@baseplate-dev/plugin-auth 0.6.17 → 0.6.19

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.d.ts

@@ -0,0 +1,67 @@
+import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+/**
+ * Creates or replaces a short code verification (e.g. an emailed OTP).
+ *
+ * The identifier is caller-supplied (typically an email) rather than a random
+ * selector, so the code cannot be folded into a single token the way a
+ * split-token flow does. Only one code may be outstanding per
+ * `type`/`identifier` pair, so requesting a new one replaces any existing code
+ * and resets the attempt counter.
+ *
+ * The identifier rather than a user reference is the subject here, since a
+ * code may be issued for an address that has no account yet.
+ *
+ * The returned id identifies this particular issuance, so a caller that binds
+ * it to the requester (e.g. in a cookie) can tell one request apart from the
+ * next. It is regenerated on every call for that reason: reusing it would let
+ * whoever requested an earlier code redeem a later one requested by someone
+ * else.
+ *
+ * @param code - The plaintext code sent to the user; only its hash is stored
+ */
+export declare function createCodeVerification({ type, identifier, code, expiresInSec, }: {
+    type: string;
+    identifier: string;
+    code: string;
+    expiresInSec: number;
+}): Promise<{
+    id: string;
+}>;
+/**
+ * Validates a short code verification, leaving the record in place so the
+ * caller can gather any further input it needs before committing.
+ *
+ * Security: a short numeric code has far less entropy than a random token, so
+ * each code carries its own attempt counter alongside the endpoint rate limits.
+ * Every call spends an attempt, including one that matches, and the record is
+ * deleted once the code has expired or a wrong guess has spent the last
+ * attempt. Pass the returned record to {@link consumeCodeVerification} to
+ * complete the flow.
+ *
+ * The cleanup paths delete by filter rather than by primary key: simultaneous
+ * callers can each decide the record should go, and only one of them removes a
+ * row.
+ */
+export declare function validateCodeVerification({ type, identifier, code, maxAttempts, }: {
+    type: string;
+    identifier: string;
+    code: string;
+    maxAttempts: number;
+}): Promise<AuthVerification | null>;
+/**
+ * Consumes a previously validated verification, returning whether this call is
+ * the one that claimed it.
+ *
+ * The conditional delete is the authorization step: concurrent requests
+ * carrying the same code race here, and only the request that removes the row
+ * may proceed. Reading the row and deleting it in separate statements would
+ * let both win.
+ *
+ * @param client - Transaction client, so consuming the code can be committed
+ * together with whatever the code authorized rather than ahead of it
+ */
+export declare function consumeCodeVerification({ id, client, }: {
+    id: string;
+    client?: Prisma.TransactionClient;
+}): Promise<boolean>;
+//# sourceMappingURL=code-verification.service.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.js

