@baseplate-dev/plugin-auth 1.0.7 → 1.0.8

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.d.ts

@@ -12,7 +12,10 @@ export declare const moduleGroup: {
         TPL_USER_OBJECT_TYPE: {};
     }, {
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            CookieUserSessionService: {};
             createAuthVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
@@ -28,33 +31,17 @@ export declare const moduleGroup: {
         TPL_PASSWORD_RESET_EMAIL: {};
     }, {
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            CookieUserSessionService: {};
             createAuthVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
-        }>>;
-        emailModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            EmailAdapter: {
-                isTypeOnly: true;
-            };
-            EmailAttachment: {
-                isTypeOnly: true;
-            };
-            EmailRawOptions: {
-                isTypeOnly: true;
-            };
-            EmailSendOptions: {
-                isTypeOnly: true;
-            };
-            sendEmail: {};
-            sendEmailQueue: {};
-            sendRawEmail: {};
-            TransformedEmailMessage: {
-                isTypeOnly: true;
-            };
+            getConfig: {};
+            isDevelopment: {};
         }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
@@ -64,6 +51,7 @@ export declare const moduleGroup: {
             InternalServerError: {};
             logError: {};
             NotFoundError: {};
+            throwIfPrismaNotFound: {};
             TooManyRequestsError: {};
             UnauthorizedError: {};
         }>>;
@@ -92,11 +80,17 @@ export declare const moduleGroup: {
             RequestServiceContext: {
                 isTypeOnly: true;
             };
+            RequestServiceContextWith: {
+                isTypeOnly: true;
+            };
         }>>;
     }, {
         constantsPassword: {};
+        servicesUserPassword: {};
     }>;
-    servicesUserPassword: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+    servicesUserPassword: import("@baseplate-dev/core-generators").TsTemplateFile<{
+        TPL_NAME_REQUIRED_CHECK: {};
+    }, {
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
             ForbiddenError: {};
@@ -105,6 +99,7 @@ export declare const moduleGroup: {
             InternalServerError: {};
             logError: {};
             NotFoundError: {};
+            throwIfPrismaNotFound: {};
             TooManyRequestsError: {};
             UnauthorizedError: {};
         }>>;
@@ -139,9 +134,9 @@ export declare const moduleGroup: {
             RequestServiceContext: {
                 isTypeOnly: true;
             };
-        }>>;
-        userSessionServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            userSessionService: {};
+            RequestServiceContextWith: {
+                isTypeOnly: true;
+            };
         }>>;
         userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             UserSessionPayload: {
@@ -171,7 +166,10 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             TPL_USER_OBJECT_TYPE: {};
         }, {
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                cleanupAuthVerificationQueue: {};
+                cleanupAuthVerificationWorker: {};
                 cleanupExpiredAuthVerifications: {};
+                CookieUserSessionService: {};
                 createAuthVerification: {};
                 userSessionPayload: {};
                 validateAuthVerification: {};
@@ -187,33 +185,17 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             TPL_PASSWORD_RESET_EMAIL: {};
         }, {
             authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+                cleanupAuthVerificationQueue: {};
+                cleanupAuthVerificationWorker: {};
                 cleanupExpiredAuthVerifications: {};
+                CookieUserSessionService: {};
                 createAuthVerification: {};
                 userSessionPayload: {};
                 validateAuthVerification: {};
             }>>;
             configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                config: {};
-            }>>;
-            emailModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                EmailAdapter: {
-                    isTypeOnly: true;
-                };
-                EmailAttachment: {
-                    isTypeOnly: true;
-                };
-                EmailRawOptions: {
-                    isTypeOnly: true;
-                };
-                EmailSendOptions: {
-                    isTypeOnly: true;
-                };
-                sendEmail: {};
-                sendEmailQueue: {};
-                sendRawEmail: {};
-                TransformedEmailMessage: {
-                    isTypeOnly: true;
-                };
+                getConfig: {};
+                isDevelopment: {};
             }>>;
             errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 BadRequestError: {};
@@ -223,6 +205,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
                 InternalServerError: {};
                 logError: {};
                 NotFoundError: {};
+                throwIfPrismaNotFound: {};
                 TooManyRequestsError: {};
                 UnauthorizedError: {};
             }>>;
@@ -251,11 +234,17 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
                 RequestServiceContext: {
                     isTypeOnly: true;
                 };
+                RequestServiceContextWith: {
+                    isTypeOnly: true;
+                };
             }>>;
         }, {
             constantsPassword: {};
+            servicesUserPassword: {};
         }>;
-        servicesUserPassword: import("@baseplate-dev/core-generators").TsTemplateFile<{}, {
+        servicesUserPassword: import("@baseplate-dev/core-generators").TsTemplateFile<{
+            TPL_NAME_REQUIRED_CHECK: {};
+        }, {
             errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 BadRequestError: {};
                 ForbiddenError: {};
@@ -264,6 +253,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
                 InternalServerError: {};
                 logError: {};
                 NotFoundError: {};
+                throwIfPrismaNotFound: {};
                 TooManyRequestsError: {};
                 UnauthorizedError: {};
             }>>;
@@ -298,9 +288,9 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
                 RequestServiceContext: {
                     isTypeOnly: true;
                 };
-            }>>;
-            userSessionServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-                userSessionService: {};
+                RequestServiceContextWith: {
+                    isTypeOnly: true;
+                };
             }>>;
             userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
                 UserSessionPayload: {
@@ -326,33 +316,17 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
         TPL_ACCOUNT_VERIFICATION_EMAIL: {};
     }, {
         authModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            CookieUserSessionService: {};
             createAuthVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
-        }>>;
-        emailModuleImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            EmailAdapter: {
-                isTypeOnly: true;
-            };
-            EmailAttachment: {
-                isTypeOnly: true;
-            };
-            EmailRawOptions: {
-                isTypeOnly: true;
-            };
-            EmailSendOptions: {
-                isTypeOnly: true;
-            };
-            sendEmail: {};
-            sendEmailQueue: {};
-            sendRawEmail: {};
-            TransformedEmailMessage: {
-                isTypeOnly: true;
-            };
+            getConfig: {};
+            isDevelopment: {};
         }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
@@ -362,6 +336,7 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             InternalServerError: {};
             logError: {};
             NotFoundError: {};
+            throwIfPrismaNotFound: {};
             TooManyRequestsError: {};
             UnauthorizedError: {};
         }>>;
@@ -386,6 +361,9 @@ export declare const LOCAL_AUTH_CORE_AUTH_EMAIL_PASSWORD_TEMPLATES: {
             RequestServiceContext: {
                 isTypeOnly: true;
             };
+            RequestServiceContextWith: {
+                isTypeOnly: true;
+            };
         }>>;
     }, {
         constantsPassword: {};

