@vonall/auth 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @vonall/auth
 
+## 0.4.0
+
+### Minor Changes
+
+- The pass-through services are gone: `UserRepo.kontoLoeschen` replaces `KontoService.loeschen`; `EinladungRepo.listOpenBy`/`listAllOpen` replace `EinladungService.offene`/`alleOffenen`, and `EinladungService.zurueckziehen(null, id)` the admin's withdrawal; `AgentRepo` replaces `AgentService`. `@vonall/mcp`'s components use `@vonall/auth`'s `messageOf`.
+
+## 0.3.1
+
+### Patch Changes
+
+- The code review's fixes: `svelte-sonner`, `bits-ui`, `@lucide/svelte` and `mode-watcher` are peer dependencies (one copy per app, so toasts reach the Product's Toaster); the login page no longer echoes unknown `?error=` codes and clears the URL's reason on a new attempt; every path goes through the base path; the settings page stays where the Product mounted it; copying the backup codes reports a failure.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -54,7 +54,7 @@ better-auth plugins and rate limit rule come from `@vonall/mcp` through `plugins
 <!-- src/routes/auth/signup/+page.svelte -->  <RegisterForm />
 <!-- src/routes/auth/reset-password -->       <ResetPasswordForm />
 <!-- src/routes/einladung/[token] -->         <EinladungPage {data} tagline={APP_TAGLINE} />
-<!-- src/routes/home/settings -->             <SettingsPage extraTabs={[agentsTab()]}>{#snippet extra(id)}…{/snippet}</SettingsPage>
+<!-- src/routes/home/settings -->             <SettingsPage extraTabs={[{ id: "agents", label, hint, icon: Bot }]}>{#snippet extra(id)}…{/snippet}</SettingsPage>
 <!-- src/routes/home/manage_user -->          <AdminView currentUserId={data.currentUserId} />
 ```
 

package/dist/messages.d.ts

@@ -57,6 +57,7 @@ export declare const en: {
     noNewAccountOpen: string;
     loginTooOld: string;
     confirmEmailFirst: string;
+    loginFailed: string;
     resetLinkNotSent: string;
     resetLinkSent: string;
     resetLinkNotRequested: string;

package/dist/messages.js

@@ -63,6 +63,7 @@ export const en = {
     noNewAccountOpen: "Accounts can't be created at the moment. Please try again later.",
     loginTooOld: "Your login is more than a day old. Please log in again for this action.",
     confirmEmailFirst: "Confirm your email address first: we just sent you a new link.",
+    loginFailed: "Login failed.",
     resetLinkNotSent: "The reset link could not be sent.",
     resetLinkSent: "If an account with this email address exists, a link to reset the password has been sent.",
     resetLinkNotRequested: "The reset link could not be requested.",
@@ -306,6 +307,7 @@ export const de = {
     noNewAccountOpen: "Im Moment können keine Konten erstellt werden. Bitte versuch es später wieder.",
     loginTooOld: "Deine Anmeldung ist älter als einen Tag. Melde dich für diese Aktion bitte neu an.",
     confirmEmailFirst: "Bestätige zuerst deine E-Mail-Adresse: Wir haben dir gerade einen neuen Link geschickt.",
+    loginFailed: "Die Anmeldung hat nicht geklappt.",
     resetLinkNotSent: "Der Link zum Zurücksetzen konnte nicht verschickt werden.",
     resetLinkSent: "Wenn es ein Konto mit dieser E-Mail-Adresse gibt, ist ein Link zum Zurücksetzen des Passworts unterwegs.",
     resetLinkNotRequested: "Der Link zum Zurücksetzen konnte nicht angefordert werden.",

package/dist/remote/app_user.remote.js

@@ -5,7 +5,6 @@ import { m } from "../messages.js";
 import { adminQuery, adminSchemaCommand, protectedCommand, protectedForm, protectedQuery, protectedSchemaCommand } from "../server/helpers.js";
 import { authInstance } from "../server/registry.js";
 import { UserRepo } from "../server/repositories/UserRepo.js";
-import { KontoService } from "../server/service/konto.service.js";
 import { emailSchema, nameSchema, passwordSchema } from "../types.js";
 import { isSessionNotFresh, reauthPath } from "../util/fresh.js";
 /** The Admin option: every account. */
@@ -80,12 +79,12 @@ export const deleteUser = adminSchemaCommand(z.object({ userId: z.string() }), a
     if (userId === admin.id) {
         throw error(400, { message: m().ownAccount, id: "own_account", timestamp: new Date().toISOString() });
     }
-    await KontoService.loeschen(userId);
+    await UserRepo.kontoLoeschen(userId);
     await getAllUsers().refresh();
     return { success: true };
 });
