@jxsuite/auth 0.5.6 → 0.6.0

package/README.md

@@ -4,12 +4,7 @@
 
 ## Overview
 
-`@jxsuite/auth` is the Jx extension putting users behind the connector's data tables. It owns the
-project.json `auth` section and mounts [Better Auth](https://better-auth.com) at
-`/_jx/auth`, publishing the `ctx.auth = { getSession, authorize }` hooks on the shared server
-context (specs/extensions.md §11). That mount runs at **order 10**, ahead of the connector's
-`/_jx/data` mount (order 20). With it active, table permission rules beyond `public`/`none` come
-alive:
+`@jxsuite/auth` is the Jx extension putting users behind the connector's data tables. It owns the project.json `auth` section and mounts [Better Auth](https://better-auth.com) at `/_jx/auth`, publishing the `ctx.auth = { getSession, authorize }` hooks on the shared server context (specs/extensions.md §11). That mount runs at **order 10**, ahead of the connector's `/_jx/data` mount (order 20). With it active, table permission rules beyond `public`/`none` come alive:
 
 | Rule            | Grants                                                                                            |
 | --------------- | ------------------------------------------------------------------------------------------------- |
@@ -19,15 +14,9 @@ alive:
 
 Without the auth mount the data mount **fails closed**: only `public` rules pass.
 
-Declaring an `ownerField` makes that column authoritative: **every** session-granted insert
-(`authenticated`, `owner`, `role:<r>`) stamps it with the signed-in user's id, so clients can
-never forge ownership.
+Declaring an `ownerField` makes that column authoritative: **every** session-granted insert (`authenticated`, `owner`, `role:<r>`) stamps it with the signed-in user's id, so clients can never forge ownership.
 
-The auth system tables (`user`, `session`, `account`, `verification`) live on an ordinary
-connector connection, named by `auth.connection` and defaulting to the project's first-declared
-connection. Better Auth's additive migrations create them: `jx db push` (or the Studio's push
-button) plans them as `kind: "auth"` steps after the connector plan, and the dev server also syncs
-them on first touch of `/_jx/auth`.
+The auth system tables (`user`, `session`, `account`, `verification`) live on an ordinary connector connection, named by `auth.connection` and defaulting to the project's first-declared connection. Better Auth's additive migrations create them: `jx db push` (or the Studio's push button) plans them as `kind: "auth"` steps after the connector plan, and the dev server also syncs them on first touch of `/_jx/auth`.
 
 ## Enable it
 
@@ -55,10 +44,7 @@ them on first touch of `/_jx/auth`.
 }
 ```
 
-Secrets never enter project.json (specs/extensions.md §13): set the signing secret under the env
-var named by `auth.secretEnv` (default `BETTER_AUTH_SECRET`) in `.dev.vars` locally and via
-`wrangler secret put` in production. Social providers name their credential env vars the same way
-(`providers.github.clientIdEnv`, defaulting to `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`).
+Secrets never enter project.json (specs/extensions.md §13): set the signing secret under the env var named by `auth.secretEnv` (default `BETTER_AUTH_SECRET`) in `.dev.vars` locally and via `wrangler secret put` in production. Social providers name their credential env vars the same way (`providers.github.clientIdEnv`, defaulting to `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`).
 
 ## Page UX
 
@@ -71,27 +57,15 @@ var named by `auth.secretEnv` (default `BETTER_AUTH_SECRET`) in `.dev.vars` loca
 }
 ```
 
-- **`Session`** resolves to `{ userId, role?, user }` or `null` and updates live via
-  `subscribe()`. Outside browsers it resolves to `null`, so statically generated pages always
-  render the signed-out state.
-- **`AuthActions`** resolves to `{ signInEmail, signUpEmail, signInSocial, signOut }`. Wire a
-  form's `onsubmit` to `{ "$ref": "auth.signInEmail" }` and the handler reads the form's
-  `email`/`password` fields, refreshes the session store, bumps the `_v` read-after-write version,
-  and applies `auth.redirects`.
+- **`Session`** resolves to `{ userId, role?, user }` or `null` and updates live via `subscribe()`. Outside browsers it resolves to `null`, so statically generated pages always render the signed-out state.
+- **`AuthActions`** resolves to `{ signInEmail, signUpEmail, signInSocial, signOut }`. Wire a form's `onsubmit` to `{ "$ref": "auth.signInEmail" }` and the handler reads the form's `email`/`password` fields, refreshes the session store, bumps the `_v` read-after-write version, and applies `auth.redirects`.
 
 ## v1 cuts
 
-- **No email transport**: no verification or password-reset emails ship in v1, so email/password
-  accounts are live immediately after sign-up.
-- **Roles are edited via the data grid**: declare role names in `auth.roles` (this adds the
-  `role` column to the user table); assign them by editing user rows in the Studio's data grid.
-  Sign-up input can never set a role.
-- **Public-insert abuse**: a table with `insert: "public"` accepts writes from anyone on the
-  internet. Prefer `authenticated` inserts, or accept the risk knowingly (rate limiting /
-  Turnstile are future work).
+- **No email transport**: no verification or password-reset emails ship in v1, so email/password accounts are live immediately after sign-up.
+- **Roles are edited via the data grid**: declare role names in `auth.roles` (this adds the `role` column to the user table); assign them by editing user rows in the Studio's data grid. Sign-up input can never set a role.
+- **Public-insert abuse**: a table with `insert: "public"` accepts writes from anyone on the internet. Prefer `authenticated` inserts, or accept the risk knowingly (rate limiting / Turnstile are future work).
 
 ## Versioning
 
-Published to npm as `@jxsuite/auth`, TypeScript source like every `@jxsuite` package, following
-the monorepo's release train. Depends on `@jxsuite/connector` (the `resolveDialect` seam and the
-permission/hook types it publishes for dependents); core packages never depend on this extension.
+Published to npm as `@jxsuite/auth`, TypeScript source like every `@jxsuite` package, following the monorepo's release train. Depends on `@jxsuite/connector` (the `resolveDialect` seam and the permission/hook types it publishes for dependents); core packages never depend on this extension.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxsuite/auth",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "description": "Better Auth sessions, sign-in flows, and table permissions for Jx sites over /_jx/auth",
   "license": "MIT",
   "repository": {
@@ -38,13 +38,13 @@
     "upgrade": "bun update --latest && bun install"
   },
   "dependencies": {
-    "@jxsuite/connector": "^0.5.6",
-    "@jxsuite/schema": "^2.0.0",
-    "better-auth": "^1.7.2",
+    "@jxsuite/connector": "^0.6.0",
+    "@jxsuite/schema": "^2.2.0",
+    "better-auth": "^1.7.4",
     "kysely": "^0.29.5"
   },
   "devDependencies": {
-    "@happy-dom/global-registrator": "^20.11.8",
+    "@happy-dom/global-registrator": "^20.14.5",
     "ajv": "^8.20.0"
   },
   "jx": "./jx-extension.json"

package/src/Auth.class.json

@@ -21,7 +21,7 @@
 
   "$studio": {
     "settings": {
-      "icon": "sp-icon-lock-closed",
+      "icon": "lock-simple",
       "label": "Authentication",
       "order": 58,
       "layout": "form",