cauthy-auth 0.38.0 → 0.38.2

package/dist/index.mjs

@@ -715,9 +715,10 @@ function createSystem(given = {}) {
   let asking;
   async function ask() {
     configured();
-    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId });
+    const self = key?.clientId || clientId;
+    const form = new URLSearchParams({ grant_type: "client_credentials", client_id: self });
     if (key) {
-      const assertion = await new SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(clientId).setSubject(clientId).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
+      const assertion = await new SignJWT({}).setProtectedHeader({ alg: "RS256", kid: key.keyId }).setIssuer(self).setSubject(self).setAudience(tokenEndpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("2m").sign(await signingKey());
       form.set("client_assertion_type", ASSERTION_TYPE);
       form.set("client_assertion", assertion);
     } else {
@@ -1687,7 +1688,8 @@ function createCauthy(given = {}) {
         // Whether the workspace signs people in with a password at all. A
         // Cauthy from before the setting says nothing of it: then it does.
         passwordSignIn: settings.data?.allow_password !== false,
-        signUp: settings.data?.allow_signup !== false,
+        // The workspace's switch, and how the application's own system takes sign-ups.
+        signUp: settings.data?.allow_signup !== false && settings.data?.signup?.mode !== "invite_only",
         // The application's system makes an organization per sign-up: the form asks the company's name.
         ...settings.data?.signup?.organization?.ask === true ? { organization: { ask: true, required: settings.data.signup.organization.required === true } } : {},
         // A sign-in link needs a page of the application to open.