@baseplate-dev/plugin-auth 0.6.17 → 0.6.18

package/dist/local-auth/core/node.js

@@ -1,6 +1,6 @@
 import { appModuleGenerator, passwordHasherServiceGenerator, } from '@baseplate-dev/fastify-generators';
 import { emailTemplateSpec } from '@baseplate-dev/plugin-email';
-import { appCompilerSpec, backendAppEntryType, createPluginModule, PluginUtils, webAppEntryType, } from '@baseplate-dev/project-builder-lib';
+import { appCompilerSpec, backendAppEntryType, createPluginModule, pluginAppCompiler, PluginUtils, webAppEntryType, } from '@baseplate-dev/project-builder-lib';
 import { getAuthPluginDefinition } from '#src/auth/index.js';
 import { authApolloGenerator } from './generators/auth-apollo/auth-apollo.generator.js';
 import { authEmailPasswordGenerator } from './generators/auth-email-password/auth-email-password.generator.js';
@@ -9,6 +9,7 @@ import { authHooksGenerator } from './generators/auth-hooks/auth-hooks.generator
 import { authRoutesGenerator } from './generators/auth-routes/auth-routes.generator.js';
 import { authModuleGenerator, reactAuthGenerator, seedInitialUserGenerator, } from './generators/index.js';
 import { reactSessionGenerator } from './generators/react-session/react-session.generator.js';
+import { getLocalAuthWebAppData } from './schema/web-app-schema.js';
 export default createPluginModule({
     name: 'node',
     dependencies: {
@@ -16,8 +17,12 @@ export default createPluginModule({
         emailTemplate: emailTemplateSpec,
     },
     initialize: ({ appCompiler, emailTemplate }, { pluginKey }) => {
-        // Register auth email templates with the transactional lib
-        emailTemplate.generators.push(authEmailTemplatesGenerator({}));
+        // Register auth email templates with the transactional lib. Resolved lazily
+        // so the sign-in code email is only emitted when that flow is enabled.
+        emailTemplate.generators.push(({ projectDefinition }) => {
+            const { emailOtp } = PluginUtils.configByKeyOrThrow(projectDefinition, pluginKey);
+            return authEmailTemplatesGenerator({ emailOtp });
+        });
         // register backend compiler
         appCompiler.compilers.push({
             pluginKey,
@@ -30,6 +35,12 @@ export default createPluginModule({
                 const devWebPorts = webApps.map((app) => app.devPort);
                 const devWebDomainPort = devWebPorts[0] ??
                     projectDefinition.settings.general.portOffset + 30;
+                // The register mutation is shared by every web app on this
+                // backend, so it can only be dropped once none of them allow
+                // self-service registration.
+                const disableRegistration = webApps.length > 0 &&
+                    webApps.every((app) => getLocalAuthWebAppData(app, pluginKey)?.disableRegistration ??
+                        false);
                 const additionalAdminRoles = localAuthDefinition.additionalUserAdminRoles.map((role) => definitionContainer.nameFromId(role));
                 // 'admin' is always included since it is now a built-in role guaranteed to exist
                 const adminRoles = [...new Set(['admin', ...additionalAdminRoles])];
@@ -40,6 +51,7 @@ export default createPluginModule({
                     authModule: authModuleGenerator({
                         userAdminRoles: adminRoles,
                         devWebPorts,
+                        emailOtp: localAuthDefinition.emailOtp,
                     }),
                     emailPassword: appModuleGenerator({
                         id: 'email-password',
@@ -49,17 +61,21 @@ export default createPluginModule({
                                 adminRoles,
                                 devWebDomainPort,
                                 requireNameOnRegistration: localAuthDefinition.requireNameOnRegistration,
+                                emailOtp: localAuthDefinition.emailOtp,
+                                disableRegistration,
                             }),
                             hasher: passwordHasherServiceGenerator({}),
                         },
                     }),
                 });
             },
-        }, {
+        }, pluginAppCompiler({
             pluginKey,
             appType: webAppEntryType,
-            compile: ({ projectDefinition, appCompiler }) => {
+            compile: ({ projectDefinition, appDefinition, appCompiler }) => {
                 const localAuthDefinition = PluginUtils.configByKeyOrThrow(projectDefinition, pluginKey);
+                const disableRegistration = getLocalAuthWebAppData(appDefinition, pluginKey)
+                    ?.disableRegistration ?? false;
                 appCompiler.addRootChildren({
                     authApollo: authApolloGenerator({}),
                     reactAuth: reactAuthGenerator({}),
@@ -67,10 +83,12 @@ export default createPluginModule({
                     reactSession: reactSessionGenerator({}),
                     authRoutes: authRoutesGenerator({
                         requireNameOnRegistration: localAuthDefinition.requireNameOnRegistration,
+                        emailOtp: localAuthDefinition.emailOtp,
+                        disableRegistration,
                     }),
                 });
             },
-        });
+        }));
     },
 });
 //# sourceMappingURL=node.js.map

