@rpcbase/auth 0.45.0 → 0.47.0

package/dist/api/sign-in/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-in/handler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAA8B,MAAM,cAAc,CAAA;AAG9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBAgElC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-in/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAA8B,MAAM,cAAc,CAAA;AAG9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBA4DlC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}

package/dist/api/sign-in/index.d.ts

@@ -1,7 +1,7 @@
 import { z } from '../../../../vite/node_modules/zod';
 export declare const Route = "/api/rb/auth/sign-in";
 export declare const requestSchema: z.ZodObject<{
-    email_or_phone: z.ZodDefault<z.ZodString>;
+    email: z.ZodString;
     password: z.ZodString;
     remember_me: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;

package/dist/api/sign-in/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/sign-in/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,KAAK,yBAAyB,CAAA;AAE3C,eAAO,MAAM,aAAa;;;;iBAexB,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAE1D,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/sign-in/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,KAAK,yBAAyB,CAAA;AAE3C,eAAO,MAAM,aAAa;;;;iBAOxB,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAE1D,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA"}

package/dist/api/sign-up/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-up/handler.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAA8B,MAAM,cAAc,CAAA;AAG9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBAwFlC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/sign-up/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAA8B,MAAM,cAAc,CAAA;AAG9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBAgFlC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}

package/dist/api/sign-up/index.d.ts

@@ -1,9 +1,8 @@
 import { z } from '../../../../vite/node_modules/zod';
 export declare const Route = "/api/rb/auth/sign-up";
 export declare const requestSchema: z.ZodObject<{
-    email_or_phone: z.ZodString;
+    email: z.ZodString;
     password: z.ZodString;
-    password_confirmation: z.ZodString;
     remember_me: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type RequestPayload = z.infer<typeof requestSchema>;

package/dist/api/sign-up/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/sign-up/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,KAAK,yBAAyB,CAAA;AAE3C,eAAO,MAAM,aAAa;;;;;iBAoBtB,CAAA;AAEJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAE1D,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/sign-up/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,KAAK,yBAAyB,CAAA;AAE3C,eAAO,MAAM,aAAa;;;;iBAQtB,CAAA;AAEJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAE1D,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA"}

package/dist/api/verify-otp/handler.d.ts

@@ -0,0 +1,5 @@
+import { Api } from '../../../../api/src';
+import { AuthSessionUser } from '../../types';
+declare const _default: (api: Api<AuthSessionUser>) => void;
+export default _default;
+//# sourceMappingURL=handler.d.ts.map

package/dist/api/verify-otp/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/verify-otp/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAA8B,MAAM,cAAc,CAAA;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;yBA0DlC,KAAK,GAAG,CAAC,eAAe,CAAC;AAAzC,wBAEC"}

package/dist/api/verify-otp/index.d.ts

@@ -0,0 +1,16 @@
+import { z } from '../../../../vite/node_modules/zod';
+export declare const Route = "/api/rb/auth/verify-otp";
+export declare const requestSchema: z.ZodObject<{
+    email: z.ZodString;
+    code: z.ZodString;
+    remember_me: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type RequestPayload = z.infer<typeof requestSchema>;
+export declare const responseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    user_id: z.ZodOptional<z.ZodString>;
+    tenant_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ResponsePayload = z.infer<typeof responseSchema>;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/verify-otp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/verify-otp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,KAAK,4BAA4B,CAAA;AAE9C,eAAO,MAAM,aAAa;;;;iBAIxB,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAE1D,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA"}

package/dist/components/{EmailOrPhoneInput → EmailInput}/index.d.ts

@@ -1,4 +1,4 @@
-export declare const EmailOrPhoneInput: ({ id, className, placeholder, }: {
+export declare const EmailInput: ({ id, className, placeholder, }: {
     id: string;
     className?: string;
     placeholder?: string;

package/dist/components/EmailInput/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/EmailInput/index.tsx"],"names":[],"mappings":"AAGA,eAAO,MAAM,UAAU,GAAI,iCAIxB;IACD,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,4CA2BA,CAAA"}

