cauthy-auth 0.9.0 → 0.11.0

package/dist/client.d.mts

@@ -4,6 +4,9 @@ import { A as AuthField } from './validate-B_iC-4y8.mjs';
 export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.mjs';
 import 'jose';
 
+/** Whether this browser can use a passkey at all. */
+declare function canUsePasskeys(): boolean;
+
 interface SessionState {
     /** The signed-in person and their organizations, or null. */
     session: PublicSession | null;
@@ -70,8 +73,29 @@ interface AuthMethods {
     /** Whether people may create an account themselves. */
     signUp: boolean;
     magicLink: boolean;
-    /** Whether to offer a passkey. It is asked for on Cauthy's page: the person goes there for that step and comes back signed in. */
+    /** Whether to offer a passkey. */
     passkey: boolean;
+    /**
+     * Whether the passkey is used on this page itself. False: `signIn.passkey`
+     * sends the person to Cauthy's page for that step alone, and they come back
+     * signed in. That happens only when this page is outside the domain the
+     * workspace's passkeys belong to.
+     */
+    passkeyHere: boolean;
+    /**
+     * Whether Cauthy's page can use the passkey, for that step alone: where a
+     * page that cannot, or a browser that refuses to here, sends the person.
+     */
+    passkeyOnCauthy: boolean;
+}
+/** A passkey of the signed-in account. Moments are UTC. */
+interface Passkey {
+    id: string;
+    /** What the person called it ("My laptop"), or "". */
+    name: string;
+    createdAt: string;
+    /** When it last signed the person in, or null. */
+    lastUsedAt: string | null;
 }
 /** A person's own account, as their account screen shows it. */
 interface Account {
@@ -175,6 +199,22 @@ interface AccountClient {
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
     signOutEverywhere(): Promise<AuthResult<'signed_out'>>;
+    /** The account's passkeys. */
+    passkeys(): Promise<Passkey[]>;
+    /**
+     * Makes a passkey on this device, on this page: the browser asks the person
+     * for their fingerprint, face or screen lock. An account with a password
+     * proves it again first. `cancelled`: the person closed the browser's prompt.
+     */
+    addPasskey(form?: {
+        password?: string;
+        name?: string;
+    }): Promise<AuthResult<'added', {
+        passkey: Passkey;
+    }>>;
+    removePasskey(id: string): Promise<AuthResult<'removed', {
+        id: string;
+    }>>;
 }
 interface AuthClient {
     signIn: {
@@ -207,12 +247,21 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** Sends the browser to Cauthy's page to use a passkey; it comes back signed in, at `returnTo`. */
+        /**
+         * Signs in with a passkey, on this page: the browser asks the person for
+         * their fingerprint, face or screen lock. When this page cannot use the
+         * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
+         * to Cauthy's page for that step alone and comes back signed in, at
+         * `returnTo`: then the answer is `redirected`. `cancelled`: the person
+         * closed the browser's prompt.
+         */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
-        }): void;
-        /** Where `passkey` sends the browser, for a plain link. */
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }> | AuthResult<'redirected'>>;
+        /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
             locale?: string;
@@ -267,7 +316,14 @@ interface AuthClientOptions {
     /** Where the server mounted the routes. Default: `/api/auth`. */
     basePath?: string;
     fetch?: typeof fetch;
+    /**
+     * The language the person reads, for what Cauthy mails them (a sign-in
+     * link, a new password, a confirmation): a tag like `es` or `es-CO`, or a
+     * function that answers it when the person can change it. Default: the
+     * page's own (`<html lang>`), else the browser's.
+     */
+    locale?: string | (() => string | undefined);
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type SessionState, type SessionStore, type SessionStoreOptions, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type Passkey, type SessionState, type SessionStore, type SessionStoreOptions, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.d.ts

@@ -4,6 +4,9 @@ import { A as AuthField } from './validate-B_iC-4y8.js';
 export { F as FieldProblem, M as MIN_PASSWORD, c as checkCode, a as checkEmail, b as checkName, d as checkNewPassword, e as checkPassword } from './validate-B_iC-4y8.js';
 import 'jose';
 