package/dist/local-auth/core/schema/migrations.d.ts

@@ -0,0 +1,3 @@
+import type { PluginConfigMigration } from '@baseplate-dev/project-builder-lib';
+export declare const LOCAL_AUTH_PLUGIN_CONFIG_MIGRATIONS: PluginConfigMigration[];
+//# sourceMappingURL=migrations.d.ts.map

package/dist/local-auth/core/schema/migrations.js

@@ -0,0 +1,36 @@
+import { modelScalarFieldEntityType } from '@baseplate-dev/project-builder-lib';
+import { LOCAL_AUTH_MODELS } from '#src/local-auth/constants/model-names.js';
+export const LOCAL_AUTH_PLUGIN_CONFIG_MIGRATIONS = [
+    {
+        name: 'add-auth-verification-attempts',
+        version: 1,
+        // Emailed sign-in codes count failed guesses in a column so the counter can
+        // be incremented in the database. The field is added for every project, not
+        // just those with the flow enabled, because migrations run on a version
+        // bump rather than when the setting is toggled — gating it here would break
+        // anyone who turns the flow on later.
+        migrate: () => ({
+            updateProjectDefinition: (draft) => {
+                const draftDef = draft;
+                const authVerification = draftDef.models?.find((model) => model.name === LOCAL_AUTH_MODELS.authVerification);
+                const fields = authVerification?.model?.fields;
+                // Projects created after this change are seeded with the field already.
+                if (!fields || fields.some((field) => field.name === 'attempts')) {
+                    return;
+                }
+                // Ahead of expiresAt/createdAt, matching the seeded field order so a
+                // migrated definition and a fresh one produce the same schema.
+                const timestampIndex = fields.findIndex((field) => field.name === 'expiresAt');
+                const insertAt = timestampIndex === -1 ? fields.length : timestampIndex;
+                fields.splice(insertAt, 0, {
+                    id: modelScalarFieldEntityType.generateNewId(),
+                    name: 'attempts',
+                    type: 'int',
+                    isOptional: false,
+                    options: { default: '0' },
+                });
+            },
+        }),
+    },
+];
+//# sourceMappingURL=migrations.js.map

package/dist/local-auth/core/schema/models.js

@@ -247,6 +247,14 @@ export function createLocalAuthPartialDefinition(authFeatureName, accountsFeatur
                             type: 'json',
                             isOptional: true,
                         },
+                        // Failed guesses against a short code. Only the emailed-code flow
+                        // uses this; split-token rows leave it at 0, since their verifier
+                        // is random enough that a single miss deletes the record outright.
+                        {
+                            name: 'attempts',
+                            type: 'int',
+                            options: { default: '0' },
+                        },
                         {
                             name: 'expiresAt',
                             type: 'dateTime',

package/dist/local-auth/core/schema/plugin-definition.d.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 export declare const createLocalAuthPluginDefinitionSchema: (context: import("@baseplate-dev/project-builder-lib").DefinitionSchemaParserContext) => z.ZodObject<{
     additionalUserAdminRoles: z.ZodPrefault<z.ZodArray<z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
     requireNameOnRegistration: z.ZodDefault<z.ZodBoolean>;
+    emailOtp: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type LocalAuthPluginDefinition = def.InferOutput<typeof createLocalAuthPluginDefinitionSchema>;
 export type LocalAuthPluginDefinitionInput = def.InferInput<typeof createLocalAuthPluginDefinitionSchema>;

package/dist/local-auth/core/schema/plugin-definition.js

@@ -6,5 +6,6 @@ export const createLocalAuthPluginDefinitionSchema = definitionSchema((ctx) => z
         onDelete: 'DELETE',
     })), []),
     requireNameOnRegistration: z.boolean().default(false),
+    emailOtp: z.boolean().default(false),
 }));
 //# sourceMappingURL=plugin-definition.js.map

