@fonderie/auth 7.3.5 → 7.4.0

package/brain/outcomes.md

@@ -150,6 +150,7 @@ Raw SQL ships in `node_modules/@fonderie/auth/dist/migrations/sql/` — read it
 | POST | `/auth/mfa/disable` | `requireAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.disable` |
 | POST | `/auth/mfa/setup` | `requireAuth → requireEmailLogin → requireVerified → mfa.setup` |
 | POST | `/auth/mfa/verify` | `ipLimit('mfaVerify') → requireAnyAuth → requireEmailLogin → requireVerified → validate(mfaTokenSchema) → mfa.verify` |
+| GET | `/auth/providers` | `async () => setApiResponse(HTTP.OK, 'AUTH_PROVIDERS', 'Sign-in methods available here', { providers: [...config.providers], })` |
 | POST | `/auth/refresh` | `validate(refreshSchema) → auth.refresh` |
 | POST | `/auth/register` | `ipLimit('register') → validate(registerSchema) → auth.register` |
 | GET | `/auth/send-verification` | `requireAnyAuth → auth.sendVerification` |

package/dist/index.cjs

@@ -89,6 +89,7 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/routes.ts
+var import_core10 = require("@fonderie/core");
 var import_middlewares2 = require("@fonderie/core/middlewares");
 
 // src/middlewares/require-email-login.ts
@@ -2751,6 +2752,27 @@ function buildAuthRoutes(store, config, bus) {
     return [o.method ?? method, o.path ?? path, ...handlers];
   };
   const routes = [
+    // Which sign-in methods this deployment can actually honour (Public).
+    //
+    // A frontend has to decide which buttons to draw, and the only honest
+    // source is the side holding the credentials. The alternative — a
+    // build-time flag in the app — stores the same fact twice and lets the
+    // two disagree; the symptom is a user clicking a provider the server
+    // cannot complete and landing on the provider's error page, which the
+    // app cannot explain.
+    //
+    // Public and unauthenticated on purpose: the login screen needs it
+    // before anyone has signed in. It discloses nothing a visitor could not
+    // learn by looking at the buttons, and deliberately nothing else — no
+    // client ids, no redirect URIs, no module inventory.
+    R(
+      "providers",
+      "GET",
+      "/auth/providers",
+      async () => (0, import_core10.setApiResponse)(import_core10.HTTP.OK, "AUTH_PROVIDERS", "Sign-in methods available here", {
+        providers: [...config.providers]
+      })
+    ),
     // Registration & Login (Public)
     R("register", "POST", "/auth/register", ipLimit("register"), (0, import_middlewares.validate)(registerSchema), auth.register),
     R("login", "POST", "/auth/login", ipLimit("login"), (0, import_middlewares.validate)(loginSchema), acctLimit("login"), auth.login),
@@ -2817,17 +2839,17 @@ function buildAuthRoutes(store, config, bus) {
 }
 
 // src/services/config-guard.ts
-var import_core10 = require("@fonderie/core");
+var import_core11 = require("@fonderie/core");
 var MODULE = "@fonderie/auth";
 function collectAuthConfigProblems(config) {
   const problems = [];
   const secret = config.jwtSecret ?? "";
-  const secretProblem = (0, import_core10.secretStrengthProblem)(secret);
+  const secretProblem = (0, import_core11.secretStrengthProblem)(secret);
   if (secretProblem === "too-short") {
     problems.push({
       module: MODULE,
       severity: "error",
-      message: `jwtSecret must be at least ${import_core10.MIN_SECRET_LENGTH} characters (got ${secret.length})`
+      message: `jwtSecret must be at least ${import_core11.MIN_SECRET_LENGTH} characters (got ${secret.length})`
     });
   } else if (secretProblem === "placeholder") {
     problems.push({
@@ -2851,7 +2873,7 @@ function collectAuthConfigProblems(config) {
         severity: "error",
         message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing"
       });
-    } else if (import_core10.PLACEHOLDER_SECRET.test(clientSecret)) {
+    } else if (import_core11.PLACEHOLDER_SECRET.test(clientSecret)) {
       problems.push({
         module: MODULE,
         severity: "error",