@jskit-ai/auth-web 0.1.101 → 0.1.102

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-web",
-  "version": "0.1.101",
+  "version": "0.1.102",
   "kind": "runtime",
   "description": "Auth web module: Fastify auth routes plus web login/sign-out scaffolds.",
   "dependsOn": [
@@ -158,6 +158,19 @@ export default Object.freeze({
           },
           "purpose": "Public sign-out route that clears session then returns to login."
         },
+        {
+          "id": "auth.reset-password",
+          "path": "/auth/reset-password",
+          "scope": "surface",
+          "surface": "auth",
+          "name": "auth-reset-password",
+          "componentKey": "auth-reset-password",
+          "autoRegister": false,
+          "guard": {
+            "policy": "public"
+          },
+          "purpose": "Public password reset screen for recovery links."
+        },
         {
           "id": "auth.default-login",
           "path": "/auth/default-login",
@@ -247,10 +260,10 @@ export default Object.freeze({
     "dependencies": {
       "runtime": {
         "@mdi/js": "^7.4.47",
-        "@jskit-ai/auth-core": "0.1.99",
-        "@jskit-ai/http-runtime": "0.1.99",
-        "@jskit-ai/kernel": "0.1.101",
-        "@jskit-ai/shell-web": "0.1.100"
+        "@jskit-ai/auth-core": "0.1.100",
+        "@jskit-ai/http-runtime": "0.1.100",
+        "@jskit-ai/kernel": "0.1.102",
+        "@jskit-ai/shell-web": "0.1.101"
       },
       "dev": {}
     },
@@ -277,6 +290,13 @@ export default Object.freeze({
         "category": "auth-web",
         "id": "auth-view-signout"
       },
+      {
+        "from": "templates/src/views/auth/ResetPasswordView.vue",
+        "to": "src/views/auth/ResetPasswordView.vue",
+        "reason": "Install minimal password reset container that renders the module-provided DefaultResetPasswordView by default.",
+        "category": "auth-web",
+        "id": "auth-view-reset-password"
+      },
       {
         "from": "templates/src/pages/auth/login.vue",
         "to": "src/pages/auth/login.vue",
@@ -290,6 +310,13 @@ export default Object.freeze({
         "reason": "Provide an auth-surface /auth/signout wrapper that renders the package sign-out view.",
         "category": "auth-web",
         "id": "auth-page-signout"
+      },
+      {
+        "from": "templates/src/pages/auth/reset-password.vue",
+        "to": "src/pages/auth/reset-password.vue",
+        "reason": "Provide an auth-surface /auth/reset-password wrapper that renders the package password reset view.",
+        "category": "auth-web",
+        "id": "auth-page-reset-password"
       }
     ],
     "text": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-web",
-  "version": "0.1.101",
+  "version": "0.1.102",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -11,6 +11,7 @@
     "./server/routes/authRoutes": "./src/server/routes/authRoutes.js",
     "./client": "./src/client/index.js",
     "./client/views/DefaultLoginView": "./src/client/views/DefaultLoginView.vue",
+    "./client/views/DefaultResetPasswordView": "./src/client/views/DefaultResetPasswordView.vue",
     "./client/views/DefaultSignOutView": "./src/client/views/DefaultSignOutView.vue",
     "./client/runtime/authGuardRuntime": "./src/client/runtime/authGuardRuntime.js",
     "./client/runtime/authHttpClient": "./src/client/runtime/authHttpClient.js",
@@ -18,11 +19,11 @@
     "./client/runtime/useSignOut": "./src/client/runtime/useSignOut.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.99",
+    "@jskit-ai/auth-core": "0.1.100",
     "@mdi/js": "^7.4.47",
-    "@jskit-ai/kernel": "0.1.101",
-    "@jskit-ai/shell-web": "0.1.100",
-    "@jskit-ai/http-runtime": "0.1.99"
+    "@jskit-ai/kernel": "0.1.102",
+    "@jskit-ai/shell-web": "0.1.101",
+    "@jskit-ai/http-runtime": "0.1.100"
   },
   "peerDependencies": {
     "@tanstack/vue-query": "^5.90.5",

package/src/client/composables/loginView/useLoginViewActions.js

@@ -89,6 +89,13 @@ export function useLoginViewActions({
   }
 
   function applySessionPayload(payload) {
+    if (typeof state.applyCapabilities === "function") {
+      state.applyCapabilities(payload || {});
+    }
+    if (payload?.authCapabilities || payload?.capabilities) {
+      return;
+    }
+
     state.oauthProviders.value = Array.isArray(payload?.oauthProviders)
       ? payload.oauthProviders
           .map((provider) => {

package/src/client/composables/loginView/useLoginViewState.js

@@ -1,4 +1,5 @@
 import { computed, ref } from "vue";
+import { normalizeAuthCapabilities } from "@jskit-ai/auth-core/shared/authCapabilities";
 import {
   resolveSurfaceIdFromPlacementPathname,
   resolveSurfaceRootPathFromPlacementContext
@@ -40,6 +41,7 @@ export function useLoginViewState({ placementContext } = {}) {
   const rememberAccountOnDevice = ref(true);
   const rememberedAccount = ref(null);
   const useRememberedAccount = ref(false);
+  const authCapabilities = ref(normalizeAuthCapabilities());
   const oauthProviders = ref([]);
   const oauthDefaultProvider = ref("");
   const loading = ref(false);
@@ -55,6 +57,14 @@ export function useLoginViewState({ placementContext } = {}) {
   const isForgot = computed(() => mode.value === FORGOT_MODE);
   const isOtp = computed(() => mode.value === OTP_MODE);
   const isEmailConfirmationPending = computed(() => mode.value === EMAIL_CONFIRMATION_MODE);
+  const canUsePasswordLogin = computed(() => authCapabilities.value.features.password.login === true);
+  const canRegister = computed(() => authCapabilities.value.features.password.register === true);
+  const canRequestPasswordRecovery = computed(
+    () => authCapabilities.value.features.passwordRecovery.request === true
+  );
+  const canUseOtp = computed(() => authCapabilities.value.features.otp.login === true);
+  const canUseOAuth = computed(() => authCapabilities.value.features.oauthLogin.enabled === true);
+  const canResendEmailConfirmation = computed(() => authCapabilities.value.features.emailConfirmation === true);
   const showRememberedAccount = computed(
     () => (isLogin.value || isOtp.value) && useRememberedAccount.value && Boolean(rememberedAccount.value)
   );
@@ -160,6 +170,25 @@ export function useLoginViewState({ placementContext } = {}) {
     clearRememberedAccountState();
   }
 
