@ultimat3/cli 29.4.0 → 30.0.0

package/src/templates/sign-in-oidc.ts

@@ -0,0 +1,189 @@
+// `x g sign-in --oidc <provider>`: an OpenID Connect issuer, discovered when the first sign-in
+// arrives (`discoverOAuthProvider`), its two legs (`oauthLogin`) mounted on `runtime.routes`, and
+// the page that links to the first one. PKCE, the sealed handshake, the state check and the account
+// link are the framework's; which IdP group means which role stays the app's (`resolveGrants`).
+
+import { catalogJson } from './catalog-json';
+import { catalogPath } from './locales';
+import type { GeneratedFile } from './naming';
+import {
+  SIGN_IN_CATALOG,
+  type SignInForm,
+  type SignInTemplateOptions,
+  signInPageSource,
+  signInPageTest,
+} from './sign-in-pages';
+import { AUTH_DIR, sharedSignInFiles } from './sign-in-shared';
+
+/** `bigco-sso` → `BIGCO_SSO`: the prefix `discoverOAuthProvider` derives its two env keys from. */
+export const oidcEnvPrefix = (provider: string): string =>
+  provider.toUpperCase().replace(/[^A-Z0-9]+/g, '_');
+
+/** The settings an OIDC sign-in cannot run without, in the order `x env example` should list. */
+export const oidcSignInEnv = (provider: string): readonly string[] => {
+  const prefix = oidcEnvPrefix(provider);
+  return [
+    `${prefix}_ISSUER`,
+    `${prefix}_CLIENT_ID`,
+    `${prefix}_CLIENT_SECRET`,
+    'SESSION_SECRET',
+    'APP_URL',
+  ];
+};
+
+const oidcSource = (
+  provider: string,
+): string => `// Sign-in through ${provider}, an OpenID Connect issuer. Discovered on the FIRST sign-in, never at
+// import: the boot scan imports this module before anything may open a socket, and an IdP that is
+// down must cost a sign-in, not a deploy. A failed discovery is retried by the next request.
+//
+// Who a first-time user IS here — roles, org — is \`resolveGrants\` (\`oauthLogin\`'s option): omitted,
+// they arrive with no roles and no org, and every \`can()\` denies them. That mapping is this app's.
+import {
+  type Auth,
+  defineAuth,
+  discoverOAuthProvider,
+  hasOAuthProvider,
+  type OAuthLoginRoutes,
+  oauthLogin,
+  oauthStartPath,
+  registerOAuthProvider,
+} from '@ultimat3/auth';
+import { appAuth } from './auth';
+import { AFTER_SIGN_IN } from './sign-in-flow';
+
+export const OIDC_PROVIDER = '${provider}';
+export const OIDC_ISSUER_ENV = '${oidcEnvPrefix(provider)}_ISSUER';
+/** Where the sign-in page sends a browser: the start leg, \`/auth/oauth/${provider}\`. */
+export const OIDC_START_PATH = oauthStartPath(OIDC_PROVIDER);
+
+type Env = Readonly<Record<string, string | undefined>>;
+
+/**
+ * The app's \`Auth\` over the same adapter, naming the one provider it serves. A second instance
+ * and not an edit to \`auth.ts\`: its sessions are the same rows, so \`authenticator.ts\` reads them.
+ */
+const signInAuth = (): Auth =>
+  defineAuth({ adapter: appAuth().adapter, providers: [OIDC_PROVIDER] });
+
+let legs: Promise<OAuthLoginRoutes> | undefined;
+
+/** The two legs, built once the issuer answered. \`sign-in-guard.ts\` refuses a deploy without it. */
+export const oidcLegs = (env: Env = process.env): Promise<OAuthLoginRoutes> => {
+  legs ??= (async () => {
+    const issuer = (env[OIDC_ISSUER_ENV] ?? '').trim();
+    if (!hasOAuthProvider(OIDC_PROVIDER)) {
+      registerOAuthProvider(await discoverOAuthProvider({ id: OIDC_PROVIDER, issuer }));
+    }
+    return oauthLogin(signInAuth(), { successPath: AFTER_SIGN_IN });
+  })().catch((error: unknown) => {
+    legs = undefined;
+    throw error;
+  });
+  return legs;
+};
+`;
+
+const oidcTest = (
+  provider: string,
+): string => `// The provider's names, and the one rule discovery keeps: nothing is fetched at import.