package/dist/components/PasswordInput/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/PasswordInput/index.tsx"],"names":[],"mappings":"AAGA,KAAK,kBAAkB,GAAG;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,qDAM3B,kBAAkB,4CA0BpB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/PasswordInput/index.tsx"],"names":[],"mappings":"AAKA,KAAK,kBAAkB,GAAG;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,qDAM3B,kBAAkB,4CA2CpB,CAAA"}

package/dist/components/SignUpForm/index.d.ts

@@ -1,6 +1,7 @@
 import { ReactNode } from 'react';
-export declare const SignUpForm: ({ children, className }: {
+export declare const SignUpForm: ({ children, className, otpNextPath }: {
     children: ReactNode;
     className?: string;
+    otpNextPath?: string;
 }) => import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=index.d.ts.map

package/dist/components/SignUpForm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/SignUpForm/index.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAC,SAAS,EAAsB,MAAM,OAAO,CAAA;AAWpD,eAAO,MAAM,UAAU,GAAI,yBAGxB;IACD,QAAQ,EAAE,SAAS,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,4CAyEA,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/SignUpForm/index.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAC,SAAS,EAAsB,MAAM,OAAO,CAAA;AAYpD,eAAO,MAAM,UAAU,GAAI,sCAIxB;IACD,QAAQ,EAAE,SAAS,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,4CA8EA,CAAA"}

package/dist/components/index.d.ts

@@ -1,6 +1,6 @@
 export * from './AuthLayout';
 export * from './AppleSignInButton';
-export * from './EmailOrPhoneInput';
+export * from './EmailInput';
 export * from './SignInForm';
 export * from './SignUpForm';
 export * from './RememberMeCheckbox';

package/dist/components/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/components/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,qBAAqB,CAAA;AACnC,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA"}

package/dist/handler-CE4lXc0G.js

@@ -0,0 +1,64 @@
+import crypto from "crypto";
+import { loadModel } from "@rpcbase/api";
+import { hashPassword, sendEmail } from "@rpcbase/server";
+import { R as Route, r as requestSchema } from "./index-DwX0Y2YV.js";
+const signUp = async (payload, ctx) => {
+  const User = await loadModel("User", ctx);
+  const Tenant = await loadModel("Tenant", ctx);
+  const parsed = requestSchema.safeParse(payload);
+  if (!parsed.success) {
+    ctx.res.status(400);
+    return { success: false, error: "invalid_payload" };
+  }
+  const { email, password, remember_me: _remember_me } = parsed.data;
+  const existingUser = await User.findOne({ email });
+  if (existingUser) {
+    console.log("user with email already exists", email);
+    ctx.res.status(409);
+    return { success: false, error: "user_exists" };
+  }
+  const salt = crypto.randomBytes(16).toString("hex");
+  const derivedKey = await hashPassword(password, salt);
+  const hashedPassword = `${salt}:${derivedKey.toString("hex")}`;
+  const tenantId = crypto.randomUUID();
+  const emailVerificationCode = crypto.randomInt(0, 1e6).toString().padStart(6, "0");
+  const emailVerificationExpiresAt = new Date(Date.now() + 10 * 60 * 1e3);
+  const user = new User({
+    email,
+    password: hashedPassword,
+    tenants: [tenantId],
+    email_verification_code: emailVerificationCode,
+    email_verification_expires_at: emailVerificationExpiresAt
+  });
+  await user.save();
+  try {
+    await sendEmail({
+      to: email,
+      subject: `Verify your email: ${emailVerificationCode}`,
+      html: `
+        <p>Welcome to rpcbase!</p>
+        <p>Your verification code is <strong>${emailVerificationCode}</strong>. It expires in 10 minutes.</p>
+        <p>If you didn't request this, you can ignore this message.</p>
+      `,
+      text: `Welcome to rpcbase! Your verification code is ${emailVerificationCode}. It expires in 10 minutes. If you didn't request this, you can ignore this message.`
+    });
+  } catch (err) {
+    console.warn("failed to send sign-up email", err);
+  }
+  try {
+    await Tenant.create({
+      tenant_id: tenantId,
+      name: email
+    });
+  } catch (err) {
+    console.warn("failed to create tenant for user", err);
+  }
+  console.log("created new user", user._id.toString());
+  return { success: true, user_id: user._id.toString(), tenant_id: tenantId };
+};
+const handler = (api) => {
+  api.post(Route, signUp);
+};
+export {
+  handler as default
+};

