@owlmeans/web-auth 0.1.18-rc.6 → 0.1.18-rc.60

package/README.md

@@ -6,7 +6,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.47
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/web-auth",
-  "version": "0.1.18-rc.6",
-  "generatedAt": "2026-08-18T14:48:00.517Z",
+  "version": "0.1.18-rc.60",
+  "generatedAt": "2026-10-03T20:05:07.592Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/web-auth/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: web-auth
-description: How to use @owlmeans/web-auth — web client auth plugins that register into @owlmeans/client-auth/manager. Currently ships the development-only PK-based supervisor login form (appendSupervisorAuth). Auto-invoked when importing @owlmeans/web-auth.
+description: How to use @owlmeans/web-auth — web-side authentication-plugin package that registers into the shared @owlmeans/client-auth/manager registry. It ships the development-only PK supervisor login form (appendSupervisorAuth, supervisorClientPlugin, SUPERVISOR_LOGIN_PATH). Auto-invoked when importing @owlmeans/web-auth or wiring the supervisor login into a web client.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,35 +8,64 @@ user-invocable: false
 # @owlmeans/web-auth
 
 **Layer:** Web
-**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.6"` in `dependencies`
+**Install:** `"@owlmeans/web-auth": "^0.1.18-rc.60"` in `dependencies`
 
-Web-side auth UI plugins that register into the shared `@owlmeans/client-auth/manager` plugin registry
-(mirrors `@owlmeans/web-oidc-rp`). Currently ships the **PK-based supervisor** login form.
+Web-side auth UI plugins registering into the shared `@owlmeans/client-auth/manager` plugin registry
+(mirroring `@owlmeans/web-oidc-rp`). It ships the **PK supervisor** login form.
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `appendSupervisorAuth(context, opts?)` | Dev-only: register the supervisor login form plugin |
-| `SUPERVISOR_LOGIN_PATH` | `/authentication/login/pk-supervisor` (the typed-route path) |
-| `supervisorClientPlugin` | The client `AuthenticationPlugin` (self-contained form) |
+| `appendSupervisorAuth(context, opts?)` | Register the supervisor login plugin and, unless told otherwise, offer it on the sign-in screen |
+| `WebSupervisorAuthOptions` | `{ enabled?, offer? }` |
+| `SUPERVISOR_LOGIN_PATH` | `/authentication/login/pk-supervisor` — the typed-route path |
+| `supervisorClientPlugin` | The client `AuthenticationPlugin`: a self-contained form that signs the server challenge and hands the packed credential to the standard auth control |
 
 ## Subpath Exports
-- `./auth/plugins` — side-effect import that always-registers the supervisor plugin
-  (`import '@owlmeans/web-auth/auth/plugins'`). Prefer the dev-gated `appendSupervisorAuth`.
+
+- `./auth/plugins` — a side-effect import that always registers the supervisor plugin
+  (`import '@owlmeans/web-auth/auth/plugins'`). Prefer the gated `appendSupervisorAuth`.
 
 ## Usage
+
 ```ts
 import { appendSupervisorAuth } from '@owlmeans/web-auth'
-// in your web client makeContext():
-appendSupervisorAuth(context) // enabled in development only (cfg.debug)
+
+// in the web client's makeContext():
+appendSupervisorAuth(context)
 ```
-The form renders at `SUPERVISOR_LOGIN_PATH` via the standard `CAUTHEN_AUTHEN_TYPED` route — no extra
-route registration needed. Test ids: `supervisor-auth-form`, `supervisor-user-id`, `supervisor-pk`,
-`supervisor-submit`, `supervisor-error`.
 
