@baseplate-dev/plugin-auth 0.6.17 → 0.6.19

package/dist/local-auth/core/generators/auth-module/auth-module.generator.d.ts

@@ -1,6 +1,6 @@
 export declare const authModuleGenerator: import("@baseplate-dev/sync").GeneratorBundleCreator<{
     userAdminRoles?: string[] | undefined;
-    devWebPorts?: number[] | undefined;
+    emailOtp?: boolean | undefined;
 }, {
     paths: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthModulePaths: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;
@@ -12,10 +12,13 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
             CookieUserSessionService: {};
             createAuthVerification: {};
+            createCodeVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
+            validateCodeVerification: {};
         }>>;
     }, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;
@@ -23,6 +26,25 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
     renderers: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthModuleRenderers: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-renderers.js").LocalAuthCoreAuthModuleRenderers>;
     }, {
+        appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createSigner: {};
+            deriveKey: {};
+            SecretPolicy: {
+                isTypeOnly: true;
+            };
+            Signer: {
+                isTypeOnly: true;
+            };
+        }>>;
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             AuthContext: {
                 isTypeOnly: true;
@@ -33,7 +55,6 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             AuthUserSessionInfo: {
                 isTypeOnly: true;
             };
-            createAnonymousAuthContext: {};
             createAuthContextFromSessionInfo: {};
             createSystemAuthContext: {};
             InvalidSessionError: {};
@@ -154,11 +175,6 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             };
         }>>;
     }, undefined>;
-    config: import("@baseplate-dev/sync").GeneratorTask<undefined, {
-        provider: import("@baseplate-dev/sync").ProviderType<Omit<import("@baseplate-dev/utils").FieldMap<{
-            configFields: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/fastify-generators").ConfigServiceField>;
-        }>, "getValues">>;
-    }, undefined>;
     appModule: import("@baseplate-dev/sync").GeneratorTask<any, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;
         appModule: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/fastify-generators").AppModuleProvider>;

package/dist/local-auth/core/generators/auth-module/auth-module.generator.js

@@ -1,44 +1,22 @@
 import { tsCodeFragment, TsCodeUtils, tsTypeImportBuilder, } from '@baseplate-dev/core-generators';
-import { appModuleProvider, appRuntimeConfigProvider, configServiceProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, prismaOutputProvider, } from '@baseplate-dev/fastify-generators';
-import { createGenerator, createGeneratorTask, createProviderTask, } from '@baseplate-dev/sync';
+import { appModuleProvider, appRuntimeConfigProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, prismaOutputProvider, } from '@baseplate-dev/fastify-generators';
+import { createGenerator, createGeneratorTask } from '@baseplate-dev/sync';
 import { quot } from '@baseplate-dev/utils';
 import { z } from 'zod';
 import { LOCAL_AUTH_MODELS } from '#src/local-auth/constants/model-names.js';
 import { LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED as GENERATED_TEMPLATES } from './generated/index.js';
 const descriptorSchema = z.object({
     userAdminRoles: z.array(z.string()).default([]),
-    devWebPorts: z.array(z.number()).default([]),
+    emailOtp: z.boolean().default(false),
 });
 export const authModuleGenerator = createGenerator({
     name: 'local-auth/core/auth-module',
     generatorFileUrl: import.meta.url,
     descriptorSchema,
-    buildTasks: ({ userAdminRoles, devWebPorts }) => ({
+    buildTasks: ({ userAdminRoles, emailOtp }) => ({
         paths: GENERATED_TEMPLATES.paths.task,
         imports: GENERATED_TEMPLATES.imports.task,
         renderers: GENERATED_TEMPLATES.renderers.task,
-        config: createProviderTask(configServiceProvider, (configService) => {
-            const allowedOrigins = devWebPorts
-                .map((p) => `http://localhost:${String(p)}`)
-                .join(',');
-            configService.configFields.set('ALLOWED_ORIGINS', {
-                validator: tsCodeFragment("z.string().optional().transform((val) => (val ? val.split(',').map((s) => s.trim()) : []))"),
-                comment: 'Comma-separated list of additional allowed origins for CSRF protection (e.g. https://example.com,https://app.example.com)',
-                ...(allowedOrigins
-                    ? {
-                        seedValue: allowedOrigins,
-                        exampleValue: allowedOrigins,
-                    }
-                    : {}),
-            });
-            const authSecret = 'a-secret-key-1234567890';
-            configService.configFields.set('AUTH_SECRET', {
-                validator: tsCodeFragment('z.string().regex(/^[a-zA-Z0-9-_+=/]{20,}$/)'),
-                comment: 'Secret key for signing auth cookie (at least 20 alphanumeric characters)',
-                seedValue: authSecret,
-                exampleValue: authSecret,
-            });
-        }),
         appModule: createGeneratorTask({
             dependencies: {
                 paths: GENERATED_TEMPLATES.paths.provider,
@@ -70,6 +48,9 @@ export const authModuleGenerator = createGenerator({
                             },
                         }));
                         await builder.apply(renderers.servicesAuthVerification.render({}));
+                        if (emailOtp) {
+                            await builder.apply(renderers.servicesCodeVerification.render({}));
+                        }
                         await builder.apply(renderers.constantsGroup.render({}));
                         await builder.apply(renderers.utilsGroup.render({}));
                         await builder.apply(renderers.moduleGroup.render({

