@baseplate-dev/plugin-auth 1.0.6 → 1.0.8

package/dist/auth/core/components/role-editor-form/role-editor-form.js

@@ -0,0 +1,54 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { authRoleEntityType } from '@baseplate-dev/project-builder-lib';
+import { Badge, Button, RecordView, RecordViewActions, RecordViewItem, RecordViewItemList, SectionListSection, SectionListSectionContent, SectionListSectionDescription, SectionListSectionHeader, SectionListSectionTitle, useConfirmDialog, } from '@baseplate-dev/ui-components';
+import { useFieldArray } from '@hookform/lenses/rhf';
+import { useState } from 'react';
+import { useWatch } from 'react-hook-form';
+import { MdAdd, MdDeleteOutline, MdEdit } from 'react-icons/md';
+import { RoleDialog } from './role-dialog.js';
+export function RoleEditorForm({ className, control, }) {
+    const { requestConfirm } = useConfirmDialog();
+    const { append, update, remove } = useFieldArray({
+        control,
+        name: 'roles',
+    });
+    const [roleToEdit, setRoleToEdit] = useState();
+    const [isEditing, setIsEditing] = useState(false);
+    const roles = useWatch({ control, name: 'roles' });
+    function handleSaveRole(newRole) {
+        const existingIndex = roles.findIndex((role) => role.id === newRole.id);
+        if (existingIndex === -1) {
+            append(newRole);
+        }
+        else {
+            update(existingIndex, newRole);
+        }
+    }
+    function handleDeleteRole(roleIdx) {
+        const role = roles[roleIdx];
+        if (!role)
+            return;
+        requestConfirm({
+            title: 'Delete Role',
+            content: `Are you sure you want to delete the role "${role.name}"?`,
+            onConfirm: () => {
+                remove(roleIdx);
+            },
+        });
+    }
+    return (_jsxs(SectionListSection, { className: className, children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "User Roles" }), _jsx(SectionListSectionDescription, { children: "Define roles for your application. Default roles are protected and cannot be removed." })] }), _jsxs(SectionListSectionContent, { className: "auth:space-y-4", children: [roles.map((role, roleIdx) => (_jsxs(RecordView, { children: [_jsxs(RecordViewItemList, { children: [_jsx(RecordViewItem, { title: "Name", children: _jsx("div", { className: "auth:flex auth:items-center auth:gap-2", children: _jsx("span", { children: role.name }) }) }), _jsx(RecordViewItem, { title: "Description", children: role.comment.trim() || (_jsx("span", { className: "auth:text-muted-foreground", children: "No description" })) })] }), _jsxs(RecordViewActions, { children: [role.builtIn && _jsx(Badge, { variant: "secondary", children: "Default Role" }), !role.builtIn && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "ghost", size: "icon", title: "Edit", "aria-label": "Edit role", onClick: () => {
+                                                    setRoleToEdit(role);
+                                                    setIsEditing(true);
+                                                }, children: _jsx(MdEdit, {}) }), _jsx(Button, { variant: "ghostDestructive", size: "icon", title: "Delete", "aria-label": "Delete role", onClick: () => {
+                                                    handleDeleteRole(roleIdx);
+                                                }, children: _jsx(MdDeleteOutline, {}) })] }))] })] }, role.id))), _jsx(RoleDialog, { open: isEditing, onOpenChange: setIsEditing, role: roleToEdit, isNew: roleToEdit ? !roles.some((r) => r.id === roleToEdit.id) : true, onSave: handleSaveRole }), _jsxs(Button, { variant: "secondary", size: "sm", onClick: () => {
+                            setRoleToEdit({
+                                id: authRoleEntityType.generateNewId(),
+                                name: '',
+                                comment: '',
+                                builtIn: false,
+                            });
+                            setIsEditing(true);
+                        }, children: [_jsx(MdAdd, {}), "Add Role"] })] })] }));
+}
+//# sourceMappingURL=role-editor-form.js.map

