@jskit-ai/auth-provider-local-core 0.1.84 → 0.1.85

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.84",
+  "version": "0.1.85",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -9,9 +9,6 @@
     "./server/providers/AuthLocalProvider": "./src/server/providers/AuthLocalProvider.js",
     "./server/lib/index": "./src/server/lib/index.js"
   },
-  "dependencies": {
-    "nodemailer": "^9.0.3"
-  },
   "description": "Local auth provider with a file backend default and no database requirement.",
   "jskit": {
     "kind": "runtime",
@@ -53,13 +50,14 @@
           "auth.invitation-context",
           "auth.local.backend",
           "auth.local.password-strategy",
-          "auth.profile.projector"
+          "auth.profile.projector",
+          "auth.local.recovery-sender"
         ]
       }
     }
   },
   "peerDependencies": {
-    "@jskit-ai/auth-core": "0.1.181",
-    "@jskit-ai/kernel": "0.1.183"
+    "@jskit-ai/auth-core": "0.1.182",
+    "@jskit-ai/kernel": "0.1.184"
   }
 }

package/src/server/lib/service.js

@@ -257,37 +257,13 @@ function normalizeInvitationInput(value = null) {
   };
 }
 
-async function maybeSendRecoveryEmail(config, recoveryUrl, email) {
-  if (!config.smtpConfigured) {
-    return;
-  }
-  const nodemailer = await import("nodemailer");
-  const transport = nodemailer.createTransport({
-    host: config.smtp.host,
-    port: config.smtp.port,
-    secure: config.smtp.secure,
-    auth: config.smtp.user
-      ? {
-          user: config.smtp.user,
-          pass: config.smtp.password
-        }
-      : undefined
-  });
-  await transport.sendMail({
-    from: config.smtp.from,
-    replyTo: config.smtp.replyTo || undefined,
-    to: email,
-    subject: "Reset your password",
-    text: `Open this link to reset your password:\n\n${recoveryUrl}\n`
-  });
-}
-
 function createLocalAuthService({
   backend,
   config,
   profileProjector = null,
   passwordStrategy = null,
-  invitationContextResolver = null
+  invitationContextResolver = null,
+  recoverySender = null
 }) {
   if (!backend || typeof backend.withTransaction !== "function") {
     throw new Error("Local auth requires auth.local.backend with withTransaction().");
@@ -296,6 +272,10 @@ function createLocalAuthService({
     throw new Error("Local auth requires a session secret.");
   }
 
+  if (recoverySender !== null && typeof recoverySender !== "function") {
+    throw new Error("auth.local.recovery-sender must be a function.");
+  }
+
   const passwords = normalizePasswordStrategy(passwordStrategy);
   const isProduction = config.nodeEnv === "production";
   const devAuth = config.devAuth || resolveDevAuthPolicy({
@@ -303,8 +283,8 @@ function createLocalAuthService({
   });
   assertDevAuthPolicy(devAuth);
   const profileProjectionEnabled = typeof profileProjector?.syncIdentityProfile === "function";
-  const recoveryDelivery = config.smtpConfigured
-    ? "smtp"
+  const recoveryDelivery = recoverySender
+    ? "email"
     : isProduction
       ? "disabled"
       : config.recoveryDevOutput === "response"
@@ -639,15 +619,15 @@ function createLocalAuthService({
       });
     });
     if (recoveryUrl) {
-      await maybeSendRecoveryEmail(config, recoveryUrl, email);
-      if (!config.smtpConfigured && config.recoveryDevOutput === "log" && config.logger?.info) {
+      if (recoverySender) await recoverySender({ email, recoveryUrl });
+      if (!recoverySender && config.recoveryDevOutput === "log" && config.logger?.info) {
         config.logger.info({ recoveryUrl, email }, "Local auth password recovery URL created.");
       }
     }
     return {
       ok: true,
       message: "If an account exists for that email, password reset instructions have been sent.",
-      ...(recoveryUrl && !config.smtpConfigured && config.recoveryDevOutput === "response" ? { recoveryUrl } : {})
+      ...(recoveryUrl && !recoverySender && config.recoveryDevOutput === "response" ? { recoveryUrl } : {})
     };
   }
 

package/src/server/providers/AuthLocalProvider.js

@@ -35,62 +35,41 @@ function resolveSessionSecret(env, { storeDir, isProduction }) {
   return generated;
 }
 
