@camstack/addon-auth 1.1.2 → 1.1.4

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CXCR7sEk.js");
+const require_dist = require("../dist-BLBS0d1z.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -30,6 +30,7 @@ const require_dist = require("../dist-CXCR7sEk.js");
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
 var DEFAULT_CONFIG = {
+	enabled: false,
 	displayName: "Email magic link",
 	icon: "mail",
 	publicOrigin: "",
@@ -38,21 +39,10 @@ var DEFAULT_CONFIG = {
 	ttlSec: 600
 };
 var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
-	kind = "magic-link";
-	hasRedirectFlow = false;
-	hasCredentialFlow = true;
-	displayName;
-	icon;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
-		this.displayName = DEFAULT_CONFIG.displayName;
-		this.icon = DEFAULT_CONFIG.icon;
 	}
 	async onInitialize() {
-		Object.assign(this, {
-			displayName: this.config.displayName || DEFAULT_CONFIG.displayName,
-			icon: this.config.icon || DEFAULT_CONFIG.icon
-		});
 		const authProvider = {
 			validateCredentials: async () => null,
 			validateToken: async () => null,
@@ -63,30 +53,55 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routes = [{
-			method: "POST",
-			path: "/request",
-			access: "public",
-			description: "Request a magic link be delivered to the given email",
-			handler: async (req, reply) => this.handleRequest(req, reply)
-		}, {
-			method: "GET",
-			path: "/login",
-			access: "public",
-			description: "Click target embedded in the magic-link email",
-			handler: async (req, reply) => this.handleLogin(req, reply)
-		}];
-		const routeProvider = {
-			id: "auth-magic-link",
-			getRoutes: () => routes
-		};
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-magic-link", [
+			{
+				method: "GET",
+				path: "/start",
+				access: "public",
+				description: "Login-page landing: email-entry form that POSTs to /request",
+				handler: async (req, reply) => this.handleStart(req, reply)
+			},
+			{
+				method: "POST",
+				path: "/request",
+				access: "public",
+				description: "Request a magic link be delivered to the given email",
+				handler: async (req, reply) => this.handleRequest(req, reply)
+			},
+			{
+				method: "GET",
+				path: "/login",
+				access: "public",
+				description: "Click target embedded in the magic-link email",
+				handler: async (req, reply) => this.handleLogin(req, reply)
+			}
+		]);
+		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
+		return [
+			{
+				capability: require_dist.authProviderCapability,
+				provider: authProvider
+			},
+			{
+				capability: require_dist.addonRoutesCapability,
+				provider: routeProvider
+			},
+			{
+				capability: require_dist.loginMethodCapability,
+				provider: loginMethodProvider
+			}
+		];
+	}
+	buildLoginMethods() {
+		if (!this.config.enabled) return [];
 		return [{
-			capability: require_dist.authProviderCapability,
-			provider: authProvider
-		}, {
-			capability: require_dist.addonRoutesCapability,
-			provider: routeProvider
+			kind: "redirect",
+			id: "auth-magic-link",
+			label: this.config.displayName || DEFAULT_CONFIG.displayName,
+			icon: this.config.icon || DEFAULT_CONFIG.icon,
+			startUrl: "/addon/auth-magic-link/start",
+			stage: "primary"
 		}];
 	}
 	globalSettingsSchema() {
@@ -96,6 +111,13 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
+				this.field({
+					type: "boolean",
+					key: "enabled",
+					label: "Enabled",
+					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
+					default: DEFAULT_CONFIG.enabled
+				}),
 				this.field({
 					type: "text",
 					key: "displayName",
@@ -169,6 +191,59 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 		for (const u of users) if (u.username.toLowerCase() === needle) return u;
 		return null;
 	}
+	/**
+	* Login-page landing for the magic-link `redirect` login method. Serves
+	* a self-contained email-entry page that POSTs to `/request`; the tiny
+	* inline script lives in the ADDON's served HTML (not the admin shell),
+	* keeping the login page free of any magic-link-specific JS. Always
+	* responds 200 (account-enumeration-safe, mirroring `/request`).
