@user-hub/auth 0.1.3 → 0.1.5

package/README.md

@@ -39,10 +39,10 @@ HUB_ADMIN_PASSWORD=…
 Then, from your app's folder (`bunx` reads `.env` and `.env.local` automatically; with a secret manager, run it through that):
 
 ```sh
-bunx hub-user register --name "Your App" --prod https://your-app.com --dev http://localhost:3000
+bunx hub-user register --name "Your App" --new --prod https://your-app.com --dev http://localhost:3000
 ```
 
-It prints your **app key** (made from the name) and the values to set. Not deployed yet? Leave out `--prod`: you can develop, and badge scans start reaching the app once you add it. Run it again with the same `--name` to update the URLs; a URL left out keeps the registered one. Give every app its own name: the same name updates the same app. (A hub admin can do the same under **Apps** in the hub, and copy the values from **Setup**.)
+It prints your **app key** (made from the name) and the values to set. Not deployed yet? Leave out `--prod`: you can develop, and badge scans start reaching the app once you add it. Run it again with the same `--name` to update the URLs; a URL left out keeps the registered one. `--new` refuses to touch an app that already has that name, so you never take over someone else's; leave it out when updating your own app later. (A hub admin can do the same under **Apps** in the hub, and copy the values from **Setup**.)
 
 ### 3. Set the values
 
@@ -171,7 +171,7 @@ Apps without Convex use `HubAuthProvider` and `HubSignedIn` from `@user-hub/auth
 | both | `HubSignedIn` | Shows its children only when signed in. Props: `signedOut?`, `loading?` |
 | | `useHubUser()`, `useHubToken()`, `useHubSignOut()` | The person (or null), the raw token (or null), a sign-out function. Also from `/convex-react` |
 | `@user-hub/auth/server` | `verifyHubToken(requestOrToken, { app })` | Checks a token anywhere else |
-| CLI | `hub-user register --name <name> [--prod <url>] [--dev <url>] [--hub <url>] [--json]` | Registers or updates the app (at least one URL) |
+| CLI | `hub-user register --name <name> [--prod <url>] [--dev <url>] [--new] [--hub <url>] [--json]` | Registers or updates the app (at least one URL); `--new` only creates, exit code 3 if the name is taken |
 
 ## Developing this package
 

package/dist/cli.js

@@ -2,12 +2,14 @@
 
 // src/cli.ts
 import { parseArgs } from "node:util";
-var USAGE = `Usage: hub-user register --name <name> [--prod <url>] [--dev <url>] [--hub <url>] [--json]
+var USAGE = `Usage: hub-user register --name <name> [--prod <url>] [--dev <url>] [--new] [--hub <url>] [--json]
 
   --name   The app's name in the hub; its key comes from it (required)
   --prod   Where badge scans send people. Leave it out until the app is
            deployed: it can be developed, but not scheduled.
   --dev    Where developers open the app as a person, e.g. http://localhost:3000
+  --new    Only create a new app: if the name is taken, change nothing and
+           exit with code 3 so you can pick another name
   --hub    The hub's URL (default: HUB_URL)
   --json   Print JSON instead of text
 
@@ -30,6 +32,7 @@ var { values, positionals } = parseArgs({
     name: { type: "string" },
     hub: { type: "string" },
     json: { type: "boolean", default: false },
+    new: { type: "boolean", default: false },
     help: { type: "boolean", short: "h", default: false }
   }
 });
@@ -57,10 +60,18 @@ var response = await fetch(`${hub}/api/apps/register`, {
   body: JSON.stringify({
     name,
     ...values.prod !== undefined && { url: values.prod },
-    ...values.dev !== undefined && { devUrl: values.dev }
+    ...values.dev !== undefined && { devUrl: values.dev },
+    ...values.new && { createOnly: true }
   })
 }).catch((error) => fail(`could not reach ${hub}: ${error.message}`));
 var result = await response.json().catch(() => ({}));
+if (result.taken) {
+  if (values.json)
+    console.log(JSON.stringify(result, null, 2));
+  else
+    console.error(`hub-user: ${result.error}`);
+  process.exit(3);
+}
 if (!response.ok) {
   fail(result.error ?? `the hub answered ${response.status}`);
 }

package/dist/convex-react.js

@@ -13,11 +13,20 @@ import { useMemo } from "react";
 import { jsx } from "react/jsx-runtime";
 function useConvexHubAuth() {
   const session = useHubSession2();
+  const signOut = useHubSignOut2();
   return useMemo(() => ({
     isLoading: session === undefined,
     isAuthenticated: Boolean(session),
-    fetchAccessToken: async () => session && session.user.expiresAt > Date.now() ? session.token : null
-  }), [session]);
+    fetchAccessToken: async ({
+      forceRefreshToken
+    }) => {
+      if (forceRefreshToken) {
+        signOut();
+        return null;
+      }
+      return session && session.user.expiresAt > Date.now() ? session.token : null;
+    }
+  }), [session, signOut]);
 }
 function ConvexHubAuthProvider({
   client,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@user-hub/auth",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Sign people in from User Hub badges: Convex auth config, React provider, server verification and the hub-user CLI.",
   "type": "module",
   "files": [

package/skills/user-hub-auth/SKILL.md

@@ -12,10 +12,10 @@ People at a workshop scan a printed QR badge. The hub sends them to whichever ap
 If there is no app yet, don't build one by hand: scaffold one with sign-in already wired (TanStack Start + Convex, sign-in and sign-out, a facilitator page, `CLAUDE.md` and this skill):
 
 ```sh
-bun create @user-hub my-app
+bun create user-hub@latest my-app
 ```
 
-In a terminal it asks for the hub's URL and admin password and saves them to the new app's `.env.local`. As an agent you never handle the password, so either ask the human to run it, or run it only when `HUB_URL` and `HUB_ADMIN_PASSWORD` are already in the environment (for example `infisical run -- bun create @user-hub my-app`). Never pass `--admin-password` with a value you typed yourself.
+In a terminal it asks for the hub's URL and admin password and saves them to the new app's `.env.local`. As an agent you never handle the password, so either ask the human to run it, or run it only when `HUB_URL` and `HUB_ADMIN_PASSWORD` are already in the environment (for example `infisical run -- bun create user-hub@latest my-app`).
 
 Then:
 
@@ -58,9 +58,11 @@ You need four things. Ask for them; never guess.
 2. **Register the app** from the app's repo root, with `HUB_URL` and the password supplied the way the human chose in question 3 above:
 
    ```sh
-   bunx hub-user register --name "<app name>" --prod https://app.example.com --dev http://localhost:3000
+   bunx hub-user register --name "<app name>" --new --prod https://app.example.com --dev http://localhost:3000
    ```
 
+   `--new` makes sure you never take over another app: if the name is already taken, nothing changes and it exits with code 3 and "already exists". Then ask the human for another name and run it again. Drop `--new` only when updating this app's own registration later.
+
    Leave out `--prod` if the app is not deployed yet. Running it again with the same `--name` updates the URLs; a URL left out keeps the registered one. If it fails with "set HUB_URL", "set HUB_ADMIN_PASSWORD" or a wrong password, stop and ask the human; do not work around it.
 
    It prints the app **key** (made from the name), `HUB_ISSUER` and `HUB_JWKS` (server side) and `VITE_HUB_URL` (frontend). Add `--json` to parse them.