cauthy-auth 0.36.1 → 0.38.0

package/README.md

@@ -76,6 +76,8 @@ import { Account, AccountPasskeys } from 'cauthy-auth/react'
 
 `sections` lists the parts shown, in that order: `profile`, `email`, `password`, `linked`, `secondStep`, `phone`, `passkeys`, `agents`, `sessions` (default: all). Each is also its own component: `AccountProfile`, `AccountEmail`, `AccountPassword`, `AccountLinked`, `AccountSecondStep`, `AccountPhone`, `AccountPasskeys`, `AccountAgents`, `AccountSessions`. `onSaved` is called after every change saved, with `{ kind, ... }`: `profile.saved`, `email.change_requested`, `password.changed`, `identity.linked`, `identity.unlinked`, `mfa.enabled`, `mfa.disabled`, `recovery_codes.regenerated`, `phone.added`, `phone.removed`, `passkey.added`, `passkey.removed`, `agent.disconnected`, `sessions.ended`.
 
+Each part shows a form only while what it sets up has nothing set yet: no second step, no phone, no passkey, no name. Once something is set, the part shows it (the name and address, "Your account has a password", the second step on, the masked phone and its channel, the passkeys with their kind and date) with its actions: "Change", "Change email", "Change password", "Turn off", "New recovery codes", "Remove phone", "Add a passkey". The form opens only when one is pressed, with a "Cancel" back; an action that weakens the account asks for the current password there, and runs at once for an account without one. Turning the second step on shows the QR code to scan (drawn by Cauthy, a PNG `data:` image; `classNames.qr` styles it), the key to type by hand, and a link that opens an authenticator app on a phone. Recovery codes, when made, are listed as text to select, with "Copy all" (to the clipboard, one per line) and "Download .txt" (`recovery-codes.txt`). They go nowhere else: no log, no browser storage.
+
 The legal documents a signed-in person still owes (a new version of the terms), with the action that accepts them. It shows nothing when nothing is owed:
 
 ```tsx
@@ -106,6 +108,8 @@ await organizations.archive(org.id)               // only the workspace restores
 await organizations.delete(org.id)                // for good
 ```
 
+`<OrganizationMembers />` follows the same rule: the form to add a member shows as it is while nobody but the person belongs; once others do, it opens on "Add member", with "Cancel". The organization's name shows with "Rename", which opens its form.
+
 | Reserved power | Lets a member |
 | --- | --- |
 | `cauthy:members:read` | see the people (`can.readMembers`) |
@@ -201,7 +205,7 @@ The forms stay busy from the press until the work is really over. A sign-in that
 
