@baseplate-dev/plugin-auth 0.6.14 → 0.6.16

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.js

@@ -1,7 +1,7 @@
 // @ts-nocheck
 import { EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC } from '$constantsPassword';
 import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
-import { config } from '%configServiceImports';
+import { getConfig } from '%configServiceImports';
 import { BadRequestError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { memoizeRateLimiter } from '%rateLimitImports';
@@ -50,7 +50,7 @@ export async function requestEmailVerification({ userId, context, }) {
         expiresInSec: EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC,
     });
     // Construct verification URL using configured domain
-    const verifyLink = `${config.AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+    const verifyLink = `${getConfig().AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
     await services.email.send(TPL_ACCOUNT_VERIFICATION_EMAIL, {
         to: user.email,
         data: { verifyLink },

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.ts

@@ -10,7 +10,7 @@ import {
   createAuthVerification,
   validateAuthVerification,
 } from '%authModuleImports';
-import { config } from '%configServiceImports';
+import { getConfig } from '%configServiceImports';
 import { BadRequestError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { memoizeRateLimiter } from '%rateLimitImports';
@@ -91,7 +91,7 @@ export async function requestEmailVerification({
   });
 
   // Construct verification URL using configured domain
-  const verifyLink = `${config.AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+  const verifyLink = `${getConfig().AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
 
   await services.email.send(TPL_ACCOUNT_VERIFICATION_EMAIL, {
     to: user.email,

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.js

@@ -2,7 +2,7 @@
 import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PASSWORD_RESET_TOKEN_EXPIRY_SEC, } from '$constantsPassword';
 import { resetLoginRateLimits } from '$servicesUserPassword';
 import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
-import { config } from '%configServiceImports';
+import { getConfig } from '%configServiceImports';
 import { BadRequestError, handleZodRequestValidationError, } from '%errorHandlerServiceImports';
 import { createPasswordHash } from '%passwordHasherServiceImports';
 import { prisma } from '%prismaImports';
@@ -59,7 +59,7 @@ export async function requestPasswordReset({ email: rawEmail, context, }) {
             expiresInSec: PASSWORD_RESET_TOKEN_EXPIRY_SEC,
         });
         // Construct reset URL using configured domain
-        const resetLink = `${config.AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
+        const resetLink = `${getConfig().AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
         // Send email asynchronously (queue-based)
         await services.email.send(TPL_PASSWORD_RESET_EMAIL, {
             to: user.email,

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.ts

@@ -12,7 +12,7 @@ import {
   createAuthVerification,
   validateAuthVerification,
 } from '%authModuleImports';
-import { config } from '%configServiceImports';
+import { getConfig } from '%configServiceImports';
 import {
   BadRequestError,
   handleZodRequestValidationError,
@@ -108,7 +108,7 @@ export async function requestPasswordReset({
     });
 
     // Construct reset URL using configured domain
-    const resetLink = `${config.AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
+    const resetLink = `${getConfig().AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
 
     // Send email asynchronously (queue-based)
     await services.email.send(TPL_PASSWORD_RESET_EMAIL, {

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/user-password.service.js

@@ -94,8 +94,8 @@ export async function authenticateUserWithEmailAndPassword({ input, context, })
     const clientIp = context.reqInfo.ip;
     const emailIpKey = `${email}_${clientIp}`;
     // Check IP-based rate limit (slow brute force protection)
-    const ipResult = await getLoginIpLimiter().consume(clientIp);
-    if (!ipResult.allowed) {
+    const ipResult = await getLoginIpLimiter().get(clientIp);
+    if (ipResult && !ipResult.allowed) {
         throw new TooManyRequestsError('Too many login attempts. Please try again later or reset your password.', 'login-ip-rate-limited', { retryAfterMs: ipResult.msBeforeNext });
     }
     // Check consecutive failures rate limit (fast brute force protection)
@@ -113,10 +113,13 @@ export async function authenticateUserWithEmailAndPassword({ input, context, })
         },
     });
     // check for password match
-    const isValid = await verifyPasswordHash(userAccount?.password ?? '', password);
+    const isValid = await verifyPasswordHash(userAccount?.password, password);
     if (!isValid || !userAccount) {
         // Track failed attempt
-        await getLoginConsecutiveFailsLimiter().consume(emailIpKey);
+        await Promise.all([
+            getLoginIpLimiter().consume(clientIp),
+            getLoginConsecutiveFailsLimiter().consume(emailIpKey),
+        ]);
         throw new BadRequestError('Invalid email or password', 'invalid-credentials');
     }
     // Reset consecutive failures on successful login
@@ -149,7 +152,7 @@ export async function changeUserPassword({ userId, input, }) {
         },
     });
     // Verify current password
-    const isValid = await verifyPasswordHash(userAccount?.password ?? '', currentPassword);
+    const isValid = await verifyPasswordHash(userAccount?.password, currentPassword);
     if (!isValid || !userAccount) {
         throw new BadRequestError('Current password is incorrect', 'invalid-current-password');
     }