package/dist/local-auth/core/generators/auth-email-password/generated/typed-templates.js

@@ -1,6 +1,5 @@
 import { createTsTemplateFile } from '@baseplate-dev/core-generators';
-import { configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionServiceImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
-import { emailModuleImportsProvider } from '@baseplate-dev/plugin-email';
+import { configServiceImportsProvider, errorHandlerServiceImportsProvider, passwordHasherServiceImportsProvider, pothosImportsProvider, prismaGeneratedImportsProvider, prismaImportsProvider, requestServiceContextImportsProvider, userSessionTypesImportsProvider, } from '@baseplate-dev/fastify-generators';
 import { rateLimitImportsProvider } from '@baseplate-dev/plugin-rate-limit';
 import path from 'node:path';
 import { authModuleImportsProvider } from '#src/local-auth/core/generators/auth-module/generated/ts-import-providers.js';
@@ -50,7 +49,6 @@ const servicesPasswordReset = createTsTemplateFile({
     importMapProviders: {
         authModuleImports: authModuleImportsProvider,
         configServiceImports: configServiceImportsProvider,
-        emailModuleImports: emailModuleImportsProvider,
         errorHandlerServiceImports: errorHandlerServiceImportsProvider,
         passwordHasherServiceImports: passwordHasherServiceImportsProvider,
         prismaImports: prismaImportsProvider,
@@ -64,7 +62,10 @@ const servicesPasswordReset = createTsTemplateFile({
         requestPasswordReset: { isTypeOnly: false },
         validatePasswordResetToken: { isTypeOnly: false },
     },
-    referencedGeneratorTemplates: { constantsPassword: {} },
+    referencedGeneratorTemplates: {
+        constantsPassword: {},
+        servicesUserPassword: {},
+    },
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/password-reset.service.ts'),
     },
@@ -80,7 +81,6 @@ const servicesUserPassword = createTsTemplateFile({
         prismaImports: prismaImportsProvider,
         rateLimitImports: rateLimitImportsProvider,
         requestServiceContextImports: requestServiceContextImportsProvider,
-        userSessionServiceImports: userSessionServiceImportsProvider,
         userSessionTypesImports: userSessionTypesImportsProvider,
     },
     name: 'services-user-password',
@@ -96,7 +96,7 @@ const servicesUserPassword = createTsTemplateFile({
     source: {
         path: path.join(import.meta.dirname, '../templates/module/services/user-password.service.ts'),
     },
-    variables: {},
+    variables: { TPL_NAME_REQUIRED_CHECK: {} },
 });
 export const moduleGroup = {
     constantsPassword,
@@ -120,7 +120,6 @@ const servicesEmailVerification = createTsTemplateFile({
     importMapProviders: {
         authModuleImports: authModuleImportsProvider,
         configServiceImports: configServiceImportsProvider,
-        emailModuleImports: emailModuleImportsProvider,
         errorHandlerServiceImports: errorHandlerServiceImportsProvider,
         prismaImports: prismaImportsProvider,
         rateLimitImports: rateLimitImportsProvider,