 | Part | Is given |
 | --- | --- |
-| `Form` | `as` (`form` or `div`), `onSubmit`, `noValidate`, `aria-busy`, `className`, `section`, `children`. Render a `<form>` for `as="form"`, for Enter to send it. `section` names each part of `<Account />` (`profile`, `passkeys`… as in `AccountSection`) and of `<OrganizationMembers />` (`members`, `add-member`, `organization`, `rename`), to draw each as a card |
+| `Form` | `as` (`form` or `div`), `onSubmit`, `noValidate`, `aria-busy`, `className`, `section`, `children`. Render a `<form>` for `as="form"`, for Enter to send it. `section` names each part of `<Account />` (`profile`, `passkeys`… as in `AccountSection`) and of `<OrganizationMembers />` (`members`, `add-member`, `organization`, `rename`), to draw each as a card. A part that shows what is set, with its actions, is a `div`; it is a `form` once its form is open |
 | `Button` | `type`, `variant` (`primary`, `secondary`, `danger`), `loading`, `disabled`, `className`, `onClick`, `children` |
 | `Input` | `id`, `name`, `type`, `value`, `autoComplete`, `required`, `disabled`, `className`, `aria-invalid`, `aria-describedby`, `onChange(e)` |
 | `Checkbox` | `id`, `name`, `checked`, `required`, `disabled`, `className`, `onChange(checked)`, `children` (its label) |
@@ -222,7 +226,7 @@ What Cauthy mails from these forms (a sign-in link, a new password, a confirmati
 <CauthyProvider locale={() => i18n.language}>
 ```
 
-`texts` changes any sentence. Its keys are stable: `email`, `password`, `name`, `code`, `signIn`, `signUp`, `continueWith`, `orWithEmail`, `forgotPassword`, `noAccount`, `createAccount`, `company`, `iAccept`, `and`, `termsOfService`, `privacyPolicy`, `haveAccount`, `sendLink`, `linkSent`, `codeHelp`, `codeHelpPhone`, `codeHelpEmail`, `sendEmailAgain`, `sendCodeSms`, `sendCodeWhatsapp`, `codeSent`, `pushSend`, `pushPick`, `pushWaiting`, `phone`, `phoneHelp`, `phoneOn`, `phoneOff`, `addPhone`, `removePhone`, `bySms`, `byWhatsapp`, `channel`, `verify`, `checkEmail`, `backToSignIn`, `emailMeALink`, `linkHelp`, `sendMeTheLink`, `back`, `usePasskey`, `codeFromMail`, `signInLinkSent`, `newPassword`, `savePassword`, `passwordChanged`, `confirming`, `loading`, `emailConfirmed`, `invitedTo`, `invitedToOrganization`, `invitedAs`, `choosePassword`, `acceptInvite`, `openingInvitation`, `invitationInvalid`, `profile`, `save`, `saved`, `currentPassword`, `changePassword`, `passwordChangedHere`, `secondStep`, `secondStepOn`, `secondStepOff`, `turnOn`, `turnOff`, `addToApp`, `openInApp`, `recoveryCodes`, `newRecoveryCodes`, `keepCodes`, `passkeys`, `managePasskeys`, `passkeysHelp`, `noPasskeys`, `passkeyName`, `addPasskey` (unused), `addPasskeyDevice`, `addSecurityKey`, `passkeyKinds`, `removePasskey`, `passkeyAdded`, `passkeyUnnamed`, `sessions`, `signOutEverywhere`, `agents`, `agentsHelp`, `disconnect`, `anAgent`, `unknownDevice`, `emailAddress`, `newEmail`, `changeEmail`, `emailSent`, `linkedAccounts`, `noLinkedAccounts`, `linkWith`, `unlink`, `linked`, `ssoOnly`, `members`, `membersHidden`, `organizationMissing`, `memberYou`, `memberInvited`, `memberManager`, `memberRole`, `memberAdd`, `memberAdded`, `memberRemove`, `memberRemoveConfirm`, `memberLeave`, `memberLeaveConfirm`, `memberInviteAgain`, `memberInvitationSent`, `organization`, `organizationRename`, `organizationRenamed`, `organizationArchive`, `organizationArchiveConfirm`, `organizationArchived`, `organizationDelete`, `organizationDeleteConfirm`, `organizationDeleted`, `yes`, `cancel`, `termsChanged`, `termsChangedHelp`, `acceptTerms`, and `errors` by error code. Built in: English and Spanish (`locale`). The dashboard can start the look from your stylesheet (shadcn/ui and Tailwind, Stackmyth, or variables of your own); `npx cauthy-auth theme --css src/app/globals.css` reads it the same way from a terminal.