package/dist/handler-DOnLMd-9.js

@@ -0,0 +1,57 @@
+import { loadModel } from "@rpcbase/api";
+import { o as object, b as boolean, s as string } from "./schemas-KL7REOdt.js";
+const Route = "/api/rb/auth/verify-otp";
+const requestSchema = object({
+  email: string().email(),
+  code: string().length(6, "Code must be 6 digits"),
+  remember_me: boolean().default(true)
+});
+object({
+  success: boolean(),
+  error: string().optional(),
+  user_id: string().optional(),
+  tenant_id: string().optional()
+});
+const verifyOtp = async (payload, ctx) => {
+  const User = await loadModel("User", ctx);
+  const parsed = requestSchema.safeParse(payload);
+  if (!parsed.success) {
+    ctx.res.status(400);
+    return { success: false, error: "invalid_payload" };
+  }
+  const { email, code } = parsed.data;
+  const user = await User.findOne({ email }, { email_verification_code: 1, email_verification_expires_at: 1, tenants: 1 });
+  if (!user) {
+    ctx.res.status(404);
+    return { success: false, error: "user_not_found" };
+  }
+  const storedCode = user.email_verification_code;
+  const expiresAt = user.email_verification_expires_at;
+  const isExpired = expiresAt instanceof Date && expiresAt.getTime() < Date.now();
+  if (!storedCode || storedCode !== code || isExpired) {
+    ctx.res.status(400);
+    return { success: false, error: "invalid_code" };
+  }
+  user.email_verification_code = void 0;
+  user.email_verification_expires_at = void 0;
+  await user.save();
+  const tenantId = user.tenants?.[0]?.toString?.() || "00000000";
+  const signedInTenants = (user.tenants || []).map((t) => t.toString?.() || String(t)) || [tenantId];
+  if (!ctx.req.session) {
+    ctx.res.status(500);
+    return { success: false, error: "session_unavailable" };
+  }
+  ctx.req.session.user = {
+    id: user._id.toString(),
+    current_tenant_id: tenantId,
+    signed_in_tenants: signedInTenants.length ? signedInTenants : [tenantId],
+    is_entry_gate_authorized: true
+  };
+  return { success: true, user_id: user._id.toString(), tenant_id: tenantId };
+};
+const handler = (api) => {
+  api.post(Route, verifyOtp);
+};
+export {
+  handler as default
+};

package/dist/{handler-BSoyBLZM.js → handler-r4ZECW_z.js}

@@ -1,8 +1,7 @@
 import crypto from "crypto";
-import { i as isEmail } from "./isEmail-IG0hXiQk.js";
 import { loadModel } from "@rpcbase/api";
 import { hashPassword } from "@rpcbase/server";
-import { R as Route, r as requestSchema } from "./index-r56vqjph.js";
+import { R as Route, r as requestSchema } from "./index-Bdcryyvv.js";
 const signIn = async (payload, ctx) => {
   const User = await loadModel("User", ctx);
   const parsed = requestSchema.safeParse(payload);
@@ -10,9 +9,8 @@ const signIn = async (payload, ctx) => {
     ctx.res.status(400);
     return { success: false, error: "invalid_payload" };
   }
-  const { email_or_phone, password } = parsed.data;
-  const query = isEmail(email_or_phone) ? { email: email_or_phone } : { phone: email_or_phone };
-  const user = await User.findOne(query, { password: 1, tenants: 1 });
+  const { email, password } = parsed.data;
+  const user = await User.findOne({ email }, { password: 1, tenants: 1 });
   if (!user?.password) {
     ctx.res.status(401);
     return { success: false, error: "invalid_credentials" };