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/user-password.service.ts

@@ -169,8 +169,8 @@ export async function authenticateUserWithEmailAndPassword({
   const emailIpKey = `${email}_${clientIp}`;
 
   // Check IP-based rate limit (slow brute force protection)
-  const ipResult = await getLoginIpLimiter().consume(clientIp);
-  if (!ipResult.allowed) {
+  const ipResult = await getLoginIpLimiter().get(clientIp);
+  if (ipResult && !ipResult.allowed) {
     throw new TooManyRequestsError(
       'Too many login attempts. Please try again later or reset your password.',
       'login-ip-rate-limited',
@@ -201,13 +201,13 @@ export async function authenticateUserWithEmailAndPassword({
   });
 
   // check for password match
-  const isValid = await verifyPasswordHash(
-    userAccount?.password ?? '',
-    password,
-  );
+  const isValid = await verifyPasswordHash(userAccount?.password, password);
   if (!isValid || !userAccount) {
     // Track failed attempt
-    await getLoginConsecutiveFailsLimiter().consume(emailIpKey);
+    await Promise.all([
+      getLoginIpLimiter().consume(clientIp),
+      getLoginConsecutiveFailsLimiter().consume(emailIpKey),
+    ]);
     throw new BadRequestError(
       'Invalid email or password',
       'invalid-credentials',
@@ -263,7 +263,7 @@ export async function changeUserPassword({
 
   // Verify current password
   const isValid = await verifyPasswordHash(
-    userAccount?.password ?? '',
+    userAccount?.password,
     currentPassword,
   );
   if (!isValid || !userAccount) {

package/dist/local-auth/core/generators/auth-module/auth-module.generator.d.ts

@@ -50,7 +50,8 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             };
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
         }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
@@ -79,6 +80,7 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
         }>>;
         queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             bindQueueHandler: {};
+            DEFAULT_QUEUE_CONCURRENCY: {};
             defineQueue: {};
             EnqueueOptions: {
                 isTypeOnly: true;
@@ -104,6 +106,12 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             QueueJobHandler: {
                 isTypeOnly: true;
             };
+            QueuePolicyFixPlan: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixResult: {
+                isTypeOnly: true;
+            };
             QueueRuntime: {
                 isTypeOnly: true;
             };
@@ -160,7 +168,7 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
     }, any>;
     appRuntimeConfig: import("@baseplate-dev/sync").GeneratorTask<any, {
         appRuntimeConfig: import("@baseplate-dev/sync").ProviderType<Omit<import("@baseplate-dev/utils").FieldMap<{
-            services: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/core-generators").TsCodeFragment>;
+            services: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/fastify-generators").AppRuntimeServiceEntry>;
             construction: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/fastify-generators").AppRuntimeConstructionEntry>;
             flattenedModuleFields: import("@baseplate-dev/utils").MapContainer<string, string>;
             usesBackgroundServices: import("@baseplate-dev/utils").ScalarContainer<boolean | undefined>;

