@baseplate-dev/plugin-auth 0.6.18 → 0.6.19

package/dist/local-auth/core/generators/auth-email-password/generated/index.d.ts

@@ -1,9 +1,9 @@
 export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
     imports: {
+        generatorName: string;
         task: import("@baseplate-dev/sync").GeneratorTask<{
             authEmailPasswordImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 authenticateUserWithEmailAndPassword: {};
-                cleanupExpiredPasswordResetTokens: {};
                 completePasswordReset: {};
                 createUserWithEmailAndPassword: {};
                 PASSWORD_MAX_LENGTH: {};
@@ -30,6 +30,15 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
         task: import("@baseplate-dev/sync").GeneratorTask<{
             localAuthCoreAuthEmailPasswordRenderers: import("@baseplate-dev/sync").ProviderExport<import("./template-renderers.js").LocalAuthCoreAuthEmailPasswordRenderers>;
         }, {
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
@@ -143,9 +152,19 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
                 servicesUserPassword: {};
             }>;
             servicesPasswordReset: import("@baseplate-dev/core-generators").TsTemplateFile<{
+                TPL_AUTH_WEB_APP: {};
                 TPL_PASSWORD_CHANGED_EMAIL: {};
                 TPL_PASSWORD_RESET_EMAIL: {};
             }, {
+                appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                    getApiUrl: {};
+                    getWebAppForUrl: {};
+                    getWebOrigins: {};
+                    getWebUrl: {};
+                    WebAppName: {
+                        isTypeOnly: true;
+                    };
+                }>>;
                 authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                     cleanupAuthVerificationQueue: {};
                     cleanupAuthVerificationWorker: {};
@@ -158,10 +177,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
                     validateAuthVerification: {};
                     validateCodeVerification: {};
                 }>>;
-                configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                    getConfig: {};
-                    isDevelopment: {};
-                }>>;
                 errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                     BadRequestError: {};
                     ForbiddenError: {};
@@ -389,7 +404,17 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
         }>;
         servicesEmailVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{
             TPL_ACCOUNT_VERIFICATION_EMAIL: {};
+            TPL_AUTH_WEB_APP: {};
         }, {
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
@@ -402,10 +427,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
                 validateAuthVerification: {};
                 validateCodeVerification: {};
             }>>;
-            configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                getConfig: {};
-                isDevelopment: {};
-            }>>;
             errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 BadRequestError: {};
                 ForbiddenError: {};
@@ -447,8 +468,18 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
             constantsPassword: {};
         }>;
         servicesInvite: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_AUTH_WEB_APP: {};
             TPL_INVITE_EMAIL: {};
         }, {
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
@@ -461,10 +492,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED: {
                 validateAuthVerification: {};
                 validateCodeVerification: {};
             }>>;
-            configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                getConfig: {};
-                isDevelopment: {};
-            }>>;
             errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 BadRequestError: {};
                 ForbiddenError: {};

package/dist/local-auth/core/generators/auth-email-password/generated/template-renderers.d.ts

@@ -32,6 +32,15 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_RENDERERS: {
     task: import("@baseplate-dev/sync").GeneratorTask<{
         localAuthCoreAuthEmailPasswordRenderers: import("@baseplate-dev/sync").ProviderExport<LocalAuthCoreAuthEmailPasswordRenderers>;
     }, {
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};

package/dist/local-auth/core/generators/auth-email-password/generated/template-renderers.js

