@lukoweb/apitogo 0.1.53 → 0.1.54

package/dist/cli/cli.js

@@ -393,6 +393,7 @@ function normalizeApitogoConfig(config2) {
   delete normalized.projectName;
   migratePlanCatalog(normalized);
   syncBillingEnabled(normalized);
+  syncAuthentication(normalized);
   return normalized;
 }
 function isBillingEnabled(config2) {
@@ -402,6 +403,63 @@ function isBillingEnabled(config2) {
   );
   return plans?.enabled === true;
 }
+function isUserPanelEnabled(normalized) {
+  const modules = asRecord(normalized.modules);
+  const userPanel = asRecord(modules?.userPanel);
+  if (userPanel?.enabled === true) {
+    return true;
+  }
+  const dashboard = asRecord(userPanel?.dashboard);
+  const userManagement = asRecord(userPanel?.userManagement);
+  const apiKeys = asRecord(userPanel?.apiKeys);
+  const plans = asRecord(userPanel?.plans);
+  return dashboard?.enabled === true || userManagement?.enabled === true || apiKeys?.enabled === true || plans?.enabled === true;
+}
+function syncAuthentication(normalized) {
+  const userPanelEnabled = isUserPanelEnabled(normalized);
+  const authentication = asRecord(normalized.authentication);
+  if (!userPanelEnabled && !authentication) {
+    return;
+  }
+  const auth = authentication ?? {};
+  auth.enabled = userPanelEnabled;
+  auth.type = "dev-portal";
+  if (userPanelEnabled) {
+    const native = asRecord(auth.native) ?? {};
+    if (native.enabled === void 0) {
+      native.enabled = true;
+    }
+    auth.native = native;
+    if (!Array.isArray(auth.providers)) {
+      auth.providers = [];
+    }
+  }
+  normalized.authentication = auth;
+}
+function stripAuthenticationSecrets(authentication) {
+  const {
+    gateway: _gateway,
+    oidc: _oidc,
+    stripe: _stripe,
+    type: _type,
+    email,
+    providers,
+    ...authPublic
+  } = authentication;
+  const emailRecord = asRecord(email);
+  if (emailRecord) {
+    const { connectionString: _connectionString, ...emailPublic } = emailRecord;
+    authPublic.email = emailPublic;
+  }
+  if (Array.isArray(providers)) {
+    authPublic.providers = providers.map((entry) => {
+      const provider = asRecord(entry) ?? {};
+      const { clientSecret: _clientSecret, ...providerPublic } = provider;
+      return providerPublic;
+    });
+  }
+  return authPublic;
+}
 function syncBillingEnabled(normalized) {
   const legacyPricing = asRecord(normalized.pricing);
   const modules = ensureModules(normalized);
@@ -430,13 +488,7 @@ function deriveManifestFields(config2) {
     if (key === "authentication") {
       const authentication2 = asRecord(normalized.authentication);
       if (authentication2) {
-        const {
-          gateway: _gateway,
-          oidc: _oidc,
-          stripe: _stripe,
-          ...authPublic
-        } = authentication2;
-        manifest.authentication = authPublic;
+        manifest.authentication = stripAuthenticationSecrets(authentication2);
       }
       continue;
     }
@@ -640,8 +692,23 @@ var init_local_manifest = __esm({
       }).optional(),
       authentication: z3.object({
         enabled: z3.boolean().optional(),
-        type: z3.string().optional(),
-        apiBaseUrl: z3.string().optional()
+        apiBaseUrl: z3.string().optional(),
+        native: z3.object({
+          enabled: z3.boolean().optional()
+        }).optional(),
+        email: z3.object({
+          provider: z3.string().optional(),
+          from: z3.string().optional()
+        }).optional(),
+        providers: z3.array(
+          z3.object({
+            id: z3.string().min(1),
+            displayName: z3.string().optional(),
+            authority: z3.string().optional(),
+            clientId: z3.string().optional(),
+            scopes: z3.string().optional()
+          })
+        ).optional()
       }).optional(),
       plans: z3.array(ManifestPlanInputSchema).optional(),
       backend: z3.object({
@@ -4094,8 +4161,26 @@ var init_ZudokuConfig = __esm({
         redirectToAfterSignOut: z9.string().optional()
       }),
       z9.object({
-        type: z9.literal("dev-portal"),
+        type: z9.literal("dev-portal").optional().default("dev-portal"),
         apiBaseUrl: z9.string().optional(),
+        native: z9.object({
+          enabled: z9.boolean().optional()
+        }).optional(),
+        email: z9.object({
+          provider: z9.string().optional(),
+          from: z9.string().optional(),
+          connectionString: z9.string().optional()
+        }).optional(),
+        providers: z9.array(
+          z9.object({
+            id: z9.string().min(1),
+            displayName: z9.string().optional(),
+            authority: z9.string().optional(),
+            clientId: z9.string().optional(),
+            clientSecret: z9.string().optional(),
+            scopes: z9.string().optional()
+          })
+        ).optional(),
         redirectToAfterSignUp: z9.string().optional(),
         redirectToAfterSignIn: z9.string().optional(),
         redirectToAfterSignOut: z9.string().optional()
@@ -4716,7 +4801,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.1.53",
+  version: "0.1.54",
   type: "module",
   sideEffects: [
     "**/*.css",

