@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/docs/endpoints/social.md

@@ -0,0 +1,116 @@
+# Social sign-in: Google, Apple, Facebook
+
+The app signs the user in with the provider's own SDK, then sends the provider's token here. `:provider` is `google`, `apple` or `facebook`; any other value returns `404 NOT_FOUND`. Which token to send is explained in [Sign-in flows](../sign-in-flows.md#google-apple-and-facebook). Shared formats, the sign-in result and the user object are described in [Endpoints](README.md).
+
+---
+
+## POST /auth/social/:provider
+
+Signs in, or signs up if the email is new.
+
+| | |
+|---|---|
+| Auth | Public |
+| Rate limit | 30 per IP per 15 minutes |
+| Settings used | `google` / `apple` / `facebook` (enabled + client ids), `registration.*` |
+
+**Request**
+
+```http
+POST /auth/social/google
+```
+
+```json
+{
+  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMyJ9.eyJpc3MiOiJodHRwczovL2FjY291bnRzLmdvb2dsZS5jb20i...",
+  "nonce": "b1f3c0d2e4a5",
+  "firstName": "Asha",
+  "lastName": "Rao",
+  "acceptTerms": true,
+  "acceptPrivacyPolicy": true
+}
+```
+
+| Field | Type | Required | Notes |
+|---|---|---|---|
+| `token` | string | yes | Google/Apple: ID token. Facebook: access token. Up to 8192 characters |
+| `nonce` | string | no | The **raw** nonce your app used with the provider; required if the token contains one. Up to 256 characters |
+| `firstName`, `lastName`, `acceptTerms`, `acceptPrivacyPolicy` | | only for new accounts | Apple sends the name only once, to your app, so pass it here |
+
+**Response `200`:** the [sign-in result](README.md#sign-in-result).
+
+**Errors**
+
+| Status | `code` | When |
+|---|---|---|
+| 401 | `INVALID_SOCIAL_TOKEN` | Bad signature, expired, issued to another app, wrong nonce, or Facebook rejected it |
+| 409 | `ACCOUNT_EXISTS_WITH_OTHER_METHOD` | The provider didn't verify the email (always the case for Facebook) and an account already has it. Sign in normally, then link |
+| 400 | `VALIDATION_ERROR` | New account: `missingSignUpDetails`, which includes `"email"` if Facebook gave no email |
+| 400 | `EMAIL_DOMAIN_NOT_ALLOWED` | |
+| 403 | `SIGN_IN_METHOD_DISABLED` | Provider turned off |
+| 403 | `SIGN_UP_CLOSED` | |
+| 501 | `NOT_CONFIGURED` | No client ids (Google/Apple) or app secret (Facebook) on the server |
+
+```json
+{
+  "success": false,
+  "code": "ACCOUNT_EXISTS_WITH_OTHER_METHOD",
+  "message": "An account with this email already exists. Sign in your usual way, then link this account from your profile."
+}
+```
+
+---
+
+## POST /auth/social/:provider/link
+
+Connects a provider account to the signed-in user, e.g. from a "Connected accounts" screen.
+
+| | |
+|---|---|
+| Auth | User, session checked live |
+
+**Request**
+
+```json
+{ "token": "eyJhbGciOiJSUzI1NiIs...", "nonce": "b1f3c0d2e4a5" }
+```
+
+**Response `200`**
+
+```json
+{ "success": true }
+```
+
+Linking an account that is already linked to **this** user also returns success.
+
+**Errors**
+
+| Status | `code` | When |
+|---|---|---|
+| 409 | `SOCIAL_ACCOUNT_IN_USE` | Linked to another user |
+| 401 | `INVALID_SOCIAL_TOKEN` | |
+
+---
+
+## DELETE /auth/social/:provider
+
+Disconnects a provider.
+
+| | |
+|---|---|
+| Auth | User, session checked live |
+
+**Request:** no body.
+
+**Response `200`**
+
+```json
+{ "success": true }
+```
+
+**Errors**
+
+| Status | `code` | When |
+|---|---|---|
+| 404 | `NOT_FOUND` | That provider isn't linked |
+| 409 | `LAST_SIGN_IN_METHOD` | It's the user's only way to sign in |

package/docs/endpoints/two-factor.md

@@ -0,0 +1,146 @@
+# Two-factor authentication
+
+Authenticator-app codes (TOTP) plus 10 single-use backup codes. Needs `twoFactor.enabled` (on by default); otherwise `403 FEATURE_DISABLED`. All code-checking endpoints share a limit of 10 attempts per user per 15 minutes. Shared formats, the sign-in result and the user object are described in [Endpoints](README.md).
