@lowdefy/server-dev 0.0.0-experimental-20260714092003 → 0.0.0-experimental-20260714122106

package/client/feedback/FeedbackOverlay.jsx

@@ -15,6 +15,7 @@
 */
 
 import React, { useEffect, useReducer, useRef, useState } from 'react';
+import { createPortal } from 'react-dom';
 
 import { blockAncestorChain, describeElement, nearestBlock } from './elementInspect.js';
 import {
@@ -663,7 +664,16 @@ function FeedbackOverlay({ basePath, pageId, onClose }) {
   } catch {
     content = null;
   }
-  return content;
+  // Portal to document.body so the overlay is a top-level sibling of the app
+  // root. Rendered inline it inherits the app root's stacking context, and an
+  // open antd modal (portalled to body, zIndex ~1000) then paints above the
+  // overlay regardless of its own zIndex — making the comment textarea
+  // unclickable. As a body sibling its zIndex competes in the root stacking
+  // context and wins.
+  if (typeof document === 'undefined' || !document.body) {
+    return content;
+  }
+  return createPortal(content, document.body);
 }
 
 // Pure render function kept outside the hook-bearing component body so a
@@ -776,7 +786,11 @@ function renderOverlayContent({
             <div style={descriptorRow}>{state.draftShapes.length} shape(s) drawn</div>
           )}
           <div style={buttonRow}>
-            <button type="button" style={secondaryButton} onClick={() => dispatch({ type: 'DISCARD_DRAFT' })}>
+            <button
+              type="button"
+              style={secondaryButton}
+              onClick={() => dispatch({ type: 'DISCARD_DRAFT' })}
+            >
               Cancel
             </button>
             <button type="button" style={primaryButton} onClick={handleSave}>
@@ -823,10 +837,18 @@ function renderOverlayContent({
           </label>
           {state.sendError && <div style={errorRow}>{state.sendError}</div>}
           <div style={buttonRow}>
-            <button type="button" style={dangerButton} onClick={() => dispatch({ type: 'DISCARD_ALL' })}>
+            <button
+              type="button"
+              style={dangerButton}
+              onClick={() => dispatch({ type: 'DISCARD_ALL' })}
+            >
               Discard all
             </button>
-            <button type="button" style={secondaryButton} onClick={() => dispatch({ type: 'ADD_ANOTHER' })}>
+            <button
+              type="button"
+              style={secondaryButton}
+              onClick={() => dispatch({ type: 'ADD_ANOTHER' })}
+            >
               Add another
             </button>
             <button

package/lib/client/auth/Auth.jsx

@@ -14,8 +14,6 @@
   limitations under the License.
 */
 
-/* eslint-disable react/jsx-props-no-spreading */
-
 import React from 'react';
 import AuthConfigured from './AuthConfigured.jsx';
 import AuthNotConfigured from './AuthNotConfigured.js';
@@ -25,15 +23,15 @@ import { serializer } from '@lowdefy/helpers';
 // Client code imports the build JSON directly — Vite handles JSON imports;
 // the lib/build/*.js wrappers are server-only (they read from disk).
 // Deserialize to restore arrays from their ~arr build markers (providers
-// must be a real array for single-provider inference in createAuthMethods).
+// must be a real array for provider lookups in createAuthMethods).
 import rawAuthConfig from '../../../build/auth.json';
 
 const authConfig = serializer.deserialize(rawAuthConfig);
 
-function Auth({ children, session }) {
+function Auth({ children, user }) {
   if (authConfig.configured === true) {
     return (
-      <AuthConfigured serverSession={session} authConfig={authConfig}>
+      <AuthConfigured serverUser={user} authConfig={authConfig}>
         {(auth) => children(auth)}
       </AuthConfigured>
     );

package/lib/client/auth/AuthConfigured.jsx

@@ -14,17 +14,17 @@
   limitations under the License.
 */
 
-/* eslint-disable react/jsx-props-no-spreading */
-
 import React, { useEffect, useRef } from 'react';
+import { createAuthClient } from 'better-auth/react';
 import {
-  authConfigManager,
-  getSession,
-  SessionProvider,
-  signIn,
-  signOut,
-  useSession,
-} from '@hono/auth-js/react';
+  adminClient,
+  genericOAuthClient,
+  magicLinkClient,
+  organizationClient,
+  phoneNumberClient,
+  twoFactorClient,
+} from 'better-auth/client/plugins';
+import { passkeyClient } from '@better-auth/passkey/client';
 
 import { serializer } from '@lowdefy/helpers';
 
