@binary1702/auth 0.1.1 → 0.2.1

package/INSTALL.md

@@ -40,8 +40,19 @@ const user = await requireUser()   // { id, username } or throws 401
 
 ## More users
 
+From the terminal:
+
 ```bash
 npx @binary1702/auth add-user
 npx @binary1702/auth set-password
 npx @binary1702/auth list-users
 ```
+
+Or let people register themselves at `/auth/sign-up`. Add to `.env.local`:
+
+```
+AUTH_SIGNUP=open             # anyone can create an account
+AUTH_INVITE_CODE=secret      # optional: the form then asks for this code
+```
+
+Without `AUTH_SIGNUP`, sign-up is closed. The one exception is a fresh install with zero users, where `/auth/sign-in` takes you to create the first account.

package/PROMPT.md

@@ -67,7 +67,7 @@ const user = await requireUser()   // { id, username } or throws AuthError (401)
 
 For sign-out, link to `/auth/sign-out`. For client code, `fetch("/auth/session")`.
 
-Do not build a sign-up page. Users are created with `npx @binary1702/auth add-user`.
+Do not build a sign-up page. One exists at `/auth/sign-up`. It is closed by default (except for the very first user on an empty install). To let people register, add `AUTH_SIGNUP=open` to `.env.local`, optionally with `AUTH_INVITE_CODE=<code>` to require a code on the form. Users can also be created with `npx @binary1702/auth add-user`.
 
 ## Deploy
 

package/README.md

@@ -77,6 +77,7 @@ Works in route handlers, server components, and server actions.
 | URL | What it does |
 |---|---|
 | `/auth/sign-in` | The sign-in page. Served by the package, no React, no styling work. |
+| `/auth/sign-up` | Self registration. Closed unless `AUTH_SIGNUP=open`. See [Users](#users). |
 | `/auth/sign-out` | Clears the session and sends you back to sign-in. Link to it. |
 | `/auth/session` | `{ user }` or `{ user: null }` as JSON, for client code. |
 
@@ -84,9 +85,11 @@ Everything else on the site requires a session. Unauthenticated page requests re
 
 ---
 
-## Managing users
+## Users
 
-There is no sign-up page. Users are created from the terminal.
+Two ways in. Pick one or use both.
+
+**From the terminal** (always works):
 
 ```bash
 npx @binary1702/auth add-user           # prompts for username and password
@@ -95,6 +98,18 @@ npx @binary1702/auth set-password ben
 npx @binary1702/auth list-users
 ```
 
+**Self sign-up at `/auth/sign-up`**, controlled by one env var:
+
+| `.env.local` | Who can sign up |
+|---|---|
+| nothing set | Nobody. Except on a fresh install with zero users: `/auth/sign-in` sends you to create the first account. |
+| `AUTH_SIGNUP=open` | Anyone. The sign-in page gets a "Create one" link. |
+| `AUTH_SIGNUP=open` + `AUTH_INVITE_CODE=secret` | Anyone who knows the code. The form gets an invite field. |
+
+Rules on the form: username 2 to 32 characters (letters, numbers, `. _ -`), password at least 8. Accounts are created and signed in immediately. Nothing to approve.
+
+Programmatic: `POST /auth/sign-up` as JSON `{ username, password, invite? }` returns `200 { user }` and the cookie, or `400 / 403 / 404 / 409` with `{ error }`.
+
 ---
 