+
+---
+
+## GET /auth/2fa
+
+| | |
+|---|---|
+| Auth | User |
+
+**Response `200`**
+
+```json
+{ "success": true, "isEnabled": true, "remainingBackupCodes": 8 }
+```
+
+---
+
+## POST /auth/2fa/setup
+
+Step 1: creates a secret. Nothing changes for the user until step 2.
+
+| | |
+|---|---|
+| Auth | User, session checked live |
+
+**Request:** no body.
+
+**Response `200`**
+
+```json
+{
+  "success": true,
+  "secret": "JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP",
+  "authenticatorAppUrl": "otpauth://totp/MyApp%3Aasha%40example.com?secret=JBSWY3DPEHPK3PXPJBSWY3DPEHPK3PXP&issuer=MyApp&algorithm=SHA1&digits=6&period=30"
+}
+```
+
+Show `authenticatorAppUrl` as a QR code, with `secret` underneath for typing by hand.
+
+**Errors:** `409 TWO_FACTOR_ALREADY_ENABLED`.
+
+---
+
+## POST /auth/2fa/enable
+
+Step 2: confirms with the first code from the app. Turns 2FA on, signs out other devices, and returns backup codes. **Show the backup codes once** and ask the user to save them.
+
+| | |
+|---|---|
+| Auth | User, session checked live |
+
+**Request**
+
+```json
+{ "code": "123456" }
+```
+
+**Response `200`**
+
+```json
+{
+  "success": true,
+  "backupCodes": ["k7m2-x9p4", "h3nq-8v2w", "p5tz-r6c9", "b2wx-m7k3", "s9qf-4h8n", "z3vc-t5p2", "m8kr-q2x6", "w4nh-c9t7", "f6pb-y3m5", "r2xs-k8w4"]
+}
+```
+
+**Errors**
+
+| Status | `code` | When |
+|---|---|---|
+| 401 | `INVALID_OTP` | Wrong code |
+| 409 | `TWO_FACTOR_SETUP_NOT_STARTED` | Call `/auth/2fa/setup` first |
+| 409 | `TWO_FACTOR_ALREADY_ENABLED` | |
+
+---
+
+## POST /auth/2fa/verify
+
+The second step of sign-in, after a sign-in returned `two_factor_required`. Accepts an authenticator code **or** a backup code (each backup code works once).
+
+| | |
+|---|---|
+| Auth | Public |
+
+**Request**
+
+```json
+{ "challengeToken": "ch_Zm9vYmFyZXhhbXBsZWNoYWxsZW5nZXRva2VuMTIzNDU2Nzg", "code": "123456" }
+```
+
+| Field | Type | Required | Notes |
+|---|---|---|---|
+| `challengeToken` | string | yes | from the sign-in response; valid 5 minutes |
+| `code` | string | yes | `"123456"` or a backup code such as `"k7m2-x9p4"` (dash, spaces and capitals are ignored) |
+
+**Response `200`:** the [sign-in result](README.md#sign-in-result) with `status: "signed_in"`.
+
+**Errors**
+
+| Status | `code` | When |
+|---|---|---|
+| 401 | `INVALID_OTP` | Wrong code (the challenge allows 5 wrong tries) |
+| 400 | `INVALID_TOKEN` | Challenge unknown, used, expired, or too many wrong tries: sign in again |
+
+---
+
+## POST /auth/2fa/disable
+
+Turns 2FA off. Needs a current authenticator code or a backup code.
+
+| | |
+|---|---|
+| Auth | User, session checked live |
+
+**Request**
+
+```json
+{ "code": "123456" }
+```
+
+**Response `200`:** `{ "success": true }`
+
+**Errors:** `401 INVALID_OTP`, `409 TWO_FACTOR_NOT_ENABLED`.
+
+---
+
+## POST /auth/2fa/backup-codes
+
+Replaces all backup codes with 10 new ones. Needs a current code.