+  function applyCapabilities(payload = {}) {
+    authCapabilities.value = normalizeAuthCapabilities(payload.authCapabilities || payload.capabilities || {});
+    const oauth = authCapabilities.value.features.oauthLogin;
+    if (oauth.enabled) {
+      oauthProviders.value = oauth.providers;
+      oauthDefaultProvider.value = oauth.defaultProvider || "";
+    } else {
+      oauthProviders.value = [];
+      oauthDefaultProvider.value = "";
+    }
+    if (
+      (mode.value === REGISTER_MODE && !canRegister.value) ||
+      (mode.value === FORGOT_MODE && !canRequestPasswordRecovery.value) ||
+      (mode.value === OTP_MODE && !canUseOtp.value)
+    ) {
+      switchMode(LOGIN_MODE);
+    }
+  }
+
   function switchAccount() {
     clearRememberedAccountHint();
     clearRememberedAccountState();
@@ -172,21 +201,30 @@ export function useLoginViewState({ placementContext } = {}) {
   }
 
   function switchMode(nextMode) {
-    if (nextMode === mode.value) {
+    let resolvedMode = nextMode;
+    if (resolvedMode === REGISTER_MODE && !canRegister.value) {
+      resolvedMode = LOGIN_MODE;
+    } else if (resolvedMode === FORGOT_MODE && !canRequestPasswordRecovery.value) {
+      resolvedMode = LOGIN_MODE;
+    } else if (resolvedMode === OTP_MODE && !canUseOtp.value) {
+      resolvedMode = LOGIN_MODE;
+    }
+
+    if (resolvedMode === mode.value) {
       return;
     }
 
-    mode.value = nextMode;
+    mode.value = resolvedMode;
     resetCredentialFields();
     registerConfirmationResendPending.value = false;
-    if (nextMode !== EMAIL_CONFIRMATION_MODE) {
+    if (resolvedMode !== EMAIL_CONFIRMATION_MODE) {
       pendingEmailConfirmationAddress.value = "";
       pendingEmailConfirmationMessage.value = "";
     }
     clearTransientMessages();
     resetTransientValidationState();
 
-    if (nextMode !== LOGIN_MODE && nextMode !== OTP_MODE) {
+    if (resolvedMode !== LOGIN_MODE && resolvedMode !== OTP_MODE) {
       useRememberedAccount.value = false;
       return;
     }
@@ -225,6 +263,7 @@ export function useLoginViewState({ placementContext } = {}) {
     rememberAccountOnDevice,
     rememberedAccount,
     useRememberedAccount,
+    authCapabilities,
     oauthProviders,
     oauthDefaultProvider,
     loading,
@@ -239,6 +278,12 @@ export function useLoginViewState({ placementContext } = {}) {
     isForgot,
     isOtp,
     isEmailConfirmationPending,
+    canUsePasswordLogin,
+    canRegister,
+    canRequestPasswordRecovery,
+    canUseOtp,
+    canUseOAuth,
+    canResendEmailConfirmation,
     showRememberedAccount,
     rememberedAccountDisplayName,
     rememberedAccountMaskedEmail,
@@ -253,6 +298,7 @@ export function useLoginViewState({ placementContext } = {}) {
     resolveNormalizedEmail,
     applyRememberedAccountHint,
     applyRememberedAccountPreference,
+    applyCapabilities,
     clearTransientMessages,
     switchMode,
     switchAccount,

package/src/client/composables/loginView/useLoginViewValidation.js

@@ -102,6 +102,9 @@ export function useLoginViewValidation({ state } = {}) {
     if (state.loading.value) {
       return false;
     }
+    if (state.isLogin.value && !state.canUsePasswordLogin.value) {
+      return false;
+    }
     if (emailErrorMessages.value.length > 0) {
       return false;
     }

package/src/client/index.js

@@ -1,10 +1,12 @@
 import { AuthWebClientProvider } from "./providers/AuthWebClientProvider.js";
 import DefaultLoginView from "./views/DefaultLoginView.vue";
 import DefaultSignOutView from "./views/DefaultSignOutView.vue";
+import DefaultResetPasswordView from "./views/DefaultResetPasswordView.vue";
 
 export { AuthWebClientProvider } from "./providers/AuthWebClientProvider.js";
 export { default as DefaultLoginView } from "./views/DefaultLoginView.vue";
 export { default as DefaultSignOutView } from "./views/DefaultSignOutView.vue";
+export { default as DefaultResetPasswordView } from "./views/DefaultResetPasswordView.vue";
 export { default as AuthProfileWidget } from "./views/AuthProfileWidget.vue";
 export { default as AuthProfileMenuLinkItem } from "./views/AuthProfileMenuLinkItem.vue";
 export { useAuthStore } from "./stores/useAuthStore.js";
@@ -18,7 +20,8 @@ export {
 const routeComponents = Object.freeze({
   "auth-login": DefaultLoginView,
   "auth-signout": DefaultSignOutView,
-  "auth-default-login": DefaultLoginView
+  "auth-default-login": DefaultLoginView,
+  "auth-reset-password": DefaultResetPasswordView
 });
 
 const clientProviders = Object.freeze([AuthWebClientProvider]);

