@baseplate-dev/plugin-auth 1.0.6 → 1.0.8

package/dist/local-auth/constants/model-names.js

@@ -0,0 +1,23 @@
+export const LOCAL_AUTH_MODELS = {
+    /**
+     * Model name for the user model that represents a user in the local auth system.
+     */
+    user: 'User',
+    /**
+     * Model name for the user account model that represents a user account in the local auth system, e.g. email / password.
+     */
+    userAccount: 'UserAccount',
+    /**
+     * Model name for the user role model that represents a user role in the local auth system.
+     */
+    userRole: 'UserRole',
+    /**
+     * Model name for the user session model that represents a user session in the local auth system.
+     */
+    userSession: 'UserSession',
+    /**
+     * Model name for the auth verification model used for secure token-based verification flows (e.g. password reset, email verification).
+     */
+    authVerification: 'AuthVerification',
+};
+//# sourceMappingURL=model-names.js.map

package/dist/local-auth/core/common.d.ts

@@ -0,0 +1,6 @@
+export type { PluginModule } from '@baseplate-dev/project-builder-lib';
+declare const _default: import("@baseplate-dev/project-builder-lib").PluginModule<{
+    [x: string]: import("@baseplate-dev/project-builder-lib").PluginSpec<object, object>;
+}>;
+export default _default;
+//# sourceMappingURL=common.d.ts.map

package/dist/local-auth/core/common.js

@@ -0,0 +1,20 @@
+import { authModelsSpec, createPluginModule, definitionIssueCheckerSpec, pluginConfigSpec, } from '@baseplate-dev/project-builder-lib';
+import { LOCAL_AUTH_MODELS } from '#src/local-auth/constants/model-names.js';
+import { createLocalAuthPluginDefinitionSchema } from './schema/plugin-definition.js';
+import { createLocalAuthSchemaChecker } from './schema/schema-issue-checker.js';
+export default createPluginModule({
+    name: 'common',
+    dependencies: {
+        pluginConfig: pluginConfigSpec,
+        authModels: authModelsSpec,
+        issueCheckers: definitionIssueCheckerSpec,
+    },
+    initialize: ({ pluginConfig, authModels, issueCheckers }, { pluginKey }) => {
+        pluginConfig.schemas.set(pluginKey, createLocalAuthPluginDefinitionSchema);
+        authModels.getAuthModels.set(() => ({
+            user: LOCAL_AUTH_MODELS.user,
+        }));
+        issueCheckers.checkers.set(pluginKey, createLocalAuthSchemaChecker(pluginKey));
+    },
+});
+//# sourceMappingURL=common.js.map

package/dist/local-auth/core/components/local-auth-definition-editor.d.ts

@@ -0,0 +1,5 @@
+import type { WebConfigProps } from '@baseplate-dev/project-builder-lib';
+import type React from 'react';
+import '#src/styles.css';
+export declare function LocalAuthDefinitionEditor({ definition: pluginMetadata, metadata, onSave, }: WebConfigProps): React.JSX.Element;
+//# sourceMappingURL=local-auth-definition-editor.d.ts.map