+import { hasOAuthProvider } from '@ultimat3/auth';
+import { expect, unitTest } from '@ultimat3/testing';
+import { OIDC_ISSUER_ENV, OIDC_PROVIDER, OIDC_START_PATH, oidcLegs } from './oidc';
+
+unitTest('the provider, its issuer key and its start path are spelled once', () => {
+  expect(OIDC_PROVIDER).toBe('${provider}');
+  expect(OIDC_ISSUER_ENV).toBe('${oidcEnvPrefix(provider)}_ISSUER');
+  expect(OIDC_START_PATH).toBe('/auth/oauth/${provider}');
+  // Importing this module registered nothing: the first sign-in does.
+  expect(hasOAuthProvider(OIDC_PROVIDER)).toBe(false);
+});
+
+unitTest('a discovery that fails is refused, and the next sign-in tries again', async () => {
+  // No issuer configured: the sealed network refuses the fetch, and nothing is memoised.
+  await expect(oidcLegs({})).rejects.toBeDefined();
+  await expect(oidcLegs({})).rejects.toBeDefined();
+  expect(hasOAuthProvider(OIDC_PROVIDER)).toBe(false);
+});
+`;
+
+const routesSource =
+  (): string => `// The two OIDC legs as plain HTTP routes — \`runtime.ts\` hands them to both boots. Plain routes,
+// not actions: the callback is a redirect protocol whose shape the provider fixes.
+import { OAUTH_CALLBACK_ROUTE_PATH, OAUTH_START_ROUTE_PATH } from '@ultimat3/auth';
+import type { Route } from '@ultimat3/http';
+import { oidcLegs } from './oidc';
+
+const leg = (name: 'start' | 'callback', path: string): Route => ({
+  method: 'GET',
+  path,
+  // Public by definition: these two requests are how an anonymous visitor stops being one.
+  meta: { name: \`auth.oidc.\${name}\`, auth: 'public' },
+  handler: async (request) => (await oidcLegs())[name].handle(request.raw),
+});
+
+export const signInRoutes: readonly Route[] = [
+  leg('start', OAUTH_START_ROUTE_PATH),
+  leg('callback', OAUTH_CALLBACK_ROUTE_PATH),
+];
+`;
+
+const routesTest =
+  (): string => `// Both legs are mounted, public, at the framework's one declaration of where they live.
+import { OAUTH_CALLBACK_ROUTE_PATH, OAUTH_START_ROUTE_PATH } from '@ultimat3/auth';
+import { expect, unitTest } from '@ultimat3/testing';
+import { signInRoutes } from './sign-in-routes';
+
+unitTest('the start and callback legs are public GET routes at the framework paths', () => {
+  expect(signInRoutes.map((route) => [route.method, route.path, route.meta.auth])).toEqual([
+    ['GET', OAUTH_START_ROUTE_PATH, 'public'],
+    ['GET', OAUTH_CALLBACK_ROUTE_PATH, 'public'],
+  ]);
+});
+`;
+
+/** A link, not a form: the start leg is a GET that redirects to the provider. */
+const OIDC_FORM: SignInForm = {
+  comment: `// Sign in through the identity provider: one link to the start leg, which redirects there. Nothing
+// here hydrates, and no password ever reaches this app.`,
+  imports: ["import { Button, Link } from '@ultimat3/ui';"],
+  localImports: ["import { OIDC_START_PATH } from '../oidc';"],
+  props: false,
+  body: `      <Link href={OIDC_START_PATH} appearance="button">
+        {t('app.auth.signIn.continue')}
+      </Link>`,
+};
+
+export function oidcSignInFiles(
+  provider: string,
+  options: SignInTemplateOptions,
+): readonly GeneratedFile[] {
+  const module = options.catalogModule;
+  return [
+    ...sharedSignInFiles(
+      oidcSignInEnv(provider),
+      `The issuer and the client are ${provider}'s; SESSION_SECRET seals the handshake and APP_URL is where the provider sends the browser back.`,
+      {
+        importLine: "import { signInRoutes } from './app/auth/sign-in-routes';",
+        expression: 'signInRoutes',
+      },
+    ),
+    { path: `${AUTH_DIR}/oidc.ts`, contents: oidcSource(provider) },
+    { path: `${AUTH_DIR}/oidc.test.ts`, contents: oidcTest(provider) },
+    { path: `${AUTH_DIR}/sign-in-routes.ts`, contents: routesSource() },
+    { path: `${AUTH_DIR}/sign-in-routes.test.ts`, contents: routesTest() },
+    { path: `${AUTH_DIR}/sign-in/page.tsx`, contents: signInPageSource(module, OIDC_FORM) },
+    {
+      path: `${AUTH_DIR}/sign-in/page.test.ts`,
+      contents: signInPageTest(module, 'app.auth.signIn', `'href="/auth/oauth/${provider}"'`),
+    },
+    ...options.locales.map((locale) => ({
+      path: catalogPath(locale),
+      contents: catalogJson({
+        ...SIGN_IN_CATALOG,
+        'app.auth.signIn.continue': `Continue with ${provider}`,
+      }),
+      merge: 'json' as const,
+    })),
+  ];
+}

package/src/templates/sign-in-pages.ts

@@ -0,0 +1,148 @@
+// The pages `x g sign-in` writes, both shapes: the sign-in page (what proves who you are is the
+// shape's — a password form or a provider link), the second-factor page, and the sign-out form.