package/src/client/runtime/authCallbackUrlParams.js

@@ -0,0 +1,56 @@
+const AUTH_CALLBACK_URL_BASE = "https://jskit.invalid";
+
+function readAuthCallbackUrlParams(url = "") {
+  const normalizedUrl = String(url || "").trim();
+  if (!normalizedUrl) {
+    return null;
+  }
+
+  try {
+    const parsedUrl = new URL(normalizedUrl, AUTH_CALLBACK_URL_BASE);
+    return {
+      parsedUrl,
+      searchParams: new URLSearchParams(parsedUrl.search || ""),
+      hashParams: new URLSearchParams(String(parsedUrl.hash || "").replace(/^#/, ""))
+    };
+  } catch {
+    return null;
+  }
+}
+
+function readAuthCallbackParam(callbackUrlParams, key) {
+  const normalizedKey = String(key || "").trim();
+  if (!callbackUrlParams || !normalizedKey) {
+    return "";
+  }
+
+  return String(
+    callbackUrlParams.searchParams.get(normalizedKey) ||
+      callbackUrlParams.hashParams.get(normalizedKey) ||
+      ""
+  ).trim();
+}
+
+function stripAuthCallbackParamsFromUrl(url = "", keys = []) {
+  const callbackUrlParams = readAuthCallbackUrlParams(url);
+  if (!callbackUrlParams) {
+    return "";
+  }
+
+  const normalizedKeys = Array.isArray(keys)
+    ? keys.map((key) => String(key || "").trim()).filter(Boolean)
+    : [];
+  normalizedKeys.forEach((key) => {
+    callbackUrlParams.parsedUrl.searchParams.delete(key);
+    callbackUrlParams.hashParams.delete(key);
+  });
+
+  const nextHash = callbackUrlParams.hashParams.toString();
+  return `${callbackUrlParams.parsedUrl.pathname}${callbackUrlParams.parsedUrl.search}${nextHash ? `#${nextHash}` : ""}`;
+}
+
+export {
+  readAuthCallbackParam,
+  readAuthCallbackUrlParams,
+  stripAuthCallbackParamsFromUrl
+};

package/src/client/runtime/authGuardRuntime.js

@@ -4,11 +4,13 @@ import { isExternalLinkTarget } from "@jskit-ai/kernel/shared/support/linkPath";
 import { normalizePathname as normalizeSurfacePathname } from "@jskit-ai/kernel/shared/surface/paths";
 import { createListenerSubscription } from "@jskit-ai/kernel/shared/support/listenerSet";
 import { normalizePermissionList } from "@jskit-ai/kernel/shared/support/permissions";
+import { normalizeAuthCapabilities } from "@jskit-ai/auth-core/shared/authCapabilities";
 
 const GLOBAL_GUARD_EVALUATOR_KEY = "__JSKIT_WEB_SHELL_GUARD_EVALUATOR__";
 const AUTH_POLICY_AUTHENTICATED = "authenticated";
 const DEFAULT_SESSION_PATH = AUTH_PATHS.SESSION;
 const DEFAULT_LOGIN_ROUTE = "/auth/login";
+const DEFAULT_RESET_PASSWORD_ROUTE = "/auth/reset-password";
 const DEFAULT_REFRESH_ON_FOREGROUND = false;
 const DEFAULT_REFRESH_ON_RECONNECT = false;
 const DEFAULT_REALTIME_REFRESH_EVENTS = Object.freeze(["users.bootstrap.changed", "auth.session.changed"]);
@@ -38,7 +40,8 @@ const DEFAULT_AUTH_STATE = Object.freeze({
   email: "",
   permissions: Object.freeze([]),
   oauthDefaultProvider: "",
-  oauthProviders: Object.freeze([])
+  oauthProviders: Object.freeze([]),
+  authCapabilities: normalizeAuthCapabilities()
 });
 
 function asGlobalObject() {
@@ -107,6 +110,7 @@ function normalizeAuthState(payload = {}) {
   const username = authenticated ? String(payload.username || "").trim() : "";
   const email = authenticated ? String(payload.email || "").trim().toLowerCase() : "";
   const permissions = authenticated ? Object.freeze(normalizePermissionList(payload.permissions)) : Object.freeze([]);
+  const authCapabilities = normalizeAuthCapabilities(payload.authCapabilities || payload.capabilities || {});
 
   return Object.freeze({
     authenticated,
@@ -114,7 +118,8 @@ function normalizeAuthState(payload = {}) {
     email,
     permissions,
     oauthDefaultProvider,
-    oauthProviders
+    oauthProviders,
+    authCapabilities
   });
 }
 
@@ -307,7 +312,8 @@ function redirectOAuthCallbackToLoginRoute(loginRoute) {
 
   const currentPathname = normalizePathname(window.location.pathname || "", "/");
   const loginPathname = normalizePathname(normalizedLoginRoute, DEFAULT_LOGIN_ROUTE);
-  if (currentPathname === loginPathname) {
+  const resetPasswordPathname = normalizePathname(DEFAULT_RESET_PASSWORD_ROUTE, DEFAULT_RESET_PASSWORD_ROUTE);
+  if (currentPathname === loginPathname || currentPathname === resetPasswordPathname) {
     return false;
   }
 

package/src/client/runtime/inject.js

@@ -1,4 +1,5 @@
 import { inject } from "vue";
+import { normalizeAuthCapabilities } from "@jskit-ai/auth-core/shared/authCapabilities";
 import { isAuthGuardRuntime } from "./authGuardRuntime.js";
 import { createBrowserOAuthLaunchClient, isAuthOAuthLaunchClient } from "./oauthLaunchClient.js";
 
@@ -9,7 +10,8 @@ const EMPTY_AUTH_GUARD_STATE = Object.freeze({
   authenticated: false,
   username: "",
   oauthDefaultProvider: "",
-  oauthProviders: Object.freeze([])
+  oauthProviders: Object.freeze([]),
+  authCapabilities: normalizeAuthCapabilities()
 });
 
 const EMPTY_AUTH_GUARD_RUNTIME = Object.freeze({

package/src/client/runtime/oauthCallbackRuntime.js

@@ -7,46 +7,29 @@ import {
 import { AUTH_PATHS } from "@jskit-ai/auth-core/shared/authPaths";
 import { normalizeAuthReturnToPath } from "../lib/returnToPath.js";
 import { authHttpRequest } from "./authHttpClient.js";
+import {
+  readAuthCallbackParam,
+  readAuthCallbackUrlParams
+} from "./authCallbackUrlParams.js";
 import { ensureCommandSectionValid } from "../composables/loginView/validationHelpers.js";
 