package/dist/{index-r56vqjph.js → index-Bdcryyvv.js}

@@ -1,15 +1,7 @@
-import { i as isValidNumber } from "./isValidNumber-6pMDGLRn.js";
 import { o as object, b as boolean, s as string } from "./schemas-KL7REOdt.js";
 const Route = "/api/rb/auth/sign-in";
 const requestSchema = object({
-  email_or_phone: string().nonempty("Email or phone number is required").default("").refine(
-    (value) => {
-      const isEmail = string().email().safeParse(value).success;
-      const isPhone = isValidNumber(value);
-      return isEmail || isPhone;
-    },
-    "Please enter a valid email address or phone number"
-  ),
+  email: string().nonempty("Email is required").email("Please enter a valid email address"),
   password: string().min(1, { message: "Password is required" }),
   remember_me: boolean().default(true)
 });

package/dist/index-DwX0Y2YV.js

@@ -0,0 +1,17 @@
+import { o as object, b as boolean, s as string } from "./schemas-KL7REOdt.js";
+const Route = "/api/rb/auth/sign-up";
+const requestSchema = object({
+  email: string().nonempty("Email is required").email("Please enter a valid email address"),
+  password: string().min(8, { message: "Password must be at least 8 characters long." }),
+  remember_me: boolean().default(true)
+});
+object({
+  success: boolean(),
+  error: string().optional(),
+  user_id: string().optional(),
+  tenant_id: string().optional()
+});
+export {
+  Route as R,
+  requestSchema as r
+};