 /** Deletes the user's own account with all its data. */
 export const deleteOwnAccount = protectedCommand(async (user) => {
-    await KontoService.loeschen(user.id);
+    await UserRepo.kontoLoeschen(user.id);
     return { success: true };
 });

package/dist/remote/einladung.remote.d.ts

@@ -1,6 +1,11 @@
 /** The user's open Einladungen, and whether the server can send them by email. */
 export declare const getOffeneEinladungen: import("$app/server").RemoteQueryFunction<void, {
-    einladungen: import("../types.js").OffeneEinladung[];
+    einladungen: {
+        id: string;
+        email: string | null;
+        expiresAt: Date;
+        createdAt: Date;
+    }[];
     mail: boolean;
 }, void>;
 /** Creates an Einladung; the link is returned only here. With an email, it is also sent (if mail is set up). */

package/dist/remote/einladung.remote.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { m } from "../messages.js";
 import { adminQuery, adminSchemaCommand, protectedQuery, protectedSchemaCommand } from "../server/helpers.js";
 import { registry } from "../server/registry.js";
+import { EinladungRepo } from "../server/repositories/EinladungRepo.js";
 import { EinladungService } from "../server/service/einladung.service.js";
 import { sendEinladungEmail } from "../server/service/mail.js";
 import { emailSchema } from "../types.js";
@@ -15,7 +16,7 @@ function unwrap(result) {
 }
 /** The user's open Einladungen, and whether the server can send them by email. */
 export const getOffeneEinladungen = protectedQuery(async (user) => {
-    return { einladungen: await EinladungService.offene(user.id), mail: registry().mailer.enabled };
+    return { einladungen: await EinladungRepo.listOpenBy(user.id, new Date()), mail: registry().mailer.enabled };
 });
 /** Creates an Einladung; the link is returned only here. With an email, it is also sent (if mail is set up). */
 export const createEinladung = protectedSchemaCommand(z.object({ email: emailSchema.nullable() }), async ({ email }, user) => {
@@ -47,10 +48,10 @@ export const withdrawEinladung = protectedSchemaCommand(z.object({ einladungId:
 });
 /** The Admin option: every open Einladung, and withdrawing any of them. */
 export const getAlleEinladungen = adminQuery(async () => {
-    return await EinladungService.alleOffenen();
+    return await EinladungRepo.listAllOpen(new Date());
 });
 export const adminWithdrawEinladung = adminSchemaCommand(z.object({ einladungId: z.string() }), async ({ einladungId }) => {
-    unwrap(await EinladungService.zurueckziehenAlsAdmin(einladungId));
+    unwrap(await EinladungService.zurueckziehen(null, einladungId));
     await getAlleEinladungen().refresh();
     await getOffeneEinladungen().refresh();
 });

package/dist/server/index.d.ts

@@ -5,5 +5,4 @@ export { authInstance, registry as authRegistry, type AuthLog, type Db } from ".
 export { EinladungRepo } from "./repositories/EinladungRepo.js";
 export { UserRepo } from "./repositories/UserRepo.js";
 export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, EinladungService, type EinladungError } from "./service/einladung.service.js";
-export { KontoService } from "./service/konto.service.js";
 export { sendEinladungEmail, sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";

package/dist/server/index.js

@@ -5,5 +5,4 @@ export { authInstance, registry as authRegistry } from "./registry.js";
 export { EinladungRepo } from "./repositories/EinladungRepo.js";
 export { UserRepo } from "./repositories/UserRepo.js";
 export { EINLADUNG_COOKIE, EINLADUNG_GUELTIG_TAGE, EinladungService } from "./service/einladung.service.js";
-export { KontoService } from "./service/konto.service.js";
 export { sendEinladungEmail, sendPasswordResetEmail, sendVerifyEmail } from "./service/mail.js";

package/dist/server/repositories/UserRepo.d.ts

@@ -14,6 +14,9 @@ export declare const UserRepo: {
         providerId: string;
         updatedAt: Date;
     }[]>;
-    /** Deletes the user; every row that belongs to them goes with it (foreign keys cascade). */
-    deleteUser(userId: string): Promise<void>;
+    /**
+     * Deletes the Konto: the user with everything that belongs to them (the foreign keys of every user-owned table
+     * cascade, so a Product's own tables reference `user.id` with `onDelete: "cascade"`).
