@authup/server-auth-console 1.0.0-beta.69 → 1.0.0-beta.70
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +98 -54
- package/package.json +11 -11
package/README.md
CHANGED
|
@@ -1,78 +1,122 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
consent
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
1
|
+
<p align="center">
|
|
2
|
+
<img src="https://raw.githubusercontent.com/authup/authup/master/.github/assets/logo.svg" alt="Authup logo" width="96" height="96" />
|
|
3
|
+
</p>
|
|
4
|
+
|
|
5
|
+
<h1 align="center">@authup/server-auth-console</h1>
|
|
6
|
+
|
|
7
|
+
<p align="center">
|
|
8
|
+
<b>The service that renders Authup's hosted login, consent, registration and password recovery pages.</b><br>
|
|
9
|
+
server-core redirects every page request here; this service renders it and hydrates it over HTTP.
|
|
10
|
+
</p>
|
|
11
|
+
|
|
12
|
+
<p align="center">
|
|
13
|
+
<a href="https://www.npmjs.com/package/@authup/server-auth-console"><img src="https://img.shields.io/npm/v/@authup/server-auth-console" alt="npm version" /></a>
|
|
14
|
+
<a href="https://github.com/authup/authup/actions/workflows/main.yml"><img src="https://github.com/authup/authup/actions/workflows/main.yml/badge.svg" alt="CI" /></a>
|
|
15
|
+
<a href="./LICENSE"><img src="https://img.shields.io/badge/license-AGPL--3.0-blue" alt="License: AGPL-3.0" /></a>
|
|
16
|
+
</p>
|
|
17
|
+
|
|
18
|
+
<p align="center">
|
|
19
|
+
<a href="#installation"><b>Installation</b></a> · <a href="#usage">Usage</a> · <a href="#api">API</a> · <a href="https://authup.org">Documentation</a>
|
|
20
|
+
</p>
|
|
21
|
+
|
|
22
|
+
---
|
|
23
|
+
|
|
24
|
+
## Where it fits
|
|
25
|
+
|
|
26
|
+
A `GET` on one of server-core's page routes (`/authorize`, `/register`, `/activate`, `/password-forgot`, `/password-reset`, `/logout`, `/device`) answers a redirect to this service carrying the request's own query. This service renders the page through the server bundle of [`@authup/client-auth-console`](https://github.com/authup/authup/tree/master/apps/client-auth-console), resolved out of `node_modules`, and serves that bundle's client assets under its own `/assets`, cached as immutable for one year.
|
|
27
|
+
|
|
28
|
+
It holds no credential, no database and no loopback. It fetches each page's data anonymously from server-core:
|
|
29
|
+
|
|
30
|
+
| Page | Hydrated from |
|
|
31
|
+
|---|---|
|
|
32
|
+
| `/authorize` | `GET /authorize/info` with the browser's query, plus the visitor's access token cookie so the first render shows the right step |
|
|
33
|
+
| `/register`, `/activate`, `/password-forgot`, `/password-reset` | The feature flags on `GET /`, plus the page's own query |
|
|
34
|
+
| `/device` | The feature flags, plus the `user_code` it was called with |
|
|
35
|
+
| `/logout` | Nothing: the page drives the end-session call itself |
|
|
36
|
+
|
|
37
|
+
The [`authup`](https://github.com/authup/authup/tree/master/apps/authup) CLI depends on this package. Install it directly only to run the pages without the CLI, or to compose its handler into a server of your own.
|
|
38
|
+
|
|
39
|
+
## Installation
|
|
40
|
+
|
|
41
|
+
```shell
|
|
42
|
+
npm install @authup/server-auth-console
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
Node.js `^22.13.0 || ^23.5.0 || >=24.0.0`. The package is ESM-only and ships the `authup-auth-console` binary. `@authup/client-auth-console` comes with it as a dependency.
|
|
25
46
|
|
|
26
47
|
## Usage
|
|
27
48
|
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
49
|
+
### With the CLI
|
|
50
|
+
|
|
51
|
+
```shell
|
|
52
|
+
authup start console auth # this console alone, on authConsole.port
|
|
53
|
+
authup start # this console on server-core's own listener, at /console/auth
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
Both read `authup.yml` and hand this service its own section. `authup start` also points the service's internal API address at its own listener, unless `internalUrl` is configured.
|
|
31
57
|
|
|
32
|
-
|
|
33
|
-
that runs a console without the CLI. It reads the environment alone.
