@agent-native/core 0.24.4 → 0.24.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/onboarding/default-steps.d.ts.map +1 -1
- package/dist/onboarding/default-steps.js +0 -17
- package/dist/onboarding/default-steps.js.map +1 -1
- package/dist/secrets/substitution.d.ts +1 -0
- package/dist/secrets/substitution.d.ts.map +1 -1
- package/dist/secrets/substitution.js +32 -0
- package/dist/secrets/substitution.js.map +1 -1
- package/dist/server/auth.d.ts +0 -1
- package/dist/server/auth.d.ts.map +1 -1
- package/dist/server/auth.js +14 -338
- package/dist/server/auth.js.map +1 -1
- package/docs/content/authentication.md +8 -9
- package/docs/content/deployment.md +2 -2
- package/package.json +1 -1
package/dist/server/auth.js
CHANGED
|
@@ -428,17 +428,6 @@ function getAccessTokens() {
|
|
|
428
428
|
}
|
|
429
429
|
return tokens;
|
|
430
430
|
}
|
|
431
|
-
function safeTokenMatch(input, tokens) {
|
|
432
|
-
const inputBuf = Buffer.from(input);
|
|
433
|
-
for (const token of tokens) {
|
|
434
|
-
const tokenBuf = Buffer.from(token);
|
|
435
|
-
if (inputBuf.length === tokenBuf.length &&
|
|
436
|
-
crypto.timingSafeEqual(inputBuf, tokenBuf)) {
|
|
437
|
-
return true;
|
|
438
|
-
}
|
|
439
|
-
}
|
|
440
|
-
return false;
|
|
441
|
-
}
|
|
442
431
|
function getBearerSessionToken(event) {
|
|
443
432
|
const auth = getHeader(event, "authorization");
|
|
444
433
|
if (!auth)
|
|
@@ -1546,43 +1535,15 @@ function stripAppBasePath(pathname) {
|
|
|
1546
1535
|
return pathname;
|
|
1547
1536
|
}
|
|
1548
1537
|
// ---------------------------------------------------------------------------
|
|
1549
|
-
//
|
|
1538
|
+
// Fallback login page HTML (custom auth with no login page configured)
|
|
1550
1539
|
// ---------------------------------------------------------------------------
|
|
1551
|
-
function
|
|
1552
|
-
if (process.env.AGENT_NATIVE_WORKSPACE !== "1" &&
|
|
1553
|
-
process.env.VITE_AGENT_NATIVE_WORKSPACE !== "1") {
|
|
1554
|
-
return "";
|
|
1555
|
-
}
|
|
1556
|
-
if (!requestPath || !requestPath.startsWith("/"))
|
|
1557
|
-
return "";
|
|
1558
|
-
const firstSegment = requestPath.split(/[/?#]/)[1];
|
|
1559
|
-
if (!firstSegment)
|
|
1560
|
-
return "";
|
|
1561
|
-
const reservedRootPaths = new Set([
|
|
1562
|
-
"_agent-native",
|
|
1563
|
-
".well-known",
|
|
1564
|
-
"api",
|
|
1565
|
-
"login",
|
|
1566
|
-
"signup",
|
|
1567
|
-
"apps",
|
|
1568
|
-
"new-app",
|
|
1569
|
-
"approval",
|
|
1570
|
-
"extensions",
|
|
1571
|
-
]);
|
|
1572
|
-
if (reservedRootPaths.has(firstSegment))
|
|
1573
|
-
return "";
|
|
1574
|
-
if (!isValidWorkspaceAppIdFormat(firstSegment))
|
|
1575
|
-
return "";
|
|
1576
|
-
return `/${firstSegment}`;
|
|
1577
|
-
}
|
|
1578
|
-
function getTokenLoginHtml(options = {}) {
|
|
1579
|
-
const configuredBasePath = getAppBasePath() || inferWorkspaceBasePathFromRequest(options.requestPath);
|
|
1540
|
+
function getCustomAuthRequiredHtml() {
|
|
1580
1541
|
return `<!DOCTYPE html>
|
|
1581
1542
|
<html lang="en">
|
|
1582
1543
|
<head>
|
|
1583
1544
|
<meta charset="UTF-8">
|
|
1584
1545
|
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
