@owlmeans/web-auth 0.1.14

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OwlMeans Common — Fullstack typescript framework
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,16 @@
+<!-- owlmeans:agent-guidance:start -->
+## Agent guidance
+
+This package ships embedded Claude Code skills and GitHub Copilot instructions under
+`agent-meta/`. After installing your `@owlmeans/*` packages, run the OwlMeans
+agent-skills installer to place them into your project's native locations
+(`.claude/skills/` and `.github/instructions/`):
+
+```sh
+npx @owlmeans/agent-skills
+```
+
+The embedded files are version-matched to this package release. Do not edit them
+directly — they are regenerated on each publish. To contribute guidance edits,
+open a PR against the source monorepo.
+<!-- owlmeans:agent-guidance:end -->

package/agent-meta/instructions/web-auth.instructions.md

@@ -0,0 +1,22 @@
+---
+description: "How to use @owlmeans/web-auth — web auth UI plugins registering into @owlmeans/client-auth/manager. Ships the development-only PK-based supervisor login form via appendSupervisorAuth. Use when adding the supervisor login UI to a web app."
+applyTo: "**/*.ts, **/*.tsx"
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/web-auth
+
+Web-side auth UI plugins that register into `@owlmeans/client-auth/manager` (mirrors
+`@owlmeans/web-oidc-rp`). Currently ships the **development-only PK-based supervisor** login form.
+
+```ts
+import { appendSupervisorAuth } from '@owlmeans/web-auth'
+appendSupervisorAuth(context) // in web makeContext(); dev-only by default (cfg.debug)
+```
+
+- Form renders at `SUPERVISOR_LOGIN_PATH` (`/authentication/login/pk-supervisor`) via the standard
+  typed auth route — no extra route registration.
+- Side-effect always-on alternative: `import '@owlmeans/web-auth/auth/plugins'`.
+- Test ids: `supervisor-auth-form`, `supervisor-user-id`, `supervisor-pk`, `supervisor-submit`,
+  `supervisor-error`.
+- Full feature (server side, options, security, test helpers): see the **supervisor-auth** instruction.

package/agent-meta/manifest.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": 1,
+  "package": "@owlmeans/web-auth",
+  "version": "0.1.14",
+  "generatedAt": "2026-08-05T16:56:53.378Z",
+  "canonicalRepo": "https://github.com/owlmeans/common",
+  "entries": [
+    {
+      "kind": "skill",
+      "name": "web-auth",
+      "category": "package-specific",
+      "file": "skills/web-auth/SKILL.md",
+      "canonicalPath": ".claude/skills/web-auth/SKILL.md"
+    },
+    {
+      "kind": "instruction",
+      "name": "web-auth",
+      "category": "package-specific",
+      "file": "instructions/web-auth.instructions.md",
+      "canonicalPath": ".github/instructions/web-auth.instructions.md"
+    }
+  ]
+}

