@baseplate-dev/plugin-auth 0.6.18 → 0.6.19

package/dist/local-auth/core/generators/auth-module/auth-module.generator.d.ts

@@ -1,6 +1,5 @@
 export declare const authModuleGenerator: import("@baseplate-dev/sync").GeneratorBundleCreator<{
     userAdminRoles?: string[] | undefined;
-    devWebPorts?: number[] | undefined;
     emailOtp?: boolean | undefined;
 }, {
     paths: import("@baseplate-dev/sync").GeneratorTask<{
@@ -27,6 +26,25 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
     renderers: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthModuleRenderers: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-renderers.js").LocalAuthCoreAuthModuleRenderers>;
     }, {
+        appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createSigner: {};
+            deriveKey: {};
+            SecretPolicy: {
+                isTypeOnly: true;
+            };
+            Signer: {
+                isTypeOnly: true;
+            };
+        }>>;
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             AuthContext: {
                 isTypeOnly: true;
@@ -37,7 +55,6 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             AuthUserSessionInfo: {
                 isTypeOnly: true;
             };
-            createAnonymousAuthContext: {};
             createAuthContextFromSessionInfo: {};
             createSystemAuthContext: {};
             InvalidSessionError: {};
@@ -158,11 +175,6 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             };
         }>>;
     }, undefined>;
-    config: import("@baseplate-dev/sync").GeneratorTask<undefined, {
-        provider: import("@baseplate-dev/sync").ProviderType<Omit<import("@baseplate-dev/utils").FieldMap<{
-            configFields: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/fastify-generators").ConfigServiceField>;
-        }>, "getValues">>;
-    }, undefined>;
     appModule: import("@baseplate-dev/sync").GeneratorTask<any, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;
         appModule: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/fastify-generators").AppModuleProvider>;

package/dist/local-auth/core/generators/auth-module/auth-module.generator.js

@@ -1,45 +1,22 @@
 import { tsCodeFragment, TsCodeUtils, tsTypeImportBuilder, } from '@baseplate-dev/core-generators';
-import { appModuleProvider, appRuntimeConfigProvider, configServiceProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, prismaOutputProvider, } from '@baseplate-dev/fastify-generators';
-import { createGenerator, createGeneratorTask, createProviderTask, } from '@baseplate-dev/sync';
+import { appModuleProvider, appRuntimeConfigProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, prismaOutputProvider, } from '@baseplate-dev/fastify-generators';
+import { createGenerator, createGeneratorTask } from '@baseplate-dev/sync';
 import { quot } from '@baseplate-dev/utils';
 import { z } from 'zod';
 import { LOCAL_AUTH_MODELS } from '#src/local-auth/constants/model-names.js';
 import { LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED as GENERATED_TEMPLATES } from './generated/index.js';
 const descriptorSchema = z.object({
     userAdminRoles: z.array(z.string()).default([]),
-    devWebPorts: z.array(z.number()).default([]),
     emailOtp: z.boolean().default(false),
 });
 export const authModuleGenerator = createGenerator({
     name: 'local-auth/core/auth-module',
     generatorFileUrl: import.meta.url,
     descriptorSchema,
-    buildTasks: ({ userAdminRoles, devWebPorts, emailOtp }) => ({
+    buildTasks: ({ userAdminRoles, emailOtp }) => ({
         paths: GENERATED_TEMPLATES.paths.task,
         imports: GENERATED_TEMPLATES.imports.task,
         renderers: GENERATED_TEMPLATES.renderers.task,
-        config: createProviderTask(configServiceProvider, (configService) => {
-            const allowedOrigins = devWebPorts
-                .map((p) => `http://localhost:${String(p)}`)
-                .join(',');
-            configService.configFields.set('ALLOWED_ORIGINS', {
-                validator: tsCodeFragment("z.string().optional().transform((val) => (val ? val.split(',').map((s) => s.trim()) : []))"),
-                comment: 'Comma-separated list of additional allowed origins for CSRF protection (e.g. https://example.com,https://app.example.com)',
-                ...(allowedOrigins
-                    ? {
-                        seedValue: allowedOrigins,
-                        exampleValue: allowedOrigins,
-                    }
-                    : {}),
-            });
-            const authSecret = 'a-secret-key-1234567890';
-            configService.configFields.set('AUTH_SECRET', {
-                validator: tsCodeFragment('z.string().regex(/^[a-zA-Z0-9-_+=/]{20,}$/)'),
-                comment: 'Secret key for signing auth cookie (at least 20 alphanumeric characters)',
-                seedValue: authSecret,
-                exampleValue: authSecret,
-            });
-        }),
         appModule: createGeneratorTask({
             dependencies: {
                 paths: GENERATED_TEMPLATES.paths.provider,