@@ -32,42 +32,122 @@ import rawLowdefyConfig from '../../../build/config.json';
 
 const lowdefyConfig = serializer.deserialize(rawLowdefyConfig);
 
-// @hono/auth-js/react configures its fetch paths through a module-level
-// manager instead of SessionProvider props.
-if (lowdefyConfig.basePath) {
-  authConfigManager.setConfig({ basePath: `${lowdefyConfig.basePath}/api/auth` });
-}
+const authClient = createAuthClient({
+  baseURL: `${window.location.origin}${lowdefyConfig.basePath ?? ''}/api/auth`,
+  plugins: [
+    adminClient(),
+    genericOAuthClient(),
+    magicLinkClient(),
+    organizationClient(),
+    passkeyClient(),
+    phoneNumberClient(),
+    twoFactorClient(),
+  ],
+});
 
-function Session({ children }) {
-  const wasAuthenticated = useRef(false);
-  const { data: session, status } = useSession();
-  wasAuthenticated.current = wasAuthenticated.current || status === 'authenticated';
+// The server resolves the caller per request and embeds it in the page
+// config, so the first render never flashes unauthenticated. The BetterAuth
+// client store takes over once its session fetch settles.
+//
+// Roles and merged attributes resolve server-side from the active member row
+// - the base session carries neither. The last server-resolved caller is
+// kept in a ref: while the session user is unchanged its roles and
+// attributes stay authoritative, and UpdateSession refreshes the ref from
+// /api/user after a change (e.g. SetActiveOrganization).
+function Session({ children, reloadSuppressedRef, serverUser }) {
+  const { data: session, isPending } = authClient.useSession();
+  const resolvedUserRef = useRef(serverUser);
+  const wasAuthenticated = useRef(Boolean(serverUser));
 
   useEffect(() => {
-    if (wasAuthenticated.current && status === 'unauthenticated') {
+    if (session) {
+      wasAuthenticated.current = true;
+    }
+    // Reload after sign-out (or session revocation) so the server can apply
+    // the page auth fork - a protected page redirects to the login page.
+    // A logout with a callbackUrl suppresses the reload - its own navigation
+    // would otherwise race this one.
+    if (wasAuthenticated.current && !isPending && !session && !reloadSuppressedRef.current) {
       window.location.reload();
     }
-  }, [status]);
+  }, [session, isPending]);
 
-  // If session is passed to SessionProvider from the server-rendered config
-  // we won't have a loading state here, but unauthenticated first loads do.
-  if (status === 'loading') {
-    return '';
+  if (isPending) {
+    return children(resolvedUserRef.current, resolvedUserRef);
+  }
+  if (!session?.user) {
+    return children(null, resolvedUserRef);
   }
-  return children(session);
+  const resolved = resolvedUserRef.current;
+  const user =
+    resolved && resolved.id === session.user.id
+      ? { ...session.user, roles: resolved.roles, attributes: resolved.attributes }
+      : { roles: [], ...session.user };
+  return children(user, resolvedUserRef);
 }
 
