cauthy-auth 0.37.0 → 0.38.1

package/dist/index.mjs

@@ -1687,7 +1687,8 @@ function createCauthy(given = {}) {
         // Whether the workspace signs people in with a password at all. A
         // Cauthy from before the setting says nothing of it: then it does.
         passwordSignIn: settings.data?.allow_password !== false,
-        signUp: settings.data?.allow_signup !== false,
+        // The workspace's switch, and how the application's own system takes sign-ups.
+        signUp: settings.data?.allow_signup !== false && settings.data?.signup?.mode !== "invite_only",
         // The application's system makes an organization per sign-up: the form asks the company's name.
         ...settings.data?.signup?.organization?.ask === true ? { organization: { ask: true, required: settings.data.signup.organization.required === true } } : {},
         // A sign-in link needs a page of the application to open.
@@ -2050,7 +2051,8 @@ function createCauthy(given = {}) {
       if (route === "/me/mfa/setup") {
         const res = await as("/v1/auth/mfa/setup", { password });
         if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
-        return json({ status: "started", secret: String(res.data?.secret ?? ""), otpauthUri: String(res.data?.otpauth_uri ?? "") }, 200, mine.headers);
+        const qr = String(res.data?.qr ?? "");
+        return json({ status: "started", secret: String(res.data?.secret ?? ""), otpauthUri: String(res.data?.otpauth_uri ?? ""), qr: qr.startsWith("data:image/png;base64,") ? qr : "" }, 200, mine.headers);
       }
       if (route === "/me/mfa/verify") {
         const bad = checkCode(b.code);