@@ -1,5 +1,5 @@
 import { typescriptFileProvider } from '@baseplate-dev/core-generators';
-import { configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appUrlsImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
 import { rateLimitImportsProvider } from '@baseplate-dev/plugin-rate-limit';
 import { createGeneratorTask, createProviderType } from '@baseplate-dev/sync';
 import { authModuleImportsProvider } from '#src/local-auth/core/generators/auth-module/generated/ts-import-providers.js';
@@ -8,6 +8,7 @@ import { LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES } from './typed-templates
 const localAuthCoreAuthEmailPasswordRenderers = createProviderType('local-auth-core-auth-email-password-renderers');
 const localAuthCoreAuthEmailPasswordRenderersTask = createGeneratorTask({
     dependencies: {
+        appUrlsImports: appUrlsImportsProvider,
         authModuleImports: authModuleImportsProvider,
         configServiceImports: configServiceImportsProvider,
         errorHandlerServiceImports: errorHandlerServiceImportsProvider,
@@ -24,7 +25,7 @@ const localAuthCoreAuthEmailPasswordRenderersTask = createGeneratorTask({
     exports: {
         localAuthCoreAuthEmailPasswordRenderers: localAuthCoreAuthEmailPasswordRenderers.export(),
     },
-    run({ authModuleImports, configServiceImports, errorHandlerServiceImports, passwordHasherServiceImports, paths, pothosImports, prismaGeneratedImports, prismaImports, rateLimitImports, requestServiceContextImports, typescriptFile, userSessionTypesImports, }) {
+    run({ appUrlsImports, authModuleImports, configServiceImports, errorHandlerServiceImports, passwordHasherServiceImports, paths, pothosImports, prismaGeneratedImports, prismaImports, rateLimitImports, requestServiceContextImports, typescriptFile, userSessionTypesImports, }) {
         return {
             providers: {
                 localAuthCoreAuthEmailPasswordRenderers: {
@@ -40,8 +41,8 @@ const localAuthCoreAuthEmailPasswordRenderersTask = createGeneratorTask({
                             group: LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES.moduleGroup,
                             paths,
                             importMapProviders: {
+                                appUrlsImports,
                                 authModuleImports,
-                                configServiceImports,
                                 errorHandlerServiceImports,
                                 passwordHasherServiceImports,
                                 pothosImports,
@@ -112,8 +113,8 @@ const localAuthCoreAuthEmailPasswordRenderersTask = createGeneratorTask({
                             template: LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES.servicesEmailVerification,
                             destination: paths.servicesEmailVerification,
                             importMapProviders: {
+                                appUrlsImports,
                                 authModuleImports,
-                                configServiceImports,
                                 errorHandlerServiceImports,
                                 prismaImports,
                                 rateLimitImports,
@@ -128,8 +129,8 @@ const localAuthCoreAuthEmailPasswordRenderersTask = createGeneratorTask({
                             template: LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES.servicesInvite,
                             destination: paths.servicesInvite,
                             importMapProviders: {
+                                appUrlsImports,
                                 authModuleImports,
-                                configServiceImports,
                                 errorHandlerServiceImports,
                                 passwordHasherServiceImports,
                                 prismaGeneratedImports,

package/dist/local-auth/core/generators/auth-email-password/generated/ts-import-providers.d.ts

@@ -1,7 +1,6 @@
 import type { TsImportMapProviderFromSchema } from '@baseplate-dev/core-generators';
 export declare const authEmailPasswordImportsSchema: {
     authenticateUserWithEmailAndPassword: {};
-    cleanupExpiredPasswordResetTokens: {};
     completePasswordReset: {};
     createUserWithEmailAndPassword: {};
     PASSWORD_MAX_LENGTH: {};
@@ -14,7 +13,6 @@ export declare const authEmailPasswordImportsSchema: {
 export type AuthEmailPasswordImportsProvider = TsImportMapProviderFromSchema<typeof authEmailPasswordImportsSchema>;
 export declare const authEmailPasswordImportsProvider: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
     authenticateUserWithEmailAndPassword: {};
-    cleanupExpiredPasswordResetTokens: {};
     completePasswordReset: {};
     createUserWithEmailAndPassword: {};
     PASSWORD_MAX_LENGTH: {};
@@ -25,10 +23,10 @@ export declare const authEmailPasswordImportsProvider: import("@baseplate-dev/sy
     validatePasswordResetToken: {};
 }>>;
 export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_IMPORTS: {
+    generatorName: string;
     task: import("@baseplate-dev/sync").GeneratorTask<{
         authEmailPasswordImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             authenticateUserWithEmailAndPassword: {};
-            cleanupExpiredPasswordResetTokens: {};
             completePasswordReset: {};
             createUserWithEmailAndPassword: {};
             PASSWORD_MAX_LENGTH: {};

package/dist/local-auth/core/generators/auth-email-password/generated/ts-import-providers.js

