cauthy-auth 0.30.0 → 0.32.0

package/dist/index.mjs

@@ -691,6 +691,8 @@ function createSystem(given = {}) {
   const envKey = env("CAUTHY_SYSTEM_KEY");
   const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env("CAUTHY_SYSTEM_KEY_ID") ?? "" } : void 0);
   const ownSystem = given.system ?? env("CAUTHY_SYSTEM") ?? "";
+  const acceptInviteUrl = given.acceptInviteUrl ?? env("CAUTHY_ACCEPT_INVITE_URL") ?? "";
+  const inviteHeaders = /^https?:\/\//.test(acceptInviteUrl) ? { "x-cauthy-client-id": clientId, "x-cauthy-link-to": acceptInviteUrl } : {};
   const doFetch = (...args) => (given.fetch ?? fetch)(...args);
   const tokenEndpoint = `${issuer}/v1/oauth/token`;
   function configured() {
@@ -733,10 +735,10 @@ function createSystem(given = {}) {
       asking = void 0;
     });
   }
-  async function call(method, path, body) {
+  async function call(method, path, body, extra = {}) {
     const send = async () => doFetch(`${issuer}${path}`, {
       method,
-      headers: { authorization: `Bearer ${await token()}`, ...body === void 0 ? {} : { "content-type": "application/json" } },
+      headers: { authorization: `Bearer ${await token()}`, ...extra, ...body === void 0 ? {} : { "content-type": "application/json" } },
       body: body === void 0 ? void 0 : JSON.stringify(body)
     });
     let res = await send();
@@ -747,7 +749,7 @@ function createSystem(given = {}) {
     if (!res.ok) await fail(res, `${method} ${path}`);
     return res.status === 204 ? void 0 : res.json();
   }
-  const data = async (method, path, body) => (await call(method, path, body))?.data;
+  const data = async (method, path, body, extra) => (await call(method, path, body, extra))?.data;
   const id = encodeURIComponent;
   return {
     token,
@@ -784,7 +786,8 @@ function createSystem(given = {}) {
         return toMember(await data(
           "POST",
           `/v1/organizations/${id(orgId)}/members`,
-          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId }
+          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId },
+          inviteHeaders
         ));
       },
       async setRole(orgId, userId, role) {
@@ -795,7 +798,7 @@ function createSystem(given = {}) {
       }
     },
     async invite(person) {
-      const u = await data("POST", "/v1/users", { ...person, client_id: clientId });
+      const u = await data("POST", "/v1/users", { ...person, client_id: clientId }, inviteHeaders);
       return { id: u.id, email: u.email };
     },
     theme: {
@@ -1130,13 +1133,16 @@ function createCauthy(given = {}) {
   const againCookie = `${cookieName}_again`;
   const stepCookie = `${cookieName}_step`;
   const doFetch = (...args) => (given.fetch ?? fetch)(...args);
+  const iconOf = iconFor(issuer);
   const key = keyOf(secret);
   const pages = {
     signIn: given.pages?.signIn ? localPath(given.pages.signIn, "/") : void 0,
     resetPassword: given.pages?.resetPassword ? localPath(given.pages.resetPassword, "/") : void 0,
-    verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0
+    verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, "/") : void 0,
+    acceptInvite: given.pages?.acceptInvite ? localPath(given.pages.acceptInvite, "/") : void 0
   };
-  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, system: system || void 0, fetch: given.fetch });
+  const acceptInviteUrl = baseURL && pages.acceptInvite ? `${withoutTrailingSlashes(baseURL)}${pages.acceptInvite}` : void 0;
+  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, system: system || void 0, acceptInviteUrl, fetch: given.fetch });
