@lowdefy/server-dev 0.0.0-experimental-20260827092002 → 0.0.0-experimental-20260827092153

package/client/App.jsx

@@ -40,7 +40,7 @@ function ThemeTokenResolver({ lowdefyRef, children }) {
   return children;
 }
 
-function App({ router }) {
+function App({ config, router }) {
   const lowdefyRef = useRef({});
   const [runtimeErrors, setRuntimeErrors] = useState([]);
   // Subscribe to rootConfig SWR cache — deduplicates with Routing's fetch.
@@ -143,7 +143,7 @@ function App({ router }) {
                   />
                 }
               >
-                <Auth>
+                <Auth user={config?.user}>
                   {(auth) => {
                     return <Routing auth={auth} lowdefy={lowdefyRef.current} router={router} />;
                   }}

package/client/Page.jsx

@@ -20,7 +20,7 @@ import Client from '@lowdefy/client';
 
 import BuildErrorPage from '../lib/client/BuildErrorPage.jsx';
 import InstallingPluginsPage from '../lib/client/InstallingPluginsPage.jsx';
-import RestartingPage from '../lib/client/RestartingPage.jsx';
+import RedirectingPage from '../lib/client/RedirectingPage.jsx';
 import usePageConfig from '../lib/client/utils/usePageConfig.js';
 
 const Page = ({
@@ -47,10 +47,22 @@ const Page = ({
     }
   }, [pageConfig?._warnings, lowdefy]);
 
+  // Full load to the sign-in page so it can return here after sign-in — an
+  // effect, not a fetcher side effect, so the redirect re-fires if the same
+  // cached result renders again.
+  useEffect(() => {
+    if (pageConfig?.authRedirect) {
+      window.location.assign(pageConfig.authRedirect);
+    }
+  }, [pageConfig?.authRedirect]);
+
   if (!pageConfig) {
     router.replace({ pathname: '/404' });
     return '';
   }
+  if (pageConfig.authRedirect) {
+    return <RedirectingPage redirect={pageConfig.authRedirect} />;
+  }
   if (pageConfig.buildError) {
     return (
       <BuildErrorPage
@@ -63,9 +75,6 @@ const Page = ({
   if (pageConfig.installing) {
     return <InstallingPluginsPage packages={pageConfig.packages} />;
   }
-  if (resetContext.restarting) {
-    return <RestartingPage />;
-  }
 
   // Merge dynamic JS entries fetched after JIT build with the static jsMap
   const mergedJsMap = pageConfig._jsEntries ? { ...jsMap, ...pageConfig._jsEntries } : jsMap;

package/client/Reload.jsx

@@ -25,6 +25,13 @@ import waitForRestartedServer from '../lib/client/utils/waitForRestartedServer.j
 const Reload = ({ children, basePath, lowdefy }) => {
   const [reset, setReset] = useState(false);
   const [restarting, setRestarting] = useState(false);
+  // reset is a one-shot boolean the engine lowers only after a page mounts
+  // (getContext.js) — while a page is suspended it stays true and setReset(true)
+  // bails out of re-rendering. The tick always changes, so every reload event
+  // re-invokes Routing's render prop, which re-reads reloadVersion and mints a
+  // fresh Suspense/SWR key — a suspended tab recovers instead of stranding on
+  // the building screen.
+  const [, setReloadTick] = useState(0);
   const mutateCache = useMutateCache(basePath);
   useEffect(() => {
     const sse = new EventSource(`${basePath}/api/reload`);
@@ -38,6 +45,7 @@ const Reload = ({ children, basePath, lowdefy }) => {
           lowdefy._internal.initialised = false;
         }
         setReset(true);
+        setReloadTick((tick) => tick + 1);
         console.log('Reloaded config.');
       }, 600);
     });

package/client/Routing.jsx

@@ -20,6 +20,7 @@ import Head from '@lowdefy/client/adapters/Head.js';
 import createLinkComponent from '@lowdefy/client/adapters/Link.js';
 