package/dist/local-auth/core/schema/web-app-schema.d.ts

@@ -0,0 +1,15 @@
+import type { def, WebAppConfigWithPluginData } from '@baseplate-dev/project-builder-lib';
+import z from 'zod';
+/**
+ * Per-app local-auth settings contributed to the web app config via
+ * `webAppSchemaExtensionSpec`, stored under `pluginData[localAuthPluginKey]`.
+ */
+export declare const createLocalAuthWebAppSchema: (context: import("@baseplate-dev/project-builder-lib").DefinitionSchemaParserContext) => z.ZodObject<{
+    disableRegistration: z.ZodPrefault<z.ZodBoolean>;
+}, z.z.core.$strip>;
+export type LocalAuthWebAppData = def.InferOutput<typeof createLocalAuthWebAppSchema>;
+/**
+ * Reads the local-auth per-app settings slice from a web app config.
+ */
+export declare function getLocalAuthWebAppData(webApp: WebAppConfigWithPluginData, pluginKey: string): LocalAuthWebAppData | undefined;
+//# sourceMappingURL=web-app-schema.d.ts.map

package/dist/local-auth/core/schema/web-app-schema.js

@@ -0,0 +1,16 @@
+import { definitionSchema, getWebAppPluginData, } from '@baseplate-dev/project-builder-lib';
+import z from 'zod';
+/**
+ * Per-app local-auth settings contributed to the web app config via
+ * `webAppSchemaExtensionSpec`, stored under `pluginData[localAuthPluginKey]`.
+ */
+export const createLocalAuthWebAppSchema = definitionSchema((ctx) => z.object({
+    disableRegistration: ctx.withDefault(z.boolean(), false),
+}));
+/**
+ * Reads the local-auth per-app settings slice from a web app config.
+ */
+export function getLocalAuthWebAppData(webApp, pluginKey) {
+    return getWebAppPluginData(webApp, pluginKey);
+}
+//# sourceMappingURL=web-app-schema.js.map

package/dist/local-auth/core/web.js

@@ -1,5 +1,7 @@
 import { createPluginModule, FeatureUtils, pluginDefaultsSpec, webConfigSpec, } from '@baseplate-dev/project-builder-lib';
+import { createWebAppSettingsWebConfig, webAppSchemaExtensionWebSpec, } from '@baseplate-dev/project-builder-lib/web';
 import { LocalAuthDefinitionEditor } from './components/local-auth-definition-editor.js';
+import { LocalAuthWebAppSettingsForm } from './components/local-auth-web-app-settings-form.js';
 import { createLocalAuthPartialDefinition } from './schema/models.js';
 import '../../styles.css';
 const AUTH_FEATURE_NAME = 'accounts/auth';
@@ -9,9 +11,14 @@ export default createPluginModule({
     dependencies: {
         webConfig: webConfigSpec,
         pluginDefaults: pluginDefaultsSpec,
+        webAppSchemaExtensionWeb: webAppSchemaExtensionWebSpec,
     },
-    initialize: ({ webConfig, pluginDefaults }, { pluginKey }) => {
+    initialize: ({ webConfig, pluginDefaults, webAppSchemaExtensionWeb }, { pluginKey }) => {
         webConfig.components.set(pluginKey, LocalAuthDefinitionEditor);
+        webAppSchemaExtensionWeb.configs.set(pluginKey, createWebAppSettingsWebConfig({
+            pluginKey,
+            Form: LocalAuthWebAppSettingsForm,
+        }));
         pluginDefaults.builders.set(pluginKey, ({ draft }) => {
             // Idempotent with the parent auth builder, which also ensures these.
             FeatureUtils.ensureFeatureByNameRecursively(draft, AUTH_FEATURE_NAME);

package/dist/web/assets/{_virtual_mf-localSharedImportMap___mfe_internal__plugin_mf_2_auth-ChkXxpXe.js → _virtual_mf-localSharedImportMap___mfe_internal__plugin_mf_2_auth__mf_owner__1-CKKmnLep.js}