|
|
1585
|
-
<title>
|
|
1546
|
+
<title>Authentication required</title>
|
|
1586
1547
|
<style>
|
|
1587
1548
|
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
|
|
1588
1549
|
:root {
|
|
@@ -1595,18 +1556,10 @@ function getTokenLoginHtml(options = {}) {
|
|
|
1595
1556
|
--text: #f4f4f5;
|
|
1596
1557
|
--muted: #a1a1aa;
|
|
1597
1558
|
--subtle: #71717a;
|
|
1598
|
-
--error: #fca5a5;
|
|
1599
|
-
--error-bg: rgba(127,29,29,0.18);
|
|
1600
|
-
--success: #86efac;
|
|
1601
|
-
--success-bg: rgba(20,83,45,0.2);
|
|
1602
|
-
--info: #c4b5fd;
|
|
1603
|
-
--info-bg: rgba(76,29,149,0.18);
|
|
1604
1559
|
}
|
|
1605
1560
|
body {
|
|
1606
1561
|
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
|
|
1607
|
-
background:
|
|
1608
|
-
radial-gradient(circle at top left, rgba(63,63,70,0.24), transparent 32rem),
|
|
1609
|
-
linear-gradient(180deg, #111114 0%, var(--bg) 58%);
|
|
1562
|
+
background: linear-gradient(180deg, #111114 0%, var(--bg) 58%);
|
|
1610
1563
|
color: var(--text);
|
|
1611
1564
|
display: flex;
|
|
1612
1565
|
align-items: center;
|
|
@@ -1650,107 +1603,11 @@ function getTokenLoginHtml(options = {}) {
|
|
|
1650
1603
|
font-size: 0.9375rem;
|
|
1651
1604
|
line-height: 1.55;
|
|
1652
1605
|
}
|
|
1653
|
-
label {
|
|
1654
|
-
display: flex;
|
|
1655
|
-
align-items: baseline;
|
|
1656
|
-
justify-content: space-between;
|
|
1657
|
-
gap: 0.75rem;
|
|
1658
|
-
font-size: 0.8125rem;
|
|
1659
|
-
color: var(--muted);
|
|
1660
|
-
margin-bottom: 0.375rem;
|
|
1661
|
-
}
|
|
1662
|
-
label span:last-child {
|
|
1663
|
-
color: var(--subtle);
|
|
1664
|
-
font-size: 0.75rem;
|
|
1665
|
-
}
|
|
1666
|
-
.input-wrap { position: relative; }
|
|
1667
|
-
input {
|
|
1668
|
-
width: 100%;
|
|
1669
|
-
min-height: 2.75rem;
|
|
1670
|
-
padding: 0.625rem 0.75rem;
|
|
1671
|
-
background: #0f0f12;
|
|
1672
|
-
border: 1px solid var(--border);
|
|
1673
|
-
border-radius: 8px;
|
|
1674
|
-
color: var(--text);
|
|
1675
|
-
font-size: 0.9375rem;
|
|
1676
|
-
outline: none;
|
|
1677
|
-
}
|
|
1678
|
-
input:focus {
|
|
1679
|
-
border-color: var(--border-strong);
|
|
1680
|
-
box-shadow: 0 0 0 3px rgba(255,255,255,0.08);
|
|
1681
|
-
}
|
|
1682
|
-
input::placeholder { color: #52525b; }
|
|
1683
|
-
button {
|
|
1684
|
-
width: 100%;
|
|
1685
|
-
min-height: 2.75rem;
|
|
1686
|
-
margin-top: 1rem;
|
|
1687
|
-
padding: 0.625rem 0.875rem;
|
|
1688
|
-
background: var(--text);
|
|
1689
|
-
color: #000;
|
|
1690
|
-
border: none;
|
|
1691
|
-
border-radius: 8px;
|
|
1692
|
-
font-size: 0.9375rem;
|
|
1693
|
-
font-weight: 600;
|
|
1694
|
-
cursor: pointer;
|
|
1695
|
-
transition: transform 120ms ease, opacity 120ms ease, background 120ms ease;
|
|
1696
|
-
}
|
|
1697
|
-
button:hover:not(:disabled) { background: #e4e4e7; transform: translateY(-1px); }
|
|
1698
|
-
button:disabled { opacity: 0.55; cursor: wait; }
|
|
1699
1606
|
.hint {
|
|
1700
|
-
margin-top: 0.75rem;
|
|
1701
|
-
color: var(--subtle);
|
|
1702
|
-
font-size: 0.8125rem;
|
|
1703
|
-
line-height: 1.45;
|
|
1704
|
-
}
|
|
1705
|
-
.msg {
|
|
1706
|
-
display: none;
|
|
1707
|
-
margin-top: 0.875rem;