@@ -3,7 +3,6 @@ import { createGeneratorTask, createReadOnlyProviderType, } from '@baseplate-dev
 import { LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_PATHS } from './template-paths.js';
 export const authEmailPasswordImportsSchema = createTsImportMapSchema({
     authenticateUserWithEmailAndPassword: {},
-    cleanupExpiredPasswordResetTokens: {},
     completePasswordReset: {},
     createUserWithEmailAndPassword: {},
     PASSWORD_MAX_LENGTH: {},
@@ -26,7 +25,6 @@ const localAuthCoreAuthEmailPasswordImportsTask = createGeneratorTask({
             providers: {
                 authEmailPasswordImports: createTsImportMap(authEmailPasswordImportsSchema, {
                     authenticateUserWithEmailAndPassword: paths.servicesUserPassword,
-                    cleanupExpiredPasswordResetTokens: paths.servicesPasswordReset,
                     completePasswordReset: paths.servicesPasswordReset,
                     createUserWithEmailAndPassword: paths.servicesUserPassword,
                     PASSWORD_MAX_LENGTH: paths.constantsPassword,
@@ -41,6 +39,7 @@ const localAuthCoreAuthEmailPasswordImportsTask = createGeneratorTask({
     },
 });
 export const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_IMPORTS = {
+    generatorName: '@baseplate-dev/plugin-auth#local-auth/core/auth-email-password',
     task: localAuthCoreAuthEmailPasswordImportsTask,
 };
 //# sourceMappingURL=ts-import-providers.js.map

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.d.ts

@@ -31,9 +31,19 @@ export declare const moduleGroup: {
         servicesUserPassword: {};
     }>;
     servicesPasswordReset: import("@baseplate-dev/core-generators").TsTemplateFile<{
+        TPL_AUTH_WEB_APP: {};
         TPL_PASSWORD_CHANGED_EMAIL: {};
         TPL_PASSWORD_RESET_EMAIL: {};
     }, {
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
@@ -46,10 +56,6 @@ export declare const moduleGroup: {
             validateAuthVerification: {};
             validateCodeVerification: {};
         }>>;
-        configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            getConfig: {};
-            isDevelopment: {};
-        }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
             ForbiddenError: {};
@@ -193,9 +199,19 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             servicesUserPassword: {};
         }>;
         servicesPasswordReset: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_AUTH_WEB_APP: {};
             TPL_PASSWORD_CHANGED_EMAIL: {};
             TPL_PASSWORD_RESET_EMAIL: {};
         }, {
+            appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                getApiUrl: {};
+                getWebAppForUrl: {};
+                getWebOrigins: {};
+                getWebUrl: {};
+                WebAppName: {
+                    isTypeOnly: true;
+                };
+            }>>;
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 cleanupAuthVerificationQueue: {};
                 cleanupAuthVerificationWorker: {};
@@ -208,10 +224,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
                 validateAuthVerification: {};
                 validateCodeVerification: {};
             }>>;
-            configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                getConfig: {};
-                isDevelopment: {};
-            }>>;
             errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 BadRequestError: {};
                 ForbiddenError: {};
@@ -439,7 +451,17 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
     }>;
     servicesEmailVerification: import("@baseplate-dev/core-generators").TsTemplateFile<{
         TPL_ACCOUNT_VERIFICATION_EMAIL: {};
+        TPL_AUTH_WEB_APP: {};
     }, {
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
@@ -452,10 +474,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             validateAuthVerification: {};
             validateCodeVerification: {};
         }>>;
-        configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            getConfig: {};
-            isDevelopment: {};
-        }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
             ForbiddenError: {};
@@ -497,8 +515,18 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
         constantsPassword: {};
     }>;
     servicesInvite: import("@baseplate-dev/core-generators").TsTemplateFile<{
+        TPL_AUTH_WEB_APP: {};
         TPL_INVITE_EMAIL: {};
     }, {
+        appUrlsImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getApiUrl: {};
+            getWebAppForUrl: {};
+            getWebOrigins: {};
+            getWebUrl: {};
+            WebAppName: {
+                isTypeOnly: true;
+            };
+        }>>;
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             cleanupAuthVerificationQueue: {};
             cleanupAuthVerificationWorker: {};
@@ -511,10 +539,6 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             validateAuthVerification: {};
             validateCodeVerification: {};
         }>>;
-        configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            getConfig: {};
-            isDevelopment: {};
-        }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
             ForbiddenError: {};