 import BuildingPage from '../lib/client/BuildingPage.jsx';
+import RestartingPage from '../lib/client/RestartingPage.jsx';
 import FeedbackMount from './feedback/FeedbackMount.jsx';
 import Inspector from './Inspector.jsx';
 import OpenInEditorListener from './openInEditor/OpenInEditorListener.jsx';
@@ -75,29 +76,36 @@ function Routing({ auth, lowdefy, router }) {
       <FeedbackMount basePath={router.basePath} lowdefy={lowdefy} pageId={pageId} />
       <OpenInEditorListener basePath={router.basePath} pageId={pageId} />
       <Reload basePath={router.basePath} lowdefy={lowdefy}>
-        {(resetContext) => (
-          <Suspense key={`${pageId}_${getReloadVersion()}`} fallback={<BuildingPage />}>
-            <Page
-              auth={auth}
-              Components={{ Head, Link }}
-              config={{
-                rootConfig,
-              }}
-              jsMap={staticJsMap}
-              lowdefy={lowdefy}
-              pageId={pageId}
-              resetContext={resetContext}
-              router={router}
-              types={{
-                actions,
-                blockMetas,
-                blocks,
-                icons,
-                operators,
-              }}
-            />
-          </Suspense>
-        )}
+        {(resetContext) =>
+          // Rendered here, not in Page — Page sits below the Suspense boundary
+          // and cannot render anything while its config fetch is suspended, so
+          // a restarting server would present as "Building page..." forever.
+          resetContext.restarting ? (
+            <RestartingPage />
+          ) : (
+            <Suspense key={`${pageId}_${getReloadVersion()}`} fallback={<BuildingPage />}>
+              <Page
+                auth={auth}
+                Components={{ Head, Link }}
+                config={{
+                  rootConfig,
+                }}
+                jsMap={staticJsMap}
+                lowdefy={lowdefy}
+                pageId={pageId}
+                resetContext={resetContext}
+                router={router}
+                types={{
+                  actions,
+                  blockMetas,
+                  blocks,
+                  icons,
+                  operators,
+                }}
+              />
+            </Suspense>
+          )
+        }
       </Reload>
     </>
   );

package/lib/client/RedirectingPage.jsx

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import React from 'react';
+
+// Shown while the 401 sign-in redirect navigates. The link is the escape
+// hatch for a dropped navigation - the tab must never depend on a single
+// window.location.assign to leave this screen.
+const RedirectingPage = ({ redirect }) => {
+  return (
+    <div
+      style={{
+        height: '100vh',
+        textAlign: 'center',
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        justifyContent: 'center',
+        backgroundColor: 'var(--ant-color-bg-layout)',
+        color: 'var(--ant-color-text)',
+        fontFamily:
+          "system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif",
+      }}
+    >
+      <div
+        style={{
+          verticalAlign: 'middle',
+          display: 'inline-block',
+        }}
+      >
+        <h3>Redirecting to sign-in...</h3>
+        <p>
+          <a href={redirect} style={{ color: 'var(--ant-color-primary)' }}>
+            Continue to sign-in
+          </a>{' '}
+          if you are not redirected automatically.
+        </p>
+      </div>
+    </div>
+  );
+};
+
+export default RedirectingPage;

package/lib/client/auth/Auth.jsx

@@ -14,8 +14,6 @@
   limitations under the License.
 */
 
-/* eslint-disable react/jsx-props-no-spreading */
-
 import React from 'react';
 import AuthConfigured from './AuthConfigured.jsx';
 import AuthNotConfigured from './AuthNotConfigured.js';
@@ -25,15 +23,15 @@ import { serializer } from '@lowdefy/helpers';
 // Client code imports the build JSON directly — Vite handles JSON imports;
 // the lib/build/*.js wrappers are server-only (they read from disk).
 // Deserialize to restore arrays from their ~arr build markers (providers
-// must be a real array for single-provider inference in createAuthMethods).
+// must be a real array for provider lookups in createAuthMethods).
 import rawAuthConfig from '../../../build/auth.json';
 
 const authConfig = serializer.deserialize(rawAuthConfig);
 