|
|
1708
|
-
padding: 0.75rem;
|
|
1709
|
-
border-radius: 8px;
|
|
1710
|
-
font-size: 0.8125rem;
|
|
1711
|
-
line-height: 1.45;
|
|
1712
|
-
}
|
|
1713
|
-
.msg.show { display: block; }
|
|
1714
|
-
.msg.error {
|
|
1715
|
-
color: var(--error);
|
|
1716
|
-
background: var(--error-bg);
|
|
1717
|
-
border: 1px solid rgba(248,113,113,0.22);
|
|
1718
|
-
}
|
|
1719
|
-
.msg.success {
|
|
1720
|
-
color: var(--success);
|
|
1721
|
-
background: var(--success-bg);
|
|
1722
|
-
border: 1px solid rgba(74,222,128,0.18);
|
|
1723
|
-
}
|
|
1724
|
-
.msg.info {
|
|
1725
|
-
color: var(--info);
|
|
1726
|
-
background: var(--info-bg);
|
|
1727
|
-
border: 1px solid rgba(167,139,250,0.2);
|
|
1728
|
-
}
|
|
1729
|
-
details {
|
|
1730
1607
|
margin-top: 1rem;
|
|
1731
|
-
padding-top: 1rem;
|
|
1732
|
-
border-top: 1px solid var(--border);
|
|
1733
|
-
}
|
|
1734
|
-
summary {
|
|
1735
|
-
cursor: pointer;
|
|
1736
|
-
color: var(--muted);
|
|
1737
|
-
font-size: 0.8125rem;
|
|
1738
|
-
font-weight: 600;
|
|
1739
|
-
}
|
|
1740
|
-
details p {
|
|
1741
|
-
margin-top: 0.75rem;
|
|
1742
1608
|
color: var(--subtle);
|
|
1743
1609
|
font-size: 0.8125rem;
|
|
1744
|
-
line-height: 1.
|
|
1745
|
-
}
|
|
1746
|
-
code {
|
|
1747
|
-
color: #e4e4e7;
|
|
1748
|
-
background: var(--panel-soft);
|
|
1749
|
-
border: 1px solid var(--border);
|
|
1750
|
-
border-radius: 5px;
|
|
1751
|
-
padding: 0.075rem 0.25rem;
|
|
1752
|
-
font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
|
|
1753
|
-
font-size: 0.78rem;
|
|
1610
|
+
line-height: 1.45;
|
|
1754
1611
|
}
|
|
1755
1612
|
@media (max-width: 480px) {
|
|
1756
1613
|
.card { padding: 1.5rem; }
|
|
@@ -1760,118 +1617,11 @@ function getTokenLoginHtml(options = {}) {
|
|
|
1760
1617
|
</head>
|
|
1761
1618
|
<body>
|
|
1762
1619
|
<div class="card">
|
|
1763
|
-
<div class="eyebrow">
|
|
1764
|
-
<h1>
|
|
1765
|
-
<p class="intro">
|
|
1766
|
-
<
|
|
1767
|
-
<label for="token"><span>App ACCESS_TOKEN</span><span>Required</span></label>
|
|
1768
|
-
<div class="input-wrap">
|
|
1769
|
-
<input id="token" type="password" autocomplete="current-password" autofocus placeholder="Paste the shared app token" />
|
|
1770
|
-
</div>
|
|
1771
|
-
<button id="submit" type="submit">Continue</button>
|
|
1772
|
-
<p class="hint">If someone sent you this app, ask them for the shared app token. If you own the deploy, use the exact value saved as <code>ACCESS_TOKEN</code> or one of <code>ACCESS_TOKENS</code>.</p>
|
|
1773
|
-
<p class="msg error" id="msg" role="alert"></p>
|
|
1774
|
-
</form>
|
|
1775
|
-
<details>
|
|
1776
|
-
<summary>Where do I find this?</summary>
|
|
1777
|
-
<p>Create or copy the app's shared token from your deployment environment variables. The key should be <code>ACCESS_TOKEN</code> for one token or <code>ACCESS_TOKENS</code> for a comma-separated list. Redeploy after changing it.</p>
|
|
1778
|
-
</details>
|
|
1620
|
+
<div class="eyebrow">Authentication required</div>
|
|
1621
|
+
<h1>Sign in is not configured</h1>
|
|
1622
|
+
<p class="intro">This route requires an authenticated session, but this app's custom auth plugin did not provide a sign-in page.</p>