package/dist/local-auth/core/generators/auth-module/auth-module.generator.js

@@ -102,7 +102,9 @@ export const authModuleGenerator = createGenerator({
                 paths: GENERATED_TEMPLATES.paths.provider,
             },
             run({ appRuntimeConfig, paths }) {
-                appRuntimeConfig.services.set('userSession', tsCodeFragment('CookieUserSessionService', tsTypeImportBuilder(['CookieUserSessionService']).from(paths.userSessionService)));
+                appRuntimeConfig.services.set('userSession', {
+                    type: tsCodeFragment('CookieUserSessionService', tsTypeImportBuilder(['CookieUserSessionService']).from(paths.userSessionService)),
+                });
                 appRuntimeConfig.construction.set('userSession', {
                     fragment: TsCodeUtils.template `new ${TsCodeUtils.importFragment('CookieUserSessionService', paths.userSessionService)}()`,
                 });

package/dist/local-auth/core/generators/auth-module/generated/index.d.ts

@@ -54,7 +54,8 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 };
             }>>;
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                config: {};
+                getConfig: {};
+                isDevelopment: {};
             }>>;
             errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 BadRequestError: {};
@@ -83,6 +84,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
             }>>;
             queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 bindQueueHandler: {};
+                DEFAULT_QUEUE_CONCURRENCY: {};
                 defineQueue: {};
                 EnqueueOptions: {
                     isTypeOnly: true;
@@ -108,6 +110,12 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 QueueJobHandler: {
                     isTypeOnly: true;
                 };
+                QueuePolicyFixPlan: {
+                    isTypeOnly: true;
+                };
+                QueuePolicyFixResult: {
+                    isTypeOnly: true;
+                };
                 QueueRuntime: {
                     isTypeOnly: true;
                 };
@@ -243,6 +251,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
         queuesCleanupAuthVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
             queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 bindQueueHandler: {};
+                DEFAULT_QUEUE_CONCURRENCY: {};
                 defineQueue: {};
                 EnqueueOptions: {
                     isTypeOnly: true;
@@ -268,6 +277,12 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 QueueJobHandler: {
                     isTypeOnly: true;
                 };
+                QueuePolicyFixPlan: {
+                    isTypeOnly: true;
+                };
+                QueuePolicyFixResult: {
+                    isTypeOnly: true;
+                };
                 QueueRuntime: {
                     isTypeOnly: true;
                 };
@@ -291,6 +306,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
         queuesCleanupAuthVerificationWorker: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
             queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 bindQueueHandler: {};
+                DEFAULT_QUEUE_CONCURRENCY: {};
                 defineQueue: {};
                 EnqueueOptions: {
                     isTypeOnly: true;
@@ -316,6 +332,12 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 QueueJobHandler: {
                     isTypeOnly: true;
                 };
+                QueuePolicyFixPlan: {
+                    isTypeOnly: true;
+                };
+                QueuePolicyFixResult: {
+                    isTypeOnly: true;
+                };
                 QueueRuntime: {
                     isTypeOnly: true;
                 };
@@ -380,7 +402,8 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 };
             }>>;
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                config: {};
+                getConfig: {};
+                isDevelopment: {};
             }>>;
             errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 BadRequestError: {};
@@ -424,7 +447,8 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
             cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
             sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
                 configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                    config: {};
+                    getConfig: {};
+                    isDevelopment: {};
                 }>>;
             }, Record<never, Record<never, never>>>;
             verifyRequestOrigin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;

package/dist/local-auth/core/generators/auth-module/generated/template-renderers.d.ts

@@ -56,7 +56,8 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_RENDERERS: {
             };
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
         }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
@@ -85,6 +86,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_RENDERERS: {
         }>>;
         queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             bindQueueHandler: {};
+            DEFAULT_QUEUE_CONCURRENCY: {};
             defineQueue: {};
             EnqueueOptions: {
                 isTypeOnly: true;
@@ -110,6 +112,12 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_RENDERERS: {
             QueueJobHandler: {
                 isTypeOnly: true;
             };
+            QueuePolicyFixPlan: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixResult: {
+                isTypeOnly: true;
+            };
             QueueRuntime: {
                 isTypeOnly: true;
             };