 ## The two files it wrote

package/dist/cli.js

@@ -197,22 +197,22 @@ async function stepSchema() {
     await ensureSchema().catch((e) => fail(`Could not reach the database: ${e.message}`));
     done("auth_users table ready");
 }
-async function createUserInteractive(presetName) {
+async function createUserInteractive(presetEmail) {
     const { createUser, findUser } = await db();
     const { hashPassword } = await import("./core/password.js");
-    const username = presetName ?? (await ask("Username"));
-    if (!username)
-        fail("Username is required.");
-    if (await findUser(username))
-        fail(`User "${username}" already exists.`);
+    const email = (presetEmail ?? (await ask("Email"))).trim().toLowerCase();
+    if (!email)
+        fail("Email is required.");
+    if (await findUser(email))
+        fail(`User "${email}" already exists.`);
     const password = await ask("Password", { hidden: true });
     if (password.length < 8)
         fail("Password must be at least 8 characters.");
     const again = await ask("Password again", { hidden: true });
     if (password !== again)
         fail("Passwords do not match.");
-    await createUser(username, await hashPassword(password));
-    done(`user "${username}" created`);
+    await createUser(email, await hashPassword(password));
+    done(`user "${email}" created`);
 }
 async function stepFirstUser() {
     const { countUsers } = await db();
@@ -231,9 +231,12 @@ ${c.bold("Done.")} Start the dev server and open ${c.bold("/auth/sign-in")}.
 Get the user in any route or server component:
 
   import { requireUser } from "${PKG}/next"
-  const user = await requireUser()   // { id, username }
+  const user = await requireUser()   // { id, email }
 
 Add users later:  npx ${PKG} add-user
+Or let people register themselves at /auth/sign-up:
+  AUTH_SIGNUP=open            in .env.local (anyone)
+  AUTH_INVITE_CODE=<code>     optional, the form then needs it
 `);
 }
 // ── main ──────────────────────────────────────────────────────
@@ -242,8 +245,8 @@ async function main() {
     console.log(`\n${c.bold(PKG)}\n`);
     if (cmd === "help" || cmd === "--help" || cmd === "-h") {
         console.log(`  npx ${PKG}                    set up auth in this project (safe to re-run)
-  npx ${PKG} add-user [name]    create a user
-  npx ${PKG} set-password [name]
+  npx ${PKG} add-user [email]   create a user
+  npx ${PKG} set-password [email]
   npx ${PKG} list-users
 `);
         return;
@@ -256,16 +259,16 @@ async function main() {
             await createUserInteractive(arg);
         if (cmd === "list-users") {
             for (const u of await d.listUsers())
-                console.log(`  ${u.username}  ${c.dim(u.id)}`);
+                console.log(`  ${u.email}  ${c.dim(u.id)}`);
         }
         if (cmd === "set-password") {
-            const username = arg ?? (await ask("Username"));
+            const email = (arg ?? (await ask("Email"))).trim().toLowerCase();
             const password = await ask("New password", { hidden: true });
             if (password.length < 8)
                 fail("Password must be at least 8 characters.");
             const { hashPassword } = await import("./core/password.js");
-            const ok = await d.setPassword(username, await hashPassword(password));
-            ok ? done(`password updated for "${username}"`) : fail(`No user "${username}".`);
+            const ok = await d.setPassword(email, await hashPassword(password));
+            ok ? done(`password updated for "${email}"`) : fail(`No user "${email}".`);
         }
         console.log();
         return;

package/dist/core/config.d.ts

@@ -2,6 +2,7 @@ export declare const COOKIE_NAME = "auth_session";
 export declare const SESSION_DAYS = 7;
 export declare const SIGN_IN_PATH = "/auth/sign-in";
 export declare const SIGN_OUT_PATH = "/auth/sign-out";
+export declare const SIGN_UP_PATH = "/auth/sign-up";
 export declare const TABLE = "auth_users";
 export declare function getSecret(): string;
 export declare function getDatabaseUrl(): string;

package/dist/core/config.js

@@ -8,6 +8,7 @@ export const COOKIE_NAME = "auth_session";
 export const SESSION_DAYS = 7;
 export const SIGN_IN_PATH = "/auth/sign-in";
 export const SIGN_OUT_PATH = "/auth/sign-out";
+export const SIGN_UP_PATH = "/auth/sign-up";
 export const TABLE = "auth_users";
 export function getSecret() {
     const secret = process.env.AUTH_SECRET;

