@objectstack/plugin-auth 6.9.0 → 7.1.0

package/dist/index.js

@@ -69,6 +69,7 @@ module.exports = __toCommonJS(index_exports);
 
 // src/auth-plugin.ts
 var import_apps = require("@objectstack/platform-objects/apps");
+var import_pages = require("@objectstack/platform-objects/pages");
 
 // src/objectql-adapter.ts
 var import_adapters = require("better-auth/adapters");
@@ -694,8 +695,7 @@ var AuthManager = class {
                 relatedId: user.id
               });
             } catch (err) {
-              console.error(`[AuthManager] sendResetPassword failed: ${err?.message ?? err}`);
-              throw err;
+              console.error(`[AuthManager] sendResetPassword failed (swallowed): ${err?.message ?? err}`);
             }
           }
         };
@@ -731,8 +731,7 @@ var AuthManager = class {
                 relatedId: user.id
               });
             } catch (err) {
-              console.error(`[AuthManager] sendVerificationEmail failed: ${err?.message ?? err}`);
-              throw err;
+              console.error(`[AuthManager] sendVerificationEmail failed (swallowed): ${err?.message ?? err}`);
             }
           }
         }
@@ -873,12 +872,14 @@ var AuthManager = class {
   async buildPluginList() {
     const pluginConfig = this.config.plugins ?? {};
     const plugins = [];
+    const oidcEnv = globalThis?.process?.env?.OS_OIDC_PROVIDER_ENABLED;
+    const oidcFromEnv = oidcEnv != null ? String(oidcEnv).toLowerCase() === "true" : void 0;
     const enabled = {
       organization: pluginConfig.organization ?? true,
       twoFactor: pluginConfig.twoFactor ?? false,
       passkeys: pluginConfig.passkeys ?? false,
       magicLink: pluginConfig.magicLink ?? false,
-      oidcProvider: pluginConfig.oidcProvider ?? false,
+      oidcProvider: oidcFromEnv ?? pluginConfig.oidcProvider ?? false,
       deviceAuthorization: pluginConfig.deviceAuthorization ?? false,
       admin: pluginConfig.admin ?? false
     };
@@ -1023,8 +1024,7 @@ var AuthManager = class {
               relatedId: invitation.id
             });
           } catch (err) {
-            console.error(`[AuthManager] sendInvitationEmail failed: ${err?.message ?? err}`);
-            throw err;
+            console.error(`[AuthManager] sendInvitationEmail failed (swallowed): ${err?.message ?? err}`);
           }
         }
       }));
@@ -1355,13 +1355,15 @@ var AuthManager = class {
     };
     const termsUrl = resolveLegalUrl(rawTermsUrl, DEFAULT_TERMS_URL);
     const privacyUrl = resolveLegalUrl(rawPrivacyUrl, DEFAULT_PRIVACY_URL);
+    const oidcEnv = globalThis?.process?.env?.OS_OIDC_PROVIDER_ENABLED;
+    const oidcFromEnv = oidcEnv != null ? String(oidcEnv).toLowerCase() === "true" : void 0;
     const features = {
       twoFactor: pluginConfig.twoFactor ?? false,
       passkeys: pluginConfig.passkeys ?? false,
       magicLink: pluginConfig.magicLink ?? false,
       organization: pluginConfig.organization ?? true,
       multiOrgEnabled,
-      oidcProvider: pluginConfig.oidcProvider ?? false,
+      oidcProvider: oidcFromEnv ?? pluginConfig.oidcProvider ?? false,
       deviceAuthorization: pluginConfig.deviceAuthorization ?? false,
       ...termsUrl ? { termsUrl } : {},
       ...privacyUrl ? { privacyUrl } : {}
@@ -1453,7 +1455,12 @@ var AuthPlugin = class {
       // @objectstack/platform-objects/apps). plugin-auth is the natural
       // owner of its registration since it loads first among the trio
       // (auth + security + audit) that supplies the underlying objects.
-      apps: [import_apps.SETUP_APP, import_apps.STUDIO_APP],
+      apps: [import_apps.SETUP_APP, import_apps.STUDIO_APP, import_apps.ACCOUNT_APP],
+      // Slotted record-detail pages for system objects — currently
+      // sys_organization gets a Members / Invitations / Teams tab strip
+      // (see SysOrganizationDetailPage for the rationale and the
+      // intentionally-omitted OAuth / SSO tabs).
+      pages: [import_pages.SysOrganizationDetailPage, import_pages.SysUserDetailPage],
       // List views for each Setup-nav object are defined on the schema
       // itself via the canonical `listViews` map (e.g.
       // sys_user.listViews.{all_users,unverified,two_factor}). Registering
@@ -1472,30 +1479,6 @@ var AuthPlugin = class {