package/dist/auth/core/node.d.ts

@@ -1,5 +1,5 @@
-declare const _default: import("@baseplate-dev/project-builder-lib").PluginPlatformModule<{
-    appCompiler: import("@baseplate-dev/project-builder-lib").PluginSpecWithInitializer<import("@baseplate-dev/project-builder-lib").AppCompilerSpec>;
-}, {}>;
+declare const _default: import("@baseplate-dev/project-builder-lib").PluginModule<{
+    [x: string]: import("@baseplate-dev/project-builder-lib").PluginSpec<object, object>;
+}>;
 export default _default;
 //# sourceMappingURL=node.d.ts.map

package/dist/auth/core/node.js

@@ -1,58 +1,47 @@
-import { appModuleGenerator, passwordHasherServiceGenerator, } from '@baseplate-dev/fastify-generators';
-import { appCompilerSpec, backendAppEntryType, createPlatformPluginExport, PluginUtils, webAppEntryType, } from '@baseplate-dev/project-builder-lib';
-import { createCommonBackendAuthModuleGenerators, createCommonBackendAuthRootGenerators, createCommonWebAuthGenerators, } from '#src/common/index.js';
-import { authApolloGenerator } from './generators/auth-apollo/auth-apollo.generator.js';
-import { authEmailPasswordGenerator } from './generators/auth-email-password/auth-email-password.generator.js';
-import { authHooksGenerator } from './generators/auth-hooks/auth-hooks.generator.js';
-import { authRoutesGenerator } from './generators/auth-routes/auth-routes.generator.js';
-import { authModuleGenerator, reactAuthGenerator } from './generators/index.js';
-import { reactSessionGenerator } from './generators/react-session/react-session.generator.js';
-export default createPlatformPluginExport({
+import { authContextGenerator, authPluginGenerator, authRolesGenerator, pothosAuthGenerator, prismaAuthorizerUtilsGenerator, prismaQueryFilterUtilsGenerator, userSessionTypesGenerator, } from '@baseplate-dev/fastify-generators';
+import { appCompilerSpec, backendAppEntryType, createPluginModule, PluginUtils, webAppEntryType, } from '@baseplate-dev/project-builder-lib';
+import { authErrorsGenerator, authIdentifyGenerator, } from '@baseplate-dev/react-generators';
+export default createPluginModule({
+    name: 'node',
     dependencies: {
         appCompiler: appCompilerSpec,
     },
-    exports: {},
-    initialize: ({ appCompiler }, { pluginId }) => {
+    initialize: ({ appCompiler }, { pluginKey }) => {
         // register backend compiler
-        appCompiler.registerAppCompiler({
-            pluginId,
+        appCompiler.compilers.push({
+            pluginKey,
             appType: backendAppEntryType,
-            compile: ({ projectDefinition, definitionContainer, appCompiler }) => {
-                const auth = PluginUtils.configByIdOrThrow(projectDefinition, pluginId);
+            compile: ({ projectDefinition, appCompiler }) => {
+                const auth = PluginUtils.configByKeyOrThrow(projectDefinition, pluginKey);
                 appCompiler.addChildrenToFeature(auth.authFeatureRef, {
-                    ...createCommonBackendAuthModuleGenerators({ roles: auth.roles }),
-                    authModule: authModuleGenerator({
-                        userSessionModelName: definitionContainer.nameFromId(auth.modelRefs.userSession),
-                        userModelName: definitionContainer.nameFromId(auth.modelRefs.user),
-                    }),
-                    emailPassword: appModuleGenerator({
-                        id: 'email-password',
-                        name: 'password',
-                        children: {
-                            module: authEmailPasswordGenerator({}),
-                            hasher: passwordHasherServiceGenerator({}),
-                        },
+                    authContext: authContextGenerator({}),
+                    authPlugin: authPluginGenerator({}),
+                    authRoles: authRolesGenerator({
+                        roles: auth.roles.map((r) => ({
+                            name: r.name,
+                            comment: r.comment,
+                            builtIn: r.builtIn,
+                            autoAssigned: r.autoAssigned,
+                        })),
                     }),
+                    userSessionTypes: userSessionTypesGenerator({}),
+                });
+                appCompiler.addRootChildren({
+                    pothosAuth: pothosAuthGenerator({}),
+                    authorizerUtils: prismaAuthorizerUtilsGenerator({}),
+                    queryFilterUtils: prismaQueryFilterUtilsGenerator({}),
                 });
-                appCompiler.addRootChildren(createCommonBackendAuthRootGenerators());
             },
-        });
-        // register web compiler
-        appCompiler.registerAppCompiler({
-            pluginId,
+        }, {
+            pluginKey,
             appType: webAppEntryType,
             compile: ({ appCompiler }) => {
                 appCompiler.addRootChildren({
-                    ...createCommonWebAuthGenerators(),
-                    authApollo: authApolloGenerator({}),
-                    reactAuth: reactAuthGenerator({}),
-                    authHooks: authHooksGenerator({}),
-                    reactSession: reactSessionGenerator({}),
-                    authRoutes: authRoutesGenerator({}),
+                    authIdentify: authIdentifyGenerator({}),
+                    authErrors: authErrorsGenerator({}),
                 });
             },
         });
-        return {};
     },
 });
 //# sourceMappingURL=node.js.map