package/dist/core/db.d.ts

@@ -3,14 +3,14 @@ import type { User } from "./session.ts";
 export declare function ensureSchema(): Promise<void>;
 type Row = {
     id: string;
-    username: string;
+    email: string;
     password_hash: string;
 };
-export declare function findUser(username: string): Promise<Row | null>;
-export declare function createUser(username: string, passwordHash: string): Promise<User>;
+export declare function findUser(email: string): Promise<Row | null>;
+export declare function createUser(email: string, passwordHash: string): Promise<User>;
 export declare function countUsers(): Promise<number>;
 export declare function listUsers(): Promise<(User & {
     created_at: string;
 })[]>;
-export declare function setPassword(username: string, passwordHash: string): Promise<boolean>;
+export declare function setPassword(email: string, passwordHash: string): Promise<boolean>;
 export { TABLE };

package/dist/core/db.js

@@ -1,7 +1,7 @@
 // ─────────────────────────────────────────────────────────────
 // Storage. One table, owned by this package.
 //
-//   auth_users (id, username, password_hash, created_at)
+//   auth_users (id, email, password_hash, created_at)
 //
 // ensureSchema() is idempotent and memoized per process, so route
 // handlers can call it on every request for free after the first.
@@ -18,7 +18,7 @@ export function ensureSchema() {
         await sql() `
       CREATE TABLE IF NOT EXISTS auth_users (
         id            UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-        username      TEXT NOT NULL UNIQUE,
+        email         TEXT NOT NULL UNIQUE,
         password_hash TEXT NOT NULL,
         created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
       )
@@ -28,19 +28,19 @@ export function ensureSchema() {
         throw err;
     }));
 }
-export async function findUser(username) {
+export async function findUser(email) {
     await ensureSchema();
     const rows = (await sql() `
-    SELECT id, username, password_hash FROM auth_users WHERE username = ${username}
+    SELECT id, email, password_hash FROM auth_users WHERE email = ${email}
   `);
     return rows[0] ?? null;
 }
-export async function createUser(username, passwordHash) {
+export async function createUser(email, passwordHash) {
     await ensureSchema();
     const [row] = (await sql() `
-    INSERT INTO auth_users (username, password_hash)
-    VALUES (${username}, ${passwordHash})
-    RETURNING id, username
+    INSERT INTO auth_users (email, password_hash)
+    VALUES (${email}, ${passwordHash})
+    RETURNING id, email
   `);
     return row;
 }
@@ -52,13 +52,13 @@ export async function countUsers() {
 export async function listUsers() {
     await ensureSchema();
     return (await sql() `
-    SELECT id, username, created_at FROM auth_users ORDER BY created_at
+    SELECT id, email, created_at FROM auth_users ORDER BY created_at
   `);
 }
-export async function setPassword(username, passwordHash) {
+export async function setPassword(email, passwordHash) {
     await ensureSchema();
     const rows = (await sql() `
-    UPDATE auth_users SET password_hash = ${passwordHash} WHERE username = ${username} RETURNING id
+    UPDATE auth_users SET password_hash = ${passwordHash} WHERE email = ${email} RETURNING id
   `);
     return rows.length > 0;
 }

package/dist/core/html.d.ts

@@ -2,4 +2,12 @@ export declare function signInPage(opts?: {
     error?: string;
     next?: string;
     title?: string;
+    canSignUp?: boolean;
+}): string;
+export declare function signUpPage(opts?: {
+    error?: string;
+    next?: string;
+    title?: string;
+    inviteRequired?: boolean;
+    first?: boolean;
 }): string;

