@baseplate-dev/plugin-auth 0.6.16 → 0.6.18

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.d.ts

@@ -9,16 +9,20 @@ export declare const moduleGroup: {
     }>;
     schemaUserPasswordMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{
         TPL_ADMIN_ROLES: {};
+        TPL_REGISTER_MUTATION: {};
         TPL_USER_OBJECT_TYPE: {};
     }, {
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
             CookieUserSessionService: {};
             createAuthVerification: {};
+            createCodeVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
+            validateCodeVerification: {};
         }>>;
         pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             builder: {};
@@ -34,10 +38,13 @@ export declare const moduleGroup: {
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
             CookieUserSessionService: {};
             createAuthVerification: {};
+            createCodeVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
+            validateCodeVerification: {};
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             getConfig: {};
@@ -152,6 +159,7 @@ export declare const moduleGroup: {
     }>;
 };
 export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
+    constantsOtp: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
     moduleGroup: {
         constantsPassword: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
         schemaPasswordResetMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
@@ -163,16 +171,20 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
         }>;
         schemaUserPasswordMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{
             TPL_ADMIN_ROLES: {};
+            TPL_REGISTER_MUTATION: {};
             TPL_USER_OBJECT_TYPE: {};
         }, {
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
                 cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
                 CookieUserSessionService: {};
                 createAuthVerification: {};
+                createCodeVerification: {};
                 userSessionPayload: {};
                 validateAuthVerification: {};
+                validateCodeVerification: {};
             }>>;
             pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 builder: {};
@@ -188,10 +200,13 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
                 cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
                 CookieUserSessionService: {};
                 createAuthVerification: {};
+                createCodeVerification: {};
                 userSessionPayload: {};
                 validateAuthVerification: {};
+                validateCodeVerification: {};
             }>>;
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 getConfig: {};
@@ -305,6 +320,25 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             servicesEmailVerification: {};
         }>;
     };
+    schemaEmailOtpMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+        authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
+            cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
+            CookieUserSessionService: {};
+            createAuthVerification: {};
+            createCodeVerification: {};
+            userSessionPayload: {};
+            validateAuthVerification: {};
+            validateCodeVerification: {};
+        }>>;
+        pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            builder: {};
+        }>>;
+    }, {
+        servicesEmailOtp: {};
+    }>;
     schemaEmailVerificationMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
         pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             builder: {};
@@ -312,6 +346,97 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
     }, {
         servicesEmailVerification: {};
     }>;
+    schemaInviteMutations: import("@baseplate-dev/core-generators").TsTemplateFile<{
+        TPL_ADMIN_ROLES: {};
+        TPL_USER_OBJECT_TYPE: {};
+    }, {
+        authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
+            cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
+            CookieUserSessionService: {};
+            createAuthVerification: {};
+            createCodeVerification: {};
+            userSessionPayload: {};
+            validateAuthVerification: {};
+            validateCodeVerification: {};
+        }>>;
+        pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            builder: {};
+        }>>;
+    }, {
+        servicesInvite: {};
+    }>;
+    servicesEmailOtp: import("@baseplate-dev/core-generators").TsTemplateFile<{
+        TPL_EMAIL_OTP_EMAIL: {};
+        TPL_NAME_REQUIRED_CHECK: {};
+    }, {
+        authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
+            cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
+            CookieUserSessionService: {};
+            createAuthVerification: {};
+            createCodeVerification: {};
+            userSessionPayload: {};
+            validateAuthVerification: {};
+            validateCodeVerification: {};
+        }>>;
+        configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getConfig: {};
+            isDevelopment: {};
+        }>>;
+        errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            BadRequestError: {};
+            ForbiddenError: {};
+            handleZodRequestValidationError: {};
+            HttpError: {};
+            InternalServerError: {};
+            logError: {};
+            NotFoundError: {};
+            throwIfPrismaNotFound: {};
+            TooManyRequestsError: {};
+            UnauthorizedError: {};
+        }>>;
+        prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            prisma: {};
+        }>>;
+        rateLimitImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createRateLimiter: {};
+            memoizeRateLimiter: {};
+            RateLimiter: {
+                isTypeOnly: true;
+            };
+            RateLimiterConfig: {
+                isTypeOnly: true;
+            };
+            RateLimitResult: {
+                isTypeOnly: true;
+            };
+        }>>;
+        requestServiceContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createContextFromRequest: {};
+            RequestServiceContext: {
+                isTypeOnly: true;
+            };
+            RequestServiceContextWith: {
+                isTypeOnly: true;
+            };
+        }>>;
+        userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            UserSessionPayload: {
+                isTypeOnly: true;
+            };
+            UserSessionService: {
+                isTypeOnly: true;
+            };
+        }>>;
+    }, {
+        constantsOtp: {};
+        constantsPassword: {};
+    }>;
     servicesEmailVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{
         TPL_ACCOUNT_VERIFICATION_EMAIL: {};
     }, {
@@ -319,10 +444,13 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
             CookieUserSessionService: {};
             createAuthVerification: {};
+            createCodeVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
+            validateCodeVerification: {};
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             getConfig: {};
@@ -368,5 +496,69 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
     }, {
         constantsPassword: {};
     }>;
+    servicesInvite: import("@baseplate-dev/core-generators").TsTemplateFile<{
+        TPL_INVITE_EMAIL: {};
+    }, {
+        authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
+            cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
+            CookieUserSessionService: {};
+            createAuthVerification: {};
+            createCodeVerification: {};
+            userSessionPayload: {};
+            validateAuthVerification: {};
+            validateCodeVerification: {};
+        }>>;
+        configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getConfig: {};
+            isDevelopment: {};
+        }>>;
+        errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            BadRequestError: {};
+            ForbiddenError: {};
+            handleZodRequestValidationError: {};
+            HttpError: {};
+            InternalServerError: {};
+            logError: {};
+            NotFoundError: {};
+            throwIfPrismaNotFound: {};
+            TooManyRequestsError: {};
+            UnauthorizedError: {};
+        }>>;
+        passwordHasherServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createPasswordHash: {};
+            verifyPasswordHash: {};
+        }>>;
+        prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            PrismaClient: {};
+            Prisma: {};
+            '*': {};
+            $Enums: {};
+        }>>;
+        prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            prisma: {};
+        }>>;
+        requestServiceContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createContextFromRequest: {};
+            RequestServiceContext: {
+                isTypeOnly: true;
+            };
+            RequestServiceContextWith: {
+                isTypeOnly: true;
+            };
+        }>>;
+        userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            UserSessionPayload: {
+                isTypeOnly: true;
+            };
+            UserSessionService: {
+                isTypeOnly: true;
+            };
+        }>>;
+    }, {
+        constantsPassword: {};
+    }>;
 };
 //# sourceMappingURL=typed-templates.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.js