package/dist/declarations/config/apitogo-config-core.d.ts

@@ -1,11 +1,19 @@
 export declare const APITOGO_CONFIG_FILENAME = "apitogo.config.json";
 export type ApitogoJsonConfig = Record<string, unknown>;
+export type AuthProviderPublicConfig = {
+    id: string;
+    displayName?: string;
+    authority?: string;
+    clientId?: string;
+    scopes?: string;
+};
 export type AuthenticationSecrets = {
-    oidc?: {
-        authority?: string;
-        clientId?: string;
-        clientSecret?: string;
+    email?: {
+        connectionString?: string;
     };
+    providers?: Record<string, {
+        clientSecret?: string;
+    }>;
     stripe?: {
         secretKey?: string;
         webhookSecret?: string;
@@ -18,6 +26,8 @@ type PlanCatalogItem = Record<string, unknown> & {
 export declare function readPlanCatalogItems(config: ApitogoJsonConfig): PlanCatalogItem[];
 export declare function normalizeApitogoConfig(config: ApitogoJsonConfig): ApitogoJsonConfig;
 export declare function isBillingEnabled(config: ApitogoJsonConfig): boolean;
+export declare function readAuthProviders(config: ApitogoJsonConfig): AuthProviderPublicConfig[];
+export declare function isNativeAuthEnabled(config: ApitogoJsonConfig): boolean;
 export declare function deriveManifestFields(config: ApitogoJsonConfig): ApitogoJsonConfig;
 export declare function extractManifest(config: ApitogoJsonConfig | null | undefined): ApitogoJsonConfig | null;
 export declare function extractSiteConfig(config: ApitogoJsonConfig | null | undefined): ApitogoJsonConfig;

package/dist/declarations/config/local-manifest.d.ts

@@ -35,8 +35,21 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
     }, z.core.$strip>>;
     authentication: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
-        type: z.ZodOptional<z.ZodString>;
         apiBaseUrl: z.ZodOptional<z.ZodString>;
+        native: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        email: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodOptional<z.ZodString>;
+            from: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        providers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            displayName: z.ZodOptional<z.ZodString>;
+            authority: z.ZodOptional<z.ZodString>;
+            clientId: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>>;
     plans: z.ZodOptional<z.ZodArray<z.ZodObject<{
         sku: z.ZodString;
@@ -91,6 +104,7 @@ export type DevPortalPreviewPlanCatalog = {
 };
 export declare function isPricingEnabled(manifest: DevPortalLocalManifest | null | undefined): boolean;
 export declare function isAuthenticationEnabled(manifest: DevPortalLocalManifest | null | undefined): boolean;
+export declare function isNativeAuthEnabledInManifest(manifest: DevPortalLocalManifest | null | undefined): boolean;
 export declare function manifestToPreviewCatalog(manifest: DevPortalLocalManifest | null | undefined): DevPortalPreviewPlanCatalog;
 export declare function normalizeBillingPeriod(period?: string): string;
 export declare function plansToPreviewCatalog(plans: ManifestPlanInput[] | undefined): Pick<DevPortalPreviewPlanCatalog, "plans">;