+// Native forms and links only: nothing hydrates, so each page ships 0 bytes of script.
+
+import { sortedImports } from './imports';
+import { catalogImport, SIGN_IN_PATH, translatorBinding } from './sign-in-shared';
+
+export interface SignInTemplateOptions {
+  readonly locales: readonly string[];
+  /** The app's `@<app>/i18n`; absent, the page imports `t` from `@ultimat3/i18n`. */
+  readonly catalogModule?: string | undefined;
+}
+
+/** What one shape puts on the sign-in page: its imports, its proof of identity, why. */
+export interface SignInForm {
+  readonly comment: string;
+  /** Bare specifiers only, sorted with the page's own. */
+  readonly imports: readonly string[];
+  /** Relative imports, after the bare block. */
+  readonly localImports: readonly string[];
+  readonly props: boolean;
+  readonly body: string;
+}
+
+const routeConfig = (key: string): string => `export const config = defineRoute({
+  render: 'stream',
+  hydrate: 'never',
+  // Never from a cache: a stale sign-in form posts at a build that has moved on.
+  offline: 'network-only',
+  budget: { js: '0kb' },
+  meta: ({ t }) => ({
+    title: t('${key}.title'),
+    description: t('${key}.description'),
+    robots: { index: false, follow: false },
+  }),
+});`;
+
+/** Every sign-in page carries the way out too: the one form that posts at `destroySession`. */
+const SIGN_OUT_FORM = `      <form method="post" action={derivePath('destroySession').path}>
+        <input type="hidden" name="confirm" value="sign-out" />
+        <Button type="submit" variant="secondary">
+          {t('app.auth.signOut.submit')}
+        </Button>
+      </form>`;
+
+export const signInPageSource = (
+  module: string | undefined,
+  form: SignInForm,
+): string => `${form.comment}
+${sortedImports([
+  catalogImport(module),
+  "import { derivePath } from '@ultimat3/action';",
+  "import { defineRoute } from '@ultimat3/render';",
+  ...form.imports,
+])}
+${[...form.localImports, "import styles from './page.module.scss';"].join('\n')}
+
+${routeConfig('app.auth.signIn')}
+${
+  form.props
+    ? `
+export interface SignInProps {
+  readonly query?: Readonly<Record<string, string>> | undefined;
+}
+`
+    : ''
+}
+export function Page(${form.props ? 'props: SignInProps' : ''}) {${translatorBinding(module)}
+  return (
+    <main class={styles.page}>
+      <h1>{t('app.auth.signIn.title')}</h1>
+${form.body}
+${SIGN_OUT_FORM}
+    </main>
+  );
+}
+`;
+
+/** The second leg posts the sign-in's \`next\` back, so \`confirmSession\` lands where it was going. */
+export const secondFactorSource = (
+  module: string | undefined,
+): string => `// The second leg of a sign-in: the code from an authenticator app, posted at \`confirmSession\`.