package/dist/auth/core/schema/migrations.d.ts

@@ -0,0 +1,3 @@
+import type { PluginConfigMigration } from '@baseplate-dev/project-builder-lib';
+export declare const AUTH_PLUGIN_CONFIG_MIGRATIONS: PluginConfigMigration[];
+//# sourceMappingURL=migrations.d.ts.map

package/dist/auth/core/schema/migrations.js

@@ -0,0 +1,54 @@
+import { featureEntityType } from '@baseplate-dev/project-builder-lib';
+export const AUTH_PLUGIN_CONFIG_MIGRATIONS = [
+    {
+        name: 'add-accounts-feature-ref',
+        version: 1,
+        // Plugin migrations run on raw serialized JSON where withRef fields store
+        // feature NAME PATHS (e.g. "accounts/auth"), not IDs. Values must be set to
+        // names so deserialization can resolve them to feature IDs.
+        migrate: (config, projectDefinition) => {
+            const typedConfig = config;
+            const def = projectDefinition;
+            const features = def.features ?? [];
+            // Find or plan to create the three features needed for the new hierarchy:
+            //   accounts        (parent, no code)
+            //   accounts/auth   (auth infrastructure)
+            //   accounts/users  (user models)
+            const accountsFeature = features.find((f) => f.name === 'accounts' && !f.parentRef);
+            const accountsId = accountsFeature?.id ?? featureEntityType.generateNewId();
+            const accountsAuthFeature = features.find((f) => f.name === 'accounts/auth');
+            const accountsAuthId = accountsAuthFeature?.id ?? featureEntityType.generateNewId();
+            const accountsUsersFeature = features.find((f) => f.name === 'accounts/users');
+            const accountsUsersId = accountsUsersFeature?.id ?? featureEntityType.generateNewId();
+            return {
+                updatedConfig: {
+                    ...typedConfig,
+                    authFeatureRef: 'accounts/auth',
+                    accountsFeatureRef: 'accounts/users',
+                },
+                updateProjectDefinition: (draft) => {
+                    const draftDef = draft;
+                    draftDef.features ??= [];
+                    if (!accountsFeature) {
+                        draftDef.features.push({ id: accountsId, name: 'accounts' });
+                    }
+                    if (!accountsAuthFeature) {
+                        draftDef.features.push({
+                            id: accountsAuthId,
+                            name: 'accounts/auth',
+                            parentRef: 'accounts',
+                        });
+                    }
+                    if (!accountsUsersFeature) {
+                        draftDef.features.push({
+                            id: accountsUsersId,
+                            name: 'accounts/users',
+                            parentRef: 'accounts',
+                        });
+                    }
+                },
+            };
+        },
+    },
+];
+//# sourceMappingURL=migrations.js.map