package/agent-meta/skills/web-auth/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: web-auth
+description: How to use @owlmeans/web-auth — web client auth plugins that register into @owlmeans/client-auth/manager. Currently ships the development-only PK-based supervisor login form (appendSupervisorAuth). Auto-invoked when importing @owlmeans/web-auth.
+user-invocable: false
+---
+<!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
+
+# @owlmeans/web-auth
+
+**Layer:** Web
+**Install:** `"@owlmeans/web-auth": "^0.1.14"` in `dependencies`
+
+Web-side auth UI plugins that register into the shared `@owlmeans/client-auth/manager` plugin registry
+(mirrors `@owlmeans/web-oidc-rp`). Currently ships the **PK-based supervisor** login form.
+
+## Key Exports
+
+| Export | Description |
+|--------|-------------|
+| `appendSupervisorAuth(context, opts?)` | Dev-only: register the supervisor login form plugin |
+| `SUPERVISOR_LOGIN_PATH` | `/authentication/login/pk-supervisor` (the typed-route path) |
+| `supervisorClientPlugin` | The client `AuthenticationPlugin` (self-contained form) |
+
+## Subpath Exports
+- `./auth/plugins` — side-effect import that always-registers the supervisor plugin
+  (`import '@owlmeans/web-auth/auth/plugins'`). Prefer the dev-gated `appendSupervisorAuth`.
+
+## Usage
+```ts
+import { appendSupervisorAuth } from '@owlmeans/web-auth'
+// in your web client makeContext():
+appendSupervisorAuth(context) // enabled in development only (cfg.debug)
+```
+The form renders at `SUPERVISOR_LOGIN_PATH` via the standard `CAUTHEN_AUTHEN_TYPED` route — no extra
+route registration needed. Test ids: `supervisor-auth-form`, `supervisor-user-id`, `supervisor-pk`,
+`supervisor-submit`, `supervisor-error`.
+
+See the **supervisor-auth** skill for the full feature (server append, options, security, test helpers).
+
+## Depends On
+- `@owlmeans/client-auth`, `@owlmeans/web-client`, `@owlmeans/client`
+- `@owlmeans/auth` (type + `buildSupervisorPayload`), `@owlmeans/basic-keys`, `@owlmeans/basic-ids`

package/build/append.d.ts

@@ -0,0 +1,19 @@
+export interface WebSupervisorAuthOptions {
+    /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
+    enabled?: boolean;
+}
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on
+ * the web client context. Development-only by default. It registers the
+ * supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ */
+export declare const appendSupervisorAuth: <T extends {
+    cfg: {
+        debug?: {
+            all?: boolean;
+            supervisor?: boolean;
+        };
+    };
+}>(context: T, opts?: WebSupervisorAuthOptions) => T;
+//# sourceMappingURL=append.d.ts.map

package/build/append.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,wBAAwB;IACvC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAKD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS;IAAE,GAAG,EAAE;QAAE,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,EACzG,SAAS,CAAC,EAAE,OAAO,wBAAwB,KAC1C,CASF,CAAA"}

package/build/append.js

@@ -0,0 +1,19 @@
+import { AuthenticationType } from '@owlmeans/auth';
+import { plugins as authPlugins } from '@owlmeans/client-auth/manager';
+import { supervisorClientPlugin } from './auth/plugins/supervisor.js';
+const isDevelopment = (context) => context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true;
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on
+ * the web client context. Development-only by default. It registers the
+ * supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ */
+export const appendSupervisorAuth = (context, opts) => {
+    const enabled = opts?.enabled ?? isDevelopment(context);
+    if (!enabled) {
+        return context;
+    }
+    authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin;
+    return context;
+};
+//# sourceMappingURL=append.js.map

package/build/append.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAOrE,MAAM,aAAa,GAAG,CAAC,OAAqE,EAAW,EAAE,CACvG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/auth/plugins/index.d.ts

@@ -0,0 +1,6 @@
+import { supervisorClientPlugin } from './supervisor.js';
+export declare const plugins: {
+    [type: string]: import("@owlmeans/client-auth/manager/plugins").AuthenticationPlugin;
+};
+export { supervisorClientPlugin };
+//# sourceMappingURL=index.d.ts.map

package/build/auth/plugins/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAOxD,eAAO,MAAM,OAAO;;CAAc,CAAA;AAClC,OAAO,EAAE,sBAAsB,EAAE,CAAA"}

package/build/auth/plugins/index.js

@@ -0,0 +1,10 @@
+import { plugins as authPlugins } from '@owlmeans/client-auth/manager';
+import { AuthenticationType } from '@owlmeans/auth';
+import { supervisorClientPlugin } from './supervisor.js';
+// Side-effect registration into the shared client auth plugin registry. Prefer
+// the dev-gated `appendSupervisorAuth` for explicit, environment-aware wiring;
+// this import is the always-on alternative (mirrors @owlmeans/web-oidc-rp).
+authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin;
+export const plugins = authPlugins;
+export { supervisorClientPlugin };
+//# sourceMappingURL=index.js.map

