cauthy-auth 0.8.0 → 0.10.0

package/dist/index.mjs

@@ -1013,10 +1013,15 @@ function createCauthy(given = {}) {
           accept: "application/json",
           // A link Cauthy mails opens the application's page for it when it
           // has one; otherwise Cauthy's own. Either way in the reader's language.
-          ...page ? { "x-cauthy-link-to": `${originOf(request)}${page}`, "x-cauthy-client-id": clientId } : { "x-cauthy-links": "hosted" },
+          ...page ? { "x-cauthy-link-to": `${originOf(request)}${page}` } : { "x-cauthy-links": "hosted" },
+          // Whose request it is: what Cauthy mails goes in this application's
+          // name, under its logo.
+          ...clientId ? { "x-cauthy-client-id": clientId } : {},
           ...await passedOn(request),
           ...bearer2 ? { authorization: `Bearer ${bearer2}` } : {},
           ...request.headers.get("accept-language") ? { "accept-language": request.headers.get("accept-language") } : {},
+          // The language the application says its person reads, over the browser's.
+          ...request.headers.get("x-cauthy-locale") ? { "x-cauthy-locale": request.headers.get("x-cauthy-locale") } : {},
           ...request.headers.get("user-agent") ? { "user-agent": request.headers.get("user-agent") } : {},
           ...payload === void 0 ? {} : { "content-type": "application/json" }
         },
@@ -1055,7 +1060,7 @@ function createCauthy(given = {}) {
   let lookCache = null;
   async function ownRoute(request, url, route) {
     const post = request.method === "POST";
-    const own = ["/sign-in/email", "/sign-in/mfa", "/sign-up/email", "/forgot-password", "/reset-password", "/verify-email", "/sign-in/magic-link", "/sign-in/magic-link/verify", "/sign-in/email-code", "/me", "/me/password", "/me/mfa/setup", "/me/mfa/verify", "/me/mfa/disable", "/me/mfa/recovery-codes", "/me/sessions", "/me/sessions/end", "/sign-out", "/methods", "/look"].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/");
+    const own = ["/sign-in/email", "/sign-in/mfa", "/sign-up/email", "/forgot-password", "/reset-password", "/verify-email", "/sign-in/magic-link", "/sign-in/magic-link/verify", "/sign-in/email-code", "/me", "/me/password", "/me/mfa/setup", "/me/mfa/verify", "/me/mfa/disable", "/me/mfa/recovery-codes", "/me/sessions", "/me/sessions/end", "/me/email", "/me/identities", "/me/identities/unlink", "/sign-out", "/methods", "/look"].includes(route) || route.startsWith("/sign-in/social/") || route.startsWith("/callback/") || route.startsWith("/me/identities/link/");
     if (!own) return null;
     if (tenant === "") {
       return problem(500, "not_configured", "cauthy-auth: tenant (CAUTHY_TENANT) is required for the application's own sign-in screens");
@@ -1098,16 +1103,46 @@ function createCauthy(given = {}) {
       const clear = writeCookie(stepCookie, "", attrs(request, 0));
       const back = step?.returnTo ?? afterSignIn;
       const failedTo = (code2) => redirect(`${back}${back.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code2)}`, [clear]);
-      if (step === null || step.kind !== "social" || step.provider !== provider || url.searchParams.get("state") !== step.token) return failedTo("state_mismatch");
+      if (step === null || step.kind !== "social" && step.kind !== "link" || step.provider !== provider || url.searchParams.get("state") !== step.token) return failedTo("state_mismatch");
       const code = url.searchParams.get("code");
       if (!code) return failedTo(url.searchParams.get("error") === "access_denied" ? "cancelled" : "provider_refused");
       const q = new URLSearchParams({ code, state: step.token, redirect_uri: `${originOf(request)}${basePath}/callback/${provider}` });
+      if (step.kind === "link") {
+        const mine = await signedInAs(request);
+        if ("response" in mine) return failedTo("unauthenticated");
+        const linked = await ask(request, "GET", `/v1/auth/identities/${provider}/link/callback?${q}`, void 0, void 0, mine.token);