-function AuthConfigured({ authConfig, children, serverSession }) {
-  const auth = { authConfig, getSession, signIn, signOut };
+function AuthConfigured({ authConfig, children, serverUser }) {
+  const reloadSuppressedRef = useRef(false);
+  const auth = {
+    authConfig,
+    getSession: ({ disableCookieCache } = {}) =>
+      authClient.getSession(disableCookieCache ? { query: { disableCookieCache: true } } : {}),
+    // The server-resolved caller - roles from the active member row and the
+    // merged attributes bag - for re-syncing after session changes.
+    getResolvedUser: async () => {
+      const response = await fetch(`${lowdefyConfig.basePath ?? ''}/api/user`, {
+        credentials: 'same-origin',
+      });
+      if (!response.ok) {
+        // Throw instead of parsing an error page - a silent { user: undefined }
+        // would read as a client-side logout in updateSession.
+        throw new Error(`Failed to fetch the resolved user (HTTP ${response.status}).`);
+      }
+      return response.json();
+    },
+    suppressSignOutReload: () => {
+      reloadSuppressedRef.current = true;
+    },
+    acceptInvitation: (params) => authClient.organization.acceptInvitation(params),
+    // addPasskey runs the WebAuthn browser ceremony itself - options fetch,
+    // authenticator prompt, verification.
+    addPasskey: (params) => authClient.passkey.addPasskey(params),
+    changePassword: (params) => authClient.changePassword(params),
+    deletePasskey: (params) => authClient.passkey.deletePasskey(params),
+    impersonateUser: (params) => authClient.admin.impersonateUser(params),
+    phoneNumberRequestPasswordReset: (params) =>
+      authClient.phoneNumber.requestPasswordReset(params),
+    phoneNumberResetPassword: (params) => authClient.phoneNumber.resetPassword(params),
+    phoneNumberSendOtp: (params) => authClient.phoneNumber.sendOtp(params),
+    phoneNumberVerify: (params) => authClient.phoneNumber.verify(params),
+    requestPasswordReset: (params) => authClient.requestPasswordReset(params),
+    resetPassword: (params) => authClient.resetPassword(params),
+    revokeOtherSessions: () => authClient.revokeOtherSessions(),
+    sendVerificationEmail: (params) => authClient.sendVerificationEmail(params),
+    setActiveOrganization: (params) => authClient.organization.setActive(params),
+    signInEmail: (params) => authClient.signIn.email(params),
+    signInMagicLink: (params) => authClient.signIn.magicLink(params),
+    signInOauth2: (params) => authClient.signIn.oauth2(params),
+    signInPhoneNumber: (params) => authClient.signIn.phoneNumber(params),
+    signInSocial: (params) => authClient.signIn.social(params),
+    signOut: () => authClient.signOut(),
+    signUpEmail: (params) => authClient.signUp.email(params),
+    stopImpersonating: () => authClient.admin.stopImpersonating(),
+    twoFactorDisable: (params) => authClient.twoFactor.disable(params),
+    twoFactorEnable: (params) => authClient.twoFactor.enable(params),
+    twoFactorVerifyBackupCode: (params) => authClient.twoFactor.verifyBackupCode(params),
+    twoFactorVerifyTotp: (params) => authClient.twoFactor.verifyTotp(params),
+  };
   return (
-    <SessionProvider session={serverSession}>
-      <Session>
-        {(session) => {
-          auth.session = session;
-          return children(auth);
-        }}
-      </Session>
-    </SessionProvider>
+    <Session reloadSuppressedRef={reloadSuppressedRef} serverUser={serverUser}>
+      {(user, resolvedUserRef) => {
+        auth.user = user;
+        auth.updateResolvedUser = (resolved) => {
+          resolvedUserRef.current = resolved;
+        };
+        return children(auth);
+      }}
+    </Session>
   );
 }
 

package/lib/client/auth/AuthNotConfigured.js

@@ -13,7 +13,6 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-/* eslint-disable react/jsx-props-no-spreading */
 
 function authNotConfigured() {
   throw new Error('Auth not configured.');
@@ -22,9 +21,30 @@ function authNotConfigured() {
 function AuthNotConfigured({ authConfig, children }) {
   const auth = {
     authConfig,
+    user: null,
+    acceptInvitation: authNotConfigured,
+    addPasskey: authNotConfigured,
+    changePassword: authNotConfigured,
+    deletePasskey: authNotConfigured,
+    getResolvedUser: authNotConfigured,
     getSession: authNotConfigured,
-    signIn: authNotConfigured,
+    impersonateUser: authNotConfigured,
+    requestPasswordReset: authNotConfigured,
+    resetPassword: authNotConfigured,
+    revokeOtherSessions: authNotConfigured,
+    sendVerificationEmail: authNotConfigured,
+    setActiveOrganization: authNotConfigured,
+    signInEmail: authNotConfigured,
+    signInMagicLink: authNotConfigured,
+    signInOauth2: authNotConfigured,
+    signInSocial: authNotConfigured,
     signOut: authNotConfigured,
+    signUpEmail: authNotConfigured,
+    stopImpersonating: authNotConfigured,
+    twoFactorDisable: authNotConfigured,
+    twoFactorEnable: authNotConfigured,
+    twoFactorVerifyBackupCode: authNotConfigured,
+    twoFactorVerifyTotp: authNotConfigured,
   };
 
   return children(auth);

package/lib/client/utils/usePageConfig.js

@@ -54,6 +54,13 @@ async function fetchPageConfig(url) {
   if (res.status === 404) {
     return null;
   }
+  if (res.status === 401) {
+    // Logged-out navigation to a protected page - full load to the login
+    // page so it can return here after sign-in.
+    const { redirect } = await res.json();
+    window.location.assign(redirect ?? '/404');
+    return new Promise(() => {});
+  }
   const data = await res.json();
   if (data?.buildError) {
     return data;

package/lib/docs/getBrowser.js

@@ -18,6 +18,7 @@ import { chromium } from 'playwright-core';
 import { type } from '@lowdefy/helpers';
 
 import lowdefyConfig from '../build/config.js';
+import { HEADLESS_USER_COOKIE, headlessUser } from '../server/auth/headlessUser.js';
 
