@baseplate-dev/plugin-auth 1.0.7 → 1.0.8

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/user-password.service.js

@@ -5,7 +5,6 @@ import { BadRequestError, handleZodRequestValidationError, logError, NotFoundErr
 import { createPasswordHash, verifyPasswordHash, } from '%passwordHasherServiceImports';
 import { prisma } from '%prismaImports';
 import { memoizeRateLimiter } from '%rateLimitImports';
-import { userSessionService } from '%userSessionServiceImports';
 import z from 'zod';
 const PROVIDER_ID = 'email-password';
 const emailPasswordSchema = z.object({
@@ -14,6 +13,7 @@ const emailPasswordSchema = z.object({
         .max(PASSWORD_MAX_LENGTH)
         .transform((value) => value.toLowerCase()),
     password: z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),
+    name: z.string().min(1).max(100).optional(),
 });
 /**
  * Rate limiters for authentication operations.
@@ -24,19 +24,31 @@ const getRegistrationLimiter = memoizeRateLimiter('registration', {
     blockDuration: 60 * 60, // Block for 1 hour if exceeded
 });
 const getLoginIpLimiter = memoizeRateLimiter('login-ip', {
-    points: 10,
-    duration: 60 * 60 * 24, // 24 hours
+    points: 15,
+    duration: 60 * 60, // 1 hour
     blockDuration: 60 * 60, // Block for 1 hour if exceeded
 });
 const getLoginConsecutiveFailsLimiter = memoizeRateLimiter('login-consecutive-fails', {
-    points: 5,
-    duration: 60 * 60 * 24, // 24 hours (duration for tracking)
-    blockDuration: 60 * 15, // Block for 15 minutes after 5 consecutive fails
+    points: 10,
+    duration: 60 * 60, // 1 hour (duration for tracking)
+    blockDuration: 60 * 15, // Block for 15 minutes after consecutive fails
 });
+/**
+ * Resets login rate limits for the given email+IP combination.
+ * Intentionally scoped to the requesting IP only — a password reset should not
+ * clear rate limits accumulated from other IPs (which may be attacker traffic).
+ */
+export async function resetLoginRateLimits({ email, ip, }) {
+    await Promise.all([
+        getLoginConsecutiveFailsLimiter().delete(`${email}_${ip}`),
+        getLoginIpLimiter().delete(ip),
+    ]);
+}
 export async function createUserWithEmailAndPassword({ input, }) {
-    const { email, password } = await emailPasswordSchema
+    const { email, password, name } = await emailPasswordSchema
         .parseAsync(input)
         .catch(handleZodRequestValidationError);
+    TPL_NAME_REQUIRED_CHECK;
     // check if user with that email already exists
     const existingUser = await prisma.userAccount.findUnique({
         where: {
@@ -53,6 +65,7 @@ export async function createUserWithEmailAndPassword({ input, }) {
     const user = await prisma.user.create({
         data: {
             email,
+            name,
             accounts: {
                 create: {
                     accountId: email,
@@ -68,7 +81,7 @@ export async function registerUserWithEmailAndPassword({ input, context, }) {
     // Rate limit registration by IP
     await getRegistrationLimiter().consumeOrThrow(context.reqInfo.ip, 'Too many registration attempts. Please try again later.', 'registration-rate-limited');
     const user = await createUserWithEmailAndPassword({ input });
-    const session = await userSessionService.createSession(user.id, context);
+    const session = await context.services.userSession.createSession(user.id, context);
     // Send verification email (fire-and-forget, don't block registration)
     requestEmailVerification({ userId: user.id, context }).catch(logError);
     return { session, user };
@@ -81,11 +94,14 @@ export async function authenticateUserWithEmailAndPassword({ input, context, })
     const clientIp = context.reqInfo.ip;
     const emailIpKey = `${email}_${clientIp}`;
     // Check IP-based rate limit (slow brute force protection)
-    await getLoginIpLimiter().consumeOrThrow(clientIp, 'Too many login attempts. Please try again later.', 'login-ip-rate-limited');
+    const ipResult = await getLoginIpLimiter().get(clientIp);
+    if (ipResult && !ipResult.allowed) {
+        throw new TooManyRequestsError('Too many login attempts. Please try again later or reset your password.', 'login-ip-rate-limited', { retryAfterMs: ipResult.msBeforeNext });
+    }
     // Check consecutive failures rate limit (fast brute force protection)
     const consecutiveFailsResult = await getLoginConsecutiveFailsLimiter().get(emailIpKey);
     if (consecutiveFailsResult && !consecutiveFailsResult.allowed) {
-        throw new TooManyRequestsError('Account temporarily locked due to too many failed attempts. Please try again later.', 'login-consecutive-fails-blocked', { retryAfterMs: consecutiveFailsResult.msBeforeNext });
+        throw new TooManyRequestsError('Account temporarily locked due to too many failed attempts. Please reset your password or try again later.', 'login-consecutive-fails-blocked', { retryAfterMs: consecutiveFailsResult.msBeforeNext });
     }
     // check if user with that email exists
     const userAccount = await prisma.userAccount.findUnique({
@@ -97,15 +113,18 @@ export async function authenticateUserWithEmailAndPassword({ input, context, })
         },
     });
     // check for password match
-    const isValid = await verifyPasswordHash(userAccount?.password ?? '', password);
+    const isValid = await verifyPasswordHash(userAccount?.password, password);
     if (!isValid || !userAccount) {
         // Track failed attempt
-        await getLoginConsecutiveFailsLimiter().consume(emailIpKey);
+        await Promise.all([
+            getLoginIpLimiter().consume(clientIp),
+            getLoginConsecutiveFailsLimiter().consume(emailIpKey),
+        ]);
         throw new BadRequestError('Invalid email or password', 'invalid-credentials');
     }
     // Reset consecutive failures on successful login
     await getLoginConsecutiveFailsLimiter().delete(emailIpKey);
-    const session = await userSessionService.createSession(userAccount.userId, context);
+    const session = await context.services.userSession.createSession(userAccount.userId, context);
     return { session };
 }
 const changePasswordSchema = z.object({
@@ -133,7 +152,7 @@ export async function changeUserPassword({ userId, input, }) {
         },
     });
     // Verify current password
-    const isValid = await verifyPasswordHash(userAccount?.password ?? '', currentPassword);
+    const isValid = await verifyPasswordHash(userAccount?.password, currentPassword);
     if (!isValid || !userAccount) {
         throw new BadRequestError('Current password is incorrect', 'invalid-current-password');
     }