package/build/auth/plugins/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/plugins/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAExD,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;AAEnE,MAAM,CAAC,MAAM,OAAO,GAAG,WAAW,CAAA;AAClC,OAAO,EAAE,sBAAsB,EAAE,CAAA"}

package/build/auth/plugins/supervisor.d.ts

@@ -0,0 +1,15 @@
+import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins';
+/**
+ * PK-based supervisor login form (development-only). The operator (or an e2e
+ * test) enters a target user id / email and one of the project's trusted private
+ * keys. The form generates a fresh session salt, signs `buildSupervisorPayload`
+ * with the entered key, and hands the packed credential to the standard auth
+ * control - the back-end supervisor plugin verifies the signature and mints a
+ * regular owlmeans token for the user.
+ *
+ * The plugin is self-contained: it renders its own minimal form and performs the
+ * token storage + redirect (mirroring the Google plugin), so a host app only has
+ * to register it (see web `appendSupervisorAuth`).
+ */
+export declare const supervisorClientPlugin: AuthenticationPlugin;
+//# sourceMappingURL=supervisor.d.ts.map

package/build/auth/plugins/supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAWjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAsEpC,CAAA"}

package/build/auth/plugins/supervisor.js

@@ -0,0 +1,64 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth';
+import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth';
+import { useContext } from '@owlmeans/client';
+import { HOME } from '@owlmeans/web-client';
+import { makeKeyPairModel } from '@owlmeans/basic-keys';
+import { createIdOfLength } from '@owlmeans/basic-ids';
+/**
+ * PK-based supervisor login form (development-only). The operator (or an e2e
+ * test) enters a target user id / email and one of the project's trusted private
+ * keys. The form generates a fresh session salt, signs `buildSupervisorPayload`
+ * with the entered key, and hands the packed credential to the standard auth
+ * control - the back-end supervisor plugin verifies the signature and mints a
+ * regular owlmeans token for the user.
+ *
+ * The plugin is self-contained: it renders its own minimal form and performs the
+ * token storage + redirect (mirroring the Google plugin), so a host app only has
+ * to register it (see web `appendSupervisorAuth`).
+ */
+export const supervisorClientPlugin = {
+    type: AuthenticationType.Supervisor,
+    Implementation: () => ({ type, control }) => {
+        const context = useContext();
+        const [userId, setUserId] = useState('');
+        const [pk, setPk] = useState('');
+        const [error, setError] = useState(null);
+        const [busy, setBusy] = useState(false);
+        const onSubmit = async (event) => {
+            event.preventDefault();
+            setError(null);
+            setBusy(true);
+            try {
+                // Fetch a fresh server challenge right before signing so the allowance is
+                // always ready (avoids a race when the form is submitted immediately).
+                await control.requestAllowence({ type });
+                const token = await control.authenticate({ userId, credential: pk });
+                if (token.token !== '') {
+                    const authService = context.service(AUTH_SERVICE);
+                    await authService.authenticate(token);
+                }
+                const [homeUrl] = await context.module(HOME).call({ full: true }) ?? [];
+                window.location.href = homeUrl ?? window.location.origin;
+            }
+            catch (e) {
+                setError(e instanceof Error ? e.message : String(e));
+                setBusy(false);
+            }
+        };
+        return (_jsxs("form", { onSubmit: onSubmit, "data-testid": "supervisor-auth-form", style: { display: 'flex', flexDirection: 'column', gap: 12, maxWidth: 420, margin: '0 auto' }, children: [_jsx("h3", { children: "Supervisor sign-in (development)" }), _jsxs("label", { style: { display: 'flex', flexDirection: 'column', gap: 4 }, children: ["User id / email", _jsx("input", { name: "userId", type: "text", autoComplete: "off", value: userId, "data-testid": "supervisor-user-id", onChange: e => setUserId(e.target.value), required: true })] }), _jsxs("label", { style: { display: 'flex', flexDirection: 'column', gap: 4 }, children: ["Primary key", _jsx("input", { name: "pk", type: "password", autoComplete: "off", value: pk, "data-testid": "supervisor-pk", onChange: e => setPk(e.target.value), required: true })] }), _jsx("button", { type: "submit", "data-testid": "supervisor-submit", disabled: busy || userId === '' || pk === '', children: busy ? 'Signing in…' : 'Sign in as supervisor' }), error != null ? _jsx("p", { role: "alert", "data-testid": "supervisor-error", style: { color: 'crimson' }, children: error }) : null] }));
+    },
+    // Sign the supervisor payload with the entered private key and pack the salt +
+    // signature into `credential`. `credentials.challenge` here is the unwrapped,
+    // single-use server challenge (set by the auth control before this runs).
+    authenticate: async (credentials) => {
+        const key = makeKeyPairModel(credentials.credential);
+        const salt = createIdOfLength(16);
+        const signature = await key.sign(buildSupervisorPayload(credentials.challenge ?? '', credentials.userId, salt));
+        credentials.credential = JSON.stringify({ salt, signature });
+        // The real token is issued by the backend via the standard auth control flow.
+        return { token: '' };
+    }
+};
+//# sourceMappingURL=supervisor.js.map