 // playwright-core does not bundle a browser (unlike @playwright/test) — it
 // only drives one that is already installed. `channel: 'chrome'` picks up a
@@ -73,6 +74,16 @@ function buildPageUrl({ origin, pageId }) {
 async function openPage({ browser, origin, pageId, width = 1280, height = 800, timeout = 15000 }) {
   const url = buildPageUrl({ origin, pageId });
   const context = await browser.newContext({ viewport: { width, height } });
+  // Inject an authenticated user so auth-protected pages don't 404 for the
+  // cookieless headless context. Mirrors the e2e user-cookie pattern; scoped to
+  // `origin` so it rides along on the same-origin /api/* fetches.
+  await context.addCookies([
+    {
+      name: HEADLESS_USER_COOKIE,
+      value: Buffer.from(JSON.stringify(headlessUser)).toString('base64'),
+      url: origin,
+    },
+  ]);
   const page = await context.newPage();
   try {
     await page.goto(url, { waitUntil: 'networkidle', timeout });

package/lib/server/auth/createSystemContext.js

@@ -0,0 +1,68 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import path from 'node:path';
+import { createSystemContext as buildSystemContext } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+import { v4 as uuid } from 'uuid';
+
+import agents from '../../../build/plugins/agents.js';
+import appMeta from '../../build/appMeta.js';
+import config from '../../build/config.js';
+import connections from '../../../build/plugins/connections.js';
+import createHandleError from '../log/createHandleError.js';
+import createLogger from '../log/createLogger.js';
+import fileCache from '../fileCache.js';
+import i18nConfig from '../../build/i18n.js';
+import loadDynamicJsMap from '../loadDynamicJsMap.js';
+import operators from '../../../build/plugins/operators/server.js';
+import steps from '../../../build/plugins/steps.js';
+import websockets from '../../../build/plugins/websockets.js';
+
+const secrets = getSecretsFromEnv();
+
+// Builds a fresh system context per auth hook fire - the trusted internal
+// caller the BetterAuth engine uses to invoke hook endpoints. All fields are
+// startup singletons except the per-fire rid, logger, handleError, the
+// dynamic jsMap re-read (JIT rebuilds rewrite serverJsMap.js), and auth -
+// auth is threaded in by the caller (createHookDispatch) rather than
+// imported directly, since it comes from the same BetterAuth construction
+// that this factory is a dependency of (see createHookDispatch.js).
+function createSystemContext({ auth } = {}) {
+  const rid = uuid();
+  const buildDirectory = path.join(process.cwd(), 'build');
+  return buildSystemContext({
+    rid,
+    agents,
+    appMeta,
+    auth,
+    buildDirectory,
+    config,
+    configDirectory: process.env.LOWDEFY_DIRECTORY_CONFIG || process.cwd(),
+    connections,
+    createHandleError,
+    fileCache,
+    i18n: i18nConfig,
+    jsMap: loadDynamicJsMap(buildDirectory),
+    logger: createLogger({ rid }),
+    operators,
+    secrets,
+    steps,
+    websockets,
+  });
+}
+
+export default createSystemContext;

package/lib/server/auth/getAuth.js

@@ -0,0 +1,46 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { getBetterAuth } from '@lowdefy/api';
+import { getSecretsFromEnv } from '@lowdefy/node-utils';
+
+import adapters from '../../../build/plugins/auth/adapters.js';
+import appMeta from '../../build/appMeta.js';
+import authJson from '../../build/auth.js';
+import createSystemContext from './createSystemContext.js';
+import lowdefyConfig from '../../build/config.js';
+import providers from '../../../build/plugins/auth/providers.js';
+
+// Returns the BetterAuth instance (memoized in @lowdefy/api), or null when
+// auth is not configured. dev: true relaxes cookies for plain-http localhost
+// and derives a per-app cookie prefix so parallel dev apps do not collide.
+function getAuth({ logger }) {
+  if (authJson.configured !== true) {
+    return null;
+  }
+  return getBetterAuth({
+    appMeta,
+    authJson,
+    config: lowdefyConfig,
+    createSystemContext,
+    dev: true,
+    logger,
+    plugins: { adapters, providers },
+    secrets: getSecretsFromEnv(),
+  });
+}
+
+export default getAuth;

