cauthy-auth 0.30.0 → 0.31.0

package/dist/{system-0mHrdAgO.d.mts → system-BrrJsrFW.d.mts}

@@ -56,11 +56,17 @@ interface CauthyOptions {
      *   signIn         where `<SignIn />` is: a sign-in link opens it
      *   resetPassword  where `<ResetPassword />` is
      *   verifyEmail    where `<VerifyEmail />` is
+     *   acceptInvite   where `<AcceptInvite />` is: an invitation opens it
+     *
+     * An invitation sent by `auth.system.members.add` or `auth.system.invite`
+     * opens `acceptInvite` only when the application knows its public origin
+     * (`baseURL`): that call has no request to read it from.
      */
     pages?: {
         signIn?: string;
         resetPassword?: string;
         verifyEmail?: string;
+        acceptInvite?: string;
     };
     /**
      * The address of the person a request comes from, passed on to Cauthy so
@@ -448,6 +454,14 @@ interface SystemOptions {
     key?: SystemKey;
     /** The application's system, which `check` asks about. Default: `CAUTHY_SYSTEM`. */
     system?: string;
+    /**
+     * The application's own page for accepting an invitation, as an absolute
+     * address (`https://app.example.com/accept-invite`, where `<AcceptInvite />`
+     * is). The invitations `members.add` and `invite` send open it; without it,
+     * they open Cauthy's own page. Cauthy follows it only on an origin the
+     * client registered to be sent back to. Default: `CAUTHY_ACCEPT_INVITE_URL`.
+     */
+    acceptInviteUrl?: string;
     fetch?: typeof fetch;
 }
 /** Cauthy refused a request of the application's own. */

package/dist/{system-BIYbS7h2.d.ts → system-BvvoNs2y.d.ts}

@@ -56,11 +56,17 @@ interface CauthyOptions {
      *   signIn         where `<SignIn />` is: a sign-in link opens it
      *   resetPassword  where `<ResetPassword />` is
      *   verifyEmail    where `<VerifyEmail />` is
+     *   acceptInvite   where `<AcceptInvite />` is: an invitation opens it
+     *
+     * An invitation sent by `auth.system.members.add` or `auth.system.invite`
+     * opens `acceptInvite` only when the application knows its public origin
+     * (`baseURL`): that call has no request to read it from.
      */
     pages?: {
         signIn?: string;
         resetPassword?: string;
         verifyEmail?: string;
+        acceptInvite?: string;
     };
     /**
      * The address of the person a request comes from, passed on to Cauthy so
@@ -448,6 +454,14 @@ interface SystemOptions {
     key?: SystemKey;
     /** The application's system, which `check` asks about. Default: `CAUTHY_SYSTEM`. */
     system?: string;
+    /**
+     * The application's own page for accepting an invitation, as an absolute
+     * address (`https://app.example.com/accept-invite`, where `<AcceptInvite />`
+     * is). The invitations `members.add` and `invite` send open it; without it,
+     * they open Cauthy's own page. Cauthy follows it only on an origin the
+     * client registered to be sent back to. Default: `CAUTHY_ACCEPT_INVITE_URL`.
+     */
+    acceptInviteUrl?: string;
     fetch?: typeof fetch;
 }
 /** Cauthy refused a request of the application's own. */

package/dist/vue.d.mts

@@ -1,8 +1,8 @@
 import { ShallowRef, Plugin } from 'vue';
 import { SessionStore, SessionState, SessionStoreOptions, AuthClient } from './client.mjs';
 export { Account, AccountSession, AuthError, AuthMethods, AuthResult, Passkey, PasskeyKind, SSOConnection } from './client.mjs';
-import { q as PublicSession } from './system-0mHrdAgO.mjs';
-export { P as PermissionOf, m as Policy, R as RoleOf, s as SessionOrganization, u as SessionUser, y as can, B as definePolicy } from './system-0mHrdAgO.mjs';
+import { q as PublicSession } from './system-BrrJsrFW.mjs';
+export { P as PermissionOf, m as Policy, R as RoleOf, s as SessionOrganization, u as SessionUser, y as can, B as definePolicy } from './system-BrrJsrFW.mjs';
 import './theme.mjs';
 import './validate-sEXG82po.mjs';
 import 'jose';

package/dist/vue.d.ts

@@ -1,8 +1,8 @@
 import { ShallowRef, Plugin } from 'vue';
 import { SessionStore, SessionState, SessionStoreOptions, AuthClient } from './client.js';
 export { Account, AccountSession, AuthError, AuthMethods, AuthResult, Passkey, PasskeyKind, SSOConnection } from './client.js';
-import { q as PublicSession } from './system-BIYbS7h2.js';
-export { P as PermissionOf, m as Policy, R as RoleOf, s as SessionOrganization, u as SessionUser, y as can, B as definePolicy } from './system-BIYbS7h2.js';
+import { q as PublicSession } from './system-BvvoNs2y.js';
+export { P as PermissionOf, m as Policy, R as RoleOf, s as SessionOrganization, u as SessionUser, y as can, B as definePolicy } from './system-BvvoNs2y.js';
 import './theme.js';
 import './validate-sEXG82po.js';
 import 'jose';

package/dist/vue.js

@@ -375,11 +375,11 @@ function createAuthClient(options = {}) {
       if (res.ok) {
         const m = await res.json();
         if (m.password) policy = passwordPolicyOf(m.password);
-        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, ...policy ? { password: policy } : {}, passwordSignIn: m.passwordSignIn !== false, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true, sso: m.sso === true };
       }
     } catch {
     }
-    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
+    return { providers: [], signUp: true, passwordSignIn: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false, sso: false };
   }
   async function ceremony(begin, finish, form, run, more = {}) {
     const begun = await post(begin, form, null);
@@ -526,6 +526,20 @@ function createAuthClient(options = {}) {
     forgotPassword: (f) => post("/forgot-password", { email: f.email }, checkEmail(f.email), f.captchaToken),
     resetPassword: (f) => post("/reset-password", { token: f.token, password: f.password }, checkNewPassword(f.password, policy)),
     verifyEmail: (f) => post("/verify-email", { token: f.token }, null),
+    async invitation(token) {
+      const bad = { ok: false, error: { code: "invalid_token", message: "This invitation is not valid, or it has expired." } };
+      if (typeof token !== "string" || token.trim() === "") return bad;
+      try {
+        const res = await doFetch(`${base}/invitation?token=${encodeURIComponent(token.trim())}`, { credentials: "same-origin", headers: { accept: "application/json" } });
+        const body = await res.json().catch(() => null);
+        if (res.ok && body?.invitation) return { ok: true, status: "ok", invitation: body.invitation };
+        const e = body?.error;
+        return { ok: false, error: e && typeof e.code === "string" ? { code: e.code, message: String(e.message ?? "") } : UNAVAILABLE };
+      } catch {
+        return { ok: false, error: UNAVAILABLE };
+      }
+    },
+    acceptInvitation: (token, password) => post("/invitation/accept", { token, password }, checkNewPassword(password, policy)),
     signOut: () => post("/sign-out", {}, null),
     organizations: {
       async list(system) {