package/dist/core/html.js

@@ -1,20 +1,10 @@
 // ─────────────────────────────────────────────────────────────
-// The sign-in page. Plain HTML served by the route handler,
-// so the consumer never builds a form or a page.
+// The sign-in and sign-up pages. Plain HTML served by the route
+// handler, so the consumer never builds a form or a page.
 // ─────────────────────────────────────────────────────────────
-import { SIGN_IN_PATH } from "./config.js";
+import { SIGN_IN_PATH, SIGN_UP_PATH } from "./config.js";
 const escape = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
-export function signInPage(opts = {}) {
-    const title = escape(opts.title ?? "Sign in");
-    const next = escape(opts.next ?? "/");
-    const error = opts.error ? `<p class="error">${escape(opts.error)}</p>` : "";
-    return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title}</title>
-<style>
+const STYLE = `
   :root { color-scheme: light dark; --fg: #111; --bg: #fff; --line: #ddd; --muted: #666; --err: #c0392b; }
   @media (prefers-color-scheme: dark) { :root { --fg: #eee; --bg: #111; --line: #333; --muted: #999; --err: #ff6b6b; } }
   * { box-sizing: border-box; }
@@ -27,17 +17,58 @@ export function signInPage(opts = {}) {
   input:focus { outline: 2px solid var(--fg); outline-offset: 1px; }
   button { font: inherit; font-weight: 500; padding: 9px; border: 0; border-radius: 6px; background: var(--fg); color: var(--bg); cursor: pointer; }
   .error { margin: 0; font-size: 13px; color: var(--err); }
-</style>
+  .alt { margin: 4px 0 0; font-size: 13px; color: var(--muted); text-align: center; }
+  .alt a { color: var(--fg); }
+`;
+function page(opts) {
+    const title = escape(opts.title);
+    const next = escape(opts.next ?? "/");
+    const error = opts.error ? `<p class="error">${escape(opts.error)}</p>` : "";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>${STYLE}</style>
 </head>
 <body>
-<form method="post" action="${SIGN_IN_PATH}">
+<form method="post" action="${opts.action}">
   <h1>${title}</h1>
   ${error}
-  <label>Username <input name="username" autocomplete="username" autofocus required></label>
-  <label>Password <input name="password" type="password" autocomplete="current-password" required></label>
+  ${opts.fields}
   <input type="hidden" name="next" value="${next}">
-  <button type="submit">Sign in</button>
+  <button type="submit">${escape(opts.button)}</button>
+  ${opts.alt ?? ""}
 </form>
 </body>
 </html>`;
 }
+export function signInPage(opts = {}) {
+    const next = opts.next && opts.next !== "/" ? `?next=${encodeURIComponent(opts.next)}` : "";
+    return page({
+        title: opts.title ?? "Sign in",
+        action: SIGN_IN_PATH,
+        error: opts.error,
+        next: opts.next,
+        button: "Sign in",
+        fields: `
+  <label>Email <input name="email" type="email" autocomplete="email" autofocus required></label>
+  <label>Password <input name="password" type="password" autocomplete="current-password" required></label>`,
+        alt: opts.canSignUp ? `<p class="alt">No account? <a href="${SIGN_UP_PATH}${next}">Create one</a></p>` : undefined,
+    });
+}
+export function signUpPage(opts = {}) {
+    const next = opts.next && opts.next !== "/" ? `?next=${encodeURIComponent(opts.next)}` : "";
+    return page({
+        title: opts.title ?? (opts.first ? "Create the first account" : "Create account"),
+        action: SIGN_UP_PATH,
+        error: opts.error,
+        next: opts.next,
+        button: "Create account",
+        fields: `
+  <label>Email <input name="email" type="email" autocomplete="email" autofocus required></label>
+  <label>Password <input name="password" type="password" autocomplete="new-password" minlength="8" required></label>${opts.inviteRequired ? `\n  <label>Invite code <input name="invite" autocomplete="off" required></label>` : ""}`,
+        alt: opts.first ? undefined : `<p class="alt">Have an account? <a href="${SIGN_IN_PATH}${next}">Sign in</a></p>`,
+    });
+}

package/dist/core/session.d.ts

@@ -1,6 +1,6 @@
 export type User = {
     id: string;
-    username: string;
+    email: string;
 };
 export declare function signSession(user: User, secret: string): Promise<string>;
 export declare function verifySession(token: string, secret: string): Promise<User | null>;

package/dist/core/session.js

@@ -9,7 +9,7 @@ import { SignJWT, jwtVerify } from "jose";
 import { SESSION_DAYS } from "./config.js";
 const key = (secret) => new TextEncoder().encode(secret);
 export async function signSession(user, secret) {
-    return new SignJWT({ username: user.username })
+    return new SignJWT({ email: user.email })
         .setProtectedHeader({ alg: "HS256" })
         .setSubject(user.id)
         .setIssuedAt()
@@ -19,9 +19,9 @@ export async function signSession(user, secret) {
 export async function verifySession(token, secret) {
     try {
         const { payload } = await jwtVerify(token, key(secret), { algorithms: ["HS256"] });
-        if (typeof payload.sub !== "string" || typeof payload.username !== "string")
+        if (typeof payload.sub !== "string" || typeof payload.email !== "string")
             return null;
-        return { id: payload.sub, username: payload.username };
+        return { id: payload.sub, email: payload.email };
     }
     catch {
         return null;

