@faable/faable 4.20.0 → 4.21.0

package/dist/commands/auth/clients/login_methods.js

@@ -0,0 +1,83 @@
+// A client's own `login_methods` overrides the tenant's FIELD BY FIELD
+// (auth: resolveLoginMethodsConfig): a field the client does not set is
+// inherited. The update route stores the object whole, so every change here is
+// a read-modify-write of what the client has now, and a field this command was
+// not asked about keeps whatever it was — its own value or the inheritance.
+const has_login_method_changes = (c) => !!(c.inherit ||
+    c.passkey ||
+    c.only?.length ||
+    c.disable?.length ||
+    c.enable?.length);
+/**
+ * A connection by id or by name (case-insensitive). A name two connections
+ * share is refused rather than guessed: removing the wrong login method is
+ * not something to find out on the login screen.
+ */
+const resolve_connection = (connections, ref) => {
+    const by_id = connections.find(c => c.id === ref);
+    if (by_id)
+        return by_id;
+    const by_name = connections.filter(c => c.connection_name?.toLowerCase() === ref.toLowerCase());
+    if (by_name.length === 1)
+        return by_name[0];
+    const known = connections
+        .map(c => `${c.connection_name ?? '?'} (${c.id})`)
+        .join(', ');
+    if (by_name.length > 1) {
+        throw new Error(`"${ref}" names ${by_name.length} connections — use the id: ${by_name.map(c => c.id).join(', ')}`);
+    }
+    throw new Error(`Unknown connection "${ref}". This tenant has: ${known}`);
+};
+/**
+ * The client's next `login_methods`, or `null` to inherit everything from the
+ * tenant. `undefined` when nothing was asked for.
+ */
+const apply_login_method_changes = (own, tenant, connections, changes) => {
+    if (!has_login_method_changes(changes))
+        return undefined;
+    if (changes.inherit)
+        return null;
+    const next = { ...(own ?? {}) };
+    if (changes.only?.length || changes.disable?.length || changes.enable?.length) {
+        // Starts from what the client shows TODAY: its own list, or the tenant's
+        // it inherits — otherwise the first own list would silently re-offer
+        // everything the tenant had removed.
+        const disabled = new Set(own?.disabled_connections ?? tenant?.disabled_connections ?? []);
+        if (changes.only?.length) {
+            const keep = new Set(changes.only.map(ref => resolve_connection(connections, ref).id));
+            disabled.clear();
+            for (const c of connections)
+                if (!keep.has(c.id))
+                    disabled.add(c.id);
+        }
+        for (const ref of changes.disable ?? []) {
+            disabled.add(resolve_connection(connections, ref).id);
+        }
+        for (const ref of changes.enable ?? []) {
+            disabled.delete(resolve_connection(connections, ref).id);
+        }
+        next.disabled_connections = [...disabled];
+    }
+    if (changes.passkey === 'on')
+        next.passkey_login_enabled = true;
+    else if (changes.passkey === 'off')
+        next.passkey_login_enabled = false;
+    else if (changes.passkey === 'inherit')
+        delete next.passkey_login_enabled;
+    return Object.keys(next).length ? next : null;
+};
+/** What the login screen of this client offers, for the summary line. */
+const effective_login_methods = (own, tenant, connections) => {
+    const disabled = new Set(own?.disabled_connections ?? tenant?.disabled_connections ?? []);
+    const order = new Set(own?.order ?? tenant?.order ?? []);
+    const passkey = own?.passkey_login_enabled ?? tenant?.passkey_login_enabled ?? false;
+    return {
+        passkey,
+        // OIDC providers stay off the screen unless `order` names them.
+        connections: connections.filter(c => c.enabled !== false &&
+            !disabled.has(c.id) &&
+            (c.connection_type !== 'oidc' || order.has(c.id)))
+    };
+};
+
+export { apply_login_method_changes, effective_login_methods, has_login_method_changes, resolve_connection };

package/dist/commands/auth/clients/update.js

@@ -3,6 +3,7 @@ import { log } from '../../../log.js';
 import { tenant_options } from '../options.js';
 import { json_option, print_json } from '../../../lib/listing.js';
 import { parse_field_spec, parse_fields_json, apply_field_changes, format_field } from './profile_fields.js';
+import { has_login_method_changes, apply_login_method_changes, effective_login_methods } from './login_methods.js';
 import { resolve_client } from './resolve.js';
 