+     */
+    kontoLoeschen(userId: string): Promise<void>;
 };

package/dist/server/repositories/UserRepo.js

@@ -59,8 +59,11 @@ export const UserRepo = {
             .from(schema.account)
             .where(eq(schema.account.userId, userId));
     },
-    /** Deletes the user; every row that belongs to them goes with it (foreign keys cascade). */
-    async deleteUser(userId) {
+    /**
+     * Deletes the Konto: the user with everything that belongs to them (the foreign keys of every user-owned table
+     * cascade, so a Product's own tables reference `user.id` with `onDelete: "cascade"`).
+     */
+    async kontoLoeschen(userId) {
         const { db, schema } = registry();
         await db.delete(schema.user).where(eq(schema.user.id, userId));
     },

package/dist/server/service/einladung.service.d.ts

@@ -1,5 +1,5 @@
 import { type Result } from "neverthrow";
-import type { EinladungInfo, OffeneEinladung, SignupMode, SignupState } from "../../types.js";
+import type { EinladungInfo, SignupMode, SignupState } from "../../types.js";
 export declare const EINLADUNG_GUELTIG_TAGE = 14;
 /** The cookie that carries an Einladung's token from its link through signup (email, Google or GitHub). */
 export declare const EINLADUNG_COOKIE = "einladung";
@@ -33,16 +33,6 @@ export declare const EinladungService: {
     }>;
     /** Uses the Einladung for the new user: marks it as taken. */
     annehmen(userId: string, token: string, now?: Date): Promise<Result<void, EinladungError>>;
-    offene(userId: string, now?: Date): Promise<OffeneEinladung[]>;
-    /** Withdraws an open Einladung of the user. */
-    zurueckziehen(userId: string, einladungId: string): Promise<Result<void, EinladungError>>;
-    /** For the admin: every open Einladung, and withdrawing any of them. */
-    alleOffenen(now?: Date): Promise<{
-        id: string;
-        email: string | null;
-        inviterName: string;
-        expiresAt: Date;
-        createdAt: Date;
-    }[]>;
-    zurueckziehenAlsAdmin(einladungId: string): Promise<Result<void, EinladungError>>;
+    /** Withdraws an open Einladung of the user, or any open one when `userId` is null (the admin). */
+    zurueckziehen(userId: string | null, einladungId: string): Promise<Result<void, EinladungError>>;
 };

package/dist/server/service/einladung.service.js

@@ -59,18 +59,8 @@ export const EinladungService = {
             return err(fehler.angenommen());
         return ok(undefined);
     },
-    async offene(userId, now = new Date()) {
-        return await EinladungRepo.listOpenBy(userId, now);
-    },
-    /** Withdraws an open Einladung of the user. */
+    /** Withdraws an open Einladung of the user, or any open one when `userId` is null (the admin). */
     async zurueckziehen(userId, einladungId) {
         return (await EinladungRepo.deleteOpen(einladungId, userId)) ? ok(undefined) : err(fehler.unbekannt());
     },
-    /** For the admin: every open Einladung, and withdrawing any of them. */
-    async alleOffenen(now = new Date()) {
-        return await EinladungRepo.listAllOpen(now);
-    },
-    async zurueckziehenAlsAdmin(einladungId) {
-        return (await EinladungRepo.deleteOpen(einladungId, null)) ? ok(undefined) : err(fehler.unbekannt());
-    },
 };

package/dist/ui/DeletionTab.svelte

@@ -8,6 +8,7 @@
 	import { m } from "../messages.js";
 	import { deleteOwnAccount } from "../remote/app_user.remote.js";
 	import { authUi } from "./context.js";
+	import { href } from "./href.js";
 	import { messageOf } from "../util/messageOf.js";
 
 	/** Deleting the own account; `agents` adds the sentence about connected AI assistants (the MCP endpoint). */
@@ -27,7 +28,7 @@
 			if (res.success) {
 				toast.success(m().accountDeleted);
 				await authClient.signOut().catch(() => undefined);
-				window.location.href = "/";
+				window.location.href = href("/");
 			} else {
 				toast.error(m().accountNotDeleted);
 			}

package/dist/ui/LoginForm.svelte

@@ -37,7 +37,8 @@
 	const providers = $derived(page.data.providers as { github?: boolean; google?: boolean } | undefined);
 	const mail = $derived(page.data.mail as boolean);
 
-	const urlError = $derived(page.url.searchParams.get("error"));