@@ -3,6 +3,15 @@ import { configServiceImportsProvider, errorHandlerServiceImportsProvider, passw
 import { rateLimitImportsProvider } from '@baseplate-dev/plugin-rate-limit';
 import path from 'node:path';
 import { authModuleImportsProvider } from '#src/local-auth/core/generators/auth-module/generated/ts-import-providers.js';
+const constantsOtp = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {},
+    name: 'constants-otp',
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/constants/otp.constants.ts'),
+    },
+    variables: {},
+});
 const constantsPassword = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     group: 'module',
@@ -41,7 +50,11 @@ const schemaUserPasswordMutations = createTsTemplateFile({
     source: {
         path: path.join(import.meta.dirname, '../templates/module/schema/user-password.mutations.ts'),
     },
-    variables: { TPL_ADMIN_ROLES: {}, TPL_USER_OBJECT_TYPE: {} },
+    variables: {
+        TPL_ADMIN_ROLES: {},
+        TPL_REGISTER_MUTATION: {},
+        TPL_USER_OBJECT_TYPE: {},
+    },
 });
 const servicesPasswordReset = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
@@ -105,6 +118,19 @@ export const moduleGroup = {
     servicesPasswordReset,
     servicesUserPassword,
 };
+const schemaEmailOtpMutations = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        authModuleImports: authModuleImportsProvider,
+        pothosImports: pothosImportsProvider,
+    },
+    name: 'schema-email-otp-mutations',
+    referencedGeneratorTemplates: { servicesEmailOtp: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/schema/email-otp.mutations.ts'),
+    },
+    variables: {},
+});
 const schemaEmailVerificationMutations = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: { pothosImports: pothosImportsProvider },
@@ -115,6 +141,37 @@ const schemaEmailVerificationMutations = createTsTemplateFile({
     },
     variables: {},
 });
+const schemaInviteMutations = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        authModuleImports: authModuleImportsProvider,
+        pothosImports: pothosImportsProvider,
+    },
+    name: 'schema-invite-mutations',
+    referencedGeneratorTemplates: { servicesInvite: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/schema/invite.mutations.ts'),
+    },
+    variables: { TPL_ADMIN_ROLES: {}, TPL_USER_OBJECT_TYPE: {} },
+});
+const servicesEmailOtp = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        authModuleImports: authModuleImportsProvider,
+        configServiceImports: configServiceImportsProvider,
+        errorHandlerServiceImports: errorHandlerServiceImportsProvider,
+        prismaImports: prismaImportsProvider,
+        rateLimitImports: rateLimitImportsProvider,
+        requestServiceContextImports: requestServiceContextImportsProvider,
+        userSessionTypesImports: userSessionTypesImportsProvider,
+    },
+    name: 'services-email-otp',
+    referencedGeneratorTemplates: { constantsOtp: {}, constantsPassword: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/services/email-otp.service.ts'),
+    },
+    variables: { TPL_EMAIL_OTP_EMAIL: {}, TPL_NAME_REQUIRED_CHECK: {} },
+});
 const servicesEmailVerification = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
@@ -132,9 +189,33 @@ const servicesEmailVerification = createTsTemplateFile({
     },
     variables: { TPL_ACCOUNT_VERIFICATION_EMAIL: {} },
 });
+const servicesInvite = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        authModuleImports: authModuleImportsProvider,
+        configServiceImports: configServiceImportsProvider,
+        errorHandlerServiceImports: errorHandlerServiceImportsProvider,
+        passwordHasherServiceImports: passwordHasherServiceImportsProvider,
+        prismaGeneratedImports: prismaGeneratedImportsProvider,
+        prismaImports: prismaImportsProvider,
+        requestServiceContextImports: requestServiceContextImportsProvider,
+        userSessionTypesImports: userSessionTypesImportsProvider,
+    },
+    name: 'services-invite',
+    referencedGeneratorTemplates: { constantsPassword: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/services/invite.service.ts'),
+    },
+    variables: { TPL_INVITE_EMAIL: {} },
+});
 export const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES = {
+    constantsOtp,
     moduleGroup,
+    schemaEmailOtpMutations,
     schemaEmailVerificationMutations,
+    schemaInviteMutations,
+    servicesEmailOtp,
     servicesEmailVerification,
+    servicesInvite,
 };
 //# sourceMappingURL=typed-templates.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/otp.constants.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Number of digits in an emailed sign-in code.
+ *
+ * Six is the length users expect from a one-time code. At this length the
+ * keyspace alone is not much of a barrier, so what keeps guessing impractical
+ * is the attempt budget below, the endpoint rate limits, and the short expiry.
+ */
+export declare const EMAIL_OTP_LENGTH = 6;
+/**
+ * Emailed sign-in code expiration time in seconds (10 minutes)
+ */
+export declare const EMAIL_OTP_EXPIRY_SEC: number;
+/**
+ * Maximum number of guesses allowed per emailed sign-in code before it is
+ * discarded. A short numeric code needs its own attempt budget on top of the
+ * endpoint rate limits.
+ */
+export declare const EMAIL_OTP_MAX_ATTEMPTS = 5;
+//# sourceMappingURL=otp.constants.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/otp.constants.js

