@main12/auth-login 0.3.0 → 0.3.1

package/dist/components/pages/LoginPageTailwind.js

@@ -21,7 +21,7 @@ function LoginContent({ onPasswordLogin, redirectTo = '/', showGoogleOAuth = tru
         poweredBy: poweredBy,
         cardClassName: cardClassName,
         backgroundClass: backgroundClass,
-        footer: /*#__PURE__*/ _jsxs("p", {
+        footer: signupUrl ? /*#__PURE__*/ _jsxs("p", {
             className: "text-center text-gray-600 text-sm",
             children: [
                 "Don't have an account?",
@@ -32,7 +32,7 @@ function LoginContent({ onPasswordLogin, redirectTo = '/', showGoogleOAuth = tru
                     children: "Sign up"
                 })
             ]
-        }),
+        }) : undefined,
         children: [
             step === 'email' && /*#__PURE__*/ _jsxs("div", {
                 className: "animate-[fadeIn_0.3s_ease-out]",
@@ -46,11 +46,30 @@ function LoginContent({ onPasswordLogin, redirectTo = '/', showGoogleOAuth = tru
                                 className: "mb-4",
                                 onPress: handleGoogleLogin,
                                 children: [
-                                    /*#__PURE__*/ _jsx("span", {
-                                        className: "text-lg",
-                                        children: "G"
+                                    /*#__PURE__*/ _jsxs("svg", {
+                                        width: "20",
+                                        height: "20",
+                                        viewBox: "0 0 48 48",
+                                        children: [
+                                            /*#__PURE__*/ _jsx("path", {
+                                                fill: "#EA4335",
+                                                d: "M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z"
+                                            }),
+                                            /*#__PURE__*/ _jsx("path", {
+                                                fill: "#4285F4",
+                                                d: "M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z"
+                                            }),
+                                            /*#__PURE__*/ _jsx("path", {
+                                                fill: "#FBBC05",
+                                                d: "M10.53 28.59a14.5 14.5 0 0 1 0-9.18l-7.98-6.19a24.01 24.01 0 0 0 0 21.56l7.98-6.19z"
+                                            }),
+                                            /*#__PURE__*/ _jsx("path", {
+                                                fill: "#34A853",
+                                                d: "M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z"
+                                            })
+                                        ]
                                     }),
-                                    " Continue with Google"
+                                    "Continue with Google"
                                 ]
                             }),
                             /*#__PURE__*/ _jsxs("div", {

package/dist/components/pages/SetPasswordPageHero.js

@@ -50,7 +50,8 @@ export default function SetPasswordPageHero({ redirectTo = '/', logo, poweredBy,
                             className: "relative",
                             children: [
                                 /*#__PURE__*/ _jsx(Input, {
-                                    className: "w-full pr-10 bg-white"
+                                    variant: "secondary",
+                                    className: "w-full pr-10"
                                 }),
                                 /*#__PURE__*/ _jsx("button", {
                                     type: "button",
@@ -84,7 +85,8 @@ export default function SetPasswordPageHero({ redirectTo = '/', logo, poweredBy,
                             children: "Confirm Password"
                         }),
                         /*#__PURE__*/ _jsx(Input, {
-                            className: "w-full bg-white"
+                            variant: "secondary",
+                            className: "w-full"
                         })
                     ]
                 }),

