@owlmeans/web-auth 0.1.18-rc.23 → 0.1.18-rc.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README.md +1 -1
  2. package/agent-meta/manifest.json +2 -2
  3. package/agent-meta/skills/web-auth/SKILL.md +36 -22
  4. package/build/append.d.ts.map +1 -1
  5. package/package.json +10 -10
package/README.md CHANGED
@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
6
6
  your project's skill store (`.agents/skills/`):
7
7
 
8
8
  ```sh
9
- npx @owlmeans/agent-skills
9
+ npx @owlmeans/agent-skills@^0.1.18-rc.12
10
10
  ```
11
11
 
12
12
  The embedded files are version-matched to this package release. Do not edit them
package/agent-meta/manifest.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "schemaVersion": 2,
3
3
  "package": "@owlmeans/web-auth",
4
- "version": "0.1.18-rc.23",
5
- "generatedAt": "2026-09-01T17:39:40.762Z",
4
+ "version": "0.1.18-rc.24",
5
+ "generatedAt": "2026-09-04T22:43:25.441Z",
6
6
  "canonicalRepo": "https://github.com/owlmeans/common",
7
7
  "entries": [
8
8
  {
package/agent-meta/skills/web-auth/SKILL.md CHANGED
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: web-auth
3
- description: How to use @owlmeans/web-auth — web client auth plugins that register into @owlmeans/client-auth/manager. Currently ships the development-only PK-based supervisor login form (appendSupervisorAuth). Auto-invoked when importing @owlmeans/web-auth.
3
+ description: How to use @owlmeans/web-auth — web-side authentication-plugin package that registers into the shared @owlmeans/client-auth/manager registry. It ships the development-only PK supervisor login form (appendSupervisorAuth, supervisorClientPlugin, SUPERVISOR_LOGIN_PATH). Auto-invoked when importing @owlmeans/web-auth or wiring the supervisor login into a web client.
4
4
  user-invocable: false
5
5
  ---
6
6
  <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,46 +8,60 @@ user-invocable: false
8
8
  # @owlmeans/web-auth
9
9
 
10
10
  **Layer:** Web
11
- **Install:** `"@owlmeans/web-auth": "^0.1.18-rc.23"` in `dependencies`
11
+ **Install:** `"@owlmeans/web-auth": "^0.1.18-rc.24"` in `dependencies`
12
12
 
13
- Web-side auth UI plugins that register into the shared `@owlmeans/client-auth/manager` plugin registry
14
- (mirrors `@owlmeans/web-oidc-rp`). Currently ships the **PK-based supervisor** login form.
13
+ Web-side auth UI plugins registering into the shared `@owlmeans/client-auth/manager` plugin registry
14
+ (mirroring `@owlmeans/web-oidc-rp`). It ships the **PK supervisor** login form.
15
15
 
16
16
  ## Key Exports
17
17
 
18
18
  | Export | Description |
19
19
  |--------|-------------|
20
- | `appendSupervisorAuth(context, opts?)` | Dev-only: register the supervisor login form plugin |
21
- | `SUPERVISOR_LOGIN_PATH` | `/authentication/login/pk-supervisor` (the typed-route path) |
22
- | `supervisorClientPlugin` | The client `AuthenticationPlugin` (self-contained form) |
20
+ | `appendSupervisorAuth(context, opts?)` | Register the supervisor login plugin and, unless told otherwise, offer it on the sign-in screen |
21
+ | `WebSupervisorAuthOptions` | `{ enabled?, offer? }` |
22
+ | `SUPERVISOR_LOGIN_PATH` | `/authentication/login/pk-supervisor` — the typed-route path |
23
+ | `supervisorClientPlugin` | The client `AuthenticationPlugin`: a self-contained form that signs the server challenge and hands the packed credential to the standard auth control |
23
24
 
24
25
  ## Subpath Exports
25
- - `./auth/plugins` — side-effect import that always-registers the supervisor plugin
26
- (`import '@owlmeans/web-auth/auth/plugins'`). Prefer the dev-gated `appendSupervisorAuth`.
26
+
27
+ - `./auth/plugins` — a side-effect import that always registers the supervisor plugin
28
+ (`import '@owlmeans/web-auth/auth/plugins'`). Prefer the gated `appendSupervisorAuth`.
27
29
 
28
30
  ## Usage
31
+
29
32
  ```ts
30
33
  import { appendSupervisorAuth } from '@owlmeans/web-auth'
31
- // in your web client makeContext():
32
- appendSupervisorAuth(context) // enabled where cfg.debug.supervisor === true
34
+
35
+ // in the web client's makeContext():
36
+ appendSupervisorAuth(context)
33
37
  ```
34
38
 
35
39
  **It reads `cfg.debug.supervisor`, and deliberately NOT `cfg.debug.all`.** Whole families of
36
40
  OwlMeans applications set `debug.all` for reasons that have nothing to do with authentication — a
37
- Viable-generated target sets it for itself — so gating on it put an operator login on every one of
38
- them, in production, reachable by anyone who typed the URL. `{ enabled: true }` forces it on for a
39
- consumer that relied on the old default.
41
+ Viable-generated target sets it for itself — so gating on it would put an operator login on every
42
+ one of them, in production, reachable by anyone who typed the URL. Pass `{ enabled: true }` to force
43
+ it on regardless of the debug flags.
40
44
 