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/user-password.service.ts

@@ -19,7 +19,6 @@ import {
 } from '%passwordHasherServiceImports';
 import { prisma } from '%prismaImports';
 import { memoizeRateLimiter } from '%rateLimitImports';
-import { userSessionService } from '%userSessionServiceImports';
 import z from 'zod';
 
 const PROVIDER_ID = 'email-password';
@@ -30,6 +29,7 @@ const emailPasswordSchema = z.object({
     .max(PASSWORD_MAX_LENGTH)
     .transform((value) => value.toLowerCase()),
   password: z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),
+  name: z.string().min(1).max(100).optional(),
 });
 
 /**
@@ -43,31 +43,51 @@ const getRegistrationLimiter = memoizeRateLimiter('registration', {
 });
 
 const getLoginIpLimiter = memoizeRateLimiter('login-ip', {
-  points: 10,
-  duration: 60 * 60 * 24, // 24 hours
+  points: 15,
+  duration: 60 * 60, // 1 hour
   blockDuration: 60 * 60, // Block for 1 hour if exceeded
 });
 
 const getLoginConsecutiveFailsLimiter = memoizeRateLimiter(
   'login-consecutive-fails',
   {
-    points: 5,
-    duration: 60 * 60 * 24, // 24 hours (duration for tracking)
-    blockDuration: 60 * 15, // Block for 15 minutes after 5 consecutive fails
+    points: 10,
+    duration: 60 * 60, // 1 hour (duration for tracking)
+    blockDuration: 60 * 15, // Block for 15 minutes after consecutive fails
   },
 );
 