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.d.ts

@@ -94,7 +94,8 @@ export declare const utilsGroup: {
     cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
     sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
         }>>;
     }, Record<never, Record<never, never>>>;
     verifyRequestOrigin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
@@ -195,6 +196,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
     queuesCleanupAuthVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
         queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             bindQueueHandler: {};
+            DEFAULT_QUEUE_CONCURRENCY: {};
             defineQueue: {};
             EnqueueOptions: {
                 isTypeOnly: true;
@@ -220,6 +222,12 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             QueueJobHandler: {
                 isTypeOnly: true;
             };
+            QueuePolicyFixPlan: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixResult: {
+                isTypeOnly: true;
+            };
             QueueRuntime: {
                 isTypeOnly: true;
             };
@@ -243,6 +251,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
     queuesCleanupAuthVerificationWorker: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
         queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             bindQueueHandler: {};
+            DEFAULT_QUEUE_CONCURRENCY: {};
             defineQueue: {};
             EnqueueOptions: {
                 isTypeOnly: true;
@@ -268,6 +277,12 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             QueueJobHandler: {
                 isTypeOnly: true;
             };
+            QueuePolicyFixPlan: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixResult: {
+                isTypeOnly: true;
+            };
             QueueRuntime: {
                 isTypeOnly: true;
             };
@@ -332,7 +347,8 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             };
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
         }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
@@ -376,7 +392,8 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
         cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
         sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                config: {};
+                getConfig: {};
+                isDevelopment: {};
             }>>;
         }, Record<never, Record<never, never>>>;
         verifyRequestOrigin: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.js

@@ -5,17 +5,19 @@ import { USER_SESSION_DURATION_SEC, USER_SESSION_MAX_LIFETIME_SEC, USER_SESSION_
 import { verifyRequestOrigin } from '$verifyRequestOrigin';
 import { InvalidSessionError } from '%authContextImports';
 import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { config } from '%configServiceImports';
+import { getConfig, isDevelopment } from '%configServiceImports';
 import { ForbiddenError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { randomBytes } from 'node:crypto';
-const COOKIE_OPTIONS = {
-    httpOnly: true,
-    sameSite: 'lax',
-    secure: config.APP_ENVIRONMENT !== 'dev',
-    maxAge: USER_SESSION_DURATION_SEC,
-    path: '/',
-};
+function getCookieOptions() {
+    return {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: !isDevelopment(),
+        maxAge: USER_SESSION_DURATION_SEC,
+        path: '/',
+    };
+}
 /**
  * Validates the expiry of a user session and determines if it needs to be renewed.
  *
@@ -83,8 +85,8 @@ export class CookieUserSessionService {
             ...user.roles.map((role) => role.role),
         ];
         const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-        const cookieValue = signObject({ token }, config.AUTH_SECRET);
-        context.cookieStore.set(cookieName, cookieValue, COOKIE_OPTIONS);
+        const cookieValue = signObject({ token }, getConfig().AUTH_SECRET);
+        context.cookieStore.set(cookieName, cookieValue, getCookieOptions());
         return { userId, expiresAt, roles };
     }
     /**
@@ -98,7 +100,7 @@ export class CookieUserSessionService {
             where: { id: sessionInfo.id },
         });
         const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-        context.cookieStore.clear(cookieName, COOKIE_OPTIONS);
+        context.cookieStore.clear(cookieName, getCookieOptions());
     }
     /**
      * Retrieves the user session information from the request.
@@ -120,12 +122,12 @@ export class CookieUserSessionService {
         if ((req.method !== 'GET' ||
             req.headers.upgrade?.toLowerCase() === 'websocket') &&
             req.method !== 'HEAD' &&
-            !verifyRequestOrigin(req, [req.host, ...config.ALLOWED_ORIGINS])) {
+            !verifyRequestOrigin(req, [req.host, ...getConfig().ALLOWED_ORIGINS])) {
             throw new ForbiddenError('Invalid Origin header');
         }
         try {
             // Unsign the session cookie
-            const sessionCookieResult = unsignObject(sessionCookieValue, config.AUTH_SECRET);
+            const sessionCookieResult = unsignObject(sessionCookieValue, getConfig().AUTH_SECRET);
             if (!sessionCookieResult)
                 throw new InvalidSessionError();
             const { token } = sessionCookieResult;
@@ -150,8 +152,8 @@ export class CookieUserSessionService {
                         expiresAt: sessionExpiryResult.newExpiry,
                     },
                 });
-                const newSignedCookie = signObject({ token }, config.AUTH_SECRET);
-                reply.setCookie(cookieName, newSignedCookie, COOKIE_OPTIONS);
+                const newSignedCookie = signObject({ token }, getConfig().AUTH_SECRET);
+                reply.setCookie(cookieName, newSignedCookie, getCookieOptions());
             }
             const { user } = userSession;
             const expiresAt = sessionExpiryResult.newExpiry ?? userSession.expiresAt;
@@ -169,7 +171,7 @@ export class CookieUserSessionService {
         catch (err) {
             // clear the cookie if it's invalid
             if (err instanceof InvalidSessionError && reply) {
-                reply.clearCookie(cookieName, COOKIE_OPTIONS);
+                reply.clearCookie(cookieName, getCookieOptions());
             }
             throw err;
         }