@@ -0,0 +1,140 @@
+// @ts-nocheck
+import { safeCompare } from '$servicesAuthVerification';
+import { deriveKey } from '%appSecretImports';
+import { prisma } from '%prismaImports';
+import * as crypto from 'node:crypto';
+/**
+ * Short code verifications, for flows that email a handful of digits rather
+ * than a link.
+ *
+ * These share the `AuthVerification` table with the split-token flows in
+ * {@link ./auth-verification.service.js} but not their security model: the
+ * secret is short enough to guess, so it is keyed rather than hashed, carries
+ * its own attempt budget, and is addressed by a caller-supplied identifier
+ * instead of a random selector.
+ */
+/**
+ * Derives the stored value for a short code.
+ *
+ * Short codes occupy a keyspace small enough to invert a plain digest by
+ * exhaustive search, so they are keyed with the server secret rather than
+ * hashed: an attacker holding only the database cannot recover them. The type
+ * and identifier are mixed in so a stored value is valid solely for the flow
+ * and address it was issued for.
+ */
+function hashCode({ type, identifier, code, }) {
+    return crypto
+        .createHmac('sha256', deriveKey('auth:code-verification:v1'))
+        .update(`${type}:${identifier}:${code}`)
+        .digest('hex');
+}
+/**
+ * Creates or replaces a short code verification (e.g. an emailed OTP).
+ *
+ * The identifier is caller-supplied (typically an email) rather than a random
+ * selector, so the code cannot be folded into a single token the way a
+ * split-token flow does. Only one code may be outstanding per
+ * `type`/`identifier` pair, so requesting a new one replaces any existing code
+ * and resets the attempt counter.
+ *
+ * The identifier rather than a user reference is the subject here, since a
+ * code may be issued for an address that has no account yet.
+ *
+ * The returned id identifies this particular issuance, so a caller that binds
+ * it to the requester (e.g. in a cookie) can tell one request apart from the
+ * next. It is regenerated on every call for that reason: reusing it would let
+ * whoever requested an earlier code redeem a later one requested by someone
+ * else.
+ *
+ * @param code - The plaintext code sent to the user; only its hash is stored
+ */
+export async function createCodeVerification({ type, identifier, code, expiresInSec, }) {
+    const value = hashCode({ type, identifier, code });
+    const expiresAt = new Date(Date.now() + expiresInSec * 1000);
+    const id = crypto.randomUUID();
+    await prisma.authVerification.upsert({
+        where: { type_identifier: { type, identifier } },
+        create: {
+            id,
+            type,
+            identifier,
+            value,
+            expiresAt,
+        },
+        // Resetting `attempts` is what gives the replacement code a fresh budget;
+        // without it a reissued code would inherit the old code's failed guesses.
+        update: {
+            id,
+            value,
+            attempts: 0,
+            expiresAt,
+        },
+        select: { id: true },
+    });
+    return { id };
+}
+/**
+ * Validates a short code verification, leaving the record in place so the
+ * caller can gather any further input it needs before committing.
+ *
+ * Security: a short numeric code has far less entropy than a random token, so
+ * each code carries its own attempt counter alongside the endpoint rate limits.
+ * Every call spends an attempt, including one that matches, and the record is
+ * deleted once the code has expired or a wrong guess has spent the last
+ * attempt. Pass the returned record to {@link consumeCodeVerification} to
+ * complete the flow.
+ *
+ * The cleanup paths delete by filter rather than by primary key: simultaneous
+ * callers can each decide the record should go, and only one of them removes a
+ * row.
+ */
+export async function validateCodeVerification({ type, identifier, code, maxAttempts, }) {
+    const record = await prisma.authVerification.findUnique({
+        where: { type_identifier: { type, identifier } },
+    });
+    if (!record) {
+        return null;
+    }
+    if (record.expiresAt < new Date()) {
+        await prisma.authVerification.deleteMany({ where: { id: record.id } });
+        return null;
+    }
+    // Simultaneous guesses serialize on this statement, so at most `maxAttempts`
+    // of them reach the comparison below.
+    const [claimed] = await prisma.authVerification.updateManyAndReturn({
+        where: { id: record.id, attempts: { lt: maxAttempts } },
+        data: { attempts: { increment: 1 } },
+    });
+    // A spent budget is not this caller's to clean up: the guess that spent it
+    // discards the record below, and a correct guess that spent it may still be
+    // holding the record for {@link consumeCodeVerification}.
+    if (!claimed) {
+        return null;
+    }
+    if (safeCompare(claimed.value, hashCode({ type, identifier, code }))) {
+        return claimed;
+    }
+    if (claimed.attempts >= maxAttempts) {
+        await prisma.authVerification.deleteMany({ where: { id: record.id } });
+    }
+    return null;
+}
+/**
+ * Consumes a previously validated verification, returning whether this call is
+ * the one that claimed it.
+ *
+ * The conditional delete is the authorization step: concurrent requests
+ * carrying the same code race here, and only the request that removes the row
+ * may proceed. Reading the row and deleting it in separate statements would
+ * let both win.
+ *
+ * @param client - Transaction client, so consuming the code can be committed
+ * together with whatever the code authorized rather than ahead of it
+ */
+export async function consumeCodeVerification({ id, client = prisma, }) {
+    const { count } = await client.authVerification.deleteMany({
+        where: { id },
+    });
+    return count === 1;
+}
+//# sourceMappingURL=code-verification.service.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.ts