package/dist/local-auth/core/generators/auth-module/generated/index.d.ts

@@ -1,5 +1,6 @@
 export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
     imports: {
+        generatorName: string;
         task: import("@baseplate-dev/sync").GeneratorTask<{
             authModuleImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
@@ -30,6 +31,25 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
         task: import("@baseplate-dev/sync").GeneratorTask<{
             localAuthCoreAuthModuleRenderers: import("@baseplate-dev/sync").ProviderExport<import("./template-renderers.js").LocalAuthCoreAuthModuleRenderers>;
         }, {
+            appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createSigner: {};
+                deriveKey: {};
+                SecretPolicy: {
+                    isTypeOnly: true;
+                };
+                Signer: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 AuthContext: {
                     isTypeOnly: true;
@@ -40,7 +60,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 AuthUserSessionInfo: {
                     isTypeOnly: true;
                 };
-                createAnonymousAuthContext: {};
                 createAuthContextFromSessionInfo: {};
                 createSystemAuthContext: {};
                 InvalidSessionError: {};
@@ -388,9 +407,15 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
             }>>;
         }, Record<never, Record<never, never>>>;
         servicesCodeVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
-            configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                getConfig: {};
-                isDevelopment: {};
+            appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createSigner: {};
+                deriveKey: {};
+                SecretPolicy: {
+                    isTypeOnly: true;
+                };
+                Signer: {
+                    isTypeOnly: true;
+                };
             }>>;
             prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 PrismaClient: {};
@@ -407,6 +432,25 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
         userSessionService: import("@baseplate-dev/core-generators").TsTemplateFile<{
             TPL_PRISMA_USER_SESSION: {};
         }, {
+            appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                createSigner: {};
+                deriveKey: {};
+                SecretPolicy: {
+                    isTypeOnly: true;
+                };
+                Signer: {
+                    isTypeOnly: true;
+                };
+            }>>;
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 AuthContext: {
                     isTypeOnly: true;
@@ -417,7 +461,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 AuthUserSessionInfo: {
                     isTypeOnly: true;
                 };
-                createAnonymousAuthContext: {};
                 createAuthContextFromSessionInfo: {};
                 createSystemAuthContext: {};
                 InvalidSessionError: {};
@@ -470,13 +513,11 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_GENERATED: {
                 };
             }>>;
         }, {
-            cookieSigner: {};
             sessionCookie: {};
             userSessionConstants: {};
             verifyRequestOrigin: {};
         }>;
         utilsGroup: {
-            cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
             sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
                 configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                     getConfig: {};

package/dist/local-auth/core/generators/auth-module/generated/template-paths.d.ts

@@ -1,6 +1,5 @@
 export interface LocalAuthCoreAuthModulePaths {
     authRoleEnum: string;
-    cookieSigner: string;
     queuesCleanupAuthVerification: string;
     queuesCleanupAuthVerificationWorker: string;
     schemaUserSessionMutations: string;

package/dist/local-auth/core/generators/auth-module/generated/template-paths.js

@@ -12,7 +12,6 @@ const localAuthCoreAuthModulePathsTask = createGeneratorTask({
             providers: {
                 localAuthCoreAuthModulePaths: {
                     authRoleEnum: `${moduleRoot}/schema/auth-role.enum.ts`,
-                    cookieSigner: `${moduleRoot}/utils/cookie-signer.ts`,
                     queuesCleanupAuthVerification: `${moduleRoot}/queues/cleanup-auth-verification.queue.ts`,
                     queuesCleanupAuthVerificationWorker: `${moduleRoot}/queues/cleanup-auth-verification.worker.ts`,
                     schemaUserSessionMutations: `${moduleRoot}/schema/user-session.mutations.ts`,

package/dist/local-auth/core/generators/auth-module/generated/template-renderers.d.ts

