cauthy-auth 0.30.0 → 0.31.0

package/dist/next.d.mts

@@ -1,5 +1,5 @@
-import { C as Cauthy } from './cauthy-BXgsZ-Um.mjs';
-import { S as Session } from './system-0mHrdAgO.mjs';
+import { C as Cauthy } from './cauthy-2jtP2LVQ.mjs';
+import { S as Session } from './system-BrrJsrFW.mjs';
 import 'jose';
 import './theme.mjs';
 

package/dist/next.d.ts

@@ -1,5 +1,5 @@
-import { C as Cauthy } from './cauthy-CHENs452.js';
-import { S as Session } from './system-BIYbS7h2.js';
+import { C as Cauthy } from './cauthy-CKfvvv_i.js';
+import { S as Session } from './system-BvvoNs2y.js';
 import 'jose';
 import './theme.js';
 

package/dist/react.d.mts

@@ -403,11 +403,25 @@ type AuthResult<S extends string, More = unknown> = ({
 };
 /** What the screen may offer. */
 interface AuthMethods {
-    /** The providers the workspace signs people in with: `{ id: 'google', name: 'Google' }`. */
+    /**
+     * The providers the workspace signs people in with and has turned on:
+     * `{ id: 'google', name: 'Google', iconUrl: 'https://…/v1/social/icons/google.svg' }`.
+     * `iconUrl` is the provider's logo, served by Cauthy; absent from a Cauthy
+     * that does not serve logos.
+     */
     providers: {
         id: string;
         name: string;
+        iconUrl?: string;
     }[];
+    /**
+     * Whether the workspace signs people in with a password. False: the
+     * password field, "forgot your password" and a sign-up with a password are
+     * not offered, and Cauthy refuses them (`password_disabled`). True from a
+     * server that does not say. (`password` is something else: the policy a new
+     * password must meet.)
+     */
+    passwordSignIn: boolean;
     /** Whether people may create an account themselves. */
     signUp: boolean;
     /** Set when the application's system makes an organization per sign-up: the form asks the company's name. */
@@ -416,7 +430,7 @@ interface AuthMethods {
         required: boolean;
     };
     magicLink: boolean;
-    /** Whether to offer a passkey. */
+    /** Whether to offer a passkey. False when the workspace turned passkeys off. */
     passkey: boolean;
     /**
      * Whether the passkey is used on this page itself. False: `signIn.passkey`
@@ -468,6 +482,15 @@ interface AuthMethods {
      */
     password?: PasswordPolicy;
 }
+/** An invitation, as its page shows it before the person chooses a password. */
+interface Invitation {
+    /** The address invited: the account the person signs in as. */
+    email: string;
+    /** The workspace's name. */
+    workspace: string;
+    /** The organization the person was invited to, when there is one. */
+    organization?: string;
+}
 /** A legal document the person owes: not yet accepted in its current version. */
 interface PendingLegal {
     kind: string;
@@ -1059,7 +1082,25 @@ interface AuthClient {
         token: string;
         password: string;
     }): Promise<AuthResult<'changed'>>;
-    /** Confirms the address, with the token the mailed link opened the page with (`token`). */
+    /**
+     * Who an invitation is for and to what, with the token the mailed link
+     * opened the page with (`token`). Reading it does not spend it.
+     * `invalid_token`: unknown, spent or expired.
+     */
+    invitation(token: string): Promise<AuthResult<'ok', {
+        invitation: Invitation;
+    }>>;
+    /**
