[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@seamless-auth/[email protected]

Minor Changes

• 2f18490: Add authenticator app (TOTP) screens to the Angular binding. Once a sign-in is under way, the login screen offers "Use an authenticator app", which opens the new authenticator-code screen (SaAuthenticatorCode) and explains a wrong or reused code, a lockout and rate limiting. The new register-authenticator screen (SaRegisterAuthenticator) shows a QR code, the setup key with a copy button and an otpauth:// link, verifies the first code, and continues where register-passkey does. register-passkey offers it to a recovery session, which can no longer skip enrollment, and on a device that cannot register a passkey; enrolling an app lifts the recovery restriction. SaAuthenticatorAppSettings is a router-independent settings component that shows whether an app is set up, adds one, and turns it off with a current code. SaAuthenticatorEnrollment is exported for custom screens, SaFallbackOptions gains an offerAuthenticator input and an authenticator output, and the SeamlessAuth service gains a recoverySession signal.

Patch Changes

• Updated dependencies [e5e6680]
• Updated dependencies [e5e6680]
• Updated dependencies [e5e6680]
• Updated dependencies [44854d0]
• Updated dependencies [e5e6680]
• Updated dependencies [8dbd3d8]
• Updated dependencies [8dbd3d8]
• Updated dependencies [8dbd3d8]
• Updated dependencies [dc52b23]
• Updated dependencies [a5956b0]
  • @seamless-auth/[email protected]

@seamless-auth/[email protected]

Minor Changes

• 44854d0: Add the auth API v0.20 recovery primitives to the client and the session store.

  • Recovery codes: getRecoveryCodeStatus(), generateRecoveryCodes() and redeemRecoveryCode(code). Replacing an existing set needs a fresh step-up; the 403 it answers without one is recognized by isStepUpRequired(), and generateRecoveryCodesWithStepUp() runs the step-up and tries again.
  • Self-service account recovery: startAccountRecovery(channel), verifyAccountRecovery(code), getAccountRecoveryStatus(), completeAccountRecovery(), cancelAccountRecovery(cancelToken), and for a signed-in owner listAccountRecoveryRequests() and cancelAccountRecoveryRequest(id).
  • Recovery sessions: redeeming a code or completing a recovery issues a session that can only enroll a factor. isRecoverySession() on the client and recoverySession in the session state report it, and the session actions redeemRecoveryCode and completeAccountRecovery sign in with it. After a passkey registration or TOTP enrollment made from a recovery session the client refreshes the session (POST /refresh), so the new access token drops the recovery claim the adapters' guards refuse.
  • Flows for every binding: loadRecoveryOptions(), recoveryCancelTokenFromHash(), cancelRecoveryFromLink(), recoveryErrorMessage(), recoveryCodesText(), passkeyKind() and passkeyDisplayName(), plus getRecoveryErrorCode() and isEnrollmentRequired().
  • Bearer transport routes each recovery route with the credential the auth API's adapter manifest gives it.

  Needs an auth API with account recovery (v0.20) and a server adapter that proxies its manifest routes.

• 8dbd3d8: Adds shared authenticator app (TOTP) flow helpers for the bundled screens: signInWithTotp(), totpErrorMessage(), formatTotpSecret() and TOTP_CODE_LENGTH.

  The bearer transport no longer refreshes and resends a request whose 401 names a rejected factor (totp_verification_failed, totp_disable_failed, step_up_failed, invalid_recovery_code). That 401 is the answer to a wrong code, not an expired token, and resending the same code only spent another attempt against the rate limit and lockout.

  generateRecoveryCodesWithStepUp() now reports a failed step-up as "Confirm it is you to replace your recovery codes." instead of naming the passkey, since the step-up can also be an authenticator app code.

• 8dbd3d8: Adds verifyTotpLogin(code), which signs in with an authenticator app code on the sign-in login() started (POST /totp/verify-login). The bearer transport sends it on the pre-auth token and stores the session it issues.

• 8dbd3d8: Adds qrCode(text), which turns the otpauth:// URL from authenticator app enrollment into a QR code a phone camera can scan, with no extra dependency. It returns the symbol's size in modules (quiet zone included) and SVG path data, so any binding can render it as <svg viewBox="0 0 {size} {size}"><path d="{path}" /></svg>. It throws a RangeError for text too long for a QR code. qrMatrix(text) returns the raw module grid for custom rendering.