package/dist/local-auth/core/generators/auth-module/generated/index.d.ts

@@ -1,14 +1,18 @@
 export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
     imports: {
+        generatorName: string;
         task: import("@baseplate-dev/sync").GeneratorTask<{
             authModuleImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
                 cleanupExpiredAuthVerifications: {};
+                consumeCodeVerification: {};
                 CookieUserSessionService: {};
                 createAuthVerification: {};
+                createCodeVerification: {};
                 userSessionPayload: {};
                 validateAuthVerification: {};
+                validateCodeVerification: {};
             }>>;
         }, {
             paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").LocalAuthCoreAuthModulePaths>;
@@ -27,6 +31,25 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
         task: import("@baseplate-dev/sync").GeneratorTask<{
             localAuthCoreAuthModuleRenderers: import("@baseplate-dev/sync").ProviderExport<import("./template-renderers.js").LocalAuthCoreAuthModuleRenderers>;
         }, {
+            appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createSigner: {};
+                deriveKey: {};
+                SecretPolicy: {
+                    isTypeOnly: true;
+                };
+                Signer: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 AuthContext: {
                     isTypeOnly: true;
@@ -37,7 +60,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 AuthUserSessionInfo: {
                     isTypeOnly: true;
                 };
-                createAnonymousAuthContext: {};
                 createAuthContextFromSessionInfo: {};
                 createSystemAuthContext: {};
                 InvalidSessionError: {};
@@ -384,9 +406,51 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 prisma: {};
             }>>;
         }, Record<never, Record<never, never>>>;
+        servicesCodeVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+            appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createSigner: {};
+                deriveKey: {};
+                SecretPolicy: {
+                    isTypeOnly: true;
+                };
+                Signer: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                PrismaClient: {};
+                Prisma: {};
+                '*': {};
+                $Enums: {};
+            }>>;
+            prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                prisma: {};
+            }>>;
+        }, {
+            servicesAuthVerification: {};
+        }>;
         userSessionService: import("@baseplate-dev/core-generators").TsTemplateFile<{
             TPL_PRISMA_USER_SESSION: {};
         }, {
+            appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createSigner: {};
+                deriveKey: {};
+                SecretPolicy: {
+                    isTypeOnly: true;
+                };
+                Signer: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 AuthContext: {
                     isTypeOnly: true;
@@ -397,7 +461,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 AuthUserSessionInfo: {
                     isTypeOnly: true;
                 };
-                createAnonymousAuthContext: {};
                 createAuthContextFromSessionInfo: {};
                 createSystemAuthContext: {};
                 InvalidSessionError: {};
@@ -450,13 +513,11 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 };
             }>>;
         }, {
-            cookieSigner: {};
             sessionCookie: {};
             userSessionConstants: {};
             verifyRequestOrigin: {};
         }>;
         utilsGroup: {
-            cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
             sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
                 configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                     getConfig: {};

package/dist/local-auth/core/generators/auth-module/generated/template-paths.d.ts

