decane-connect-kit 2.29.1 → 2.30.0

package/dist/index.cjs

@@ -42,6 +42,7 @@ __export(errors_exports, {
   InvalidApiKeyError: () => InvalidApiKeyError,
   InvalidPinError: () => InvalidPinError,
   InvalidRecoveryFileError: () => InvalidRecoveryFileError,
+  LoginInUseError: () => LoginInUseError,
   NetworkError: () => NetworkError,
   NewDeviceError: () => NewDeviceError,
   OriginNotAllowedError: () => OriginNotAllowedError,
@@ -64,7 +65,7 @@ __export(errors_exports, {
   WrongPasswordError: () => WrongPasswordError,
   WrongUnlockPasswordError: () => WrongUnlockPasswordError
 });
-var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, WalletExistsError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
+var DecaneConnectError, InvalidApiKeyError, OriginNotAllowedError, SessionExpiredError, UnlockRequiredError, ReconnectRequiredError, UserCancelledError, WebAuthnNotSupportedError, InvalidPinError, CallSequenceError, NetworkError, ShareCorruptedError, ProvisioningTimeoutError, NewDeviceError, StaleDeviceShareError, PromptPinNotConfiguredError, PromptPasswordNotConfiguredError, WrongUnlockPasswordError, InvalidAccessTokenError, UnlockTokenRejectedError, AttestationError, RecoveryFailedError, InvalidRecoveryFileError, WrongPasswordError, RecoveryWalletMismatchError, ExportNotAuthorizedError, LoginInUseError, WalletExistsError, WalletEnrolmentError, ProvisioningRateLimitedError, EnclaveHttpError;
 var init_errors = __esm({
   "src/social/errors.ts"() {
     "use strict";
@@ -213,6 +214,11 @@ var init_errors = __esm({
         super("EXPORT_NOT_AUTHORIZED", "Export requires a fresh security check", true);
       }
     };
+    LoginInUseError = class extends DecaneConnectError {
+      constructor(message = "That login already opens another account. It was not linked.") {
+        super("LOGIN_IN_USE", message);
+      }
+    };
     WalletExistsError = class extends DecaneConnectError {
       constructor() {
         super("WALLET_EXISTS", "This account already has a wallet; opening it instead.", true);
@@ -266,6 +272,7 @@ __export(index_exports, {
   InvalidApiKeyError: () => InvalidApiKeyError,
   InvalidPinError: () => InvalidPinError,
   InvalidRecoveryFileError: () => InvalidRecoveryFileError,
+  LoginInUseError: () => LoginInUseError,
   MIN_PASSWORD_LENGTH: () => MIN_PASSWORD_LENGTH,
   NetworkError: () => NetworkError,
   NewDeviceError: () => NewDeviceError,
@@ -2118,7 +2125,9 @@ var ERROR_MAP = {
   // generic failure message.
   UNAUTHORIZED: ReconnectRequiredError,
   // A restorable wallet already exists: the client provisions instead of creating.
-  WALLET_EXISTS: WalletExistsError
+  WALLET_EXISTS: WalletExistsError,
+  // linkWithToken(): the login already opens another account.
+  LOGIN_IN_USE: LoginInUseError
 };
 var REQUEST_TIMEOUT_MS = 3e4;
 var ApiClient = class {
@@ -2287,6 +2296,23 @@ var ApiClient = class {
       body: JSON.stringify(providerId ? { token, providerId } : { token })
     });
   }
+  /** Attach a login from the project's own provider to the signed-in account. */
+  async linkExternal(jwt, token, providerId) {
+    return this._request("/auth/link/external", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${jwt}` },
+      body: JSON.stringify(providerId ? { token, providerId } : { token })
+    });
+  }
+  async listLinkedLogins(jwt) {
+    return this._request("/auth/link/external", { method: "GET", headers: { Authorization: `Bearer ${jwt}` } });
+  }
+  async unlinkLogin(jwt, id) {
+    await this._request(`/auth/link/external/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${jwt}` }
+    });
+  }
   /**
    * Returns null when this user has no server-registered passkey, which is the
    * expected answer for wallets created before passkey sign-in existed or for
@@ -3910,7 +3936,7 @@ async function buildPortableBackup(deviceShare, recoveryShare, password, address
 // src/social/client.ts
 var DEFAULT_API_BASE = "https://backend.decane.app";
 var DEFAULT_TEE_URL = "https://4405742df08d19abc549a05ade2a7154d98bd87f-8443.dstack-pha-prod9.phala.network";