package/dist/core/signup.d.ts

@@ -0,0 +1,15 @@
+export type SignupPolicy = {
+    /** Can anyone reach the sign-up page right now? */
+    allowed: boolean;
+    /** Is an invite code required on the form? */
+    inviteRequired: boolean;
+    /** Why it is allowed. "first" skips the invite code: there is nobody to invite you. */
+    reason: "open" | "first" | "closed";
+};
+export declare function signupPolicy(env: {
+    AUTH_SIGNUP?: string;
+    AUTH_INVITE_CODE?: string;
+}, userCount: number): SignupPolicy;
+export declare const EMAIL_RE: RegExp;
+/** Returns an error message, or null when the pair is acceptable. */
+export declare function validateCredentials(email: string, password: string): string | null;

package/dist/core/signup.js

@@ -0,0 +1,26 @@
+// ─────────────────────────────────────────────────────────────
+// Sign-up policy. One pure function, so it can be tested and read.
+//
+//   AUTH_SIGNUP=open          anyone may register at /auth/sign-up
+//   AUTH_INVITE_CODE=<code>   with "open": the form also needs this code
+//   (unset)                   closed, EXCEPT when there are no users yet,
+//                             so a fresh install can create its first
+//                             account in the browser instead of the CLI
+// ─────────────────────────────────────────────────────────────
+export function signupPolicy(env, userCount) {
+    if (userCount === 0)
+        return { allowed: true, inviteRequired: false, reason: "first" };
+    if (env.AUTH_SIGNUP === "open") {
+        return { allowed: true, inviteRequired: Boolean(env.AUTH_INVITE_CODE), reason: "open" };
+    }
+    return { allowed: false, inviteRequired: false, reason: "closed" };
+}
+export const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** Returns an error message, or null when the pair is acceptable. */
+export function validateCredentials(email, password) {
+    if (!EMAIL_RE.test(email))
+        return "Please enter a valid email address.";
+    if (password.length < 8)
+        return "Password must be at least 8 characters.";
+    return null;
+}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { hashPassword, verifyPassword } from "./core/password.ts";
 export { signSession, verifySession, type User } from "./core/session.ts";
 export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.ts";
-export { signInPage } from "./core/html.ts";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";
+export { signInPage, signUpPage } from "./core/html.ts";
+export { signupPolicy, validateCredentials, type SignupPolicy } from "./core/signup.ts";
+export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.ts";

package/dist/index.js

@@ -3,5 +3,6 @@
 export { hashPassword, verifyPassword } from "./core/password.js";
 export { signSession, verifySession } from "./core/session.js";
 export { ensureSchema, findUser, createUser, countUsers, listUsers, setPassword } from "./core/db.js";
-export { signInPage } from "./core/html.js";
-export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, getSecret, getDatabaseUrl } from "./core/config.js";
+export { signInPage, signUpPage } from "./core/html.js";
+export { signupPolicy, validateCredentials } from "./core/signup.js";
+export { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_OUT_PATH, SIGN_UP_PATH, getSecret, getDatabaseUrl } from "./core/config.js";