@@ -1,12 +1,12 @@
 export interface LocalAuthCoreAuthModulePaths {
     authRoleEnum: string;
-    cookieSigner: string;
     queuesCleanupAuthVerification: string;
     queuesCleanupAuthVerificationWorker: string;
     schemaUserSessionMutations: string;
     schemaUserSessionPayloadObjectType: string;
     schemaUserSessionQueries: string;
     servicesAuthVerification: string;
+    servicesCodeVerification: string;
     sessionCookie: string;
     userRolesMutations: string;
     userRolesService: string;

package/dist/local-auth/core/generators/auth-module/generated/template-paths.js

@@ -12,13 +12,13 @@ const localAuthCoreAuthModulePathsTask = createGeneratorTask({
             providers: {
                 localAuthCoreAuthModulePaths: {
                     authRoleEnum: `${moduleRoot}/schema/auth-role.enum.ts`,
-                    cookieSigner: `${moduleRoot}/utils/cookie-signer.ts`,
                     queuesCleanupAuthVerification: `${moduleRoot}/queues/cleanup-auth-verification.queue.ts`,
                     queuesCleanupAuthVerificationWorker: `${moduleRoot}/queues/cleanup-auth-verification.worker.ts`,
                     schemaUserSessionMutations: `${moduleRoot}/schema/user-session.mutations.ts`,
                     schemaUserSessionPayloadObjectType: `${moduleRoot}/schema/user-session-payload.object-type.ts`,
                     schemaUserSessionQueries: `${moduleRoot}/schema/user-session.queries.ts`,
                     servicesAuthVerification: `${moduleRoot}/services/auth-verification.service.ts`,
+                    servicesCodeVerification: `${moduleRoot}/services/code-verification.service.ts`,
                     sessionCookie: `${moduleRoot}/utils/session-cookie.ts`,
                     userRolesMutations: `${moduleRoot}/schema/user-roles.mutations.ts`,
                     userRolesService: `${moduleRoot}/services/user-roles.service.ts`,

package/dist/local-auth/core/generators/auth-module/generated/template-renderers.d.ts

@@ -17,6 +17,9 @@ export interface LocalAuthCoreAuthModuleRenderers {
     servicesAuthVerification: {
         render: (options: Omit<RenderTsTemplateFileActionInput<typeof LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.servicesAuthVerification>, 'destination' | 'importMapProviders' | 'template' | 'generatorPaths'>) => BuilderAction;
     };
+    servicesCodeVerification: {
+        render: (options: Omit<RenderTsTemplateFileActionInput<typeof LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.servicesCodeVerification>, 'destination' | 'importMapProviders' | 'template' | 'generatorPaths'>) => BuilderAction;
+    };
     userSessionService: {
         render: (options: Omit<RenderTsTemplateFileActionInput<typeof LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.userSessionService>, 'destination' | 'importMapProviders' | 'template' | 'generatorPaths'>) => BuilderAction;
     };
@@ -29,6 +32,25 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_RENDERERS: {
     task: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthModuleRenderers: import("@baseplate-dev/sync").ProviderExport<LocalAuthCoreAuthModuleRenderers>;
     }, {
+        appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createSigner: {};
+            deriveKey: {};
+            SecretPolicy: {
+                isTypeOnly: true;
+            };
+            Signer: {
+                isTypeOnly: true;
+            };
+        }>>;
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             AuthContext: {
                 isTypeOnly: true;
@@ -39,7 +61,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_RENDERERS: {
             AuthUserSessionInfo: {
                 isTypeOnly: true;
             };
-            createAnonymousAuthContext: {};
             createAuthContextFromSessionInfo: {};
             createSystemAuthContext: {};
             InvalidSessionError: {};

package/dist/local-auth/core/generators/auth-module/generated/template-renderers.js