package/dist/declarations/config/validators/ZudokuConfig.d.ts

@@ -367,8 +367,24 @@ declare const AuthenticationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
     redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"dev-portal">;
+    type: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"dev-portal">>>;
     apiBaseUrl: z.ZodOptional<z.ZodString>;
+    native: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    email: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodOptional<z.ZodString>;
+        from: z.ZodOptional<z.ZodString>;
+        connectionString: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    providers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
+        authority: z.ZodOptional<z.ZodString>;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
     redirectToAfterSignUp: z.ZodOptional<z.ZodString>;
     redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
     redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
@@ -6771,8 +6787,24 @@ export declare const ZudokuConfig: z.ZodObject<{
         redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
         redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
-        type: z.ZodLiteral<"dev-portal">;
+        type: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"dev-portal">>>;
         apiBaseUrl: z.ZodOptional<z.ZodString>;
+        native: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        email: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodOptional<z.ZodString>;
+            from: z.ZodOptional<z.ZodString>;
+            connectionString: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        providers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            displayName: z.ZodOptional<z.ZodString>;
+            authority: z.ZodOptional<z.ZodString>;
+            clientId: z.ZodOptional<z.ZodString>;
+            clientSecret: z.ZodOptional<z.ZodString>;
+            scopes: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
         redirectToAfterSignUp: z.ZodOptional<z.ZodString>;
         redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
         redirectToAfterSignOut: z.ZodOptional<z.ZodString>;

package/dist/declarations/lib/authentication/providers/dev-portal-auth-pages.d.ts

@@ -0,0 +1,15 @@
+export declare function DevPortalLoginPage({ apiBaseUrl, }: {
+    apiBaseUrl?: string;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function DevPortalRegisterPage({ apiBaseUrl, }: {
+    apiBaseUrl?: string;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function DevPortalVerifyEmailPage({ apiBaseUrl }: {
+    apiBaseUrl?: string;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function DevPortalForgotPasswordPage({ apiBaseUrl }: {
+    apiBaseUrl?: string;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function DevPortalResetPasswordPage({ apiBaseUrl }: {
+    apiBaseUrl?: string;
+}): import("react/jsx-runtime").JSX.Element;

package/dist/declarations/lib/authentication/providers/dev-portal-constants.d.ts

@@ -14,5 +14,23 @@ export type EndUserMeResponse = {
 };
 export type DevPortalAuthStatusResponse = {
     available: boolean;
-    oidcConfigured: boolean;
+    nativeEnabled?: boolean;
+    oidcConfigured?: boolean;
+    providerCount?: number;
+};
+export type DevPortalAuthConfigResponse = {
+    native: {
+        enabled: boolean;
+    };
+    email?: {
+        provider: string;
+        from: string;
+    } | null;
+    providers: Array<{
+        id: string;
+        displayName: string;
+        authority: string;
+        clientId: string;
+        scopes: string[];
+    }>;
 };