package/dist/index.js

@@ -1,10 +1,11 @@
 import { jsxs, jsx, Fragment } from "react/jsx-runtime";
-import { useLocation, Link } from "@rpcbase/router";
+import { useLocation, Link, useNavigate } from "@rpcbase/router";
 import clsx from "clsx";
 import { useFormContext, useForm, zodResolver, FormProvider } from "@rpcbase/form";
+import * as React from "react";
 import { useEffect, useState } from "react";
-import { r as requestSchema } from "./index-r56vqjph.js";
-import { r as requestSchema$1 } from "./index-Cq04nmsE.js";
+import { r as requestSchema } from "./index-Bdcryyvv.js";
+import { r as requestSchema$1 } from "./index-DwX0Y2YV.js";
 import { b, a, r } from "./middleware-BiMXO6Dq.js";
 const LINKS_REDIRECTION_MAP = {
   "/auth/sign-in": {
@@ -78,13 +79,13 @@ const AppleSignInButton = ({
     }
   );
 };
-const EmailOrPhoneInput = ({
+const EmailInput = ({
   id,
   className,
   placeholder
 }) => {
   const { register, formState } = useFormContext();
-  const error = formState.errors.email_or_phone;
+  const error = formState.errors.email;
   let errorMessage;
   if (typeof error === "string") {
     errorMessage = error;
@@ -96,12 +97,12 @@ const EmailOrPhoneInput = ({
       "input",
       {
         id,
-        type: "text",
+        type: "email",
         required: true,
-        autoComplete: "on",
+        autoComplete: "email",
         className,
         placeholder,
-        ...register("email_or_phone")
+        ...register("email")
       }
     ),
     errorMessage ? /* @__PURE__ */ jsx("p", { className: "mt-1 -mb-2 text-sm/6 text-red-500", children: errorMessage }) : null
@@ -113,7 +114,7 @@ const SignInForm = ({
 }) => {
   const methods = useForm({
     defaultValues: {
-      email_or_phone: "",
+      email: "",
       password: "",
       remember_me: true
     },
@@ -145,14 +146,15 @@ const SignInForm = ({
 };
 const SignUpForm = ({
   children,
-  className
+  className,
+  otpNextPath
 }) => {
+  const navigate = useNavigate();
   const [serverMessage, setServerMessage] = useState(null);
   const methods = useForm({
     defaultValues: {
-      email_or_phone: "",
+      email: "",
       password: "",
-      password_confirmation: "",
       remember_me: true
     },
     resolver: zodResolver(requestSchema$1)
@@ -173,7 +175,7 @@ const SignUpForm = ({
       console.log("SIGN UP RESPONSE", json);
       if (!res.ok) {
         console.error("Sign-up failed", json);
-        const message = json.error === "user_exists" ? "An account already exists with this email or phone." : "Sign-up failed. Please try again.";
+        const message = json.error === "user_exists" ? "An account already exists with this email." : "Sign-up failed. Please try again.";
         methods.setError("root", { type: "server", message });
         return;
       }
@@ -181,8 +183,12 @@ const SignUpForm = ({
         methods.setError("root", { type: "server", message: "Sign-up failed. Please try again." });
         return;
       }
+      const search = new URLSearchParams({ email: data.email });
+      if (otpNextPath) {
+        search.set("next", otpNextPath);
+      }
+      navigate(`/auth/sign-up-otp?${search.toString()}`);
       setServerMessage("Account created. Check your inbox to verify your email.");
-      methods.reset();
     } catch (err) {
       console.error("Sign-up request error", err);
       methods.setError("root", { type: "server", message: "Network error. Please try again." });
@@ -220,6 +226,58 @@ const RememberMeCheckbox = ({
     )
   ] });
 };
+function EyeSlashIcon({
+  title,
+  titleId,
+  ...props
+}, svgRef) {
+  return /* @__PURE__ */ React.createElement("svg", Object.assign({
+    xmlns: "http://www.w3.org/2000/svg",
+    fill: "none",
+    viewBox: "0 0 24 24",
+    strokeWidth: 1.5,
+    stroke: "currentColor",
+    "aria-hidden": "true",
+    "data-slot": "icon",
+    ref: svgRef,
+    "aria-labelledby": titleId
+  }, props), title ? /* @__PURE__ */ React.createElement("title", {
+    id: titleId
+  }, title) : null, /* @__PURE__ */ React.createElement("path", {
+    strokeLinecap: "round",
+    strokeLinejoin: "round",
+    d: "M3.98 8.223A10.477 10.477 0 0 0 1.934 12C3.226 16.338 7.244 19.5 12 19.5c.993 0 1.953-.138 2.863-.395M6.228 6.228A10.451 10.451 0 0 1 12 4.5c4.756 0 8.773 3.162 10.065 7.498a10.522 10.522 0 0 1-4.293 5.774M6.228 6.228 3 3m3.228 3.228 3.65 3.65m7.894 7.894L21 21m-3.228-3.228-3.65-3.65m0 0a3 3 0 1 0-4.243-4.243m4.242 4.242L9.88 9.88"
+  }));
+}
+const ForwardRef$1 = /* @__PURE__ */ React.forwardRef(EyeSlashIcon);
+function EyeIcon({
+  title,
+  titleId,
+  ...props
+}, svgRef) {
+  return /* @__PURE__ */ React.createElement("svg", Object.assign({
+    xmlns: "http://www.w3.org/2000/svg",
+    fill: "none",
+    viewBox: "0 0 24 24",
+    strokeWidth: 1.5,
+    stroke: "currentColor",
+    "aria-hidden": "true",
+    "data-slot": "icon",
+    ref: svgRef,
+    "aria-labelledby": titleId
+  }, props), title ? /* @__PURE__ */ React.createElement("title", {
+    id: titleId
+  }, title) : null, /* @__PURE__ */ React.createElement("path", {
+    strokeLinecap: "round",
+    strokeLinejoin: "round",
+    d: "M2.036 12.322a1.012 1.012 0 0 1 0-.639C3.423 7.51 7.36 4.5 12 4.5c4.638 0 8.573 3.007 9.963 7.178.07.207.07.431 0 .639C20.577 16.49 16.64 19.5 12 19.5c-4.638 0-8.573-3.007-9.963-7.178Z"
+  }), /* @__PURE__ */ React.createElement("path", {
+    strokeLinecap: "round",
+    strokeLinejoin: "round",
+    d: "M15 12a3 3 0 1 1-6 0 3 3 0 0 1 6 0Z"
+  }));
+}
+const ForwardRef = /* @__PURE__ */ React.forwardRef(EyeIcon);
 const PasswordInput = ({
   id,
   name = "password",
@@ -227,28 +285,42 @@ const PasswordInput = ({
   placeholder,
   autoComplete = "current-password"
 }) => {
+  const [showPassword, setShowPassword] = useState(false);
   const { register, formState } = useFormContext();
   const fieldError = formState.errors[name];
   const errorMessage = typeof fieldError === "string" ? fieldError : typeof fieldError?.message === "string" ? fieldError.message : void 0;
+  const inputClassName = className ? `${className} pr-11` : "pr-11";
   return /* @__PURE__ */ jsxs(Fragment, { children: [
-    /* @__PURE__ */ jsx(
-      "input",
-      {
-        id,
-        type: "password",
-        autoComplete,
-        className,
-        placeholder,
-        ...register(name)
-      }
-    ),
+    /* @__PURE__ */ jsxs("div", { className: "relative", children: [
+      /* @__PURE__ */ jsx(
+        "input",
+        {
+          id,
+          type: showPassword ? "text" : "password",
+          autoComplete,
+          className: inputClassName,
+          placeholder,
+          ...register(name)
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          className: "absolute inset-y-0 right-0 flex items-center pr-3 text-gray-500",
+          onClick: () => setShowPassword((prev) => !prev),
+          "aria-label": showPassword ? "Hide characters" : "Show characters",
+          children: showPassword ? /* @__PURE__ */ jsx(ForwardRef$1, { className: "h-5 w-5", "aria-hidden": true }) : /* @__PURE__ */ jsx(ForwardRef, { className: "h-5 w-5", "aria-hidden": true })
+        }
+      )
+    ] }),
     errorMessage ? /* @__PURE__ */ jsx("p", { className: "mt-1 -mb-2 text-sm/6 text-red-500", children: errorMessage }) : null
   ] });
 };
 export {
   AppleSignInButton,
   AuthLayout,
-  EmailOrPhoneInput,
+  EmailInput,
   PasswordInput,
   RememberMeCheckbox,
   SignInForm,