@@ -0,0 +1,20 @@
+// @ts-nocheck
+/**
+ * Number of digits in an emailed sign-in code.
+ *
+ * Six is the length users expect from a one-time code. At this length the
+ * keyspace alone is not much of a barrier, so what keeps guessing impractical
+ * is the attempt budget below, the endpoint rate limits, and the short expiry.
+ */
+export const EMAIL_OTP_LENGTH = 6;
+/**
+ * Emailed sign-in code expiration time in seconds (10 minutes)
+ */
+export const EMAIL_OTP_EXPIRY_SEC = 60 * 10;
+/**
+ * Maximum number of guesses allowed per emailed sign-in code before it is
+ * discarded. A short numeric code needs its own attempt budget on top of the
+ * endpoint rate limits.
+ */
+export const EMAIL_OTP_MAX_ATTEMPTS = 5;
+//# sourceMappingURL=otp.constants.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/otp.constants.ts

@@ -0,0 +1,22 @@
+// @ts-nocheck
+
+/**
+ * Number of digits in an emailed sign-in code.
+ *
+ * Six is the length users expect from a one-time code. At this length the
+ * keyspace alone is not much of a barrier, so what keeps guessing impractical
+ * is the attempt budget below, the endpoint rate limits, and the short expiry.
+ */
+export const EMAIL_OTP_LENGTH = 6;
+
+/**
+ * Emailed sign-in code expiration time in seconds (10 minutes)
+ */
+export const EMAIL_OTP_EXPIRY_SEC = 60 * 10;
+
+/**
+ * Maximum number of guesses allowed per emailed sign-in code before it is
+ * discarded. A short numeric code needs its own attempt budget on top of the
+ * endpoint rate limits.
+ */
+export const EMAIL_OTP_MAX_ATTEMPTS = 5;