-See the **supervisor-auth** skill for the full feature (server append, options, security, test helpers).
+**It reads `cfg.debug.supervisor`, and deliberately NOT `cfg.debug.all`.** Whole families of
+OwlMeans applications set `debug.all` for reasons that have nothing to do with authentication — a
+Viable-generated target sets it for itself — so gating on it would put an operator login on every
+one of them, in production, reachable by anyone who typed the URL. Pass `{ enabled: true }` to force
+it on regardless of the debug flags.
+
+Registering the plugin is not enough to make it OFFERED: `supervisorClientPlugin` carries
+`restricted: true`, so the sign-in screen shows it only where the configuration names it. That is
+what `appendSupervisorAuth` writes into `cfg.security.auth.login.overrides` (and
+`login.secretKey`) when it enables the plugin — pass `{ offer: false }` to register it without
+advertising it.
+
+The form renders at `SUPERVISOR_LOGIN_PATH` through the standard `CAUTHEN_AUTHEN_TYPED` route, so
+no extra route registration is needed. It orders itself last (`order: 900`) and renders as a link,
+because it is a tool rather than a way in. Test ids: `supervisor-auth-form`, `supervisor-user-id`,
+`supervisor-pk`, `supervisor-submit`, `supervisor-error`.
+
+On submit the form requests a fresh allowance, signs `buildSupervisorPayload(challenge, userId,
+salt)` with the entered private key, packs `{ salt, signature }` as the credential, exchanges the
+resulting token through the client `AuthService`, and navigates via `landAfterLogin` +
+`landingUrl` (`@owlmeans/client-auth/login`) — a pending post-login step, then a screen suspended
+in `@owlmeans/client-flow` (an OAuth consent screen reached signed out, say), else `HOME`. It no
+longer imports `@owlmeans/client-flow` or `@owlmeans/web-client` directly; `landAfterLogin` is the
+whole decision.
+
+See the **supervisor-auth** skill for the whole feature — the server append, its options, the
+security boundary and the `@owlmeans/test-ui` helpers.
 
 ## Depends On
-- `@owlmeans/client-auth`, `@owlmeans/web-client`, `@owlmeans/client`
-- `@owlmeans/auth` (type + `buildSupervisorPayload`), `@owlmeans/basic-keys`, `@owlmeans/basic-ids`
+- `@owlmeans/client-auth` (the manager plugin registry), `@owlmeans/web-client`, `@owlmeans/client`
+- `@owlmeans/auth` — `AuthenticationType.Supervisor`, `buildSupervisorPayload`
+- `@owlmeans/auth-common` — the client `AuthService` type
+- `@owlmeans/basic-keys` (signing), `@owlmeans/basic-ids` (the salt), `@owlmeans/config`

package/build/append.d.ts

@@ -1,19 +1,28 @@
+import type { CommonConfig } from '@owlmeans/config';
 export interface WebSupervisorAuthOptions {
-    /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
+    /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
     enabled?: boolean;
+    /**
+     * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
+     * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
+     */
+    offer?: boolean;
 }
-/**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
- */
-export declare const appendSupervisorAuth: <T extends {
+interface DebugCarrier {
     cfg: {
         debug?: {
             all?: boolean;
             supervisor?: boolean;
         };
+        security?: CommonConfig['security'];
     };
-}>(context: T, opts?: WebSupervisorAuthOptions) => T;
+}
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
+ */
+export declare const appendSupervisorAuth: <T extends DebugCarrier>(context: T, opts?: WebSupervisorAuthOptions) => T;
+export {};
 //# sourceMappingURL=append.d.ts.map

package/build/append.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,wBAAwB;IACvC,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAKD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS;IAAE,GAAG,EAAE;QAAE,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,WAChG,CAAC,SAAS,wBAAwB,KAC1C,CASF,CAAA"}
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAGpD,MAAM,WAAW,wBAAwB;IACvC,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,UAAU,YAAY;IACpB,GAAG,EAAE;QACH,KAAK,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;QAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,CAAA;KACpC,CAAA;CACF;AAcD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,YAAY,WAChD,CAAC,SAAS,wBAAwB,KAC1C,CAoBF,CAAA"}