+/** Whether this browser can use a passkey at all. */
+declare function canUsePasskeys(): boolean;
+
 interface SessionState {
     /** The signed-in person and their organizations, or null. */
     session: PublicSession | null;
@@ -70,8 +73,29 @@ interface AuthMethods {
     /** Whether people may create an account themselves. */
     signUp: boolean;
     magicLink: boolean;
-    /** Whether to offer a passkey. It is asked for on Cauthy's page: the person goes there for that step and comes back signed in. */
+    /** Whether to offer a passkey. */
     passkey: boolean;
+    /**
+     * Whether the passkey is used on this page itself. False: `signIn.passkey`
+     * sends the person to Cauthy's page for that step alone, and they come back
+     * signed in. That happens only when this page is outside the domain the
+     * workspace's passkeys belong to.
+     */
+    passkeyHere: boolean;
+    /**
+     * Whether Cauthy's page can use the passkey, for that step alone: where a
+     * page that cannot, or a browser that refuses to here, sends the person.
+     */
+    passkeyOnCauthy: boolean;
+}
+/** A passkey of the signed-in account. Moments are UTC. */
+interface Passkey {
+    id: string;
+    /** What the person called it ("My laptop"), or "". */
+    name: string;
+    createdAt: string;
+    /** When it last signed the person in, or null. */
+    lastUsedAt: string | null;
 }
 /** A person's own account, as their account screen shows it. */
 interface Account {
@@ -175,6 +199,22 @@ interface AccountClient {
     sessions(): Promise<AccountSession[]>;
     /** Signs the account out everywhere, here too. */
     signOutEverywhere(): Promise<AuthResult<'signed_out'>>;
+    /** The account's passkeys. */
+    passkeys(): Promise<Passkey[]>;
+    /**
+     * Makes a passkey on this device, on this page: the browser asks the person
+     * for their fingerprint, face or screen lock. An account with a password
+     * proves it again first. `cancelled`: the person closed the browser's prompt.
+     */
+    addPasskey(form?: {
+        password?: string;
+        name?: string;
+    }): Promise<AuthResult<'added', {
+        passkey: Passkey;
+    }>>;
+    removePasskey(id: string): Promise<AuthResult<'removed', {
+        id: string;
+    }>>;
 }
 interface AuthClient {
     signIn: {
@@ -207,12 +247,21 @@ interface AuthClient {
         }): Promise<AuthResult<'signed_in', {
             session: PublicSession;
         }>>;
-        /** Sends the browser to Cauthy's page to use a passkey; it comes back signed in, at `returnTo`. */
+        /**
+         * Signs in with a passkey, on this page: the browser asks the person for
+         * their fingerprint, face or screen lock. When this page cannot use the
+         * workspace's passkeys (`methods().passkeyHere` is false), the browser goes
+         * to Cauthy's page for that step alone and comes back signed in, at
+         * `returnTo`: then the answer is `redirected`. `cancelled`: the person
+         * closed the browser's prompt.
+         */
         passkey(options?: {
             returnTo?: string;
             locale?: string;
-        }): void;
-        /** Where `passkey` sends the browser, for a plain link. */
+        }): Promise<AuthResult<'signed_in', {
+            session: PublicSession;
+        }> | AuthResult<'redirected'>>;
+        /** Where `passkey` sends the browser when this page cannot use the passkey itself. */
         passkeyUrl(options?: {
             returnTo?: string;
             locale?: string;
@@ -267,7 +316,14 @@ interface AuthClientOptions {
     /** Where the server mounted the routes. Default: `/api/auth`. */
     basePath?: string;
     fetch?: typeof fetch;
+    /**
+     * The language the person reads, for what Cauthy mails them (a sign-in
+     * link, a new password, a confirmation): a tag like `es` or `es-CO`, or a
+     * function that answers it when the person can change it. Default: the
+     * page's own (`<html lang>`), else the browser's.
+     */
+    locale?: string | (() => string | undefined);
 }
 declare function createAuthClient(options?: AuthClientOptions): AuthClient;
 
-export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type SessionState, type SessionStore, type SessionStoreOptions, createAuthClient, createSessionStore };
+export { type Account, type AccountClient, type AccountSession, type AuthClient, type AuthClientOptions, type AuthError, AuthField, type AuthMethods, type AuthResult, type LinkedIdentity, type Passkey, type SessionState, type SessionStore, type SessionStoreOptions, canUsePasskeys, createAuthClient, createSessionStore };

package/dist/client.js

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   MIN_PASSWORD: () => MIN_PASSWORD,
+  canUsePasskeys: () => canUsePasskeys,
   checkCode: () => checkCode,
   checkEmail: () => checkEmail,
   checkName: () => checkName,
@@ -31,6 +32,73 @@ __export(client_exports, {
 });
 module.exports = __toCommonJS(client_exports);
 