+	*/
+	async handleStart(_req, reply) {
+		const title = this.config.displayName || DEFAULT_CONFIG.displayName;
+		const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+  :root { color-scheme: dark; }
+  body { margin:0; min-height:100vh; display:flex; align-items:center; justify-content:center;
+         background:#0b0d12; color:#e5e7eb; font:14px/1.5 system-ui,-apple-system,sans-serif; }
+  .card { width:100%; max-width:22rem; padding:1.5rem; border:1px solid #232733; border-radius:0.75rem;
+          background:#12151c; box-shadow:0 10px 30px rgba(0,0,0,.35); }
+  h1 { font-size:1rem; margin:0 0 1rem; }
+  label { font-size:.75rem; color:#9ca3af; display:block; margin-bottom:.35rem; }
+  input { width:100%; box-sizing:border-box; padding:.6rem .7rem; border-radius:.5rem;
+          border:1px solid #232733; background:#0b0d12; color:#e5e7eb; outline:none; }
+  input:focus { border-color:#6366f1; }
+  button { margin-top:1rem; width:100%; padding:.6rem; border:0; border-radius:.5rem; cursor:pointer;
+           background:#6366f1; color:#fff; font-weight:600; }
+  button:disabled { opacity:.5; cursor:default; }
+  .msg { margin-top:1rem; font-size:.8rem; color:#34d399; }
+  .err { color:#f87171; }
+  a { color:#9ca3af; font-size:.75rem; }
+</style></head>
+<body><form class="card" id="f">
+  <h1>${escapeHtml(title)}</h1>
+  <label for="email">Email address</label>
+  <input id="email" name="email" type="email" autocomplete="email" required autofocus placeholder="you@example.com">
+  <button id="b" type="submit">Send login link</button>
+  <div class="msg" id="m" hidden></div>
+  <p style="margin-top:1rem"><a href="/admin/login">Back to sign in</a></p>
+</form>
+<script>
+  var f=document.getElementById('f'),b=document.getElementById('b'),m=document.getElementById('m');
+  f.addEventListener('submit',function(e){e.preventDefault();b.disabled=true;m.hidden=true;m.className='msg';
+    fetch('/addon/auth-magic-link/request',{method:'POST',headers:{'content-type':'application/json'},
+      body:JSON.stringify({email:document.getElementById('email').value})})
+    .then(function(){m.textContent='If that email matches an account, a login link is on its way.';m.hidden=false;})
+    .catch(function(){m.className='msg err';m.textContent='Something went wrong. Please try again.';m.hidden=false;})
+    .finally(function(){b.disabled=false;});});
+<\/script>
+</body></html>`;
+		reply.code(200);
+		reply.header("Content-Type", "text/html; charset=utf-8");
+		reply.send(html);
+	}
 	async handleRequest(req, reply) {
 		try {
 			const body = req.body ?? {};
@@ -235,6 +310,10 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 		reply.send("");
 	}
 };
+/** Minimal HTML-attribute/text escaper for the interpolated page title. */
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
 //#endregion
 exports.AuthMagicLinkAddon = AuthMagicLinkAddon;
 exports.default = AuthMagicLinkAddon;

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as BaseAddon, i as errMsg, n as authProviderCapability, t as addonRoutesCapability } from "../dist-JmuFs-U5.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-JUeAGU3c.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -25,6 +25,7 @@ import { a as BaseAddon, i as errMsg, n as authProviderCapability, t as addonRou
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
 var DEFAULT_CONFIG = {
+	enabled: false,
 	displayName: "Email magic link",
 	icon: "mail",
 	publicOrigin: "",
@@ -33,21 +34,10 @@ var DEFAULT_CONFIG = {
 	ttlSec: 600
 };
 var AuthMagicLinkAddon = class extends BaseAddon {
-	kind = "magic-link";
-	hasRedirectFlow = false;
-	hasCredentialFlow = true;
-	displayName;
-	icon;
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
-		this.displayName = DEFAULT_CONFIG.displayName;
-		this.icon = DEFAULT_CONFIG.icon;
 	}
 	async onInitialize() {
-		Object.assign(this, {
-			displayName: this.config.displayName || DEFAULT_CONFIG.displayName,
-			icon: this.config.icon || DEFAULT_CONFIG.icon
-		});
 		const authProvider = {
 			validateCredentials: async () => null,
 			validateToken: async () => null,
@@ -58,30 +48,55 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routes = [{
-			method: "POST",
-			path: "/request",
-			access: "public",
-			description: "Request a magic link be delivered to the given email",
-			handler: async (req, reply) => this.handleRequest(req, reply)
-		}, {
-			method: "GET",
-			path: "/login",
-			access: "public",
-			description: "Click target embedded in the magic-link email",
-			handler: async (req, reply) => this.handleLogin(req, reply)
-		}];
-		const routeProvider = {
-			id: "auth-magic-link",
-			getRoutes: () => routes
-		};
+		const routeProvider = buildAddonRouteProvider("auth-magic-link", [