-function Auth({ children, session }) {
+function Auth({ children, user }) {
   if (authConfig.configured === true) {
     return (
-      <AuthConfigured serverSession={session} authConfig={authConfig}>
+      <AuthConfigured serverUser={user} authConfig={authConfig}>
         {(auth) => children(auth)}
       </AuthConfigured>
     );

package/lib/client/auth/AuthConfigured.jsx

@@ -14,60 +14,213 @@
   limitations under the License.
 */
 
-/* eslint-disable react/jsx-props-no-spreading */
-
-import React, { useEffect, useRef } from 'react';
+import React, { useEffect, useRef, useState } from 'react';
+import { createAuthClient } from 'better-auth/react';
 import {
-  authConfigManager,
-  getSession,
-  SessionProvider,
-  signIn,
-  signOut,
-  useSession,
-} from '@hono/auth-js/react';
+  adminClient,
+  magicLinkClient,
+  organizationClient,
+  phoneNumberClient,
+  twoFactorClient,
+} from 'better-auth/client/plugins';
+import { oauthProviderClient } from '@better-auth/oauth-provider/client';
+import { passkeyClient } from '@better-auth/passkey/client';
 
-import { serializer } from '@lowdefy/helpers';
+import { normalizeCaller, serializer } from '@lowdefy/helpers';
 
 import rawLowdefyConfig from '../../../build/config.json';
 
 const lowdefyConfig = serializer.deserialize(rawLowdefyConfig);
 
-// @hono/auth-js/react configures its fetch paths through a module-level
-// manager instead of SessionProvider props.
-if (lowdefyConfig.basePath) {
-  authConfigManager.setConfig({ basePath: `${lowdefyConfig.basePath}/api/auth` });
-}
+// GenericOAuth providers have no client plugin here. BetterAuth 1.7.0 dropped
+// genericOAuthClient from better-auth/client/plugins, and nothing replaces it:
+// through 1.6.x it was a marker plugin carrying only an id, a version, an empty
+// $InferServerPlugin for TypeScript inference, and the generic-oauth error
+// codes - no actions, atoms, fetch plugins or path methods. signIn.oauth2 is
+// resolved by the client's dynamic path proxy from the call itself
+// (signIn.oauth2 -> POST /sign-in/oauth2, POST because providerId is always
+// sent), so the sign-in a Lowdefy GenericOAuth provider makes is unaffected.
+const authClient = createAuthClient({
+  baseURL: `${window.location.origin}${lowdefyConfig.basePath ?? ''}/api/auth`,
+  plugins: [
+    adminClient(),
+    magicLinkClient(),
+    oauthProviderClient(),
+    organizationClient(),
+    passkeyClient(),
+    phoneNumberClient(),
+    twoFactorClient(),
+  ],
+});
 