-function parseCallbackUrl(url = "") {
-  const normalizedUrl = String(url || "").trim();
-  if (!normalizedUrl) {
-    return null;
-  }
-
-  try {
-    return new URL(normalizedUrl, "https://jskit.invalid");
-  } catch {
-    return null;
-  }
-}
-
 function readOAuthCallbackParamsFromUrl(url = "") {
-  const parsedUrl = parseCallbackUrl(url);
-  if (!parsedUrl) {
+  const callbackUrlParams = readAuthCallbackUrlParams(url);
+  if (!callbackUrlParams) {
     return null;
   }
 
-  const searchParams = new URLSearchParams(parsedUrl.search || "");
-  const hashParams = new URLSearchParams(String(parsedUrl.hash || "").replace(/^#/, ""));
-
-  const code = String(searchParams.get("code") || hashParams.get("code") || "").trim();
-  const accessToken = String(searchParams.get("access_token") || hashParams.get("access_token") || "").trim();
-  const refreshToken = String(searchParams.get("refresh_token") || hashParams.get("refresh_token") || "").trim();
+  const { searchParams } = callbackUrlParams;
+  const code = readAuthCallbackParam(callbackUrlParams, "code");
+  const accessToken = readAuthCallbackParam(callbackUrlParams, "access_token");
+  const refreshToken = readAuthCallbackParam(callbackUrlParams, "refresh_token");
   const errorCode = String(
-    searchParams.get("error") ||
-      hashParams.get("error") ||
-      searchParams.get("errorCode") ||
-      hashParams.get("errorCode") ||
-      ""
+    readAuthCallbackParam(callbackUrlParams, "error") ||
+      readAuthCallbackParam(callbackUrlParams, "errorCode")
   ).trim();
   const errorDescription = String(
-    searchParams.get("error_description") ||
-      hashParams.get("error_description") ||
-      searchParams.get("errorDescription") ||
-      hashParams.get("errorDescription") ||
-      ""
+    readAuthCallbackParam(callbackUrlParams, "error_description") ||
+      readAuthCallbackParam(callbackUrlParams, "errorDescription")
   ).trim();
   const hasSessionPair = Boolean(accessToken && refreshToken);
 

package/src/client/runtime/passwordRecoveryCallbackRuntime.js

@@ -0,0 +1,82 @@
+import {
+  readAuthCallbackParam,
+  readAuthCallbackUrlParams,
+  stripAuthCallbackParamsFromUrl
+} from "./authCallbackUrlParams.js";
+
+const PASSWORD_RECOVERY_CALLBACK_PARAM_KEYS = Object.freeze([
+  "token",
+  "code",
+  "token_hash",
+  "access_token",
+  "refresh_token",
+  "expires_in",
+  "expires_at",
+  "token_type",
+  "type"
+]);
+
+function readPasswordRecoveryCallbackPayloadFromUrl(url = "") {
+  const callbackUrlParams = readAuthCallbackUrlParams(url);
+  if (!callbackUrlParams) {
+    return null;
+  }
+
+  const accessToken = readAuthCallbackParam(callbackUrlParams, "access_token");
+  const refreshToken = readAuthCallbackParam(callbackUrlParams, "refresh_token");
+  const tokenHash = readAuthCallbackParam(callbackUrlParams, "token_hash");
+  const code =
+    readAuthCallbackParam(callbackUrlParams, "token") ||
+    readAuthCallbackParam(callbackUrlParams, "code");
+
+  if (accessToken && refreshToken) {
+    return Object.freeze({
+      accessToken,
+      refreshToken,
+      type: "recovery"
+    });
+  }
+  if (tokenHash) {
+    return Object.freeze({
+      tokenHash,
+      type: "recovery"
+    });
+  }
+  if (code) {
+    return Object.freeze({
+      code,
+      type: "recovery"
+    });
+  }
+  if (accessToken || refreshToken) {
+    return Object.freeze({
+      accessToken,
+      refreshToken,
+      type: "recovery"
+    });
+  }
+  return null;
+}
+
+function stripPasswordRecoveryCallbackParamsFromUrl(url = "") {
+  return stripAuthCallbackParamsFromUrl(url, PASSWORD_RECOVERY_CALLBACK_PARAM_KEYS);
+}
+
+function stripPasswordRecoveryCallbackParamsFromLocation() {
+  if (typeof window !== "object" || !window.location || !window.history) {
+    return;
+  }
+
+  window.history.replaceState(
+    {},
+    "",
+    stripPasswordRecoveryCallbackParamsFromUrl(window.location.href)
+  );
+}
+
+export {
+  PASSWORD_RECOVERY_CALLBACK_PARAM_KEYS,
+  readPasswordRecoveryCallbackPayloadFromUrl,
+  stripPasswordRecoveryCallbackParamsFromLocation,
+  stripPasswordRecoveryCallbackParamsFromUrl
+};

package/src/client/stores/useAuthStore.js

@@ -68,6 +68,7 @@ export const useAuthStore = defineStore("jskit.auth-web.auth", () => {
   const username = computed(() => String(authState.value.username || ""));
   const oauthProviders = computed(() => authState.value.oauthProviders || EMPTY_AUTH_GUARD_STATE.oauthProviders);
   const oauthDefaultProvider = computed(() => String(authState.value.oauthDefaultProvider || ""));
+  const authCapabilities = computed(() => authState.value.authCapabilities || EMPTY_AUTH_GUARD_STATE.authCapabilities);
 
   return {
     runtime,
@@ -76,6 +77,7 @@ export const useAuthStore = defineStore("jskit.auth-web.auth", () => {
     username,
     oauthProviders,
     oauthDefaultProvider,
+    authCapabilities,
     attachRuntime,
     initialize,
     refresh,

package/src/client/views/DefaultLoginView.vue

@@ -35,7 +35,7 @@
               Sign in
             </v-btn>
             <v-btn
-              v-if="!showRememberedAccount"
+              v-if="!showRememberedAccount && canRegister"
               data-testid="auth-mode-register"
               class="text-none"
               :variant="isRegister ? 'flat' : 'text'"
@@ -59,6 +59,7 @@
                   Go to main screen
                 </v-btn>
                 <v-btn
+                  v-if="canResendEmailConfirmation"
                   class="text-none"
                   variant="outlined"
                   color="secondary"
@@ -86,6 +87,7 @@
               </div>
 
               <v-text-field
+                v-if="!isLogin || canUsePasswordLogin"
                 v-model="email"
                 label="Email"
                 variant="outlined"
@@ -98,7 +100,7 @@
               />
 