package/dist/next/index.js

@@ -7,21 +7,24 @@
 // Serves:
 //   GET  /auth/sign-in    the sign-in page
 //   POST /auth/sign-in    verify, set cookie, redirect to ?next or /
+//   GET  /auth/sign-up    the sign-up page (see core/signup.ts for when)
+//   POST /auth/sign-up    create user, set cookie, redirect
 //   GET  /auth/sign-out   clear cookie, redirect to sign-in
 //   POST /auth/sign-out   same (for fetch callers)
 //   GET  /auth/session    { user } or { user: null }
 //
 // Use anywhere on the server:
-//   const user = await requireUser()   // { id, username } or throws AuthError(401)
-//   const user = await getUser()       // { id, username } or null
+//   const user = await requireUser()   // { id, email } or throws AuthError(401)
+//   const user = await getUser()       // { id, email } or null
 // ─────────────────────────────────────────────────────────────
 import { cookies } from "next/headers.js";
 import { NextResponse } from "next/server.js";
-import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, getSecret } from "../core/config.js";
+import { COOKIE_NAME, SESSION_DAYS, SIGN_IN_PATH, SIGN_UP_PATH, getSecret } from "../core/config.js";
 import { signSession, verifySession } from "../core/session.js";
-import { verifyPassword } from "../core/password.js";
-import { findUser } from "../core/db.js";
-import { signInPage } from "../core/html.js";
+import { hashPassword, verifyPassword } from "../core/password.js";
+import { countUsers, createUser, findUser } from "../core/db.js";
+import { signInPage, signUpPage } from "../core/html.js";
+import { signupPolicy, validateCredentials } from "../core/signup.js";
 export class AuthError extends Error {
     status = 401;
     constructor(message = "Unauthorized") {
@@ -67,18 +70,37 @@ function html(body, status = 200) {
 }
 async function readBody(req) {
     const type = req.headers.get("content-type") ?? "";
-    if (type.includes("application/json")) {
-        const b = (await req.json().catch(() => ({})));
-        return { username: String(b.username ?? ""), password: String(b.password ?? ""), next: safeNext(String(b.next ?? "")), json: true };
-    }
-    const f = await req.formData();
+    const get = (b, k) => String((b instanceof FormData ? b.get(k) : b[k]) ?? "");
+    const b = type.includes("application/json")
+        ? (await req.json().catch(() => ({})))
+        : await req.formData();
     return {
-        username: String(f.get("username") ?? ""),
-        password: String(f.get("password") ?? ""),
-        next: safeNext(String(f.get("next") ?? "")),
-        json: false,
+        email: get(b, "email").trim().toLowerCase(),
+        password: get(b, "password"),
+        invite: get(b, "invite").trim(),
+        next: safeNext(get(b, "next")),
+        json: type.includes("application/json"),
     };
 }
+async function currentUser(req) {
+    const token = req.cookies.get(COOKIE_NAME)?.value;
+    return token ? verifySession(token, getSecret()) : null;
+}
+/** Sign the user in on a response: cookie + redirect (form) or JSON (fetch). */
+async function signedIn(req, user, next, json) {
+    const token = await signSession(user, getSecret());
+    const res = json ? NextResponse.json({ user }) : NextResponse.redirect(new URL(next, req.url), 303);
+    res.cookies.set(COOKIE_NAME, token, cookieOptions());
+    return res;
+}
+/** Back to a form with ?error=<msg>, keeping ?next. */
+function backTo(req, path, error, next) {
+    const url = new URL(path, req.url);
+    url.searchParams.set("error", error);
+    if (next !== "/")
+        url.searchParams.set("next", next);
+    return NextResponse.redirect(url, 303);
+}
 function signOutResponse(req, json) {
     const res = json
         ? NextResponse.json({ ok: true })
@@ -86,26 +108,37 @@ function signOutResponse(req, json) {
     res.cookies.set(COOKIE_NAME, "", { ...cookieOptions(), maxAge: 0 });
     return res;
 }
+async function policy() {
+    return signupPolicy(process.env, await countUsers());
+}
 // ── handlers ──────────────────────────────────────────────────
 export async function GET(req, ctx) {
     const { path } = await ctx.params;
     const route = path.join("/");
+    const q = req.nextUrl.searchParams;
+    const next = safeNext(q.get("next"));
     if (route === "sign-in") {
-        const next = safeNext(req.nextUrl.searchParams.get("next"));
-        const existing = req.cookies.get(COOKIE_NAME)?.value;
-        if (existing && (await verifySession(existing, getSecret()))) {
+        if (await currentUser(req))
