@owlmeans/web-auth 0.1.18-rc.2 → 0.1.18-rc.20

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/web-auth",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.505Z",
+  "version": "0.1.18-rc.20",
+  "generatedAt": "2026-09-01T12:30:48.601Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-auth/SKILL.md

@@ -8,7 +8,7 @@ user-invocable: false
 # @owlmeans/web-auth
 
 **Layer:** Web
-**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.20"` in `dependencies`
 
 Web-side auth UI plugins that register into the shared `@owlmeans/client-auth/manager` plugin registry
 (mirrors `@owlmeans/web-oidc-rp`). Currently ships the **PK-based supervisor** login form.
@@ -29,8 +29,19 @@ Web-side auth UI plugins that register into the shared `@owlmeans/client-auth/ma
 ```ts
 import { appendSupervisorAuth } from '@owlmeans/web-auth'
 // in your web client makeContext():
-appendSupervisorAuth(context) // enabled in development only (cfg.debug)
+appendSupervisorAuth(context) // enabled where cfg.debug.supervisor === true
 ```
+
+**It reads `cfg.debug.supervisor`, and deliberately NOT `cfg.debug.all`.** Whole families of
+OwlMeans applications set `debug.all` for reasons that have nothing to do with authentication — a
+Viable-generated target sets it for itself — so gating on it put an operator login on every one of
+them, in production, reachable by anyone who typed the URL. `{ enabled: true }` forces it on for a
+consumer that relied on the old default.
+
+Registering the plugin is not enough to make it OFFERED: `supervisorClientPlugin` carries
+`restricted: true`, so the sign-in screen shows it only where the configuration names it. That is
+what `appendSupervisorAuth` writes into `cfg.security.auth.login.overrides` when it enables the
+plugin — pass `{ offer: false }` to register it without advertising it.
 The form renders at `SUPERVISOR_LOGIN_PATH` via the standard `CAUTHEN_AUTHEN_TYPED` route — no extra
 route registration needed. Test ids: `supervisor-auth-form`, `supervisor-user-id`, `supervisor-pk`,
 `supervisor-submit`, `supervisor-error`.

package/build/append.d.ts

@@ -1,19 +1,28 @@
+import type { CommonConfig } from '@owlmeans/config';
 export interface WebSupervisorAuthOptions {
-    /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
+    /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
     enabled?: boolean;
+    /**
+     * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
+     * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
+     */
+    offer?: boolean;
 }
-/**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
- */
-export declare const appendSupervisorAuth: <T extends {
+interface DebugCarrier {
     cfg: {
         debug?: {
             all?: boolean;
             supervisor?: boolean;
         };
+        security?: CommonConfig['security'];
     };
-}>(context: T, opts?: WebSupervisorAuthOptions) => T;
+}
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
+ */
+export declare const appendSupervisorAuth: <T extends DebugCarrier>(context: T, opts?: WebSupervisorAuthOptions) => T;
+export {};
 //# sourceMappingURL=append.d.ts.map

package/build/append.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,wBAAwB;IACvC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAKD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS;IAAE,GAAG,EAAE;QAAE,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,WAChG,CAAC,SAAS,wBAAwB,KAC1C,CASF,CAAA"}
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAGpD,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,UAAU,YAAY;IACpB,GAAG,EAAE;QACH,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,CAAA;KACpC,CAAA;CACF;AAcD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,YAAY,WAChD,CAAC,SAAS,wBAAwB,KAC1C,CAoBF,CAAA"}

package/build/append.js

@@ -1,19 +1,38 @@
 import { AuthenticationType } from '@owlmeans/auth';
 import { plugins as authPlugins } from '@owlmeans/client-auth/manager';
 import { supervisorClientPlugin } from './auth/plugins/supervisor.js';
-const isDevelopment = (context) => context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true;
 /**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ * Whether this deployment wants the PK supervisor login.
+ *
+ * Reads `debug.supervisor` and deliberately NOT `debug.all`. `debug.all` is set by whole families
+ * of applications for reasons that have nothing to do with authentication — a generated target
+ * application sets it for itself — so gating on it hands an operator login to every one of them,
+ * in production, reachable by anyone who types the URL. `debug.supervisor` is a deployment saying
+ * this specific thing on purpose.
+ */
+const isSupervised = (context) => context.cfg.debug?.supervisor === true;
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
  */
 export const appendSupervisorAuth = (context, opts) => {
-    const enabled = opts?.enabled ?? isDevelopment(context);
+    const enabled = opts?.enabled ?? isSupervised(context);
     if (!enabled) {
         return context;
     }
     authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin;
+    if (opts?.offer ?? true) {
+        const cfg = context.cfg;
+        cfg.security ??= {};
+        cfg.security.auth ??= {};
+        cfg.security.auth.login ??= {};
+        const login = cfg.security.auth.login;
+        login.secretKey ??= true;
+        login.overrides ??= {};
+        login.overrides[AuthenticationType.Supervisor] ??= { enabled: true };
+    }
     return context;
 };
 //# sourceMappingURL=append.js.map

package/build/append.js.map

@@ -1 +1 @@
-{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAOrE,MAAM,aAAa,GAAG,CAAC,OAAqE,EAAW,EAAE,CACvG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAEtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAmBrE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAW,EAAE,CACtD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAmB,CAAA;QACvC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;QACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAA;QACxB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAA;QACrC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAA;QACxB,KAAK,CAAC,SAAS,KAAK,EAAE,CAAA;QACtB,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACtE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/auth/plugins/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAWjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAsEpC,CAAA"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAWjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBA2EpC,CAAA"}