+        if (linked.error) return failedTo(linked.error.code);
+        const h = new Headers(mine.headers);
+        h.append("set-cookie", clear);
+        return redirect(`${back}${back.includes("?") ? "&" : "?"}linked=${encodeURIComponent(provider)}`, [...h.getSetCookie()]);
+      }
       const done = await ask(request, "GET", `/v1/auth/social/${provider}/callback?${q}`);
       if (done.error) return failedTo(done.error.code);
       const s = await stored(done.data);
       if (s === null) return failedTo("unavailable");
       return redirect(back, [...await write(request, s, readCookies(request.headers.get("cookie"))), clear]);
     }
+    if (route.startsWith("/me/identities/link/") && !post) {
+      const provider = providerIn(route.slice("/me/identities/link/".length));
+      if (!PROVIDER_ID.test(provider)) return new Response("Not found", { status: 404 });
+      const returnTo = localPath(url.searchParams.get("return_to"), afterSignIn);
+      const failed2 = (code) => redirect(`${returnTo}${returnTo.includes("?") ? "&" : "?"}auth_error=${encodeURIComponent(code)}`);
+      const mine = await signedInAs(request);
+      if ("response" in mine) return failed2("unauthenticated");
+      const callback2 = `${basePath}/callback/${provider}`;
+      const started = await ask(request, "GET", `/v1/auth/identities/${provider}/link?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback2}`)}`, void 0, callback2, mine.token);
+      if (started.error || typeof started.data?.redirect_url !== "string") return failed2(started.error?.code ?? "provider_unavailable");
+      const step = { kind: "link", token: String(started.data.state ?? ""), provider, returnTo };
+      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, await key), attrs(request, STEP_SECONDS))]);
+    }
+    if (route === "/me/identities" && !post) {
+      const mine = await signedInAs(request);
+      if ("response" in mine) return mine.response;
+      const res = await ask(request, "GET", "/v1/auth/identities", void 0, void 0, mine.token);
+      if (res.error) return problem(res.status, res.error.code, res.error.message, void 0, mine.headers);
+      const list = Array.isArray(res.data) ? res.data : [];
+      return json({ identities: list.map((x) => ({ provider: String(x.provider ?? ""), email: String(x.email ?? ""), name: String(x.name ?? ""), linkedAt: String(x.linked_at ?? "") })) }, 200, mine.headers);
+    }
     if ((route === "/me" || route === "/me/sessions") && !post) {
       const mine = await signedInAs(request);
       if ("response" in mine) return mine.response;
@@ -1224,6 +1259,21 @@ function createCauthy(given = {}) {
         if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : void 0);
         return json({ status: "renewed", recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers);
       }
+      if (route === "/me/email") {
+        const bad = checkEmail(b.email);
+        if (bad) return invalid(bad);
+        const email = String(b.email).trim();
+        const res = await as("/v1/auth/me/email", { email, password });
+        if (res.error) return refused(res, res.error.code === "step_up_required" ? "password" : ["invalid_email", "email_unchanged", "email_taken"].includes(res.error.code) ? "email" : void 0);
+        return json({ status: "sent", email }, 200, mine.headers);
+      }
+      if (route === "/me/identities/unlink") {
+        const provider = typeof b.provider === "string" ? b.provider : "";
+        if (!PROVIDER_ID.test(provider)) return problem(400, "invalid_provider", "Say which provider to unlink.", "provider", mine.headers);
+        const res = await as(`/v1/auth/identities/${provider}`, void 0, "DELETE");
+        if (res.error) return refused(res);
+        return json({ status: "unlinked", provider }, 200, mine.headers);
+      }
       if (route === "/me/sessions/end") {
         const res = await as("/v1/auth/me/sessions", void 0, "DELETE");
         if (res.error) return refused(res);