-function resolveSmtpConfig(env) {
-  const host = String(env.AUTH_LOCAL_SMTP_HOST || "").trim();
-  if (!host) return { smtpConfigured: false, smtp: null };
-  const from = String(env.AUTH_LOCAL_SMTP_FROM || "").trim();
-  if (!from) throw new Error("AUTH_LOCAL_SMTP_FROM is required when AUTH_LOCAL_SMTP_HOST is set.");
-  return {
-    smtpConfigured: true,
-    smtp: {
-      host,
-      port: Number(env.AUTH_LOCAL_SMTP_PORT || 587),
-      secure: parseBooleanFlag(env.AUTH_LOCAL_SMTP_SECURE, false),
-      user: String(env.AUTH_LOCAL_SMTP_USER || "").trim(),
-      password: String(env.AUTH_LOCAL_SMTP_PASSWORD || ""),
-      from,
-      replyTo: String(env.AUTH_LOCAL_SMTP_REPLY_TO || "").trim()
-    }
-  };
-}
-
-function resolveAppPublicUrl(env, { smtpConfigured }) {
+function resolveAppPublicUrl(env, { recoverySender }) {
   const configured = String(env.APP_PUBLIC_URL || "").trim();
   if (!configured) {
-    if (smtpConfigured) throw new Error("APP_PUBLIC_URL is required when local auth SMTP recovery is configured.");
+    if (recoverySender) throw new Error("APP_PUBLIC_URL is required when local auth email recovery is configured.");
     return "http://localhost:5173";
   }
   let parsed;
   try {
     parsed = new URL(configured);
   } catch {
-    throw new Error("APP_PUBLIC_URL must be a valid URL when local auth SMTP recovery is configured.");
+    throw new Error("APP_PUBLIC_URL must be a valid URL when local auth email recovery is configured.");
   }
   if (!["http:", "https:"].includes(parsed.protocol)) {
-    throw new Error("APP_PUBLIC_URL must use http or https when local auth SMTP recovery is configured.");
+    throw new Error("APP_PUBLIC_URL must use http or https when local auth email recovery is configured.");
   }
   return parsed.toString().replace(/\/$/u, "");
 }
 
-function resolveConfig({ appRoot, backend, env, logger }) {
+function resolveConfig({ appRoot, backend, env, logger, recoverySender = null }) {
   const nodeEnv = String(env.NODE_ENV || "development").trim() || "development";
   const isProduction = nodeEnv === "production";
   const storeDir = resolveStoreDir(env, appRoot);
   if (!backend && isProduction && !parseBooleanFlag(env.AUTH_LOCAL_FILE_PRODUCTION_ACK, false)) {
     throw new Error("AUTH_LOCAL_FILE_PRODUCTION_ACK is required to use the local file auth backend in production.");
   }
-  const smtp = resolveSmtpConfig(env);
   const devAuth = resolveDevAuthPolicyFromEnv(env);
   assertDevAuthPolicy(devAuth);
   return {
     storeDir,
     nodeEnv,
     logger,
-    appPublicUrl: resolveAppPublicUrl(env, smtp),
+    appPublicUrl: resolveAppPublicUrl(env, { recoverySender }),
     sessionSecret: resolveSessionSecret(env, { storeDir, isProduction }),
     recoveryDevOutput: String(env.AUTH_LOCAL_RECOVERY_DEV_OUTPUT || "log").trim().toLowerCase() || "log",
-    devAuth,
-    ...smtp
+    devAuth
   };
 }
 
@@ -104,7 +83,8 @@ const AuthLocalProvider = defineProvider({
   },
   optional: {
     backend: "auth.local.backend",
-    passwordStrategy: "auth.local.password-strategy"
+    passwordStrategy: "auth.local.password-strategy",
+    recoverySender: "auth.local.recovery-sender"
   },
   provides: {
     authService: "auth.service"
@@ -113,13 +93,14 @@ const AuthLocalProvider = defineProvider({
     return { authService: createDeferredAuthService() };
   },
   boot(dependencies, { outputs }) {
-    const { appRoot, backend, env, extensions, logger, passwordStrategy } = dependencies;
-    const config = resolveConfig({ appRoot, backend, env, logger });
+    const { appRoot, backend, env, extensions, logger, passwordStrategy, recoverySender = null } = dependencies;
+    const config = resolveConfig({ appRoot, backend, env, logger, recoverySender });
     const baseService = createLocalAuthService({
       backend: backend || createLocalFileBackend({ storeDir: config.storeDir }),
       config,
       profileProjector: extensions.resolveProfileProjector(),
       passwordStrategy,
+      recoverySender,
       invitationContextResolver: extensions.resolveInvitationContextResolver()
     });
     attachDeferredAuthService(outputs.authService, extensions.decorateService(baseService));

package/test/packageMetadata.test.js

@@ -9,6 +9,7 @@ test("local auth has no package mutation or CI recipe", () => {
   assert.equal(Object.hasOwn(packageMetadata, "mutations"), false);
 });
 