+
+| | |
+|---|---|
+| Auth | User, session checked live |
+
+**Request**
+
+```json
+{ "code": "123456" }
+```
+
+**Response `200`:** `{ "success": true, "backupCodes": ["...10 codes..."] }`
+
+**Errors:** `401 INVALID_OTP`, `409 TWO_FACTOR_NOT_ENABLED`.

package/docs/error-codes.md

@@ -0,0 +1,100 @@
+# Error codes
+
+Every error has this shape:
+
+```json
+{ "success": false, "code": "INVALID_OTP", "message": "This code is incorrect.", "attemptsLeft": 3 }
+```
+
+- **`code`** is stable. Write your app logic against it.
+- **`message`** is safe to show to users, but may be reworded between versions. Translate by `code` if your app is multilingual.
+- **Extra fields** appear on some errors, as listed below.
+
+The error list is defined in `AUTH_ERRORS` in [`src/constants.ts`](../src/constants.ts) and exported, so TypeScript clients can import it.
+
+## 400: the request is wrong
+
+| Code | Meaning | Extra fields |
+|---|---|---|
+| `VALIDATION_ERROR` | Missing, wrong-type or unknown fields. | `problems` (from the body checks) or `missingSignUpDetails` (a new account needs these: `firstName`, `lastName`, `acceptTerms`, `acceptPrivacyPolicy`, `email`) |
+| `INVALID_EMAIL` | Not an email address. | |
+| `INVALID_PHONE` | Not an international number (`+` and country code). | |
+| `INVALID_PASSWORD` | Breaks the password rules, or appeared in a data breach (different message). | `requirements` (e.g. `["at least 10 characters"]`) |
+| `TERMS_NOT_ACCEPTED` | `acceptTerms` must be `true`. | |
+| `PRIVACY_POLICY_NOT_ACCEPTED` | `acceptPrivacyPolicy` must be `true`. | |
+| `EMAIL_DOMAIN_NOT_ALLOWED` | `registration.allowedEmailDomains` excludes this email. | |
+| `PHONE_COUNTRY_NOT_ALLOWED` | `phoneOtp.allowedCountryCodes` excludes this number. | |
+| `INVALID_OTP` | Wrong email/SMS code. | `attemptsLeft` |
+| `OTP_EXPIRED` | No usable code: expired, used, too many wrong tries, or never sent. Ask for a new one. | |
+| `INVALID_TOKEN` | A link token (verify email, reset password, magic link, email change, invitation) or challenge token is invalid, expired or used. | |
+| `EMAIL_UNCHANGED` | `POST /auth/email/change` with the account's current email. | |
+| `INVALID_SETTINGS` | Admin settings change rejected. | `problems` |
+| `UNSAFE_WEBHOOK_URL` | Webhook URL is not public https. | `problem` |
+
+## 401: who are you?
+
+| Code | Meaning | What the client should do |
+|---|---|---|
+| `UNAUTHORIZED` | No access token on a protected route. | Go to sign-in |
+| `INVALID_TOKEN` | Access token expired or invalid, **or** refresh token invalid. | On an API call: refresh once and retry. On `/auth/refresh`: go to sign-in |
+| `INVALID_CREDENTIALS` | Wrong email or password (always the same for both). | Show the message |
+| `INVALID_OTP` | Wrong 2FA code at `/auth/2fa/verify`. | Let the user retry |
+| `INVALID_API_KEY` | Missing, wrong, revoked or expired API key. | Fix the server's configuration |
+| `INVALID_SOCIAL_TOKEN` | Google/Apple/Facebook token could not be verified (expired, wrong app, wrong nonce). | Sign in with the provider again |
+| `INVALID_PASSKEY` | Passkey signature could not be verified, or the passkey is unknown. | Try again or use another method |
+
+## 403: not allowed
+
+| Code | Meaning | Extra fields |
+|---|---|---|
+| `ACCOUNT_NOT_VERIFIED` | Verification still owed. | `pendingVerifications`, `email?`, `phoneNumber?` |
+| `ACCOUNT_DEACTIVATED` | The user deactivated the account. | `reactivationToken`, `expiresIn` |
+| `ACCOUNT_SUSPENDED` | An admin suspended the account. | |
