cauthy-auth 0.8.0 → 0.10.0

package/dist/react.d.mts

@@ -260,6 +260,15 @@ interface AccountSession {
  * The signed-in person's own account. What weakens it — the password, the
  * second step, its recovery codes — asks for the current password again.
  */
+/** A provider the account can also sign in with. */
+interface LinkedIdentity {
+    provider: string;
+    /** The address the provider has for the person, when it said. */
+    email: string;
+    name: string;
+    /** When it was linked, in UTC (ISO 8601). */
+    linkedAt: string;
+}
 interface AccountClient {
     /** The account, or null when nobody is signed in. */
     get(): Promise<Account$1 | null>;
@@ -299,6 +308,34 @@ interface AccountClient {
             recoveryCodes: string[];
         }>>;
     };
+    /**
+     * Asks to sign in with another address. Nothing changes yet: the new address
+     * is mailed a link to confirm it, and once it is confirmed the old one is
+     * told, with a link that undoes it. Both open Cauthy's own page.
+     */
+    changeEmail(form: {
+        email: string;
+        password: string;
+    }): Promise<AuthResult<'sent', {
+        email: string;
+    }>>;
+    /** The providers (Google…) the account can also sign in with. */
+    identities(): Promise<LinkedIdentity[]>;
+    /**
+     * Sends the browser to the provider, to link it to the account; it comes back
+     * at `returnTo` with `?linked=<provider>`, or `?auth_error=<code>`.
+     */
+    link(provider: string, options?: {
+        returnTo?: string;
+    }): void;
+    /** Where `link` sends the browser, for a plain link. */
+    linkUrl(provider: string, options?: {
+        returnTo?: string;
+    }): string;
+    /** The account stops signing in with that provider. Refused when it would be left with no way to sign in. */
+    unlink(provider: string): Promise<AuthResult<'unlinked', {
+        provider: string;
+    }>>;
     /** Where the account is signed in. */
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
@@ -395,6 +432,13 @@ interface AuthClientOptions {
     /** Where the server mounted the routes. Default: `/api/auth`. */
     basePath?: string;
     fetch?: typeof fetch;
+    /**
+     * The language the person reads, for what Cauthy mails them (a sign-in
+     * link, a new password, a confirmation): a tag like `es` or `es-CO`, or a
+     * function that answers it when the person can change it. Default: the
+     * page's own (`<html lang>`), else the browser's.
+     */
+    locale?: string | (() => string | undefined);
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
@@ -448,6 +492,15 @@ interface AuthTexts {
     sessions: string;
     signOutEverywhere: string;
     unknownDevice: string;
+    emailAddress: string;
+    newEmail: string;
+    changeEmail: string;
+    emailSent: string;
+    linkedAccounts: string;
+    noLinkedAccounts: string;
+    linkWith: string;
+    unlink: string;
+    linked: string;
     /** By error code; one missing shows what the server said. */
     errors: Record<string, string>;
 }
@@ -576,4 +629,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, type JsonValue, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, createAuthClient, definePolicy, useAuth, useSession };
+export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, type JsonValue, type LinkedIdentity, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, createAuthClient, definePolicy, useAuth, useSession };

