@alore/auth-react-sdk - npm Package Compare versions

Comparing version 1.1.0-alpha.11 to 1.1.0-alpha.12

dist/utils/AloreAuth.d.ts

@@ -186,2 +186,4 @@ import type { AuthMachineContext, AuthProviderConfig, FetchWithProgressiveBackoffConfig, ForgeData } from '../types';
                 passwordHash: string;
+                device?: string;
+                trustThisDevice?: boolean;
             };
@@ -188,0 +190,0 @@ }) => Promise<any>;

dist/utils/AloreAuth.js

@@ -155,2 +155,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
                 }
+                // Include device trust token if available (to skip email 2FA on trusted devices)
+                let trustToken = null;
+                if (typeof window !== 'undefined') {
+                    trustToken = window.localStorage.getItem('deviceTrustToken');
+                }
                 const response = yield this.fetchWithProgressiveBackoff(searchParams.size > 0 ? `${url}?${searchParams.toString()}` : url, {
@@ -161,7 +166,4 @@ method: 'POST',
                     },
-                    body: JSON.stringify({
-                        email: email || credentialEmail,
-                        passwordHash,
-                        device,
-                    }),
+                    body: JSON.stringify(Object.assign({ email: email || credentialEmail, passwordHash,
+                        device }, (trustToken && { trustToken }))),
                 });
@@ -342,3 +344,3 @@ const data = yield response.json();
             verifyEmail2fa: (context, event) => __awaiter(this, void 0, void 0, function* () {
-                const { email, passwordHash, secureCode } = event.payload;
+                const { email, passwordHash, secureCode, device, trustThisDevice } = event.payload;
                 const { credentialEmail, authProviderConfigs } = context;
@@ -348,8 +350,3 @@ const { firebaseCompatible } = authProviderConfigs || {};
                     method: 'POST',
-                    body: JSON.stringify({
-                        email: email || credentialEmail,
-                        passwordHash,
-                        emailCode: secureCode,
-                        sessionId: context.sessionId,
-                    }),
+                    body: JSON.stringify(Object.assign(Object.assign({ email: email || credentialEmail, passwordHash, emailCode: secureCode, sessionId: context.sessionId }, (device && { device })), (trustThisDevice !== undefined && { trustThisDevice }))),
                     headers: {
@@ -360,4 +357,12 @@ 'Content-Type': 'application/json',
                 const data = yield response.json();
-                if (response.ok)
+                if (response.ok) {
+                    // Persist device trust token for future logins
+                    if (data.deviceTrustToken && typeof window !== 'undefined') {
+                        window.localStorage.setItem('deviceTrustToken', data.deviceTrustToken);
+                    }
+                    else if (typeof window !== 'undefined') {
+                        window.localStorage.removeItem('deviceTrustToken');
+                    }
                     return data;
+                }
                 throw new Error(data.message || data.error || 'Authentication failed');
@@ -364,0 +369,0 @@ }),

package.json

 {
   "name": "@alore/auth-react-sdk",
-  "version": "1.1.0-alpha.11",
+  "version": "1.1.0-alpha.12",
   "repository": "https://github.com/0xCarbon/alore-js",
@@ -5,0 +5,0 @@ "description": "SDK for Alore Auth",

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Improved metrics

Total package byte prevSize

76251

1.07%

Lines of code

1107

0.64%

Worsened metrics

Number of medium supply chain risk alerts

3

50%

No dependency changes