   const originOf = (request) => {
     if (baseURL) return withoutTrailingSlashes(baseURL);
     const url = new URL(request.url);
@@ -1563,6 +1569,14 @@ function createCauthy(given = {}) {
     for (const c of [...await write(request, s, readCookies(request.headers.get("cookie"))), ...extra]) h.append("set-cookie", c);
     return json({ status: "signed_in", session: await toPublic(toSession(s)), ...more }, 200, h);
   }
+  async function loggedIn(request, data) {
+    if (data?.mfa_required === true) {
+      const step = { kind: "mfa", token: String(data.mfa_token ?? ""), returnTo: afterSignIn };
+      const how = data.mfa_method === "email" ? { method: "email" } : {};
+      return json({ status: "mfa_required", ...how }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
+    }
+    return signedIn(request, data);
+  }
   let lookCache = null;
   let policyCache = null;
   const keepPolicy = (settings) => {
@@ -1636,7 +1650,9 @@ function createCauthy(given = {}) {
       "/me/organizations/members/invite",
       "/me/organizations/rename",
       "/me/organizations/archive",
-      "/me/organizations/delete"
+      "/me/organizations/delete",
+      "/invitation",
+      "/invitation/accept"
     ].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/") || route.startsWith("/me/upgrade/social/") || route === "/sign-in/sso" || route === "/sign-in/sso/discover" || route === "/sso/callback";
     if (!own) return null;
     if (tenant === "") {
@@ -1658,17 +1674,21 @@ function createCauthy(given = {}) {
       ]);
       const list = Array.isArray(providers.data) ? providers.data : [];
       const password = keepPolicy(settings);
-      const here = place.data?.here === true;
+      const passkeys = settings.data?.allow_passkeys !== false;
+      const here = passkeys && place.data?.here === true;
       return json({
-        providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? "") })).filter((p) => p.id !== ""),
+        providers: list.map((p) => ({ id: String(p.provider ?? p.id ?? ""), name: String(p.label ?? p.name ?? p.provider ?? ""), ...iconOf(p) })).filter((p) => p.id !== ""),
+        // Whether the workspace signs people in with a password at all. A
+        // Cauthy from before the setting says nothing of it: then it does.
+        passwordSignIn: settings.data?.allow_password !== false,
         signUp: settings.data?.allow_signup !== false,
         // The application's system makes an organization per sign-up: the form asks the company's name.
         ...settings.data?.signup?.organization?.ask === true ? { organization: { ask: true, required: settings.data.signup.organization.required === true } } : {},
         // A sign-in link needs a page of the application to open.
         magicLink: settings.data?.allow_magic_link === true && pages.signIn !== void 0,
-        passkey: place.error ? true : here || place.data?.on_cauthy === true,
+        passkey: passkeys && (place.error ? true : here || place.data?.on_cauthy === true),
         passkeyHere: here,
-        passkeyOnCauthy: place.error ? true : place.data?.on_cauthy === true,
+        passkeyOnCauthy: passkeys && (place.error ? true : place.data?.on_cauthy === true),
         // A company's sign-in, found by the person's work address.
         sso: Array.isArray(sso.data) && sso.data.some((c) => c?.discoverable === true),
         // The terms a sign-up accepts and the consents it answers, when the workspace asks any.