package/dist/local-auth/core/components/local-auth-definition-editor.js

@@ -0,0 +1,63 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { applyMergedDefinition, diffDefinition, PluginUtils, } from '@baseplate-dev/project-builder-lib';
+import { DefinitionDiffAlert, useBlockUnsavedChangesNavigate, useDefinitionSchema, useProjectDefinition, useResettableForm, } from '@baseplate-dev/project-builder-lib/web';
+import { FormActionBar, MultiComboboxFieldController, SectionList, SectionListSection, SectionListSectionContent, SectionListSectionDescription, SectionListSectionHeader, SectionListSectionTitle, SwitchFieldController, } from '@baseplate-dev/ui-components';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { useMemo } from 'react';
+import { getAuthPluginDefinition } from '#src/auth/utils/get-auth-plugin-definition.js';
+import { AuthConfigTabs } from '#src/common/components/auth-config-tabs.js';
+import { createLocalAuthPartialDefinition } from '../schema/models.js';
+import { createLocalAuthPluginDefinitionSchema } from '../schema/plugin-definition.js';
+import '#src/styles.css';
+export function LocalAuthDefinitionEditor({ definition: pluginMetadata, metadata, onSave, }) {
+    const { definition, definitionContainer, saveDefinitionWithFeedback } = useProjectDefinition();
+    const authPluginDefinitionSchema = useDefinitionSchema(createLocalAuthPluginDefinitionSchema);
+    const authDefinition = getAuthPluginDefinition(definition);
+    const roles = authDefinition.roles
+        .filter((role) => !role.builtIn)
+        .map((role) => ({
+        label: role.name,
+        value: role.id,
+    }));
+    const defaultValues = useMemo(() => {
+        if (pluginMetadata?.config) {
+            return pluginMetadata.config;
+        }
+        return {
+            additionalUserAdminRoles: [],
+            requireNameOnRegistration: false,
+        };
+    }, [pluginMetadata?.config]);
+    const form = useResettableForm({
+        resolver: zodResolver(authPluginDefinitionSchema),
+        defaultValues,
+    });
+    const { control, reset, handleSubmit } = form;
+    const authFeature = definition.features.find((f) => f.id === authDefinition.authFeatureRef);
+    if (!authFeature) {
+        throw new Error(`Auth feature not found for ref: ${authDefinition.authFeatureRef}`);
+    }
+    const accountsFeature = definition.features.find((f) => f.id === authDefinition.accountsFeatureRef);
+    if (!accountsFeature) {
+        throw new Error(`Accounts feature not found for ref: ${authDefinition.accountsFeatureRef}`);
+    }
+    const partialDef = useMemo(() => createLocalAuthPartialDefinition(authFeature.name, accountsFeature.name), [authFeature.name, accountsFeature.name]);
+    const diff = useMemo(() => diffDefinition(definitionContainer.schema, definitionContainer.definition, partialDef), [definitionContainer, partialDef]);
+    const onSubmit = handleSubmit((data) => saveDefinitionWithFeedback((draftConfig) => {
+        const updatedData = {
+            ...data,
+        };
+        applyMergedDefinition(definitionContainer, partialDef)(draftConfig);
+        PluginUtils.setPluginConfig(draftConfig, metadata, updatedData, definitionContainer);
+    }, {
+        successMessage: 'Successfully saved auth plugin!',
+        onSuccess: () => {
+            onSave();
+        },
+    }));
+    useBlockUnsavedChangesNavigate({ control, reset, onSubmit });
+    return (_jsxs("div", { className: "auth:relative auth:flex auth:h-full auth:flex-1 auth:flex-col auth:gap-4 auth:overflow-hidden", children: [_jsx(AuthConfigTabs, {}), _jsx("div", { className: "auth:mb-[--action-bar-height] auth:flex auth:flex-1 auth:overflow-y-auto", style: {
+                    '--action-bar-height': '52px',
+                }, children: _jsxs("form", { onSubmit: onSubmit, className: "auth:max-w-6xl auth:flex-1", children: [_jsx("div", { className: "auth:pb-16", children: _jsxs(SectionList, { children: [_jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "Local Auth User Models" }), _jsx(SectionListSectionDescription, { children: "The plugin will automatically configure the models it needs." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(DefinitionDiffAlert, { diff: diff }) })] }), _jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "User Management Permissions" }), _jsx(SectionListSectionDescription, { children: "The \"admin\" role always has user management permissions. Optionally add more roles that can manage users and assign roles in the admin interface." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(MultiComboboxFieldController, { label: "Additional User Admin Roles", name: "additionalUserAdminRoles", control: control, options: roles, description: "Additional roles (beyond admin) that can manage users and assign roles." }) })] }), _jsxs(SectionListSection, { children: [_jsxs(SectionListSectionHeader, { children: [_jsx(SectionListSectionTitle, { children: "Registration Settings" }), _jsx(SectionListSectionDescription, { children: "Configure what information is collected during user registration." })] }), _jsx(SectionListSectionContent, { className: "auth:space-y-6", children: _jsx(SwitchFieldController, { label: "Require Name on Registration", name: "requireNameOnRegistration", control: control, description: "When enabled, users must provide their name when registering." }) })] })] }) }), _jsx(FormActionBar, { form: form, allowSaveWithoutDirty: !pluginMetadata || diff.hasChanges })] }) })] }));
+}
+//# sourceMappingURL=local-auth-definition-editor.js.map

