@aiquants/auth-react-router 0.2.1 → 0.3.0

package/README.md

@@ -22,8 +22,8 @@ export const authServer = createAuthServer({
     isEmailAllowed: emailDomainAllowlist(parseAllowlistCsv(env.ALLOWED_EMAILS), parseAllowlistCsv(env.ALLOWED_DOMAINS)),
     backendAuth: { verify: verifyBackend, signup: (p, t) => signupBackend(p, t) },      // FastAPI verify/signup
     getUserPhoto: async (openid) => (await getOpenids({ openid }))[0]?.picture ?? "",   // drizzle TDOpenid
-    warmup: async () => { await Promise.all([ensureQuantsConnection(), ensureSanwaConnection()]) },
-    mockUser: quantsMockUserPort,   // test backdoor (E2E) — omit in production-only apps
+    warmup: async () => { await Promise.all([ensurePrimaryConnection(), ensureSecondaryConnection()]) },
+    mockUser: mockUserPort,   // test backdoor (E2E) — omit in production-only apps
 })
 export const { authenticator, sessionStorage, getSession, getSessionUser, saveSession, requireUser, requireAdminUser, commitSession, destroySession, authenticate, refreshedAccessToken, authenticateInLoader, loginLoader, loginAction, logoutLoader, logout, logoutAndRedirect, googleCallbackLoader } = authServer
 ```
@@ -46,23 +46,23 @@ Styling: this package has **no hand-written component CSS** (the `GoogleForm` cl
 
 Never mix the two: importing the standalone utility CSS next to a host Tailwind build duplicates same-named utilities, and base/variant cascade winners flip versus the single-build canonical order.
 
-## Behavior contract (preserved from quants-react-router)
+## Behavior Contract
 
 - **Session cookie byte compatibility**: `__session` (httpOnly/lax/30d), key `"user"`, value = `{ id, displayName, name, emails, accessToken, refreshToken?, expirationDateMs?, provider, role? }` — never `photo`/`_json`/`photos`. Changing this invalidates all live 30-day sessions.
-- **Verify order**: Google profile check → `backendAuth.verify` → allowlist → `backendAuth.signup` (every login). Failures redirect to `<loginPath>?error=<encoded Japanese message>` (messages overridable via `messages`).
+- **Verify order**: Google profile check → `backendAuth.verify` → allowlist → `backendAuth.signup` (every login). Failures redirect to `<loginPath>?error=<encoded error message>` (messages overridable via `messages`).
 - **Token refresh**: expiry check → Google `oauth2/v4/token` rotate → session update; `invalid_grant` destroys the session and redirects to login with `Set-Cookie`.
 - **Loader guard**: `authenticateInLoader(request, { failureRedirect })` returns `{ user?, cookie? }`; `failureRedirect: null` = no-redirect mode. Photo lookups are cached with in-flight dedup per factory instance.
 
-## DI ports absorbing per-app differences (quants vs sanledge)
+## DI Ports Absorbing Per-App Differences
 
-| Port | quants | sanledge |
+| Port | App A | App B |
 | --- | --- | --- |
 | `google.scopes` | default | + `directory.readonly` etc. |
 | `mockUser` | `mock_user_id` cookie parse + name map | fixed id |
 | `warmup` | 2 pools | 1 pool |
-| `backendAuth` | quants-api | sanledge-api |
+| `backendAuth` | primary-api | secondary-api |
 
-## Intentional changes vs the original (§8, approved)
+## Intentional Changes vs Original (§8, approved)
 
 1. No import-time env reads/throws — all validation happens in `createAuthServer`.
 2. Allowlist matching is trim+lowercase (unified with the Python side via `@aiquants/auth-core`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiquants/auth-react-router",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "React Router v7 auth adapter for @aiquants/auth-core: Google OAuth strategy factory (remix-auth), cookie session storage with DI test backdoor, per-request loader guard with token refresh + photo cache, auth route handlers, and a <GoogleForm> login button.",
   "sideEffects": [
     "**/*.css"