@camstack/addon-auth 1.1.3 → 1.1.4

package/dist/{dist-mmJDfwXE.js → dist-BLBS0d1z.js}

@@ -7052,6 +7052,123 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
+* Build an `IAddonRouteProvider` from a list of routes. Implements
+* both the operator-facing `getRoutes` (returning route descriptors
+* minus the handlers, which can't cross JSON) and the framework-
+* private `invoke` method that the hub calls when this provider lives
+* in a forked worker.
+*
+* Co-located addons use the returned `getRoutes` directly because
+* their handlers don't need to cross any wire. The `invoke` method
+* is present anyway so the bridge code on the hub is uniform — it
+* doesn't need to switch on "local vs remote provider" at the call
+* site.
+*
+* Example:
+*   const routes: IAddonHttpRoute[] = [
+*     { method: 'GET', path: '/start', access: 'public', handler: this.handleStart },
+*   ]
+*   return [
+*     {
+*       capability: addonRoutesCapability,
+*       provider: buildAddonRouteProvider('auth-oidc', routes),
+*     },
+*   ]
+*/
+function buildAddonRouteProvider(id, routes) {
+	return {
+		id,
+		getRoutes: () => routes,
+		invoke: async (input) => {
+			const match = matchRoute(routes, input.method, input.path);
+			if (!match) return {
+				status: 404,
+				headers: {},
+				redirectUrl: null,
+				body: { error: `No route matches ${input.method} ${input.path}` }
+			};
+			const envelope = {
+				status: 200,
+				headers: {},
+				redirectUrl: null
+			};
+			const reply = buildCapturingReply(envelope);
+			const request = {
+				params: {
+					...input.params,
+					...match.params
+				},
+				query: input.query,
+				body: input.body,
+				headers: input.headers,
+				...input.user ? { user: input.user } : {},
+				...input.scopedToken !== void 0 ? { scopedToken: input.scopedToken } : {}
+			};
+			await match.route.handler(request, reply);
+			return envelope;
+		}
+	};
+}
+/**
+* Pattern matcher: same semantics as `AddonRouteRegistry.matchRoute`
+* but operating on a flat list and bypassing the `/addon/<id>/` prefix
+* — the bridge sends the post-prefix path directly so we don't need
+* to round-trip it through normalization.
+*/
+function matchRoute(routes, method, path) {
+	const normalizedMethod = method.toUpperCase();
+	for (const route of routes) {
+		if (route.method !== normalizedMethod) continue;
+		const params = matchPath(route.path, path);
+		if (params !== null) return {
+			route,
+			params
+		};
+	}
+	return null;
+}
+function matchPath(pattern, p) {
+	const patternParts = pattern.split("/").filter(Boolean);
+	const pathParts = p.split("/").filter(Boolean);
+	if (patternParts.length !== pathParts.length) return null;
+	const params = {};
+	for (let i = 0; i < patternParts.length; i++) {
+		const a = patternParts[i];
+		const b = pathParts[i];
+		if (a.startsWith(":")) params[a.slice(1)] = b;
+		else if (a !== b) return null;
+	}
+	return params;
+}
+function buildCapturingReply(envelope) {
+	const wrapper = {
+		status(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		code(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		send(data) {
+			envelope.body = data;
+		},
+		redirect(url) {
+			envelope.redirectUrl = url;
+			if (envelope.status === 200) envelope.status = 302;
+		},
+		header(name, value) {
+			envelope.headers[name.toLowerCase()] = value;
+			return wrapper;
+		},
+		type(mime) {
+			envelope.contentType = mime;
+			return wrapper;
+		}
+	};
+	return wrapper;
+}
+/**
 * Numeric day-of-week: 0 = Sunday … 6 = Saturday (matches `Date.getDay`).
 * Named `RecordingWeekday` to avoid collision with the string-union
 * `Weekday` exported from `interfaces/timezones.ts`.
@@ -23154,6 +23271,12 @@ Object.defineProperty(exports, "authProviderCapability", {
 		return authProviderCapability;
 	}
 });
+Object.defineProperty(exports, "buildAddonRouteProvider", {
+	enumerable: true,
+	get: function() {
+		return buildAddonRouteProvider;
+	}
+});
 Object.defineProperty(exports, "errMsg", {
 	enumerable: true,
 	get: function() {