package/dist/local-auth/core/generators/auth-apollo/auth-apollo.generator.d.ts

@@ -0,0 +1,13 @@
+export declare const authApolloGenerator: import("@baseplate-dev/sync").GeneratorBundleCreator<Record<string, never>, {
+    main: import("@baseplate-dev/sync").GeneratorTask<any, {
+        reactApolloConfig: import("@baseplate-dev/sync").ProviderType<Omit<import("@baseplate-dev/utils").FieldMap<{
+            createApolloClientArguments: import("@baseplate-dev/utils").NamedArrayFieldContainer<import("@baseplate-dev/react-generators").ApolloCreateArgument>;
+            apolloLinks: import("@baseplate-dev/utils").NamedArrayFieldContainer<import("@baseplate-dev/react-generators").ApolloLink>;
+        }>, "getValues">>;
+        reactSession: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            UserSessionClient: {};
+            userSessionClient: {};
+        }>>;
+    }, any>;
+}>;
+//# sourceMappingURL=auth-apollo.generator.d.ts.map

package/dist/local-auth/core/generators/auth-apollo/auth-apollo.generator.js

@@ -0,0 +1,40 @@
+import { tsCodeFragment, TsCodeUtils, tsImportBuilder, } from '@baseplate-dev/core-generators';
+import { reactApolloConfigProvider } from '@baseplate-dev/react-generators';
+import { createGenerator, createGeneratorTask } from '@baseplate-dev/sync';
+import { z } from 'zod';
+import { reactSessionImportsProvider } from '../react-session/index.js';
+const descriptorSchema = z.object({});
+export const authApolloGenerator = createGenerator({
+    name: 'local-auth/core/auth-apollo',
+    generatorFileUrl: import.meta.url,
+    descriptorSchema,
+    buildTasks: () => ({
+        main: createGeneratorTask({
+            dependencies: {
+                reactApolloConfig: reactApolloConfigProvider,
+                reactSession: reactSessionImportsProvider,
+            },
+            run({ reactApolloConfig, reactSession }) {
+                return {
+                    providers: {
+                        authApollo: {},
+                    },
+                    build: async (builder) => {
+                        const linkTemplate = await builder.readTemplate('session-error-link.ts');
+                        const sessionErrorLink = TsCodeUtils.extractTemplateSnippet(linkTemplate, 'SESSION_ERROR_LINK');
+                        reactApolloConfig.apolloLinks.add({
+                            name: 'sessionErrorLink',
+                            bodyFragment: tsCodeFragment(sessionErrorLink, [
+                                tsImportBuilder(['ErrorLink']).from('@apollo/client/link/error'),
+                                tsImportBuilder(['ServerError']).from('@apollo/client/errors'),
+                                reactSession.userSessionClient.declaration(),
+                            ]),
+                            priority: 'error',
+                        });
+                    },
+                };
+            },
+        }),
+    }),
+});
+//# sourceMappingURL=auth-apollo.generator.js.map

package/dist/local-auth/core/generators/auth-apollo/templates/session-error-link.js

@@ -0,0 +1,20 @@
+// @ts-nocheck
+// SESSION_ERROR_LINK:START
+const sessionErrorLink = new ErrorLink(({ error }) => {
+    if (ServerError.is(error) && error.statusCode === 401) {
+        // Try to parse the body as JSON to check for invalid-session
+        try {
+            const body = JSON.parse(error.bodyText);
+            if (body.code === 'invalid-session') {
+                userSessionClient.signOut();
+            }
+        }
+        catch {
+            // Body is not JSON, ignore
+        }
+    }
+    return;
+});
+export {};
+// SESSION_ERROR_LINK:END
+//# sourceMappingURL=session-error-link.js.map

package/dist/local-auth/core/generators/auth-apollo/templates/session-error-link.ts

@@ -0,0 +1,18 @@
+// @ts-nocheck
+
+// SESSION_ERROR_LINK:START
+const sessionErrorLink = new ErrorLink(({ error }) => {
+  if (ServerError.is(error) && error.statusCode === 401) {
+    // Try to parse the body as JSON to check for invalid-session
+    try {
+      const body = JSON.parse(error.bodyText) as { code?: string };
+      if (body.code === 'invalid-session') {
+        userSessionClient.signOut();
+      }
+    } catch {
+      // Body is not JSON, ignore
+    }
+  }
+  return;
+});
+// SESSION_ERROR_LINK:END