package/dist/react.d.ts

@@ -260,6 +260,15 @@ interface AccountSession {
  * The signed-in person's own account. What weakens it — the password, the
  * second step, its recovery codes — asks for the current password again.
  */
+/** A provider the account can also sign in with. */
+interface LinkedIdentity {
+    provider: string;
+    /** The address the provider has for the person, when it said. */
+    email: string;
+    name: string;
+    /** When it was linked, in UTC (ISO 8601). */
+    linkedAt: string;
+}
 interface AccountClient {
     /** The account, or null when nobody is signed in. */
     get(): Promise<Account$1 | null>;
@@ -299,6 +308,34 @@ interface AccountClient {
             recoveryCodes: string[];
         }>>;
     };
+    /**
+     * Asks to sign in with another address. Nothing changes yet: the new address
+     * is mailed a link to confirm it, and once it is confirmed the old one is
+     * told, with a link that undoes it. Both open Cauthy's own page.
+     */
+    changeEmail(form: {
+        email: string;
+        password: string;
+    }): Promise<AuthResult<'sent', {
+        email: string;
+    }>>;
+    /** The providers (Google…) the account can also sign in with. */
+    identities(): Promise<LinkedIdentity[]>;
+    /**
+     * Sends the browser to the provider, to link it to the account; it comes back
+     * at `returnTo` with `?linked=<provider>`, or `?auth_error=<code>`.
+     */
+    link(provider: string, options?: {
+        returnTo?: string;
+    }): void;
+    /** Where `link` sends the browser, for a plain link. */
+    linkUrl(provider: string, options?: {
+        returnTo?: string;
+    }): string;
+    /** The account stops signing in with that provider. Refused when it would be left with no way to sign in. */
+    unlink(provider: string): Promise<AuthResult<'unlinked', {
+        provider: string;
+    }>>;
     /** Where the account is signed in. */
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
@@ -395,6 +432,13 @@ interface AuthClientOptions {
     /** Where the server mounted the routes. Default: `/api/auth`. */
     basePath?: string;
     fetch?: typeof fetch;
+    /**
+     * The language the person reads, for what Cauthy mails them (a sign-in
+     * link, a new password, a confirmation): a tag like `es` or `es-CO`, or a
+     * function that answers it when the person can change it. Default: the
+     * page's own (`<html lang>`), else the browser's.
+     */
+    locale?: string | (() => string | undefined);
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
@@ -448,6 +492,15 @@ interface AuthTexts {
     sessions: string;
     signOutEverywhere: string;
     unknownDevice: string;
+    emailAddress: string;
+    newEmail: string;
+    changeEmail: string;
+    emailSent: string;
+    linkedAccounts: string;
+    noLinkedAccounts: string;
+    linkWith: string;
+    unlink: string;
+    linked: string;
     /** By error code; one missing shows what the server said. */
     errors: Record<string, string>;
 }
@@ -576,4 +629,4 @@ declare function useSession(): SessionContext;
  */
 declare function useAuth(): AuthClient & Pick<SessionContext, 'session' | 'status' | 'refresh'>;
 
-export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, type JsonValue, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, createAuthClient, definePolicy, useAuth, useSession };
+export { Account, type AccountClient, type Account$1 as AccountDetails, type AccountProps, type AccountSession, type AuthClient, type AuthError, type AuthFormProps, type AuthMethods, type AuthResult, type AuthTexts, CauthyProvider, type CauthyProviderProps, ForgotPassword, type JsonValue, type LinkedIdentity, type PermissionOf, type Policy, type PublicSession, ResetPassword, type RoleOf, type SessionContext, type SessionOrganization, type SessionUser, SignIn, SignUp, VerifyEmail, can, createAuthClient, definePolicy, useAuth, useSession };