@@ -32,6 +32,25 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_RENDERERS: {
     task: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthModuleRenderers: import("@baseplate-dev/sync").ProviderExport<LocalAuthCoreAuthModuleRenderers>;
     }, {
+        appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createSigner: {};
+            deriveKey: {};
+            SecretPolicy: {
+                isTypeOnly: true;
+            };
+            Signer: {
+                isTypeOnly: true;
+            };
+        }>>;
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             AuthContext: {
                 isTypeOnly: true;
@@ -42,7 +61,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_RENDERERS: {
             AuthUserSessionInfo: {
                 isTypeOnly: true;
             };
-            createAnonymousAuthContext: {};
             createAuthContextFromSessionInfo: {};
             createSystemAuthContext: {};
             InvalidSessionError: {};

package/dist/local-auth/core/generators/auth-module/generated/template-renderers.js

@@ -1,5 +1,5 @@
 import { typescriptFileProvider } from '@baseplate-dev/core-generators';
-import { authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appSecretImportsProvider, appUrlsImportsProvider, authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
 import { queuesImportsProvider } from '@baseplate-dev/plugin-queue';
 import { createGeneratorTask, createProviderType } from '@baseplate-dev/sync';
 import { LOCAL_AUTH_CORE_AUTH_MODULE_PATHS } from './template-paths.js';
@@ -7,6 +7,8 @@ import { LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES } from './typed-templates.js';
 const localAuthCoreAuthModuleRenderers = createProviderType('local-auth-core-auth-module-renderers');
 const localAuthCoreAuthModuleRenderersTask = createGeneratorTask({
     dependencies: {
+        appSecretImports: appSecretImportsProvider,
+        appUrlsImports: appUrlsImportsProvider,
         authContextImports: authContextImportsProvider,
         authRolesImports: authRolesImportsProvider,
         configServiceImports: configServiceImportsProvider,
@@ -23,7 +25,7 @@ const localAuthCoreAuthModuleRenderersTask = createGeneratorTask({
     exports: {
         localAuthCoreAuthModuleRenderers: localAuthCoreAuthModuleRenderers.export(),
     },
-    run({ authContextImports, authRolesImports, configServiceImports, errorHandlerServiceImports, paths, pothosImports, prismaGeneratedImports, prismaImports, queuesImports, requestServiceContextImports, typescriptFile, userSessionTypesImports, }) {
+    run({ appSecretImports, appUrlsImports, authContextImports, authRolesImports, configServiceImports, errorHandlerServiceImports, paths, pothosImports, prismaGeneratedImports, prismaImports, queuesImports, requestServiceContextImports, typescriptFile, userSessionTypesImports, }) {
         return {
             providers: {
                 localAuthCoreAuthModuleRenderers: {
@@ -86,7 +88,7 @@ const localAuthCoreAuthModuleRenderersTask = createGeneratorTask({
                             template: LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.servicesCodeVerification,
                             destination: paths.servicesCodeVerification,
                             importMapProviders: {
-                                configServiceImports,
+                                appSecretImports,
                                 prismaGeneratedImports,
                                 prismaImports,
                             },
@@ -99,6 +101,8 @@ const localAuthCoreAuthModuleRenderersTask = createGeneratorTask({
                             template: LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES.userSessionService,
                             destination: paths.userSessionService,
                             importMapProviders: {
+                                appSecretImports,
+                                appUrlsImports,
                                 authContextImports,
                                 authRolesImports,
                                 configServiceImports,

package/dist/local-auth/core/generators/auth-module/generated/ts-import-providers.d.ts

@@ -25,6 +25,7 @@ export declare const authModuleImportsProvider: import("@baseplate-dev/sync").Pr
     validateCodeVerification: {};
 }>>;
 export declare const LOCAL_AUTH_CORE_AUTH_MODULE_IMPORTS: {
+    generatorName: string;
     task: import("@baseplate-dev/sync").GeneratorTask<{
         authModuleImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             cleanupAuthVerificationQueue: {};

package/dist/local-auth/core/generators/auth-module/generated/ts-import-providers.js