package/dist/local-auth/core/generators/auth-email-password/auth-email-password.generator.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Sets up email / password authentication
+ */
+export declare const authEmailPasswordGenerator: import("@baseplate-dev/sync").GeneratorBundleCreator<{
+    adminRoles: string[];
+    devWebDomainPort: number;
+    requireNameOnRegistration: boolean;
+}, {
+    paths: import("@baseplate-dev/sync").GeneratorTask<{
+        localAuthCoreAuthEmailPasswordPaths: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-paths.js").LocalAuthCoreAuthEmailPasswordPaths>;
+    }, {
+        appModule: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/fastify-generators").AppModuleProvider>;
+    }, undefined>;
+    imports: import("@baseplate-dev/sync").GeneratorTask<{
+        authEmailPasswordImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            authenticateUserWithEmailAndPassword: {};
+            cleanupExpiredPasswordResetTokens: {};
+            completePasswordReset: {};
+            createUserWithEmailAndPassword: {};
+            PASSWORD_MAX_LENGTH: {};
+            PASSWORD_MIN_LENGTH: {};
+            PASSWORD_RESET_TOKEN_EXPIRY_SEC: {};
+            registerUserWithEmailAndPassword: {};
+            requestPasswordReset: {};
+            validatePasswordResetToken: {};
+        }>>;
+    }, {
+        paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthEmailPasswordPaths>;
+    }, undefined>;
+    renderers: import("@baseplate-dev/sync").GeneratorTask<{
+        localAuthCoreAuthEmailPasswordRenderers: import("@baseplate-dev/sync").ProviderExport<import("./generated/template-renderers.js").LocalAuthCoreAuthEmailPasswordRenderers>;
+    }, {
+        authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
+            cleanupExpiredAuthVerifications: {};
+            CookieUserSessionService: {};
+            createAuthVerification: {};
+            userSessionPayload: {};
+            validateAuthVerification: {};
+        }>>;
+        configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            getConfig: {};
+            isDevelopment: {};
+        }>>;
+        errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            BadRequestError: {};
+            ForbiddenError: {};
+            handleZodRequestValidationError: {};
+            HttpError: {};
+            InternalServerError: {};
+            logError: {};
+            NotFoundError: {};
+            throwIfPrismaNotFound: {};
+            TooManyRequestsError: {};
+            UnauthorizedError: {};
+        }>>;
+        passwordHasherServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createPasswordHash: {};
+            verifyPasswordHash: {};
+        }>>;
+        paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthEmailPasswordPaths>;
+        pothosImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            builder: {};
+        }>>;
+        prismaGeneratedImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            PrismaClient: {};
+            Prisma: {};
+            '*': {};
+            $Enums: {};
+        }>>;
+        prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            prisma: {};
+        }>>;
+        rateLimitImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createRateLimiter: {};
+            memoizeRateLimiter: {};
+            RateLimiter: {
+                isTypeOnly: true;
+            };
+            RateLimiterConfig: {
+                isTypeOnly: true;
+            };
+            RateLimitResult: {
+                isTypeOnly: true;
+            };
+        }>>;
+        requestServiceContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            createContextFromRequest: {};
+            RequestServiceContext: {
+                isTypeOnly: true;
+            };
+            RequestServiceContextWith: {
+                isTypeOnly: true;
+            };
+        }>>;
+        typescriptFile: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").TypescriptFileProvider>;
+        userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            UserSessionPayload: {
+                isTypeOnly: true;
+            };
+            UserSessionService: {
+                isTypeOnly: true;
+            };
+        }>>;
+    }, undefined>;
+    config: import("@baseplate-dev/sync").GeneratorTask<undefined, {
+        provider: import("@baseplate-dev/sync").ProviderType<Omit<import("@baseplate-dev/utils").FieldMap<{
+            configFields: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/fastify-generators").ConfigServiceField>;
+        }>, "getValues">>;
+    }, undefined>;
+    appModule: import("@baseplate-dev/sync").GeneratorTask<any, {
+        paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthEmailPasswordPaths>;
+        appModule: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/fastify-generators").AppModuleProvider>;
+    }, any>;
+    main: import("@baseplate-dev/sync").GeneratorTask<any, {
+        renderers: import("@baseplate-dev/sync").ProviderType<import("./generated/template-renderers.js").LocalAuthCoreAuthEmailPasswordRenderers>;
+        transactionalLibConfig: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/plugin-email").TransactionalLibConfigProvider>;
+        userObjectType: import("@baseplate-dev/sync").ProviderDependency<import("@baseplate-dev/fastify-generators").PothosTypeOutputProvider>;
+    }, any>;
+}>;
+//# sourceMappingURL=auth-email-password.generator.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/auth-email-password.generator.js