-function Session({ children }) {
-  const wasAuthenticated = useRef(false);
-  const { data: session, status } = useSession();
-  wasAuthenticated.current = wasAuthenticated.current || status === 'authenticated';
+// UpdateSession owns session freshness - suppress BetterAuth's own
+// signal-driven refetch on the calls that would otherwise fire one, so
+// nothing competes with (and aborts) the refetch UpdateSession awaits.
+// Only calls that mutate an existing session are suppressed - calls that
+// can establish one (the sign-ins, and the two-factor, phone-number and
+// passkey verifies) keep their signal: its refetch is what makes the store
+// notice a login when no navigation follows.
+// disableSignal silences all atomListeners for the call, including the
+// organization plugin's org atoms - none are exposed to app config, so a
+// future design exposing one must refresh it through its own action.
+const sessionScoped = (params) => ({
+  ...params,
+  fetchOptions: { ...params?.fetchOptions, disableSignal: true },
+});
+
+// The server resolves the caller per request and embeds it in the page
+// config, so the first render never flashes unauthenticated. The BetterAuth
+// client store takes over once its session fetch settles.
+//
+// Roles and merged attributes resolve server-side from the active member row
+// - the base session carries neither. The last server-resolved caller is
+// held in state: while the session user is unchanged it stays authoritative
+// for the fields the session does not carry, and UpdateSession refreshes it
+// from /api/user after a change (e.g. SetActiveOrganization). Holding it in
+// state, not a ref, re-renders Session when it changes so _user recomputes -
+// the same reactive footing the session half already stands on.
+//
+// Only the session half is passed through normalizeCaller. BetterAuth's store
+// returns camelCase keys whatever the columns are named, so untransformed it
+// would sit emailVerified beside the resolved caller's email_verified on one
+// object; anything arriving from the server is already snake_case.
+function Session({ children, reloadSuppressedRef, serverUser }) {
+  const { data: session, isPending } = authClient.useSession();
+  const [resolvedUser, setResolvedUser] = useState(serverUser);
+  const wasAuthenticated = useRef(Boolean(serverUser));
 
   useEffect(() => {
-    if (wasAuthenticated.current && status === 'unauthenticated') {
+    if (session) {
+      wasAuthenticated.current = true;
+    }
+    // Reload after sign-out (or session revocation) so the server can apply
+    // the page auth fork - a protected page redirects to the login page.
+    // A logout with a callbackUrl suppresses the reload - its own navigation
+    // would otherwise race this one.
+    if (wasAuthenticated.current && !isPending && !session && !reloadSuppressedRef.current) {
       window.location.reload();
     }
-  }, [status]);
+  }, [session, isPending]);
 
-  // If session is passed to SessionProvider from the server-rendered config
-  // we won't have a loading state here, but unauthenticated first loads do.
-  if (status === 'loading') {
-    return '';
+  if (isPending) {
+    return children(resolvedUser, setResolvedUser);
+  }
+  if (!session?.user) {
+    return children(null, setResolvedUser);
+  }
+  const resolved = resolvedUser;
+  if (!resolved) {
+    return children({ roles: [], ...normalizeCaller(session.user) }, setResolvedUser);
+  }
+  if (resolved.id !== session.user.id) {
+    // The ref has not caught up with a changed session user - a sign-in as a
+    // different person lands between the session refetch and the /api/user
+    // result. Render the last resolved caller whole rather than mixing the new
+    // session user with the previous person's resolved fields, or falling back
+    // to a caller with no roles - blocks re-evaluate operators on render, so a
+    // role-guarded page would act on an empty role list. UpdateSession closes
+    // the window when it lands the new caller; a flow that changes the session
+    // user without chaining it leaves the previous caller rendered until the
+    // next page load.
+    return children(resolved, setResolvedUser);
   }
-  return children(session);
+  // _user is one object with one meaning on both sides: the resolved caller is
+  // spread whole, so every field resolveAuthentication emits is readable in app
+  // config without this file naming it. session.user is the floor - the client
+  // store may hold a fresher one than the resolved state, and the resolved
+  // object wins wherever both carry a key.
+  const user = { ...normalizeCaller(session.user), ...resolved };
+  return children(user, setResolvedUser);
 }
 