-var DEFAULT_SESSION_MINUTES = 120;
+var DEFAULT_SESSION_MINUTES = 480;
 function makePersistKey(apiKey) {
   return `decane:social:${apiKey.slice(0, 20)}`;
 }
@@ -4954,6 +4980,20 @@ async function createDecaneConnect(config) {
       const result = await api.authExternal(token, opts?.providerId);
       return handleAuthResult(result);
     },
+    async linkWithToken(token, opts) {
+      if (!token) throw new CallSequenceError("linkWithToken requires a token");
+      if (!auth) throw new ReconnectRequiredError();
+      const result = await api.linkExternal(auth.jwt, token, opts?.providerId);
+      return result.id ? { alreadyLinked: result.alreadyLinked, id: result.id } : { alreadyLinked: result.alreadyLinked };
+    },
+    async listLinkedLogins() {
+      if (!auth) throw new ReconnectRequiredError();
+      return (await api.listLinkedLogins(auth.jwt)).logins;
+    },
+    async unlinkLogin(id) {
+      if (!auth) throw new ReconnectRequiredError();
+      await api.unlinkLogin(auth.jwt, id);
+    },
     async connectWithAccessToken(token) {
       const claims = decodeAccessToken(token);
       if (!claims) throw new InvalidAccessTokenError("not a Decane access token");
@@ -6887,6 +6927,7 @@ function DecaneKit({ config, children }) {
       protection,
       deferDeviceProtection,
       resumeSessionAcrossTabs,
+      sessionDurationMinutes,
       // Recovery callbacks. Forwarding these is what makes recovery
       // configurable at all from <DecaneKit>; before, they were silently
       // dropped and the headless client was constructed without them.
@@ -6910,6 +6951,7 @@ function DecaneKit({ config, children }) {
       protection,
       deferDeviceProtection,
       resumeSessionAcrossTabs,
+      sessionDurationMinutes,
       offerRecoveryAtSignup,
       onRecoveryShareOffer,
       onRecoveryFileReady,
@@ -7033,6 +7075,21 @@ function DecaneKit({ config, children }) {
       throw e;
     }
   }, [clearPhase]);
+  const linkWithToken = (0, import_react5.useCallback)(async (token, opts) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    return sdk.linkWithToken(token, opts);
+  }, []);
+  const listLinkedLogins = (0, import_react5.useCallback)(async () => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    return sdk.listLinkedLogins();
+  }, []);
+  const unlinkLogin = (0, import_react5.useCallback)(async (id) => {
+    const sdk = socialRef.current;
+    if (!sdk) throw new Error("Social sign-in not configured");
+    await sdk.unlinkLogin(id);
+  }, []);
   const connectWithToken = (0, import_react5.useCallback)(async (token, opts) => {
     const sdk = socialRef.current;
     if (!sdk) throw new Error("Social sign-in not configured");
@@ -7250,6 +7307,9 @@ function DecaneKit({ config, children }) {
         verifyPhoneCode: verifyPhoneCode2,
         connectWithToken,
         connectWithAccessToken,
+        linkWithToken,
+        listLinkedLogins,
+        unlinkLogin,
         customAuthLabel: customAuthConfig?.label,
         connectWithCustomAuth: customAuthConfig ? connectWithCustomAuth : void 0,
         socialUnlock,
@@ -7366,6 +7426,9 @@ function useSocialAuth() {
     verifyPhoneCode: verifyPhoneCode2,
     connectWithToken,
     connectWithAccessToken,
+    linkWithToken,
+    listLinkedLogins,
+    unlinkLogin,
     customAuthLabel,
     connectWithCustomAuth,
     signInWithPasskey: ctxSignInWithPasskey,
@@ -7569,6 +7632,11 @@ function useSocialAuth() {
     confirmPhoneCode,
     signInWithToken,
     signInWithAccessToken,
+    // Linked logins: while signed in, attach a login from your own auth (a
+    // phone number your backend verified, say) so it opens this same wallet.
+    linkWithToken,
+    listLinkedLogins,
+    unlinkLogin,
     signInWithCustomAuth: connectWithCustomAuth ? signInWithCustomAuth : void 0,
     signInWithPasskey,
     unlock,
@@ -8123,6 +8191,7 @@ function useSignTypedData() {
   InvalidApiKeyError,
   InvalidPinError,
   InvalidRecoveryFileError,
+  LoginInUseError,
   MIN_PASSWORD_LENGTH,
   NetworkError,
   NewDeviceError,