package/dist/{dist-suALViLT.mjs → dist-JUeAGU3c.mjs}

@@ -7052,6 +7052,123 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
+* Build an `IAddonRouteProvider` from a list of routes. Implements
+* both the operator-facing `getRoutes` (returning route descriptors
+* minus the handlers, which can't cross JSON) and the framework-
+* private `invoke` method that the hub calls when this provider lives
+* in a forked worker.
+*
+* Co-located addons use the returned `getRoutes` directly because
+* their handlers don't need to cross any wire. The `invoke` method
+* is present anyway so the bridge code on the hub is uniform — it
+* doesn't need to switch on "local vs remote provider" at the call
+* site.
+*
+* Example:
+*   const routes: IAddonHttpRoute[] = [
+*     { method: 'GET', path: '/start', access: 'public', handler: this.handleStart },
+*   ]
+*   return [
+*     {
+*       capability: addonRoutesCapability,
+*       provider: buildAddonRouteProvider('auth-oidc', routes),
+*     },
+*   ]
+*/
+function buildAddonRouteProvider(id, routes) {
+	return {
+		id,
+		getRoutes: () => routes,
+		invoke: async (input) => {
+			const match = matchRoute(routes, input.method, input.path);
+			if (!match) return {
+				status: 404,
+				headers: {},
+				redirectUrl: null,
+				body: { error: `No route matches ${input.method} ${input.path}` }
+			};
+			const envelope = {
+				status: 200,
+				headers: {},
+				redirectUrl: null
+			};
+			const reply = buildCapturingReply(envelope);
+			const request = {
+				params: {
+					...input.params,
+					...match.params
+				},
+				query: input.query,
+				body: input.body,
+				headers: input.headers,
+				...input.user ? { user: input.user } : {},
+				...input.scopedToken !== void 0 ? { scopedToken: input.scopedToken } : {}
+			};
+			await match.route.handler(request, reply);
+			return envelope;
+		}
+	};
+}
+/**
+* Pattern matcher: same semantics as `AddonRouteRegistry.matchRoute`
+* but operating on a flat list and bypassing the `/addon/<id>/` prefix
+* — the bridge sends the post-prefix path directly so we don't need
+* to round-trip it through normalization.
+*/
+function matchRoute(routes, method, path) {
+	const normalizedMethod = method.toUpperCase();
+	for (const route of routes) {
+		if (route.method !== normalizedMethod) continue;
+		const params = matchPath(route.path, path);
+		if (params !== null) return {
+			route,
+			params
+		};
+	}
+	return null;
+}
+function matchPath(pattern, p) {
+	const patternParts = pattern.split("/").filter(Boolean);
+	const pathParts = p.split("/").filter(Boolean);
+	if (patternParts.length !== pathParts.length) return null;
+	const params = {};
+	for (let i = 0; i < patternParts.length; i++) {
+		const a = patternParts[i];
+		const b = pathParts[i];
+		if (a.startsWith(":")) params[a.slice(1)] = b;
+		else if (a !== b) return null;
+	}
+	return params;
+}
+function buildCapturingReply(envelope) {
+	const wrapper = {
+		status(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		code(code) {
+			envelope.status = code;
+			return wrapper;
+		},
+		send(data) {
+			envelope.body = data;
+		},
+		redirect(url) {
+			envelope.redirectUrl = url;
+			if (envelope.status === 200) envelope.status = 302;
+		},
+		header(name, value) {
+			envelope.headers[name.toLowerCase()] = value;
+			return wrapper;
+		},
+		type(mime) {
+			envelope.contentType = mime;
+			return wrapper;
+		}
+	};
+	return wrapper;
+}
+/**
 * Numeric day-of-week: 0 = Sunday … 6 = Saturday (matches `Date.getDay`).
 * Named `RecordingWeekday` to avoid collision with the string-union
 * `Weekday` exported from `interfaces/timezones.ts`.
@@ -23124,4 +23241,4 @@ object({
 	schemaVersion: literal(1)
 });
 //#endregion
-export { userPasskeysCapability as a, array as c, loginMethodCapability as i, object as l, addonWidgetsSourceCapability as n, errMsg as o, authProviderCapability as r, BaseAddon as s, addonRoutesCapability as t, string as u };
+export { loginMethodCapability as a, BaseAddon as c, string as d, buildAddonRouteProvider as i, array as l, addonWidgetsSourceCapability as n, userPasskeysCapability as o, authProviderCapability as r, errMsg as s, addonRoutesCapability as t, object as u };