package/dist/declarations/lib/authentication/providers/dev-portal-utils.d.ts

@@ -3,7 +3,11 @@ import { type EndUserMeResponse } from "./dev-portal-constants.js";
 export declare function resolveDevPortalApiBaseUrl(config: Pick<DevPortalAuthenticationConfig, "apiBaseUrl">): string | undefined;
 export declare function isPlaceholderDevPortalApiUrl(apiBaseUrl: string | undefined): boolean;
 export declare function toAbsoluteReturnUrl(pathOrUrl: string): string;
-export declare function buildDevPortalLoginUrl(apiBaseUrl: string, returnUrl: string): string;
+export declare function buildDevPortalOidcChallengeUrl(apiBaseUrl: string, providerId: string, returnUrl: string): string;
 export declare function buildDevPortalLogoutUrl(apiBaseUrl: string, returnUrl: string): string;
+export declare function normalizeDevPortalAuthConfig(raw: unknown): import("./dev-portal-constants.js").DevPortalAuthConfigResponse;
+export declare function isNativeAuthEnabled(config: import("./dev-portal-constants.js").DevPortalAuthConfigResponse | null | undefined): boolean;
+export declare function fetchDevPortalAuthConfig(apiBaseUrl: string, fetchImpl?: typeof fetch): Promise<import("./dev-portal-constants.js").DevPortalAuthConfigResponse>;
+export declare function postDevPortalAuth<T>(apiBaseUrl: string, path: string, body: unknown, fetchImpl?: typeof fetch): Promise<T>;
 export declare function probeDevPortalBackend(apiBaseUrl: string, fetchImpl?: typeof fetch): Promise<boolean>;
 export declare function mapEndUserMeToProfile(me: EndUserMeResponse): import("../state.js").UserProfile;

package/dist/declarations/lib/authentication/providers/dev-portal.d.ts

@@ -21,7 +21,12 @@ export declare class DevPortalAuthenticationProvider extends CoreAuthenticationP
     private backendAvailable;
     private refreshGeneration;
     private refreshInFlight;
+    private authConfigNativeEnabled;
     constructor({ apiBaseUrl, redirectToAfterSignIn, redirectToAfterSignUp, redirectToAfterSignOut, }: DevPortalAuthenticationConfig);
+    getRoutes(): {
+        path: string;
+        element: import("react/jsx-runtime").JSX.Element;
+    }[];
     initialize(_context: ZudokuContext): Promise<void>;
     onPageLoad: () => Promise<void>;
     private syncBackendAvailability;

package/dist/flat-config.d.ts

@@ -319,8 +319,24 @@ export interface FlatZudokuConfig {
     redirectToAfterSignIn?: string
     redirectToAfterSignOut?: string
   } | {
-    type: "dev-portal"
+    type?: "dev-portal"
     apiBaseUrl?: string
+    native?: {
+      enabled?: boolean
+    }
+    email?: {
+      provider?: string
+      from?: string
+      connectionString?: string
+    }
+    providers?: {
+      id: string
+      displayName?: string
+      authority?: string
+      clientId?: string
+      clientSecret?: string
+      scopes?: string
+    }[]
     redirectToAfterSignUp?: string
     redirectToAfterSignIn?: string
     redirectToAfterSignOut?: string

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.53",
+  "version": "0.1.54",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/config/apitogo-config-core.ts

@@ -34,12 +34,20 @@ const SITE_CONFIG_KEYS = [
 
 export type ApitogoJsonConfig = Record<string, unknown>;
 
+export type AuthProviderPublicConfig = {
+  id: string;
+  displayName?: string;
+  authority?: string;
+  clientId?: string;
+  scopes?: string;
+};
+
 export type AuthenticationSecrets = {
-  oidc?: {
-    authority?: string;
-    clientId?: string;
-    clientSecret?: string;
+  email?: {
+    connectionString?: string;
   };
+  /** Provider secrets keyed by provider `id` (from env: `authentication__providers__{id}__clientSecret`). */
+  providers?: Record<string, { clientSecret?: string }>;
   stripe?: {
     secretKey?: string;
     webhookSecret?: string;
@@ -351,6 +359,7 @@ export function normalizeApitogoConfig(
 
   migratePlanCatalog(normalized);
   syncBillingEnabled(normalized);
+  syncAuthentication(normalized);
 
   return normalized;
 }
@@ -364,6 +373,119 @@ export function isBillingEnabled(config: ApitogoJsonConfig): boolean {
   return plans?.enabled === true;
 }
 