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.js

@@ -1,5 +1,5 @@
 import { createTsTemplateFile } from '@baseplate-dev/core-generators';
-import { configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
+import { appUrlsImportsProvider, configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
 import { rateLimitImportsProvider } from '@baseplate-dev/plugin-rate-limit';
 import path from 'node:path';
 import { authModuleImportsProvider } from '#src/local-auth/core/generators/auth-module/generated/ts-import-providers.js';
@@ -60,8 +60,8 @@ const servicesPasswordReset = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     group: 'module',
     importMapProviders: {
+        appUrlsImports: appUrlsImportsProvider,
         authModuleImports: authModuleImportsProvider,
-        configServiceImports: configServiceImportsProvider,
         errorHandlerServiceImports: errorHandlerServiceImportsProvider,
         passwordHasherServiceImports: passwordHasherServiceImportsProvider,
         prismaImports: prismaImportsProvider,
@@ -70,7 +70,6 @@ const servicesPasswordReset = createTsTemplateFile({
     },
     name: 'services-password-reset',
     projectExports: {
-        cleanupExpiredPasswordResetTokens: { isTypeOnly: false },
         completePasswordReset: { isTypeOnly: false },
         requestPasswordReset: { isTypeOnly: false },
         validatePasswordResetToken: { isTypeOnly: false },
@@ -82,7 +81,11 @@ const servicesPasswordReset = createTsTemplateFile({
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/password-reset.service.ts'),
     },
-    variables: { TPL_PASSWORD_CHANGED_EMAIL: {}, TPL_PASSWORD_RESET_EMAIL: {} },
+    variables: {
+        TPL_AUTH_WEB_APP: {},
+        TPL_PASSWORD_CHANGED_EMAIL: {},
+        TPL_PASSWORD_RESET_EMAIL: {},
+    },
 });
 const servicesUserPassword = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
@@ -175,8 +178,8 @@ const servicesEmailOtp = createTsTemplateFile({
 const servicesEmailVerification = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
+        appUrlsImports: appUrlsImportsProvider,
         authModuleImports: authModuleImportsProvider,
-        configServiceImports: configServiceImportsProvider,
         errorHandlerServiceImports: errorHandlerServiceImportsProvider,
         prismaImports: prismaImportsProvider,
         rateLimitImports: rateLimitImportsProvider,
@@ -187,13 +190,13 @@ const servicesEmailVerification = createTsTemplateFile({
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/email-verification.service.ts'),
     },
-    variables: { TPL_ACCOUNT_VERIFICATION_EMAIL: {} },
+    variables: { TPL_ACCOUNT_VERIFICATION_EMAIL: {}, TPL_AUTH_WEB_APP: {} },
 });
 const servicesInvite = createTsTemplateFile({
     fileOptions: { kind: 'singleton' },
     importMapProviders: {
+        appUrlsImports: appUrlsImportsProvider,
         authModuleImports: authModuleImportsProvider,
-        configServiceImports: configServiceImportsProvider,
         errorHandlerServiceImports: errorHandlerServiceImportsProvider,
         passwordHasherServiceImports: passwordHasherServiceImportsProvider,
         prismaGeneratedImports: prismaGeneratedImportsProvider,
@@ -206,7 +209,7 @@ const servicesInvite = createTsTemplateFile({
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/invite.service.ts'),
     },
-    variables: { TPL_INVITE_EMAIL: {} },
+    variables: { TPL_AUTH_WEB_APP: {}, TPL_INVITE_EMAIL: {} },
 });
 export const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES = {
     constantsOtp,

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.js

@@ -1,7 +1,7 @@
 // @ts-nocheck
 import { EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC } from '$constantsPassword';
+import { getWebAppForUrl, getWebUrl } from '%appUrlsImports';
 import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
-import { getConfig } from '%configServiceImports';
 import { BadRequestError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { memoizeRateLimiter } from '%rateLimitImports';
@@ -49,8 +49,7 @@ export async function requestEmailVerification({ userId, context, }) {
         userId: user.id,
         expiresInSec: EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC,
     });
-    // Construct verification URL using configured domain
-    const verifyLink = `${getConfig().AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+    const verifyLink = getWebUrl(getWebAppForUrl(context.reqInfo.headers.origin) ?? TPL_AUTH_WEB_APP, `/auth/verify-email?token=${encodeURIComponent(token)}`);
     await services.email.send(TPL_ACCOUNT_VERIFICATION_EMAIL, {
         to: user.email,
         data: { verifyLink },