+${sortedImports([
+  catalogImport(module),
+  "import { derivePath } from '@ultimat3/action';",
+  "import { defineRoute } from '@ultimat3/render';",
+  "import { Button, Field, Input } from '@ultimat3/ui';",
+])}
+import { NEXT_PARAM, nextPath } from '../../sign-in-flow';
+import styles from '../page.module.scss';
+
+${routeConfig('app.auth.secondFactor')}
+
+export interface SecondFactorProps {
+  readonly query?: Readonly<Record<string, string>> | undefined;
+}
+
+export function Page(props: SecondFactorProps) {${translatorBinding(module)}
+  return (
+    <main class={styles.page}>
+      <h1>{t('app.auth.secondFactor.title')}</h1>
+      <form method="post" action={derivePath('confirmSession').path}>
+        <input type="hidden" name={NEXT_PARAM} value={nextPath(props.query?.[NEXT_PARAM])} />
+        <Field label={t('app.auth.secondFactor.code')} required>
+          {(control) => (
+            <Input {...control} name="code" inputmode="numeric" autocomplete="one-time-code" />
+          )}
+        </Field>
+        <Button type="submit">{t('app.auth.secondFactor.submit')}</Button>
+      </form>
+    </main>
+  );
+}
+`;
+
+/** The line that holds a page to its sign-out form. */
+const SIGN_OUT_EXPECTED = `  expect(view.html).toContain(\`action="\${derivePath('destroySession').path}"\`);
+`;
+
+/** The page renders, names itself, ships no island, and its form posts where `contains` says. */
+export const signInPageTest = (
+  module: string | undefined,
+  key: string,
+  contains: string,
+  signOut = true,
+): string => `// The page renders its form at the route it posts to, with no script and no search listing.
+${sortedImports([
+  catalogImport(module),
+  "import { derivePath } from '@ultimat3/action';",
+  "import { expect, renderRoute, unitTest } from '@ultimat3/testing';",
+])}
+import * as page from './page';
+
+unitTest('the page renders its form, names itself, and ships no island', async () => {${translatorBinding(module)}
+  const view = await renderRoute(page, { url: 'https://example.test${SIGN_IN_PATH}', params: {} });
+  expect(view.html).toContain(${contains});
+${signOut ? SIGN_OUT_EXPECTED : ''}  expect(view.meta.title).toBe(t('${key}.title'));
+  expect(view.islands).toEqual([]);
+  expect(page.config.budget.js).toBe('0kb');
+});
+`;
+
+/** The keys every sign-in page reads; a shape adds its own. */
+export const SIGN_IN_CATALOG: Readonly<Record<string, string>> = {
+  'app.auth.signIn.title': 'Sign in',
+  'app.auth.signIn.description': 'Sign in to your account.',
+  'app.auth.signOut.submit': 'Sign out',
+};

package/src/templates/sign-in-password.ts

@@ -0,0 +1,216 @@
+// `x g sign-in --password`: an address and a password over `login()`, the second leg over
+// `completeMfa()`, and the two native-form pages that post at them. No island: the browser's own
+// form handling is the client, so the pages ship 0 bytes of script.
+
+import { catalogJson } from './catalog-json';
+import { catalogPath } from './locales';
+import type { GeneratedFile } from './naming';
+import { confirmSessionTest, createSessionTest } from './sign-in-action-tests';
+import {
+  SIGN_IN_CATALOG,
+  type SignInForm,
+  type SignInTemplateOptions,
+  secondFactorSource,
+  signInPageSource,
+  signInPageTest,
+} from './sign-in-pages';
+import { AUTH_DIR, SIGN_IN_PATH, sharedSignInFiles } from './sign-in-shared';
+
+/** The master key seals the second-factor challenge between the two legs. */
+export const PASSWORD_SIGN_IN_ENV: readonly string[] = ['ULTIMATE_SECRETS_KEY'];
+
+const challengeSource =
+  (): string => `// The second-factor challenge between the two legs: a sealed, five-minute credential \`login()\`
+// hands back inside \`X_MFA_REQUIRED\`, carried in an HttpOnly cookie rather than a URL a log keeps.
+import { MFA_CHALLENGE_TTL_MS } from '@ultimat3/auth';
+import { isUltimateError } from '@ultimat3/core';
+import { deleteCookie, setCookie, useRequestCookie } from '@ultimat3/http';
+
+export const MFA_CHALLENGE_COOKIE = 'x_mfa_challenge';
+export const SECOND_FACTOR_PATH = '${SIGN_IN_PATH}/second-factor';
+
+/** The sealed challenge an \`X_MFA_REQUIRED\` carries, or \`null\` for any other throw. */
+export const challengeOf = (error: unknown): string | null => {
+  if (!isUltimateError(error) || error.code !== 'X_MFA_REQUIRED') return null;
+  const challenge = error.meta?.['challenge'];
+  return typeof challenge === 'string' && challenge !== '' ? challenge : null;
+};
+
+export const holdChallenge = (challenge: string): void =>
+  setCookie(MFA_CHALLENGE_COOKIE, challenge, { maxAge: Math.floor(MFA_CHALLENGE_TTL_MS / 1000) });
+
+export const heldChallenge = (): string | null => {
+  const value = useRequestCookie(MFA_CHALLENGE_COOKIE);
+  return value === null || value === '' ? null : value;
+};
+
+export const dropChallenge = (): void => deleteCookie(MFA_CHALLENGE_COOKIE);
+`;
+
+const challengeTest =
+  (): string => `// Only an X_MFA_REQUIRED carrying a challenge is a second leg; every other throw is not.