-function AuthConfigured({ authConfig, children, serverSession }) {
-  const auth = { authConfig, getSession, signIn, signOut };
+function AuthConfigured({ authConfig, children, serverUser }) {
+  const reloadSuppressedRef = useRef(false);
+  const auth = {
+    authConfig,
+    getSession: ({ disableCookieCache } = {}) =>
+      authClient.getSession(disableCookieCache ? { query: { disableCookieCache: true } } : {}),
+    // Refetches the session through the session atom - the store's only
+    // writer - and resolves only after the store is written. fetchSession
+    // returns undefined and never rejects (failures are written into the
+    // atom), so the atom's own { data, error } is read back and returned,
+    // keeping unwrap working and surfacing a failed refresh to the action.
+    refreshSession: async ({ disableCookieCache } = {}) => {
+      const sessionAtom = authClient.$store.atoms.session;
+      await sessionAtom
+        .get()
+        .refetch(disableCookieCache ? { query: { disableCookieCache: true } } : undefined);
+      const { data, error } = sessionAtom.get();
+      return { data, error };
+    },
+    // The server-resolved caller - roles from the active member row and the
+    // merged attributes bag - for re-syncing after session changes.
+    getResolvedUser: async () => {
+      const response = await fetch(`${lowdefyConfig.basePath ?? ''}/api/user`, {
+        credentials: 'same-origin',
+      });
+      if (!response.ok) {
+        // /api/user itself always answers 200 { user } - user: null when no
+        // caller is admitted, which updateSession branches on. A non-OK
+        // response is a transport failure (gateway error page, 5xx) with no
+        // parsable body.
+        throw new Error(`Failed to fetch the resolved user (HTTP ${response.status}).`);
+      }
+      return response.json();
+    },
+    suppressSignOutReload: () => {
+      reloadSuppressedRef.current = true;
+    },
+    acceptInvitation: (params) => authClient.organization.acceptInvitation(sessionScoped(params)),
+    // addPasskey runs the WebAuthn browser ceremony itself - options fetch,
+    // authenticator prompt, verification.
+    addPasskey: (params) => authClient.passkey.addPasskey(params),
+    changePassword: (params) => authClient.changePassword(sessionScoped(params)),
+    deletePasskey: (params) => authClient.passkey.deletePasskey(params),
+    updatePasskey: (params) => authClient.passkey.updatePasskey(params),
+    leaveOrganization: (params) => authClient.organization.leave(sessionScoped(params)),
+    // The caller's memberships from the org plugin, keyed on the session
+    // alone - not the active organization. sessionScoped so the list read
+    // does not also fire the org-list atom's own refetch of the same route.
+    listOrganizations: () => authClient.organization.list(sessionScoped()),
+    // POST /oauth2/consent. The signed authorization query is not passed
+    // here - the oauthProviderClient fetch plugin stamps it onto the body as
+    // oauth_query from window.location.search, so the call must run while
+    // the page still holds the query the oauth-provider redirect arrived
+    // with.
+    oauth2Consent: (params) => authClient.oauth2.consent(params),
+    phoneNumberRequestPasswordReset: (params) =>
+      authClient.phoneNumber.requestPasswordReset(params),
+    phoneNumberResetPassword: (params) => authClient.phoneNumber.resetPassword(params),
+    phoneNumberSendOtp: (params) => authClient.phoneNumber.sendOtp(params),
+    phoneNumberVerify: (params) => authClient.phoneNumber.verify(params),
+    requestPasswordReset: (params) => authClient.requestPasswordReset(params),
+    resetPassword: (params) => authClient.resetPassword(params),
+    revokeOtherSessions: () => authClient.revokeOtherSessions(sessionScoped()),
+    sendVerificationEmail: (params) => authClient.sendVerificationEmail(params),
+    setActiveOrganization: (params) => authClient.organization.setActive(sessionScoped(params)),
+    signInEmail: (params) => authClient.signIn.email(params),
+    signInMagicLink: (params) => authClient.signIn.magicLink(params),
+    signInOauth2: (params) => authClient.signIn.oauth2(params),
+    signInPasskey: (params) => authClient.signIn.passkey(params),
+    signInPhoneNumber: (params) => authClient.signIn.phoneNumber(params),
+    signInSocial: (params) => authClient.signIn.social(params),
+    signOut: () => authClient.signOut(),
+    signUpEmail: (params) => authClient.signUp.email(params),
+    twoFactorDisable: (params) => authClient.twoFactor.disable(sessionScoped(params)),
+    twoFactorEnable: (params) => authClient.twoFactor.enable(sessionScoped(params)),
+    twoFactorGenerateBackupCodes: (params) =>
+      authClient.twoFactor.generateBackupCodes(sessionScoped(params)),
+    twoFactorVerifyBackupCode: (params) => authClient.twoFactor.verifyBackupCode(params),
+    twoFactorVerifyTotp: (params) => authClient.twoFactor.verifyTotp(params),
+  };
   return (
-    <SessionProvider session={serverSession}>
-      <Session>
-        {(session) => {
-          auth.session = session;
-          return children(auth);
-        }}
-      </Session>
-    </SessionProvider>
+    <Session reloadSuppressedRef={reloadSuppressedRef} serverUser={serverUser}>
+      {(user, setResolvedUser) => {
+        auth.user = user;
+        auth.updateResolvedUser = (resolved) => setResolvedUser(resolved);
+        return children(auth);
+      }}
+    </Session>
   );
 }
 

