cauthy-auth 0.39.0 → 0.40.0

package/README.md

@@ -235,7 +235,7 @@ npx cauthy-auth init
 npx cauthy-auth init --system ledger --app-url https://app.example.com   # production
 ```
 
-The same client is your application's own identity: it manages its organizations with no person's token. When people sign in with a public client (no secret) and the application's identity is a confidential client beside it, give the key that client's id: `systemKey: { privateKey, keyId, clientId }`. Its sign-ins then carry the proof that tells Cauthy which application signed the person in, and from what address.
+The same client is your application's own identity: it manages its organizations with no person's token. When people sign in with a public client (no secret) and the application's identity is a confidential client beside it, give the key that client's id: `systemKey: { privateKey, keyId, clientId }`. Its sign-ins then carry the proof that tells Cauthy which application signed the person in, and from what address. The proof also goes with the code exchange at the end of a sign-in through Cauthy's page, which a contract can require (`sign_in.require_system_proof`).
 
 ```ts
 const org = await auth.system.organizations.create({ name: 'Acme' })

package/dist/index.js

@@ -1212,13 +1212,13 @@ function createCauthy(given = {}) {
     return proto === "https" || proto === "http" ? `${proto}://${url.host}` : url.origin;
   };
   const attrs = (request, maxAge) => ({ secure: originOf(request).startsWith("https://"), maxAge });
-  async function token(form) {
+  async function token(form, proof = {}) {
     const body2 = new URLSearchParams({ client_id: clientId, ...form });
     if (clientSecret) body2.set("client_secret", clientSecret);
     try {
       const res = await doFetch(`${issuer}/v1/oauth/token`, {
         method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+        headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json", ...proof },
         body: body2
       });
       if (res.ok) return { ok: true, body: await res.json() };
@@ -1458,7 +1458,7 @@ function createCauthy(given = {}) {
       code,
       redirect_uri: `${originOf(request)}${basePath}/callback`,
       code_verifier: flow.verifier
-    });
+    }, await passedOn(request));
     const s = res.ok ? await stored(res.body) : null;
     if (s === null) return failed(request, "exchange_failed");
     return redirect(flow.returnTo, [...await write(request, s, had), writeCookie(flowCookie, "", attrs(request, 0)), writeCookie(againCookie, "", attrs(request, 0))]);
@@ -1570,7 +1570,7 @@ function createCauthy(given = {}) {
       const proof = { "x-cauthy-system-token": await ownSystem.token(), "x-cauthy-app-origin": originOf(request) };
       return ip ? { ...proof, "x-cauthy-client-ip": ip } : proof;
     } catch {
-      noProofUntil = Date.now() + 5 * 6e4;
+      noProofUntil = Date.now() + 3e4;
       return {};
     }
   }