@@ -41,6 +41,7 @@ const localAuthCoreAuthModuleImportsTask = createGeneratorTask({
     },
 });
 export const LOCAL_AUTH_CORE_AUTH_MODULE_IMPORTS = {
+    generatorName: '@baseplate-dev/plugin-auth#local-auth/core/auth-module',
     task: localAuthCoreAuthModuleImportsTask,
 };
 //# sourceMappingURL=ts-import-providers.js.map

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.d.ts

@@ -91,7 +91,6 @@ export declare const moduleGroup: {
     }, Record<never, Record<never, never>>>;
 };
 export declare const utilsGroup: {
-    cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
     sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             getConfig: {};
@@ -326,9 +325,15 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
         }>>;
     }, Record<never, Record<never, never>>>;
     servicesCodeVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
-        configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            getConfig: {};
-            isDevelopment: {};
+        appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createSigner: {};
+            deriveKey: {};
+            SecretPolicy: {
+                isTypeOnly: true;
+            };
+            Signer: {
+                isTypeOnly: true;
+            };
         }>>;
         prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             PrismaClient: {};
@@ -345,6 +350,25 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
     userSessionService: import("@baseplate-dev/core-generators").TsTemplateFile<{
         TPL_PRISMA_USER_SESSION: {};
     }, {
+        appSecretImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createSigner: {};
+            deriveKey: {};
+            SecretPolicy: {
+                isTypeOnly: true;
+            };
+            Signer: {
+                isTypeOnly: true;
+            };
+        }>>;
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             AuthContext: {
                 isTypeOnly: true;
@@ -355,7 +379,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             AuthUserSessionInfo: {
                 isTypeOnly: true;
             };
-            createAnonymousAuthContext: {};
             createAuthContextFromSessionInfo: {};
             createSystemAuthContext: {};
             InvalidSessionError: {};
@@ -408,13 +431,11 @@ export declare const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES: {
             };
         }>>;
     }, {
-        cookieSigner: {};
         sessionCookie: {};
         userSessionConstants: {};
         verifyRequestOrigin: {};
     }>;
     utilsGroup: {
-        cookieSigner: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {}, Record<never, Record<never, never>>>;
         sessionCookie: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 getConfig: {};

package/dist/local-auth/core/generators/auth-module/generated/typed-templates.js

@@ -1,5 +1,5 @@
 import { createTsTemplateFile } from '@baseplate-dev/core-generators';
-import { authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appSecretImportsProvider, appUrlsImportsProvider, authContextImportsProvider, authRolesImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
 import { queuesImportsProvider } from '@baseplate-dev/plugin-queue';
 import path from 'node:path';
 const userSessionConstants = createTsTemplateFile({
@@ -143,7 +143,7 @@ const servicesAuthVerification = createTsTemplateFile({
 const servicesCodeVerification = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
-        configServiceImports: configServiceImportsProvider,
+        appSecretImports: appSecretImportsProvider,
         prismaGeneratedImports: prismaGeneratedImportsProvider,
         prismaImports: prismaImportsProvider,
     },
@@ -162,6 +162,8 @@ const servicesCodeVerification = createTsTemplateFile({
 const userSessionService = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
+        appSecretImports: appSecretImportsProvider,
+        appUrlsImports: appUrlsImportsProvider,
         authContextImports: authContextImportsProvider,
         authRolesImports: authRolesImportsProvider,
         configServiceImports: configServiceImportsProvider,
@@ -173,7 +175,6 @@ const userSessionService = createTsTemplateFile({
     name: 'user-session-service',
     projectExports: { CookieUserSessionService: { isTypeOnly: false } },
     referencedGeneratorTemplates: {
-        cookieSigner: {},
         sessionCookie: {},
         userSessionConstants: {},
         verifyRequestOrigin: {},
@@ -183,16 +184,6 @@ const userSessionService = createTsTemplateFile({
     },
     variables: { TPL_PRISMA_USER_SESSION: {} },
 });
-const cookieSigner = createTsTemplateFile({
-    fileOptions: { kind: 'singleton' },
-    group: 'utils',
-    importMapProviders: {},
-    name: 'cookie-signer',
-    source: {
-        path: path.join(import.meta.dirname, '../templates/module/utils/cookie-signer.ts'),
-    },
-    variables: {},
-});
 const sessionCookie = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     group: 'utils',
@@ -213,7 +204,7 @@ const verifyRequestOrigin = createTsTemplateFile({
     },
     variables: {},
 });
-export const utilsGroup = { cookieSigner, sessionCookie, verifyRequestOrigin };
+export const utilsGroup = { sessionCookie, verifyRequestOrigin };
 export const LOCAL_AUTH_CORE_AUTH_MODULE_TEMPLATES = {
     constantsGroup,
     moduleGroup,