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.js

@@ -30,9 +30,10 @@ builder.mutationField('resetPasswordWithToken', (t) => t.fieldWithInputPayload({
         token: t.input.field({ required: true, type: 'String' }),
         newPassword: t.input.field({ required: true, type: 'String' }),
     },
-    resolve: async (_root, { input }) => completePasswordReset({
+    resolve: async (_root, { input }, context) => completePasswordReset({
         token: input.token,
         newPassword: input.newPassword,
+        context,
     }),
 }));
 //# sourceMappingURL=password-reset.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.ts

@@ -45,10 +45,11 @@ builder.mutationField('resetPasswordWithToken', (t) =>
       token: t.input.field({ required: true, type: 'String' }),
       newPassword: t.input.field({ required: true, type: 'String' }),
     },
-    resolve: async (_root, { input }) =>
+    resolve: async (_root, { input }, context) =>
       completePasswordReset({
         token: input.token,
         newPassword: input.newPassword,
+        context,
       }),
   }),
 );

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.js

@@ -9,10 +9,14 @@ builder.mutationField('registerWithEmailPassword', (t) => t.fieldWithInputPayloa
     },
     input: {
         email: t.input.field({ required: true, type: 'String' }),
+        name: t.input.field({ required: false, type: 'String' }),
         password: t.input.field({ required: true, type: 'String' }),
     },
     resolve: async (root, { input }, context) => registerUserWithEmailAndPassword({
-        input,
+        input: {
+            ...input,
+            name: input.name ?? undefined,
+        },
         context,
     }),
 }));

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.ts

@@ -17,11 +17,15 @@ builder.mutationField('registerWithEmailPassword', (t) =>
     },
     input: {
       email: t.input.field({ required: true, type: 'String' }),
+      name: t.input.field({ required: false, type: 'String' }),
       password: t.input.field({ required: true, type: 'String' }),
     },
     resolve: async (root, { input }, context) =>
       registerUserWithEmailAndPassword({
-        input,
+        input: {
+          ...input,
+          name: input.name ?? undefined,
+        },
         context,
       }),
   }),

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.d.ts

@@ -1,11 +1,11 @@
-import type { RequestServiceContext } from '%requestServiceContextImports';
+import type { RequestServiceContext, RequestServiceContextWith } from '%requestServiceContextImports';
 /**
  * Request an email verification for the authenticated user.
  * Sends a verification email with a link to verify.
  */
 export declare function requestEmailVerification({ userId, context, }: {
     userId: string;
-    context: RequestServiceContext;
+    context: RequestServiceContextWith<'email'>;
 }): Promise<{
     success: true;
 }>;

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.js

@@ -1,8 +1,7 @@
 // @ts-nocheck
 import { EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC } from '$constantsPassword';
 import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
-import { config } from '%configServiceImports';
-import { sendEmail } from '%emailModuleImports';
+import { getConfig } from '%configServiceImports';
 import { BadRequestError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { memoizeRateLimiter } from '%rateLimitImports';
@@ -30,6 +29,7 @@ const getVerifyEmailIpLimiter = memoizeRateLimiter('verify-email-ip', {
  * Sends a verification email with a link to verify.
  */
 export async function requestEmailVerification({ userId, context, }) {
+    const { services } = context;
     await Promise.all([
         getRequestEmailVerificationIpLimiter().consumeOrThrow(context.reqInfo.ip, 'Too many verification attempts. Please try again later.', 'too-many-requests'),
         getRequestEmailVerificationUserLimiter().consumeOrThrow(userId, 'Too many verification attempts. Please try again later.', 'too-many-requests'),
@@ -50,8 +50,8 @@ export async function requestEmailVerification({ userId, context, }) {
         expiresInSec: EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC,
     });
     // Construct verification URL using configured domain
-    const verifyLink = `${config.AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
-    await sendEmail(TPL_ACCOUNT_VERIFICATION_EMAIL, {
+    const verifyLink = `${getConfig().AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+    await services.email.send(TPL_ACCOUNT_VERIFICATION_EMAIL, {
         to: user.email,
         data: { verifyLink },
     });