@@ -0,0 +1,191 @@
+// @ts-nocheck
+
+import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+
+import { safeCompare } from '$servicesAuthVerification';
+import { deriveKey } from '%appSecretImports';
+import { prisma } from '%prismaImports';
+import * as crypto from 'node:crypto';
+
+/**
+ * Short code verifications, for flows that email a handful of digits rather
+ * than a link.
+ *
+ * These share the `AuthVerification` table with the split-token flows in
+ * {@link ./auth-verification.service.js} but not their security model: the
+ * secret is short enough to guess, so it is keyed rather than hashed, carries
+ * its own attempt budget, and is addressed by a caller-supplied identifier
+ * instead of a random selector.
+ */
+
+/**
+ * Derives the stored value for a short code.
+ *
+ * Short codes occupy a keyspace small enough to invert a plain digest by
+ * exhaustive search, so they are keyed with the server secret rather than
+ * hashed: an attacker holding only the database cannot recover them. The type
+ * and identifier are mixed in so a stored value is valid solely for the flow
+ * and address it was issued for.
+ */
+function hashCode({
+  type,
+  identifier,
+  code,
+}: {
+  type: string;
+  identifier: string;
+  code: string;
+}): string {
+  return crypto
+    .createHmac('sha256', deriveKey('auth:code-verification:v1'))
+    .update(`${type}:${identifier}:${code}`)
+    .digest('hex');
+}
+
+/**
+ * Creates or replaces a short code verification (e.g. an emailed OTP).
+ *
+ * The identifier is caller-supplied (typically an email) rather than a random
+ * selector, so the code cannot be folded into a single token the way a
+ * split-token flow does. Only one code may be outstanding per
+ * `type`/`identifier` pair, so requesting a new one replaces any existing code
+ * and resets the attempt counter.
+ *
+ * The identifier rather than a user reference is the subject here, since a
+ * code may be issued for an address that has no account yet.
+ *
+ * The returned id identifies this particular issuance, so a caller that binds
+ * it to the requester (e.g. in a cookie) can tell one request apart from the
+ * next. It is regenerated on every call for that reason: reusing it would let
+ * whoever requested an earlier code redeem a later one requested by someone
+ * else.
+ *
+ * @param code - The plaintext code sent to the user; only its hash is stored
+ */
+export async function createCodeVerification({
+  type,
+  identifier,
+  code,
+  expiresInSec,
+}: {
+  type: string;
+  identifier: string;
+  code: string;
+  expiresInSec: number;
+}): Promise<{ id: string }> {
+  const value = hashCode({ type, identifier, code });
+  const expiresAt = new Date(Date.now() + expiresInSec * 1000);
+  const id = crypto.randomUUID();
+
+  await prisma.authVerification.upsert({
+    where: { type_identifier: { type, identifier } },
+    create: {
+      id,
+      type,
+      identifier,
+      value,
+      expiresAt,
+    },
+    // Resetting `attempts` is what gives the replacement code a fresh budget;
+    // without it a reissued code would inherit the old code's failed guesses.
+    update: {
+      id,
+      value,
+      attempts: 0,
+      expiresAt,
+    },
+    select: { id: true },
+  });
+
+  return { id };
+}
+
+/**
+ * Validates a short code verification, leaving the record in place so the
+ * caller can gather any further input it needs before committing.
+ *
+ * Security: a short numeric code has far less entropy than a random token, so
+ * each code carries its own attempt counter alongside the endpoint rate limits.
+ * Every call spends an attempt, including one that matches, and the record is
+ * deleted once the code has expired or a wrong guess has spent the last
+ * attempt. Pass the returned record to {@link consumeCodeVerification} to
+ * complete the flow.
+ *
+ * The cleanup paths delete by filter rather than by primary key: simultaneous
+ * callers can each decide the record should go, and only one of them removes a
+ * row.
+ */
+export async function validateCodeVerification({
+  type,
+  identifier,
+  code,
+  maxAttempts,
+}: {
+  type: string;
+  identifier: string;
+  code: string;
+  maxAttempts: number;
+}): Promise<AuthVerification | null> {
+  const record = await prisma.authVerification.findUnique({
+    where: { type_identifier: { type, identifier } },
+  });
+
+  if (!record) {
+    return null;
+  }
+
+  if (record.expiresAt < new Date()) {
+    await prisma.authVerification.deleteMany({ where: { id: record.id } });
+    return null;
+  }
+
+  // Simultaneous guesses serialize on this statement, so at most `maxAttempts`
+  // of them reach the comparison below.
+  const [claimed] = await prisma.authVerification.updateManyAndReturn({
+    where: { id: record.id, attempts: { lt: maxAttempts } },
+    data: { attempts: { increment: 1 } },
+  });
+
+  // A spent budget is not this caller's to clean up: the guess that spent it
+  // discards the record below, and a correct guess that spent it may still be
+  // holding the record for {@link consumeCodeVerification}.
+  if (!claimed) {
+    return null;
+  }
+
+  if (safeCompare(claimed.value, hashCode({ type, identifier, code }))) {
+    return claimed;
+  }
+
+  if (claimed.attempts >= maxAttempts) {
+    await prisma.authVerification.deleteMany({ where: { id: record.id } });
+  }
+
+  return null;
+}
+
+/**
+ * Consumes a previously validated verification, returning whether this call is
+ * the one that claimed it.
+ *
+ * The conditional delete is the authorization step: concurrent requests
+ * carrying the same code race here, and only the request that removes the row
+ * may proceed. Reading the row and deleting it in separate statements would
+ * let both win.
+ *
+ * @param client - Transaction client, so consuming the code can be committed
+ * together with whatever the code authorized rather than ahead of it
+ */
+export async function consumeCodeVerification({
+  id,
+  client = prisma,
+}: {
+  id: string;
+  client?: Prisma.TransactionClient;
+}): Promise<boolean> {
+  const { count } = await client.authVerification.deleteMany({
+    where: { id },
+  });
+
+  return count === 1;
+}