+import { UltimateError } from '@ultimat3/core';
+import { expect, unitTest } from '@ultimat3/testing';
+import { challengeOf } from './sign-in-challenge';
+
+const coded = (code: string, meta?: Record<string, unknown>) =>
+  new UltimateError({ code, cause: 'a test throw', fix: 'none', ...(meta ? { meta } : {}) });
+
+unitTest('a sealed challenge is read off X_MFA_REQUIRED, and nothing else is one', () => {
+  expect(challengeOf(coded('X_MFA_REQUIRED', { challenge: 'sealed' }))).toBe('sealed');
+  expect(challengeOf(coded('X_MFA_REQUIRED'))).toBeNull();
+  expect(challengeOf(coded('X_UNAUTHENTICATED', { challenge: 'sealed' }))).toBeNull();
+  expect(challengeOf('X_MFA_REQUIRED')).toBeNull();
+});
+`;
+
+const createSessionSource =
+  (): string => `// Sign in with an address and a password. \`login()\` is the whole check — the hash, the lockout and
+// one indistinguishable \`X_UNAUTHENTICATED\` for every way a credential is wrong. A second factor
+// still owed stops here with the sealed challenge held for the next page.
+import { action, t } from '@ultimat3/action';
+import { login } from '@ultimat3/auth';
+import { useRequestContext } from '@ultimat3/http';
+import { allow } from '@ultimat3/policy';
+import { appAuth } from '../auth';
+import { challengeOf, holdChallenge, SECOND_FACTOR_PATH } from '../sign-in-challenge';
+import { landAt, NEXT_PARAM, nextPath } from '../sign-in-flow';
+
+export const createSession = action({
+  input: t.object({
+    email: t.email,
+    password: t.string.min(1).max(1024),
+    [NEXT_PARAM]: t.optional(t.string.max(2048)),
+  }),
+  output: t.object({ ok: t.boolean, next: t.string, secondFactor: t.boolean }),
+  // Public by declaration: signing in is the one operation nobody holds a permission for yet.
+  policy: allow('public'),
+  mcp: { expose: false },
+  async handle({ input }) {
+    const request = useRequestContext('createSession');
+    try {
+      const signedIn = await login(appAuth(), {
+        email: input.email,
+        password: input.password,
+        ip: request.ip,
+      });
+      request.headers.append('set-cookie', signedIn.cookie);
+      return { ok: true, next: landAt(nextPath(input[NEXT_PARAM])), secondFactor: false };
+    } catch (error) {
+      const challenge = challengeOf(error);
+      if (challenge === null) throw error;
+      holdChallenge(challenge);
+      // The way on survives the second leg: its form posts \`next\` back to \`confirmSession\`.
+      const next = input[NEXT_PARAM];
+      const then =
+        next === undefined
+          ? SECOND_FACTOR_PATH
+          : \`\${SECOND_FACTOR_PATH}?\${NEXT_PARAM}=\${encodeURIComponent(nextPath(next))}\`;
+      return { ok: false, next: landAt(then), secondFactor: true };
+    }
+  },
+});
+`;
+
+const confirmSessionSource =
+  (): string => `// The second leg: the six digits (or one recovery code) against the challenge the first leg held.
+// \`completeMfa()\` meters the guess against the same lockout a password guess spends.