@@ -1678,6 +1698,14 @@ function createCauthy(given = {}) {
         ...password ? { password } : {}
       });
     }
+    if (route === "/invitation" && !post) {
+      const token2 = (url.searchParams.get("token") ?? "").trim();
+      if (token2 === "" || token2.length > 512) return problem(422, "invalid_token", "This invitation is not valid, or it has expired.");
+      const res = await ask(request, "GET", `/v1/auth/invitation?token=${encodeURIComponent(token2)}`);
+      if (res.error) return problem(res.status, res.error.code, res.error.message);
+      const organization = typeof res.data?.organization === "string" && res.data.organization !== "" ? { organization: res.data.organization } : {};
+      return json({ status: "ok", invitation: { email: String(res.data?.email ?? ""), workspace: String(res.data?.workspace ?? ""), ...organization } });
+    }
     if (route === "/sign-in/sso" && !post) {
       const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
       const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
@@ -1907,12 +1935,7 @@ function createCauthy(given = {}) {
       if (bad) return invalid(bad);
       const res = await ask(request, "POST", "/v1/auth/login", { email: String(b.email).trim(), password: b.password });
       if (res.error) return problem(res.status, res.error.code, res.error.message);
-      if (res.data?.mfa_required === true) {
-        const step = { kind: "mfa", token: String(res.data.mfa_token ?? ""), returnTo: afterSignIn };
-        const how = res.data.mfa_method === "email" ? { method: "email" } : {};
-        return json({ status: "mfa_required", ...how }, 200, new Headers({ "set-cookie": writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS)) }));
-      }
-      return signedIn(request, res.data);
+      return loggedIn(request, res.data);
     }
     if (route === "/sign-in/mfa") {
       const bad = checkCode(b.code);
@@ -2133,13 +2156,13 @@ function createCauthy(given = {}) {
           if (bad) return invalid(bad);
           const role = typeof b.role === "string" ? b.role : "";
           if (role === "") return problem(400, "invalid_role", "Choose a role.", "role", mine.headers);
-          const res = await as(base, {
+          const res = await ask(request, "POST", base, {
             email: String(b.email).trim(),
             role,
             name: typeof b.name === "string" ? b.name.trim() : "",
             client_id: clientId,
             ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {}
-          });
+          }, pages.acceptInvite, mine.token);
           if (res.error) return refused(res, res.error.code === "unknown_role" ? "role" : "email");
           return json({ status: "added", member: orgMemberOf(res.data) }, 200, mine.headers);
         }
@@ -2159,7 +2182,7 @@ function createCauthy(given = {}) {
           return json({ status: "removed", userId: user }, 200, mine.headers);
         }
         if (route === "/me/organizations/members/invite") {
-          const res = await as(`${base}/${user}/invite`, { client_id: clientId, ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} });
+          const res = await ask(request, "POST", `${base}/${user}/invite`, { client_id: clientId, ...typeof b.locale === "string" && b.locale ? { locale: b.locale } : {} }, pages.acceptInvite, mine.token);
           if (res.error) return refused(res);
           return json({ status: "sent", userId: user }, 200, mine.headers);
         }
@@ -2198,6 +2221,14 @@ function createCauthy(given = {}) {
       if (res.data?.access_token) return signedIn(request, res.data);
       return json({ status: "verified" });
     }
+    if (route === "/invitation/accept") {
+      if (!isToken(b.token)) return problem(422, "invalid_token", "This invitation is not valid, or it has expired.");
+      const bad = await newPasswordProblem(request, b.password);
+      if (bad) return invalid(bad);
+      const res = await ask(request, "POST", "/v1/auth/invitation/accept", { token: String(b.token), password: b.password });
+      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === "weak_password" ? "password" : void 0, void 0, res.error.reasons);
+      return loggedIn(request, res.data);
+    }
     if (route === "/sign-in/passkey/begin") {
       const email = typeof b.email === "string" && checkEmail(b.email) === null ? b.email.trim() : "";
       const res = await ask(request, "POST", "/v1/auth/webauthn/login/begin", email !== "" ? { email } : {});
@@ -2355,6 +2386,18 @@ function createCauthy(given = {}) {
     options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName }
   };
 }
+function iconFor(issuer) {
+  return (p) => {
+    const raw = typeof p?.icon_url === "string" ? p.icon_url.trim() : "";
+    if (raw === "") return {};
+    try {
+      const url = new URL(raw.startsWith("/") && !raw.startsWith("//") ? `${issuer}${raw}` : raw);
+      return url.protocol === "https:" || url.protocol === "http:" ? { iconUrl: url.href } : {};
+    } catch {
+      return {};
+    }
+  };
+}
 function legalOf(raw) {
   const documents = Array.isArray(raw?.documents) ? raw.documents : [];
   const purposes = Array.isArray(raw?.consent_purposes) ? raw.consent_purposes : [];