package/lib/server/auth/getHeadlessSession.js

@@ -0,0 +1,39 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { HEADLESS_USER_COOKIE } from './headlessUser.js';
+
+// Mirrors the e2e user-injection pattern (server-e2e/lib/server/auth/session.js):
+// the headless renderer sets a base64-JSON user cookie on its own browser
+// context, so its /api/* fetches carry a session while the developer's real
+// browser (no cookie) is unaffected.
+function getHeadlessSession(c) {
+  const cookieHeader = c.req.header('cookie') ?? '';
+  const match = cookieHeader.match(new RegExp(`${HEADLESS_USER_COOKIE}=([^;]+)`));
+  if (!match) {
+    return undefined;
+  }
+
+  try {
+    const decoded = Buffer.from(decodeURIComponent(match[1]), 'base64').toString();
+    const user = JSON.parse(decoded);
+    return { user };
+  } catch {
+    return undefined;
+  }
+}
+
+export default getHeadlessSession;

package/lib/server/auth/{getMockSession.js → getMockUser.js}

@@ -14,13 +14,15 @@
   limitations under the License.
 */
 
-import { createSessionCallback } from '@lowdefy/api';
 import { serializer } from '@lowdefy/helpers';
 
 import authJson from '../../build/auth.js';
-import callbacks from '../../../build/plugins/auth/callbacks.js';
 
-async function getMockSession() {
+// dev.mockUser is a pre-resolved caller that substitutes for the whole
+// resolveAuthentication step - no auth engine, no session lookup, no
+// membership wall. Its roles are authoritative. LOWDEFY_DEV_USER takes
+// priority over auth.dev.mockUser from lowdefy.yaml.
+function getMockUser() {
   const mockUserJson = process.env.LOWDEFY_DEV_USER;
   let mockUser;
 
@@ -35,7 +37,7 @@ async function getMockSession() {
   }
 
   if (!mockUser) {
-    return undefined;
+    return null;
   }
 
   // Deserialize to restore arrays from ~arr markers and remove other build markers
@@ -48,20 +50,10 @@ async function getMockSession() {
     );
   }
 
-  // Create session callback to transform mock user
-  const sessionCallback = createSessionCallback({
-    authConfig: authJson,
-    plugins: { callbacks },
-  });
-
-  // Transform mock user through session callback (mock user acts as token)
-  const session = await sessionCallback({
-    session: { user: {} },
-    token: mockUser,
-    user: mockUser,
-  });
-
-  return session;
+  if (!mockUser.roles) {
+    mockUser.roles = [];
+  }
+  return mockUser;
 }
 
-export default getMockSession;
+export default getMockUser;

package/lib/server/auth/{getAuthConfig.js → getStrategies.js}

@@ -14,25 +14,27 @@
   limitations under the License.
 */
 
-import { getAuthConfig as getApiAuthConfig } from '@lowdefy/api';
+import { getAuthStrategies } from '@lowdefy/api';
 import { getSecretsFromEnv } from '@lowdefy/node-utils';
 
-import adapters from '../../../build/plugins/auth/adapters.js';
 import appMeta from '../../build/appMeta.js';
 import authJson from '../../build/auth.js';
-import callbacks from '../../../build/plugins/auth/callbacks.js';
-import events from '../../../build/plugins/auth/events.js';
-import providers from '../../../build/plugins/auth/providers.js';
+import strategyTypes from '../../../build/plugins/auth/strategies.js';
 
-function getAuthConfig({ logger }) {
-  return getApiAuthConfig({
+// Returns the API auth strategy verifiers (memoized in @lowdefy/api), or an
+// empty list when auth is not configured - resolveAuthentication tries them
+// in config order when no session resolves.
+function getStrategies({ logger }) {
+  if (authJson.configured !== true) {
+    return [];
+  }
+  return getAuthStrategies({
     appMeta,
     authJson,
-    dev: true,
     logger,
-    plugins: { adapters, callbacks, events, providers },
+    plugins: { strategies: strategyTypes },
     secrets: getSecretsFromEnv(),
   });
 }
 
-export default getAuthConfig;
+export default getStrategies;

package/lib/server/auth/headlessUser.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// Shared between the headless renderer (getBrowser.js, which sets the cookie on
+// its browser context) and the dev getSession (getHeadlessSession.js, which
+// decodes it) so the cookie name and injected user shape live in one place.
+const HEADLESS_USER_COOKIE = 'lowdefy_headless_user';
+
+const headlessUser = {
+  sub: 'lowdefy-headless',
+  id: 'lowdefy-headless',
+  name: 'Lowdefy Headless',
+  roles: [],
+};
+
+export { HEADLESS_USER_COOKIE, headlessUser };