+function isUserPanelEnabled(normalized: ApitogoJsonConfig): boolean {
+  const modules = asRecord(normalized.modules);
+  const userPanel = asRecord(modules?.userPanel);
+  if (userPanel?.enabled === true) {
+    return true;
+  }
+
+  const dashboard = asRecord(userPanel?.dashboard);
+  const userManagement = asRecord(userPanel?.userManagement);
+  const apiKeys = asRecord(userPanel?.apiKeys);
+  const plans = asRecord(userPanel?.plans);
+
+  return (
+    dashboard?.enabled === true ||
+    userManagement?.enabled === true ||
+    apiKeys?.enabled === true ||
+    plans?.enabled === true
+  );
+}
+
+/** Read public OIDC provider entries from `authentication.providers` array. */
+export function readAuthProviders(
+  config: ApitogoJsonConfig,
+): AuthProviderPublicConfig[] {
+  const normalized = normalizeApitogoConfig(config);
+  const authentication = asRecord(normalized.authentication);
+  const providers = authentication?.providers;
+  if (!Array.isArray(providers)) {
+    return [];
+  }
+
+  return providers
+    .map((entry) => asRecord(entry))
+    .filter((entry): entry is Record<string, unknown> => entry !== undefined)
+    .filter((entry) => typeof entry.id === "string" && entry.id.trim())
+    .map((entry) => ({
+      id: String(entry.id).trim(),
+      displayName:
+        typeof entry.displayName === "string" ? entry.displayName : undefined,
+      authority:
+        typeof entry.authority === "string" ? entry.authority : undefined,
+      clientId: typeof entry.clientId === "string" ? entry.clientId : undefined,
+      scopes: typeof entry.scopes === "string" ? entry.scopes : undefined,
+    }));
+}
+
+export function isNativeAuthEnabled(config: ApitogoJsonConfig): boolean {
+  const normalized = normalizeApitogoConfig(config);
+  if (!isUserPanelEnabled(normalized)) {
+    return false;
+  }
+
+  const native = asRecord(asRecord(normalized.authentication)?.native);
+  return native?.enabled !== false;
+}
+
+function syncAuthentication(normalized: ApitogoJsonConfig): void {
+  const userPanelEnabled = isUserPanelEnabled(normalized);
+  const authentication = asRecord(normalized.authentication);
+
+  if (!userPanelEnabled && !authentication) {
+    return;
+  }
+
+  const auth = authentication ?? {};
+  auth.enabled = userPanelEnabled;
+  auth.type = "dev-portal";
+
+  if (userPanelEnabled) {
+    const native = asRecord(auth.native) ?? {};
+    if (native.enabled === undefined) {
+      native.enabled = true;
+    }
+    auth.native = native;
+
+    if (!Array.isArray(auth.providers)) {
+      auth.providers = [];
+    }
+  }
+
+  normalized.authentication = auth;
+}
+
+function stripAuthenticationSecrets(
+  authentication: Record<string, unknown>,
+): Record<string, unknown> {
+  const {
+    gateway: _gateway,
+    oidc: _oidc,
+    stripe: _stripe,
+    type: _type,
+    email,
+    providers,
+    ...authPublic
+  } = authentication;
+
+  const emailRecord = asRecord(email);
+  if (emailRecord) {
+    const { connectionString: _connectionString, ...emailPublic } = emailRecord;
+    authPublic.email = emailPublic;
+  }
+
+  if (Array.isArray(providers)) {
+    authPublic.providers = providers.map((entry) => {
+      const provider = asRecord(entry) ?? {};
+      const { clientSecret: _clientSecret, ...providerPublic } = provider;
+      return providerPublic;
+    });
+  }
+
+  return authPublic;
+}
+
 function syncBillingEnabled(normalized: ApitogoJsonConfig): void {
   const legacyPricing = asRecord(normalized.pricing);
   const modules = ensureModules(normalized);
@@ -400,13 +522,7 @@ export function deriveManifestFields(
     if (key === "authentication") {
       const authentication = asRecord(normalized.authentication);
       if (authentication) {
-        const {
-          gateway: _gateway,
-          oidc: _oidc,
-          stripe: _stripe,
-          ...authPublic
-        } = authentication;
-        manifest.authentication = authPublic;
+        manifest.authentication = stripAuthenticationSecrets(authentication);
       }
       continue;
     }