41
45
  Registering the plugin is not enough to make it OFFERED: `supervisorClientPlugin` carries
42
46
  `restricted: true`, so the sign-in screen shows it only where the configuration names it. That is
43
- what `appendSupervisorAuth` writes into `cfg.security.auth.login.overrides` when it enables the
44
- plugin — pass `{ offer: false }` to register it without advertising it.
45
- The form renders at `SUPERVISOR_LOGIN_PATH` via the standard `CAUTHEN_AUTHEN_TYPED` route — no extra
46
- route registration needed. Test ids: `supervisor-auth-form`, `supervisor-user-id`, `supervisor-pk`,
47
- `supervisor-submit`, `supervisor-error`.
47
+ what `appendSupervisorAuth` writes into `cfg.security.auth.login.overrides` (and
48
+ `login.secretKey`) when it enables the plugin — pass `{ offer: false }` to register it without
49
+ advertising it.
50
+
51
+ The form renders at `SUPERVISOR_LOGIN_PATH` through the standard `CAUTHEN_AUTHEN_TYPED` route, so
52
+ no extra route registration is needed. It orders itself last (`order: 900`) and renders as a link,
53
+ because it is a tool rather than a way in. Test ids: `supervisor-auth-form`, `supervisor-user-id`,
54
+ `supervisor-pk`, `supervisor-submit`, `supervisor-error`.
55
+
56
+ On submit the form requests a fresh allowance, signs `buildSupervisorPayload(challenge, userId,
57
+ salt)` with the entered private key, packs `{ salt, signature }` as the credential, exchanges the
58
+ resulting token through the client `AuthService`, and navigates to `HOME`.
48
59
 
49
- See the **supervisor-auth** skill for the full feature (server append, options, security, test helpers).
60
+ See the **supervisor-auth** skill for the whole feature — the server append, its options, the
61
+ security boundary and the `@owlmeans/test-ui` helpers.
50
62
 
51
63
  ## Depends On
52
- - `@owlmeans/client-auth`, `@owlmeans/web-client`, `@owlmeans/client`
53
- - `@owlmeans/auth` (type + `buildSupervisorPayload`), `@owlmeans/basic-keys`, `@owlmeans/basic-ids`
64
+ - `@owlmeans/client-auth` (the manager plugin registry), `@owlmeans/web-client`, `@owlmeans/client`
65
+ - `@owlmeans/auth` — `AuthenticationType.Supervisor`, `buildSupervisorPayload`
66
+ - `@owlmeans/auth-common` — the client `AuthService` type
67
+ - `@owlmeans/basic-keys` (signing), `@owlmeans/basic-ids` (the salt), `@owlmeans/config`
package/build/append.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAGpD,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,UAAU,YAAY;IACpB,GAAG,EAAE;QACH,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,CAAA;KACpC,CAAA;CACF;AAcD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,YAAY,EACzD,SAAS,CAAC,EAAE,OAAO,wBAAwB,KAC1C,CAoBF,CAAA"}
1
+ {"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAGpD,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,UAAU,YAAY;IACpB,GAAG,EAAE;QACH,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,CAAA;KACpC,CAAA;CACF;AAcD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,YAAY,WAChD,CAAC,SAAS,wBAAwB,KAC1C,CAoBF,CAAA"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@owlmeans/web-auth",
3
- "version": "0.1.18-rc.23",
3
+ "version": "0.1.18-rc.24",
4
4
  "license": "MIT",
5
5
  "type": "module",
6
6
  "scripts": {
@@ -29,15 +29,15 @@
29
29
  }
30
30
  },
31
31
  "dependencies": {
32
- "@owlmeans/auth": "^0.1.18-rc.8",
33
- "@owlmeans/auth-common": "^0.1.18-rc.12",
34
- "@owlmeans/basic-ids": "^0.1.18-rc.8",
35
- "@owlmeans/basic-keys": "^0.1.18-rc.11",
36
- "@owlmeans/client": "^0.1.18-rc.15",
37
- "@owlmeans/client-auth": "^0.1.18-rc.19",
38
- "@owlmeans/config": "^0.1.18-rc.11",
39
- "@owlmeans/context": "^0.1.18-rc.7",
40
- "@owlmeans/web-client": "^0.1.18-rc.23"
32
+ "@owlmeans/auth": "^0.1.18-rc.9",
33
+ "@owlmeans/auth-common": "^0.1.18-rc.13",
34
+ "@owlmeans/basic-ids": "^0.1.18-rc.9",
35
+ "@owlmeans/basic-keys": "^0.1.18-rc.12",
36
+ "@owlmeans/client": "^0.1.18-rc.16",
37
+ "@owlmeans/client-auth": "^0.1.18-rc.20",
38
+ "@owlmeans/config": "^0.1.18-rc.12",
39
+ "@owlmeans/context": "^0.1.18-rc.8",
40
+ "@owlmeans/web-client": "^0.1.18-rc.24"
41
41
  },
42
42
  "peerDependencies": {
43
43
  "react": "*"