|
|
1623
|
+
<p class="hint">If this route should be public, add it to the auth plugin's public route configuration. Otherwise configure a custom sign-in page for this app.</p>
|
|
1779
1624
|
</div>
|
|
1780
|
-
<script>
|
|
1781
|
-
var configuredBasePath = ${JSON.stringify(configuredBasePath)};
|
|
1782
|
-
function __anBasePath() {
|
|
1783
|
-
if (
|
|
1784
|
-
configuredBasePath &&
|
|
1785
|
-
(window.location.pathname === configuredBasePath ||
|
|
1786
|
-
window.location.pathname.indexOf(configuredBasePath + '/') === 0)
|
|
1787
|
-
) {
|
|
1788
|
-
return configuredBasePath;
|
|
1789
|
-
}
|
|
1790
|
-
var marker = '/_agent-native';
|
|
1791
|
-
var idx = window.location.pathname.indexOf(marker);
|
|
1792
|
-
return idx > 0 ? window.location.pathname.slice(0, idx) : '';
|
|
1793
|
-
}
|
|
1794
|
-
function __anPath(path) {
|
|
1795
|
-
return __anBasePath() + path;
|
|
1796
|
-
}
|
|
1797
|
-
function setMessage(kind, text) {
|
|
1798
|
-
var msg = document.getElementById('msg');
|
|
1799
|
-
msg.textContent = text;
|
|
1800
|
-
msg.className = 'msg ' + kind + ' show';
|
|
1801
|
-
}
|
|
1802
|
-
function clearMessage() {
|
|
1803
|
-
var msg = document.getElementById('msg');
|
|
1804
|
-
msg.textContent = '';
|
|
1805
|
-
msg.className = 'msg error';
|
|
1806
|
-
}
|
|
1807
|
-
function setBusy(isBusy) {
|
|
1808
|
-
var button = document.getElementById('submit');
|
|
1809
|
-
var input = document.getElementById('token');
|
|
1810
|
-
button.disabled = isBusy;
|
|
1811
|
-
input.disabled = isBusy;
|
|
1812
|
-
button.textContent = isBusy ? 'Checking...' : 'Continue';
|
|
1813
|
-
}
|
|
1814
|
-
async function readJsonSafely(res) {
|
|
1815
|
-
try {
|
|
1816
|
-
return await res.json();
|
|
1817
|
-
} catch (_err) {
|
|
1818
|
-
return null;
|
|
1819
|
-
}
|
|
1820
|
-
}
|
|
1821
|
-
async function verifySession() {
|
|
1822
|
-
var res = await fetch(__anPath('/_agent-native/auth/session'), {
|
|
1823
|
-
method: 'GET',
|
|
1824
|
-
credentials: 'same-origin',
|
|
1825
|
-
cache: 'no-store',
|
|
1826
|
-
headers: { 'Accept': 'application/json' },
|
|
1827
|
-
});
|
|
1828
|
-
if (!res.ok) return false;
|
|
1829
|
-
var data = await readJsonSafely(res);
|
|
1830
|
-
return !!data && !data.error;
|
|
1831
|
-
}
|
|
1832
|
-
document.getElementById('form').addEventListener('submit', async (e) => {
|
|
1833
|
-
e.preventDefault();
|
|
1834
|
-
var token = document.getElementById('token').value.trim();
|
|
1835
|
-
if (!token) {
|
|
1836
|
-
setMessage('error', 'Paste the shared app token to continue.');
|
|
1837
|
-
return;
|
|
1838
|
-
}
|
|
1839
|
-
clearMessage();
|
|
1840
|
-
setBusy(true);
|
|
1841
|
-
setMessage('info', 'Checking the app token...');
|
|
1842
|
-
try {
|
|
1843
|
-
var res = await fetch(__anPath('/_agent-native/auth/login'), {
|
|
1844
|
-
method: 'POST',
|
|
1845
|
-
headers: {
|
|
1846
|
-
'Content-Type': 'application/json',
|
|
1847
|
-
'Accept': 'application/json',
|
|
1848
|
-
},
|
|
1849
|
-
credentials: 'same-origin',
|
|
1850
|
-
body: JSON.stringify({ token: token }),
|
|
1851
|
-
});
|
|
1852
