@lobb-js/lobb-ext-auth 0.14.1 → 0.15.1

package/dist/lib/components/pages/loginPage/index.svelte

@@ -1,27 +1,18 @@
-<script lang="ts">
-    import type { ExtensionProps } from "@lobb-js/studio";
-    import { Auth } from "../../../../auth";
-
-    const { utils }: ExtensionProps = $props();
-
-    let formData = {
-        email:
-            window.location.hostname === "demo.lobb.app"
-                ? "admin@example.com"
-                : "",
-        password: window.location.hostname === "demo.lobb.app" ? "admin" : "",
-    };
-
-    async function handleOnSubmit(e: Event) {
-        e.preventDefault();
-        if (!formData.email && !formData.password) {
-            utils.toast.error("Please complete all fields");
-            return;
-        }
-
-        const auth = new Auth(utils);
-        await auth.login(formData);
-    }
+<script lang="ts">import { Auth } from "../../../../auth";
+const { utils } = $props();
+let formData = {
+	email: window.location.hostname === "demo.lobb.app" ? "admin@example.com" : "",
+	password: window.location.hostname === "demo.lobb.app" ? "admin" : ""
+};
+async function handleOnSubmit(e) {
+	e.preventDefault();
+	if (!formData.email && !formData.password) {
+		utils.toast.error("Please complete all fields");
+		return;
+	}
+	const auth = new Auth(utils);
+	await auth.login(formData);
+}
 </script>
 
 <div

package/dist/lib/components/pages/settings/index.svelte

@@ -1,24 +1,20 @@
-<script lang="ts">
-	import type { ExtensionProps } from "@lobb-js/studio";
-    import Users from "./pages/users.svelte";
-    import RolesAndPermissions from "./pages/rolesAndPermissions.svelte";
-    import ActivityFeed from "./pages/activityFeed.svelte";
-
-	const props: ExtensionProps = $props();
-	const components = props.utils.components;
-	const { Sidebar } = components;
-	const { Icons } = components;
-	const auth_settings_page = $derived(props.utils.page.url.pathname.split("/")[5]);
-	const isSmall = $derived(!props.utils.mediaQueries.sm.current);
-
-	// Bare /studio/extensions/auth/settings has no sub-page to render, which
-	// would leave the page blank. Redirect to the first sub-page (Users) so
-	// landing on the settings root always shows something useful.
-	$effect(() => {
-		if (!auth_settings_page) {
-			props.utils.goto("/studio/extensions/auth/settings/users");
-		}
-	});
+<script lang="ts">import Users from "./pages/users.svelte";
+import RolesAndPermissions from "./pages/rolesAndPermissions.svelte";
+import ActivityFeed from "./pages/activityFeed.svelte";
+const props = $props();
+const components = props.utils.components;
+const { Sidebar } = components;
+const { Icons } = components;
+const auth_settings_page = $derived(props.utils.page.url.pathname.split("/")[5]);
+const isSmall = $derived(!props.utils.mediaQueries.sm.current);
+// Bare /studio/extensions/auth/settings has no sub-page to render, which
+// would leave the page blank. Redirect to the first sub-page (Users) so
+// landing on the settings root always shows something useful.
+$effect(() => {
+	if (!auth_settings_page) {
+		props.utils.goto("/studio/extensions/auth/settings/users");
+	}
+});
 </script>
 
 <!-- TODO: add the sidebar in here to add these pages

package/dist/lib/components/pages/settings/pages/activityFeed.svelte

@@ -1,8 +1,6 @@
-<script lang="ts">
-	import type { ExtensionProps } from "@lobb-js/studio";
-
-	const { utils }: ExtensionProps = $props();
-	const components = utils.components;
+<script lang="ts">const { utils } = $props();
+const components = utils.components;
+export {};
 </script>
 
 <div class="flex flex-col gap-4 p-4 h-full">

package/dist/lib/components/pages/settings/pages/rolesAndPermissions.svelte

@@ -1,8 +1,6 @@
-<script lang="ts">
-	import type { ExtensionProps } from "@lobb-js/studio";
-
-	const { utils }: ExtensionProps = $props();
-	const components = utils.components;
+<script lang="ts">const { utils } = $props();
+const components = utils.components;
+export {};
 </script>
 