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.js

@@ -1,14 +1,16 @@
 // @ts-nocheck
-import { signObject, unsignObject } from '$cookieSigner';
 import { getUserSessionCookieName } from '$sessionCookie';
 import { USER_SESSION_DURATION_SEC, USER_SESSION_MAX_LIFETIME_SEC, USER_SESSION_RENEWAL_THRESHOLD_SEC, } from '$userSessionConstants';
 import { verifyRequestOrigin } from '$verifyRequestOrigin';
+import { createSigner } from '%appSecretImports';
+import { getWebOrigins } from '%appUrlsImports';
 import { InvalidSessionError } from '%authContextImports';
 import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { getConfig, isDevelopment } from '%configServiceImports';
+import { isDevelopment } from '%configServiceImports';
 import { ForbiddenError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { randomBytes } from 'node:crypto';
+const sessionCookieSigner = createSigner('auth:session:v1');
 function getCookieOptions() {
     return {
         httpOnly: true,
@@ -85,7 +87,7 @@ export class CookieUserSessionService {
             ...user.roles.map((role) => role.role),
         ];
         const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-        const cookieValue = signObject({ token }, getConfig().AUTH_SECRET);
+        const cookieValue = sessionCookieSigner.sign({ token });
         context.cookieStore.set(cookieName, cookieValue, getCookieOptions());
         return { userId, expiresAt, roles };
     }
@@ -122,17 +124,14 @@ export class CookieUserSessionService {
         if ((req.method !== 'GET' ||
             req.headers.upgrade?.toLowerCase() === 'websocket') &&
             req.method !== 'HEAD' &&
-            !verifyRequestOrigin(req, [req.host, ...getConfig().ALLOWED_ORIGINS])) {
+            !verifyRequestOrigin(req, [req.host, ...getWebOrigins()])) {
             throw new ForbiddenError('Invalid Origin header');
         }
         try {
-            // Unsign the session cookie
-            const sessionCookieResult = unsignObject(sessionCookieValue, getConfig().AUTH_SECRET);
+            const sessionCookieResult = sessionCookieSigner.verify(sessionCookieValue);
             if (!sessionCookieResult)
                 throw new InvalidSessionError();
             const { token } = sessionCookieResult;
-            if (typeof token !== 'string')
-                throw new InvalidSessionError();
             // Fetch and validate user session
             const userSession = await TPL_PRISMA_USER_SESSION.findUnique({
                 where: { token },
@@ -152,7 +151,7 @@ export class CookieUserSessionService {
                         expiresAt: sessionExpiryResult.newExpiry,
                     },
                 });
-                const newSignedCookie = signObject({ token }, getConfig().AUTH_SECRET);
+                const newSignedCookie = sessionCookieSigner.sign({ token });
                 reply.setCookie(cookieName, newSignedCookie, getCookieOptions());
             }
             const { user } = userSession;

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-session.service.ts

@@ -10,7 +10,6 @@ import type {
 import type { CookieSerializeOptions } from '@fastify/cookie';
 import type { FastifyReply, FastifyRequest } from 'fastify';
 