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.ts

@@ -1,14 +1,16 @@
 // @ts-nocheck
 
-import type { RequestServiceContext } from '%requestServiceContextImports';
+import type {
+  RequestServiceContext,
+  RequestServiceContextWith,
+} from '%requestServiceContextImports';
 
 import { EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC } from '$constantsPassword';
 import {
   createAuthVerification,
   validateAuthVerification,
 } from '%authModuleImports';
-import { config } from '%configServiceImports';
-import { sendEmail } from '%emailModuleImports';
+import { getConfig } from '%configServiceImports';
 import { BadRequestError } from '%errorHandlerServiceImports';
 import { prisma } from '%prismaImports';
 import { memoizeRateLimiter } from '%rateLimitImports';
@@ -52,8 +54,10 @@ export async function requestEmailVerification({
   context,
 }: {
   userId: string;
-  context: RequestServiceContext;
+  context: RequestServiceContextWith<'email'>;
 }): Promise<{ success: true }> {
+  const { services } = context;
+
   await Promise.all([
     getRequestEmailVerificationIpLimiter().consumeOrThrow(
       context.reqInfo.ip,
@@ -87,9 +91,9 @@ export async function requestEmailVerification({
   });
 
   // Construct verification URL using configured domain
-  const verifyLink = `${config.AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+  const verifyLink = `${getConfig().AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
 
-  await sendEmail(TPL_ACCOUNT_VERIFICATION_EMAIL, {
+  await services.email.send(TPL_ACCOUNT_VERIFICATION_EMAIL, {
     to: user.email,
     data: { verifyLink },
   });

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.d.ts

@@ -1,10 +1,10 @@
-import type { RequestServiceContext } from '%requestServiceContextImports';
+import type { RequestServiceContextWith } from '%requestServiceContextImports';
 /**
  * Request a password reset for the given email.
  */
 export declare function requestPasswordReset({ email: rawEmail, context, }: {
     email: string;
-    context: RequestServiceContext;
+    context: RequestServiceContextWith<'email'>;
 }): Promise<{
     success: true;
 }>;
@@ -28,9 +28,10 @@ export declare function validatePasswordResetToken({ token: rawToken, }: {
  * - Always invalidates all existing sessions for security
  * - All remaining password-reset tokens for this user are deleted
  */
-export declare function completePasswordReset({ token: rawToken, newPassword: rawNewPassword, }: {
+export declare function completePasswordReset({ token: rawToken, newPassword: rawNewPassword, context, }: {
     token: string;
     newPassword: string;
+    context: RequestServiceContextWith<'email'>;
 }): Promise<{
     success: true;
 }>;

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.js

@@ -1,8 +1,8 @@
 // @ts-nocheck
 import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PASSWORD_RESET_TOKEN_EXPIRY_SEC, } from '$constantsPassword';
+import { resetLoginRateLimits } from '$servicesUserPassword';
 import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
-import { config } from '%configServiceImports';
-import { sendEmail } from '%emailModuleImports';
+import { getConfig } from '%configServiceImports';
 import { BadRequestError, handleZodRequestValidationError, } from '%errorHandlerServiceImports';
 import { createPasswordHash } from '%passwordHasherServiceImports';
 import { prisma } from '%prismaImports';
@@ -38,6 +38,7 @@ const requestPasswordResetSchema = z.object({
  * Request a password reset for the given email.
  */
 export async function requestPasswordReset({ email: rawEmail, context, }) {
+    const { services } = context;
     const { email } = await requestPasswordResetSchema
         .parseAsync({ email: rawEmail })
         .catch(handleZodRequestValidationError);
@@ -58,9 +59,9 @@ export async function requestPasswordReset({ email: rawEmail, context, }) {
             expiresInSec: PASSWORD_RESET_TOKEN_EXPIRY_SEC,
         });
         // Construct reset URL using configured domain
-        const resetLink = `${config.AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
+        const resetLink = `${getConfig().AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
         // Send email asynchronously (queue-based)
-        await sendEmail(TPL_PASSWORD_RESET_EMAIL, {
+        await services.email.send(TPL_PASSWORD_RESET_EMAIL, {
             to: user.email,
             data: { resetLink },
         });
@@ -103,7 +104,8 @@ const completePasswordResetSchema = z.object({
  * - Always invalidates all existing sessions for security
  * - All remaining password-reset tokens for this user are deleted
  */
-export async function completePasswordReset({ token: rawToken, newPassword: rawNewPassword, }) {
+export async function completePasswordReset({ token: rawToken, newPassword: rawNewPassword, context, }) {
+    const { services } = context;
     const { token, newPassword } = await completePasswordResetSchema
         .parseAsync({
         token: rawToken,
@@ -151,8 +153,10 @@ export async function completePasswordReset({ token: rawToken, newPassword: rawN
             where: { userId: user.id },
         }),
     ]);
+    // Reset login rate limits so the user can log in with their new password
+    await resetLoginRateLimits({ email: user.email, ip: context.reqInfo.ip });
     // Send password changed confirmation email
-    await sendEmail(TPL_PASSWORD_CHANGED_EMAIL, {
+    await services.email.send(TPL_PASSWORD_CHANGED_EMAIL, {
         to: user.email,
         data: {},
     });