 <div class="flex flex-col gap-4 p-4 h-full">

package/dist/lib/components/pages/settings/pages/users.svelte

@@ -1,8 +1,6 @@
-<script lang="ts">
-	import type { ExtensionProps } from "@lobb-js/studio";
-
-	const { utils }: ExtensionProps = $props();
-	const components = utils.components;
+<script lang="ts">const { utils } = $props();
+const components = utils.components;
+export {};
 </script>
 
 <div class="flex flex-col gap-4 p-4 h-full">

package/dist/lib/components/pages/userSettings/index.svelte

@@ -1,32 +1,26 @@
-<script lang="ts">
-	import type { ExtensionProps } from "@lobb-js/studio";
-	import { DetailView } from "@lobb-js/studio";
-	import { onMount } from "svelte";
-
-	const { utils }: ExtensionProps = $props();
-	const { Button, Separator, Skeleton, Icons } = utils.components;
-
-	let entry = $state<Record<string, any>>({});
-	let loading = $state(true);
-
-	onMount(async () => {
-		// /me is the only auth_users path a role without explicit auth_users
-		// read perms can reach (self-bypass at the policy layer).
-		const response = await utils.lobb.findOne("auth_users", "me");
+<script lang="ts">import { DetailView } from "@lobb-js/studio";
+import { onMount } from "svelte";
+const { utils } = $props();
+const { Button, Separator, Skeleton, Icons } = utils.components;
+let entry = $state({});
+let loading = $state(true);
+onMount(async () => {
+	// /me is the only auth_users path a role without explicit auth_users
+	// read perms can reach (self-bypass at the policy layer).
+	const response = await utils.lobb.findOne("auth_users", "me");
+	const result = await response.json();
+	entry = result.data;
+	loading = false;
+});
+async function handleSave() {
+	const response = await utils.lobb.updateOne("auth_users", "me", { data: entry });
+	if (response.status >= 400) {
 		const result = await response.json();
-		entry = result.data;
-		loading = false;
-	});
-
-	async function handleSave() {
-		const response = await utils.lobb.updateOne("auth_users", "me", { data: entry });
-		if (response.status >= 400) {
-			const result = await response.json();
-			utils.toast.error(result.message);
-			return;
-		}
-		utils.toast.success("Profile updated successfully.");
+		utils.toast.error(result.message);
+		return;
 	}
+	utils.toast.success("Profile updated successfully.");
+}
 </script>
 
 <div class="flex flex-col gap-4 p-4">

package/extensions/auth/workflows/baseWorkflow.ts

@@ -30,10 +30,20 @@ export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[]
         input.triggeredBy === "API" &&
         Number(input.id) === 1
       ) {
-        throw new ctx.LobbError({
-          code: "FORBIDDEN",
-          message: "The admin user cannot be updated.",
-        });
+        // Only the security-sensitive core fields are locked on the admin —
+        // changing them could lock out or hijack the account. Other fields
+        // (e.g. extension-added ones) are fine to update.
+        const protectedFields = ["email", "password", "role"];
+        const touched = Object.keys(input.data ?? {}).filter((field) =>
+          protectedFields.includes(field)
+        );
+        if (touched.length) {
+          throw new ctx.LobbError({
+            code: "FORBIDDEN",
+            message:
+              `The admin user's ${touched.join(", ")} cannot be updated.`,
+          });
+        }
       }
     },
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobb-js/lobb-ext-auth",
-  "version": "0.14.1",
+  "version": "0.15.1",
   "license": "UNLICENSED",
   "type": "module",
   "publishConfig": {
@@ -32,12 +32,13 @@
     "package": "svelte-package --input extensions/auth/studio"
   },
   "dependencies": {
-    "@lobb-js/core": "^0.42.0",
+    "@lobb-js/core": "^0.44.0",
     "argon2": "^0.40.3",
     "hono": "^4.7.0"
   },
   "devDependencies": {
-    "@lobb-js/studio": "^0.50.0",
+    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@lobb-js/studio": "^0.53.1",
     "@lucide/svelte": "^0.563.1",
     "@sveltejs/adapter-node": "^5.5.4",
     "@sveltejs/kit": "^2.60.1",