package/dist/auth/core/schema/plugin-definition.d.ts

@@ -1,98 +1,35 @@
 import type { def } from '@baseplate-dev/project-builder-lib';
 import { z } from 'zod';
 export declare const createAuthPluginDefinitionSchema: (context: import("@baseplate-dev/project-builder-lib").DefinitionSchemaParserContext) => z.ZodObject<{
-    modelRefs: z.ZodObject<{
-        user: z.ZodEffects<z.ZodString, string, string>;
-        userAccount: z.ZodEffects<z.ZodString, string, string>;
-        userRole: z.ZodEffects<z.ZodString, string, string>;
-        userSession: z.ZodEffects<z.ZodString, string, string>;
-    }, "strip", z.ZodTypeAny, {
-        user: string;
-        userAccount: string;
-        userRole: string;
-        userSession: string;
-    }, {
-        user: string;
-        userAccount: string;
-        userRole: string;
-        userSession: string;
-    }>;
-    authFeatureRef: z.ZodEffects<z.ZodString, string, string>;
-    roles: z.ZodEffects<z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        comment: z.ZodString;
-        builtIn: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
+    implementationPluginKey: z.ZodString;
+    authFeatureRef: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    accountsFeatureRef: z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    roles: z.ZodArray<z.ZodType<{
         id: string;
         name: string;
         comment: string;
         builtIn: boolean;
+        autoAssigned: boolean;
     }, {
         id: string;
         name: string;
         comment: string;
         builtIn?: boolean | undefined;
-    }>, {
+        autoAssigned?: boolean | undefined;
+    }, z.core.$ZodTypeInternals<{
         id: string;
         name: string;
         comment: string;
         builtIn: boolean;
+        autoAssigned: boolean;
     }, {
         id: string;
         name: string;
         comment: string;
         builtIn?: boolean | undefined;
-    }>, "many">, {
-        id: string;
-        name: string;
-        comment: string;
-        builtIn: boolean;
-    }[], {
-        id: string;
-        name: string;
-        comment: string;
-        builtIn?: boolean | undefined;
-    }[]>, {
-        id: string;
-        name: string;
-        comment: string;
-        builtIn: boolean;
-    }[], {
-        id: string;
-        name: string;
-        comment: string;
-        builtIn?: boolean | undefined;
-    }[]>;
-}, "strip", z.ZodTypeAny, {
-    modelRefs: {
-        user: string;
-        userAccount: string;
-        userRole: string;
-        userSession: string;
-    };
-    authFeatureRef: string;
-    roles: {
-        id: string;
-        name: string;
-        comment: string;
-        builtIn: boolean;
-    }[];
-}, {
-    modelRefs: {
-        user: string;
-        userAccount: string;
-        userRole: string;
-        userSession: string;
-    };
-    authFeatureRef: string;
-    roles: {
-        id: string;
-        name: string;
-        comment: string;
-        builtIn?: boolean | undefined;
-    }[];
-}>;
+        autoAssigned?: boolean | undefined;
+    }>>>;
+}, z.core.$strip>;
 export type AuthPluginDefinition = def.InferOutput<typeof createAuthPluginDefinitionSchema>;
 export type AuthPluginDefinitionInput = def.InferInput<typeof createAuthPluginDefinitionSchema>;
 //# sourceMappingURL=plugin-definition.d.ts.map