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/password-reset.service.ts

@@ -1,18 +1,18 @@
 // @ts-nocheck
 
-import type { RequestServiceContext } from '%requestServiceContextImports';
+import type { RequestServiceContextWith } from '%requestServiceContextImports';
 
 import {
   PASSWORD_MAX_LENGTH,
   PASSWORD_MIN_LENGTH,
   PASSWORD_RESET_TOKEN_EXPIRY_SEC,
 } from '$constantsPassword';
+import { resetLoginRateLimits } from '$servicesUserPassword';
 import {
   createAuthVerification,
   validateAuthVerification,
 } from '%authModuleImports';
-import { config } from '%configServiceImports';
-import { sendEmail } from '%emailModuleImports';
+import { getConfig } from '%configServiceImports';
 import {
   BadRequestError,
   handleZodRequestValidationError,
@@ -68,8 +68,10 @@ export async function requestPasswordReset({
   context,
 }: {
   email: string;
-  context: RequestServiceContext;
+  context: RequestServiceContextWith<'email'>;
 }): Promise<{ success: true }> {
+  const { services } = context;
+
   const { email } = await requestPasswordResetSchema
     .parseAsync({ email: rawEmail })
     .catch(handleZodRequestValidationError);
@@ -106,10 +108,10 @@ export async function requestPasswordReset({
     });
 
     // Construct reset URL using configured domain
-    const resetLink = `${config.AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
+    const resetLink = `${getConfig().AUTH_FRONTEND_URL}/auth/reset-password?token=${encodeURIComponent(token)}`;
 
     // Send email asynchronously (queue-based)
-    await sendEmail(TPL_PASSWORD_RESET_EMAIL, {
+    await services.email.send(TPL_PASSWORD_RESET_EMAIL, {
       to: user.email,
       data: { resetLink },
     });
@@ -167,10 +169,14 @@ const completePasswordResetSchema = z.object({
 export async function completePasswordReset({
   token: rawToken,
   newPassword: rawNewPassword,
+  context,
 }: {
   token: string;
   newPassword: string;
+  context: RequestServiceContextWith<'email'>;
 }): Promise<{ success: true }> {
+  const { services } = context;
+
   const { token, newPassword } = await completePasswordResetSchema
     .parseAsync({
       token: rawToken,
@@ -225,8 +231,11 @@ export async function completePasswordReset({
     }),
   ]);
 
+  // Reset login rate limits so the user can log in with their new password
+  await resetLoginRateLimits({ email: user.email, ip: context.reqInfo.ip });
+
   // Send password changed confirmation email
-  await sendEmail(TPL_PASSWORD_CHANGED_EMAIL, {
+  await services.email.send(TPL_PASSWORD_CHANGED_EMAIL, {
     to: user.email,
     data: {},
   });

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/user-password.service.d.ts

@@ -1,16 +1,27 @@
 import type { User } from '%prismaGeneratedImports';
 import type { RequestServiceContext } from '%requestServiceContextImports';
 import type { UserSessionPayload } from '%userSessionTypesImports';
+/**
+ * Resets login rate limits for the given email+IP combination.
+ * Intentionally scoped to the requesting IP only — a password reset should not
+ * clear rate limits accumulated from other IPs (which may be attacker traffic).
+ */
+export declare function resetLoginRateLimits({ email, ip, }: {
+    email: string;
+    ip: string;
+}): Promise<void>;
 export declare function createUserWithEmailAndPassword({ input, }: {
     input: {
         email: string;
         password: string;
+        name?: string;
     };
 }): Promise<User>;
 export declare function registerUserWithEmailAndPassword({ input, context, }: {
     input: {
         email: string;
         password: string;
+        name?: string;
     };
     context: RequestServiceContext;
 }): Promise<{