+			{
+				method: "GET",
+				path: "/start",
+				access: "public",
+				description: "Login-page landing: email-entry form that POSTs to /request",
+				handler: async (req, reply) => this.handleStart(req, reply)
+			},
+			{
+				method: "POST",
+				path: "/request",
+				access: "public",
+				description: "Request a magic link be delivered to the given email",
+				handler: async (req, reply) => this.handleRequest(req, reply)
+			},
+			{
+				method: "GET",
+				path: "/login",
+				access: "public",
+				description: "Click target embedded in the magic-link email",
+				handler: async (req, reply) => this.handleLogin(req, reply)
+			}
+		]);
+		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
+		return [
+			{
+				capability: authProviderCapability,
+				provider: authProvider
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: routeProvider
+			},
+			{
+				capability: loginMethodCapability,
+				provider: loginMethodProvider
+			}
+		];
+	}
+	buildLoginMethods() {
+		if (!this.config.enabled) return [];
 		return [{
-			capability: authProviderCapability,
-			provider: authProvider
-		}, {
-			capability: addonRoutesCapability,
-			provider: routeProvider
+			kind: "redirect",
+			id: "auth-magic-link",
+			label: this.config.displayName || DEFAULT_CONFIG.displayName,
+			icon: this.config.icon || DEFAULT_CONFIG.icon,
+			startUrl: "/addon/auth-magic-link/start",
+			stage: "primary"
 		}];
 	}
 	globalSettingsSchema() {
@@ -91,6 +106,13 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
+				this.field({
+					type: "boolean",
+					key: "enabled",
+					label: "Enabled",
+					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
+					default: DEFAULT_CONFIG.enabled
+				}),
 				this.field({
 					type: "text",
 					key: "displayName",
@@ -164,6 +186,59 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 		for (const u of users) if (u.username.toLowerCase() === needle) return u;
 		return null;
 	}
+	/**
+	* Login-page landing for the magic-link `redirect` login method. Serves
+	* a self-contained email-entry page that POSTs to `/request`; the tiny
+	* inline script lives in the ADDON's served HTML (not the admin shell),
+	* keeping the login page free of any magic-link-specific JS. Always
+	* responds 200 (account-enumeration-safe, mirroring `/request`).
+	*/
+	async handleStart(_req, reply) {
+		const title = this.config.displayName || DEFAULT_CONFIG.displayName;
+		const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(title)}</title>
+<style>
+  :root { color-scheme: dark; }
+  body { margin:0; min-height:100vh; display:flex; align-items:center; justify-content:center;
+         background:#0b0d12; color:#e5e7eb; font:14px/1.5 system-ui,-apple-system,sans-serif; }
+  .card { width:100%; max-width:22rem; padding:1.5rem; border:1px solid #232733; border-radius:0.75rem;
+          background:#12151c; box-shadow:0 10px 30px rgba(0,0,0,.35); }
+  h1 { font-size:1rem; margin:0 0 1rem; }
+  label { font-size:.75rem; color:#9ca3af; display:block; margin-bottom:.35rem; }
+  input { width:100%; box-sizing:border-box; padding:.6rem .7rem; border-radius:.5rem;
+          border:1px solid #232733; background:#0b0d12; color:#e5e7eb; outline:none; }
+  input:focus { border-color:#6366f1; }
+  button { margin-top:1rem; width:100%; padding:.6rem; border:0; border-radius:.5rem; cursor:pointer;
+           background:#6366f1; color:#fff; font-weight:600; }
+  button:disabled { opacity:.5; cursor:default; }
+  .msg { margin-top:1rem; font-size:.8rem; color:#34d399; }
+  .err { color:#f87171; }
+  a { color:#9ca3af; font-size:.75rem; }
+</style></head>
+<body><form class="card" id="f">
+  <h1>${escapeHtml(title)}</h1>
+  <label for="email">Email address</label>
+  <input id="email" name="email" type="email" autocomplete="email" required autofocus placeholder="you@example.com">
+  <button id="b" type="submit">Send login link</button>
+  <div class="msg" id="m" hidden></div>
+  <p style="margin-top:1rem"><a href="/admin/login">Back to sign in</a></p>
+</form>
+<script>
+  var f=document.getElementById('f'),b=document.getElementById('b'),m=document.getElementById('m');
+  f.addEventListener('submit',function(e){e.preventDefault();b.disabled=true;m.hidden=true;m.className='msg';
+    fetch('/addon/auth-magic-link/request',{method:'POST',headers:{'content-type':'application/json'},
+      body:JSON.stringify({email:document.getElementById('email').value})})
+    .then(function(){m.textContent='If that email matches an account, a login link is on its way.';m.hidden=false;})
+    .catch(function(){m.className='msg err';m.textContent='Something went wrong. Please try again.';m.hidden=false;})
+    .finally(function(){b.disabled=false;});});