package/dist/components/pages/SignupPageTailwind.js

@@ -52,11 +52,30 @@ export default function SignupPage({ onSignup, showGoogleOAuth = true, loginUrl
                         size: "lg",
                         className: "mb-4",
                         children: [
-                            /*#__PURE__*/ _jsx("span", {
-                                className: "text-lg",
-                                children: "G"
+                            /*#__PURE__*/ _jsxs("svg", {
+                                width: "20",
+                                height: "20",
+                                viewBox: "0 0 48 48",
+                                children: [
+                                    /*#__PURE__*/ _jsx("path", {
+                                        fill: "#EA4335",
+                                        d: "M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z"
+                                    }),
+                                    /*#__PURE__*/ _jsx("path", {
+                                        fill: "#4285F4",
+                                        d: "M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z"
+                                    }),
+                                    /*#__PURE__*/ _jsx("path", {
+                                        fill: "#FBBC05",
+                                        d: "M10.53 28.59a14.5 14.5 0 0 1 0-9.18l-7.98-6.19a24.01 24.01 0 0 0 0 21.56l7.98-6.19z"
+                                    }),
+                                    /*#__PURE__*/ _jsx("path", {
+                                        fill: "#34A853",
+                                        d: "M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z"
+                                    })
+                                ]
                             }),
-                            " Continue with Google"
+                            "Continue with Google"
                         ]
                     }),
                     /*#__PURE__*/ _jsxs("div", {

package/dist/components/pages/VerifyOtpPageHero.js

@@ -49,6 +49,7 @@ function VerifyOtpHeroContent({ loginUrl = '/login', logo, poweredBy, cardClassN
                     onChange: setOtp,
                     isDisabled: isLoading,
                     autoFocus: true,
+                    variant: "secondary",
                     children: [
                         /*#__PURE__*/ _jsxs(InputOTP.Group, {
                             children: [

package/dist/config.d.ts

@@ -11,9 +11,13 @@ export declare const pluginConfig: {
     googleOAuthEnabled: boolean;
     routeRedirects: boolean;
     authBasePath: string;
+    passwordLogin: boolean;
+    otpLogin: boolean;
 };
 /** Call this client-side to mirror the server plugin config. */
 export declare function initClientConfig(opts: {
     style?: AuthStyle;
     googleOAuthEnabled?: boolean;
+    passwordLogin?: boolean;
+    otpLogin?: boolean;
 }): void;

package/dist/config.js

@@ -2,9 +2,13 @@ export const pluginConfig = {
     style: 'tailwind',
     googleOAuthEnabled: false,
     routeRedirects: false,
-    authBasePath: '/auth'
+    authBasePath: '/auth',
+    passwordLogin: true,
+    otpLogin: true
 };
 /** Call this client-side to mirror the server plugin config. */ export function initClientConfig(opts) {
     if (opts.style) pluginConfig.style = opts.style;
     if (opts.googleOAuthEnabled !== undefined) pluginConfig.googleOAuthEnabled = opts.googleOAuthEnabled;
+    if (opts.passwordLogin !== undefined) pluginConfig.passwordLogin = opts.passwordLogin;
+    if (opts.otpLogin !== undefined) pluginConfig.otpLogin = opts.otpLogin;
 }