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.d.ts

@@ -28,18 +28,19 @@ export declare function createCodeVerification({ type, identifier, code, expires
     id: string;
 }>;
 /**
- * Validates a short code verification without consuming it, so the caller can
- * gather any further input it needs before committing.
+ * Validates a short code verification, leaving the record in place so the
+ * caller can gather any further input it needs before committing.
  *
  * Security: a short numeric code has far less entropy than a random token, so
  * each code carries its own attempt counter alongside the endpoint rate limits.
- * The record is deleted when the code has expired or the attempt budget is
- * exhausted. Pass the returned record to {@link consumeCodeVerification} to
+ * Every call spends an attempt, including one that matches, and the record is
+ * deleted once the code has expired or a wrong guess has spent the last
+ * attempt. Pass the returned record to {@link consumeCodeVerification} to
  * complete the flow.
  *
- * Both cleanup paths delete by filter rather than by primary key: simultaneous
+ * The cleanup paths delete by filter rather than by primary key: simultaneous
  * callers can each decide the record should go, and only one of them removes a
- * row. A keyed delete would raise on the others instead of returning null.
+ * row.
  */
 export declare function validateCodeVerification({ type, identifier, code, maxAttempts, }: {
     type: string;

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.js

@@ -1,6 +1,6 @@
 // @ts-nocheck
 import { safeCompare } from '$servicesAuthVerification';
-import { getConfig } from '%configServiceImports';
+import { deriveKey } from '%appSecretImports';
 import { prisma } from '%prismaImports';
 import * as crypto from 'node:crypto';
 /**
@@ -24,7 +24,7 @@ import * as crypto from 'node:crypto';
  */
 function hashCode({ type, identifier, code, }) {
     return crypto
-        .createHmac('sha256', getConfig().AUTH_SECRET)
+        .createHmac('sha256', deriveKey('auth:code-verification:v1'))
         .update(`${type}:${identifier}:${code}`)
         .digest('hex');
 }
@@ -74,18 +74,19 @@ export async function createCodeVerification({ type, identifier, code, expiresIn
     return { id };
 }
 /**
- * Validates a short code verification without consuming it, so the caller can
- * gather any further input it needs before committing.
+ * Validates a short code verification, leaving the record in place so the
+ * caller can gather any further input it needs before committing.
  *
  * Security: a short numeric code has far less entropy than a random token, so
  * each code carries its own attempt counter alongside the endpoint rate limits.
- * The record is deleted when the code has expired or the attempt budget is
- * exhausted. Pass the returned record to {@link consumeCodeVerification} to
+ * Every call spends an attempt, including one that matches, and the record is
+ * deleted once the code has expired or a wrong guess has spent the last
+ * attempt. Pass the returned record to {@link consumeCodeVerification} to
  * complete the flow.
  *
- * Both cleanup paths delete by filter rather than by primary key: simultaneous
+ * The cleanup paths delete by filter rather than by primary key: simultaneous
  * callers can each decide the record should go, and only one of them removes a
- * row. A keyed delete would raise on the others instead of returning null.
+ * row.
  */
 export async function validateCodeVerification({ type, identifier, code, maxAttempts, }) {
     const record = await prisma.authVerification.findUnique({
@@ -98,17 +99,22 @@ export async function validateCodeVerification({ type, identifier, code, maxAtte
         await prisma.authVerification.deleteMany({ where: { id: record.id } });
         return null;
     }
-    if (safeCompare(record.value, hashCode({ type, identifier, code }))) {
-        return record;
-    }
-    // Incremented in the database rather than read-modify-written here, so
-    // simultaneous guesses each cost a point instead of sharing one.
-    const { attempts } = await prisma.authVerification.update({
-        where: { id: record.id },
+    // Simultaneous guesses serialize on this statement, so at most `maxAttempts`
+    // of them reach the comparison below.
+    const [claimed] = await prisma.authVerification.updateManyAndReturn({
+        where: { id: record.id, attempts: { lt: maxAttempts } },
         data: { attempts: { increment: 1 } },
-        select: { attempts: true },
     });
-    if (attempts >= maxAttempts) {
+    // A spent budget is not this caller's to clean up: the guess that spent it
+    // discards the record below, and a correct guess that spent it may still be
+    // holding the record for {@link consumeCodeVerification}.
+    if (!claimed) {
+        return null;
+    }
+    if (safeCompare(claimed.value, hashCode({ type, identifier, code }))) {
+        return claimed;
+    }
+    if (claimed.attempts >= maxAttempts) {
         await prisma.authVerification.deleteMany({ where: { id: record.id } });
     }
     return null;