+<\/script>
+</body></html>`;
+		reply.code(200);
+		reply.header("Content-Type", "text/html; charset=utf-8");
+		reply.send(html);
+	}
 	async handleRequest(req, reply) {
 		try {
 			const body = req.body ?? {};
@@ -230,5 +305,9 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 		reply.send("");
 	}
 };
+/** Minimal HTML-attribute/text escaper for the interpolated page title. */
+function escapeHtml(value) {
+	return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
 //#endregion
 export { AuthMagicLinkAddon, AuthMagicLinkAddon as default };

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-CXCR7sEk.js");
+const require_dist = require("../dist-BLBS0d1z.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -1237,7 +1237,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				return this.handleCallback(code, state);
 			}
 		};
-		const routes = [{
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-oidc", [{
 			method: "GET",
 			path: "/:providerId/start",
 			access: "public",
@@ -1249,19 +1249,43 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			access: "public",
 			description: "OIDC redirect callback for a configured provider",
 			handler: async (req, reply) => this.handleCallbackRoute(req, reply)
-		}];
-		const routeProvider = {
-			id: "auth-oidc",
-			getRoutes: () => routes
-		};
+		}]);
+		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("OIDC auth provider initialized", { meta: { providers: [...this.instances.keys()] } });
-		return [{
-			capability: require_dist.authProviderCapability,
-			provider: authProvider
-		}, {
-			capability: require_dist.addonRoutesCapability,
-			provider: routeProvider
-		}];
+		return [
+			{
+				capability: require_dist.authProviderCapability,
+				provider: authProvider
+			},
+			{
+				capability: require_dist.addonRoutesCapability,
+				provider: routeProvider
+			},
+			{
+				capability: require_dist.loginMethodCapability,
+				provider: loginMethodProvider
+			}
+		];
+	}
+	/**
+	* Build one `redirect` login-method per configured provider instance.
+	* `startUrl` is the addon's public `/start` route for that instance;
+	* the login page renders a generic button navigating to it.
+	*/
+	buildLoginMethods() {
+		const out = [];
+		for (const inst of this.instances.values()) {
+			const id = inst.config.id;
+			out.push({
+				kind: "redirect",
+				id: `auth-oidc/${id}`,
+				label: inst.config.displayName || DEFAULT_PROVIDER.displayName,
+				icon: inst.config.icon || DEFAULT_PROVIDER.icon,
+				startUrl: `/addon/auth-oidc/${id}/start`,
+				stage: "primary"
+			});
+		}
+		return out;
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as BaseAddon, i as errMsg, n as authProviderCapability, t as addonRoutesCapability } from "../dist-JmuFs-U5.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-JUeAGU3c.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();
@@ -1231,7 +1231,7 @@ var AuthOidcAddon = class extends BaseAddon {
 				return this.handleCallback(code, state);
 			}
 		};
-		const routes = [{
+		const routeProvider = buildAddonRouteProvider("auth-oidc", [{
 			method: "GET",
 			path: "/:providerId/start",
 			access: "public",
@@ -1243,19 +1243,43 @@ var AuthOidcAddon = class extends BaseAddon {
 			access: "public",
 			description: "OIDC redirect callback for a configured provider",
 			handler: async (req, reply) => this.handleCallbackRoute(req, reply)
-		}];
-		const routeProvider = {
-			id: "auth-oidc",
-			getRoutes: () => routes
-		};
+		}]);
+		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("OIDC auth provider initialized", { meta: { providers: [...this.instances.keys()] } });
-		return [{
-			capability: authProviderCapability,
-			provider: authProvider
-		}, {
-			capability: addonRoutesCapability,
-			provider: routeProvider
-		}];
+		return [
+			{
+				capability: authProviderCapability,
+				provider: authProvider
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: routeProvider
+			},
+			{
+				capability: loginMethodCapability,
+				provider: loginMethodProvider
+			}
+		];
+	}
+	/**
+	* Build one `redirect` login-method per configured provider instance.
+	* `startUrl` is the addon's public `/start` route for that instance;
+	* the login page renders a generic button navigating to it.
+	*/
+	buildLoginMethods() {
+		const out = [];
+		for (const inst of this.instances.values()) {
+			const id = inst.config.id;
+			out.push({
+				kind: "redirect",
+				id: `auth-oidc/${id}`,
+				label: inst.config.displayName || DEFAULT_PROVIDER.displayName,
+				icon: inst.config.icon || DEFAULT_PROVIDER.icon,
+				startUrl: `/addon/auth-oidc/${id}/start`,
+				stage: "primary"
+			});
+		}
+		return out;
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{