+/**
+ * Resets login rate limits for the given email+IP combination.
+ * Intentionally scoped to the requesting IP only — a password reset should not
+ * clear rate limits accumulated from other IPs (which may be attacker traffic).
+ */
+export async function resetLoginRateLimits({
+  email,
+  ip,
+}: {
+  email: string;
+  ip: string;
+}): Promise<void> {
+  await Promise.all([
+    getLoginConsecutiveFailsLimiter().delete(`${email}_${ip}`),
+    getLoginIpLimiter().delete(ip),
+  ]);
+}
+
 export async function createUserWithEmailAndPassword({
   input,
 }: {
   input: {
     email: string;
     password: string;
+    name?: string;
   };
 }): Promise<User> {
-  const { email, password } = await emailPasswordSchema
+  const { email, password, name } = await emailPasswordSchema
     .parseAsync(input)
     .catch(handleZodRequestValidationError);
+  TPL_NAME_REQUIRED_CHECK;
   // check if user with that email already exists
   const existingUser = await prisma.userAccount.findUnique({
     where: {
@@ -86,6 +106,7 @@ export async function createUserWithEmailAndPassword({
   const user = await prisma.user.create({
     data: {
       email,
+      name,
       accounts: {
         create: {
           accountId: email,
@@ -106,6 +127,7 @@ export async function registerUserWithEmailAndPassword({
   input: {
     email: string;
     password: string;
+    name?: string;
   };
   context: RequestServiceContext;
 }): Promise<{ session: UserSessionPayload; user: User }> {
@@ -117,7 +139,10 @@ export async function registerUserWithEmailAndPassword({
   );
 
   const user = await createUserWithEmailAndPassword({ input });
-  const session = await userSessionService.createSession(user.id, context);
+  const session = await context.services.userSession.createSession(
+    user.id,
+    context,
+  );
 
   // Send verification email (fire-and-forget, don't block registration)
   requestEmailVerification({ userId: user.id, context }).catch(logError);
@@ -144,11 +169,14 @@ export async function authenticateUserWithEmailAndPassword({
   const emailIpKey = `${email}_${clientIp}`;
 
   // Check IP-based rate limit (slow brute force protection)
-  await getLoginIpLimiter().consumeOrThrow(
-    clientIp,
-    'Too many login attempts. Please try again later.',
-    'login-ip-rate-limited',
-  );
+  const ipResult = await getLoginIpLimiter().get(clientIp);
+  if (ipResult && !ipResult.allowed) {
+    throw new TooManyRequestsError(
+      'Too many login attempts. Please try again later or reset your password.',
+      'login-ip-rate-limited',
+      { retryAfterMs: ipResult.msBeforeNext },
+    );
+  }
 
   // Check consecutive failures rate limit (fast brute force protection)
   const consecutiveFailsResult =
@@ -156,7 +184,7 @@ export async function authenticateUserWithEmailAndPassword({
 
   if (consecutiveFailsResult && !consecutiveFailsResult.allowed) {
     throw new TooManyRequestsError(
-      'Account temporarily locked due to too many failed attempts. Please try again later.',
+      'Account temporarily locked due to too many failed attempts. Please reset your password or try again later.',
       'login-consecutive-fails-blocked',
       { retryAfterMs: consecutiveFailsResult.msBeforeNext },
     );
@@ -173,13 +201,13 @@ export async function authenticateUserWithEmailAndPassword({
   });
 