package/dist/endpoints/authEndpoints.js

@@ -1,9 +1,10 @@
+import crypto from 'crypto';
 import { generateOtp, hashOtp, verifyOtp, getOtpExpiry, isOtpExpired } from '../auth/domain/otp.js';
 import { generateWelcomeEmail, generateOtpEmail } from '../components/email/index.js';
 /**
  * POST /api/auth/check-email — Check if user exists and has password
  */ export const checkEmailEndpoint = {
-    path: '/api/auth/check-email',
+    path: '/auth/check-email',
     method: 'post',
     handler: async (req)=>{
         const { email } = req.json ? await req.json() : req.body || {};
@@ -47,7 +48,7 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
 /**
  * POST /api/auth/otp/send — Generate OTP, store it, send email via Payload
  */ export const sendOtpEndpoint = {
-    path: '/api/auth/otp/send',
+    path: '/auth/otp/send',
     method: 'post',
     handler: async (req)=>{
         const body = req.json ? await req.json() : req.body || {};
@@ -81,33 +82,32 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
             const otp = generateOtp();
             const hashed = hashOtp(otp);
             const expiresAt = getOtpExpiry(10);
-            // Store OTP in a custom collection or users doc
-            // For simplicity, we'll use the users collection with an otp field
-            // In production, use a dedicated `otps` collection
-            try {
-                await req.payload.update({
-                    collection: 'users',
-                    id: user.id,
-                    data: {
-                        otpHash: hashed,
-                        otpPurpose: purpose,
-                        otpAttempts: 0,
-                        otpExpiresAt: expiresAt.toISOString()
-                    }
-                });
-            } catch  {
-                // If the users collection doesn't have OTP fields, create a dedicated otps doc
-                await req.payload.create({
-                    collection: 'otps',
-                    data: {
-                        email: email.toLowerCase().trim(),
-                        hash: hashed,
-                        purpose,
-                        attempts: 0,
-                        expiresAt: expiresAt.toISOString()
+            // Delete any existing OTPs for this email
+            const existingOtps = await req.payload.find({
+                collection: 'auth-otps',
+                where: {
+                    email: {
+                        equals: email.toLowerCase().trim()
                     }
+                }
+            });
+            for (const doc of existingOtps.docs){
+                await req.payload.delete({
+                    collection: 'auth-otps',
+                    id: doc.id
                 });
             }
+            // Store OTP in dedicated collection
+            await req.payload.create({
+                collection: 'auth-otps',
+                data: {
+                    email: email.toLowerCase().trim(),
+                    hash: hashed,
+                    purpose,
+                    attempts: 0,
+                    expiresAt: expiresAt.toISOString()
+                }
+            });
             // Send email via Payload's configured adapter
             const emailResult = purpose === 'signup' ? generateOtpEmail({
                 userName: user.name || user.email,
@@ -140,7 +140,7 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
 /**
  * POST /api/auth/otp/verify — Verify OTP and login the user
  */ export const verifyOtpEndpoint = {
-    path: '/api/auth/otp/verify',
+    path: '/auth/otp/verify',
     method: 'post',
     handler: async (req)=>{
         const body = req.json ? await req.json() : req.body || {};
@@ -152,44 +152,19 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
             status: 400
         });
         try {
-            // Find OTP record — try users collection first
-            const users = await req.payload.find({
-                collection: 'users',
+            // Find OTP record from dedicated collection
+            const otpDocs = await req.payload.find({
+                collection: 'auth-otps',
                 where: {
                     email: {
                         equals: email.toLowerCase().trim()
                     }
                 },
+                sort: '-createdAt',
                 limit: 1
             });
-            let otpHash;
-            let otpAttempts = 0;
-            let otpExpiresAt;
-            const user = users.docs?.[0];
-            if (user?.otpHash) {
-                otpHash = user.otpHash;
-                otpAttempts = user.otpAttempts || 0;
-                otpExpiresAt = user.otpExpiresAt;
-            } else {
-                // Try dedicated otps collection
-                const otpDocs = await req.payload.find({
-                    collection: 'otps',
-                    where: {
-                        email: {
-                            equals: email.toLowerCase().trim()
-                        }
-                    },
-                    sort: '-createdAt',
-                    limit: 1
-                });
-                const otpDoc = otpDocs.docs?.[0];
-                if (otpDoc) {
-                    otpHash = otpDoc.hash;
-                    otpAttempts = otpDoc.attempts || 0;
-                    otpExpiresAt = otpDoc.expiresAt;
-                }
-            }
-            if (!otpHash) {
+            const otpDoc = otpDocs.docs?.[0];
+            if (!otpDoc?.hash) {
                 return Response.json({
                     success: false,
                     error: 'No OTP found. Please request a new code.'
@@ -197,7 +172,11 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
                     status: 400
                 });
             }
-            if (isOtpExpired(otpExpiresAt)) {
+            if (isOtpExpired(otpDoc.expiresAt)) {
+                await req.payload.delete({
+                    collection: 'auth-otps',
+                    id: otpDoc.id
+                });