package/build/append.js

@@ -1,19 +1,38 @@
 import { AuthenticationType } from '@owlmeans/auth';
 import { plugins as authPlugins } from '@owlmeans/client-auth/manager';
 import { supervisorClientPlugin } from './auth/plugins/supervisor.js';
-const isDevelopment = (context) => context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true;
 /**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ * Whether this deployment wants the PK supervisor login.
+ *
+ * Reads `debug.supervisor` and deliberately NOT `debug.all`. `debug.all` is set by whole families
+ * of applications for reasons that have nothing to do with authentication — a generated target
+ * application sets it for itself — so gating on it hands an operator login to every one of them,
+ * in production, reachable by anyone who types the URL. `debug.supervisor` is a deployment saying
+ * this specific thing on purpose.
+ */
+const isSupervised = (context) => context.cfg.debug?.supervisor === true;
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
  */
 export const appendSupervisorAuth = (context, opts) => {
-    const enabled = opts?.enabled ?? isDevelopment(context);
+    const enabled = opts?.enabled ?? isSupervised(context);
     if (!enabled) {
         return context;
     }
     authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin;
+    if (opts?.offer ?? true) {
+        const cfg = context.cfg;
+        cfg.security ??= {};
+        cfg.security.auth ??= {};
+        cfg.security.auth.login ??= {};
+        const login = cfg.security.auth.login;
+        login.secretKey ??= true;
+        login.overrides ??= {};
+        login.overrides[AuthenticationType.Supervisor] ??= { enabled: true };
+    }
     return context;
 };
 //# sourceMappingURL=append.js.map

package/build/append.js.map

@@ -1 +1 @@
-{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAOrE,MAAM,aAAa,GAAG,CAAC,OAAqE,EAAW,EAAE,CACvG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../src/append.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAEtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAmBrE;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAW,EAAE,CACtD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,OAAU,EAAE,IAA+B,EACxC,EAAE;IACL,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,sBAAsB,CAAA;IAEnE,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAmB,CAAA;QACvC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAA;QACnB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAA;QACxB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAA;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAA;QACrC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAA;QACxB,KAAK,CAAC,SAAS,KAAK,EAAE,CAAA;QACtB,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACtE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/build/auth/plugins/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAWjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAsEpC,CAAA"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAUjF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBA8EpC,CAAA"}

package/build/auth/plugins/supervisor.js

@@ -3,7 +3,7 @@ import { useState } from 'react';
 import { AuthenticationType, buildSupervisorPayload } from '@owlmeans/auth';
 import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth';
 import { useContext } from '@owlmeans/client';
-import { HOME } from '@owlmeans/web-client';
+import { landAfterLogin, landingUrl } from '@owlmeans/client-auth/login';
 import { makeKeyPairModel } from '@owlmeans/basic-keys';
 import { createIdOfLength } from '@owlmeans/basic-ids';
 /**
@@ -20,6 +20,10 @@ import { createIdOfLength } from '@owlmeans/basic-ids';
  */
 export const supervisorClientPlugin = {
     type: AuthenticationType.Supervisor,
+    // `restricted`, so registering the plugin is not enough to put an operator login on the sign-in
+    // screen of a production application — the configuration has to name it. Last in the order and
+    // rendered as a link, because it is a tool, not a way in.
+    method: { order: 900, icon: 'key', emphasis: 'link', restricted: true },
     Implementation: () => ({ type, control }) => {
         const context = useContext();
         const [userId, setUserId] = useState('');
@@ -39,8 +43,11 @@ export const supervisorClientPlugin = {
                     const authService = context.service(AUTH_SERVICE);
                     await authService.authenticate(token);
                 }
-                const [homeUrl] = await context.module(HOME).call({ full: true }) ?? [];
-                window.location.href = homeUrl ?? window.location.origin;
+                // A registered step (marketing consent, say) or a device/authorization-code consent
+                // screen that suspended itself here before sending the browser to sign in both take
+                // priority over the app's own home — `landAfterLogin` is the whole decision.
+                const landing = await landAfterLogin(context);
+                window.location.href = await landingUrl(context, landing);
             }
             catch (e) {
                 setError(e instanceof Error ? e.message : String(e));