package/dist/routes.js

@@ -1,5 +1,5 @@
 const routes = Object.entries({
-  .../* @__PURE__ */ Object.assign({ "./api/me/handler.ts": () => import("./handler-Ba3pgtfZ.js"), "./api/sign-in/handler.ts": () => import("./handler-BSoyBLZM.js"), "./api/sign-out/handler.ts": () => import("./handler-CNHucHrj.js"), "./api/sign-up/handler.ts": () => import("./handler-rZR_dx7n.js") })
+  .../* @__PURE__ */ Object.assign({ "./api/me/handler.ts": () => import("./handler-Ba3pgtfZ.js"), "./api/sign-in/handler.ts": () => import("./handler-r4ZECW_z.js"), "./api/sign-out/handler.ts": () => import("./handler-CNHucHrj.js"), "./api/sign-up/handler.ts": () => import("./handler-CE4lXc0G.js"), "./api/verify-otp/handler.ts": () => import("./handler-DOnLMd-9.js") })
 }).reduce((acc, [path, mod]) => {
   acc[path.replace("./api/", "@rpcbase/auth/api/")] = mod;
   return acc;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpcbase/auth",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "type": "module",
   "files": [
     "dist"
@@ -38,6 +38,13 @@
         "dist/"
       ]
     },
+    "build-watch": {
+      "command": "../../node_modules/.bin/vite build --watch",
+      "service": true,
+      "dependencies": [
+        "build"
+      ]
+    },
     "release": {
       "command": "../../scripts/publish.js",
       "dependencies": [

package/dist/components/EmailOrPhoneInput/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/EmailOrPhoneInput/index.tsx"],"names":[],"mappings":"AAGA,eAAO,MAAM,iBAAiB,GAAI,iCAI/B;IACD,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,4CA6BA,CAAA"}