@@ -1,5 +1,5 @@
 import { typescriptFileProvider } from '@baseplate-dev/core-generators';
-import { authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appSecretImportsProvider, appUrlsImportsProvider, authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
 import { queuesImportsProvider } from '@baseplate-dev/plugin-queue';
 import { createGeneratorTask, createProviderType } from '@baseplate-dev/sync';
 import { LOCAL_AUTH_CORE_AUTH_MODULE_PATHS } from './template-paths.js';
@@ -7,6 +7,8 @@ import { LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES } from './typed-templates.js';
 const localAuthCoreAuthModuleRenderers = createProviderType('local-auth-core-auth-module-renderers');
 const localAuthCoreAuthModuleRenderersTask = createGeneratorTask({
     dependencies: {
+        appSecretImports: appSecretImportsProvider,
+        appUrlsImports: appUrlsImportsProvider,
         authContextImports: authContextImportsProvider,
         authRolesImports: authRolesImportsProvider,
         configServiceImports: configServiceImportsProvider,
@@ -23,7 +25,7 @@ const localAuthCoreAuthModuleRenderersTask = createGeneratorTask({
     exports: {
         localAuthCoreAuthModuleRenderers: localAuthCoreAuthModuleRenderers.export(),
     },
-    run({ authContextImports, authRolesImports, configServiceImports, errorHandlerServiceImports, paths, pothosImports, prismaGeneratedImports, prismaImports, queuesImports, requestServiceContextImports, typescriptFile, userSessionTypesImports, }) {
+    run({ appSecretImports, appUrlsImports, authContextImports, authRolesImports, configServiceImports, errorHandlerServiceImports, paths, pothosImports, prismaGeneratedImports, prismaImports, queuesImports, requestServiceContextImports, typescriptFile, userSessionTypesImports, }) {
         return {
             providers: {
                 localAuthCoreAuthModuleRenderers: {
@@ -81,11 +83,26 @@ const localAuthCoreAuthModuleRenderersTask = createGeneratorTask({
                             ...options,
                         }),
                     },
+                    servicesCodeVerification: {
+                        render: (options) => typescriptFile.renderTemplateFile({
+                            template: LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.servicesCodeVerification,
+                            destination: paths.servicesCodeVerification,
+                            importMapProviders: {
+                                appSecretImports,
+                                prismaGeneratedImports,
+                                prismaImports,
+                            },
+                            generatorPaths: paths,
+                            ...options,
+                        }),
+                    },
                     userSessionService: {
                         render: (options) => typescriptFile.renderTemplateFile({
                             template: LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.userSessionService,
                             destination: paths.userSessionService,
                             importMapProviders: {
+                                appSecretImports,
+                                appUrlsImports,
                                 authContextImports,
                                 authRolesImports,
                                 configServiceImports,

package/dist/local-auth/core/generators/auth-module/generated/ts-import-providers.d.ts

@@ -3,31 +3,41 @@ export declare const authModuleImportsSchema: {
     cleanupAuthVerificationQueue: {};
     cleanupAuthVerificationWorker: {};
     cleanupExpiredAuthVerifications: {};
+    consumeCodeVerification: {};
     CookieUserSessionService: {};
     createAuthVerification: {};
+    createCodeVerification: {};
     userSessionPayload: {};
     validateAuthVerification: {};
+    validateCodeVerification: {};
 };
 export type AuthModuleImportsProvider = TsImportMapProviderFromSchema<typeof authModuleImportsSchema>;
 export declare const authModuleImportsProvider: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
     cleanupAuthVerificationQueue: {};
     cleanupAuthVerificationWorker: {};
     cleanupExpiredAuthVerifications: {};
+    consumeCodeVerification: {};
     CookieUserSessionService: {};
     createAuthVerification: {};
+    createCodeVerification: {};
     userSessionPayload: {};
     validateAuthVerification: {};
+    validateCodeVerification: {};
 }>>;
 export declare const LOCAL_AUTH_CORE_AUTH_MODULE_IMPORTS: {
+    generatorName: string;
     task: import("@baseplate-dev/sync").GeneratorTask<{
         authModuleImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            consumeCodeVerification: {};
             CookieUserSessionService: {};
             createAuthVerification: {};
+            createCodeVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
+            validateCodeVerification: {};
         }>>;
     }, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./template-paths.js").LocalAuthCoreAuthModulePaths>;

package/dist/local-auth/core/generators/auth-module/generated/ts-import-providers.js