   // check for password match
-  const isValid = await verifyPasswordHash(
-    userAccount?.password ?? '',
-    password,
-  );
+  const isValid = await verifyPasswordHash(userAccount?.password, password);
   if (!isValid || !userAccount) {
     // Track failed attempt
-    await getLoginConsecutiveFailsLimiter().consume(emailIpKey);
+    await Promise.all([
+      getLoginIpLimiter().consume(clientIp),
+      getLoginConsecutiveFailsLimiter().consume(emailIpKey),
+    ]);
     throw new BadRequestError(
       'Invalid email or password',
       'invalid-credentials',
@@ -189,7 +217,7 @@ export async function authenticateUserWithEmailAndPassword({
   // Reset consecutive failures on successful login
   await getLoginConsecutiveFailsLimiter().delete(emailIpKey);
 
-  const session = await userSessionService.createSession(
+  const session = await context.services.userSession.createSession(
     userAccount.userId,
     context,
   );
@@ -235,7 +263,7 @@ export async function changeUserPassword({
 
   // Verify current password
   const isValid = await verifyPasswordHash(
-    userAccount?.password ?? '',
+    userAccount?.password,
     currentPassword,
   );
   if (!isValid || !userAccount) {

package/dist/local-auth/core/generators/auth-email-templates/auth-email-templates.generator.d.ts

@@ -27,6 +27,7 @@ export declare const authEmailTemplatesGenerator: import("@baseplate-dev/sync").
             };
             EmailLayout: {};
             Heading: {};
+            Link: {};
             renderEmail: {};
             Section: {};
             Text: {};

package/dist/local-auth/core/generators/auth-email-templates/generated/index.d.ts

@@ -25,6 +25,7 @@ export declare const LOCAL_AUTH_AUTH_EMAIL_TEMPLATES_GENERATED: {
                 };
                 EmailLayout: {};
                 Heading: {};
+                Link: {};
                 renderEmail: {};
                 Section: {};
                 Text: {};
@@ -47,6 +48,7 @@ export declare const LOCAL_AUTH_AUTH_EMAIL_TEMPLATES_GENERATED: {
                 };
                 EmailLayout: {};
                 Heading: {};
+                Link: {};
                 renderEmail: {};
                 Section: {};
                 Text: {};
@@ -66,6 +68,7 @@ export declare const LOCAL_AUTH_AUTH_EMAIL_TEMPLATES_GENERATED: {
                 };
                 EmailLayout: {};
                 Heading: {};
+                Link: {};
                 renderEmail: {};
                 Section: {};
                 Text: {};
@@ -85,6 +88,7 @@ export declare const LOCAL_AUTH_AUTH_EMAIL_TEMPLATES_GENERATED: {
                 };
                 EmailLayout: {};
                 Heading: {};
+                Link: {};
                 renderEmail: {};
                 Section: {};
                 Text: {};

package/dist/local-auth/core/generators/auth-email-templates/generated/template-renderers.d.ts

@@ -30,6 +30,7 @@ export declare const LOCAL_AUTH_AUTH_EMAIL_TEMPLATES_RENDERERS: {
             };
             EmailLayout: {};
             Heading: {};
+            Link: {};
             renderEmail: {};
             Section: {};
             Text: {};

package/dist/local-auth/core/generators/auth-email-templates/generated/typed-templates.d.ts

@@ -12,6 +12,7 @@ export declare const LOCAL_AUTH_AUTH_EMAIL_TEMPLATES_TEMPLATES: {
             };
             EmailLayout: {};
             Heading: {};
+            Link: {};
             renderEmail: {};
             Section: {};
             Text: {};
@@ -31,6 +32,7 @@ export declare const LOCAL_AUTH_AUTH_EMAIL_TEMPLATES_TEMPLATES: {
             };
             EmailLayout: {};
             Heading: {};
+            Link: {};
             renderEmail: {};
             Section: {};
             Text: {};
@@ -50,6 +52,7 @@ export declare const LOCAL_AUTH_AUTH_EMAIL_TEMPLATES_TEMPLATES: {
             };
             EmailLayout: {};
             Heading: {};
+            Link: {};
             renderEmail: {};
             Section: {};
             Text: {};