               <v-text-field
-                v-if="!isForgot && !isOtp"
+                v-if="(isLogin && canUsePasswordLogin) || isRegister"
                 v-model="password"
                 label="Password"
                 :type="showPassword ? 'text' : 'password'"
@@ -139,13 +141,22 @@
                 class="mb-3"
               />
 
-              <div v-if="isLogin" class="aux-links d-flex justify-end mb-4">
-                <v-btn variant="text" color="secondary" @click="switchMode('forgot')">Forgot password?</v-btn>
-                <v-btn variant="text" color="secondary" @click="switchMode('otp')">Use one-time code</v-btn>
+              <div v-if="isLogin && (canRequestPasswordRecovery || canUseOtp)" class="aux-links d-flex justify-end mb-4">
+                <v-btn
+                  v-if="canRequestPasswordRecovery"
+                  variant="text"
+                  color="secondary"
+                  @click="switchMode('forgot')"
+                >
+                  Forgot password?
+                </v-btn>
+                <v-btn v-if="canUseOtp" variant="text" color="secondary" @click="switchMode('otp')">
+                  Use one-time code
+                </v-btn>
               </div>
 
               <v-checkbox
-                v-if="isLogin || isOtp"
+                v-if="(isLogin && canUsePasswordLogin) || isOtp"
                 v-model="rememberAccountOnDevice"
                 label="Remember this account on this device"
                 density="compact"
@@ -165,7 +176,7 @@
                 </v-btn>
               </div>
 
-              <div v-if="isLogin || isRegister" class="oauth-actions d-grid ga-2 mb-4">
+              <div v-if="canUseOAuth && (isLogin || isRegister)" class="oauth-actions d-grid ga-2 mb-4">
                 <v-btn
                   v-for="provider in oauthProviders"
                   :key="provider.id"
@@ -181,6 +192,7 @@
                 </v-btn>
               </div>
               <v-btn
+                v-if="!isLogin || canUsePasswordLogin"
                 data-testid="auth-submit"
                 block
                 color="primary"
@@ -251,6 +263,12 @@ const {
   isLogin,
   isRegister,
   isEmailConfirmationPending,
+  canUsePasswordLogin,
+  canRegister,
+  canRequestPasswordRecovery,
+  canUseOtp,
+  canUseOAuth,
+  canResendEmailConfirmation,
   emailConfirmationMessage,
   showRememberedAccount,
   switchMode,

package/src/client/views/DefaultResetPasswordView.vue

@@ -0,0 +1,214 @@
+<template>
+  <div class="reset-screen" :class="{ 'reset-screen--mobile': isMobileViewport }">
+    <v-container
+      fluid
+      class="reset-shell fill-height d-flex"
+      :class="[
+        isMobileViewport
+          ? 'reset-shell--mobile align-stretch justify-stretch pa-0'
+          : 'align-center justify-center py-8'
+      ]"
+    >
+      <v-card
+        class="reset-card"
+        :class="{ 'reset-card--mobile': isMobileViewport }"
+        :rounded="isMobileViewport ? false : 'lg'"
+        :elevation="isMobileViewport ? 0 : 1"
+        :border="!isMobileViewport"
+      >
+        <v-card-text class="reset-content" :class="{ 'reset-content--mobile': isMobileViewport }">
+          <div class="reset-header mb-5">
+            <h1 class="reset-title">Reset password</h1>
+          </div>
+
+          <v-alert v-if="errorMessage" type="error" variant="tonal" class="mb-4">
+            {{ errorMessage }}
+          </v-alert>
+
+          <v-alert v-if="status === 'done'" type="success" variant="tonal" class="mb-4">
+            Password updated. Sign in with your new password.
+          </v-alert>
+
+          <v-progress-linear v-if="status === 'checking'" indeterminate color="primary" class="mb-4" />
+
+          <v-form v-if="status === 'ready'" @submit.prevent="submitReset" novalidate>
+            <v-text-field
+              v-model="password"
+              label="New password"
+              :type="showPassword ? 'text' : 'password'"
+              variant="outlined"
+              density="comfortable"
+              autocomplete="new-password"
+              :append-inner-icon="showPassword ? mdiEyeOff : mdiEye"
+              :error-messages="passwordError"
+              class="mb-3"
+              @click:append-inner="showPassword = !showPassword"
+            />
+            <v-text-field
+              v-model="confirmPassword"
+              label="Confirm password"
+              :type="showConfirmPassword ? 'text' : 'password'"
+              variant="outlined"
+              density="comfortable"
+              autocomplete="new-password"
+              :append-inner-icon="showConfirmPassword ? mdiEyeOff : mdiEye"
+              :error-messages="confirmPasswordError"
+              class="mb-4"
+              @click:append-inner="showConfirmPassword = !showConfirmPassword"
+            />
+            <v-btn block color="primary" size="large" type="submit" :loading="loading" :disabled="!canSubmit">
+              Update password
+            </v-btn>
+          </v-form>
+
+          <div v-if="status === 'done' || status === 'error'" class="mt-4 d-flex justify-end">
+            <v-btn variant="text" color="secondary" href="/auth/login">Back to sign in</v-btn>
+          </div>
+        </v-card-text>
+      </v-card>
+    </v-container>
+  </div>
+</template>
+
+<script setup>
+import { computed, onMounted, ref } from "vue";
+import { mdiEye, mdiEyeOff } from "@mdi/js";
+import { useDisplay } from "vuetify";
+import { AUTH_PATHS } from "@jskit-ai/auth-core/shared/authPaths";
+import { authPasswordResetCommand } from "@jskit-ai/auth-core/shared/commands/authPasswordResetCommand";
+import { authHttpRequest } from "../runtime/authHttpClient.js";
+import {
+  readPasswordRecoveryCallbackPayloadFromUrl,
+  stripPasswordRecoveryCallbackParamsFromLocation
+} from "../runtime/passwordRecoveryCallbackRuntime.js";
+import {
+  validateCommandSection,
+  resolveFieldValidationMessage
+} from "../composables/loginView/validationHelpers.js";
+
+const { mobile: isMobileViewport } = useDisplay({ mobileBreakpoint: 960 });
+const status = ref("checking");
+const loading = ref(false);
+const errorMessage = ref("");
+const password = ref("");
+const confirmPassword = ref("");
+const showPassword = ref(false);
+const showConfirmPassword = ref(false);
+
+const resetPasswordPayload = computed(() => ({
+  password: password.value
+}));
+const resetPasswordValidation = computed(() =>
+  validateCommandSection(authPasswordResetCommand, "body", resetPasswordPayload.value)
+);
+const passwordError = computed(() => {
+  if (!password.value) {
+    return [];
+  }
+  const message = resolveFieldValidationMessage(resetPasswordValidation.value, "password");
+  return message ? [message] : [];
+});
+const confirmPasswordError = computed(() => {
+  if (!confirmPassword.value) {
+    return [];
+  }
+  return password.value === confirmPassword.value ? [] : ["Passwords must match."];
+});
+const canSubmit = computed(() =>
+  Boolean(password.value) &&
+  resetPasswordValidation.value.ok === true &&
+  password.value === confirmPassword.value &&
+  loading.value !== true
+);
+
+function readRecoveryPayload() {
+  if (typeof window !== "object" || !window.location) {
+    return null;
+  }
+  return readPasswordRecoveryCallbackPayloadFromUrl(window.location.href);
+}
+
+async function exchangeRecoveryToken() {
+  const recoveryPayload = readRecoveryPayload();
+  if (!recoveryPayload) {
+    status.value = "ready";
+    return;
+  }
+  try {
+    await authHttpRequest(AUTH_PATHS.PASSWORD_RECOVERY, {
+      method: "POST",
+      body: recoveryPayload
+    });
+    stripPasswordRecoveryCallbackParamsFromLocation();
+    status.value = "ready";
+  } catch (error) {
+    status.value = "error";
+    errorMessage.value = String(error?.message || "Recovery link is invalid or expired.");
+  }
+}
+
+async function submitReset() {
+  if (!canSubmit.value) {
+    return;
+  }
+  loading.value = true;
+  errorMessage.value = "";
+  try {
+    await authHttpRequest(AUTH_PATHS.PASSWORD_RESET, {
+      method: "POST",
+      body: {
+        password: password.value
+      }
+    });
+    status.value = "done";
+    password.value = "";
+    confirmPassword.value = "";
+  } catch (error) {
+    errorMessage.value = String(error?.message || "Unable to update password.");
+  } finally {
+    loading.value = false;
+  }
+}
+
+onMounted(exchangeRecoveryToken);
+</script>
+
+<style scoped>
+.reset-screen {
+  position: fixed;
+  inset: 0;
+  z-index: 1;
+  overflow-y: auto;
+  min-height: 100dvh;
+  background-color: rgb(var(--v-theme-background));
+}
+
+.reset-shell {
+  min-height: 100dvh;
+}
+
+.reset-card {
+  width: min(480px, 100%);
+}
+
+.reset-card--mobile {
+  width: 100%;
+  min-height: 100dvh;
+}
+
+.reset-content {
+  padding: 28px;
+}
+
+.reset-content--mobile {
+  min-height: 100dvh;
+  padding: calc(24px + env(safe-area-inset-top, 0px)) 20px calc(32px + env(safe-area-inset-bottom, 0px));
+}
+
+.reset-title {
+  margin: 0;
+  font-size: 28px;
+  line-height: 1.2;
+  color: rgb(var(--v-theme-on-surface));
+}
+</style>

