when their account asks no second step. */
     verifyEmail(form: {
         token: string;
@@ -725,4 +806,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, CheckQuestion, CheckResult, type ConnectedAgent, type Invitation, type LinkedIdentity, type OrganizationPerson, OrganizationRef, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -1,5 +1,6 @@
 import { CauthyTheme } from './theme.js';
-import { i as PublicSession } from './system-Bn8uckvQ.js';
+import { q as PublicSession, f as CheckQuestion, k as OrganizationRef, g as CheckResult } from './system-BvvoNs2y.js';
+export { h as CheckRule } from './system-BvvoNs2y.js';
 import { A as AuthField, b as PasswordPolicy } from './validate-sEXG82po.js';
 export { D as DEFAULT_PASSWORD_POLICY, F as FieldProblem, M as MIN_PASSWORD, P as PasswordClass, a as PasswordLocale, c as PasswordReason, d as checkCode, e as checkEmail, f as checkName, g as checkNewPassword, h as checkPassword, i as describePasswordPolicy, j as explainPasswordProblems, p as passwordPolicyOf, k as passwordProblems } from './validate-sEXG82po.js';
 import 'jose';
@@ -73,11 +74,25 @@ type AuthResult<S extends string, More = unknown> = ({
 };
 /** What the screen may offer. */
 interface AuthMethods {
-    /** The providers the workspace signs people in with: `{ id: 'google', name: 'Google' }`. */
+    /**
+     * The providers the workspace signs people in with and has turned on:
+     * `{ id: 'google', name: 'Google', iconUrl: 'https://…/v1/social/icons/google.svg' }`.
+     * `iconUrl` is the provider's logo, served by Cauthy; absent from a Cauthy
+     * that does not serve logos.
+     */
     providers: {
         id: string;
         name: string;
+        iconUrl?: string;
     }[];
+    /**
+     * Whether the workspace signs people in with a password. False: the
+     * password field, "forgot your password" and a sign-up with a password are
+     * not offered, and Cauthy refuses them (`password_disabled`). True from a
+     * server that does not say. (`password` is something else: the policy a new
+     * password must meet.)
+     */
+    passwordSignIn: boolean;
     /** Whether people may create an account themselves. */
     signUp: boolean;
     /** Set when the application's system makes an organization per sign-up: the form asks the company's name. */
@@ -86,7 +101,7 @@ interface AuthMethods {
         required: boolean;
     };
     magicLink: boolean;
-    /** Whether to offer a passkey. */
+    /** Whether to offer a passkey. False when the workspace turned passkeys off. */
     passkey: boolean;
     /**
      * Whether the passkey is used on this page itself. False: `signIn.passkey`
@@ -138,6 +153,15 @@ interface AuthMethods {
      */
     password?: PasswordPolicy;
 }
+/** An invitation, as its page shows it before the person chooses a password. */
+interface Invitation {
+    /** The address invited: the account the person signs in as. */
+    email: string;
+    /** The workspace's name. */
+    workspace: string;
+    /** The organization the person was invited to, when there is one. */
+    organization?: string;
+}
 /** A legal document the person owes: not yet accepted in its current version. */
 interface PendingLegal {
     kind: string;
@@ -201,19 +225,29 @@ interface ConnectedAgent {
     connectedAt: string;
     lastUsedAt: string;
 }
-/** An organization the person belongs to, with what their role lets them do with its people. */
+/** An organization the person belongs to, with what their role lets them do with it and its people. */
 interface OrganizationSeat {
     id: string;
-    /** The client system it is of (`pondari`). */
+    /** The client system it is of (`acme-crm`). */
     system: string;
     name: string;
     kind: string;
     /** The person's role in it. */
     role: string;
-    /** Cauthy's member powers, from the system's catalog: cauthy:members read and manage. */
+    /**
+     * Cauthy's reserved powers, from the system's catalog. `manageMembers`
+     * (cauthy:members:manage) adds, invites and changes roles; removing another
+     * member is `removeMembers` (cauthy:members:remove), and anybody may leave.