package/build/auth/plugins/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAiB,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,CAAA;gBACvF,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;YAC1D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../../src/auth/plugins/supervisor.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAGhC,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAE3E,OAAO,EAAE,aAAa,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB;IAC1D,IAAI,EAAE,kBAAkB,CAAC,UAAU;IAEnC,gGAAgG;IAChG,+FAA+F;IAC/F,0DAA0D;IAC1D,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAEvE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAA;QAC5B,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;QACvD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAgB,EAAE,EAAE;YAC1C,KAAK,CAAC,cAAc,EAAE,CAAA;YACtB,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;YACb,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;gBAExC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAA;gBAEpE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;oBAC9D,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;gBACvC,CAAC;gBAED,oFAAoF;gBACpF,oFAAoF;gBACpF,6EAA6E;gBAC7E,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;gBAC7C,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpD,OAAO,CAAC,KAAK,CAAC,CAAA;YAChB,CAAC;QACH,CAAC,CAAA;QAED,OAAO,CACL,gBAAM,QAAQ,EAAE,QAAQ,iBAAc,sBAAsB,EAC1D,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,aAC7F,4DAAyC,EACzC,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,gCAEhE,gBAAO,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,MAAM,iBACnD,oBAAoB,EAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IACjD,EACR,iBAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,4BAEhE,gBAAO,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,UAAU,EAAC,YAAY,EAAC,KAAK,EAAC,KAAK,EAAE,EAAE,iBAC/C,eAAe,EAC3B,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,SAAG,IAC7C,EACR,iBAAQ,IAAI,EAAC,QAAQ,iBAAa,mBAAmB,EAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAC/F,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,GACxC,EACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,YAAG,IAAI,EAAC,OAAO,iBAAa,kBAAkB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,YAAG,KAAK,GAAK,CAAC,CAAC,CAAC,IAAI,IAC1G,CACR,CAAA;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,YAAY,EAAE,KAAK,EAAE,WAAW,EAAsB,EAAE;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAC/G,WAAW,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5D,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACtB,CAAC;CACF,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-auth",
-  "version": "0.1.18-rc.6",
+  "version": "0.1.18-rc.60",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -29,21 +29,23 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.6",
-    "@owlmeans/auth-common": "^0.1.18-rc.6",
-    "@owlmeans/basic-ids": "^0.1.18-rc.6",
-    "@owlmeans/basic-keys": "^0.1.18-rc.6",
-    "@owlmeans/client": "^0.1.18-rc.6",
-    "@owlmeans/client-auth": "^0.1.18-rc.6",
-    "@owlmeans/context": "^0.1.18-rc.6",
-    "@owlmeans/web-client": "^0.1.18-rc.6"
+    "@owlmeans/auth": "^0.1.18-rc.38",
+    "@owlmeans/auth-common": "^0.1.18-rc.45",
+    "@owlmeans/basic-ids": "^0.1.18-rc.35",
+    "@owlmeans/basic-keys": "^0.1.18-rc.46",
+    "@owlmeans/client": "^0.1.18-rc.49",
+    "@owlmeans/client-auth": "^0.1.18-rc.56",
+    "@owlmeans/client-flow": "^0.1.18-rc.52",
+    "@owlmeans/config": "^0.1.18-rc.42",
+    "@owlmeans/context": "^0.1.18-rc.32",
+    "@owlmeans/web-client": "^0.1.18-rc.59"
   },
   "peerDependencies": {
     "react": "*"
   },
   "devDependencies": {
     "@owlmeans/dep-config": "workspace:*",
-    "@types/bun": "^1.3.14",
+    "@types/bun": "^1.4.0",
     "@types/react": "^19.2.17",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/append.ts

@@ -1,30 +1,63 @@
 import { AuthenticationType } from '@owlmeans/auth'
 import { plugins as authPlugins } from '@owlmeans/client-auth/manager'
+import type { CommonConfig } from '@owlmeans/config'
 import { supervisorClientPlugin } from './auth/plugins/supervisor.js'
 
 export interface WebSupervisorAuthOptions {
-  /** Force enable/disable. Default: development only (cfg.debug.all || cfg.debug.supervisor). */
+  /** Force enable/disable. Default: `cfg.debug.supervisor === true`. */
   enabled?: boolean
+  /**
+   * Also offer it on the sign-in screen. Defaults to true — an operator login that is registered
+   * but reachable only by typing its URL is a login nobody finds and an exposure nobody sees.
+   */
+  offer?: boolean
 }
 
-const isDevelopment = (context: { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }): boolean =>
-  context.cfg.debug?.all === true || context.cfg.debug?.supervisor === true
+interface DebugCarrier {
+  cfg: {
+    debug?: { all?: boolean, supervisor?: boolean }
+    security?: CommonConfig['security']
+  }
+}
 
