@vonall/auth 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @vonall/auth
 
+## 0.3.1
+
+### Patch Changes
+
+- The code review's fixes: `svelte-sonner`, `bits-ui`, `@lucide/svelte` and `mode-watcher` are peer dependencies (one copy per app, so toasts reach the Product's Toaster); the login page no longer echoes unknown `?error=` codes and clears the URL's reason on a new attempt; every path goes through the base path; the settings page stays where the Product mounted it; copying the backup codes reports a failure.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -54,7 +54,7 @@ better-auth plugins and rate limit rule come from `@vonall/mcp` through `plugins
 <!-- src/routes/auth/signup/+page.svelte -->  <RegisterForm />
 <!-- src/routes/auth/reset-password -->       <ResetPasswordForm />
 <!-- src/routes/einladung/[token] -->         <EinladungPage {data} tagline={APP_TAGLINE} />
-<!-- src/routes/home/settings -->             <SettingsPage extraTabs={[agentsTab()]}>{#snippet extra(id)}…{/snippet}</SettingsPage>
+<!-- src/routes/home/settings -->             <SettingsPage extraTabs={[{ id: "agents", label, hint, icon: Bot }]}>{#snippet extra(id)}…{/snippet}</SettingsPage>
 <!-- src/routes/home/manage_user -->          <AdminView currentUserId={data.currentUserId} />
 ```
 

package/dist/messages.d.ts

@@ -57,6 +57,7 @@ export declare const en: {
     noNewAccountOpen: string;
     loginTooOld: string;
     confirmEmailFirst: string;
+    loginFailed: string;
     resetLinkNotSent: string;
     resetLinkSent: string;
     resetLinkNotRequested: string;

package/dist/messages.js

@@ -63,6 +63,7 @@ export const en = {
     noNewAccountOpen: "Accounts can't be created at the moment. Please try again later.",
     loginTooOld: "Your login is more than a day old. Please log in again for this action.",
     confirmEmailFirst: "Confirm your email address first: we just sent you a new link.",
+    loginFailed: "Login failed.",
     resetLinkNotSent: "The reset link could not be sent.",
     resetLinkSent: "If an account with this email address exists, a link to reset the password has been sent.",
     resetLinkNotRequested: "The reset link could not be requested.",
@@ -306,6 +307,7 @@ export const de = {
     noNewAccountOpen: "Im Moment können keine Konten erstellt werden. Bitte versuch es später wieder.",
     loginTooOld: "Deine Anmeldung ist älter als einen Tag. Melde dich für diese Aktion bitte neu an.",
     confirmEmailFirst: "Bestätige zuerst deine E-Mail-Adresse: Wir haben dir gerade einen neuen Link geschickt.",
+    loginFailed: "Die Anmeldung hat nicht geklappt.",
     resetLinkNotSent: "Der Link zum Zurücksetzen konnte nicht verschickt werden.",
     resetLinkSent: "Wenn es ein Konto mit dieser E-Mail-Adresse gibt, ist ein Link zum Zurücksetzen des Passworts unterwegs.",
     resetLinkNotRequested: "Der Link zum Zurücksetzen konnte nicht angefordert werden.",

package/dist/ui/DeletionTab.svelte

@@ -8,6 +8,7 @@
 	import { m } from "../messages.js";
 	import { deleteOwnAccount } from "../remote/app_user.remote.js";
 	import { authUi } from "./context.js";
+	import { href } from "./href.js";
 	import { messageOf } from "../util/messageOf.js";
 
 	/** Deleting the own account; `agents` adds the sentence about connected AI assistants (the MCP endpoint). */
@@ -27,7 +28,7 @@
 			if (res.success) {
 				toast.success(m().accountDeleted);
 				await authClient.signOut().catch(() => undefined);
-				window.location.href = "/";
+				window.location.href = href("/");
 			} else {
 				toast.error(m().accountNotDeleted);
 			}

package/dist/ui/LoginForm.svelte

@@ -37,7 +37,8 @@
 	const providers = $derived(page.data.providers as { github?: boolean; google?: boolean } | undefined);
 	const mail = $derived(page.data.mail as boolean);
 