Patch Changes

• e5e6680: The bearer redirect guard now works on React Native. Its fetch follows redirects itself and never sets response.redirected, so a response that a redirect took to another origin was handed back as if it came from the API. A bearer request now rejects with UntrustedRedirectError whenever the response's final URL differs from the one requested and is not on apiHost or trustedOrigins. On React Native this detects such a redirect after it happened rather than preventing it, so the token may already have been sent on the followed hop.

• e5e6680: The bearer POST /refresh no longer follows a redirect. It is sent with redirect: 'manual', and any 3xx answer, a redirect the browser hides, or a response that a platform followed to an origin outside apiHost and trustedOrigins (as React Native's fetch does) is refused with UntrustedRedirectError. The held session is cleared, because it can no longer be renewed through that server. Before, a redirect on the refresh route resent the refresh token to the redirect target.

• e5e6680: The OAuth redirect ports now open only an https authorization URL, or http on localhost, 127.0.0.1 or [::1] for local development. The browser port (createBrowserOAuthRedirect) and the React Native port (createWebBrowserOAuthRedirect) throw the new UnsafeAuthorizationUrlError for anything else, such as a javascript: or data: URL in any letter case or with embedded tabs, and never navigate to it. startOAuthSignIn, which every bundled sign-in screen uses, reports that as a provider that could not start. A custom OAuthRedirectPort can use the new assertNavigableAuthorizationUrl(url). Auth API 0.19.4 already refuses to store or return such a URL, so this guards against an older or misconfigured server.

• e5e6680: A client method whose request throws now keeps the thrown error as error.cause. Every such failure used to arrive as the same status 0 error with nothing to tell them apart, so an app could not distinguish an UntrustedOriginError, an UntrustedRedirectError or a refused refresh from a network failure. Check error.cause instanceof UntrustedRedirectError (or another error class) to show a more specific message. The message and status are unchanged.

• dc52b23: Update @seamless-auth/types to 0.31.0, the contract for auth server v0.20.

• a5956b0: Update @seamless-auth/types to 0.33.0. AccountRecoveryRequest, AccountRecoveryRequestsResult and RecoveryErrorCode now alias the upstream shapes, and RecoveryErrorCode gains enrollment_required.

  The recovery session flag is now read from the recovery field of /users/me as well, so isRecoverySession() and the session state's recoverySession survive a reload, a background revalidation and initialSession. A restored recovery session is sent to enrollment by the bundled sign-in screen, and the session is refreshed after a passkey or TOTP enrollment made from it.

@seamless-auth/[email protected]

Minor Changes

• 44854d0: The prebuilt UI covers account recovery from auth API v0.20.

  • AuthRoutes serves /recovery-code (sign in with a recovery code), /recovery-codes (shown after a passkey is enrolled, to generate and save a first set, or a new one once every code is spent), /account-recovery (self-service recovery through a verified email or phone, with its waiting period) and /recovery/cancel, where the link in every recovery notice lands. That page takes the token from the URL fragment, drops it from the address bar and cancels the request. Mount AuthRoutes at the root of the deployment's FRONTEND_URL so the link resolves.
  • The sign-in screen offers "Use a recovery code" and "Recover your account" only where GET /system-config/public reports recoveryCodes or accountRecovery. A recovery session goes straight to passkey enrollment, which it cannot skip.
  • New router-free settings sections: PasskeyManagement (list with name, kind and last use, rename, delete, add another, and a nudge towards a second passkey), RecoveryCodeSettings (codes left, generate or replace with a step-up), RecoveryRequests (open recovery requests with cancel), and AccountSecurity, which renders all three.
  • useAuth() adds recoverySession, redeemRecoveryCode and completeAccountRecovery, and the package re-exports useRecoveryOptions, isStepUpRequired, isEnrollmentRequired, getRecoveryErrorCode and the recovery types.

  Needs an auth API with account recovery (v0.20) and a server adapter that proxies its manifest routes, including POST /auth/refresh.

• dbd4294: The prebuilt UI covers authenticator apps (TOTP).