+// src/passkey.ts
+function canUsePasskeys() {
+  return typeof window !== "undefined" && typeof window.PublicKeyCredential === "function" && typeof navigator !== "undefined" && typeof navigator.credentials?.get === "function";
+}
+function bytes(text2) {
+  const b64 = text2.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(text2.length / 4) * 4, "=");
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out.buffer;
+}
+function text(buf) {
+  if (!buf) return null;
+  const view = new Uint8Array(buf);
+  let bin = "";
+  for (let i = 0; i < view.byteLength; i++) bin += String.fromCharCode(view[i]);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+var withId = (list) => (list ?? []).map((c) => ({ ...c, id: bytes(c.id) }));
+async function getPasskey(options) {
+  const publicKey = { ...options, challenge: bytes(options.challenge), allowCredentials: withId(options.allowCredentials) };
+  const cred = await navigator.credentials.get({ publicKey });
+  if (cred === null) throw new DOMException("No passkey was chosen.", "NotAllowedError");
+  const r = cred.response;
+  return {
+    id: cred.id,
+    rawId: text(cred.rawId),
+    type: cred.type,
+    response: {
+      authenticatorData: text(r.authenticatorData),
+      clientDataJSON: text(r.clientDataJSON),
+      signature: text(r.signature),
+      userHandle: text(r.userHandle)
+    },
+    clientExtensionResults: cred.getClientExtensionResults?.() ?? {}
+  };
+}
+async function makePasskey(options) {
+  const publicKey = {
+    ...options,
+    challenge: bytes(options.challenge),
+    user: { ...options.user, id: bytes(options.user.id) },
+    excludeCredentials: withId(options.excludeCredentials)
+  };
+  const cred = await navigator.credentials.create({ publicKey });
+  if (cred === null) throw new DOMException("No passkey was made.", "NotAllowedError");
+  const r = cred.response;
+  return {
+    id: cred.id,
+    rawId: text(cred.rawId),
+    type: cred.type,
+    response: {
+      clientDataJSON: text(r.clientDataJSON),
+      attestationObject: text(r.attestationObject),
+      transports: typeof r.getTransports === "function" ? r.getTransports() : []
+    },
+    clientExtensionResults: cred.getClientExtensionResults?.() ?? {}
+  };
+}
+function ceremonyError(e) {
+  const name = e instanceof Error || e instanceof DOMException ? e.name : "";
+  if (name === "NotAllowedError" || name === "AbortError") return { code: "cancelled", message: "The passkey was not used. Try again when you are ready." };
+  if (name === "InvalidStateError") return { code: "passkey_exists", message: "This device already has a passkey for this account." };
+  if (name === "SecurityError") return { code: "passkey_unavailable", message: "Passkeys cannot be used on this page." };
+  return { code: "passkey_failed", message: "The passkey could not be used. Try again, or sign in another way." };
+}
+
 // src/theme.ts
 function fromWire(wire) {
   const names = {
@@ -196,7 +264,8 @@ function createSessionStore(options = {}) {
         email: (f) => then(client.signIn.email(f)),
         mfa: (f) => then(client.signIn.mfa(f)),
         magicLinkVerify: (f) => then(client.signIn.magicLinkVerify(f)),
-        emailCode: (f) => then(client.signIn.emailCode(f))
+        emailCode: (f) => then(client.signIn.emailCode(f)),
+        passkey: (o) => then(client.signIn.passkey(o))
       },
       signUp: { email: (f) => then(client.signUp.email(f)) },
       signOut: () => then(client.signOut()),
@@ -216,13 +285,17 @@ var UNAVAILABLE = { code: "unavailable", message: "Sign-in is unavailable right
 function createAuthClient(options = {}) {
   const base = (options.basePath ?? "/api/auth").replace(/\/+$/, "");
   const doFetch = (...args) => (options.fetch ?? fetch)(...args);
+  const locale = () => {
+    const said = typeof options.locale === "function" ? options.locale() : options.locale;
+    return (said ?? (typeof document === "undefined" ? "" : document.documentElement?.lang) ?? "").trim();
+  };
   async function post(path, form, bad) {
     if (bad) return { ok: false, error: { code: bad.code, message: bad.message, field: bad.field } };
     try {