-	const urlError = $derived(page.url.searchParams.get("error"));
+	// The reason the URL brought along (a refused social signup, a stale login); a fresh attempt replaces it
+	let urlError = $derived(page.url.searchParams.get("error"));
 	// A new account through GitHub or Google was refused: why depends on the signup mode
 	const noNewAccount = $derived(signupMode === "open" ? m().noNewAccountOpen : m().noNewAccountInvite);
 	const URL_ERRORS = $derived<Record<string, string>>({
@@ -47,7 +48,8 @@
 		session_not_fresh: m().loginTooOld,
 	});
 
-	const displayError = $derived(urlError ? (URL_ERRORS[urlError.toLowerCase()] ?? urlError) : errorMessage);
+	// Only known reasons are shown; an unknown code is not echoed (a link could plant any text here)
+	const displayError = $derived(urlError ? (URL_ERRORS[urlError.toLowerCase()] ?? m().loginFailed) : errorMessage);
 
 	async function requestPasswordReset(e: SubmitEvent) {
 		e.preventDefault();
@@ -57,7 +59,7 @@
 		}
 		sendingResetLink = true;
 		try {
-			const res = await authClient.requestPasswordReset({ email: forgotPasswordEmail, redirectTo: `${window.location.origin}/auth/reset-password` });
+			const res = await authClient.requestPasswordReset({ email: forgotPasswordEmail, redirectTo: `${window.location.origin}${href("/auth/reset-password")}` });
 			if (res.error) {
 				toast.error(res.error.message || m().resetLinkNotSent);
 			} else {
@@ -84,7 +86,7 @@
 		if (oauthRequest) {
 			// Fallback: with a session, the authorize endpoint continues the flow in the browser
 			const query = [...page.url.searchParams].filter(([key]) => key !== "sig" && key !== "exp");
-			window.location.href = `/api/auth/oauth2/authorize?${query.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&")}`;
+			window.location.href = `${href("/api/auth/oauth2/authorize")}?${query.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&")}`;
 			return;
 		}
 		// A new login: queries cached before it (one that sent here to log in again resolved empty) load again
@@ -99,6 +101,7 @@
 				onRequest: () => {
 					loading = true;
 					errorMessage = "";
+					urlError = null;
 				},
 				onSuccess: async (ctx) => {
 					loading = false;
@@ -169,8 +172,8 @@
 					<div class="grid gap-6">
 						{#if providers?.github || providers?.google}
 							<div class="flex flex-col gap-4">
-								{#if providers.github}<SocialButton provider="github" callbackURL={redirectTo ?? "/home"} />{/if}
-								{#if providers.google}<SocialButton provider="google" callbackURL={redirectTo ?? "/home"} />{/if}
+								{#if providers.github}<SocialButton provider="github" callbackURL={redirectTo ?? href("/home")} />{/if}
+								{#if providers.google}<SocialButton provider="google" callbackURL={redirectTo ?? href("/home")} />{/if}
 							</div>
 							<div class="after:border-border relative text-center text-sm after:absolute after:inset-0 after:top-1/2 after:z-0 after:flex after:items-center after:border-t">
 								<span class="bg-card text-muted-foreground relative z-10 px-2">{m().orWithEmail}</span>

package/dist/ui/RegisterForm.svelte

@@ -39,7 +39,7 @@
 		}
 		const name = email.split("@")[0]; // the server turns it into a readable name
 		await authClient.signUp.email(
-			{ email, password, name, callbackURL: "/home" },
+			{ email, password, name, callbackURL: href("/home") },
 			{
 				onRequest: () => {
 					loading = true;

package/dist/ui/SettingsPage.svelte

@@ -8,7 +8,6 @@
 	import type { AppUserClient } from "../types.js";
 	import { authUi } from "./context.js";
 	import DeletionTab from "./DeletionTab.svelte";
-	import { href } from "./href.js";
 	import InvitationsTab from "./InvitationsTab.svelte";
 	import LinksTab from "./LinksTab.svelte";
 	import MobileSettingsMenu from "./MobileSettingsMenu.svelte";
@@ -48,7 +47,7 @@