  • AuthenticatorRegistration at /register-authenticator sets up an authenticator app: a QR code of the otpauth:// URL (drawn as an inline SVG, no new dependency), the setup key in groups of four with a copy button, an otpauth:// link for a phone, and the first code. It then continues to /recovery-codes as passkey enrollment does.
  • /authenticator-code signs in with a code from the app, on the sign-in /login started. The sign-in screen offers "Use an authenticator app" on every sign-in in progress, because /login never lists totp and the API answers the code step the same for an address with no account. Wrong or reused codes, lockouts, rate limits and passkey-only accounts each get their own message.
  • A recovery session's passkey step offers "Use an authenticator app", which is the way forward on a device without passkeys. Verifying the first code lifts the recovery restriction, and the session is refreshed before the screen moves on.
  • Replacing recovery codes, in RecoveryCodeSettings and on /recovery-codes, asks for a current code from the authenticator app when the API wants a step-up and the account has one, with the passkey as an alternative.
  • New router-free settings section AuthenticatorAppSettings (status, inline enrollment, turn off with a current code), which AccountSecurity now renders between passkeys and recovery codes.
  • The package re-exports signInWithTotp, totpErrorMessage, formatTotpSecret, qrCode, TOTP_CODE_LENGTH and the QrCode type for custom screens.

  Needs an auth API with POST /totp/verify-login and a server adapter that proxies it.

Patch Changes

• e5e6680: The bundled magic link and OAuth callback screens now remove the token, code and state from the address bar once they have read them, replacing the history entry, so the one-time values no longer stay in browser history or travel in a Referer. The Vue, Angular and Svelte screens already did this.

• dc52b23: Update @seamless-auth/types to 0.31.0, the contract for auth server v0.20.

• a5956b0: Update @seamless-auth/types to 0.33.0. AccountRecoveryRequest, AccountRecoveryRequestsResult and RecoveryErrorCode now alias the upstream shapes, and RecoveryErrorCode gains enrollment_required.

  The recovery session flag is now read from the recovery field of /users/me as well, so isRecoverySession() and the session state's recoverySession survive a reload, a background revalidation and initialSession. A restored recovery session is sent to enrollment by the bundled sign-in screen, and the session is refreshed after a passkey or TOTP enrollment made from it.

• Updated dependencies [e5e6680]

• Updated dependencies [e5e6680]

• Updated dependencies [e5e6680]

• Updated dependencies [44854d0]

• Updated dependencies [e5e6680]

• Updated dependencies [8dbd3d8]

• Updated dependencies [8dbd3d8]

• Updated dependencies [8dbd3d8]

• Updated dependencies [dc52b23]

• Updated dependencies [a5956b0]

  • @seamless-auth/[email protected]

@seamless-auth/[email protected]

Minor Changes

• 44854d0: Add the auth API v0.20 recovery primitives to the client and the session store.

  • Recovery codes: getRecoveryCodeStatus(), generateRecoveryCodes() and redeemRecoveryCode(code). Replacing an existing set needs a fresh step-up; the 403 it answers without one is recognized by isStepUpRequired(), and generateRecoveryCodesWithStepUp() runs the step-up and tries again.
  • Self-service account recovery: startAccountRecovery(channel), verifyAccountRecovery(code), getAccountRecoveryStatus(), completeAccountRecovery(), cancelAccountRecovery(cancelToken), and for a signed-in owner listAccountRecoveryRequests() and cancelAccountRecoveryRequest(id).
  • Recovery sessions: redeeming a code or completing a recovery issues a session that can only enroll a factor. isRecoverySession() on the client and recoverySession in the session state report it, and the session actions redeemRecoveryCode and completeAccountRecovery sign in with it. After a passkey registration or TOTP enrollment made from a recovery session the client refreshes the session (POST /refresh), so the new access token drops the recovery claim the adapters' guards refuse.
  • Flows for every binding: loadRecoveryOptions(), recoveryCancelTokenFromHash(), cancelRecoveryFromLink(), recoveryErrorMessage(), recoveryCodesText(), passkeyKind() and passkeyDisplayName(), plus getRecoveryErrorCode() and isEnrollmentRequired().
  • Bearer transport routes each recovery route with the credential the auth API's adapter manifest gives it.

  Needs an auth API with account recovery (v0.20) and a server adapter that proxies its manifest routes.

Patch Changes

• e5e6680: The bearer redirect guard now works on React Native. Its fetch follows redirects itself and never sets response.redirected, so a response that a redirect took to another origin was handed back as if it came from the API. A bearer request now rejects with UntrustedRedirectError whenever the response's final URL differs from the one requested and is not on apiHost or trustedOrigins. On React Native this detects such a redirect after it happened rather than preventing it, so the token may already have been sent on the followed hop.