-import { signObject, unsignObject } from '$cookieSigner';
 import { getUserSessionCookieName } from '$sessionCookie';
 import {
   USER_SESSION_DURATION_SEC,
@@ -18,9 +17,11 @@ import {
   USER_SESSION_RENEWAL_THRESHOLD_SEC,
 } from '$userSessionConstants';
 import { verifyRequestOrigin } from '$verifyRequestOrigin';
+import { createSigner } from '%appSecretImports';
+import { getWebOrigins } from '%appUrlsImports';
 import { InvalidSessionError } from '%authContextImports';
 import { DEFAULT_USER_ROLES } from '%authRolesImports';
-import { getConfig, isDevelopment } from '%configServiceImports';
+import { isDevelopment } from '%configServiceImports';
 import { ForbiddenError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { randomBytes } from 'node:crypto';
@@ -30,6 +31,8 @@ interface SessionCookieValue {
   token: string;
 }
 
+const sessionCookieSigner = createSigner<SessionCookieValue>('auth:session:v1');
+
 function getCookieOptions(): CookieSerializeOptions {
   return {
     httpOnly: true,
@@ -131,7 +134,7 @@ export class CookieUserSessionService implements UserSessionService {
     ];
 
     const cookieName = getUserSessionCookieName(context.reqInfo.headers);
-    const cookieValue = signObject({ token }, getConfig().AUTH_SECRET);
+    const cookieValue = sessionCookieSigner.sign({ token });
 
     context.cookieStore.set(cookieName, cookieValue, getCookieOptions());
 
@@ -182,20 +185,16 @@ export class CookieUserSessionService implements UserSessionService {
       (req.method !== 'GET' ||
         req.headers.upgrade?.toLowerCase() === 'websocket') &&
       req.method !== 'HEAD' &&
-      !verifyRequestOrigin(req, [req.host, ...getConfig().ALLOWED_ORIGINS])
+      !verifyRequestOrigin(req, [req.host, ...getWebOrigins()])
     ) {
       throw new ForbiddenError('Invalid Origin header');
     }
     try {
-      // Unsign the session cookie
-      const sessionCookieResult = unsignObject(
-        sessionCookieValue,
-        getConfig().AUTH_SECRET,
-      ) as SessionCookieValue | undefined;
+      const sessionCookieResult =
+        sessionCookieSigner.verify(sessionCookieValue);
       if (!sessionCookieResult) throw new InvalidSessionError();
 
       const { token } = sessionCookieResult;
-      if (typeof token !== 'string') throw new InvalidSessionError();
 
       // Fetch and validate user session
       const userSession = await TPL_PRISMA_USER_SESSION.findUnique({
@@ -220,7 +219,7 @@ export class CookieUserSessionService implements UserSessionService {
             expiresAt: sessionExpiryResult.newExpiry,
           },
         });
-        const newSignedCookie = signObject({ token }, getConfig().AUTH_SECRET);
+        const newSignedCookie = sessionCookieSigner.sign({ token });
         reply.setCookie(cookieName, newSignedCookie, getCookieOptions());
       }
 