 		const url = new URL(page.url.href);
 		if (tabName) url.searchParams.set("tab", tabName);
 		else url.searchParams.delete("tab");
-		goto(`${href("/home/settings")}${url.search}`);
+		goto(`${page.url.pathname}${url.search}`); // wherever the Product mounted this page
 	}
 
 	const memberSince = $derived(user.createdAt ? new Date(user.createdAt).toLocaleDateString(locale, { year: "numeric", month: "long" }) : "");

package/dist/ui/SocialButton.svelte

@@ -2,16 +2,17 @@
 	import { Button } from "../components/ui/button/index.js";
 	import { m } from "../messages.js";
 	import { authUi } from "./context.js";
+	import { href } from "./href.js";
 	import IconGithub from "./IconGithub.svelte";
 	import IconGoogle from "./IconGoogle.svelte";
 
 	/** "Continue with GitHub/Google": starts the social sign-in with the Product's client. */
-	let { provider, callbackURL = "/home" }: { provider: "github" | "google"; callbackURL?: string } = $props();
+	let { provider, callbackURL = href("/home") }: { provider: "github" | "google"; callbackURL?: string } = $props();
 	const { authClient } = authUi();
 	const names = { github: "GitHub", google: "Google" };
 
 	async function login() {
-		await authClient.signIn.social({ provider, callbackURL, errorCallbackURL: "/auth/login" });
+		await authClient.signIn.social({ provider, callbackURL, errorCallbackURL: href("/auth/login") });
 	}
 </script>
 

package/dist/ui/TwoFactorAuthenticationCard.svelte

@@ -98,11 +98,15 @@
 		}
 	}
 
-	function handleCopyBackupCodes() {
-		navigator.clipboard.writeText(backupCodes.join("\n"));
-		isCopied = true;
-		toast.success(m().backupCodesCopied);
-		setTimeout(() => (isCopied = false), 2000);
+	async function handleCopyBackupCodes() {
+		try {
+			await navigator.clipboard.writeText(backupCodes.join("\n"));
+			isCopied = true;
+			toast.success(m().backupCodesCopied);
+			setTimeout(() => (isCopied = false), 2000);
+		} catch {
+			toast.error(m().copyLinkFailed);
+		}
 	}
 </script>
 

package/dist/util/fresh.js

@@ -12,7 +12,7 @@ export function isSessionNotFresh(e) {
 }
 /** The login page that signs out a stale session and then returns to `redirectTo`. */
 export function reauthPath(redirectTo) {
-    return `/auth/login?error=${SESSION_NOT_FRESH.toLowerCase()}&redirectTo=${encodeURIComponent(redirectTo)}`;
+    return `/auth/login?error=${SESSION_NOT_FRESH.toLowerCase()}&redirectTo=${encodeURIComponent(redirectTo)}`; // the Product's loads prefix the base path
 }
 /** better-auth's own check: a `freshAge` of 0 turns it off. */
 export function isStale(createdAt, freshAgeSeconds, now = new Date()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vonall/auth",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Accounts for a Web App Factory Product: better-auth with the hooks, the protected helpers, Einladungen, Konto, the auth pages and the settings; Admin as an option",
   "license": "MIT",
   "repository": {
@@ -58,7 +58,10 @@
     "neverthrow": "^8.2.0",
     "pg": "^8.23.1",
     "svelte": "^5.57.2",
-    "zod": "^4.6.7"
+    "zod": "^4.6.7",
+    "svelte-sonner": "^1.2.1",
+    "bits-ui": "^2.19.5",
+    "@lucide/svelte": "^1.22.0"
   },
   "devDependencies": {
     "@better-auth/mcp": "^1.7.12",
@@ -78,7 +81,10 @@
     "typescript": "^6.0.3",
     "vite": "8.3.4",
     "vitest": "^5.0.5",
-    "zod": "^4.6.7"
+    "zod": "^4.6.7",
+    "svelte-sonner": "^1.2.1",
+    "bits-ui": "^2.19.5",
+    "@lucide/svelte": "^1.22.0"
   },
   "imports": {
     "#lib": "./src/lib/index.js",
@@ -91,11 +97,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lucide/svelte": "1.22.0",
     "better-auth": "^1.7.12",
-    "bits-ui": "^2.20.2",
     "clsx": "^2.1.1",
-    "svelte-sonner": "^1.2.1",
     "tailwind-merge": "^3.7.0",
     "tailwind-variants": "^3.3.1",
     "uqr": "^0.1.3",