@@ -0,0 +1,82 @@
+import { tsCodeFragment, TsCodeUtils } from '@baseplate-dev/core-generators';
+import { appModuleProvider, configServiceProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, } from '@baseplate-dev/fastify-generators';
+import { transactionalLibConfigProvider } from '@baseplate-dev/plugin-email';
+import { createGenerator, createGeneratorTask, createProviderTask, } from '@baseplate-dev/sync';
+import { quot } from '@baseplate-dev/utils';
+import { z } from 'zod';
+import { LOCAL_AUTH_MODELS } from '#src/local-auth/constants/model-names.js';
+import { LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_GENERATED as GENERATED_TEMPLATES } from './generated/index.js';
+const descriptorSchema = z.object({
+    adminRoles: z.array(z.string()),
+    devWebDomainPort: z.number(),
+    requireNameOnRegistration: z.boolean(),
+});
+/**
+ * Sets up email / password authentication
+ */
+export const authEmailPasswordGenerator = createGenerator({
+    name: 'local-auth/core/auth-email-password',
+    generatorFileUrl: import.meta.url,
+    descriptorSchema,
+    buildTasks: ({ adminRoles, devWebDomainPort, requireNameOnRegistration, }) => ({
+        paths: GENERATED_TEMPLATES.paths.task,
+        imports: GENERATED_TEMPLATES.imports.task,
+        renderers: GENERATED_TEMPLATES.renderers.task,
+        config: createProviderTask(configServiceProvider, (configService) => {
+            configService.configFields.set('AUTH_FRONTEND_URL', {
+                validator: tsCodeFragment('z.url()'),
+                comment: 'Frontend URL for authentication flows including password reset and email verification (e.g., https://app.example.com)',
+                exampleValue: `http://localhost:${devWebDomainPort}`,
+            });
+        }),
+        appModule: createGeneratorTask({
+            dependencies: {
+                paths: GENERATED_TEMPLATES.paths.provider,
+                appModule: appModuleProvider,
+            },
+            run({ paths, appModule }) {
+                appModule.moduleImports.push(paths.schemaUserPasswordMutations, paths.schemaPasswordResetMutations, paths.schemaEmailVerificationMutations);
+            },
+        }),
+        main: createGeneratorTask({
+            dependencies: {
+                renderers: GENERATED_TEMPLATES.renderers.provider,
+                transactionalLibConfig: transactionalLibConfigProvider,
+                userObjectType: pothosTypeOutputProvider
+                    .dependency()
+                    .reference(createPothosPrismaObjectTypeOutputName(LOCAL_AUTH_MODELS.user)),
+            },
+            run({ renderers, transactionalLibConfig, userObjectType }) {
+                const transactionalLibPackageName = transactionalLibConfig.getTransactionalLibPackageName();
+                return {
+                    build: async (builder) => {
+                        await builder.apply(renderers.moduleGroup.render({
+                            variables: {
+                                schemaUserPasswordMutations: {
+                                    TPL_ADMIN_ROLES: TsCodeUtils.mergeFragmentsAsArrayPresorted(adminRoles.map((r) => quot(r)).toSorted()),
+                                    TPL_USER_OBJECT_TYPE: userObjectType.getTypeReference().fragment,
+                                },
+                                servicesPasswordReset: {
+                                    TPL_PASSWORD_RESET_EMAIL: TsCodeUtils.importFragment('PasswordResetEmail', transactionalLibPackageName),
+                                    TPL_PASSWORD_CHANGED_EMAIL: TsCodeUtils.importFragment('PasswordChangedEmail', transactionalLibPackageName),
+                                },
+                                servicesUserPassword: {
+                                    TPL_NAME_REQUIRED_CHECK: requireNameOnRegistration
+                                        ? tsCodeFragment("if (!name) {\n    throw new BadRequestError('Name is required', 'name-required');\n  }")
+                                        : '',
+                                },
+                            },
+                        }));
+                        await builder.apply(renderers.servicesEmailVerification.render({
+                            variables: {
+                                TPL_ACCOUNT_VERIFICATION_EMAIL: TsCodeUtils.importFragment('AccountVerificationEmail', transactionalLibPackageName),
+                            },
+                        }));
+                        await builder.apply(renderers.schemaEmailVerificationMutations.render({}));
+                    },
+                };
+            },
+        }),
+    }),
+});
+//# sourceMappingURL=auth-email-password.generator.js.map