|
|
58
|
+
### Standalone binary
|
|
34
59
|
|
|
35
|
-
```
|
|
36
|
-
PUBLIC_URL=https://example.com AUTH_CONSOLE_PORT=3020 authup-auth-console
|
|
60
|
+
```shell
|
|
61
|
+
PUBLIC_URL=https://auth.example.com INTERNAL_URL=http://core:3000 AUTH_CONSOLE_PORT=3020 authup-auth-console
|
|
37
62
|
```
|
|
38
63
|
|
|
64
|
+
The binary reads the environment alone, never `authup.yml`, and tears down on `SIGINT` / `SIGTERM`.
|
|
65
|
+
|
|
66
|
+
### In your own process
|
|
67
|
+
|
|
39
68
|
```typescript
|
|
40
69
|
import { createApplication } from '@authup/server-auth-console';
|
|
41
70
|
|
|
42
71
|
const application = createApplication();
|
|
43
|
-
|
|
44
72
|
await application.setup();
|
|
45
73
|
```
|
|
46
74
|
|
|
47
|
-
`createApplication()`
|
|
48
|
-
|
|
49
|
-
|
|
75
|
+
`createApplication()` resolves the configuration from the environment, loads the theme and listens. Pass `{ listen: false }` to build it without a listener, or `{ config }` with a `Config` or a function returning one. `createHandler(config)` returns the mountable routup app alone.
|
|
76
|
+
|
|
77
|
+
### Replace the pages
|
|
78
|
+
|
|
79
|
+
Set `authConsole.path` (`AUTH_CONSOLE_PATH`) to the directory of a package that fulfills the render contract of `@authup/client-auth-console`: a `dist/client/index.html`, a `dist/client/.vite/ssr-manifest.json` and a `dist/server/server.js` exporting `render` and `CONTRACT_VERSION`. At boot the service refuses a bundle whose `CONTRACT_VERSION` (missing counts as `1`) is not `5`.
|
|
50
80
|
|
|
51
81
|
## Configuration
|
|
52
82
|
|
|
53
|
-
Keys are declared once in `@authup/server-config
|
|
54
|
-
|
|
55
|
-
|
|
83
|
+
Keys are declared once in [`@authup/server-config`](https://github.com/authup/authup/tree/master/packages/server-config). This service's own section is `authConsole`, and it has no `enabled` key: the hosted pages are where tokens are issued, so they cannot be turned off.
|
|
84
|
+
|
|
85
|
+
| Key | Environment variable | Default | Description |
|
|
86
|
+
|---|---|---|---|
|
|
87
|
+
| `authConsole.url` | `AUTH_CONSOLE_URL` | `<publicUrl>/console/auth` | Where the pages are published; server-core redirects there. Another path is allowed, another origin is refused |
|
|
88
|
+
| `authConsole.path` | `AUTH_CONSOLE_PATH` | `''` | A substituted console package directory, consulted before `node_modules` |
|
|
89
|
+
| `authConsole.port` | `AUTH_CONSOLE_PORT` | `3020` | The standalone listener port |
|
|
90
|
+
| `authConsole.host` | `AUTH_CONSOLE_HOST` | inherits `host` (`HOST`) | The standalone listener address |
|
|
91
|
+
| `publicUrl` | `PUBLIC_URL` | derived from `core.host` and `core.port` | The API address the browser reaches; it goes into the page |
|
|
92
|
+
| `internalUrl` | `INTERNAL_URL` | `publicUrl` | The API address this service fetches from |
|
|
93
|
+
|
|
94
|
+
It also reads `theme.directoryPath` (`THEME_DIRECTORY_PATH`) and `theme.fragmentsEnabled` (`THEME_FRAGMENTS_ENABLED`).
|
|
95
|
+
|
|
96
|
+
## API
|
|
56
97
|
|
|
57
|
-
|
|
|
98
|
+
| Export | Kind | Purpose |
|
|
58
99
|
|---|---|---|
|
|
59
|
-
| `
|
|
60
|
-
| `
|
|
61
|
-
| `
|
|
62
|
-
| `
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
`
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
100
|
+
| `createApplication` | Function | The pages as a runnable service: config, theme and listener |
|
|
101
|
+
| `createHandler` | Function | The mountable routup app for a `Config`; an optional `render` replaces the bundle's |
|
|
102
|
+
| `createServer` | Function | `createHandler` wrapped in an app of its own, without the module graph |
|
|
103
|
+
| `resolveConfig`, `readConfigFromEnv` | Function | Map `authup.yml`-shaped input, or the environment, onto `Config` (async) |
|
|
104
|
+
| `CONFIG_SCHEMA` | Constant | The registry of keys this service reads |
|
|
105
|
+
| `createRenderPage` | Function | The per-handler renderer over a dist directory |
|
|
106
|
+
| `assertRenderContract` | Function | Throw when a bundle's `CONTRACT_VERSION` differs from the service's |
|
|
107
|
+
| `resolvePackagePath`, `resolveDistPath` | Function | Locate the console package and its built dist |
|
|
108
|
+
| `sanitizeRelativeRedirect` | Function | Accept a `redirect` value only when it is a site-relative path |
|
|
109
|
+
| `CONTRACT_VERSION`, `PAGES`, `BASE_PATH`, `VITE_BASE`, `HEALTH_PATH` | Constant | The serving contract with the bundle |
|
|
110
|
+
| `Config`, `ConfigInput`, `RenderPage` | Type | The resolved configuration, its input and the renderer signature |
|
|
111
|
+
|
|
112
|
+
## Notes
|
|
113
|
+
|
|
114
|
+
- **Two API addresses, on purpose.** `publicUrl` is what the browser reaches; inside a container it may name a port nothing listens on. Set `internalUrl` whenever this service runs where `publicUrl` does not resolve, or `/authorize` and the workflow pages answer `502`.