package/dist/auth/core/schema/plugin-definition.js

@@ -1,29 +1,18 @@
-import { definitionSchema, featureEntityType, modelEntityType, } from '@baseplate-dev/project-builder-lib';
+import { definitionSchema, featureEntityType, } from '@baseplate-dev/project-builder-lib';
 import { z } from 'zod';
-import { createAuthRolesSchema } from '#src/common/roles/index.js';
+import { createAuthRolesSchema } from './roles/index.js';
 export const createAuthPluginDefinitionSchema = definitionSchema((ctx) => z.object({
-    modelRefs: z.object({
-        user: ctx.withRef({
-            type: modelEntityType,
-            onDelete: 'RESTRICT',
-        }),
-        userAccount: ctx.withRef({
-            type: modelEntityType,
-            onDelete: 'RESTRICT',
-        }),
-        userRole: ctx.withRef({
-            type: modelEntityType,
-            onDelete: 'RESTRICT',
-        }),
-        userSession: ctx.withRef({
-            type: modelEntityType,
-            onDelete: 'RESTRICT',
-        }),
-    }),
+    implementationPluginKey: z
+        .string()
+        .min(1, 'Auth implementation plugin must be selected'),
     authFeatureRef: ctx.withRef({
         type: featureEntityType,
         onDelete: 'RESTRICT',
     }),
+    accountsFeatureRef: ctx.withRef({
+        type: featureEntityType,
+        onDelete: 'RESTRICT',
+    }),
     roles: createAuthRolesSchema(ctx),
 }));
 //# sourceMappingURL=plugin-definition.js.map

package/dist/auth/core/schema/roles/constants.js

@@ -0,0 +1,34 @@
+import { authRoleEntityType } from '@baseplate-dev/project-builder-lib';
+export const AUTH_DEFAULT_ROLES = [
+    {
+        name: 'public',
+        comment: 'All users (including unauthenticated and authenticated users)',
+        builtIn: true,
+        autoAssigned: true,
+    },
+    {
+        name: 'user',
+        comment: 'All authenticated users',
+        builtIn: true,
+        autoAssigned: true,
+    },
+    {
+        name: 'system',
+        comment: 'System processes without a user context, e.g. background jobs',
+        builtIn: true,
+        autoAssigned: true,
+    },
+    {
+        name: 'admin',
+        comment: 'Administrator with full access',
+        builtIn: true,
+        autoAssigned: false,
+    },
+];
+export function createDefaultAuthRoles() {
+    return AUTH_DEFAULT_ROLES.map((role) => ({
+        ...role,
+        id: authRoleEntityType.generateNewId(),
+    }));
+}
+//# sourceMappingURL=constants.js.map

package/dist/auth/core/schema/roles/index.d.ts

@@ -0,0 +1,3 @@
+export * from './constants.js';
+export * from './schema.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/core/schema/roles/index.js

@@ -0,0 +1,3 @@
+export * from './constants.js';
+export * from './schema.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/core/schema/roles/schema.d.ts

@@ -0,0 +1,62 @@
+import type { def } from '@baseplate-dev/project-builder-lib';
+import { z } from 'zod';
+export declare const createAuthRoleSchema: (context: import("@baseplate-dev/project-builder-lib").DefinitionSchemaParserContext) => z.ZodType<{
+    id: string;
+    name: string;
+    comment: string;
+    builtIn: boolean;
+    autoAssigned: boolean;
+}, {
+    id: string;
+    name: string;
+    comment: string;
+    builtIn?: boolean | undefined;
+    autoAssigned?: boolean | undefined;
+}, z.core.$ZodTypeInternals<{
+    id: string;
+    name: string;
+    comment: string;
+    builtIn: boolean;
+    autoAssigned: boolean;
+}, {
+    id: string;
+    name: string;
+    comment: string;
+    builtIn?: boolean | undefined;
+    autoAssigned?: boolean | undefined;
+}>>;
+/**
+ * Defines the schema for a role.
+ */
+export type AuthRoleDefinition = def.InferOutput<typeof createAuthRoleSchema>;
+export type AuthRoleInput = def.InferInput<typeof createAuthRoleSchema>;
+/**
+ * Defines the schema for an array of roles ensuring that there are no duplicate
+ * role names and that the built-in roles are included.
+ */
+export declare const createAuthRolesSchema: (context: import("@baseplate-dev/project-builder-lib").DefinitionSchemaParserContext) => z.ZodArray<z.ZodType<{
+    id: string;
+    name: string;
+    comment: string;
+    builtIn: boolean;
+    autoAssigned: boolean;
+}, {
+    id: string;
+    name: string;
+    comment: string;
+    builtIn?: boolean | undefined;
+    autoAssigned?: boolean | undefined;
+}, z.core.$ZodTypeInternals<{
+    id: string;
+    name: string;
+    comment: string;
+    builtIn: boolean;
+    autoAssigned: boolean;
+}, {
+    id: string;
+    name: string;
+    comment: string;
+    builtIn?: boolean | undefined;
+    autoAssigned?: boolean | undefined;
+}>>>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/auth/core/schema/roles/schema.js