+	// The reason the URL brought along (a refused social signup, a stale login); a fresh attempt replaces it
+	let urlError = $derived(page.url.searchParams.get("error"));
 	// A new account through GitHub or Google was refused: why depends on the signup mode
 	const noNewAccount = $derived(signupMode === "open" ? m().noNewAccountOpen : m().noNewAccountInvite);
 	const URL_ERRORS = $derived<Record<string, string>>({
@@ -47,7 +48,8 @@
 		session_not_fresh: m().loginTooOld,
 	});
 
-	const displayError = $derived(urlError ? (URL_ERRORS[urlError.toLowerCase()] ?? urlError) : errorMessage);
+	// Only known reasons are shown; an unknown code is not echoed (a link could plant any text here)
+	const displayError = $derived(urlError ? (URL_ERRORS[urlError.toLowerCase()] ?? m().loginFailed) : errorMessage);
 
 	async function requestPasswordReset(e: SubmitEvent) {
 		e.preventDefault();
@@ -57,7 +59,7 @@
 		}
 		sendingResetLink = true;
 		try {
-			const res = await authClient.requestPasswordReset({ email: forgotPasswordEmail, redirectTo: `${window.location.origin}/auth/reset-password` });
+			const res = await authClient.requestPasswordReset({ email: forgotPasswordEmail, redirectTo: `${window.location.origin}${href("/auth/reset-password")}` });
 			if (res.error) {
 				toast.error(res.error.message || m().resetLinkNotSent);
 			} else {
@@ -84,7 +86,7 @@
 		if (oauthRequest) {
 			// Fallback: with a session, the authorize endpoint continues the flow in the browser
 			const query = [...page.url.searchParams].filter(([key]) => key !== "sig" && key !== "exp");
-			window.location.href = `/api/auth/oauth2/authorize?${query.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&")}`;
+			window.location.href = `${href("/api/auth/oauth2/authorize")}?${query.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&")}`;
 			return;
 		}
 		// A new login: queries cached before it (one that sent here to log in again resolved empty) load again
@@ -99,6 +101,7 @@
 				onRequest: () => {
 					loading = true;
 					errorMessage = "";
+					urlError = null;
 				},
 				onSuccess: async (ctx) => {
 					loading = false;
@@ -169,8 +172,8 @@
 					<div class="grid gap-6">
 						{#if providers?.github || providers?.google}
 							<div class="flex flex-col gap-4">
-								{#if providers.github}<SocialButton provider="github" callbackURL={redirectTo ?? "/home"} />{/if}
-								{#if providers.google}<SocialButton provider="google" callbackURL={redirectTo ?? "/home"} />{/if}
+								{#if providers.github}<SocialButton provider="github" callbackURL={redirectTo ?? href("/home")} />{/if}
+								{#if providers.google}<SocialButton provider="google" callbackURL={redirectTo ?? href("/home")} />{/if}
 							</div>
 							<div class="after:border-border relative text-center text-sm after:absolute after:inset-0 after:top-1/2 after:z-0 after:flex after:items-center after:border-t">
 								<span class="bg-card text-muted-foreground relative z-10 px-2">{m().orWithEmail}</span>

package/dist/ui/RegisterForm.svelte

@@ -39,7 +39,7 @@
 		}
 		const name = email.split("@")[0]; // the server turns it into a readable name
 		await authClient.signUp.email(
-			{ email, password, name, callbackURL: "/home" },
+			{ email, password, name, callbackURL: href("/home") },
 			{
 				onRequest: () => {
 					loading = true;

package/dist/ui/SettingsPage.svelte

@@ -8,7 +8,6 @@
 	import type { AppUserClient } from "../types.js";
 	import { authUi } from "./context.js";
 	import DeletionTab from "./DeletionTab.svelte";
-	import { href } from "./href.js";
 	import InvitationsTab from "./InvitationsTab.svelte";
 	import LinksTab from "./LinksTab.svelte";
 	import MobileSettingsMenu from "./MobileSettingsMenu.svelte";
@@ -48,7 +47,7 @@
 		const url = new URL(page.url.href);
 		if (tabName) url.searchParams.set("tab", tabName);
 		else url.searchParams.delete("tab");
-		goto(`${href("/home/settings")}${url.search}`);
+		goto(`${page.url.pathname}${url.search}`); // wherever the Product mounted this page
 	}
 
 	const memberSince = $derived(user.createdAt ? new Date(user.createdAt).toLocaleDateString(locale, { year: "numeric", month: "long" }) : "");

package/dist/ui/SocialButton.svelte

