js-bao-wss-client 2.1.1 → 2.1.2

package/dist/JsBaoClient.d.ts

@@ -2827,9 +2827,17 @@ export declare class JsBaoClient extends Observable<any> {
     }>;
     /**
      * Start the passkey authentication flow, returns challenge options for the browser.
+     * @param params - Optional flow parameters
+     * @param params.rpId - The relying party to run the ceremony against. Must be
+     *   one of the app's configured passkey relying parties, else the call fails
+     *   with `PASSKEY_RP_NOT_CONFIGURED`. Omit it in a browser, where the server
+     *   derives the relying party from the request's `Origin`; name it from a
+     *   native client, which sends no `Origin` at all.
      * @group Authentication
      */
-    passkeyAuthStart(): Promise<{
+    passkeyAuthStart(params?: {
+        rpId?: string;
+    }): Promise<{
         options: any;
         challengeToken: string;
     }>;
@@ -2849,9 +2857,16 @@ export declare class JsBaoClient extends Observable<any> {
     }>;
     /**
      * Start registering a new passkey for the current user.
+     * @param params - Optional flow parameters
+     * @param params.rpId - The relying party to register the passkey under. Must
+     *   be one of the app's configured passkey relying parties, else the call
+     *   fails with `PASSKEY_RP_NOT_CONFIGURED`. Omit it in a browser; name it
+     *   from a native client, which sends no `Origin` header.
      * @group Authentication
      */
-    passkeyRegisterStart(): Promise<{
+    passkeyRegisterStart(params?: {
+        rpId?: string;
+    }): Promise<{
         options: any;
         challengeToken: string;
     }>;

package/dist/JsBaoClient.js

@@ -7296,10 +7296,16 @@ export class JsBaoClient extends Observable {
     // ============ Passkey Auth Methods ============
     /**
      * Start the passkey authentication flow, returns challenge options for the browser.
+     * @param params - Optional flow parameters
+     * @param params.rpId - The relying party to run the ceremony against. Must be
+     *   one of the app's configured passkey relying parties, else the call fails
+     *   with `PASSKEY_RP_NOT_CONFIGURED`. Omit it in a browser, where the server
+     *   derives the relying party from the request's `Origin`; name it from a
+     *   native client, which sends no `Origin` at all.
      * @group Authentication
      */
-    async passkeyAuthStart() {
-        return this.auth.passkeyAuthStart();
+    async passkeyAuthStart(params) {
+        return this.auth.passkeyAuthStart(params);
     }
     /**
      * Complete passkey authentication with the browser's credential response.
@@ -7315,10 +7321,15 @@ export class JsBaoClient extends Observable {
     // ============ Passkey Registration Methods (Add to Existing Account) ============
     /**
      * Start registering a new passkey for the current user.
+     * @param params - Optional flow parameters
+     * @param params.rpId - The relying party to register the passkey under. Must
+     *   be one of the app's configured passkey relying parties, else the call
+     *   fails with `PASSKEY_RP_NOT_CONFIGURED`. Omit it in a browser; name it
+     *   from a native client, which sends no `Origin` header.
      * @group Authentication
      */
-    async passkeyRegisterStart() {
-        return this.auth.passkeyRegisterStart();
+    async passkeyRegisterStart(params) {
+        return this.auth.passkeyRegisterStart(params);
     }
     /**
      * Complete passkey registration with the browser's credential response.