package/dist/local-auth/core/generators/auth-module/templates/module/services/code-verification.service.ts

@@ -3,7 +3,7 @@
 import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
 
 import { safeCompare } from '$servicesAuthVerification';
-import { getConfig } from '%configServiceImports';
+import { deriveKey } from '%appSecretImports';
 import { prisma } from '%prismaImports';
 import * as crypto from 'node:crypto';
 
@@ -37,7 +37,7 @@ function hashCode({
   code: string;
 }): string {
   return crypto
-    .createHmac('sha256', getConfig().AUTH_SECRET)
+    .createHmac('sha256', deriveKey('auth:code-verification:v1'))
     .update(`${type}:${identifier}:${code}`)
     .digest('hex');
 }
@@ -101,18 +101,19 @@ export async function createCodeVerification({
 }
 
 /**
- * Validates a short code verification without consuming it, so the caller can
- * gather any further input it needs before committing.
+ * Validates a short code verification, leaving the record in place so the
+ * caller can gather any further input it needs before committing.
  *
  * Security: a short numeric code has far less entropy than a random token, so
  * each code carries its own attempt counter alongside the endpoint rate limits.
- * The record is deleted when the code has expired or the attempt budget is
- * exhausted. Pass the returned record to {@link consumeCodeVerification} to
+ * Every call spends an attempt, including one that matches, and the record is
+ * deleted once the code has expired or a wrong guess has spent the last
+ * attempt. Pass the returned record to {@link consumeCodeVerification} to
  * complete the flow.
  *
- * Both cleanup paths delete by filter rather than by primary key: simultaneous
+ * The cleanup paths delete by filter rather than by primary key: simultaneous
  * callers can each decide the record should go, and only one of them removes a
- * row. A keyed delete would raise on the others instead of returning null.
+ * row.
  */
 export async function validateCodeVerification({
   type,
@@ -138,19 +139,25 @@ export async function validateCodeVerification({
     return null;
   }
 
-  if (safeCompare(record.value, hashCode({ type, identifier, code }))) {
-    return record;
-  }
-
-  // Incremented in the database rather than read-modify-written here, so
-  // simultaneous guesses each cost a point instead of sharing one.
-  const { attempts } = await prisma.authVerification.update({
-    where: { id: record.id },
+  // Simultaneous guesses serialize on this statement, so at most `maxAttempts`
+  // of them reach the comparison below.
+  const [claimed] = await prisma.authVerification.updateManyAndReturn({
+    where: { id: record.id, attempts: { lt: maxAttempts } },
     data: { attempts: { increment: 1 } },
-    select: { attempts: true },
   });
 
-  if (attempts >= maxAttempts) {
+  // A spent budget is not this caller's to clean up: the guess that spent it
+  // discards the record below, and a correct guess that spent it may still be
+  // holding the record for {@link consumeCodeVerification}.
+  if (!claimed) {
+    return null;
+  }
+
+  if (safeCompare(claimed.value, hashCode({ type, identifier, code }))) {
+    return claimed;
+  }
+
+  if (claimed.attempts >= maxAttempts) {
     await prisma.authVerification.deleteMany({ where: { id: record.id } });
   }