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.ts

@@ -20,7 +20,7 @@ import {
 import { verifyRequestOrigin } from '$verifyRequestOrigin';
 import { InvalidSessionError } from '%authContextImports';
 import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { config } from '%configServiceImports';
+import { getConfig, isDevelopment } from '%configServiceImports';
 import { ForbiddenError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { randomBytes } from 'node:crypto';
@@ -30,13 +30,15 @@ interface SessionCookieValue {
   token: string;
 }
 
-const COOKIE_OPTIONS: CookieSerializeOptions = {
-  httpOnly: true,
-  sameSite: 'lax',
-  secure: config.APP_ENVIRONMENT !== 'dev',
-  maxAge: USER_SESSION_DURATION_SEC,
-  path: '/',
-};
+function getCookieOptions(): CookieSerializeOptions {
+  return {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: !isDevelopment(),
+    maxAge: USER_SESSION_DURATION_SEC,
+    path: '/',
+  };
+}
 
 /**
  * Validates the expiry of a user session and determines if it needs to be renewed.
@@ -129,9 +131,9 @@ export class CookieUserSessionService implements UserSessionService {
     ];
 
     const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-    const cookieValue = signObject({ token }, config.AUTH_SECRET);
+    const cookieValue = signObject({ token }, getConfig().AUTH_SECRET);
 
-    context.cookieStore.set(cookieName, cookieValue, COOKIE_OPTIONS);
+    context.cookieStore.set(cookieName, cookieValue, getCookieOptions());
 
     return { userId, expiresAt, roles };
   }
@@ -151,7 +153,7 @@ export class CookieUserSessionService implements UserSessionService {
     });
 
     const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-    context.cookieStore.clear(cookieName, COOKIE_OPTIONS);
+    context.cookieStore.clear(cookieName, getCookieOptions());
   }
 
   /**
@@ -180,7 +182,7 @@ export class CookieUserSessionService implements UserSessionService {
       (req.method !== 'GET' ||
         req.headers.upgrade?.toLowerCase() === 'websocket') &&
       req.method !== 'HEAD' &&
-      !verifyRequestOrigin(req, [req.host, ...config.ALLOWED_ORIGINS])
+      !verifyRequestOrigin(req, [req.host, ...getConfig().ALLOWED_ORIGINS])
     ) {
       throw new ForbiddenError('Invalid Origin header');
     }
@@ -188,7 +190,7 @@ export class CookieUserSessionService implements UserSessionService {
       // Unsign the session cookie
       const sessionCookieResult = unsignObject(
         sessionCookieValue,
-        config.AUTH_SECRET,
+        getConfig().AUTH_SECRET,
       ) as SessionCookieValue | undefined;
       if (!sessionCookieResult) throw new InvalidSessionError();
 