@@ -1,45 +1,46 @@
 import { t as __vitePreload } from "./vite-preload-helper-ARKYL6bp.js";
-import "./dist-CrLSslv6.js";
-//#region \0virtual:mf-localSharedImportMap:__mfe_internal__plugin_mf_2_auth
+import "./dist-DQd1TAJX.js";
+//#region \0virtual:mf-localSharedImportMap:__mfe_internal__plugin_mf_2_auth__mf_owner__1
 var importMap = {
-	"react/jsx-runtime": async () => {
-		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-DRSNXPPo.js").then((n) => n.et), [], import.meta.url);
-	},
 	"react": async () => {
-		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-DRSNXPPo.js").then((n) => (n.xt(), n.bt)), [], import.meta.url);
+		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__mf_owner__1__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-C2GDE8Py.js").then((n) => (n.bt(), n.yt)), [], import.meta.url);
+	},
+	"react/jsx-runtime": async () => {
+		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__mf_owner__1__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-C2GDE8Py.js").then((n) => n.$), [], import.meta.url);
 	},
 	"react-dom": async () => {
-		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-DRSNXPPo.js").then((n) => n.Y), [], import.meta.url);
+		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__mf_owner__1__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-C2GDE8Py.js").then((n) => n.J), [], import.meta.url);
 	},
 	"zod": async () => {
-		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare__zod__loadShare__.js-BEZ7A-cz.js").then((n) => n.r), [], import.meta.url);
+		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__mf_owner__1__loadShare___mf_0_baseplate_mf_2_dev_mf_1_project_mf_2_builder_mf_2_lib__loadShare__.js-Cx7TvZ_H.js").then((n) => n.I), [], import.meta.url);
 	},
 	"@baseplate-dev/ui-components": async () => {
-		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-DRSNXPPo.js").then((n) => n.F), [], import.meta.url);
+		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__mf_owner__1__loadShare___mf_0_baseplate_mf_2_dev_mf_1_ui_mf_2_components__loadShare__.js-C2GDE8Py.js").then((n) => n.F), [], import.meta.url);
 	},
 	"@baseplate-dev/project-builder-lib/web": async () => {
-		return await __vitePreload(() => import("./web-CXAHKjIY.js"), [], import.meta.url);
+		return await __vitePreload(() => import("./web-EDeSquSP.js"), [], import.meta.url);
 	},
 	"@baseplate-dev/project-builder-lib": async () => {
-		return await __vitePreload(() => import("./dist-DY7ZXvq4.js"), [], import.meta.url);
+		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__mf_owner__1__loadShare___mf_0_baseplate_mf_2_dev_mf_1_project_mf_2_builder_mf_2_lib__loadShare__.js-Cx7TvZ_H.js").then((n) => n.E), [], import.meta.url);
 	},
 	"@tanstack/react-router": async () => {
-		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__loadShare___mf_0_tanstack_mf_1_react_mf_2_router__loadShare__.js-DfiQqvVC.js").then((n) => n.r), [], import.meta.url);
+		return await __vitePreload(() => import("./_virtual_mf___mfe_internal__plugin_mf_2_auth__mf_owner__1__loadShare___mf_0_tanstack_mf_1_react_mf_2_router__loadShare__.js-CiccpWjh.js").then((n) => n.r), [], import.meta.url);
 	}
 };
 var usedShared = {
-	"react/jsx-runtime": {
-		name: "react/jsx-runtime",
+	"react": {
+		name: "react",
 		version: "19.2.8",
 		scope: ["default"],
 		loaded: false,
 		eager: false,
 		from: "plugin-auth",
+		canLiveRebind: true,
 		async get() {
-			usedShared["react/jsx-runtime"].loaded = true;
-			const { "react/jsx-runtime": pkgDynamicImport } = importMap;
+			usedShared["react"].loaded = true;
+			const { "react": pkgDynamicImport } = importMap;
 			const exportModule = { ...await pkgDynamicImport() };
-			Object.defineProperty(exportModule, "__esModule", {
+			if (exportModule.__esModule !== true) Object.defineProperty(exportModule, "__esModule", {
 				value: true,
 				enumerable: false
 			});
@@ -54,18 +55,19 @@ var usedShared = {
 			eager: false
 		}
 	},
-	"react": {
-		name: "react",
+	"react/jsx-runtime": {
+		name: "react/jsx-runtime",
 		version: "19.2.8",
 		scope: ["default"],
 		loaded: false,
 		eager: false,
 		from: "plugin-auth",
+		canLiveRebind: true,
 		async get() {
-			usedShared["react"].loaded = true;
-			const { "react": pkgDynamicImport } = importMap;
+			usedShared["react/jsx-runtime"].loaded = true;
+			const { "react/jsx-runtime": pkgDynamicImport } = importMap;