@@ -0,0 +1,38 @@
+import { authRoleEntityType, definitionSchema, } from '@baseplate-dev/project-builder-lib';
+import { z } from 'zod';
+import { AUTH_DEFAULT_ROLES } from './constants.js';
+export const createAuthRoleSchema = definitionSchema((ctx) => ctx.withEnt(z.object({
+    id: z.string(),
+    name: z.string().min(1),
+    comment: z.string().min(1),
+    builtIn: z.boolean().default(false),
+    autoAssigned: z.boolean().default(false),
+}), { type: authRoleEntityType }));
+/**
+ * Defines the schema for an array of roles ensuring that there are no duplicate
+ * role names and that the built-in roles are included.
+ */
+export const createAuthRolesSchema = definitionSchema((ctx) => z
+    .array(createAuthRoleSchema(ctx))
+    .superRefine((roles, ctx) => {
+    const dup = roles
+        .map((r) => r.name)
+        .filter((v, i, a) => a.indexOf(v) !== i);
+    if (dup.length > 0) {
+        ctx.addIssue({
+            code: 'custom',
+            message: `Duplicate role name(s): ${dup.join(', ')}`,
+        });
+    }
+})
+    .superRefine((roles, ctx) => {
+    for (const defaultRole of AUTH_DEFAULT_ROLES) {
+        if (!roles.some((r) => r.name === defaultRole.name && r.builtIn)) {
+            ctx.addIssue({
+                code: 'custom',
+                message: `Missing built-in role: ${defaultRole.name}`,
+            });
+        }
+    }
+}));
+//# sourceMappingURL=schema.js.map

package/dist/auth/core/web.d.ts

@@ -1,6 +1,6 @@
 import '../../styles.css';
-declare const _default: import("@baseplate-dev/project-builder-lib").PluginPlatformModule<{
-    webConfig: import("@baseplate-dev/project-builder-lib").PluginSpecWithInitializer<import("@baseplate-dev/project-builder-lib").WebConfigSpec>;
-}, {}>;
+declare const _default: import("@baseplate-dev/project-builder-lib").PluginModule<{
+    [x: string]: import("@baseplate-dev/project-builder-lib").PluginSpec<object, object>;
+}>;
 export default _default;
 //# sourceMappingURL=web.d.ts.map