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.ts

@@ -6,11 +6,11 @@ import type {
 } from '%requestServiceContextImports';
 
 import { EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC } from '$constantsPassword';
+import { getWebAppForUrl, getWebUrl } from '%appUrlsImports';
 import {
   createAuthVerification,
   validateAuthVerification,
 } from '%authModuleImports';
-import { getConfig } from '%configServiceImports';
 import { BadRequestError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { memoizeRateLimiter } from '%rateLimitImports';
@@ -90,8 +90,10 @@ export async function requestEmailVerification({
     expiresInSec: EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC,
   });
 
-  // Construct verification URL using configured domain
-  const verifyLink = `${getConfig().AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+  const verifyLink = getWebUrl(
+    getWebAppForUrl(context.reqInfo.headers.origin) ?? TPL_AUTH_WEB_APP,
+    `/auth/verify-email?token=${encodeURIComponent(token)}`,
+  );
 
   await services.email.send(TPL_ACCOUNT_VERIFICATION_EMAIL, {
     to: user.email,

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/invite.service.js

@@ -1,7 +1,7 @@
 // @ts-nocheck
 import { AUTH_TOKEN_MAX_LENGTH, INVITE_TOKEN_EXPIRY_SEC, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from '$constantsPassword';
+import { getWebUrl } from '%appUrlsImports';
 import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
-import { getConfig } from '%configServiceImports';
 import { BadRequestError, handleZodRequestValidationError, NotFoundError, } from '%errorHandlerServiceImports';
 import { createPasswordHash } from '%passwordHasherServiceImports';
 import { prisma } from '%prismaImports';
@@ -38,7 +38,7 @@ export async function inviteUser({ userId, context, }) {
         userId: user.id,
         expiresInSec: INVITE_TOKEN_EXPIRY_SEC,
     });
-    const acceptLink = `${getConfig().AUTH_FRONTEND_URL}/auth/accept-invite?token=${encodeURIComponent(token)}`;
+    const acceptLink = getWebUrl(TPL_AUTH_WEB_APP, `/auth/accept-invite?token=${encodeURIComponent(token)}`);
     await services.email.send(TPL_INVITE_EMAIL, {
         to: user.email,
         data: { acceptLink },
@@ -105,27 +105,31 @@ export async function acceptInvite({ token: rawToken, newPassword: rawNewPasswor
     if (!user.email) {
         throw new BadRequestError('User has no email', 'user-has-no-email');
     }
+    // The invite token outlives the check in `inviteUser`, so the user may have
+    // registered in the meantime.
+    const existingAccount = await prisma.userAccount.findUnique({
+        where: {
+            accountId_providerId: {
+                accountId: user.email,
+                providerId: PROVIDER_ID,
+            },
+        },
+    });
+    if (existingAccount) {
+        throw new BadRequestError('User already has a password set', 'user-already-has-account');
+    }
     const passwordHash = await createPasswordHash(newPassword);
     await prisma.$transaction([
         prisma.authVerification.deleteMany({
             where: { type: INVITE_TYPE, userId: user.id },
         }),
-        prisma.userAccount.upsert({
-            where: {
-                accountId_providerId: {
-                    accountId: user.email,
-                    providerId: PROVIDER_ID,
-                },
-            },
-            create: {
+        prisma.userAccount.create({
+            data: {
                 userId: user.id,
                 accountId: user.email,
                 providerId: PROVIDER_ID,
                 password: passwordHash,
             },
-            update: {
-                password: passwordHash,
-            },
         }),
         prisma.user.update({
             where: { id: user.id },

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/invite.service.ts

@@ -13,11 +13,11 @@ import {
   PASSWORD_MAX_LENGTH,
   PASSWORD_MIN_LENGTH,
 } from '$constantsPassword';
+import { getWebUrl } from '%appUrlsImports';
 import {
   createAuthVerification,
   validateAuthVerification,
 } from '%authModuleImports';
-import { getConfig } from '%configServiceImports';
 import {
   BadRequestError,
   handleZodRequestValidationError,
@@ -76,7 +76,10 @@ export async function inviteUser({
     expiresInSec: INVITE_TOKEN_EXPIRY_SEC,
   });
 