@@ -218,8 +220,8 @@ export class CookieUserSessionService implements UserSessionService {
             expiresAt: sessionExpiryResult.newExpiry,
           },
         });
-        const newSignedCookie = signObject({ token }, config.AUTH_SECRET);
-        reply.setCookie(cookieName, newSignedCookie, COOKIE_OPTIONS);
+        const newSignedCookie = signObject({ token }, getConfig().AUTH_SECRET);
+        reply.setCookie(cookieName, newSignedCookie, getCookieOptions());
       }
 
       const { user } = userSession;
@@ -238,7 +240,7 @@ export class CookieUserSessionService implements UserSessionService {
     } catch (err) {
       // clear the cookie if it's invalid
       if (err instanceof InvalidSessionError && reply) {
-        reply.clearCookie(cookieName, COOKIE_OPTIONS);
+        reply.clearCookie(cookieName, getCookieOptions());
       }
       throw err;
     }

package/dist/local-auth/core/generators/auth-module/templates/module/utils/session-cookie.js

@@ -1,5 +1,5 @@
 // @ts-nocheck
-import { config } from '%configServiceImports';
+import { getConfig, isDevelopment } from '%configServiceImports';
 const COOKIE_NAME = 'user-session';
 /**
  * Retrieves the name of the session cookie based on the provided request.
@@ -10,9 +10,10 @@ const COOKIE_NAME = 'user-session';
  * @returns The name of the Iron session cookie.
  */
 export function getUserSessionCookieName(headers) {
-    if (config.APP_ENVIRONMENT !== 'dev') {
+    if (!isDevelopment()) {
         return `__Host-${COOKIE_NAME}`;
     }
+    const { SERVER_PORT } = getConfig();
     // in development, localhost does not support the __Host prefix and should be scoped to port
     // use origin/referer header to determine hostname because dev reverse proxies use origin/referer to signal the original host
     const { origin, referer } = headers;
@@ -20,18 +21,17 @@ export function getUserSessionCookieName(headers) {
     let port;
     try {
         if (!originalHost) {
-            port = config.SERVER_PORT;
+            port = SERVER_PORT;
         }
         else {
             const url = new URL(originalHost);
             const parsedPort = Number.parseInt(url.port, 10);
             // Validate port is in valid range (1-65535)
-            port =
-                parsedPort > 0 && parsedPort < 65_536 ? parsedPort : config.SERVER_PORT;
+            port = parsedPort > 0 && parsedPort < 65_536 ? parsedPort : SERVER_PORT;
         }
     }
     catch {
-        port = config.SERVER_PORT;
+        port = SERVER_PORT;
     }
     return `${COOKIE_NAME}-${port}`;
 }

package/dist/local-auth/core/generators/auth-module/templates/module/utils/session-cookie.ts

@@ -2,7 +2,7 @@
 
 import type { FastifyRequest } from 'fastify';
 
-import { config } from '%configServiceImports';
+import { getConfig, isDevelopment } from '%configServiceImports';
 
 const COOKIE_NAME = 'user-session';
 
@@ -17,9 +17,10 @@ const COOKIE_NAME = 'user-session';
 export function getUserSessionCookieName(
   headers: FastifyRequest['headers'],
 ): string {
-  if (config.APP_ENVIRONMENT !== 'dev') {
+  if (!isDevelopment()) {
     return `__Host-${COOKIE_NAME}`;
   }
+  const { SERVER_PORT } = getConfig();
   // in development, localhost does not support the __Host prefix and should be scoped to port
   // use origin/referer header to determine hostname because dev reverse proxies use origin/referer to signal the original host
   const { origin, referer } = headers;
@@ -27,16 +28,15 @@ export function getUserSessionCookieName(
   let port;
   try {
     if (!originalHost) {
-      port = config.SERVER_PORT;
+      port = SERVER_PORT;
     } else {
       const url = new URL(originalHost);
       const parsedPort = Number.parseInt(url.port, 10);
       // Validate port is in valid range (1-65535)
-      port =
-        parsedPort > 0 && parsedPort < 65_536 ? parsedPort : config.SERVER_PORT;
+      port = parsedPort > 0 && parsedPort < 65_536 ? parsedPort : SERVER_PORT;
     }
   } catch {
-    port = config.SERVER_PORT;
+    port = SERVER_PORT;
   }
   return `${COOKIE_NAME}-${port}`;
 }