             return NextResponse.redirect(new URL(next, req.url));
-        }
-        const error = req.nextUrl.searchParams.get("error") ? "Wrong username or password." : undefined;
-        return html(signInPage({ next, error }));
+        const p = await policy();
+        // A fresh install has nobody to sign in: go straight to creating the first account.
+        if (p.reason === "first")
+            return NextResponse.redirect(new URL(SIGN_UP_PATH, req.url));
+        const error = q.get("error") === "1" ? "Wrong email or password." : (q.get("error") ?? undefined);
+        return html(signInPage({ next, error, canSignUp: p.allowed }));
+    }
+    if (route === "sign-up") {
+        if (await currentUser(req))
+            return NextResponse.redirect(new URL(next, req.url));
+        const p = await policy();
+        if (!p.allowed)
+            return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
+        return html(signUpPage({ next, error: q.get("error") ?? undefined, inviteRequired: p.inviteRequired, first: p.reason === "first" }));
     }
     if (route === "sign-out")
         return signOutResponse(req, false);
-    if (route === "session") {
-        const token = req.cookies.get(COOKIE_NAME)?.value;
-        const user = token ? await verifySession(token, getSecret()) : null;
-        return NextResponse.json({ user });
-    }
+    if (route === "session")
+        return NextResponse.json({ user: await currentUser(req) });
     return NextResponse.json({ error: "Not found" }, { status: 404 });
 }
 export async function POST(req, ctx) {
@@ -113,23 +146,32 @@ export async function POST(req, ctx) {
     const route = path.join("/");
     if (route === "sign-out")
         return signOutResponse(req, true);
-    if (route !== "sign-in")
-        return NextResponse.json({ error: "Not found" }, { status: 404 });
-    const { username, password, next, json } = await readBody(req);
-    const row = username && password ? await findUser(username.trim()) : null;
-    const ok = row ? await verifyPassword(password, row.password_hash) : false;
-    if (!row || !ok) {
-        if (json)
-            return NextResponse.json({ error: "Wrong username or password" }, { status: 401 });
-        const url = new URL(SIGN_IN_PATH, req.url);
-        url.searchParams.set("error", "1");
-        if (next !== "/")
-            url.searchParams.set("next", next);
-        return NextResponse.redirect(url, 303);
+    if (route === "sign-in") {
+        const { email, password, next, json } = await readBody(req);
+        const row = email && password ? await findUser(email) : null;
+        const ok = row ? await verifyPassword(password, row.password_hash) : false;
+        if (!row || !ok) {
+            if (json)
+                return NextResponse.json({ error: "Wrong email or password" }, { status: 401 });
+            return backTo(req, SIGN_IN_PATH, "1", next);
+        }
+        return signedIn(req, { id: row.id, email: row.email }, next, json);
     }
-    const user = { id: row.id, username: row.username };
-    const token = await signSession(user, getSecret());
-    const res = json ? NextResponse.json({ user }) : NextResponse.redirect(new URL(next, req.url), 303);
-    res.cookies.set(COOKIE_NAME, token, cookieOptions());
-    return res;
+    if (route === "sign-up") {
+        const { email, password, invite, next, json } = await readBody(req);
+        const p = await policy();
+        const fail = (msg, status = 400) => json ? NextResponse.json({ error: msg }, { status }) : backTo(req, SIGN_UP_PATH, msg, next);
+        if (!p.allowed)
+            return NextResponse.json({ error: "Sign-up is closed" }, { status: 404 });
+        if (p.inviteRequired && invite !== process.env.AUTH_INVITE_CODE)
+            return fail("Wrong invite code.", 403);
+        const invalid = validateCredentials(email, password);
+        if (invalid)
+            return fail(invalid);
+        if (await findUser(email))
+            return fail("That email is already registered.", 409);
+        const user = await createUser(email, await hashPassword(password));
+        return signedIn(req, user, next, json);
+    }
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@binary1702/auth",
-  "version": "0.1.1",
-  "description": "Username + password auth for Next.js. One command: npx @binary1702/auth",
+  "version": "0.2.1",
+  "description": "Email + password auth for Next.js. One command: npx @binary1702/auth",
   "type": "module",
   "repository": {
     "type": "git",