package/src/server/routes/authRoutes.js

@@ -239,7 +239,7 @@ function buildRoutes(controller, { includeDevLoginAs = false } = {}) {
     {
       path: AUTH_PATHS.PASSWORD_RESET,
       method: "POST",
-      auth: "required",
+      auth: "public",
       meta: {
         tags: ["auth"],
         summary: "Set a new password for authenticated recovery session"

package/src/server/services/AuthWebService.js

@@ -1,3 +1,4 @@
+import { normalizeAuthCapabilities } from "@jskit-ai/auth-core/shared/authCapabilities";
 import { AUTH_ACTION_IDS } from "../constants/authActionIds.js";
 
 class AuthWebService {
@@ -143,6 +144,15 @@ class AuthWebService {
 
   getOAuthProviderCatalogPayload() {
     const authService = this.resolveAuthService();
+    if (typeof authService.getCapabilities === "function") {
+      const capabilities = normalizeAuthCapabilities(authService.getCapabilities());
+      const oauth = capabilities.features.oauthLogin;
+      return {
+        authCapabilities: capabilities,
+        oauthProviders: oauth.enabled ? oauth.providers : [],
+        oauthDefaultProvider: oauth.enabled ? oauth.defaultProvider : null
+      };
+    }
     const catalog =
       typeof authService.getOAuthProviderCatalog === "function"
         ? authService.getOAuthProviderCatalog()
@@ -156,12 +166,23 @@ class AuthWebService {
           .filter((provider) => provider.id && provider.label)
       : [];
     const defaultProvider = String(catalog?.defaultProvider || "").trim().toLowerCase();
+    const normalizedDefaultProvider = providers.some((provider) => provider.id === defaultProvider)
+      ? defaultProvider
+      : null;
+    const fallbackCapabilities = normalizeAuthCapabilities({
+      features: {
+        oauthLogin: {
+          enabled: providers.length > 0,
+          providers,
+          defaultProvider: normalizedDefaultProvider
+        }
+      }
+    });
 
     return {
+      authCapabilities: fallbackCapabilities,
       oauthProviders: providers,
-      oauthDefaultProvider: providers.some((provider) => provider.id === defaultProvider)
-        ? defaultProvider
-        : null
+      oauthDefaultProvider: normalizedDefaultProvider
     };
   }
 }

package/templates/src/pages/auth/reset-password.vue

@@ -0,0 +1,17 @@
+<route lang="json">
+{
+  "meta": {
+    "guard": {
+      "policy": "public"
+    }
+  }
+}
+</route>
+
+<script setup>
+import DefaultResetPasswordView from "@jskit-ai/auth-web/client/views/DefaultResetPasswordView";
+</script>
+
+<template>
+  <DefaultResetPasswordView />
+</template>

package/templates/src/views/auth/ResetPasswordView.vue

@@ -0,0 +1,7 @@
+<script setup>
+import DefaultResetPasswordView from "@jskit-ai/auth-web/client/views/DefaultResetPasswordView";
+</script>
+
+<template>
+  <DefaultResetPasswordView />
+</template>

package/test/authGuardRuntime.test.js

@@ -149,6 +149,47 @@ test("auth guard runtime redirects callback hashes on non-login routes to /auth/
   }
 });
 