 			const exportModule = { ...await pkgDynamicImport() };
-			Object.defineProperty(exportModule, "__esModule", {
+			if (exportModule.__esModule !== true) Object.defineProperty(exportModule, "__esModule", {
 				value: true,
 				enumerable: false
 			});
@@ -87,11 +89,12 @@ var usedShared = {
 		loaded: false,
 		eager: false,
 		from: "plugin-auth",
+		canLiveRebind: true,
 		async get() {
 			usedShared["react-dom"].loaded = true;
 			const { "react-dom": pkgDynamicImport } = importMap;
 			const exportModule = { ...await pkgDynamicImport() };
-			Object.defineProperty(exportModule, "__esModule", {
+			if (exportModule.__esModule !== true) Object.defineProperty(exportModule, "__esModule", {
 				value: true,
 				enumerable: false
 			});
@@ -113,11 +116,12 @@ var usedShared = {
 		loaded: false,
 		eager: false,
 		from: "plugin-auth",
+		canLiveRebind: true,
 		async get() {
 			usedShared["zod"].loaded = true;
 			const { "zod": pkgDynamicImport } = importMap;
 			const exportModule = { ...await pkgDynamicImport() };
-			Object.defineProperty(exportModule, "__esModule", {
+			if (exportModule.__esModule !== true) Object.defineProperty(exportModule, "__esModule", {
 				value: true,
 				enumerable: false
 			});
@@ -134,16 +138,17 @@ var usedShared = {
 	},
 	"@baseplate-dev/ui-components": {
 		name: "@baseplate-dev/ui-components",
-		version: "0.6.17",
+		version: "0.6.18",
 		scope: ["default"],
 		loaded: false,
 		eager: false,
 		from: "plugin-auth",
+		canLiveRebind: true,
 		async get() {
 			usedShared["@baseplate-dev/ui-components"].loaded = true;
 			const { "@baseplate-dev/ui-components": pkgDynamicImport } = importMap;
 			const exportModule = { ...await pkgDynamicImport() };
-			Object.defineProperty(exportModule, "__esModule", {
+			if (exportModule.__esModule !== true) Object.defineProperty(exportModule, "__esModule", {
 				value: true,
 				enumerable: false
 			});
@@ -153,23 +158,24 @@ var usedShared = {
 		},
 		shareConfig: {
 			singleton: true,
-			requiredVersion: "^0.6.17",
+			requiredVersion: "^0.6.18",
 			strictVersion: false,
 			eager: false
 		}
 	},
 	"@baseplate-dev/project-builder-lib/web": {
 		name: "@baseplate-dev/project-builder-lib/web",
-		version: "0.6.17",
+		version: "0.6.18",
 		scope: ["default"],
 		loaded: false,
 		eager: false,
 		from: "plugin-auth",
+		canLiveRebind: true,
 		async get() {
 			usedShared["@baseplate-dev/project-builder-lib/web"].loaded = true;
 			const { "@baseplate-dev/project-builder-lib/web": pkgDynamicImport } = importMap;
 			const exportModule = { ...await pkgDynamicImport() };
-			Object.defineProperty(exportModule, "__esModule", {
+			if (exportModule.__esModule !== true) Object.defineProperty(exportModule, "__esModule", {
 				value: true,
 				enumerable: false
 			});
@@ -179,23 +185,24 @@ var usedShared = {
 		},
 		shareConfig: {
 			singleton: true,
-			requiredVersion: "^0.6.17",
+			requiredVersion: "^0.6.18",
 			strictVersion: false,
 			eager: false
 		}
 	},
 	"@baseplate-dev/project-builder-lib": {
 		name: "@baseplate-dev/project-builder-lib",
-		version: "0.6.17",
+		version: "0.6.18",
 		scope: ["default"],
 		loaded: false,
 		eager: false,
 		from: "plugin-auth",
+		canLiveRebind: true,
 		async get() {
 			usedShared["@baseplate-dev/project-builder-lib"].loaded = true;
 			const { "@baseplate-dev/project-builder-lib": pkgDynamicImport } = importMap;
 			const exportModule = { ...await pkgDynamicImport() };
-			Object.defineProperty(exportModule, "__esModule", {
+			if (exportModule.__esModule !== true) Object.defineProperty(exportModule, "__esModule", {
 				value: true,
 				enumerable: false
 			});
@@ -205,7 +212,7 @@ var usedShared = {
 		},
 		shareConfig: {
 			singleton: true,
-			requiredVersion: "^0.6.17",
+			requiredVersion: "^0.6.18",
 			strictVersion: false,
 			eager: false
 		}
@@ -217,11 +224,12 @@ var usedShared = {
 		loaded: false,
 		eager: false,
 		from: "plugin-auth",
+		canLiveRebind: true,
 		async get() {
 			usedShared["@tanstack/react-router"].loaded = true;
 			const { "@tanstack/react-router": pkgDynamicImport } = importMap;
 			const exportModule = { ...await pkgDynamicImport() };
-			Object.defineProperty(exportModule, "__esModule", {
+			if (exportModule.__esModule !== true) Object.defineProperty(exportModule, "__esModule", {
 				value: true,
 				enumerable: false
 			});