+| `FORBIDDEN` | Missing role, organization role or API-key scope; or a cookie refresh from a website not in `refreshTokenCookie.allowedOrigins`. | |
+| `RECENT_SIGN_IN_REQUIRED` | Changing the email of an account without a password needs a sign-in from the last 10 minutes. Sign in again, then retry. | |
+| `SIGN_UP_CLOSED` | Sign-up is off (`registration.enabled`, or that method's `allowSignUp`). | |
+| `SIGN_IN_METHOD_DISABLED` | That sign-in method is turned off. | |
+| `FEATURE_DISABLED` | Organizations or 2FA are turned off. | |
+
+## 404
+
+| Code | Meaning |
+|---|---|
+| `NOT_FOUND` | Unknown id, or an organization you are not a member of (deliberately the same, so outsiders can't probe). |
+
+## 409: conflicts with current state
+
+| Code | Meaning |
+|---|---|
+| `ACCOUNT_ALREADY_EXISTS` | Phone number already used by another account, or a sign-up race. |
+| `ACCOUNT_EXISTS_WITH_OTHER_METHOD` | Social sign-in with an unverified email that belongs to an existing account. Sign in normally and link from settings. |
+| `SOCIAL_ACCOUNT_IN_USE` | This Google/Apple/Facebook account is linked to another user. |
+| `LAST_SIGN_IN_METHOD` | Removing this would leave no way to sign in. |
+| `TWO_FACTOR_ALREADY_ENABLED` / `TWO_FACTOR_NOT_ENABLED` / `TWO_FACTOR_SETUP_NOT_STARTED` | 2FA state does not allow this step. |
+| `ORGANIZATION_SLUG_TAKEN` | |
+| `ALREADY_MEMBER` | |
+| `LAST_OWNER` | An organization must keep at least one owner. |
+| `ACCOUNT_NOT_DEACTIVATED` | Reactivation of an account that isn't deactivated. |
+| `EMAIL_IN_USE` | Confirming an email change, but another account took the address in the meantime. |
+| `CONFLICT` | Any other conflict raised by your own code. |
+
+## 429, 5xx
+
+| Code | Meaning | Extra fields |
+|---|---|---|
+| `TOO_MANY_REQUESTS` | Rate limit, or a new code asked for within `resendAfterSeconds` (60 by default). Also sent as a `Retry-After` header. | `retryAfterSeconds` |
+| `NOT_CONFIGURED` (501) | Feature turned on in settings but not set up in code (no `smsSender`, no Google client id, no `passkeys` option...). | |
+| `INTERNAL_SERVER_ERROR` (500) | Unexpected failure (details only in the server log), or an email/SMS could not be sent. | |
+
+## Using errors in your own code
+
+`AuthModule` installs its error formatter app-wide, so your controllers get the same format. Throw library errors by their definition:
+
+```ts
+import { AUTH_ERRORS, AuthError } from '@techelusive/nest-auth';
+
+throw new AuthError(AUTH_ERRORS.forbidden);
+throw new AuthError(AUTH_ERRORS.validationFailed, { problems: [PICKUP_TIME_MUST_BE_IN_FUTURE] }); // your own constant
+```
+
+Any NestJS `HttpException` you throw is formatted too, with a code based on its status (`NOT_FOUND`, `CONFLICT`...).

package/docs/events.md

@@ -0,0 +1,83 @@
+# Events
+
+Every important action produces an event. Each event goes to three places, in this order:
+
+1. **The audit log** (`auth_audit_logs`, visible at `GET /auth/admin/audit-log`)
+2. **Your `onEvent` handler** (in-process)
+3. **Webhooks** subscribed to it (delivered in the background)
+
+A failure in any of these is logged and **never** breaks the action that caused the event.
+
+```ts
+AuthModule.forRoot({
+  useFactory: (profiles: ProfilesService) => ({
+    // ...
+    onEvent: async (event) => {
+      if (event.name === 'user.created') await profiles.createEmptyProfile(event.userId!);
+      if (event.name === 'user.deleted') await profiles.deleteEverythingFor(event.userId!);
+    },
+  }),
+  inject: [ProfilesService],
+});
+```
+
+`onEvent` runs inside the request, so keep it quick. Hand slow work to a queue.