package/dist/handler-rZR_dx7n.js

@@ -1,71 +0,0 @@
-import crypto from "crypto";
-import { i as isEmail } from "./isEmail-IG0hXiQk.js";
-import { loadModel } from "@rpcbase/api";
-import { hashPassword, sendEmail } from "@rpcbase/server";
-import { R as Route, r as requestSchema } from "./index-Cq04nmsE.js";
-const signUp = async (payload, ctx) => {
-  const User = await loadModel("User", ctx);
-  const Tenant = await loadModel("Tenant", ctx);
-  const parsed = requestSchema.safeParse(payload);
-  if (!parsed.success) {
-    ctx.res.status(400);
-    return { success: false, error: "invalid_payload" };
-  }
-  const { email_or_phone, password, remember_me: _remember_me } = parsed.data;
-  const is_email = isEmail(email_or_phone);
-  const query = is_email ? { email: email_or_phone } : { phone: email_or_phone };
-  const existingUser = await User.findOne(query);
-  if (existingUser) {
-    console.log("user with email or phone already exists", email_or_phone);
-    ctx.res.status(409);
-    return { success: false, error: "user_exists" };
-  }
-  const salt = crypto.randomBytes(16).toString("hex");
-  const derivedKey = await hashPassword(password, salt);
-  const hashedPassword = `${salt}:${derivedKey.toString("hex")}`;
-  const tenantId = crypto.randomUUID();
-  const user = new User({
-    ...query,
-    password: hashedPassword,
-    tenants: [tenantId]
-  });
-  await user.save();
-  if (is_email) {
-    try {
-      await sendEmail({
-        to: email_or_phone,
-        subject: "Verify your email",
-        html: "<p>Welcome to rpcbase!</p><p>We created your account. Use this email to sign in and finish verification.</p>",
-        text: "Welcome to rpcbase! We created your account. Use this email to sign in and finish verification."
-      });
-    } catch (err) {
-      console.warn("failed to send sign-up email", err);
-    }
-  }
-  try {
-    await Tenant.create({
-      tenant_id: tenantId,
-      name: query.email || query.phone
-    });
-  } catch (err) {
-    console.warn("failed to create tenant for user", err);
-  }
-  console.log("created new user", user._id.toString());
-  if (!ctx.req.session) {
-    ctx.res.status(500);
-    return { success: false, error: "session_unavailable" };
-  }
-  ctx.req.session.user = {
-    id: user._id.toString(),
-    current_tenant_id: tenantId,
-    signed_in_tenants: [tenantId],
-    is_entry_gate_authorized: true
-  };
-  return { success: true, user_id: user._id.toString(), tenant_id: tenantId };
-};
-const handler = (api) => {
-  api.post(Route, signUp);
-};
-export {
-  handler as default
-};

package/dist/index-Cq04nmsE.js

@@ -1,29 +0,0 @@
-import { i as isValidNumber } from "./isValidNumber-6pMDGLRn.js";
-import { o as object, b as boolean, s as string } from "./schemas-KL7REOdt.js";
-const Route = "/api/rb/auth/sign-up";
-const requestSchema = object({
-  email_or_phone: string().nonempty("Email or phone number is required").refine(
-    (value) => {
-      const isEmail = string().email().safeParse(value).success;
-      const isPhone = isValidNumber(value);
-      return isEmail || isPhone;
-    },
-    "Please enter a valid email address or phone number"
-  ),
-  password: string().min(8, { message: "Password must be at least 8 characters long." }),
-  password_confirmation: string().nonempty({ message: "Please confirm your password." }),
-  remember_me: boolean().default(true)
-}).refine((data) => data.password === data.password_confirmation, {
-  message: "Passwords do not match.",
-  path: ["password_confirmation"]
-});
-object({
-  success: boolean(),
-  error: string().optional(),
-  user_id: string().optional(),
-  tenant_id: string().optional()
-});
-export {
-  Route as R,
-  requestSchema as r
-};