 // The update route replaces each list whole, so every list change here is a
@@ -19,7 +20,7 @@ const edit_list = (current, add = [], remove = []) => {
 };
 const clients_update = {
     command: 'update <client_id>',
-    describe: 'Update an OAuth client (name, URLs, profile fields)',
+    describe: 'Update an OAuth client (name, URLs, profile fields, login methods)',
     builder: yargs => json_option(tenant_options(yargs))
         .positional('client_id', {
         type: 'string',
@@ -83,9 +84,40 @@ const clients_update = {
         .option('inherit-fields', {
         type: 'boolean',
         description: "Drop this client's own profile field list and use the tenant's again"
+    })
+        .option('only-connections', {
+        type: 'string',
+        array: true,
+        description: 'Offer exactly these connections (id or name) on this client\'s login screen; every other one is removed'
+    })
+        .option('disable-connection', {
+        type: 'string',
+        array: true,
+        description: 'Stop offering a connection (id or name) on this client, also at /authorize — repeatable'
+    })
+        .option('enable-connection', {
+        type: 'string',
+        array: true,
+        description: 'Offer a removed connection again — repeatable'
+    })
+        .option('passkey-login', {
+        choices: ['on', 'off', 'inherit'],
+        description: "Passkey sign-in button on this client's login screen; inherit follows the tenant (Pro plan)"
+    })
+        .option('inherit-login-methods', {
+        type: 'boolean',
+        description: "Drop this client's own login methods and follow the tenant's again"
     })
         .conflicts('fields-json', ['add-field', 'remove-field', 'inherit-fields'])
         .conflicts('inherit-fields', ['add-field', 'remove-field'])
+        .conflicts('inherit-login-methods', [
+        'only-connections',
+        'disable-connection',
+        'enable-connection',
+        'passkey-login'
+    ])
+        .conflicts('only-connections', 'disable-connection')
+        .example('$0 auth clients update my-admin --only-connections OTP --passkey-login on', 'Sign in to my-admin only with a passkey or an email code')
         .example('$0 auth clients update my-app --add-field profile:enum:student,teacher', 'Let users of my-app pick their profile with auth-js updateProfile')
         .example('$0 auth clients update my-app --remove-field school', 'Stop accepting a field')
         .example('$0 auth clients update my-app --add-callback https://app.example.com/cb', 'Allow one more redirect URL, keeping the others')
@@ -110,6 +142,28 @@ const clients_update = {
         const callbacks = edit_list(client.callbacks, args.addCallback, args.removeCallback);
         const logout_urls = edit_list(client.logout_urls, args.addLogoutUrl, args.removeLogoutUrl);
         const web_origins = edit_list(client.web_origins, args.addWebOrigin, args.removeWebOrigin);
+        const login_changes = {
+            only: args.onlyConnections,
+            disable: args.disableConnection,
+            enable: args.enableConnection,
+            passkey: args.passkeyLogin,
+            inherit: args.inheritLoginMethods
+        };
+        const own_login = client
+            .login_methods;
+        let tenant_login;
+        let connections = [];
+        let login_methods;
+        if (has_login_method_changes(login_changes)) {
+            const [account, all] = await Promise.all([
+                api.currentAccount(),
+                api.connectionList().all()
+            ]);
+            tenant_login = account
+                .login_methods;
+            connections = all;
+            login_methods = apply_login_method_changes(own_login, tenant_login, connections, login_changes);
+        }
         const patch = {
             ...(args.name !== undefined ? { name: args.name } : {}),
             ...(args.description !== undefined
@@ -118,15 +172,27 @@ const clients_update = {
             ...(callbacks ? { callbacks } : {}),
             ...(logout_urls ? { logout_urls } : {}),
             ...(web_origins ? { web_origins } : {}),
-            ...(profile_fields !== undefined ? { profile_fields } : {})
+            ...(profile_fields !== undefined ? { profile_fields } : {}),
+            ...(login_methods !== undefined ? { login_methods } : {})
         };
         if (Object.keys(patch).length === 0) {
-            throw new Error('Nothing to update — pass a --name, --description, an --add-*/--remove-* option, --fields-json or --inherit-fields');
+            throw new Error('Nothing to update — pass a --name, --description, an --add-*/--remove-* option, --fields-json, --inherit-fields or a login-method option');
         }
         const updated = await api.clientUpdate(client.id, patch);
         if (args.json)
             return print_json(updated);
         log.info(`✅ Updated client "${updated.name}" (${updated.client_id})`);
+        if (login_methods !== undefined) {
+            const now = effective_login_methods(updated
+                .login_methods, tenant_login, connections);
+            const names = now.connections.map(c => `${c.connection_name} (${c.connection_type})`);
+            if (now.passkey)
+                names.unshift('passkey');
+            log.info(`  Login screen: ${names.length ? names.join(', ') : 'nothing'}`);
+            if (login_methods === null) {
+                log.info("  Login methods: inherited from the tenant");
+            }
+        }
         if (profile_fields !== undefined) {
             const now = updated.profile_fields;
             if (!now) {