package/dist/react.js

@@ -139,13 +139,17 @@ var UNAVAILABLE = { code: "unavailable", message: "Sign-in is unavailable right
 function createAuthClient(options = {}) {
   const base = (options.basePath ?? "/api/auth").replace(/\/+$/, "");
   const doFetch = (...args) => (options.fetch ?? fetch)(...args);
+  const locale = () => {
+    const said = typeof options.locale === "function" ? options.locale() : options.locale;
+    return (said ?? (typeof document === "undefined" ? "" : document.documentElement?.lang) ?? "").trim();
+  };
   async function post(path, form, bad) {
     if (bad) return { ok: false, error: { code: bad.code, message: bad.message, field: bad.field } };
     try {
       const res = await doFetch(`${base}${path}`, {
         method: "POST",
         credentials: "same-origin",
-        headers: { "content-type": "application/json", accept: "application/json" },
+        headers: { "content-type": "application/json", accept: "application/json", ...locale() ? { "x-cauthy-locale": locale() } : {} },
         body: JSON.stringify(form)
       });
       const body = await res.json().catch(() => null);
@@ -165,6 +169,7 @@ function createAuthClient(options = {}) {
       return null;
     }
   }
+  const linkUrl = (provider, o = {}) => `${base}/me/identities/link/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const socialUrl = (provider, o = {}) => `${base}/sign-in/social/${encodeURIComponent(provider)}${o.returnTo ? `?return_to=${encodeURIComponent(o.returnTo)}` : ""}`;
   const passkeyUrl = (o = {}) => {
     const q = new URLSearchParams({ method: "passkey" });
@@ -211,6 +216,16 @@ function createAuthClient(options = {}) {
         disable: (f) => post("/me/mfa/disable", { password: f.password }, null),
         recoveryCodes: (f) => post("/me/mfa/recovery-codes", { password: f.password }, null)
       },
+      changeEmail: (f) => post("/me/email", { email: f.email, password: f.password }, checkEmail(f.email)),
+      async identities() {
+        const body = await read("/me/identities");
+        return body && Array.isArray(body.identities) ? body.identities : [];
+      },
+      linkUrl,
+      link(provider, o) {
+        window.location.assign(linkUrl(provider, o));
+      },
+      unlink: (provider) => post("/me/identities/unlink", { provider }, null),
       async sessions() {
         const body = await read("/me/sessions");
         return body && Array.isArray(body.sessions) ? body.sessions : [];
@@ -347,6 +362,15 @@ var TEXTS = {
     sessions: "Where you are signed in",
     signOutEverywhere: "Sign out everywhere",
     unknownDevice: "Unknown device",
+    emailAddress: "Email address",
+    newEmail: "New email address",
+    changeEmail: "Change email",
+    emailSent: "We sent a link to {email}. Your address changes once you open it.",
+    linkedAccounts: "Linked accounts",
+    noLinkedAccounts: "No account is linked.",
+    linkWith: "Link",
+    unlink: "Unlink",
+    linked: "The account was linked.",
     errors: {
       required: "This is required.",
       invalid_email: "That does not look like an email address.",
@@ -355,6 +379,11 @@ var TEXTS = {
       unavailable: "Sign-in is unavailable right now. Try again in a moment.",
       state_mismatch: "That sign-in could not be completed. Try again.",
       cancelled: "The sign-in was cancelled.",
+      email_taken: "That address already has an account.",
+      email_unchanged: "That is already your address.",
+      last_sign_in_method: "Add a password or link another account first: it is your only way to sign in.",
+      identity_already_linked: "That account is linked to someone else.",
+      manual_linking_disabled: "Linking accounts is turned off for this workspace.",
       invalid_token: "This link is not valid, or it has expired. Ask for a new one.",
       invalid_code: "That code is not right, or it has expired.",
       wrong_password: "The current password is not right.",
@@ -412,6 +441,15 @@ var TEXTS = {
     sessions: "D\xF3nde tienes la sesi\xF3n abierta",
     signOutEverywhere: "Cerrar sesi\xF3n en todas partes",
     unknownDevice: "Dispositivo desconocido",
+    emailAddress: "Correo",
+    newEmail: "Correo nuevo",
+    changeEmail: "Cambiar el correo",
+    emailSent: "Enviamos un enlace a {email}. Tu correo cambia cuando lo abras.",
+    linkedAccounts: "Cuentas vinculadas",
+    noLinkedAccounts: "No hay cuentas vinculadas.",
+    linkWith: "Vincular",
+    unlink: "Desvincular",
+    linked: "La cuenta qued\xF3 vinculada.",
     errors: {
       required: "Este dato es obligatorio.",
       invalid_email: "Eso no parece un correo.",
@@ -420,6 +458,11 @@ var TEXTS = {
       unavailable: "No se puede entrar en este momento. Intenta de nuevo en un momento.",
       state_mismatch: "No se pudo completar el ingreso. Intenta de nuevo.",
       cancelled: "El ingreso se cancel\xF3.",
+      email_taken: "Ese correo ya tiene una cuenta.",
+      email_unchanged: "Ese ya es tu correo.",
+      last_sign_in_method: "Primero agrega una contrase\xF1a o vincula otra cuenta: es tu \xFAnica forma de entrar.",
+      identity_already_linked: "Esa cuenta est\xE1 vinculada a otra persona.",
+      manual_linking_disabled: "Vincular cuentas est\xE1 desactivado en este workspace.",