@@ -5,10 +5,13 @@ export const authModuleImportsSchema = createTsImportMapSchema({
     cleanupAuthVerificationQueue: {},
     cleanupAuthVerificationWorker: {},
     cleanupExpiredAuthVerifications: {},
+    consumeCodeVerification: {},
     CookieUserSessionService: {},
     createAuthVerification: {},
+    createCodeVerification: {},
     userSessionPayload: {},
     validateAuthVerification: {},
+    validateCodeVerification: {},
 });
 export const authModuleImportsProvider = createReadOnlyProviderType('auth-module-imports');
 const localAuthCoreAuthModuleImportsTask = createGeneratorTask({
@@ -25,16 +28,20 @@ const localAuthCoreAuthModuleImportsTask = createGeneratorTask({
                     cleanupAuthVerificationQueue: paths.queuesCleanupAuthVerification,
                     cleanupAuthVerificationWorker: paths.queuesCleanupAuthVerificationWorker,
                     cleanupExpiredAuthVerifications: paths.servicesAuthVerification,
+                    consumeCodeVerification: paths.servicesCodeVerification,
                     CookieUserSessionService: paths.userSessionService,
                     createAuthVerification: paths.servicesAuthVerification,
+                    createCodeVerification: paths.servicesCodeVerification,
                     userSessionPayload: paths.schemaUserSessionPayloadObjectType,
                     validateAuthVerification: paths.servicesAuthVerification,
+                    validateCodeVerification: paths.servicesCodeVerification,
                 }),
             },
         };
     },
 });
 export const LOCAL_AUTH_CORE_AUTH_MODULE_IMPORTS = {
+    generatorName: '@baseplate-dev/plugin-auth#local-auth/core/auth-module',
     task: localAuthCoreAuthModuleImportsTask,
 };
 //# sourceMappingURL=ts-import-providers.js.map

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.d.ts

@@ -91,7 +91,6 @@ export declare const moduleGroup: {
     }, Record<never, Record<never, never>>>;
 };
 export declare const utilsGroup: {
-    cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
     sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             getConfig: {};
@@ -325,9 +324,51 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             prisma: {};
         }>>;
     }, Record<never, Record<never, never>>>;
+    servicesCodeVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+        appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createSigner: {};
+            deriveKey: {};
+            SecretPolicy: {
+                isTypeOnly: true;
+            };
+            Signer: {
+                isTypeOnly: true;
+            };
+        }>>;
+        prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            PrismaClient: {};
+            Prisma: {};
+            '*': {};
+            $Enums: {};
+        }>>;
+        prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            prisma: {};
+        }>>;
+    }, {
+        servicesAuthVerification: {};
+    }>;
     userSessionService: import("@baseplate-dev/core-generators").TsTemplateFile<{
         TPL_PRISMA_USER_SESSION: {};
     }, {
+        appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createSigner: {};
+            deriveKey: {};
+            SecretPolicy: {
+                isTypeOnly: true;
+            };
+            Signer: {
+                isTypeOnly: true;
+            };
+        }>>;
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             AuthContext: {
                 isTypeOnly: true;
@@ -338,7 +379,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             AuthUserSessionInfo: {
                 isTypeOnly: true;
             };
-            createAnonymousAuthContext: {};
             createAuthContextFromSessionInfo: {};
             createSystemAuthContext: {};
             InvalidSessionError: {};
@@ -391,13 +431,11 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             };
         }>>;
     }, {
-        cookieSigner: {};
         sessionCookie: {};
         userSessionConstants: {};
         verifyRequestOrigin: {};
     }>;
     utilsGroup: {
-        cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
         sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 getConfig: {};