package/build/auth/plugins/supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAiB,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;gBACvF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;YAC1D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}

package/build/consts.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Front-end path that renders the supervisor login form. It reuses the standard
+ * typed authentication route (`/authentication/login/:type`, alias
+ * `CAUTHEN_AUTHEN_TYPED`) with the supervisor type, so no extra route
+ * registration is required - registering the client plugin is enough.
+ */
+export declare const SUPERVISOR_LOGIN_PATH = "/authentication/login/pk-supervisor";
+//# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,wCAA2D,CAAA"}

package/build/consts.js

@@ -0,0 +1,9 @@
+import { AuthenticationType } from '@owlmeans/auth';
+/**
+ * Front-end path that renders the supervisor login form. It reuses the standard
+ * typed authentication route (`/authentication/login/:type`, alias
+ * `CAUTHEN_AUTHEN_TYPED`) with the supervisor type, so no extra route
+ * registration is required - registering the client plugin is enough.
+ */
+export const SUPERVISOR_LOGIN_PATH = `/authentication/login/${AuthenticationType.Supervisor}`;
+//# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,kBAAkB,CAAC,UAAU,EAAE,CAAA"}

package/build/index.d.ts

@@ -0,0 +1,4 @@
+export * from './consts.js';
+export * from './append.js';
+export { supervisorClientPlugin } from './auth/plugins/supervisor.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}

package/build/index.js

@@ -0,0 +1,4 @@
+export * from './consts.js';
+export * from './append.js';
+export { supervisorClientPlugin } from './auth/plugins/supervisor.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@owlmeans/web-auth",
+  "version": "0.1.14",
+  "license": "MIT",
+  "type": "module",
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "sleep 384 && nodemon -e ts,tsx,json --watch src --exec \"tsc -p ./tsconfig.json\"",
+    "watch": "tsc -b -w --preserveWatchOutput --pretty",
+    "test": "bun test ./tests"
+  },
+  "main": "build/index.js",
+  "module": "build/index.js",
+  "types": "build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./build/index.js",
+      "require": "./build/index.js",
+      "default": "./build/index.js",
+      "module": "./build/index.js",
+      "types": "./build/index.d.ts"
+    },
+    "./auth/plugins": {
+      "import": "./build/auth/plugins/index.js",
+      "require": "./build/auth/plugins/index.js",
+      "default": "./build/auth/plugins/index.js",
+      "module": "./build/auth/plugins/index.js",
+      "types": "./build/auth/plugins/index.d.ts"
+    }
+  },
+  "dependencies": {
+    "@owlmeans/auth": "^0.1.14",
+    "@owlmeans/auth-common": "^0.1.14",
+    "@owlmeans/basic-ids": "^0.1.14",
+    "@owlmeans/basic-keys": "^0.1.14",
+    "@owlmeans/client": "^0.1.14",
+    "@owlmeans/client-auth": "^0.1.14",
+    "@owlmeans/context": "^0.1.14",
+    "@owlmeans/web-client": "^0.1.14"
+  },
+  "peerDependencies": {
+    "react": "*"
+  },
+  "devDependencies": {
+    "@owlmeans/dep-config": "workspace:*",
+    "@types/bun": "^1.3.14",
+    "@types/react": "^19.2.17",
+    "nodemon": "^3.1.14",
+    "typescript": "^6.0.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/append.ts