package/dist/mcp/tools.js

@@ -998,6 +998,64 @@ const TOOLS = [
             remove: ['school']
         }
     },
+    {
+        name: 'update_auth_client_login',
+        title: "Change how users sign in to an app",
+        description: "Choose which login methods one Auth application offers: which connections (by id or name, as list_auth_connections shows them) and whether the passkey button appears. `only` keeps exactly those connections and removes the rest; `disable`/`enable` change one at a time. A removed connection is refused at /authorize too, not just hidden. `passkey` needs the Pro plan. `inherit: true` drops the app's own settings and follows the tenant's again. Settings not mentioned keep their current value.",
+        input: {
+            client: z
+                .string()
+                .describe('The application: client resource id (client_…) or OAuth client_id'),
+            only: z
+                .array(z.string())
+                .max(50)
+                .optional()
+                .describe('Offer exactly these connections (id or name)'),
+            disable: z
+                .array(z.string())
+                .max(50)
+                .optional()
+                .describe('Connections (id or name) to stop offering'),
+            enable: z
+                .array(z.string())
+                .max(50)
+                .optional()
+                .describe('Removed connections (id or name) to offer again'),
+            passkey: z
+                .enum(['on', 'off', 'inherit'])
+                .optional()
+                .describe('Passkey sign-in button; inherit follows the tenant'),
+            inherit: z
+                .boolean()
+                .optional()
+                .describe("Drop the app's own login methods and use the tenant's"),
+            tenant,
+            project
+        },
+        command: ['auth', 'clients', 'update'],
+        flags: a => [
+            a.client,
+            ...(a.only ?? []).flatMap((c) => ['--only-connections', c]),
+            ...(a.disable ?? []).flatMap((c) => ['--disable-connection', c]),
+            ...(a.enable ?? []).flatMap((c) => ['--enable-connection', c]),
+            ...opt('--passkey-login', a.passkey),
+            ...(a.inherit ? ['--inherit-login-methods'] : []),
+            ...auth_scope(a)
+        ],
+        shape: (c) => ({
+            id: c.id,
+            client_id: c.client_id,
+            name: c.name,
+            login_methods: c.login_methods ?? null
+        }),
+        write: true,
+        annotations: AUTH_WRITE,
+        example: {
+            client: 'client_1',
+            only: ['OTP'],
+            passkey: 'on'
+        }
+    },
     {
         name: 'send_password_setup',
         title: 'Send a password setup email',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.20.0",
+  "version": "4.21.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",