package/build/auth/plugins/supervisor.js

@@ -20,6 +20,10 @@ import { createIdOfLength } from '@owlmeans/basic-ids';
  */
 export const supervisorClientPlugin = {
     type: AuthenticationType.Supervisor,
+    // `restricted`, so registering the plugin is not enough to put an operator login on the sign-in
+    // screen of a production application — the configuration has to name it. Last in the order and
+    // rendered as a link, because it is a tool, not a way in.
+    method: { order: 900, icon: 'key', emphasis: 'link', restricted: true },
     Implementation: () => ({ type, control }) => {
         const context = useContext();
         const [userId, setUserId] = useState('');

package/build/auth/plugins/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAiB,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;gBACvF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;YAC1D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,gGAAgG;IAChG,+FAA+F;IAC/F,0DAA0D;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAiB,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;gBACvF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;YAC1D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-auth",
-  "version": "0.1.18-rc.2",
+  "version": "0.1.18-rc.20",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,21 +29,22 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.2",
-    "@owlmeans/auth-common": "^0.1.18-rc.2",
-    "@owlmeans/basic-ids": "^0.1.18-rc.2",
-    "@owlmeans/basic-keys": "^0.1.18-rc.2",
-    "@owlmeans/client": "^0.1.18-rc.2",
-    "@owlmeans/client-auth": "^0.1.18-rc.2",
-    "@owlmeans/context": "^0.1.18-rc.2",
-    "@owlmeans/web-client": "^0.1.18-rc.2"
+    "@owlmeans/auth": "^0.1.18-rc.7",
+    "@owlmeans/auth-common": "^0.1.18-rc.9",
+    "@owlmeans/basic-ids": "^0.1.18-rc.7",
+    "@owlmeans/basic-keys": "^0.1.18-rc.9",
+    "@owlmeans/client": "^0.1.18-rc.11",
+    "@owlmeans/client-auth": "^0.1.18-rc.13",
+    "@owlmeans/config": "^0.1.18-rc.8",
+    "@owlmeans/context": "^0.1.18-rc.6",
+    "@owlmeans/web-client": "^0.1.18-rc.18"
   },
   "peerDependencies": {
     "react": "*"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.3.14",
+    "@types/bun": "^1.4.0",
     "@types/react": "^19.2.17",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/append.ts

@@ -1,30 +1,63 @@
 import { AuthenticationType } from '@owlmeans/auth'
 import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import type { CommonConfig } from '@owlmeans/config'
 import { supervisorClientPlugin } from './auth/plugins/supervisor.js'
 
 export interface WebSupervisorAuthOptions {
-  /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
+  /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
   enabled?: boolean
+  /**
+   * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
+   * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
+   */
+  offer?: boolean
 }
 
-const isDevelopment = (context: { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }): boolean =>
-  context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true
+interface DebugCarrier {
+  cfg: {
+    debug?: { all?: boolean, supervisor?: boolean }
+    security?: CommonConfig['security']
+  }
+}
 
 /**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ * Whether this deployment wants the PK supervisor login.
+ *
+ * Reads `debug.supervisor` and deliberately NOT `debug.all`. `debug.all` is set by whole families
+ * of applications for reasons that have nothing to do with authentication — a generated target
+ * application sets it for itself — so gating on it hands an operator login to every one of them,
+ * in production, reachable by anyone who types the URL. `debug.supervisor` is a deployment saying
+ * this specific thing on purpose.
  */
-export const appendSupervisorAuth = <T extends { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }>(
+const isSupervised = (context: DebugCarrier): boolean =>
+  context.cfg.debug?.supervisor === true
+
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
+ */
+export const appendSupervisorAuth = <T extends DebugCarrier>(
   context: T, opts?: WebSupervisorAuthOptions
 ): T => {
-  const enabled = opts?.enabled ?? isDevelopment(context)
+  const enabled = opts?.enabled ?? isSupervised(context)
   if (!enabled) {
     return context
   }
 
   authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin
 
+  if (opts?.offer ?? true) {
+    const cfg = context.cfg as CommonConfig
+    cfg.security ??= {}
+    cfg.security.auth ??= {}
+    cfg.security.auth.login ??= {}
+    const login = cfg.security.auth.login
+    login.secretKey ??= true
+    login.overrides ??= {}
+    login.overrides[AuthenticationType.Supervisor] ??= { enabled: true }
+  }
+
   return context
 }

package/src/auth/plugins/supervisor.tsx

@@ -26,6 +26,11 @@ import { createIdOfLength } from '@owlmeans/basic-ids'
 export const supervisorClientPlugin: AuthenticationPlugin = {
   type: AuthenticationType.Supervisor,
 
+  // `restricted`, so registering the plugin is not enough to put an operator login on the sign-in
+  // screen of a production application — the configuration has to name it. Last in the order and
+  // rendered as a link, because it is a tool, not a way in.
+  method: { order: 900, icon: 'key', emphasis: 'link', restricted: true },
+
   Implementation: () => ({ type, control }) => {
     const context = useContext()
     const [userId, setUserId] = useState('')