|
-
if (!res.ok) {
|
|
1853
|
-
var badTokenMessage = 'That token was not accepted. Use this app\\'s shared ACCESS_TOKEN, not your deploy provider account token.';
|
|
1854
|
-
if (res.status === 404) {
|
|
1855
|
-
badTokenMessage = 'Could not reach this app\\'s auth endpoint. If this app is mounted under a path, confirm APP_BASE_PATH and VITE_APP_BASE_PATH match the deploy path.';
|
|
1856
|
-
}
|
|
1857
|
-
setMessage('error', badTokenMessage);
|
|
1858
|
-
setBusy(false);
|
|
1859
|
-
return;
|
|
1860
|
-
}
|
|
1861
|
-
var hasSession = await verifySession();
|
|
1862
|
-
if (!hasSession) {
|
|
1863
|
-
setMessage('error', 'The token was accepted, but the browser did not keep the session cookie. Try opening the app in a new tab, or check cookie restrictions for this domain.');
|
|
1864
|
-
setBusy(false);
|
|
1865
|
-
return;
|
|
1866
|
-
}
|
|
1867
|
-
setMessage('success', 'Signed in. Opening the app...');
|
|
1868
|
-
window.location.replace(window.location.href);
|
|
1869
|
-
} catch (_err) {
|
|
1870
|
-
setMessage('error', 'Could not contact the auth endpoint. Check the deploy status, then try again.');
|
|
1871
|
-
setBusy(false);
|
|
1872
|
-
}
|
|
1873
|
-
});
|
|
1874
|
-
</script>
|
|
1875
1625
|
</body>
|
|
1876
1626
|
</html>`;
|
|
1877
1627
|
}
|
|
@@ -2196,7 +1946,6 @@ async function mountBetterAuthRoutes(app, options) {
|
|
|
2196
1946
|
});
|
|
2197
1947
|
return { token: entry.token, email: entry.email };
|
|
2198
1948
|
}));
|
|
2199
|
-
const accessTokens = getAccessTokens();
|
|
2200
1949
|
// Initialize Better Auth. Forward `googleScopes` into the BetterAuthConfig
|
|
2201
1950
|
// so the social provider requests the broader product scopes (Gmail,
|
|
2202
1951
|
// Calendar, etc.) up front during the primary sign-in — eliminating the
|
|
@@ -2392,19 +2141,6 @@ async function mountBetterAuthRoutes(app, options) {
|
|
|
2392
2141
|
return { error: "Method not allowed" };
|
|
2393
2142
|
}
|
|
2394
2143
|
const body = await readBody(event);
|
|
2395
|
-
// Legacy ACCESS_TOKEN login
|
|
2396
|
-
if (body?.token &&
|
|
2397
|
-
typeof body.token === "string" &&
|
|
2398
|
-
accessTokens.length > 0) {
|
|
2399
|
-
if (!safeTokenMatch(body.token, accessTokens)) {
|
|
2400
|
-
setResponseStatus(event, 401);
|
|
2401
|
-
return { error: "Invalid token" };
|
|
2402
|
-
}
|
|
2403
|
-
const sessionToken = crypto.randomBytes(32).toString("hex");
|
|
2404
|
-
await addSession(sessionToken, "user");
|
|
2405
|
-
setFrameworkSessionCookie(event, sessionToken);
|
|
2406
|
-
return authLoginResponse(event, sessionToken, "user");
|
|
2407
|
-
}
|
|
2408
2144
|
// Email/password login via Better Auth
|
|
2409
2145
|
const email = body?.email?.trim?.()?.toLowerCase?.();
|
|
2410
2146
|
const password = body?.password;
|
|
@@ -2601,59 +2337,6 @@ async function mountBetterAuthRoutes(app, options) {
|
|
|
2601
2337
|
app.use(defineEventHandler(guardFn));
|
|
2602
2338
|
}
|
|
2603
2339
|
// ---------------------------------------------------------------------------
|
|
2604
|
-
// mountTokenOnlyRoutes — ACCESS_TOKEN-only auth (no Better Auth)
|
|
2605
|
-