                 return Response.json({
                     success: false,
                     error: 'Code has expired. Please request a new one.'
@@ -205,7 +184,11 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
                     status: 400
                 });
             }
-            if (otpAttempts >= 3) {
+            if ((otpDoc.attempts || 0) >= 3) {
+                await req.payload.delete({
+                    collection: 'auth-otps',
+                    id: otpDoc.id
+                });
                 return Response.json({
                     success: false,
                     error: 'Too many attempts. Please request a new code.'
@@ -214,16 +197,14 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
                 });
             }
             // Increment attempts
-            if (user?.otpHash) {
-                await req.payload.update({
-                    collection: 'users',
-                    id: user.id,
-                    data: {
-                        otpAttempts: otpAttempts + 1
-                    }
-                });
-            }
-            if (!verifyOtp(otp, otpHash)) {
+            await req.payload.update({
+                collection: 'auth-otps',
+                id: otpDoc.id,
+                data: {
+                    attempts: (otpDoc.attempts || 0) + 1
+                }
+            });
+            if (!verifyOtp(otp, otpDoc.hash)) {
                 return Response.json({
                     success: false,
                     error: 'Invalid code. Please try again.'
@@ -231,35 +212,64 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
                     status: 400
                 });
             }
-            // OTP is valid — log the user in
-            // Payload requires password for login. We use the stored password
-            // (auto-generated during signup or previously set by user).
-            const userData = users.docs?.[0];
-            const result = await req.payload.login({
+            // OTP is valid — delete it
+            await req.payload.delete({
+                collection: 'auth-otps',
+                id: otpDoc.id
+            });
+            // Find the user
+            const users = await req.payload.find({
                 collection: 'users',
-                data: {
-                    email: email.toLowerCase().trim(),
-                    password: userData?.password || ''
+                where: {
+                    email: {
+                        equals: email.toLowerCase().trim()
+                    }
                 },
-                req: req
+                limit: 1
             });
-            // Clean up OTP
-            if (user?.otpHash) {
-                await req.payload.update({
-                    collection: 'users',
-                    id: user.id,
-                    data: {
-                        otpHash: null,
-                        otpPurpose: null,
-                        otpAttempts: null,
-                        otpExpiresAt: null
-                    }
+            const user = users.docs?.[0];
+            if (!user) {
+                return Response.json({
+                    success: false,
+                    error: 'User not found'
+                }, {
+                    status: 404
                 });
             }
-            return Response.json({
+            // Use temp password strategy (same as PaintPulse) — only touches password field
+            const tempPassword = crypto.randomBytes(32).toString('hex');
+            await req.payload.update({
+                collection: 'users',
+                id: user.id,
+                data: {
+                    password: tempPassword
+                }
+            });
+            // Login with the temp password to get a proper JWT token
+            const loginResult = await req.payload.login({
+                collection: 'users',
+                data: {
+                    email: email.toLowerCase().trim(),
+                    password: tempPassword
+                }
+            });
+            if (!loginResult.user) {
+                throw new Error('Login failed after OTP verification');
+            }
+            // Set the auth cookie directly on the response
+            const response = Response.json({
                 success: true,
-                token: result.token,
-                isNewUser: !user?.password
+                token: loginResult.token,
+                isNewUser: !user?.hasPassword
+            });
+            // Attach payload-token cookie
+            const cookieHeader = `payload-token=${loginResult.token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${7200}`;
+            return new Response(response.body, {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Set-Cookie': cookieHeader
+                }
             });
         } catch (err) {
             console.error('OTP verify error:', err);
@@ -275,7 +285,7 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
 /**
  * POST /api/auth/set-password — Set/update password for authenticated user
  */ export const setPasswordEndpoint = {
-    path: '/api/auth/set-password',
+    path: '/auth/set-password',
     method: 'post',
     handler: async (req)=>{
         const body = req.json ? await req.json() : req.body || {};
@@ -339,9 +349,17 @@ import { generateWelcomeEmail, generateOtpEmail } from '../components/email/inde
 /**
  * POST /api/auth/signup — Create new user + send welcome email
  */ export const signupEndpoint = {
-    path: '/api/auth/signup',
+    path: '/auth/signup',
     method: 'post',
     handler: async (req)=>{
+        if (process.env.AUTH_PLUGIN_ALLOW_SIGNUP === 'false') {
+            return Response.json({
+                success: false,
+                message: 'Signups are currently disabled'
+            }, {
+                status: 403
+            });
+        }
         const body = req.json ? await req.json() : req.body || {};
         const { name, email } = body;
         if (!email) {