-  const acceptLink = `${getConfig().AUTH_FRONTEND_URL}/auth/accept-invite?token=${encodeURIComponent(token)}`;
+  const acceptLink = getWebUrl(
+    TPL_AUTH_WEB_APP,
+    `/auth/accept-invite?token=${encodeURIComponent(token)}`,
+  );
 
   await services.email.send(TPL_INVITE_EMAIL, {
     to: user.email,
@@ -171,28 +174,37 @@ export async function acceptInvite({
     throw new BadRequestError('User has no email', 'user-has-no-email');
   }
 
+  // The invite token outlives the check in `inviteUser`, so the user may have
+  // registered in the meantime.
+  const existingAccount = await prisma.userAccount.findUnique({
+    where: {
+      accountId_providerId: {
+        accountId: user.email,
+        providerId: PROVIDER_ID,
+      },
+    },
+  });
+
+  if (existingAccount) {
+    throw new BadRequestError(
+      'User already has a password set',
+      'user-already-has-account',
+    );
+  }
+
   const passwordHash = await createPasswordHash(newPassword);
 
   await prisma.$transaction([
     prisma.authVerification.deleteMany({
       where: { type: INVITE_TYPE, userId: user.id },
     }),
-    prisma.userAccount.upsert({
-      where: {
-        accountId_providerId: {
-          accountId: user.email,
-          providerId: PROVIDER_ID,
-        },
-      },
-      create: {
+    prisma.userAccount.create({
+      data: {
         userId: user.id,
         accountId: user.email,
         providerId: PROVIDER_ID,
         password: passwordHash,
       },
-      update: {
-        password: passwordHash,
-      },
     }),
     prisma.user.update({
       where: { id: user.id },

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.js

@@ -1,8 +1,8 @@
 // @ts-nocheck
 import { AUTH_TOKEN_MAX_LENGTH, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PASSWORD_RESET_TOKEN_EXPIRY_SEC, } from '$constantsPassword';
 import { resetLoginRateLimits } from '$servicesUserPassword';
+import { getWebAppForUrl, getWebUrl } from '%appUrlsImports';
 import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
-import { getConfig } from '%configServiceImports';
 import { BadRequestError, handleZodRequestValidationError, } from '%errorHandlerServiceImports';
 import { createPasswordHash } from '%passwordHasherServiceImports';
 import { prisma } from '%prismaImports';
@@ -58,8 +58,7 @@ export async function requestPasswordReset({ email: rawEmail, context, }) {
             userId: user.id,
             expiresInSec: PASSWORD_RESET_TOKEN_EXPIRY_SEC,
         });
-        // Construct reset URL using configured domain
-        const resetLink = `${getConfig().AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
+        const resetLink = getWebUrl(getWebAppForUrl(context.reqInfo.headers.origin) ?? TPL_AUTH_WEB_APP, `/auth/reset-password?token=${encodeURIComponent(token)}`);
         // Send email asynchronously (queue-based)
         await services.email.send(TPL_PASSWORD_RESET_EMAIL, {
             to: user.email,

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.ts

@@ -9,11 +9,11 @@ import {
   PASSWORD_RESET_TOKEN_EXPIRY_SEC,
 } from '$constantsPassword';
 import { resetLoginRateLimits } from '$servicesUserPassword';
+import { getWebAppForUrl, getWebUrl } from '%appUrlsImports';
 import {
   createAuthVerification,
   validateAuthVerification,
 } from '%authModuleImports';
-import { getConfig } from '%configServiceImports';
 import {
   BadRequestError,
   handleZodRequestValidationError,
@@ -108,8 +108,10 @@ export async function requestPasswordReset({
       expiresInSec: PASSWORD_RESET_TOKEN_EXPIRY_SEC,
     });
 
-    // Construct reset URL using configured domain
-    const resetLink = `${getConfig().AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
+    const resetLink = getWebUrl(
+      getWebAppForUrl(context.reqInfo.headers.origin) ?? TPL_AUTH_WEB_APP,
+      `/auth/reset-password?token=${encodeURIComponent(token)}`,
+    );
 
     // Send email asynchronously (queue-based)
     await services.email.send(TPL_PASSWORD_RESET_EMAIL, {