// ---------------------------------------------------------------------------
|
|
2606
|
-
function mountTokenOnlyRoutes(app, accessTokens, publicPaths = [], workspaceAppAudience = resolveWorkspaceAppAudience(), workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess()) {
|
|
2607
|
-
app.use("/_agent-native/auth/login", defineEventHandler(async (event) => {
|
|
2608
|
-
if (getMethod(event) !== "POST") {
|
|
2609
|
-
setResponseStatus(event, 405);
|
|
2610
|
-
return { error: "Method not allowed" };
|
|
2611
|
-
}
|
|
2612
|
-
const body = await readBody(event);
|
|
2613
|
-
if (!body?.token ||
|
|
2614
|
-
typeof body.token !== "string" ||
|
|
2615
|
-
!safeTokenMatch(body.token, accessTokens)) {
|
|
2616
|
-
setResponseStatus(event, 401);
|
|
2617
|
-
return { error: "Invalid token" };
|
|
2618
|
-
}
|
|
2619
|
-
const sessionToken = crypto.randomBytes(32).toString("hex");
|
|
2620
|
-
await addSession(sessionToken, "user");
|
|
2621
|
-
setFrameworkSessionCookie(event, sessionToken);
|
|
2622
|
-
return authLoginResponse(event, sessionToken, "user");
|
|
2623
|
-
}));
|
|
2624
|
-
app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
|
|
2625
|
-
for (const cookie of getFrameworkSessionCookieValues(event)) {
|
|
2626
|
-
await removeSession(cookie);
|
|
2627
|
-
}
|
|
2628
|
-
const bearerToken = getBearerSessionToken(event);
|
|
2629
|
-
if (bearerToken)
|
|
2630
|
-
await removeSession(bearerToken);
|
|
2631
|
-
clearFrameworkSessionCookies(event);
|
|
2632
|
-
if (isElectronRequest(event))
|
|
2633
|
-
await clearDesktopSso();
|
|
2634
|
-
return { ok: true };
|
|
2635
|
-
}));
|
|
2636
|
-
app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
|
|
2637
|
-
if (!isReadMethod(event)) {
|
|
2638
|
-
setResponseStatus(event, 405);
|
|
2639
|
-
return { error: "Method not allowed" };
|
|
2640
|
-
}
|
|
2641
|
-
const session = await getSession(event);
|
|
2642
|
-
return session ?? { error: "Not authenticated" };
|
|
2643
|
-
}));
|
|
2644
|
-
_authGuardConfig = {
|
|
2645
|
-
loginHtml: getTokenLoginHtml(),
|
|
2646
|
-
getLoginHtml: (_event, rawPath) => getTokenLoginHtml({ requestPath: rawPath }),
|
|
2647
|
-
publicPaths,
|
|
2648
|
-
workspaceAppAudience,
|
|
2649
|
-
workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
|
|
2650
|
-
workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
|
|
2651
|
-
};
|
|
2652
|
-
const guardFn = createAuthGuardFn();
|
|
2653
|
-
_authGuardFn = guardFn;
|
|
2654
|
-
app.use(defineEventHandler(guardFn));
|
|
2655
|
-
}
|
|
2656
|
-
// ---------------------------------------------------------------------------
|
|
2657
2340
|
// mountAuthFallbackRoutes — minimal auth endpoints when Better Auth init fails
|
|
2658
2341
|
// ---------------------------------------------------------------------------
|
|
2659
2342
|
function mountAuthFallbackRoutes(app) {
|
|
@@ -2765,7 +2448,6 @@ function mountAuthFallbackRoutes(app) {
|
|
|
2765
2448
|
* Automatically configure auth based on environment and configuration:
|
|
2766
2449
|
*
|
|
2767
2450
|
* - **BYOA (custom getSession)**: Template-provided auth callback handles everything.