package/dist/local-auth/core/generators/auth-module/auth-module.generator.d.ts

@@ -9,14 +9,14 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
     }, undefined>;
     imports: import("@baseplate-dev/sync").GeneratorTask<{
         authModuleImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            cleanupAuthVerificationQueue: {};
+            cleanupAuthVerificationWorker: {};
             cleanupExpiredAuthVerifications: {};
+            CookieUserSessionService: {};
             createAuthVerification: {};
             userSessionPayload: {};
             validateAuthVerification: {};
         }>>;
-        userSessionServiceImports: import("@baseplate-dev/sync").ProviderExport<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            userSessionService: {};
-        }>>;
     }, {
         paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;
     }, undefined>;
@@ -50,7 +50,8 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             };
         }>>;
         configServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            config: {};
+            getConfig: {};
+            isDevelopment: {};
         }>>;
         errorHandlerServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             BadRequestError: {};
@@ -60,6 +61,7 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
             InternalServerError: {};
             logError: {};
             NotFoundError: {};
+            throwIfPrismaNotFound: {};
             TooManyRequestsError: {};
             UnauthorizedError: {};
         }>>;
@@ -76,14 +78,67 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
         prismaImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             prisma: {};
         }>>;
-        queueServiceImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
-            createQueue: {};
+        queuesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
+            bindQueueHandler: {};
+            DEFAULT_QUEUE_CONCURRENCY: {};
+            defineQueue: {};
+            EnqueueOptions: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBinding: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBindingConfig: {
+                isTypeOnly: true;
+            };
+            QueueHandlerBindingInput: {
+                isTypeOnly: true;
+            };
+            QueueInfo: {
+                isTypeOnly: true;
+            };
+            QueueIntrospection: {
+                isTypeOnly: true;
+            };
+            QueueJob: {
+                isTypeOnly: true;
+            };
+            QueueJobHandler: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixPlan: {
+                isTypeOnly: true;
+            };
+            QueuePolicyFixResult: {
+                isTypeOnly: true;
+            };
+            QueueRuntime: {
+                isTypeOnly: true;
+            };
+            QueueService: {
+                isTypeOnly: true;
+            };
+            QueueToken: {
+                isTypeOnly: true;
+            };
+            QueueWorkers: {
+                isTypeOnly: true;
+            };
+            RepeatableConfig: {
+                isTypeOnly: true;
+            };
+            ScheduledJob: {
+                isTypeOnly: true;
+            };
         }>>;
         requestServiceContextImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
             createContextFromRequest: {};
             RequestServiceContext: {
                 isTypeOnly: true;
             };
+            RequestServiceContextWith: {
+                isTypeOnly: true;
+            };
         }>>;
         typescriptFile: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").TypescriptFileProvider>;
         userSessionTypesImports: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/core-generators").InferTsImportMapFromSchema<{
@@ -108,9 +163,16 @@ export declare const authModuleGenerator: import("@baseplate-dev/sync").Generato
         prismaOutput: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/fastify-generators").PrismaOutputProvider>;
         renderers: import("@baseplate-dev/sync").ProviderType<import("./generated/template-renderers.js").LocalAuthCoreAuthModuleRenderers>;
         userObjectType: import("@baseplate-dev/sync").ProviderDependency<import("@baseplate-dev/fastify-generators").PothosTypeOutputProvider>;
-        queueConfig: import("@baseplate-dev/sync").ProviderDependency<Omit<import("@baseplate-dev/utils").FieldMap<{
-            queues: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/core-generators").TsCodeFragment>;
-        }>, "getValues"> | undefined>;
+        appModule: import("@baseplate-dev/sync").ProviderType<import("@baseplate-dev/fastify-generators").AppModuleProvider>;
+        paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;
+    }, any>;
+    appRuntimeConfig: import("@baseplate-dev/sync").GeneratorTask<any, {
+        appRuntimeConfig: import("@baseplate-dev/sync").ProviderType<Omit<import("@baseplate-dev/utils").FieldMap<{
+            services: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/fastify-generators").AppRuntimeServiceEntry>;
+            construction: import("@baseplate-dev/utils").MapContainer<string, import("@baseplate-dev/fastify-generators").AppRuntimeConstructionEntry>;
+            flattenedModuleFields: import("@baseplate-dev/utils").MapContainer<string, string>;
+            usesBackgroundServices: import("@baseplate-dev/utils").ScalarContainer<boolean | undefined>;
+        }>, "getValues">>;
         paths: import("@baseplate-dev/sync").ProviderType<import("./generated/template-paths.js").LocalAuthCoreAuthModulePaths>;
     }, any>;
 }>;

