Sign-up and email verification

// Server-side calls with AuthClient, for flows you drive yourself.
import { AuthClient } from '@3een/auth';
import type { AuthError } from '@3een/auth';

const apiUrl = process.env.AUTH_API_URL!;
const apiKey = process.env.AUTH_API_KEY!; // secret: server only

const client = new AuthClient({
  clientId: process.env.AUTH_CLIENT_ID!,
  apiKey,
  apiUrl,
  redirectUri: 'https://app.example.com/dashboard',
});

/** The environment your API key belongs to (AuthClient methods need its id). */
export async function environmentId(): Promise<string> {
  const res = await fetch(`${apiUrl}/app/auth/validate-key`, {
    headers: { Authorization: `Bearer ${apiKey}` },
  });
  if (!res.ok) throw new Error('The API key was rejected');
  const body = (await res.json()) as { environmentId: string };
  return body.environmentId;
}

/** AuthClient throws an Error carrying the API's status and code. */
function describe(error: unknown): string {
  const e = error as Partial<AuthError> & Error;
  if (e.statusCode === 401) return 'Invalid email or password';
  if (e.statusCode === 429) return 'Too many attempts. Try again in a minute.';
  return e.message || 'Something went wrong';
}

export async function signUp(email: string, password: string) {
  try {
    // Sends a verification code by email; the user finishes on the hosted
    // verification page with the returned authorization_session_id.
    const { authorization_session_id } = await client.signUp({ email, password, environmentId: await environmentId() });
    return { ok: true as const, authorizationSessionId: authorization_session_id };
  } catch (error) {
    return { ok: false as const, message: describe(error) };
  }
}

export async function signIn(email: string, password: string) {
  try {
    const { accessToken, refreshToken, expiresIn, user } = await client.signIn({
      email,
      password,
      environmentId: await environmentId(),
    });
    // Store the tokens in httpOnly cookies; never hand them to browser JavaScript.
    return { ok: true as const, accessToken, refreshToken, expiresIn, user };
  } catch (error) {
    return { ok: false as const, message: describe(error) };
  }
}

export async function refresh(refreshToken: string) {
  const { accessToken, refreshToken: next, expiresIn } = await client.refreshToken(refreshToken);
  return { accessToken, refreshToken: next ?? refreshToken, expiresIn };
}

export async function forgotPassword(email: string) {
  // Always the same answer, whether or not the address has an account.
  // The email links to your hosted reset-password page.
  await client.forgotPassword(email, await environmentId());
}

export async function signOut(accessToken: string) {
  await client.signOut(accessToken); // revokes the session server-side
}