|
|
2768
|
-
* - **ACCESS_TOKEN/ACCESS_TOKENS**: Simple token-based auth.
|
|
2769
2451
|
* - **Default**: Better Auth with email/password, social providers, organizations, and JWT.
|
|
2770
2452
|
* Users see an onboarding page to create an account on first visit.
|
|
2771
2453
|
*
|
|
@@ -2872,13 +2554,13 @@ export async function autoMountAuth(app, options = {}) {
|
|
|
2872
2554
|
await clearDesktopSso();
|
|
2873
2555
|
return { ok: true };
|
|
2874
2556
|
}));
|
|
2875
|
-
const byoaLoginHtml = options.loginHtml ??
|
|
2557
|
+
const byoaLoginHtml = options.loginHtml ?? getCustomAuthRequiredHtml();
|
|
2876
2558
|
_authGuardConfig = {
|
|
2877
2559
|
loginHtml: byoaLoginHtml,
|
|
2878
2560
|
...(options.loginHtml
|
|
2879
2561
|
? {}
|
|
2880
2562
|
: {
|
|
2881
|
-
getLoginHtml: (
|
|
2563
|
+
getLoginHtml: () => getCustomAuthRequiredHtml(),
|
|
2882
2564
|
}),
|
|
2883
2565
|
publicPaths,
|
|
2884
2566
|
workspaceAppAudience,
|
|
@@ -2892,14 +2574,6 @@ export async function autoMountAuth(app, options = {}) {
|
|
|
2892
2574
|
console.log("[agent-native] Auth enabled — custom getSession provider.");
|
|
2893
2575
|
return true;
|
|
2894
2576
|
}
|
|
2895
|
-
// ACCESS_TOKEN-only mode
|
|
2896
|
-
const tokens = getAccessTokens();
|
|
2897
|
-
if (tokens.length > 0) {
|
|
2898
|
-
mountTokenOnlyRoutes(app, tokens, publicPaths, workspaceAppAudience, workspaceAppRouteAccess);
|
|
2899
|
-
if (process.env.DEBUG)
|
|
2900
|
-
console.log(`[agent-native] Auth enabled — ${tokens.length} access token(s) configured.`);
|
|
2901
|
-
return true;
|
|
2902
|
-
}
|
|
2903
2577
|
// Default: Better Auth (account-first)
|
|
2904
2578
|
try {
|
|
2905
2579
|
await mountBetterAuthRoutes(app, options);
|
|
@@ -2934,6 +2608,8 @@ export async function autoMountAuth(app, options = {}) {
|
|
|
2934
2608
|
* @deprecated Use `autoMountAuth(app, options?)` instead.
|
|
2935
2609
|
*/
|
|
2936
2610
|
export function mountAuthMiddleware(app, accessToken) {
|
|
2937
|
-
|
|
2611
|
+
void app;
|
|
2612
|
+
void accessToken;
|
|
2613
|
+
throw new Error("mountAuthMiddleware(accessToken) has been removed. Use createAuthPlugin() or autoMountAuth() with Better Auth, or a custom getSession provider.");
|
|
2938
2614
|
}
|
|
2939
2615
|
//# sourceMappingURL=auth.js.map
|