package/dist/auth/core/web.js

@@ -1,14 +1,42 @@
-import { createPlatformPluginExport, webConfigSpec, } from '@baseplate-dev/project-builder-lib';
+import { createPluginModule, FeatureUtils, pluginDefaultsSpec, webConfigSpec, } from '@baseplate-dev/project-builder-lib';
+import { createDefaultAuthRoles } from '#src/auth/core/schema/roles/constants.js';
 import { AuthDefinitionEditor } from './components/auth-definition-editor.js';
 import '../../styles.css';
-export default createPlatformPluginExport({
+const AUTH_FEATURE_NAME = 'accounts/auth';
+const ACCOUNTS_FEATURE_NAME = 'accounts/users';
+const AUTH_IMPL_FQN_PREFIX = '@baseplate-dev/plugin-auth:';
+const PARENT_AUTH_FQN = '@baseplate-dev/plugin-auth:auth';
+export default createPluginModule({
+    name: 'web',
     dependencies: {
         webConfig: webConfigSpec,
+        pluginDefaults: pluginDefaultsSpec,
     },
-    exports: {},
-    initialize: ({ webConfig }, { pluginId }) => {
-        webConfig.registerWebConfigComponent(pluginId, AuthDefinitionEditor);
-        return {};
+    initialize: ({ webConfig, pluginDefaults }, { pluginKey }) => {
+        webConfig.components.set(pluginKey, AuthDefinitionEditor);
+        pluginDefaults.builders.set(pluginKey, ({ draft, enabledPluginFqns, findPluginMetadataByFqn }) => {
+            const authFeatureRef = FeatureUtils.ensureFeatureByNameRecursively(draft, AUTH_FEATURE_NAME);
+            const accountsFeatureRef = FeatureUtils.ensureFeatureByNameRecursively(draft, ACCOUNTS_FEATURE_NAME);
+            // The auth parent plugin needs an implementation chosen by the caller
+            // (local-auth / better-auth / placeholder-auth). Pick whichever impl
+            // plugin under `@baseplate-dev/plugin-auth:` is also being enabled.
+            const implFqn = [...enabledPluginFqns].find((fqn) => fqn.startsWith(AUTH_IMPL_FQN_PREFIX) && fqn !== PARENT_AUTH_FQN);
+            if (!implFqn) {
+                throw new Error('No auth implementation plugin enabled. Add an auth implementation (e.g. local-auth or better-auth) to the enabled plugins.');
+            }
+            const implPlugin = findPluginMetadataByFqn(implFqn);
+            if (!implPlugin) {
+                throw new Error(`Auth implementation plugin ${implFqn} is enabled but its metadata could not be resolved.`);
+            }
+            return {
+                config: {
+                    implementationPluginKey: implPlugin.key,
+                    authFeatureRef,
+                    accountsFeatureRef,
+                    roles: createDefaultAuthRoles(),
+                },
+            };
+        });
     },
 });
 //# sourceMappingURL=web.js.map

package/dist/auth/index.d.ts

@@ -1,2 +1,2 @@
-export * from './core/index.js';
+export * from './utils/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.js

@@ -1,2 +1,2 @@
-export * from './core/index.js';
+export * from './utils/index.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/plugin.json

@@ -0,0 +1,8 @@
+{
+  "name": "auth",
+  "displayName": "Authentication",
+  "icon": "icon.svg",
+  "description": "Manages user authentication and authorization for your application. This is a base plugin that requires an authentication implementation (Local Auth, Better Auth, etc.)",
+  "version": "0.1.0",
+  "moduleDirectories": ["core"]
+}

package/dist/auth/utils/get-auth-plugin-definition.d.ts

@@ -0,0 +1,9 @@
+import type { ProjectDefinition } from '@baseplate-dev/project-builder-lib';
+import type { AuthPluginDefinition } from '../core/schema/plugin-definition.js';
+/**
+ * Get the auth plugin definition from the project definition.
+ * @param definition - The project definition.
+ * @returns The auth plugin definition.
+ */
+export declare function getAuthPluginDefinition(definition: ProjectDefinition): AuthPluginDefinition;
+//# sourceMappingURL=get-auth-plugin-definition.d.ts.map

package/dist/auth/utils/get-auth-plugin-definition.js

@@ -0,0 +1,10 @@
+import { PluginUtils } from '@baseplate-dev/project-builder-lib';
+/**
+ * Get the auth plugin definition from the project definition.
+ * @param definition - The project definition.
+ * @returns The auth plugin definition.
+ */
+export function getAuthPluginDefinition(definition) {
+    return PluginUtils.configByKeyOrThrow(definition, 'baseplate-dev_plugin-auth_auth');
+}
+//# sourceMappingURL=get-auth-plugin-definition.js.map

package/dist/auth/utils/index.d.ts

@@ -0,0 +1,2 @@
+export * from './get-auth-plugin-definition.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/utils/index.js

@@ -0,0 +1,2 @@
+export * from './get-auth-plugin-definition.js';
+//# sourceMappingURL=index.js.map

package/dist/better-auth/admin/common.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("@baseplate-dev/project-builder-lib").PluginModule<{
+    [x: string]: import("@baseplate-dev/project-builder-lib").PluginSpec<object, object>;
+}>;
+export default _default;
+//# sourceMappingURL=common.d.ts.map