package/lib/client/auth/AuthNotConfigured.js

@@ -13,7 +13,6 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */
-/* eslint-disable react/jsx-props-no-spreading */
 
 function authNotConfigured() {
   throw new Error('Auth not configured.');
@@ -22,9 +21,31 @@ function authNotConfigured() {
 function AuthNotConfigured({ authConfig, children }) {
   const auth = {
     authConfig,
+    user: null,
+    acceptInvitation: authNotConfigured,
+    addPasskey: authNotConfigured,
+    changePassword: authNotConfigured,
+    deletePasskey: authNotConfigured,
+    updatePasskey: authNotConfigured,
+    getResolvedUser: authNotConfigured,
     getSession: authNotConfigured,
-    signIn: authNotConfigured,
+    leaveOrganization: authNotConfigured,
+    requestPasswordReset: authNotConfigured,
+    resetPassword: authNotConfigured,
+    revokeOtherSessions: authNotConfigured,
+    sendVerificationEmail: authNotConfigured,
+    setActiveOrganization: authNotConfigured,
+    signInEmail: authNotConfigured,
+    signInMagicLink: authNotConfigured,
+    signInOauth2: authNotConfigured,
+    signInSocial: authNotConfigured,
     signOut: authNotConfigured,
+    signUpEmail: authNotConfigured,
+    twoFactorDisable: authNotConfigured,
+    twoFactorEnable: authNotConfigured,
+    twoFactorGenerateBackupCodes: authNotConfigured,
+    twoFactorVerifyBackupCode: authNotConfigured,
+    twoFactorVerifyTotp: authNotConfigured,
   };
 
   return children(auth);

package/lib/client/auth/authTemplateSync.test.mjs

@@ -0,0 +1,40 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const devAuthDir = path.dirname(fileURLToPath(import.meta.url));
+const prodAuthDir = path.resolve(devAuthDir, '../../../../server/lib/client/auth');
+
+// The dev and prod server templates each carry their own copy of the auth
+// components, kept in sync by hand. A change applied to one and not the
+// other ships dev-only or prod-only - the app then behaves differently
+// between lowdefy dev and a production build, which no unit test of either
+// copy can catch.
+test('the auth client templates are byte-identical between server and server-dev', async () => {
+  const isTemplate = (file) => !file.includes('.test.');
+  const devFiles = (await readdir(devAuthDir)).filter(isTemplate).sort();
+  const prodFiles = (await readdir(prodAuthDir)).filter(isTemplate).sort();
+  expect(prodFiles).toEqual(devFiles);
+  for (const file of devFiles) {
+    const dev = await readFile(path.join(devAuthDir, file), 'utf8');
+    const prod = await readFile(path.join(prodAuthDir, file), 'utf8');
+    // Compared per file so a failure names the file that diverged.
+    expect({ file, content: prod }).toEqual({ file, content: dev });
+  }
+});