@@ -2,16 +2,17 @@
 	import { Button } from "../components/ui/button/index.js";
 	import { m } from "../messages.js";
 	import { authUi } from "./context.js";
+	import { href } from "./href.js";
 	import IconGithub from "./IconGithub.svelte";
 	import IconGoogle from "./IconGoogle.svelte";
 
 	/** "Continue with GitHub/Google": starts the social sign-in with the Product's client. */
-	let { provider, callbackURL = "/home" }: { provider: "github" | "google"; callbackURL?: string } = $props();
+	let { provider, callbackURL = href("/home") }: { provider: "github" | "google"; callbackURL?: string } = $props();
 	const { authClient } = authUi();
 	const names = { github: "GitHub", google: "Google" };
 
 	async function login() {
-		await authClient.signIn.social({ provider, callbackURL, errorCallbackURL: "/auth/login" });
+		await authClient.signIn.social({ provider, callbackURL, errorCallbackURL: href("/auth/login") });
 	}
 </script>
 

package/dist/ui/TwoFactorAuthenticationCard.svelte

@@ -98,11 +98,15 @@
 		}
 	}
 
-	function handleCopyBackupCodes() {
-		navigator.clipboard.writeText(backupCodes.join("\n"));
-		isCopied = true;
-		toast.success(m().backupCodesCopied);
-		setTimeout(() => (isCopied = false), 2000);
+	async function handleCopyBackupCodes() {
+		try {
+			await navigator.clipboard.writeText(backupCodes.join("\n"));
+			isCopied = true;
+			toast.success(m().backupCodesCopied);
+			setTimeout(() => (isCopied = false), 2000);
+		} catch {
+			toast.error(m().copyLinkFailed);
+		}
 	}
 </script>
 

package/dist/util/fresh.js

@@ -12,7 +12,7 @@ export function isSessionNotFresh(e) {
 }
 /** The login page that signs out a stale session and then returns to `redirectTo`. */
 export function reauthPath(redirectTo) {
-    return `/auth/login?error=${SESSION_NOT_FRESH.toLowerCase()}&redirectTo=${encodeURIComponent(redirectTo)}`;
+    return `/auth/login?error=${SESSION_NOT_FRESH.toLowerCase()}&redirectTo=${encodeURIComponent(redirectTo)}`; // the Product's loads prefix the base path
 }
 /** better-auth's own check: a `freshAge` of 0 turns it off. */
 export function isStale(createdAt, freshAgeSeconds, now = new Date()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vonall/auth",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Accounts for a Web App Factory Product: better-auth with the hooks, the protected helpers, Einladungen, Konto, the auth pages and the settings; Admin as an option",
   "license": "MIT",
   "repository": {
@@ -58,7 +58,10 @@
     "neverthrow": "^8.2.0",
     "pg": "^8.23.1",
     "svelte": "^5.57.2",
-    "zod": "^4.6.7"
+    "zod": "^4.6.7",
+    "svelte-sonner": "^1.2.1",
+    "bits-ui": "^2.19.5",
+    "@lucide/svelte": "^1.22.0"
   },
   "devDependencies": {
     "@better-auth/mcp": "^1.7.12",
@@ -78,7 +81,10 @@
     "typescript": "^6.0.3",
     "vite": "8.3.4",
     "vitest": "^5.0.5",
-    "zod": "^4.6.7"
+    "zod": "^4.6.7",
+    "svelte-sonner": "^1.2.1",
+    "bits-ui": "^2.19.5",
+    "@lucide/svelte": "^1.22.0"
   },
   "imports": {
     "#lib": "./src/lib/index.js",
@@ -91,11 +97,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@lucide/svelte": "1.22.0",
     "better-auth": "^1.7.12",
-    "bits-ui": "^2.20.2",
     "clsx": "^2.1.1",
-    "svelte-sonner": "^1.2.1",
     "tailwind-merge": "^3.7.0",
     "tailwind-variants": "^3.3.1",
     "uqr": "^0.1.3",

package/dist/server/service/konto.service.d.ts

@@ -1,7 +0,0 @@
-export declare const KontoService: {
-    /**
-     * Deletes the account with everything that belongs to it: the foreign keys of every user-owned table cascade, so a
-     * Product's own tables reference `user.id` with `onDelete: "cascade"`.
-     */
-    loeschen(userId: string): Promise<void>;
-};

package/dist/server/service/konto.service.js

@@ -1,11 +0,0 @@
-/** The user's account as a whole. */
-import { UserRepo } from "../repositories/UserRepo.js";
-export const KontoService = {
-    /**
-     * Deletes the account with everything that belongs to it: the foreign keys of every user-owned table cascade, so a
-     * Product's own tables reference `user.id` with `onDelete: "cascade"`.
-     */
-    async loeschen(userId) {
-        await UserRepo.deleteUser(userId);
-    },
-};