 /**
- * Unified, explicit append for the PK-based supervisor login UI. Call it once on
- * the web client context. Development-only by default. It registers the
- * supervisor client plugin so the form is rendered by the standard typed
- * authentication route at {@link SUPERVISOR_LOGIN_PATH}.
+ * Whether this deployment wants the PK supervisor login.
+ *
+ * Reads `debug.supervisor` and deliberately NOT `debug.all`. `debug.all` is set by whole families
+ * of applications for reasons that have nothing to do with authentication — a generated target
+ * application sets it for itself — so gating on it hands an operator login to every one of them,
+ * in production, reachable by anyone who types the URL. `debug.supervisor` is a deployment saying
+ * this specific thing on purpose.
  */
-export const appendSupervisorAuth = <T extends { cfg: { debug?: { all?: boolean, supervisor?: boolean } } }>(
+const isSupervised = (context: DebugCarrier): boolean =>
+  context.cfg.debug?.supervisor === true
+
+/**
+ * Unified, explicit append for the PK-based supervisor login UI. Call it once on the web client
+ * context. It registers the supervisor client plugin so the form is rendered by the standard typed
+ * authentication route at {@link SUPERVISOR_LOGIN_PATH}, and enables it in the sign-in screen's
+ * configuration — which is what turns a `restricted` method from registered into offerable.
+ */
+export const appendSupervisorAuth = <T extends DebugCarrier>(
   context: T, opts?: WebSupervisorAuthOptions
 ): T => {
-  const enabled = opts?.enabled ?? isDevelopment(context)
+  const enabled = opts?.enabled ?? isSupervised(context)
   if (!enabled) {
     return context
   }
 
   authPlugins[AuthenticationType.Supervisor] = supervisorClientPlugin
 
+  if (opts?.offer ?? true) {
+    const cfg = context.cfg as CommonConfig
+    cfg.security ??= {}
+    cfg.security.auth ??= {}
+    cfg.security.auth.login ??= {}
+    const login = cfg.security.auth.login
+    login.secretKey ??= true
+    login.overrides ??= {}
+    login.overrides[AuthenticationType.Supervisor] ??= { enabled: true }
+  }
+
   return context
 }

package/src/auth/plugins/supervisor.tsx

@@ -6,8 +6,7 @@ import type { AuthToken } from '@owlmeans/auth'
 import { DEFAULT_ALIAS as AUTH_SERVICE } from '@owlmeans/client-auth'
 import type { AuthService } from '@owlmeans/auth-common'
 import { useContext } from '@owlmeans/client'
-import { HOME } from '@owlmeans/web-client'
-import type { Module } from '@owlmeans/web-client'
+import { landAfterLogin, landingUrl } from '@owlmeans/client-auth/login'
 import { makeKeyPairModel } from '@owlmeans/basic-keys'
 import { createIdOfLength } from '@owlmeans/basic-ids'
 
@@ -26,6 +25,11 @@ import { createIdOfLength } from '@owlmeans/basic-ids'
 export const supervisorClientPlugin: AuthenticationPlugin = {
   type: AuthenticationType.Supervisor,
 
+  // `restricted`, so registering the plugin is not enough to put an operator login on the sign-in
+  // screen of a production application — the configuration has to name it. Last in the order and
+  // rendered as a link, because it is a tool, not a way in.
+  method: { order: 900, icon: 'key', emphasis: 'link', restricted: true },
+
   Implementation: () => ({ type, control }) => {
     const context = useContext()
     const [userId, setUserId] = useState('')
@@ -49,8 +53,11 @@ export const supervisorClientPlugin: AuthenticationPlugin = {
           await authService.authenticate(token)
         }
 
-        const [homeUrl] = await context.module<Module<string>>(HOME).call({ full: true }) ?? []
-        window.location.href = homeUrl ?? window.location.origin
+        // A registered step (marketing consent, say) or a device/authorization-code consent
+        // screen that suspended itself here before sending the browser to sign in both take
+        // priority over the app's own home — `landAfterLogin` is the whole decision.
+        const landing = await landAfterLogin(context)
+        window.location.href = await landingUrl(context, landing)
       } catch (e) {
         setError(e instanceof Error ? e.message : String(e))
         setBusy(false)