package/dist/local-auth/core/generators/auth-routes/auth-routes.generator.d.ts

@@ -3,6 +3,8 @@
  */
 export declare const authRoutesGenerator: import("@baseplate-dev/sync").GeneratorBundleCreator<{
     requireNameOnRegistration: boolean;
+    emailOtp?: boolean | undefined;
+    disableRegistration?: boolean | undefined;
 }, {
     paths: import("@baseplate-dev/sync").GeneratorTask<{
         authCoreAuthRoutesPaths: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-paths.js").AuthCoreAuthRoutesPaths>;
@@ -31,6 +33,7 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
                 isTypeOnly: true;
             };
             Alert: {};
+            AlertAction: {};
             AlertDescription: {};
             AlertTitle: {};
             Autocomplete: {};
@@ -60,6 +63,7 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
             buttonVariants: {};
             Calendar: {};
             Card: {};
+            CardAction: {};
             CardContent: {};
             CardDescription: {};
             CardFooter: {};
@@ -144,6 +148,12 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
             InputGroupInput: {};
             InputGroupText: {};
             InputGroupTextarea: {};
+            InputOtp: {};
+            InputOtpField: {};
+            InputOtpFieldController: {};
+            InputOtpGroup: {};
+            InputOtpSeparator: {};
+            InputOtpSlot: {};
             inputVariants: {};
             Item: {};
             ItemActions: {};
@@ -180,6 +190,10 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
             NotFoundCard: {};
             NumberField: {};
             NumberFieldController: {};
+            PageHeader: {};
+            PageHeaderActions: {};
+            PageHeaderDescription: {};
+            PageHeaderTitle: {};
             Popover: {};
             PopoverContent: {};
             PopoverTrigger: {};
@@ -189,6 +203,11 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
                 isTypeOnly: true;
             };
             ScrollArea: {};
+            Section: {};
+            SectionActions: {};
+            SectionDescription: {};
+            SectionHeader: {};
+            SectionTitle: {};
             Select: {};
             SelectField: {};
             SelectFieldController: {};
@@ -244,7 +263,27 @@ export declare const authRoutesGenerator: import("@baseplate-dev/sync").Generato
             Textarea: {};
             TextareaField: {};
             TextareaFieldController: {};
+            Toast: {};
+            toast: {};
+            ToastAction: {};
+            ToastClose: {};
+            ToastContent: {};
+            ToastDescription: {};
             Toaster: {};
+            toastManager: {};
+            ToastOptions: {
+                isTypeOnly: true;
+            };
+            ToastPortal: {};
+            ToastProvider: {};
+            ToastTitle: {};
+            ToastType: {
+                isTypeOnly: true;
+            };
+            ToastUpdateOptions: {
+                isTypeOnly: true;
+            };
+            ToastViewport: {};
             Tooltip: {};
             TooltipContent: {};
             TooltipProvider: {};

package/dist/local-auth/core/generators/auth-routes/auth-routes.generator.js

@@ -4,6 +4,8 @@ import { z } from 'zod';
 import { AUTH_CORE_AUTH_ROUTES_GENERATED as GENERATED_TEMPLATES } from './generated/index.js';
 const descriptorSchema = z.object({
     requireNameOnRegistration: z.boolean(),
+    emailOtp: z.boolean().default(false),
+    disableRegistration: z.boolean().default(false),
 });
 /**
  * Generator for auth routes for logging in and registering
@@ -12,7 +14,7 @@ export const authRoutesGenerator = createGenerator({
     name: 'auth/core/auth-routes',
     generatorFileUrl: import.meta.url,
     descriptorSchema,
-    buildTasks: ({ requireNameOnRegistration }) => ({
+    buildTasks: ({ requireNameOnRegistration, emailOtp, disableRegistration, }) => ({
         paths: GENERATED_TEMPLATES.paths.task,
         renderers: GENERATED_TEMPLATES.renderers.task,
         main: createGeneratorTask({
@@ -39,7 +41,39 @@ export const authRoutesGenerator = createGenerator({
                     build: async (builder) => {
                         await builder.apply(renderers.mainGroup.render({
                             variables: {
-                                register: {
+                                login: {
+                                    TPL_OTP_LOGIN_LINK: emailOtp
+                                        ? `<Link
+              to="/auth/login-otp"
+              search={{ return_to }}
+              className="text-muted-foreground underline-offset-4 hover:underline"
+            >
+              Sign in with a code instead
+            </Link>`
+                                        : '',
+                                    TPL_REGISTER_LINK: disableRegistration
+                                        ? ''
+                                        : `<div>
+              Don&apos;t have an account?{' '}
+              <Link
+                to="/auth/register"
+                className="underline underline-offset-4"
+              >
+                Sign up
+              </Link>
+            </div>`,
+                                },
+                            },
+                        }));
+                        await builder.apply(renderers.verifyEmail.render({}));
+                        await builder.apply(renderers.acceptInvite.render({}));
+                        if (emailOtp) {
+                            await builder.apply(renderers.otpConstants.render({}));
+                            await builder.apply(renderers.loginOtp.render({}));
+                        }
+                        if (!disableRegistration) {
+                            await builder.apply(renderers.register.render({
+                                variables: {
                                     TPL_REGISTER_SCHEMA: registerSchema,
                                     TPL_REGISTER_INPUT: registerInput,
                                     TPL_NAME_FORM_CONTROL: requireNameOnRegistration
@@ -53,9 +87,8 @@ export const authRoutesGenerator = createGenerator({
             />`
                                         : '',
                                 },
-                            },
-                        }));
-                        await builder.apply(renderers.verifyEmail.render({}));
+                            }));
+                        }
                     },
                 };
             },