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.js

@@ -1,5 +1,5 @@
 import { createTsTemplateFile } from '@baseplate-dev/core-generators';
-import { authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appSecretImportsProvider, appUrlsImportsProvider, authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
 import { queuesImportsProvider } from '@baseplate-dev/plugin-queue';
 import path from 'node:path';
 const userSessionConstants = createTsTemplateFile({
@@ -140,9 +140,30 @@ const servicesAuthVerification = createTsTemplateFile({
     },
     variables: {},
 });
+const servicesCodeVerification = createTsTemplateFile({
+    fileOptions: { kind: 'singleton' },
+    importMapProviders: {
+        appSecretImports: appSecretImportsProvider,
+        prismaGeneratedImports: prismaGeneratedImportsProvider,
+        prismaImports: prismaImportsProvider,
+    },
+    name: 'services-code-verification',
+    projectExports: {
+        consumeCodeVerification: { isTypeOnly: false },
+        createCodeVerification: { isTypeOnly: false },
+        validateCodeVerification: { isTypeOnly: false },
+    },
+    referencedGeneratorTemplates: { servicesAuthVerification: {} },
+    source: {
+        path: path.join(import.meta.dirname, '../templates/module/services/code-verification.service.ts'),
+    },
+    variables: {},
+});
 const userSessionService = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
+        appSecretImports: appSecretImportsProvider,
+        appUrlsImports: appUrlsImportsProvider,
         authContextImports: authContextImportsProvider,
         authRolesImports: authRolesImportsProvider,
         configServiceImports: configServiceImportsProvider,
@@ -154,7 +175,6 @@ const userSessionService = createTsTemplateFile({
     name: 'user-session-service',
     projectExports: { CookieUserSessionService: { isTypeOnly: false } },
     referencedGeneratorTemplates: {
-        cookieSigner: {},
         sessionCookie: {},
         userSessionConstants: {},
         verifyRequestOrigin: {},
@@ -164,16 +184,6 @@ const userSessionService = createTsTemplateFile({
     },
     variables: { TPL_PRISMA_USER_SESSION: {} },
 });
-const cookieSigner = createTsTemplateFile({
-    fileOptions: { kind: 'singleton' },
-    group: 'utils',
-    importMapProviders: {},
-    name: 'cookie-signer',
-    source: {
-        path: path.join(import.meta.dirname, '../templates/module/utils/cookie-signer.ts'),
-    },
-    variables: {},
-});
 const sessionCookie = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     group: 'utils',
@@ -194,13 +204,14 @@ const verifyRequestOrigin = createTsTemplateFile({
     },
     variables: {},
 });
-export const utilsGroup = { cookieSigner, sessionCookie, verifyRequestOrigin };
+export const utilsGroup = { sessionCookie, verifyRequestOrigin };
 export const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES = {
     constantsGroup,
     moduleGroup,
     queuesCleanupAuthVerification,
     queuesCleanupAuthVerificationWorker,
     servicesAuthVerification,
+    servicesCodeVerification,
     userSessionService,
     utilsGroup,
 };

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.d.ts

@@ -1,4 +1,8 @@
 import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+/**
+ * Constant-time comparison of two hex strings to prevent timing attacks.
+ */
+export declare function safeCompare(a: string, b: string): boolean;
 /**
  * Creates a new auth verification using the split-token pattern.
  *

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.js

@@ -20,7 +20,7 @@ function hashVerifier(verifier) {
 /**
  * Constant-time comparison of two hex strings to prevent timing attacks.
  */
-function safeCompare(a, b) {
+export function safeCompare(a, b) {
     if (a.length !== b.length)
         return false;
     return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.ts

@@ -27,7 +27,7 @@ function hashVerifier(verifier: string): string {
 /**
  * Constant-time comparison of two hex strings to prevent timing attacks.
  */
-function safeCompare(a: string, b: string): boolean {
+export function safeCompare(a: string, b: string): boolean {
   if (a.length !== b.length) return false;
   return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
 }