@@ -0,0 +1,30 @@
+import { AuthenticationType } from '@owlmeans/auth'
+import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import { supervisorClientPlugin } from './auth/plugins/supervisor.js'
+
+export interface WebSupervisorAuthOptions {
+  /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
+  enabled?: boolean
+}
+
+const isDevelopment = (context: { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }): boolean =>
+  context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true
+
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on
+ * the web client context. Development-only by default. It registers the
+ * supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ */
+export const appendSupervisorAuth = <T extends { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }>(
+  context: T, opts?: WebSupervisorAuthOptions
+): T => {
+  const enabled = opts?.enabled ?? isDevelopment(context)
+  if (!enabled) {
+    return context
+  }
+
+  authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin
+
+  return context
+}

package/src/auth/plugins/index.ts

@@ -0,0 +1,11 @@
+import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import { AuthenticationType } from '@owlmeans/auth'
+import { supervisorClientPlugin } from './supervisor.js'
+
+// Side-effect registration into the shared client auth plugin registry. Prefer
+// the dev-gated `appendSupervisorAuth` for explicit, environment-aware wiring;
+// this import is the always-on alternative (mirrors @owlmeans/web-oidc-rp).
+authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin
+
+export const plugins = authPlugins
+export { supervisorClientPlugin }