+test("auth guard runtime leaves recovery callback hashes on reset-password route", async () => {
+  const originalWindow = globalThis.window;
+  let redirectedTo = "";
+  globalThis.window = {
+    location: {
+      pathname: "/auth/reset-password",
+      search: "",
+      hash: "#access_token=access&refresh_token=refresh&type=recovery",
+      replace(target) {
+        redirectedTo = String(target || "");
+      }
+    }
+  };
+
+  try {
+    const placementRuntime = createPlacementRuntimeStub();
+    let fetchCalls = 0;
+    const runtime = createAuthGuardRuntime({
+      placementRuntime,
+      fetchImplementation: async () => {
+        fetchCalls += 1;
+        return {
+          ok: true,
+          async json() {
+            return {
+              authenticated: false
+            };
+          }
+        };
+      }
+    });
+
+    const state = await runtime.initialize();
+    assert.equal(state.authenticated, false);
+    assert.equal(fetchCalls, 1);
+    assert.equal(redirectedTo, "");
+  } finally {
+    globalThis.window = originalWindow;
+  }
+});
+
 test("auth guard runtime only updates placement auth context", async () => {
   const placementRuntime = createPlacementRuntimeStub({
     user: {

package/test/clientSurface.test.js

@@ -12,6 +12,7 @@ import {
 test("auth-web descriptor declares auth surface ui routes", () => {
   const uiRoutes = Array.isArray(descriptor?.metadata?.ui?.routes) ? descriptor.metadata.ui.routes : [];
   const authRoutes = uiRoutes.filter((route) => String(route?.path || "").startsWith("/auth/"));
+  const resetRoute = authRoutes.find((route) => route.id === "auth.reset-password");
 
   assert.equal(authRoutes.length >= 2, true);
   for (const route of authRoutes) {
@@ -19,16 +20,20 @@ test("auth-web descriptor declares auth surface ui routes", () => {
     assert.equal(String(route?.surface || "").trim().toLowerCase(), "auth");
     assert.equal(String(route?.guard?.policy || "").trim().toLowerCase(), "public");
   }
+  assert.equal(resetRoute?.autoRegister, false);
 });
 
 test("auth-web auth page templates declare public route guard", () => {
   const loginTemplatePath = fileURLToPath(new URL("../templates/src/pages/auth/login.vue", import.meta.url));
   const signOutTemplatePath = fileURLToPath(new URL("../templates/src/pages/auth/signout.vue", import.meta.url));
+  const resetTemplatePath = fileURLToPath(new URL("../templates/src/pages/auth/reset-password.vue", import.meta.url));
   const loginTemplateSource = readFileSync(loginTemplatePath, "utf8");
   const signOutTemplateSource = readFileSync(signOutTemplatePath, "utf8");
+  const resetTemplateSource = readFileSync(resetTemplatePath, "utf8");
 
   assert.match(loginTemplateSource, /"guard"\s*:\s*\{\s*"policy"\s*:\s*"public"\s*\}/);
   assert.match(signOutTemplateSource, /"guard"\s*:\s*\{\s*"policy"\s*:\s*"public"\s*\}/);
+  assert.match(resetTemplateSource, /"guard"\s*:\s*\{\s*"policy"\s*:\s*"public"\s*\}/);
 });
 
 test("auth-web exports runtime signout helpers directly", () => {
@@ -103,6 +108,17 @@ test("default login view avoids decorative login chrome", () => {
   assert.doesNotMatch(constantsSource, /\[LOGIN_MODE\]:\s*"Sign in to continue\.?"/);
 });
 
+test("default login view gates password login controls by provider capabilities", () => {
+  const viewPath = fileURLToPath(new URL("../src/client/views/DefaultLoginView.vue", import.meta.url));
+  const validationPath = fileURLToPath(new URL("../src/client/composables/loginView/useLoginViewValidation.js", import.meta.url));
+  const viewSource = readFileSync(viewPath, "utf8");
+  const validationSource = readFileSync(validationPath, "utf8");
+
+  assert.match(viewSource, /v-if="!isLogin \|\| canUsePasswordLogin"/);
+  assert.match(viewSource, /v-if="\(isLogin && canUsePasswordLogin\) \|\| isRegister"/);
+  assert.match(validationSource, /state\.isLogin\.value && !state\.canUsePasswordLogin\.value/);
+});
+
 test("auth-web package exports only minimal client runtime/view subpaths", () => {
   const packageJson = JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"));
   const exportsMap = packageJson && typeof packageJson === "object" ? packageJson.exports : {};
@@ -111,6 +127,10 @@ test("auth-web package exports only minimal client runtime/view subpaths", () =>
     exportsMap["./client/views/DefaultLoginView"],
     "./src/client/views/DefaultLoginView.vue"
   );
+  assert.equal(
+    exportsMap["./client/views/DefaultResetPasswordView"],
+    "./src/client/views/DefaultResetPasswordView.vue"
+  );
   assert.equal(
     exportsMap["./client/views/DefaultSignOutView"],
     "./src/client/views/DefaultSignOutView.vue"
@@ -134,3 +154,16 @@ test("auth-web package exports only minimal client runtime/view subpaths", () =>
   assert.equal(exportsMap["./client/views/AuthProfileWidget"], undefined);
   assert.equal(exportsMap["./client/views/AuthProfileMenuLinkItem"], undefined);
 });
+
+test("default reset password view preserves recovery session-pair callback tokens", () => {
+  const viewPath = fileURLToPath(new URL("../src/client/views/DefaultResetPasswordView.vue", import.meta.url));
+  const viewSource = readFileSync(viewPath, "utf8");
+
+  assert.match(viewSource, /readPasswordRecoveryCallbackPayloadFromUrl\(window\.location\.href\)/);
+  assert.match(viewSource, /stripPasswordRecoveryCallbackParamsFromLocation\(\);/);
+  assert.match(viewSource, /authPasswordResetCommand/);
+  assert.match(viewSource, /validateCommandSection\(authPasswordResetCommand,\s*"body"/);
+  assert.match(viewSource, /if \(!recoveryPayload\)\s*\{\s*status\.value = "ready";/);
+  assert.doesNotMatch(viewSource, /if \(!recoveryPayload\)\s*\{\s*status\.value = "error";/);
+  assert.doesNotMatch(viewSource, /hash\.get\("access_token"\)[\s\S]*code:/);
+});

package/test/index.test.js

@@ -13,6 +13,19 @@ test("auth fastify adapter exports controller/routes backed by shared command va
   assert.ok(authLoginPasswordCommand.operation.body.schema);
 });
 