+
+## Event shape
+
+```ts
+interface AuthEvent {
+  name: AuthEventName;          // e.g. "user.created"
+  userId: string | null;        // the user it is about
+  data: Record<string, unknown>;// details; never passwords, tokens or codes
+  occurredAt: string;           // ISO time
+}
+```
+
+## All events
+
+| Event | When | `data` |
+|---|---|---|
+| `user.created` | New account (any method) | `status` |
+| `user.activated` | `PENDING_VERIFICATION` → `ACTIVE` | |
+| `user.updated` | Profile changed | `changedFields` |
+| `user.email_verified` | Email verified | |
+| `user.email_change_requested` | `POST /auth/email/change` accepted (also when the address was taken, so it can't be told apart) | `newEmail` (masked) |
+| `user.email_changed` | Email change confirmed | `previousEmail`, `newEmail` (both masked) |
+| `user.phone_verified` | Phone verified | |
+| `user.onboarding_completed` | Your app called `completeOnboarding` | |
+| `user.roles_changed` | Admin changed roles | `previousRoles`, `roles` |
+| `user.signed_in` | Successful sign-in | `signInMethod`, `usedTwoFactor`, `sessionId`, `isNewDevice` |
+| `user.sign_in_failed` | Wrong password/code, blocked account | `signInMethod`, `reason` |
+| `user.signed_out` | Sign-out (one device or all) | `sessionId` or `everywhere`, `endedSessions` |
+| `user.password_changed` | Change, reset, first set, or removal of an unverified password | `how` |
+| `user.password_reset_requested` | Reset email sent | |
+| `user.two_factor_enabled` / `user.two_factor_disabled` | 2FA turned on / off (also admin reset) | `resetByAdmin?` |
+| `user.passkey_added` / `user.passkey_removed` | | `passkeyId` |
+| `user.social_account_linked` / `user.social_account_unlinked` | | `provider` |
+| `user.suspended` | Admin suspended | `reason` |
+| `user.deactivated` / `user.reactivated` | User paused / resumed (or admin lifted a suspension) | |
+| `user.deleted` | Account deleted | |
+| `session.revoked` | A session ended | `sessionId`, `reason` |
+| `session.refresh_token_reused` | **Security:** a used refresh token came back; the session was ended | `sessionId` |
+| `organization.created` / `organization.updated` / `organization.deleted` | | `organizationId` |
+| `organization.member_added` / `organization.member_removed` | | `organizationId`, `role?` |
+| `organization.member_role_changed` | | `organizationId`, `previousRole`, `role` |
+| `organization.invitation_sent` | | `organizationId`, `role` |
+| `api_key.created` / `api_key.revoked` | | `apiKeyId`, `name?`, `scopes?` |
+| `settings.changed` | Admin changed or reset settings | `changedSections` or `reset` |
+
+The event names are exported as `AUTH_EVENTS`:
+
+```ts
+import { AUTH_EVENTS } from '@techelusive/nest-auth';
+if (event.name === AUTH_EVENTS.refreshTokenReused) alertSecurityTeam(event);
+```
+
+## Recording your own audit entries
+
+```ts
+constructor(private readonly authEvents: AuthEventsService) {}
+
+await this.authEvents.record({ name: AUTH_EVENTS.userUpdated, userId, request, details: { changedFields: ['payoutAccount'] } });
+```

package/docs/getting-started.md

@@ -0,0 +1,139 @@
+# Getting started
+
+This guide adds email + password authentication to an existing NestJS app. Other sign-in methods are switched on with one setting each, see [Configuration](configuration.md).
+
+## 1. Install
+
+```bash
+npm install @techelusive/nest-auth
+# Peer dependencies (most NestJS + TypeORM apps already have them):
+npm install @nestjs/common @nestjs/core @nestjs/platform-express typeorm pg \
+  class-validator class-transformer reflect-metadata rxjs
+# Optional: shared rate limits across servers
+npm install ioredis
+```
+
+## 2. Add the auth tables to your database
+
+The library brings its own TypeORM entities and one migration that creates 20 tables, all prefixed `auth_`. They live in your existing database next to your own tables.
+
+```ts
+// src/data-source.ts
+import { DataSource } from 'typeorm';
+import { AUTH_ENTITIES, AUTH_MIGRATIONS } from '@techelusive/nest-auth';
+
+export const appDataSource = new DataSource({
+  type: 'postgres',
+  url: process.env.DATABASE_URL,
+  entities: [...AUTH_ENTITIES, /* your entities */],
+  migrations: [...AUTH_MIGRATIONS, /* your migrations */],
+  synchronize: false,
+});
+```
+
+Run the migration:
+
+```bash
+npm run build
+npx typeorm migration:run -d dist/data-source.js
+```
+
+> Never use `synchronize: true` with these tables. The migration creates constraints and indexes that `synchronize` does not know about.