package/dist/browser.umd.js

@@ -4814,6 +4814,8 @@
         INVALID_TOKEN: "INVALID_TOKEN",
         TOKEN_EXPIRED: "TOKEN_EXPIRED",
         PASSKEY_NOT_ENABLED: "PASSKEY_NOT_ENABLED",
+        // A passkey start call named an `rpId` the app does not configure (#3024).
+        PASSKEY_RP_NOT_CONFIGURED: "PASSKEY_RP_NOT_CONFIGURED",
         MAGIC_LINK_NOT_ENABLED: "MAGIC_LINK_NOT_ENABLED",
         WAITLIST_ENTRY_UPDATED: "WAITLIST_ENTRY_UPDATED",
         // Invite-token flow (#466)
@@ -5327,11 +5329,22 @@
             };
         }
         // ============ Passkey Auth Methods ============
-        async passkeyAuthStart() {
+        /**
+         * `rpId` names the relying party the ceremony runs under (#3024). The server
+         * validates it against the app's configured relying parties; a blank one is
+         * no request at all, so it is not sent.
+         */
+        passkeyStartBody(params) {
+            const rpId = typeof params?.rpId === "string" && params.rpId.trim()
+                ? params.rpId.trim()
+                : undefined;
+            return JSON.stringify(rpId ? { rpId } : {});
+        }
+        async passkeyAuthStart(params) {
             const response = await fetch(`${this.deps.apiUrl}/app/${this.deps.appId}/api/passkey/auth/start`, {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({}),
+                body: this.passkeyStartBody(params),
                 credentials: "include",
             });
             if (!response.ok) {
@@ -5360,13 +5373,14 @@
             return { user: data.user, isNewUser: data.isNewUser };
         }
         // ============ Passkey Registration Methods (Add to Existing Account) ============
-        async passkeyRegisterStart() {
+        async passkeyRegisterStart(params) {
             const response = await fetch(`${this.deps.apiUrl}/app/${this.deps.appId}/api/passkey/register/start`, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
                     Authorization: `Bearer ${this.token}`,
                 },
+                body: this.passkeyStartBody(params),
                 credentials: "include",
             });
             if (!response.ok) {
@@ -6061,17 +6075,21 @@
         }
         const response = await fetch(requestUrl, init);
         if (!response.ok) {
-            let message = `OAuth callback failed (${response?.status})`;
+            // Carry the server's typed code through, exactly as the email paths do
+            // (#3003) — a waitlisted OAuth sign-in has to be branchable on
+            // `AUTH_CODES.ADDED_TO_WAITLIST`, not on message text.
+            const body = {};
             try {
-                const error = await response.json();
-                if (error && typeof error.error === "string" && error.error.length > 0) {
-                    message = error.error;
-                }
+                const parsed = await response.json();
+                if (parsed && typeof parsed.error === "string" && parsed.error.length > 0)
+                    body.error = parsed.error;
+                if (parsed && typeof parsed.code === "string" && parsed.code.length > 0)
+                    body.code = parsed.code;
             }
             catch (_) {
                 // ignore JSON parse errors
             }
-            throw new Error(message);
+            throw createAuthError(body, `OAuth callback failed (${response?.status})`);
         }
         const data = await response.json();
         const token = data?.token;
@@ -22358,10 +22376,16 @@
         // ============ Passkey Auth Methods ============
         /**
          * Start the passkey authentication flow, returns challenge options for the browser.
+         * @param params - Optional flow parameters
+         * @param params.rpId - The relying party to run the ceremony against. Must be
+         *   one of the app's configured passkey relying parties, else the call fails
+         *   with `PASSKEY_RP_NOT_CONFIGURED`. Omit it in a browser, where the server
+         *   derives the relying party from the request's `Origin`; name it from a
+         *   native client, which sends no `Origin` at all.
          * @group Authentication
          */
-        async passkeyAuthStart() {
-            return this.auth.passkeyAuthStart();
+        async passkeyAuthStart(params) {
+            return this.auth.passkeyAuthStart(params);
         }
         /**
          * Complete passkey authentication with the browser's credential response.
@@ -22377,10 +22401,15 @@
         // ============ Passkey Registration Methods (Add to Existing Account) ============
         /**
          * Start registering a new passkey for the current user.
+         * @param params - Optional flow parameters
+         * @param params.rpId - The relying party to register the passkey under. Must
+         *   be one of the app's configured passkey relying parties, else the call
+         *   fails with `PASSKEY_RP_NOT_CONFIGURED`. Omit it in a browser; name it
+         *   from a native client, which sends no `Origin` header.
          * @group Authentication
          */
-        async passkeyRegisterStart() {
-            return this.auth.passkeyRegisterStart();
+        async passkeyRegisterStart(params) {
+            return this.auth.passkeyRegisterStart(params);
         }
         /**
          * Complete passkey registration with the browser's credential response.