       invalid_token: "Este enlace no es v\xE1lido o ya venci\xF3. Pide uno nuevo.",
       invalid_code: "Ese c\xF3digo no es correcto o ya venci\xF3.",
       wrong_password: "La contrase\xF1a actual no es correcta.",
@@ -779,7 +822,9 @@ function Account(props) {
   const when = props.formatDate ?? ((iso) => new Date(iso).toLocaleString());
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: cx("account"), ...root, children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ProfilePart, { props, account, onSaved: setAccount }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(EmailPart, { props, account }),
     account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(PasswordPart, { props }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LinkedPart, { props }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SecondStepPart, { props, account, onChanged: (mfaEnabled) => setAccount({ ...account, mfaEnabled }) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: cx("section"), children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: cx("heading"), children: t.passkeys }),
@@ -818,6 +863,65 @@ function ProfilePart({ props, account, onSaved }) {
     done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
   ] });
 }
+function EmailPart({ props, account }) {
+  const auth = useAuth();
+  const { f, done, setDone, run, general } = useSection(props);
+  const [email, setEmail] = (0, import_react.useState)("");
+  const [password, setPassword] = (0, import_react.useState)("");
+  const submit = async (e) => {
+    e.preventDefault();
+    const r = await run(() => auth.account.changeEmail({ email, password }));
+    if (!r.ok) return;
+    setPassword("");
+    setDone(f.t.emailSent.replace("{email}", r.email));
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("form", { className: f.cx("section"), onSubmit: submit, noValidate: true, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.emailAddress }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: account.email }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "email", type: "email", label: f.t.newEmail, value: email, autoComplete: "email", required: true, onChange: setEmail }),
+    account.hasPassword && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Field, { f, name: "password", type: "password", label: f.t.currentPassword, value: password, autoComplete: "current-password", required: true, onChange: setPassword }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "submit", disabled: f.busy, className: f.cx("button"), children: f.t.changeEmail }),
+    done && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: done })
+  ] });
+}
+function LinkedPart({ props }) {
+  const auth = useAuth();
+  const { f, run, general } = useSection(props);
+  const [linked, setLinked] = (0, import_react.useState)(null);
+  const [offered, setOffered] = (0, import_react.useState)([]);
+  const [came, setCame] = (0, import_react.useState)(null);
+  (0, import_react.useEffect)(() => {
+    void auth.account.identities().then(setLinked);
+    void auth.methods().then((m) => setOffered(m.providers));
+    const back = typeof window === "undefined" ? null : new URLSearchParams(window.location.search);
+    if (back?.get("linked")) setCame(back.get("linked"));
+    else if (back?.get("auth_error")) f.setError({ code: back.get("auth_error"), message: "That account could not be linked. Try again." });
+  }, []);
+  if (linked === null) return null;
+  const name = (id) => offered.find((p) => p.id === id)?.name ?? id;
+  const unlink = async (provider) => {
+    const r = await run(() => auth.account.unlink(provider));
+    if (r.ok) setLinked(linked.filter((x) => x.provider !== provider));
+  };
+  const here = typeof window === "undefined" ? void 0 : window.location.pathname;
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { className: f.cx("section"), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { className: f.cx("heading"), children: f.t.linkedAccounts }),
+    came && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "status", className: f.cx("notice"), children: f.t.linked }),
+    general && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { role: "alert", className: f.cx("error"), children: f.say(general) }),
+    linked.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: f.cx("notice"), children: f.t.noLinkedAccounts }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ul", { className: f.cx("sessions"), children: linked.map((x) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: f.cx("session"), children: [
+      name(x.provider),
+      x.email ? ` \xB7 ${x.email}` : "",
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(f.Button, { type: "button", disabled: f.busy, className: f.cx("providerButton"), onClick: () => void unlink(x.provider), children: f.t.unlink })
+    ] }, x.provider)) }),
+    offered.filter((p) => !linked.some((x) => x.provider === p.id)).map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(f.Button, { type: "button", className: f.cx("providerButton"), onClick: () => auth.account.link(p.id, { returnTo: here }), children: [
+      f.t.linkWith,
+      " ",
+      p.name
+    ] }, p.id))
+  ] });
+}
 function PasswordPart({ props }) {
   const auth = useAuth();
   const { f, done, setDone, run, general } = useSection(props);