+     * `update`, `archive` and `delete` are cauthy:organization's: rename it,
+     * archive it, delete it for good.
+     */
     can: {
         readMembers: boolean;
         manageMembers: boolean;
+        removeMembers: boolean;
+        update: boolean;
+        archive: boolean;
+        delete: boolean;
     };
 }
 /** A person of an organization, as a member who may see them reads it. */
@@ -243,8 +277,12 @@ interface OrganizationRoleChoice {
 }
 /**
  * The signed-in person's organizations, and their people. Seeing them needs
- * cauthy:members read in the person's role; changing them needs manage. Cauthy
- * decides, with the person's own session: the application authorizes nothing.
+ * cauthy:members read in the person's role; changing them needs manage, and
+ * removing someone needs remove. The organization itself is renamed, archived
+ * or deleted with cauthy:organization update, archive or delete. Only an
+ * `owner` gives the owner role or changes an owner, and the last owner stays
+ * (`last_owner`). Cauthy decides, with the person's own session: the
+ * application authorizes nothing.
  */
 interface OrganizationsClient {
     /** The organizations the person belongs to; one system's only with `system`. */
@@ -276,6 +314,31 @@ interface OrganizationsClient {
     }): Promise<AuthResult<'sent', {
         userId: string;
     }>>;
+    /** Gives the organization a new name (cauthy:organization update). */
+    rename(organizationId: string, name: string): Promise<AuthResult<'renamed', {
+        organization: OrganizationSeat;
+    }>>;
+    /** Archives the organization: its members no longer reach it, and only the workspace restores it. */
+    archive(organizationId: string): Promise<AuthResult<'archived', {
+        organizationId: string;
+    }>>;
+    /** Deletes the organization for good. */
+    delete(organizationId: string): Promise<AuthResult<'deleted', {
+        organizationId: string;
+    }>>;
+    /**
+     * Asks Cauthy, through the application's server, whether the person may do
+     * an action on a resource in the organization, with what its conditions
+     * read. A question that could not be asked is a no, with `error` saying why.
+     *
+     *   const r = await organizations.check({ organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })
+     *   if (r.allowed) showApprove()
+     */
+    check(question: CheckQuestion & {
+        organization: OrganizationRef;
+    }): Promise<CheckResult & {
+        error?: AuthError;
+    }>;
 }
 interface AccountSession {
     /** "Mac · Chrome", or "" when the browser did not say. */
@@ -690,7 +753,25 @@ interface AuthClient {
         token: string;
         password: string;
     }): Promise<AuthResult<'changed'>>;
-    /** Confirms the address, with the token the mailed link opened the page with (`token`). */
+    /**
+     * Who an invitation is for and to what, with the token the mailed link
+     * opened the page with (`token`). Reading it does not spend it.
+     * `invalid_token`: unknown, spent or expired.
+     */
+    invitation(token: string): Promise<AuthResult<'ok', {
+        invitation: Invitation;
+    }>>;
+    /**
+     * Accepts an invitation with the password the person chose (the workspace's
+     * policy, as for a sign-up) and signs them in. `mfa_required`: the account
+     * owes a second step; ask for the code and call `signIn.mfa`, as after
+     * `signIn.email`. A password refused leaves the invitation good.
