@voltro/plugin-auth 0.5.0 → 0.7.0

package/dist/plugin.d.ts

@@ -7,9 +7,21 @@ import { VoltroPlugin } from '@voltro/protocol';
 import { YieldableError } from 'effect/Cause';
 
 declare interface AuthConfig {
-    readonly secret: string;
+    /**
+     * The session-signing key. OMIT IT and the value is read from
+     * `VOLTRO_SESSION_SECRET` when a request is actually handled.
+     *
+     * Omitting is the better default: `app.config.ts` is evaluated before the
+     * environment gate runs (and before `voltro dev` mints a project-local
+     * secret), so reading `process.env` here to pass a value is precisely what
+     * pushes apps into shipping a hardcoded fallback. Deferring the read means
+     * there is nothing to fall back TO.
+     *
+     * Pass one explicitly only when the key does not come from the environment.
+     */
+    readonly secret?: string;
     /** Explicit keyed secret set for zero-downtime rotation. When absent,
-     *  the set is derived from `secret` (current) + the
+     *  the set is derived from `secret` (or `VOLTRO_SESSION_SECRET`) plus the
      *  `VOLTRO_SESSION_SECRET_PREVIOUS` / `VOLTRO_SESSION_KID*` env vars —
      *  so env-var rotation works without setting this. Cookies are always
      *  SIGNED with the current key; verification also accepts `previous`. */
@@ -191,10 +203,32 @@ declare interface SessionRevocationOptions {
  * framework never reads it, but app code + the switch-tenant menu do).
  * Pass an explicit `tenantId` to make the ACTIVE tenant differ from the
  * user's home tenant (post switch-tenant rebind).
+ *
+ * `metadata` carries anything else the app needs on the Subject — most
+ * often a provider credential captured at login and read back by a
+ * plugin's `credentialsResolver` (`subject.metadata.jiraToken` for
+ * `@voltro/plugin-atlassian`, say). Without it an app that needs such a
+ * credential could not adopt this helper at all: building the Subject by
+ * hand was the only way to keep the value.
+ *
+ * **Precedence, when a `memberships` key appears in BOTH:** the dedicated
+ * `memberships` option wins. It is the specific, typed input and it is
+ * projected to the `{ tenantId, role }` shape `subjectMemberships` reads,
+ * so letting a free-form bag silently shadow it would break the
+ * switch-tenant menu in a way nothing type-checks. A `memberships` key
+ * inside `metadata` is passed through UNCHANGED when the option is absent
+ * — no reshaping, no validation.
+ *
+ * Note this only stamps the metadata slot at CONSTRUCTION. The sign-in /
+ * sign-up / magic-link / passkey handlers later merge `sessionId` (and
+ * the password strategy merges `provider`) onto whatever is here, so keys
+ * set through this option survive those paths — unless you name a key
+ * `sessionId` or `provider`, which those merges overwrite by design.
  */
 declare const subjectFromUser: (user: UserRecord, options?: {
     readonly tenantId?: string;
     readonly memberships?: ReadonlyArray<MembershipRecord>;
+    readonly metadata?: Record<string, unknown>;
 }) => Subject;
 
 /**

package/dist/plugin.js

@@ -1,4 +1,4 @@
 import "./session.js";
-import { n as e, t } from "./plugin-CRt-kdEA.js";
+import { n as e, t } from "./plugin-CQ_NyxPr.js";
 import "./csrf.js";
 export { t as authRoutesPlugin, e as getAuthSessionStrategy };

package/dist/session.d.ts

@@ -81,6 +81,4 @@ export declare const sessionSecretsOf: (secret: SessionSecretInput) => SessionSe
 
 export { VerifyResult }
 
-export declare const VOLTRO_DEV_SESSION_SECRET: "voltro-dev-session-secret-32b-DO-NOT-USE-IN-PROD";
-
 export { }