+import { action, t } from '@ultimat3/action';
+import { authUnauthenticated, completeMfa } from '@ultimat3/auth';
+import { useRequestContext } from '@ultimat3/http';
+import { allow } from '@ultimat3/policy';
+import { appAuth } from '../auth';
+import { dropChallenge, heldChallenge } from '../sign-in-challenge';
+import { landAt, NEXT_PARAM, nextPath } from '../sign-in-flow';
+
+export const confirmSession = action({
+  input: t.object({
+    code: t.string.min(1).max(64),
+    [NEXT_PARAM]: t.optional(t.string.max(2048)),
+  }),
+  output: t.object({ ok: t.boolean, next: t.string }),
+  policy: allow('public'),
+  mcp: { expose: false },
+  async handle({ input }) {
+    const request = useRequestContext('confirmSession');
+    const challenge = heldChallenge();
+    if (challenge === null) throw authUnauthenticated('POST confirmSession');
+    const signedIn = await completeMfa(appAuth(), challenge, input.code, { ip: request.ip });
+    dropChallenge();
+    request.headers.append('set-cookie', signedIn.cookie);
+    return { ok: true, next: landAt(nextPath(input[NEXT_PARAM])) };
+  },
+});
+`;
+
+/** An address and a password, posted at `createSession`, with the way back to where they were. */
+const PASSWORD_FORM: SignInForm = {
+  comment: `// Sign in: a native \`<form method="post">\` at the route \`createSession\` derives. Nothing here
+// hydrates, so the browser's own form handling is the client, and the page ships no script.`,
+  imports: ["import { Button, Field, Input } from '@ultimat3/ui';"],
+  localImports: ["import { NEXT_PARAM, nextPath } from '../sign-in-flow';"],
+  props: true,
+  body: `      <form method="post" action={derivePath('createSession').path}>
+        <input type="hidden" name={NEXT_PARAM} value={nextPath(props.query?.[NEXT_PARAM])} />
+        <Field label={t('app.auth.signIn.email')} required>
+          {(control) => <Input {...control} name="email" type="email" autocomplete="username" />}
+        </Field>
+        <Field label={t('app.auth.signIn.password')} required>
+          {(control) => (
+            <Input {...control} name="password" type="password" autocomplete="current-password" />
+          )}
+        </Field>
+        <Button type="submit">{t('app.auth.signIn.submit')}</Button>
+      </form>`,
+};
+
+const CATALOG: Readonly<Record<string, string>> = {
+  ...SIGN_IN_CATALOG,
+  'app.auth.signIn.email': 'Email',
+  'app.auth.signIn.password': 'Password',
+  'app.auth.signIn.submit': 'Sign in',
+  'app.auth.secondFactor.title': 'Second factor',
+  'app.auth.secondFactor.description': 'Enter the code from your authenticator app.',
+  'app.auth.secondFactor.code': 'Code',
+  'app.auth.secondFactor.submit': 'Continue',
+};
+
+/** The test's expectation that the page's form posts at `action`'s derived route. */
+const POSTS_AT = (action: string): string => `\`action="\${derivePath('${action}').path}"\``;
+
+export function passwordSignInFiles(options: SignInTemplateOptions): readonly GeneratedFile[] {
+  const module = options.catalogModule;
+  return [
+    ...sharedSignInFiles(
+      PASSWORD_SIGN_IN_ENV,
+      'The master key seals the second-factor challenge between the two legs.',
+    ),
+    { path: `${AUTH_DIR}/sign-in-challenge.ts`, contents: challengeSource() },
+    { path: `${AUTH_DIR}/sign-in-challenge.test.ts`, contents: challengeTest() },
+    { path: `${AUTH_DIR}/actions/create-session.ts`, contents: createSessionSource() },
+    {
+      path: `${AUTH_DIR}/actions/create-session.test.ts`,
+      contents: createSessionTest(),
+    },
+    { path: `${AUTH_DIR}/actions/confirm-session.ts`, contents: confirmSessionSource() },
+    {
+      path: `${AUTH_DIR}/actions/confirm-session.test.ts`,
+      contents: confirmSessionTest(),
+    },
+    { path: `${AUTH_DIR}/sign-in/page.tsx`, contents: signInPageSource(module, PASSWORD_FORM) },
+    {
+      path: `${AUTH_DIR}/sign-in/page.test.ts`,
+      contents: signInPageTest(module, 'app.auth.signIn', POSTS_AT('createSession')),
+    },
+    { path: `${AUTH_DIR}/sign-in/second-factor/page.tsx`, contents: secondFactorSource(module) },
+    {
+      path: `${AUTH_DIR}/sign-in/second-factor/page.test.ts`,
+      contents: signInPageTest(module, 'app.auth.secondFactor', POSTS_AT('confirmSession'), false),
+    },
+    ...options.locales.map((locale) => ({
+      path: catalogPath(locale),
+      contents: catalogJson(CATALOG),
+      merge: 'json' as const,
+    })),
+  ];
+}