+     */
+    acceptInvitation(token: string, password: string): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }> | AuthResult<'mfa_required', {
+        method?: 'email';
+    }>>;
     /** Confirms the address a mailed link is for. The person is signed in from the link when their account asks no second step. */
     verifyEmail(form: {
         token: string;
@@ -725,4 +806,4 @@ interface AuthClientOptions {
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type ConnectedAgent, type LinkedIdentity, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, CheckQuestion, CheckResult, type ConnectedAgent, type Invitation, type LinkedIdentity, type OrganizationPerson, OrganizationRef, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, PasswordPolicy, type PendingLegal, type SSOConnection, type SecondStep, type SessionState, type SessionStore, type SessionStoreOptions, canAutofillPasskeys, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -294,6 +294,12 @@ function checkOrganization(value, required = false) {
   if (v.length > MAX_ORGANIZATION) return { field: "organization", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
   return null;
 }
+function checkOrganizationName(value) {
+  const v = typeof value === "string" ? value.trim() : "";
+  if (v === "") return { field: "name", code: "required", message: "Enter the organization's name." };
+  if (v.length > MAX_ORGANIZATION) return { field: "name", code: "too_long", message: `Use at most ${MAX_ORGANIZATION} characters.` };
+  return null;
+}
 function checkCode(value) {
   const v = typeof value === "string" ? value.trim() : "";
   if (v === "") return { field: "code", code: "required", message: "Enter the code." };
@@ -486,11 +492,11 @@ function createAuthClient(options = {}) {
       if (res.ok) {
         const m = await res.json();
         if (m.password) policy = passwordPolicyOf(m.password);
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passwordSignIn: m.passwordSignIn !== false, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
+    return { providers: [], signUp: true, passwordSignIn: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -637,6 +643,20 @@ function createAuthClient(options = {}) {
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
+    async invitation(token) {
+      const bad = { ok: false, error: { code: "invalid_token", message: "This invitation is not valid, or it has expired." } };
+      if (typeof token !== "string" || token.trim() === "") return bad;
+      try {
+        const res = await doFetch(`${base}/invitation?token=${encodeURIComponent(token.trim())}`, { credentials: "same-origin", headers: { accept: "application/json" } });
+        const body = await res.json().catch(() => null);
+        if (res.ok && body?.invitation) return { ok: true, status: "ok", invitation: body.invitation };
+        const e = body?.error;
+        return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? "") } : UNAVAILABLE };
+      } catch {
+        return { ok: false, error: UNAVAILABLE };
+      }
+    },
+    acceptInvitation: (token, password) => post("/invitation/accept", { token, password }, checkNewPassword(password, policy)),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
       async list(system) {
@@ -654,7 +674,23 @@ function createAuthClient(options = {}) {
       add: (id, f) => post("/me/organizations/members/add", { organizationId: id, email: f.email, role: f.role, name: f.name ?? "", locale: f.locale ?? "" }, checkEmail(f.email)),
       setRole: (id, userId, role) => post("/me/organizations/members/role", { organizationId: id, userId, role }, null),
       remove: (id, userId) => post("/me/organizations/members/remove", { organizationId: id, userId }, null),
-      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null)
+      inviteAgain: (id, userId, f = {}) => post("/me/organizations/members/invite", { organizationId: id, userId, locale: f.locale ?? "" }, null),
+      rename: (id, name) => post("/me/organizations/rename", { organizationId: id, name }, checkOrganizationName(name)),
+      archive: (id) => post("/me/organizations/archive", { organizationId: id }, null),
+      delete: (id) => post("/me/organizations/delete", { organizationId: id }, null),
+      async check(q) {
+        const organizationId = typeof q.organization === "string" ? q.organization : q.organization?.id ?? "";
+        const r = await post("/me/organizations/check", {
+          organizationId,
+          resource: q.resource,
+          action: q.action,
+          ...q.attributes !== void 0 ? { attributes: q.attributes } : {},
+          ...q.resourceId !== void 0 ? { resourceId: q.resourceId } : {},
+          ...q.ownerId !== void 0 ? { ownerId: q.ownerId } : {}
+        }, null);
+        if (!r.ok) return { allowed: false, reason: r.error.message, error: r.error };
+        return { allowed: r.allowed === true, reason: String(r.reason ?? ""), ...r.rule ? { rule: r.rule } : {} };
+      }
     },
     account: {
       async get() {