+test("auth reset route remains public and lets provider validate recovery scope", () => {
+  const controller = new Proxy({}, {
+    get() {
+      return () => {};
+    }
+  });
+  const routes = buildRoutes(controller);
+  const resetRoute = routes.find((route) => route.method === "POST" && route.path === "/api/password/reset");
+
+  assert.ok(resetRoute);
+  assert.equal(resetRoute.auth, "public");
+});
+
 test("auth-web does not contain src/server/schema", () => {
   const testFilePath = fileURLToPath(import.meta.url);
   const packageRoot = path.resolve(path.dirname(testFilePath), "..");

package/test/passwordRecoveryCallbackRuntime.test.js

@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {
+  readPasswordRecoveryCallbackPayloadFromUrl,
+  stripPasswordRecoveryCallbackParamsFromUrl
+} from "../src/client/runtime/passwordRecoveryCallbackRuntime.js";
+
+test("readPasswordRecoveryCallbackPayloadFromUrl preserves Supabase session-pair hashes", () => {
+  assert.deepEqual(
+    readPasswordRecoveryCallbackPayloadFromUrl(
+      "/auth/reset-password#access_token=access&refresh_token=refresh&type=recovery"
+    ),
+    {
+      accessToken: "access",
+      refreshToken: "refresh",
+      type: "recovery"
+    }
+  );
+});
+
+test("readPasswordRecoveryCallbackPayloadFromUrl reads local tokens and token hashes", () => {
+  assert.deepEqual(
+    readPasswordRecoveryCallbackPayloadFromUrl("/auth/reset-password?token=local-token&type=recovery"),
+    {
+      code: "local-token",
+      type: "recovery"
+    }
+  );
+  assert.deepEqual(
+    readPasswordRecoveryCallbackPayloadFromUrl("/auth/reset-password?token_hash=hashed-token&type=recovery"),
+    {
+      tokenHash: "hashed-token",
+      type: "recovery"
+    }
+  );
+  assert.equal(readPasswordRecoveryCallbackPayloadFromUrl("/auth/reset-password"), null);
+});
+
+test("readPasswordRecoveryCallbackPayloadFromUrl prefers complete recovery tokens over partial session pairs", () => {
+  assert.deepEqual(
+    readPasswordRecoveryCallbackPayloadFromUrl(
+      "/auth/reset-password?token_hash=hashed-token#access_token=access&type=recovery"
+    ),
+    {
+      tokenHash: "hashed-token",
+      type: "recovery"
+    }
+  );
+});
+
+test("stripPasswordRecoveryCallbackParamsFromUrl removes credentials but keeps unrelated state", () => {
+  assert.equal(
+    stripPasswordRecoveryCallbackParamsFromUrl(
+      "/auth/reset-password?token=local-token&returnTo=%2Fhome#access_token=access&refresh_token=refresh&tab=reset"
+    ),
+    "/auth/reset-password?returnTo=%2Fhome#tab=reset"
+  );
+});

package/test/providerRuntime.test.js

@@ -227,6 +227,86 @@ test("auth route provider does not resolve authService during boot", async () =>
   assert.equal(authServiceResolutions, 1);
 });
 
+test("auth session route preserves provider capabilities through response validation", async () => {
+  const fastify = createFastifyStub();
+  const app = createApplication();
+  const httpRuntime = createHttpRuntime({ app, fastify });
+
+  app.instance("authService", {
+    writeSessionCookies() {},
+    clearSessionCookies() {},
+    getCapabilities() {
+      return {
+        provider: {
+          id: "local",
+          label: "Local"
+        },
+        features: {
+          password: {
+            login: true,
+            register: true,
+            change: true,
+            methodToggle: false
+          },
+          passwordRecovery: {
+            request: true,
+            complete: true,
+            delivery: "dev-log"
+          },
+          otp: {
+            login: false
+          },
+          oauthLogin: {
+            enabled: false,
+            providers: [],
+            defaultProvider: null
+          },
+          emailConfirmation: false,
+          profileUpdate: true,
+          providerLinking: {
+            start: false,
+            unlink: false
+          },
+          securityStatus: true,
+          signOutOtherSessions: true,
+          appProfileProjection: false,
+          devLoginAs: false
+        }
+      };
+    }
+  });
+  app.instance("actionExecutor", {
+    async execute({ actionId }) {
+      if (actionId === "auth.session.read") {
+        return {
+          authenticated: false
+        };
+      }
+      return {};
+    }
+  });
+
+  class MockAuthProvider {
+    static id = "auth.provider";
+  }
+
+  await app.start({ providers: [MockAuthProvider, AuthWebServiceProvider, AuthRouteServiceProvider] });
+
+  const registration = httpRuntime.registerRoutes();
+  assert.equal(registration.routeCount > 0, true);
+
+  const sessionRoute = fastify.routes.find((route) => route.method === "GET" && route.url === "/api/session");
+  assert.ok(sessionRoute);
+  const sessionReply = createReplyStub();
+  await sessionRoute.handler({}, sessionReply);
+
+  assert.equal(sessionReply.statusCode, 200);
+  assert.equal(sessionReply.payload.authenticated, false);
+  assert.equal(sessionReply.payload.authCapabilities.provider.id, "local");
+  assert.equal(sessionReply.payload.authCapabilities.features.password.login, true);
+  assert.equal(sessionReply.payload.authCapabilities.features.password.register, true);
+});
+
 test("auth session route exposes denial reason when policy clears a rejected authenticated session", async () => {
   const events = [];
   const fastify = createFastifyStub();