-test("local auth declares Nodemailer as its own runtime dependency", () => {
-  assert.equal(typeof packageJson.dependencies.nodemailer, "string");
+test("local auth delegates recovery delivery to the application", () => {
+  assert.equal(packageJson.dependencies?.nodemailer, undefined);
+  assert.ok(packageMetadata.metadata.apiSummary.extensionCapabilities.includes("auth.local.recovery-sender"));
 });

package/test/providerRuntime.test.js

@@ -77,6 +77,7 @@ async function createStartedApp({
   env = {},
   profileProjector = null,
   passwordStrategy = null,
+  recoverySender = null,
   invitationContextResolver = null,
   logger = null,
   configureExtensions = null
@@ -130,6 +131,7 @@ async function createStartedApp({
     "auth.extensions": extensions,
     "auth.local.backend": backend,
     ...(passwordStrategy ? { "auth.local.password-strategy": passwordStrategy } : {}),
+    ...(recoverySender !== null ? { "auth.local.recovery-sender": recoverySender } : {}),
   };
   const runtime = createCapabilityRuntime({
     inputs,
@@ -577,7 +579,6 @@ test("local auth login verifies password and creates session in one backend tran
     config: {
       sessionSecret: "test-secret",
       nodeEnv: "test",
-      smtpConfigured: false,
       recoveryDevOutput: "response",
       appPublicUrl: "http://localhost:5173"
     }
@@ -683,7 +684,6 @@ test("local auth service accepts a custom stored-password format", async () => {
     config: {
       sessionSecret: "test-secret",
       nodeEnv: "test",
-      smtpConfigured: false,
       recoveryDevOutput: "response",
       appPublicUrl: "http://localhost:5173"
     },
@@ -1055,16 +1055,13 @@ test("local auth provider passes resolved invitation context into profile projec
   assert.equal(registered.actor.appUserId, "invited-app-user");
 });
 
-test("local auth provider requires an explicit public URL for SMTP recovery", async () => {
+test("local auth provider requires an explicit public URL for email recovery", async () => {
   await assert.rejects(
     () => createStartedApp({
-      env: {
-        APP_PUBLIC_URL: "",
-        AUTH_LOCAL_SMTP_HOST: "smtp.example.com",
-        AUTH_LOCAL_SMTP_FROM: "support@example.com"
-      }
+      env: { APP_PUBLIC_URL: "" },
+      recoverySender: async () => {}
     }),
-    /APP_PUBLIC_URL is required when local auth SMTP recovery is configured/
+    /APP_PUBLIC_URL is required when local auth email recovery is configured/
   );
 });
 
@@ -1152,3 +1149,42 @@ test("local file backend replays a pending multi-file transaction journal before
   assert.equal(recovered.recovery.id, "rec_journal");
   await assert.rejects(() => fs.stat(path.join(storeDir, "transaction.journal")), { code: "ENOENT" });
 });
+
+test("local recovery uses the application sender without returning or logging its token", async (t) => {
+  const messages = [];
+  const logs = [];
+  const app = await createStartedApp({
+    env: { NODE_ENV: "production", AUTH_LOCAL_SESSION_SECRET: "fixture-session-secret" },
+    recoverySender: async (message) => { messages.push(message); },
+    logger: { info: (...args) => logs.push(args), warn() {}, error() {}, debug() {} }
+  });
+  t.after(() => fs.rm(app.storeDir, { recursive: true, force: true }));
+  await app.authService.register({ email: "sender@example.com", password: "correct horse battery staple" });
+  assert.equal(app.authService.getCapabilities().features.passwordRecovery.delivery, "email");
+  const result = await app.authService.requestPasswordReset({ email: "sender@example.com" });
+  assert.equal(result.recoveryUrl, undefined);
+  assert.equal(messages.length, 1);
+  assert.equal(messages[0].email, "sender@example.com");
+  assert.match(messages[0].recoveryUrl, /^http:\/\/localhost:5173\/auth\/reset-password\?/);
+  assert.equal(JSON.stringify(logs).includes(messages[0].recoveryUrl), false);
+  const unknown = await app.authService.requestPasswordReset({ email: "absent@example.com" });
+  assert.deepEqual(unknown, result);
+  assert.equal(messages.length, 1);
+  const token = new URL(messages[0].recoveryUrl).searchParams.get("token");
+  const recovery = await app.authService.completePasswordRecovery({ code: token, type: "recovery" });
+  assert.equal(recovery.actor.email, "sender@example.com");
+});
+
+test("a failing recovery sender does not fall back to development output", async (t) => {
+  const logs = [];
+  const failure = new Error("delivery unavailable");
+  const app = await createStartedApp({
+    env: { AUTH_LOCAL_RECOVERY_DEV_OUTPUT: "log" },
+    recoverySender: async () => { throw failure; },
+    logger: { info: (...args) => logs.push(args), warn() {}, error() {}, debug() {} }
+  });
+  t.after(() => fs.rm(app.storeDir, { recursive: true, force: true }));
+  await app.authService.register({ email: "failure@example.com", password: "correct horse battery staple" });
+  await assert.rejects(app.authService.requestPasswordReset({ email: "failure@example.com" }), failure);
+  assert.equal(logs.some((args) => JSON.stringify(args).includes("recoveryUrl")), false);
+});