+`texts` changes any sentence. Its keys are stable: `email`, `password`, `name`, `code`, `signIn`, `signUp`, `continueWith`, `orWithEmail`, `forgotPassword`, `noAccount`, `createAccount`, `company`, `iAccept`, `and`, `termsOfService`, `privacyPolicy`, `haveAccount`, `sendLink`, `linkSent`, `codeHelp`, `codeHelpPhone`, `codeHelpEmail`, `sendEmailAgain`, `sendCodeSms`, `sendCodeWhatsapp`, `codeSent`, `pushSend`, `pushPick`, `pushWaiting`, `phone`, `phoneHelp`, `phoneOn`, `phoneOff`, `addPhone`, `removePhone`, `bySms`, `byWhatsapp`, `channel`, `verify`, `checkEmail`, `backToSignIn`, `emailMeALink`, `linkHelp`, `sendMeTheLink`, `back`, `usePasskey`, `codeFromMail`, `signInLinkSent`, `newPassword`, `savePassword`, `passwordChanged`, `confirming`, `loading`, `emailConfirmed`, `invitedTo`, `invitedToOrganization`, `invitedAs`, `choosePassword`, `acceptInvite`, `openingInvitation`, `invitationInvalid`, `profile`, `save`, `saved`, `currentPassword`, `changePassword`, `passwordChangedHere`, `secondStep`, `secondStepOn`, `secondStepOff`, `turnOn`, `turnOff`, `addToApp`, `openInApp`, `recoveryCodes`, `newRecoveryCodes`, `keepCodes`, `copyCodes`, `downloadCodes`, `codesCopied`, `codesNotCopied`, `change`, `passwordSet`, `addAnotherPasskey`, `passkeys`, `managePasskeys`, `passkeysHelp`, `noPasskeys`, `passkeyName`, `addPasskey` (unused), `addPasskeyDevice`, `addSecurityKey`, `passkeyKinds`, `removePasskey`, `passkeyAdded`, `passkeyUnnamed`, `sessions`, `signOutEverywhere`, `agents`, `agentsHelp`, `disconnect`, `anAgent`, `unknownDevice`, `emailAddress`, `newEmail`, `changeEmail`, `emailSent`, `linkedAccounts`, `noLinkedAccounts`, `linkWith`, `unlink`, `linked`, `ssoOnly`, `members`, `membersHidden`, `organizationMissing`, `memberYou`, `memberInvited`, `memberManager`, `memberRole`, `memberAdd`, `memberAdded`, `memberRemove`, `memberRemoveConfirm`, `memberLeave`, `memberLeaveConfirm`, `memberInviteAgain`, `memberInvitationSent`, `organization`, `organizationRename`, `organizationRenamed`, `organizationArchive`, `organizationArchiveConfirm`, `organizationArchived`, `organizationDelete`, `organizationDeleteConfirm`, `organizationDeleted`, `yes`, `cancel`, `termsChanged`, `termsChangedHelp`, `acceptTerms`, and `errors` by error code. Built in: English and Spanish (`locale`). The dashboard can start the look from your stylesheet (shadcn/ui and Tailwind, Stackmyth, or variables of your own); `npx cauthy-auth theme --css src/app/globals.css` reads it the same way from a terminal.
 
 Connect your application to Cauthy in one step, from Cauthy's dashboard ("Connect a System") or from a terminal. In the application's folder, `init` reads its framework (Next.js, TanStack Start, React Router or Remix, SvelteKit, Vite + React, Express, Hono, Fastify), makes the client, writes every variable to its env file, `CAUTHY_SECRET` included, and lays down the route and a sign-in page, never over a file that is there:
 

package/dist/client.d.mts

@@ -403,12 +403,13 @@ interface AccountClient {
         kinds?: string[];
     }): Promise<AuthResult<'accepted'>>;
     mfa: {
-        /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
+        /** Starts turning the second step on: show `qr` (the `otpauthUri` drawn by Cauthy, a PNG `data:` URI; empty from an older Cauthy) and `secret` to add to an authenticator app, then call `verify`. */
         setup(form: {
             password: string;
         }): Promise<AuthResult<'started', {
             secret: string;
             otpauthUri: string;
+            qr: string;
         }>>;
         /** Turns it on with a code from the app. `recoveryCodes` are shown this once. */
         verify(form: {

package/dist/client.d.ts

@@ -403,12 +403,13 @@ interface AccountClient {
         kinds?: string[];
     }): Promise<AuthResult<'accepted'>>;
     mfa: {
-        /** Starts turning the second step on: show `secret` (or `otpauthUri` as a QR code) to add to an authenticator app, then call `verify`. */
+        /** Starts turning the second step on: show `qr` (the `otpauthUri` drawn by Cauthy, a PNG `data:` URI; empty from an older Cauthy) and `secret` to add to an authenticator app, then call `verify`. */
         setup(form: {
             password: string;
         }): Promise<AuthResult<'started', {
             secret: string;
             otpauthUri: string;
+            qr: string;
         }>>;
         /** Turns it on with a code from the app. `recoveryCodes` are shown this once. */
         verify(form: {