package/dist/exports/client.d.ts

@@ -1,4 +1,6 @@
 export { initClientConfig } from '../config';
+export { AuthClientInit } from '../components/AuthClientInit';
+export type { AuthClientInitProps } from '../components/AuthClientInit';
 export { useLoginFlow } from '../auth/application/hooks/useLoginFlow';
 export { useVerifyOtpFlow } from '../auth/application/hooks/useVerifyOtpFlow';
 export { useForgotPasswordFlow } from '../auth/application/hooks/useForgotPasswordFlow';

package/dist/exports/client.js

@@ -4,6 +4,7 @@
 // ============================================================
 // Plugin client config initializer
 export { initClientConfig } from '../config.js';
+export { AuthClientInit } from '../components/AuthClientInit.js';
 // Auth hooks
 export { useLoginFlow } from '../auth/application/hooks/useLoginFlow.js';
 export { useVerifyOtpFlow } from '../auth/application/hooks/useVerifyOtpFlow.js';

package/dist/exports/rsc.d.ts

@@ -1,3 +1,5 @@
+export { default as AuthPages } from '../components/AuthPagesServer';
+export type { AuthPagesProps } from '../components/AuthPagesServer';
 export { wrapInBaseTemplate, DEFAULT_COLORS, SOCIAL_ICONS, getBaseUrl, getSenderEmail, getEmailTranslations, generateOtpEmail, generateWelcomeEmail, generatePasswordResetEmail, generatePasswordChangedEmail, } from '../components/email/index';
 export type { BaseTemplateOptions, } from '../components/email/baseTemplate';
 export type { EmailColors, SocialLink, SocialPlatform, } from '../components/email/constants';

package/dist/exports/rsc.js

@@ -1,5 +1,7 @@
 // ============================================================
 // RSC (React Server Components) exports for @main12/auth-login/rsc
 // ============================================================
+// Server component auth pages (reads plugin config automatically)
+export { default as AuthPages } from '../components/AuthPagesServer.js';
 // Email template system (server-only — uses Node APIs)
 export { wrapInBaseTemplate, DEFAULT_COLORS, SOCIAL_ICONS, getBaseUrl, getSenderEmail, getEmailTranslations, generateOtpEmail, generateWelcomeEmail, generatePasswordResetEmail, generatePasswordChangedEmail } from '../components/email/index.js';

package/dist/index.d.ts

@@ -7,6 +7,10 @@ export interface GoogleOAuthConfig {
     clientSecret?: string;
     /** Toggle provider on/off */
     enabled?: boolean;
+    /** Where to redirect after successful Google login. Defaults to '/admin' */
+    successRedirect?: string;
+    /** Where to redirect after failed Google login. Defaults to '/login?error=Google login failed' */
+    failureRedirect?: string;
 }
 export interface AuthProvidersConfig {
     google?: GoogleOAuthConfig | boolean;
@@ -40,6 +44,28 @@ export interface AuthLoginPluginOptions {
     routeRedirects?: boolean | {
         basePath?: string;
     };
+    /**
+     * Allow new users to sign up.
+     * When false, signup page is hidden, signup link is removed from login,
+     * and Google OAuth rejects unregistered users.
+     * @default true
+     */
+    allowSignup?: boolean;
+    /**
+     * Allow login via password.
+     * When true, users with passwords see the password step.
+     * When false, all logins go through OTP.
+     * @default true
+     */
+    passwordLogin?: boolean;
+    /**
+     * Allow login via OTP (email verification code).
+     * When true, users without passwords get OTP automatically,
+     * and after OTP verification they go straight to the app.
+     * When false, users are prompted to set a password after OTP.
+     * @default true
+     */
+    otpLogin?: boolean;
 }
-export declare const authLoginPlugin: (options?: AuthLoginPluginOptions) => (config: Config) => Config;
+export declare const authLoginPlugin: (options?: AuthLoginPluginOptions) => (config: Config) => Promise<Config>;
 export { pluginConfig };