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mmJDfwXE.js");
+const require_dist = require("../dist-BLBS0d1z.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -30,6 +30,7 @@ const require_dist = require("../dist-mmJDfwXE.js");
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
 var DEFAULT_CONFIG = {
+	enabled: false,
 	displayName: "Email magic link",
 	icon: "mail",
 	publicOrigin: "",
@@ -52,7 +53,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routes = [
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-magic-link", [
 			{
 				method: "GET",
 				path: "/start",
@@ -74,11 +75,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 				description: "Click target embedded in the magic-link email",
 				handler: async (req, reply) => this.handleLogin(req, reply)
 			}
-		];
-		const routeProvider = {
-			id: "auth-magic-link",
-			getRoutes: () => routes
-		};
+		]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
 		return [
@@ -97,6 +94,7 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 		];
 	}
 	buildLoginMethods() {
+		if (!this.config.enabled) return [];
 		return [{
 			kind: "redirect",
 			id: "auth-magic-link",
@@ -113,6 +111,13 @@ var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
+				this.field({
+					type: "boolean",
+					key: "enabled",
+					label: "Enabled",
+					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
+					default: DEFAULT_CONFIG.enabled
+				}),
 				this.field({
 					type: "text",
 					key: "displayName",

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { i as loginMethodCapability, o as errMsg, r as authProviderCapability, s as BaseAddon, t as addonRoutesCapability } from "../dist-suALViLT.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-JUeAGU3c.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.
@@ -25,6 +25,7 @@ import { i as loginMethodCapability, o as errMsg, r as authProviderCapability, s
 *   - Auto-provision unknown emails (currently rejected for safety).
 */
 var DEFAULT_CONFIG = {
+	enabled: false,
 	displayName: "Email magic link",
 	icon: "mail",
 	publicOrigin: "",
@@ -47,7 +48,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
 			}
 		};
-		const routes = [
+		const routeProvider = buildAddonRouteProvider("auth-magic-link", [
 			{
 				method: "GET",
 				path: "/start",
@@ -69,11 +70,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 				description: "Click target embedded in the magic-link email",
 				handler: async (req, reply) => this.handleLogin(req, reply)
 			}
-		];
-		const routeProvider = {
-			id: "auth-magic-link",
-			getRoutes: () => routes
-		};
+		]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
 		return [
@@ -92,6 +89,7 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 		];
 	}
 	buildLoginMethods() {
+		if (!this.config.enabled) return [];
 		return [{
 			kind: "redirect",
 			id: "auth-magic-link",
@@ -108,6 +106,13 @@ var AuthMagicLinkAddon = class extends BaseAddon {
 			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
 			columns: 1,
 			fields: [
+				this.field({
+					type: "boolean",
+					key: "enabled",
+					label: "Enabled",
+					description: "Offer the magic-link button on the login page. Leave off until email delivery is configured.",
+					default: DEFAULT_CONFIG.enabled
+				}),
 				this.field({
 					type: "text",
 					key: "displayName",

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mmJDfwXE.js");
+const require_dist = require("../dist-BLBS0d1z.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -1237,7 +1237,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				return this.handleCallback(code, state);
 			}
 		};
-		const routes = [{
+		const routeProvider = require_dist.buildAddonRouteProvider("auth-oidc", [{
 			method: "GET",
 			path: "/:providerId/start",
 			access: "public",
@@ -1249,11 +1249,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			access: "public",
 			description: "OIDC redirect callback for a configured provider",
 			handler: async (req, reply) => this.handleCallbackRoute(req, reply)
-		}];
-		const routeProvider = {
-			id: "auth-oidc",
-			getRoutes: () => routes
-		};
+		}]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("OIDC auth provider initialized", { meta: { providers: [...this.instances.keys()] } });
 		return [

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { i as loginMethodCapability, o as errMsg, r as authProviderCapability, s as BaseAddon, t as addonRoutesCapability } from "../dist-suALViLT.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-JUeAGU3c.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();
@@ -1231,7 +1231,7 @@ var AuthOidcAddon = class extends BaseAddon {
 				return this.handleCallback(code, state);
 			}
 		};
-		const routes = [{
+		const routeProvider = buildAddonRouteProvider("auth-oidc", [{
 			method: "GET",
 			path: "/:providerId/start",
 			access: "public",
@@ -1243,11 +1243,7 @@ var AuthOidcAddon = class extends BaseAddon {
 			access: "public",
 			description: "OIDC redirect callback for a configured provider",
 			handler: async (req, reply) => this.handleCallbackRoute(req, reply)
-		}];
-		const routeProvider = {
-			id: "auth-oidc",
-			getRoutes: () => routes
-		};
+		}]);
 		const loginMethodProvider = { getLoginMethods: async () => this.buildLoginMethods() };
 		this.ctx.logger.info("OIDC auth provider initialized", { meta: { providers: [...this.instances.keys()] } });
 		return [

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-mmJDfwXE.js");
+const require_dist = require("../dist-BLBS0d1z.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as userPasskeysCapability, c as array, i as loginMethodCapability, l as object, n as addonWidgetsSourceCapability, s as BaseAddon, u as string } from "../dist-suALViLT.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as string, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, u as object } from "../dist-JUeAGU3c.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "CamStack authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",