|
|
115
|
+
- **Only the access token is forwarded, and only on `/authorize`.** The refresh token never leaves the browser, and the service never revokes or writes anything during a render.
|
|
116
|
+
- **A missing bundle does not fail the boot.** Every page answers an error naming the missing build until `@authup/client-auth-console` is built; a bundle with the wrong contract version does fail the boot.
|
|
71
117
|
|
|
72
118
|
## License
|
|
73
119
|
|
|
74
120
|
Made with 💚
|
|
75
121
|
|
|
76
|
-
Published under the [AGPL-3.0
|
|
77
|
-
A commercial license is available for organizations that cannot meet the AGPL's conditions.
|
|
78
|
-
See [LICENSING.md](../../LICENSING.md) or contact **contact@tada5hi.net**.
|
|
122
|
+
Published under the [AGPL-3.0](./LICENSE). A commercial license is available; see [LICENSING.md](https://github.com/authup/authup/blob/master/LICENSING.md).
|
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@authup/server-auth-console",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "1.0.0-beta.
|
|
5
|
-
"description": "The
|
|
4
|
+
"version": "1.0.0-beta.70",
|
|
5
|
+
"description": "The service that renders Authup's hosted login, consent, registration and password recovery pages.",
|
|
6
6
|
"license": "AGPL-3.0-only",
|
|
7
7
|
"bin": {
|
|
8
8
|
"authup-auth-console": "dist/bin.mjs"
|
|
@@ -51,21 +51,21 @@
|
|
|
51
51
|
},
|
|
52
52
|
"homepage": "https://github.com/authup/authup#readme",
|
|
53
53
|
"dependencies": {
|
|
54
|
-
"@authup/client-auth-console": "^1.0.0-beta.
|
|
55
|
-
"@authup/core-http-kit": "^1.0.0-beta.
|
|
56
|
-
"@authup/errors": "^1.0.0-beta.
|
|
57
|
-
"@authup/kit": "^1.0.0-beta.
|
|
58
|
-
"@authup/server-config": "^1.0.0-beta.
|
|
59
|
-
"@authup/server-config-kit": "^1.0.0-beta.
|
|
60
|
-
"@authup/server-console-kit": "^1.0.0-beta.
|
|
61
|
-
"@authup/specs": "^1.0.0-beta.
|
|
54
|
+
"@authup/client-auth-console": "^1.0.0-beta.70",
|
|
55
|
+
"@authup/core-http-kit": "^1.0.0-beta.70",
|
|
56
|
+
"@authup/errors": "^1.0.0-beta.70",
|
|
57
|
+
"@authup/kit": "^1.0.0-beta.70",
|
|
58
|
+
"@authup/server-config": "^1.0.0-beta.70",
|
|
59
|
+
"@authup/server-config-kit": "^1.0.0-beta.70",
|
|
60
|
+
"@authup/server-console-kit": "^1.0.0-beta.70",
|
|
61
|
+
"@authup/specs": "^1.0.0-beta.70",
|
|
62
62
|
"@routup/assets": "^5.0.0",
|
|
63
63
|
"@routup/basic": "^3.0.1",
|
|
64
64
|
"locter": "^4.1.1",
|
|
65
65
|
"orkos": "^1.1.1",
|
|
66
66
|
"routup": "^6.1.0",
|
|
67
67
|
"validup": "^2.0.1",
|
|
68
|
-
"zod": "^4.6.
|
|
68
|
+
"zod": "^4.6.7"
|
|
69
69
|
},
|
|
70
70
|
"devDependencies": {
|
|
71
71
|
"@types/node": "^26.6.5",
|