package/src/auth/plugins/supervisor.tsx

@@ -0,0 +1,96 @@
+import { useState } from 'react'
+import type { FormEvent } from 'react'
+import type { AuthenticationPlugin } from '@owlmeans/client-auth/manager/plugins'
+import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth'
+import type { AuthToken } from '@owlmeans/auth'
+import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth'
+import type { AuthService } from '@owlmeans/auth-common'
+import { useContext } from '@owlmeans/client'
+import { HOME } from '@owlmeans/web-client'
+import type { Module } from '@owlmeans/web-client'
+import { makeKeyPairModel } from '@owlmeans/basic-keys'
+import { createIdOfLength } from '@owlmeans/basic-ids'
+
+/**
+ * PK-based supervisor login form (development-only). The operator (or an e2e
+ * test) enters a target user id / email and one of the project's trusted private
+ * keys. The form generates a fresh session salt, signs `buildSupervisorPayload`
+ * with the entered key, and hands the packed credential to the standard auth
+ * control - the back-end supervisor plugin verifies the signature and mints a
+ * regular owlmeans token for the user.
+ *
+ * The plugin is self-contained: it renders its own minimal form and performs the
+ * token storage + redirect (mirroring the Google plugin), so a host app only has
+ * to register it (see web `appendSupervisorAuth`).
+ */
+export const supervisorClientPlugin: AuthenticationPlugin = {
+  type: AuthenticationType.Supervisor,
+
+  Implementation: () => ({ type, control }) => {
+    const context = useContext()
+    const [userId, setUserId] = useState('')
+    const [pk, setPk] = useState('')
+    const [error, setError] = useState<string | null>(null)
+    const [busy, setBusy] = useState(false)
+
+    const onSubmit = async (event: FormEvent) => {
+      event.preventDefault()
+      setError(null)
+      setBusy(true)
+      try {
+        // Fetch a fresh server challenge right before signing so the allowance is
+        // always ready (avoids a race when the form is submitted immediately).
+        await control.requestAllowence({ type })
+
+        const token = await control.authenticate({ userId, credential: pk })
+
+        if (token.token !== '') {
+          const authService = context.service<AuthService>(AUTH_SERVICE)
+          await authService.authenticate(token)
+        }
+
+        const [homeUrl] = await context.module<Module<string>>(HOME).call({ full: true }) ?? []
+        window.location.href = homeUrl ?? window.location.origin
+      } catch (e) {
+        setError(e instanceof Error ? e.message : String(e))
+        setBusy(false)
+      }
+    }
+
+    return (
+      <form onSubmit={onSubmit} data-testid="supervisor-auth-form"
+        style={{ display: 'flex', flexDirection: 'column', gap: 12, maxWidth: 420, margin: '0 auto' }}>
+        <h3>Supervisor sign-in (development)</h3>
+        <label style={{ display: 'flex', flexDirection: 'column', gap: 4 }}>
+          User id / email
+          <input name="userId" type="text" autoComplete="off" value={userId}
+            data-testid="supervisor-user-id"
+            onChange={e => setUserId(e.target.value)} required />
+        </label>
+        <label style={{ display: 'flex', flexDirection: 'column', gap: 4 }}>
+          Primary key
+          <input name="pk" type="password" autoComplete="off" value={pk}
+            data-testid="supervisor-pk"
+            onChange={e => setPk(e.target.value)} required />
+        </label>
+        <button type="submit" data-testid="supervisor-submit" disabled={busy || userId === '' || pk === ''}>
+          {busy ? 'Signing in…' : 'Sign in as supervisor'}
+        </button>
+        {error != null ? <p role="alert" data-testid="supervisor-error" style={{ color: 'crimson' }}>{error}</p> : null}
+      </form>
+    )
+  },
+
+  // Sign the supervisor payload with the entered private key and pack the salt +
+  // signature into `credential`. `credentials.challenge` here is the unwrapped,
+  // single-use server challenge (set by the auth control before this runs).
+  authenticate: async (credentials): Promise<AuthToken> => {
+    const key = makeKeyPairModel(credentials.credential)
+    const salt = createIdOfLength(16)
+    const signature = await key.sign(buildSupervisorPayload(credentials.challenge ?? '', credentials.userId, salt))
+    credentials.credential = JSON.stringify({ salt, signature })
+
+    // The real token is issued by the backend via the standard auth control flow.
+    return { token: '' }
+  }
+}

package/src/consts.ts

@@ -0,0 +1,9 @@
+import { AuthenticationType } from '@owlmeans/auth'
+
+/**
+ * Front-end path that renders the supervisor login form. It reuses the standard
+ * typed authentication route (`/authentication/login/:type`, alias
+ * `CAUTHEN_AUTHEN_TYPED`) with the supervisor type, so no extra route
+ * registration is required - registering the client plugin is enough.
+ */
+export const SUPERVISOR_LOGIN_PATH = `/authentication/login/${AuthenticationType.Supervisor}`

package/src/index.ts

@@ -0,0 +1,3 @@
+export * from './consts.js'
+export * from './append.js'
+export { supervisorClientPlugin } from './auth/plugins/supervisor.js'

package/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "extends": [
+    "@owlmeans/dep-config/tsconfig.base.json",
+    "@owlmeans/dep-config/tsconfig.react.json"
+  ],
+  "compilerOptions": {
+    "rootDir": "./src/",
+    "outDir": "./build/"
+  },
+  "exclude": ["./dist/**/*", "./build/**/*", "./tests/**/*", "./*.ts"]
+}