• e5e6680: The bearer POST /refresh no longer follows a redirect. It is sent with redirect: 'manual', and any 3xx answer, a redirect the browser hides, or a response that a platform followed to an origin outside apiHost and trustedOrigins (as React Native's fetch does) is refused with UntrustedRedirectError. The held session is cleared, because it can no longer be renewed through that server. Before, a redirect on the refresh route resent the refresh token to the redirect target.

• e5e6680: The OAuth redirect ports now open only an https authorization URL, or http on localhost, 127.0.0.1 or [::1] for local development. The browser port (createBrowserOAuthRedirect) and the React Native port (createWebBrowserOAuthRedirect) throw the new UnsafeAuthorizationUrlError for anything else, such as a javascript: or data: URL in any letter case or with embedded tabs, and never navigate to it. startOAuthSignIn, which every bundled sign-in screen uses, reports that as a provider that could not start. A custom OAuthRedirectPort can use the new assertNavigableAuthorizationUrl(url). Auth API 0.19.4 already refuses to store or return such a URL, so this guards against an older or misconfigured server.

• dc52b23: Update @seamless-auth/types to 0.31.0, the contract for auth server v0.20.

• a5956b0: Update @seamless-auth/types to 0.33.0. AccountRecoveryRequest, AccountRecoveryRequestsResult and RecoveryErrorCode now alias the upstream shapes, and RecoveryErrorCode gains enrollment_required.

  The recovery session flag is now read from the recovery field of /users/me as well, so isRecoverySession() and the session state's recoverySession survive a reload, a background revalidation and initialSession. A restored recovery session is sent to enrollment by the bundled sign-in screen, and the session is refreshed after a passkey or TOTP enrollment made from it.

• Updated dependencies [e5e6680]

• Updated dependencies [e5e6680]

• Updated dependencies [e5e6680]

• Updated dependencies [44854d0]

• Updated dependencies [e5e6680]

• Updated dependencies [8dbd3d8]

• Updated dependencies [8dbd3d8]

• Updated dependencies [8dbd3d8]

• Updated dependencies [dc52b23]

• Updated dependencies [a5956b0]

  • @seamless-auth/[email protected]

@seamless-auth/[email protected]

Minor Changes

• 44854d0: The session exposes recoverySession, redeemRecoveryCode(code) and completeAccountRecovery() from @seamless-auth/client, for a custom account recovery screen.

Patch Changes

• Updated dependencies [e5e6680]
• Updated dependencies [e5e6680]
• Updated dependencies [e5e6680]
• Updated dependencies [44854d0]
• Updated dependencies [e5e6680]
• Updated dependencies [8dbd3d8]
• Updated dependencies [8dbd3d8]
• Updated dependencies [8dbd3d8]
• Updated dependencies [dc52b23]
• Updated dependencies [a5956b0]
  • @seamless-auth/[email protected]

@seamless-auth/[email protected]

Minor Changes

• 9b8a9fb: The bundled screens support authenticator apps (TOTP).

  • createSeamlessAuthRoutes() adds register-authenticator (SaRegisterAuthenticator), which shows a QR code, the setup key with a copy button and an otpauth:// link, verifies the first code and then continues where passkey enrolment does, and authenticator-code (SaAuthenticatorCode), which finishes a sign-in with a code from the app. Wrong or reused codes, lockout and rate limits each get a clear message.
  • The sign-in screen's fallback options always include "Use an authenticator app" once a sign-in has started. The API answers a code for any account, so this reveals nothing about the account.
  • SaRegisterPasskey offers "Use an authenticator app" on a device that cannot register a passkey (unless the application signs in with passkeys only, where the API would refuse the app), and always for a recovery session, which can no longer skip enrolment. Adding the app ends the recovery restriction.
  • SaAuthenticatorAppSettings, exported from the package root and router-free, shows whether an authenticator app is set up and lets the user add one or turn it off with a current code.
  • useSeamlessAuth() adds recoverySession, and the package re-exports the TotpStatus type.

  Needs an auth API with TOTP sign-in (POST /totp/verify-login) and a server adapter that proxies the /totp routes.

Patch Changes

• Updated dependencies [e5e6680]
• Updated dependencies [e5e6680]
• Updated dependencies [e5e6680]
• Updated dependencies [44854d0]
• Updated dependencies [e5e6680]
• Updated dependencies [8dbd3d8]
• Updated dependencies [8dbd3d8]
• Updated dependencies [8dbd3d8]
• Updated dependencies [dc52b23]
• Updated dependencies [a5956b0]
  • @seamless-auth/[email protected]