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.d.ts

@@ -14,4 +14,16 @@ export declare const PASSWORD_RESET_TOKEN_EXPIRY_SEC: number;
  * Email verification token expiration time in seconds (24 hours)
  */
 export declare const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC: number;
+/**
+ * Invite token expiration time in seconds (7 days, since invites are
+ * admin-initiated and not tied to a login attempt in progress)
+ */
+export declare const INVITE_TOKEN_EXPIRY_SEC: number;
+/**
+ * Safety upper bound on auth verification token length (password reset,
+ * invite, etc.), generous relative to the actual token format produced by
+ * `generateSplitToken` in `auth-verification.service.ts` so validation
+ * doesn't need to track that format exactly.
+ */
+export declare const AUTH_TOKEN_MAX_LENGTH = 100;
 //# sourceMappingURL=password.constants.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.js

@@ -15,4 +15,16 @@ export const PASSWORD_RESET_TOKEN_EXPIRY_SEC = 60 * 60;
  * Email verification token expiration time in seconds (24 hours)
  */
 export const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC = 60 * 60 * 24;
+/**
+ * Invite token expiration time in seconds (7 days, since invites are
+ * admin-initiated and not tied to a login attempt in progress)
+ */
+export const INVITE_TOKEN_EXPIRY_SEC = 60 * 60 * 24 * 7;
+/**
+ * Safety upper bound on auth verification token length (password reset,
+ * invite, etc.), generous relative to the actual token format produced by
+ * `generateSplitToken` in `auth-verification.service.ts` so validation
+ * doesn't need to track that format exactly.
+ */
+export const AUTH_TOKEN_MAX_LENGTH = 100;
 //# sourceMappingURL=password.constants.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts

@@ -19,3 +19,17 @@ export const PASSWORD_RESET_TOKEN_EXPIRY_SEC = 60 * 60;
  * Email verification token expiration time in seconds (24 hours)
  */
 export const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC = 60 * 60 * 24;
+
+/**
+ * Invite token expiration time in seconds (7 days, since invites are
+ * admin-initiated and not tied to a login attempt in progress)
+ */
+export const INVITE_TOKEN_EXPIRY_SEC = 60 * 60 * 24 * 7;
+
+/**
+ * Safety upper bound on auth verification token length (password reset,
+ * invite, etc.), generous relative to the actual token format produced by
+ * `generateSplitToken` in `auth-verification.service.ts` so validation
+ * doesn't need to track that format exactly.
+ */
+export const AUTH_TOKEN_MAX_LENGTH = 100;

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-otp.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=email-otp.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-otp.mutations.js

@@ -0,0 +1,30 @@
+// @ts-nocheck
+import { requestEmailOtp, signInWithEmailOtp } from '$servicesEmailOtp';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+builder.mutationField('requestEmailOtp', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        email: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) => requestEmailOtp({ email: input.email, context }),
+}));
+builder.mutationField('signInWithEmailOtp', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+        email: t.input.field({ required: true, type: 'String' }),
+        code: t.input.field({ required: true, type: 'String' }),
+        name: t.input.field({ required: false, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) => signInWithEmailOtp({
+        input: { ...input, name: input.name ?? undefined },
+        context,
+    }),
+}));
+//# sourceMappingURL=email-otp.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-otp.mutations.ts

@@ -0,0 +1,38 @@
+// @ts-nocheck
+
+import { requestEmailOtp, signInWithEmailOtp } from '$servicesEmailOtp';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+
+builder.mutationField('requestEmailOtp', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) =>
+      requestEmailOtp({ email: input.email, context }),
+  }),
+);
+
+builder.mutationField('signInWithEmailOtp', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+      code: t.input.field({ required: true, type: 'String' }),
+      name: t.input.field({ required: false, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) =>
+      signInWithEmailOtp({
+        input: { ...input, name: input.name ?? undefined },
+        context,
+      }),
+  }),
+);

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/invite.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=invite.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/invite.mutations.js

@@ -0,0 +1,42 @@
+// @ts-nocheck
+import { acceptInvite, inviteUser, validateInviteToken } from '$servicesInvite';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+builder.mutationField('inviteUser', (t) => t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+        user: t.payload.field({
+            type: TPL_USER_OBJECT_TYPE,
+        }),
+    },
+    input: {
+        userId: t.input.field({ required: true, type: 'Uuid' }),
+    },
+    resolve: async (_root, { input }, context) => inviteUser({ userId: input.userId, context }),
+}));
+builder.mutationField('validateInviteToken', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        email: t.payload.field({ type: 'String' }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) => validateInviteToken({ token: input.token }),
+}));
+builder.mutationField('acceptInvite', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+        newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) => acceptInvite({
+        token: input.token,
+        newPassword: input.newPassword,
+        context,
+    }),
+}));
+//# sourceMappingURL=invite.mutations.js.map