+     * Accepts an invitation with the password the person chose (the workspace's
+     * policy, as for a sign-up) and signs them in. `mfa_required`: the account
+     * owes a second step; ask for the code and call `signIn.mfa`, as after
+     * `signIn.email`. A password refused leaves the invitation good.
+     */
+    acceptInvitation(token: string, password: string): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }> | AuthResult<'mfa_required', {
+        method?: 'email';
+    }>>;
     /** Confirms the address a mailed link is for. The person is signed in from the link when their account asks no second step. */
     verifyEmail(form: {
         token: string;
@@ -1151,6 +1192,13 @@ interface AuthTexts {
     passwordChanged: string;
     confirming: string;
     emailConfirmed: string;
+    invitedTo: string;
+    invitedToOrganization: string;
+    invitedAs: string;
+    choosePassword: string;
+    acceptInvite: string;
+    openingInvitation: string;
+    invitationInvalid: string;
     profile: string;
     save: string;
     saved: string;
@@ -1226,7 +1274,7 @@ interface AuthTexts {
     /** By error code; one missing shows what the server said. */
     errors: Record<string, string>;
 }
-type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'hint' | 'notice' | 'separator' | 'footer' | 'check' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
+type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'providerIcon' | 'link' | 'error' | 'fieldError' | 'hint' | 'notice' | 'separator' | 'footer' | 'check' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
 interface AuthFormProps {
     /** The language of the built-in sentences. Default: `en`. */
     locale?: 'en' | 'es';
@@ -1316,6 +1364,14 @@ declare function ForgotPassword(props: AuthFormProps): react.JSX.Element;
 declare function ResetPassword(props: AuthFormProps): react.JSX.Element;
 /** The page a "confirm your address" link opens: `pages.verifyEmail`. It confirms as it opens. */
 declare function VerifyEmail(props: AuthFormProps): react.JSX.Element;
+/**
+ * The page an invitation opens: `pages.acceptInvite`. It says who is invited
+ * to what, asks for a password under the workspace's policy, signs the person
+ * in (with the second step, when their account owes one) and goes on to
+ * `returnTo`. The invitation is good until it is accepted: reading it, or a
+ * password refused, does not spend it.
+ */
+declare function AcceptInvite(props: AuthFormProps): react.JSX.Element;
 interface AccountProps extends Omit<AuthFormProps, 'links' | 'returnTo' | 'onSuccess'> {
     /** Called after "sign out everywhere". Default: go to `/`. */
     onSignedOut?: () => void;
@@ -1390,4 +1446,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, type ConnectedAgent, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, OrganizationMembers, type OrganizationMembersProps, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SSOConnection, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };
+export { AcceptInvite, Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, type ConnectedAgent, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type Invitation, type JsonValue, type LinkedIdentity, OrganizationMembers, type OrganizationMembersProps, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SSOConnection, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };

