tinbase 0.20.0 → 0.21.0

package/dist/auth/handler.d.ts

@@ -3,7 +3,7 @@
  * uses for email/password auth, sessions, and admin user management.
  */
 import type { Database } from '../db/database.js';
-import { type Mailer, type RequestContext } from '../types.js';
+import { type Mailer, type RequestContext, type SmsSender } from '../types.js';
 import { type OAuthProviderConfig } from './oauth.js';
 import { type AuthSettings } from './settings.js';
 import { type EmailTemplates } from './templates.js';
@@ -42,6 +42,12 @@ export interface AuthConfig {
     sessionTimeboxSeconds?: number;
     /** sends outgoing auth email (magic links, OTP codes, recovery) */
     mailer: Mailer;
+    /** sends phone OTP codes (sign-in, signup confirmation, phone change) */
+    smsSender: SmsSender;
+    /** `[auth.sms] template`; `{{ .Code }}` is the OTP. Default "Your code is {{ .Code }}". */
+    smsTemplate?: string;
+    /** What `/settings` reports as `sms_provider` (twilio, or the dev inbox / a custom sender). */
+    smsProviderName?: string;
     /**
      * Per-type HTML overrides from `[auth.email.template.*]`. A project that
      * supplies one decides for itself what the mail offers - link, code, both, or
@@ -100,6 +106,7 @@ interface UserRow {
     phone_confirmed_at: Date | string | null;
     is_anonymous: boolean | null;
     email_change: string | null;
+    phone_change: string | null;
 }
 /** Routes and services the GoTrue-compatible `/auth/v1/*` endpoints. */
 export declare class AuthHandler {
@@ -274,6 +281,51 @@ export declare class AuthHandler {
     private verifyEmailChange;
     private verifyToken;
     private verifyLink;
+    /** GoTrue's answer to any phone endpoint while phone auth is off. */
+    private static phoneDisabled;
+    private static invalidPhone;
+    /**
+     * `[auth.sms] max_frequency`, measured like {@link limitEmailFrequency}:
+     * against the column that flow last wrote on the recipient's row, with an
+     * in-memory window for a number that has no row yet.
+     */
+    private limitSmsFrequency;
+    /**
+     * Mint a code for `phone`, replacing any live one of the same type, and
+     * text it. The send column is written only once the provider accepted the
+     * message, as with mail. Returns the provider's message id when it gave one.
+     */
+    private sendSmsCode;
+    /** Create the account a phone OTP is for, with GoTrue's provider metadata. */
+    private createPhoneUser;
+    /** The `phone` identity GoTrue records, so `user.identities` names the provider. */
+    private ensurePhoneIdentity;
+    /** `supabase.auth.signUp({ phone, password })`. */
+    private signupWithPhone;
+    /** `supabase.auth.signInWithOtp({ phone })`: text a code, creating the account unless told not to. */
+    private sendPhoneOtp;
+    /**
+     * `supabase.auth.resend({ phone, type: 'sms' | 'phone_change' })`.
+     *
+     * Like the email resend: 200 and no text for a number with nothing pending,
+     * whether because it has no account, is already confirmed, or has no change
+     * under way - so the endpoint cannot be used to find out which.
+     */
+    private resendSms;
+    /**
+     * `max_frequency` for a phone change: the account's own `phone_change_sent_at`
+     * (the new number has no row to measure by), plus the in-memory window on
+     * the new number itself so one account cannot be used to text it in a loop.
+     */
+    private limitPhoneChangeFrequency;
+    /**
+     * Begin a phone change: park the new number and text it a code. The number
+     * moves only when the code comes back through `/verify` type `phone_change`.
+     * Returns a Response only when the change could not be started.
+     */
+    private startPhoneChange;
+    /** `verifyOtp({ phone, token, type: 'sms' | 'phone_change' })` → session. */
+    private verifySmsToken;
     private admin;
     /**
      * POST /auth/v1/admin/invite - `auth.admin.inviteUserByEmail`.