package/dist/local-auth/core/generators/auth-module/auth-module.generator.js

@@ -1,6 +1,5 @@
-import { tsCodeFragment, TsCodeUtils } from '@baseplate-dev/core-generators';
-import { appModuleProvider, configServiceProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, prismaOutputProvider, } from '@baseplate-dev/fastify-generators';
-import { queueConfigProvider } from '@baseplate-dev/plugin-queue';
+import { tsCodeFragment, TsCodeUtils, tsTypeImportBuilder, } from '@baseplate-dev/core-generators';
+import { appModuleProvider, appRuntimeConfigProvider, configServiceProvider, createPothosPrismaObjectTypeOutputName, pothosTypeOutputProvider, prismaOutputProvider, } from '@baseplate-dev/fastify-generators';
 import { createGenerator, createGeneratorTask, createProviderTask, } from '@baseplate-dev/sync';
 import { quot } from '@baseplate-dev/utils';
 import { z } from 'zod';
@@ -56,10 +55,10 @@ export const authModuleGenerator = createGenerator({
                 userObjectType: pothosTypeOutputProvider
                     .dependency()
                     .reference(createPothosPrismaObjectTypeOutputName(LOCAL_AUTH_MODELS.user)),
-                queueConfig: queueConfigProvider.dependency().optional(),
+                appModule: appModuleProvider,
                 paths: GENERATED_TEMPLATES.paths.provider,
             },
-            run({ prismaOutput, renderers, userObjectType, queueConfig, paths }) {
+            run({ prismaOutput, renderers, userObjectType, appModule, paths }) {
                 return {
                     providers: {
                         authModule: {},
@@ -88,16 +87,29 @@ export const authModuleGenerator = createGenerator({
                                 },
                             },
                         }));
-                        // Render queue only if queue plugin is available
-                        if (queueConfig) {
-                            await builder.apply(renderers.queuesCleanupAuthVerification.render({}));
-                            // Register with` queue system
-                            queueConfig.queues.set('cleanup-auth-verification', TsCodeUtils.importFragment('cleanupAuthVerificationQueue', paths.queuesCleanupAuthVerification));
-                        }
+                        // Render queue
+                        await builder.apply(renderers.queuesCleanupAuthVerification.render({}));
+                        await builder.apply(renderers.queuesCleanupAuthVerificationWorker.render({}));
+                        // Register with the app module's queues field
+                        appModule.moduleFields.set('queues', 'cleanupAuthVerificationWorker', TsCodeUtils.importFragment('cleanupAuthVerificationWorker', paths.queuesCleanupAuthVerificationWorker));
                     },
                 };
             },
         }),
+        appRuntimeConfig: createGeneratorTask({
+            dependencies: {
+                appRuntimeConfig: appRuntimeConfigProvider,
+                paths: GENERATED_TEMPLATES.paths.provider,
+            },
+            run({ appRuntimeConfig, paths }) {
+                appRuntimeConfig.services.set('userSession', {
+                    type: tsCodeFragment('CookieUserSessionService', tsTypeImportBuilder(['CookieUserSessionService']).from(paths.userSessionService)),
+                });
+                appRuntimeConfig.construction.set('userSession', {
+                    fragment: TsCodeUtils.template `new ${TsCodeUtils.importFragment('CookieUserSessionService', paths.userSessionService)}()`,
+                });
+            },
+        }),
     }),
 });
 //# sourceMappingURL=auth-module.generator.js.map