package/dist/session.js

@@ -1,20 +1,20 @@
-import { DEFAULT_SESSION_KID as e, VOLTRO_DEV_SESSION_SECRET as t, buildSetCookie as n, readCookie as r, resolveSessionSecret as i, resolveSessionSecrets as a, signSession as o, timingSafeStringEqual as s, verifySessionKeyed as c } from "@voltro/protocol/session";
+import { DEFAULT_SESSION_KID as e, buildSetCookie as t, readCookie as n, resolveOptionalSessionSecrets as r, resolveSessionSecret as i, resolveSessionSecrets as a, signSession as o, timingSafeStringEqual as s, verifySessionKeyed as c } from "@voltro/protocol/session";
 //#region src/session.ts
-var l = "voltro:session", u = 3600 * 24 * 7, d = t, f = i, p = a, m = (e) => typeof e == "string" ? e : e.current, h = (t) => {
+var l = "voltro:session", u = 3600 * 24 * 7, d = i, f = a, p = (e) => typeof e == "string" ? e : e.current, m = (t) => {
 	if (typeof t != "string") return t;
-	let n = a(), r = {
-		kid: s(n.current.secret, t) ? n.current.kid : e,
+	let n = r(), i = {
+		kid: n && s(n.current.secret, t) ? n.current.kid : e,
 		secret: t
 	};
-	return n.previous ? {
-		current: r,
+	return n?.previous ? {
+		current: i,
 		previous: n.previous
-	} : { current: r };
-}, g = (e, t, r = {}) => {
-	let i = r.ttlSeconds ?? u, a = o(e, m(t), { ttlSeconds: i });
+	} : { current: i };
+}, h = (e, n, r = {}) => {
+	let i = r.ttlSeconds ?? u, a = o(e, p(n), { ttlSeconds: i });
 	return {
 		value: a,
-		setCookie: n(l, a, {
+		setCookie: t(l, a, {
 			maxAgeSeconds: i,
 			httpOnly: !0,
 			sameSite: "lax",
@@ -23,10 +23,10 @@ var l = "voltro:session", u = 3600 * 24 * 7, d = t, f = i, p = a, m = (e) => typ
 			path: "/"
 		})
 	};
-}, _ = (e, t) => v(e, t)?.subject ?? null, v = (e, t, n = {}) => {
-	let i = r(e, l);
-	return i ? c(i, h(t), n) : null;
-}, y = (e = {}) => n(l, "", {
+}, g = (e, t) => _(e, t)?.subject ?? null, _ = (e, t, r = {}) => {
+	let i = n(e, l);
+	return i ? c(i, m(t), r) : null;
+}, v = (e = {}) => t(l, "", {
 	maxAgeSeconds: 0,
 	httpOnly: !0,
 	sameSite: "lax",
@@ -35,4 +35,4 @@ var l = "voltro:session", u = 3600 * 24 * 7, d = t, f = i, p = a, m = (e) => typ
 	path: "/"
 });
 //#endregion
-export { l as SESSION_COOKIE_NAME, d as VOLTRO_DEV_SESSION_SECRET, y as clearSessionCookie, g as issueSession, _ as readSession, v as readSessionKeyed, f as resolveSessionSecret, p as resolveSessionSecrets, h as sessionSecretsOf };
+export { l as SESSION_COOKIE_NAME, v as clearSessionCookie, h as issueSession, g as readSession, _ as readSessionKeyed, d as resolveSessionSecret, f as resolveSessionSecrets, m as sessionSecretsOf };

package/dist/{strategy-CQ2YCIcr.js → strategy-D345j4df.js}

@@ -175,15 +175,18 @@ var s = 3e4, c = 1e4, l = (e, t = {}) => {
 			}, !0);
 		})
 	};
-}, m = (e, t = {}) => ({
-	type: "user",
-	id: e.id,
-	tenantId: t.tenantId ?? e.tenantId,
-	...t.memberships ? { metadata: { memberships: t.memberships.map((e) => ({
+}, m = (e, t = {}) => {
+	let n = { ...t.metadata };
+	return t.memberships && (n.memberships = t.memberships.map((e) => ({
 		tenantId: e.tenantId,
 		role: e.role
-	})) } } : {}
-}), h = (e) => {
+	}))), {
+		type: "user",
+		id: e.id,
+		tenantId: t.tenantId ?? e.tenantId,
+		...Object.keys(n).length > 0 ? { metadata: n } : {}
+	};
+}, h = (e) => {
 	if (e.type !== "user") return null;
 	let t = e.metadata?.sessionId;
 	return typeof t == "string" && t.length > 0 ? t : null;

package/dist/strategy.js

@@ -1,3 +1,3 @@
 import "./session.js";
-import { t as e } from "./strategy-CQ2YCIcr.js";
+import { t as e } from "./strategy-D345j4df.js";
 export { e as voltroPasswordStrategy };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-auth",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Authentication primitives: password hashing, session creation, schema mixin + tables. Pairs with the `auth` app template for the UI; both independently usable. Server-side only (uses node:crypto).",
   "keywords": [
     "voltro",
@@ -78,8 +78,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.51.1",
-    "@voltro/database": "0.5.0",
-    "@voltro/protocol": "0.5.0"
+    "@voltro/database": "0.7.0",
+    "@voltro/protocol": "0.7.0"
   },
   "peerDependencies": {
     "effect": "^3.21.4",