package/dist/react.d.ts

@@ -403,11 +403,25 @@ type AuthResult<S extends string, More = unknown> = ({
 };
 /** What the screen may offer. */
 interface AuthMethods {
-    /** The providers the workspace signs people in with: `{ id: 'google', name: 'Google' }`. */
+    /**
+     * The providers the workspace signs people in with and has turned on:
+     * `{ id: 'google', name: 'Google', iconUrl: 'https://…/v1/social/icons/google.svg' }`.
+     * `iconUrl` is the provider's logo, served by Cauthy; absent from a Cauthy
+     * that does not serve logos.
+     */
     providers: {
         id: string;
         name: string;
+        iconUrl?: string;
     }[];
+    /**
+     * Whether the workspace signs people in with a password. False: the
+     * password field, "forgot your password" and a sign-up with a password are
+     * not offered, and Cauthy refuses them (`password_disabled`). True from a
+     * server that does not say. (`password` is something else: the policy a new
+     * password must meet.)
+     */
+    passwordSignIn: boolean;
     /** Whether people may create an account themselves. */
     signUp: boolean;
     /** Set when the application's system makes an organization per sign-up: the form asks the company's name. */
@@ -416,7 +430,7 @@ interface AuthMethods {
         required: boolean;
     };
     magicLink: boolean;
-    /** Whether to offer a passkey. */
+    /** Whether to offer a passkey. False when the workspace turned passkeys off. */
     passkey: boolean;
     /**
      * Whether the passkey is used on this page itself. False: `signIn.passkey`
@@ -468,6 +482,15 @@ interface AuthMethods {
      */
     password?: PasswordPolicy;
 }
+/** An invitation, as its page shows it before the person chooses a password. */
+interface Invitation {
+    /** The address invited: the account the person signs in as. */
+    email: string;
+    /** The workspace's name. */
+    workspace: string;
+    /** The organization the person was invited to, when there is one. */
+    organization?: string;
+}
 /** A legal document the person owes: not yet accepted in its current version. */
 interface PendingLegal {
     kind: string;
@@ -1059,7 +1082,25 @@ interface AuthClient {
         token: string;
         password: string;
     }): Promise<AuthResult<'changed'>>;
-    /** Confirms the address, with the token the mailed link opened the page with (`token`). */
+    /**
+     * Who an invitation is for and to what, with the token the mailed link
+     * opened the page with (`token`). Reading it does not spend it.
+     * `invalid_token`: unknown, spent or expired.
+     */
+    invitation(token: string): Promise<AuthResult<'ok', {
+        invitation: Invitation;
+    }>>;
+    /**
+     * Accepts an invitation with the password the person chose (the workspace's
+     * policy, as for a sign-up) and signs them in. `mfa_required`: the account
+     * owes a second step; ask for the code and call `signIn.mfa`, as after
+     * `signIn.email`. A password refused leaves the invitation good.
+     */
+    acceptInvitation(token: string, password: string): Promise<AuthResult<'signed_in', {
+        session: PublicSession;
+    }> | AuthResult<'mfa_required', {
+        method?: 'email';
+    }>>;
     /** Confirms the address a mailed link is for. The person is signed in from the link when their account asks no second step. */
     verifyEmail(form: {
         token: string;
@@ -1151,6 +1192,13 @@ interface AuthTexts {
     passwordChanged: string;
     confirming: string;
     emailConfirmed: string;
+    invitedTo: string;
+    invitedToOrganization: string;
+    invitedAs: string;
+    choosePassword: string;
+    acceptInvite: string;
+    openingInvitation: string;
+    invitationInvalid: string;
     profile: string;
     save: string;
     saved: string;
@@ -1226,7 +1274,7 @@ interface AuthTexts {
     /** By error code; one missing shows what the server said. */
     errors: Record<string, string>;
 }
-type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'link' | 'error' | 'fieldError' | 'hint' | 'notice' | 'separator' | 'footer' | 'check' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
+type Slot = 'form' | 'field' | 'label' | 'input' | 'button' | 'providerButton' | 'providerIcon' | 'link' | 'error' | 'fieldError' | 'hint' | 'notice' | 'separator' | 'footer' | 'check' | 'account' | 'section' | 'heading' | 'secret' | 'codes' | 'sessions' | 'session';
 interface AuthFormProps {
     /** The language of the built-in sentences. Default: `en`. */
     locale?: 'en' | 'es';
@@ -1316,6 +1364,14 @@ declare function ForgotPassword(props: AuthFormProps): react.JSX.Element;
 declare function ResetPassword(props: AuthFormProps): react.JSX.Element;
 /** The page a "confirm your address" link opens: `pages.verifyEmail`. It confirms as it opens. */
 declare function VerifyEmail(props: AuthFormProps): react.JSX.Element;
+/**
+ * The page an invitation opens: `pages.acceptInvite`. It says who is invited
+ * to what, asks for a password under the workspace's policy, signs the person
+ * in (with the second step, when their account owes one) and goes on to
+ * `returnTo`. The invitation is good until it is accepted: reading it, or a
+ * password refused, does not spend it.
+ */
+declare function AcceptInvite(props: AuthFormProps): react.JSX.Element;
 interface AccountProps extends Omit<AuthFormProps, 'links' | 'returnTo' | 'onSuccess'> {
     /** Called after "sign out everywhere". Default: go to `/`. */
     onSignedOut?: () => void;
@@ -1390,4 +1446,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, type ConnectedAgent, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type JsonValue, type LinkedIdentity, OrganizationMembers, type OrganizationMembersProps, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SSOConnection, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };
+export { AcceptInvite, Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, type ConnectedAgent, ForgotPassword, GoogleOneTap, type GoogleOneTapProps, type Invitation, type JsonValue, type LinkedIdentity, OrganizationMembers, type OrganizationMembersProps, type OrganizationPerson, type OrganizationRoleChoice, type OrganizationSeat, type OrganizationsClient, type Passkey, type PasskeyKind, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SSOConnection, type SecondStep, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, canAutofillPasskeys, canUsePasskeys, createAuthClient, definePolicy, useAuth, useSession };