+
+## 3. Create an encryption key (development)
+
+The library encrypts its token-signing key, 2FA secrets and webhook secrets before storing them. In development, use a local key:
+
+```bash
+openssl rand -base64 32
+# put the result in .env as LOCAL_ENCRYPTION_KEY
+```
+
+In production, use AWS KMS instead (see [Production checklist](production-checklist.md)). A local key is refused when `NODE_ENV=production`.
+
+## 4. Import the module
+
+```ts
+// src/app.module.ts
+import { Module } from '@nestjs/common';
+import { AuthModule, ConsoleEmailSender } from '@techelusive/nest-auth';
+import { appDataSource } from './data-source';
+
+@Module({
+  imports: [
+    AuthModule.forRoot({
+      useFactory: async () => ({
+        dataSource: appDataSource.isInitialized ? appDataSource : await appDataSource.initialize(),
+        issuer: 'http://localhost:3000',          // your API's public URL
+        appName: 'MyApp',
+        encryption: { localKey: process.env.LOCAL_ENCRYPTION_KEY! },
+        emailSender: new ConsoleEmailSender(),     // prints emails to the console in development
+        settings: {
+          registration: { defaultRoles: ['user'] },
+        },
+      }),
+    }),
+  ],
+})
+export class AppModule {}
+```
+
+If your app already uses `@nestjs/typeorm`, inject its `DataSource` instead:
+
+```ts
+AuthModule.forRoot({
+  imports: [TypeOrmModule],
+  inject: [DataSource],
+  useFactory: (dataSource: DataSource) => ({ dataSource, /* ... */ }),
+})
+```
+
+## 5. Trust your proxy
+
+Rate limits, the device list and the audit log use the client's IP address. Behind a load balancer (AWS ALB, Nginx, Cloudflare), tell Express to trust one proxy hop:
+
+```ts
+// src/main.ts
+const app = await NestFactory.create<NestExpressApplication>(AppModule);
+app.set('trust proxy', 1);
+await app.listen(3000);
+```
+
+## 6. Try it
+
+```bash
+# Register
+curl -X POST localhost:3000/auth/register -H 'Content-Type: application/json' -d '{
+  "email": "asha@example.com", "password": "correct horse battery",
+  "firstName": "Asha", "lastName": "Rao", "acceptTerms": true, "acceptPrivacyPolicy": true
+}'
+# -> { "success": true, "status": "verification_required", "pendingVerifications": ["email"], ... }
+```
+
+The console prints the verification email, which contains a `token` (`ev_...`). Your web page would read it from the link:
+
+```bash
+curl -X POST localhost:3000/auth/email/verify -H 'Content-Type: application/json' -d '{ "token": "ev_..." }'
+
+# Sign in
+curl -X POST localhost:3000/auth/login -H 'Content-Type: application/json' \
+  -d '{ "email": "asha@example.com", "password": "correct horse battery" }'
+# -> { "success": true, "status": "signed_in", "accessToken": "eyJ...", "refreshToken": "rt_...", "user": {...} }
+
+# Call a protected route
+curl localhost:3000/auth/me -H 'Authorization: Bearer eyJ...'
+```
+
+## 7. What changed in your app
+
+- **Every route is now protected.** A request without a valid access token gets `401 UNAUTHORIZED`. Open public routes with `@Public()`, see [Protecting routes](protecting-routes.md). To opt in route by route instead, pass `protectAllRoutes: false`.
+- **One error format everywhere.** All errors, including your own, look like `{ "success": false, "code": "...", "message": "..." }`.
+- **New endpoints:** `/auth/*` and `/.well-known/jwks.json`, see [API reference](api-reference.md).
+- **Background webhook worker:** it runs every 5 seconds and does nothing until you add a webhook.
+
+## Next steps
+
+- Turn on more sign-in methods: [Configuration](configuration.md)
+- Build your screens: [Sign-in flows](sign-in-flows.md), [Client integration](client-integration.md)
+- Send real emails: write an `EmailSender` (see [Configuration → Email](configuration.md#email-sender))
+- Before launch: [Production checklist](production-checklist.md)