package/src/config/apitogo-config-loader.node.ts

@@ -36,19 +36,39 @@ export function readAuthenticationSecrets(
 ): AuthenticationSecrets {
   const overrides = applyEnvOverrides({}, env);
   const authentication = asRecord(overrides.authentication);
-  const oidc = asRecord(authentication?.oidc);
+  const email = asRecord(authentication?.email);
+  const providers = asRecord(authentication?.providers);
   const stripe = asRecord(authentication?.stripe);
 
   const secrets: AuthenticationSecrets = {};
-  if (oidc) {
-    secrets.oidc = {
-      authority:
-        typeof oidc.authority === "string" ? oidc.authority : undefined,
-      clientId: typeof oidc.clientId === "string" ? oidc.clientId : undefined,
-      clientSecret:
-        typeof oidc.clientSecret === "string" ? oidc.clientSecret : undefined,
+
+  if (email?.connectionString) {
+    secrets.email = {
+      connectionString:
+        typeof email.connectionString === "string"
+          ? email.connectionString
+          : undefined,
     };
   }
+
+  if (providers) {
+    const providerSecrets: Record<string, { clientSecret?: string }> = {};
+    for (const [id, value] of Object.entries(providers)) {
+      const provider = asRecord(value);
+      if (provider?.clientSecret) {
+        providerSecrets[id] = {
+          clientSecret:
+            typeof provider.clientSecret === "string"
+              ? provider.clientSecret
+              : undefined,
+        };
+      }
+    }
+    if (Object.keys(providerSecrets).length > 0) {
+      secrets.providers = providerSecrets;
+    }
+  }
+
   if (stripe) {
     secrets.stripe = {
       secretKey:

package/src/config/local-manifest.ts

@@ -55,8 +55,29 @@ export const DevPortalLocalManifestSchema = z.object({
   authentication: z
     .object({
       enabled: z.boolean().optional(),
-      type: z.string().optional(),
       apiBaseUrl: z.string().optional(),
+      native: z
+        .object({
+          enabled: z.boolean().optional(),
+        })
+        .optional(),
+      email: z
+        .object({
+          provider: z.string().optional(),
+          from: z.string().optional(),
+        })
+        .optional(),
+      providers: z
+        .array(
+          z.object({
+            id: z.string().min(1),
+            displayName: z.string().optional(),
+            authority: z.string().optional(),
+            clientId: z.string().optional(),
+            scopes: z.string().optional(),
+          }),
+        )
+        .optional(),
     })
     .optional(),
   plans: z.array(ManifestPlanInputSchema).optional(),
@@ -116,6 +137,16 @@ export function isAuthenticationEnabled(
   return manifest?.authentication?.enabled === true;
 }
 
+export function isNativeAuthEnabledInManifest(
+  manifest: DevPortalLocalManifest | null | undefined,
+): boolean {
+  if (!isAuthenticationEnabled(manifest)) {
+    return false;
+  }
+
+  return manifest?.authentication?.native?.enabled !== false;
+}
+
 export function manifestToPreviewCatalog(
   manifest: DevPortalLocalManifest | null | undefined,
 ): DevPortalPreviewPlanCatalog {

package/src/config/validators/ZudokuConfig.ts

@@ -492,8 +492,32 @@ const AuthenticationSchema = z.discriminatedUnion("type", [
     redirectToAfterSignOut: z.string().optional(),
   }),
   z.object({
-    type: z.literal("dev-portal"),
+    type: z.literal("dev-portal").optional().default("dev-portal"),
     apiBaseUrl: z.string().optional(),
+    native: z
+      .object({
+        enabled: z.boolean().optional(),
+      })
+      .optional(),
+    email: z
+      .object({
+        provider: z.string().optional(),
+        from: z.string().optional(),
+        connectionString: z.string().optional(),
+      })
+      .optional(),
+    providers: z
+      .array(
+        z.object({
+          id: z.string().min(1),
+          displayName: z.string().optional(),
+          authority: z.string().optional(),
+          clientId: z.string().optional(),
+          clientSecret: z.string().optional(),
+          scopes: z.string().optional(),
+        }),
+      )
+      .optional(),
     redirectToAfterSignUp: z.string().optional(),
     redirectToAfterSignIn: z.string().optional(),
     redirectToAfterSignOut: z.string().optional(),