package/dist/internal/authController.d.ts

@@ -44,6 +44,7 @@ export declare const AUTH_CODES: {
     readonly INVALID_TOKEN: "INVALID_TOKEN";
     readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
     readonly PASSKEY_NOT_ENABLED: "PASSKEY_NOT_ENABLED";
+    readonly PASSKEY_RP_NOT_CONFIGURED: "PASSKEY_RP_NOT_CONFIGURED";
     readonly MAGIC_LINK_NOT_ENABLED: "MAGIC_LINK_NOT_ENABLED";
     readonly WAITLIST_ENTRY_UPDATED: "WAITLIST_ENTRY_UPDATED";
     readonly INVITE_TOKEN_INVALID: "INVITE_TOKEN_INVALID";
@@ -273,7 +274,15 @@ export declare class AuthController {
         };
         isNewUser?: boolean;
     }>;
-    passkeyAuthStart(): Promise<{
+    /**
+     * `rpId` names the relying party the ceremony runs under (#3024). The server
+     * validates it against the app's configured relying parties; a blank one is
+     * no request at all, so it is not sent.
+     */
+    private passkeyStartBody;
+    passkeyAuthStart(params?: {
+        rpId?: string;
+    }): Promise<{
         options: any;
         challengeToken: string;
     }>;
@@ -288,7 +297,9 @@ export declare class AuthController {
         };
         isNewUser?: boolean;
     }>;
-    passkeyRegisterStart(): Promise<{
+    passkeyRegisterStart(params?: {
+        rpId?: string;
+    }): Promise<{
         options: any;
         challengeToken: string;
     }>;

package/dist/internal/authController.js

@@ -32,6 +32,8 @@ export const AUTH_CODES = {
     INVALID_TOKEN: "INVALID_TOKEN",
     TOKEN_EXPIRED: "TOKEN_EXPIRED",
     PASSKEY_NOT_ENABLED: "PASSKEY_NOT_ENABLED",
+    // A passkey start call named an `rpId` the app does not configure (#3024).
+    PASSKEY_RP_NOT_CONFIGURED: "PASSKEY_RP_NOT_CONFIGURED",
     MAGIC_LINK_NOT_ENABLED: "MAGIC_LINK_NOT_ENABLED",
     WAITLIST_ENTRY_UPDATED: "WAITLIST_ENTRY_UPDATED",
     // Invite-token flow (#466)
@@ -545,11 +547,22 @@ export class AuthController {
         };
     }
     // ============ Passkey Auth Methods ============
-    async passkeyAuthStart() {
+    /**
+     * `rpId` names the relying party the ceremony runs under (#3024). The server
+     * validates it against the app's configured relying parties; a blank one is
+     * no request at all, so it is not sent.
+     */
+    passkeyStartBody(params) {
+        const rpId = typeof params?.rpId === "string" && params.rpId.trim()
+            ? params.rpId.trim()
+            : undefined;
+        return JSON.stringify(rpId ? { rpId } : {});
+    }
+    async passkeyAuthStart(params) {
         const response = await fetch(`${this.deps.apiUrl}/app/${this.deps.appId}/api/passkey/auth/start`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({}),
+            body: this.passkeyStartBody(params),
             credentials: "include",
         });
         if (!response.ok) {
@@ -578,13 +591,14 @@ export class AuthController {
         return { user: data.user, isNewUser: data.isNewUser };
     }
     // ============ Passkey Registration Methods (Add to Existing Account) ============
-    async passkeyRegisterStart() {
+    async passkeyRegisterStart(params) {
         const response = await fetch(`${this.deps.apiUrl}/app/${this.deps.appId}/api/passkey/register/start`, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
                 Authorization: `Bearer ${this.token}`,
             },
+            body: this.passkeyStartBody(params),
             credentials: "include",
         });
         if (!response.ok) {
@@ -1281,17 +1295,21 @@ export async function exchangeOAuthCode(params) {
     }
     const response = await fetch(requestUrl, init);
     if (!response.ok) {
-        let message = `OAuth callback failed (${response?.status})`;
+        // Carry the server's typed code through, exactly as the email paths do
+        // (#3003) — a waitlisted OAuth sign-in has to be branchable on
+        // `AUTH_CODES.ADDED_TO_WAITLIST`, not on message text.
+        const body = {};
         try {
-            const error = await response.json();
-            if (error && typeof error.error === "string" && error.error.length > 0) {
-                message = error.error;
-            }
+            const parsed = await response.json();
+            if (parsed && typeof parsed.error === "string" && parsed.error.length > 0)
+                body.error = parsed.error;
+            if (parsed && typeof parsed.code === "string" && parsed.code.length > 0)
+                body.code = parsed.code;
         }
         catch (_) {
             // ignore JSON parse errors
         }
-        throw new Error(message);
+        throw createAuthError(body, `OAuth callback failed (${response?.status})`);
     }
     const data = await response.json();
     const token = data?.token;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "js-bao-wss-client",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "Client library for js-bao-wss Yjs WebSocket service",
   "author": "Primitive LLC",
   "license": "UNLICENSED",