       const res = await doFetch(`${base}${path}`, {
         method: "POST",
         credentials: "same-origin",
-        headers: { "content-type": "application/json", accept: "application/json" },
+        headers: { "content-type": "application/json", accept: "application/json", ...locale() ? { "x-cauthy-locale": locale() } : {} },
         body: JSON.stringify(form)
       });
       const body = await res.json().catch(() => null);
@@ -250,6 +323,28 @@ function createAuthClient(options = {}) {
     if (o.locale) q.set("locale", o.locale);
     return `${base}/login?${q}`;
   };
+  async function methods() {
+    try {
+      const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
+      if (res.ok) {
+        const m = await res.json();
+        return { providers: [], signUp: true, magicLink: false, passkey: false, ...m, passkeyHere: m.passkeyHere === true, passkeyOnCauthy: m.passkeyOnCauthy ?? m.passkey === true };
+      }
+    } catch {
+    }
+    return { providers: [], signUp: true, magicLink: false, passkey: false, passkeyHere: false, passkeyOnCauthy: false };
+  }
+  async function ceremony(begin, finish, form, run, more = {}) {
+    const begun = await post(begin, form, null);
+    if (!begun.ok) return begun;
+    let credential;
+    try {
+      credential = await run(begun.options);
+    } catch (e) {
+      return { ok: false, error: ceremonyError(e) };
+    }
+    return post(finish, { credential, ...more }, null);
+  }
   return {
     signIn: {
       email: (f) => post("/sign-in/email", { email: f.email, password: f.password }, firstProblem(checkEmail(f.email), checkPassword(f.password))),
@@ -258,8 +353,16 @@ function createAuthClient(options = {}) {
       magicLinkVerify: (f) => post("/sign-in/magic-link/verify", { token: f.token }, null),
       emailCode: (f) => post("/sign-in/email-code", { code: f.code }, checkCode(f.code)),
       passkeyUrl,
-      passkey(o) {
+      async passkey(o) {
+        const m = await methods();
+        if (m.passkeyHere && canUsePasskeys()) {
+          const r = await ceremony("/sign-in/passkey/begin", "/sign-in/passkey/finish", {}, getPasskey);
+          if (r.ok || r.error.code !== "passkey_unavailable" || !m.passkeyOnCauthy) return r;
+        } else if (!m.passkeyOnCauthy) {
+          return { ok: false, error: { code: "passkey_unavailable", message: "Passkeys cannot be used here." } };
+        }
         window.location.assign(passkeyUrl(o));
+        return { ok: true, status: "redirected" };
       },
       socialUrl,
       social(provider, o) {
@@ -303,7 +406,16 @@ function createAuthClient(options = {}) {
         const body = await read("/me/sessions");
         return body && Array.isArray(body.sessions) ? body.sessions : [];
       },
-      signOutEverywhere: () => post("/me/sessions/end", {}, null)
+      signOutEverywhere: () => post("/me/sessions/end", {}, null),
+      async passkeys() {
+        const body = await read("/me/passkeys");
+        return body && Array.isArray(body.passkeys) ? body.passkeys : [];
+      },
+      addPasskey(f = {}) {
+        if (!canUsePasskeys()) return Promise.resolve({ ok: false, error: { code: "passkey_unavailable", message: "This browser cannot make passkeys." } });
+        return ceremony("/me/passkeys/add/begin", "/me/passkeys/add/finish", { password: f.password ?? "" }, makePasskey, { name: f.name ?? "" });
+      },
+      removePasskey: (id) => post("/me/passkeys/remove", { id }, null)
     },
     async getSession() {
       try {
@@ -318,19 +430,13 @@ function createAuthClient(options = {}) {
       looked ??= read("/look").then((wire) => wire && typeof wire === "object" ? fromWire(wire) : null);
       return looked;
     },
-    async methods() {
-      try {
-        const res = await doFetch(`${base}/methods`, { credentials: "same-origin", headers: { accept: "application/json" } });
-        if (res.ok) return await res.json();
-      } catch {
-      }
-      return { providers: [], signUp: true, magicLink: false, passkey: false };
-    }
+    methods
   };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   MIN_PASSWORD,
+  canUsePasskeys,
   checkCode,
   checkEmail,
   checkName,