     if (!this.authManager) {
       throw new Error("Auth manager not initialized");
     }
-    ctx.hook("kernel:ready", async () => {
-      try {
-        const i18n = ctx.getService("i18n");
-        let loaded = 0;
-        for (const [locale, data] of Object.entries(import_apps.SetupAppTranslations)) {
-          if (data && typeof data === "object") {
-            try {
-              i18n.loadTranslations(locale, data);
-              loaded++;
-            } catch (err) {
-              ctx.logger.warn(
-                `Auth: failed to load Setup App translations for '${locale}': ${err?.message ?? err}`
-              );
-            }
-          }
-        }
-        if (loaded > 0) {
-          ctx.logger.info(
-            `Auth: contributed Setup App translations (${loaded} locale${loaded > 1 ? "s" : ""})`
-          );
-        }
-      } catch {
-      }
-    });
     if (this.options.registerRoutes) {
       ctx.hook("kernel:ready", async () => {
         if (this.authManager) {
@@ -1713,6 +1696,56 @@ var AuthPlugin = class {
         return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
       }
     });
+    rawApp.post(`${basePath}/sys-oauth-application/register`, async (c) => {
+      try {
+        let body = {};
+        try {
+          body = await c.req.json();
+        } catch {
+          body = {};
+        }
+        const name = body?.name;
+        const redirectUrlsInput = body?.redirectURLs;
+        const type = body?.type;
+        if (typeof name !== "string" || name.trim().length === 0) {
+          return c.json({ success: false, error: { code: "invalid_request", message: "name is required" } }, 400);
+        }
+        if (typeof redirectUrlsInput !== "string" || redirectUrlsInput.trim().length === 0) {
+          return c.json({ success: false, error: { code: "invalid_request", message: "redirectURLs is required" } }, 400);
+        }
+        const redirectUris = redirectUrlsInput.split(/[\r\n]+/).map((line) => line.trim()).filter((line) => line.length > 0);
+        if (redirectUris.length === 0) {
+          return c.json({ success: false, error: { code: "invalid_request", message: "redirectURLs must contain at least one URL" } }, 400);
+        }
+        const allowedTypes = /* @__PURE__ */ new Set(["web", "native", "user-agent-based"]);
+        const safeType = typeof type === "string" && allowedTypes.has(type) ? type : "web";
+        const authApi = await this.authManager.getApi();
+        if (!authApi?.createOAuthClient) {
+          return c.json({ success: false, error: { code: "unavailable", message: "OIDC provider is not enabled on this environment" } }, 503);
+        }
+        let result;
+        try {
+          result = await authApi.createOAuthClient({
+            body: {
+              client_name: name.trim(),
+              redirect_uris: redirectUris,
+              type: safeType
+            },
+            headers: c.req.raw.headers
+          });
+        } catch (err) {
+          const status = typeof err?.status === "number" ? err.status : 500;
+          const code = err?.body?.error ?? "oauth_register_failed";
+          const message = err?.body?.error_description ?? err?.message ?? "Unable to register OAuth client";
+          return c.json({ success: false, error: { code, message } }, status);
+        }
+        return c.json({ success: true, data: { client: result } });
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error("[AuthPlugin] sys-oauth-application/register failed", err);
+        return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
+      }
+    });
     rawApp.all(`${basePath}/*`, async (c) => {
       try {
         const response = await this.authManager.handleRequest(c.req.raw);
@@ -1753,7 +1786,10 @@ var AuthPlugin = class {
         );
       }
     });
-    if (this.options.plugins?.oidcProvider) {
+    const oidcEnv = globalThis?.process?.env?.OS_OIDC_PROVIDER_ENABLED;
+    const oidcFromEnv = oidcEnv != null ? String(oidcEnv).toLowerCase() === "true" : void 0;
+    const oidcEnabled = oidcFromEnv ?? this.options.plugins?.oidcProvider ?? false;
+    if (oidcEnabled) {
       void this.registerOidcDiscoveryRoutes(rawApp, ctx).catch((error) => {
         ctx.logger.error("Failed to register OIDC discovery routes", error);
       });