@xeplr/cli 0.3.4 → 0.3.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
package/templates/CLAUDE.md
CHANGED
|
@@ -68,3 +68,4 @@ Replace the bold parts. Add behaviour in the same message if you want it — "a
|
|
|
68
68
|
- The browser is not a security boundary: anything that must hold goes in a server function, named in the screen's events.
|
|
69
69
|
- Hooks and models are **methods** calling `super` — never arrow-function properties.
|
|
70
70
|
- `authFetch` returns the parsed body, not a Response.
|
|
71
|
+
- Sign-up needs email and `AUTH_REGISTER_ROLES` (the role a new account gets, in `api/development.env`); without either, registration is refused on purpose — never work around it by activating accounts or granting roles in SQL. An admin can activate an account from the User Roles screen.
|
package/templates/api/README.md
CHANGED
|
@@ -41,4 +41,10 @@ The API (`@xeplr/base-apis`) and the sign-in service (`@xeplr/auth`), with this
|
|
|
41
41
|
| `DB_API`, `AUTH_DB_NAME` | the two database names — never guessed |
|
|
42
42
|
| `AUTH_SUPER_ADMIN_EMAIL` / `_PASSWORD` | the first account — created once, when the sign-in database is first set up |
|
|
43
43
|
| `AUTH_TENANT_HEADER` | `none`: one set of roles for everyone. A multi-tenant app names its company header (e.g. `x-company-id`), so a role made inside a company belongs to it |
|
|
44
|
-
| `
|
|
44
|
+
| `AUTH_ACTIVATION_URL`, `AUTH_INVITE_URL`, `AUTH_RESET_URL` | the UI pages the emailed links open; the token is appended. The reset address is never taken from the request |
|
|
45
|
+
| `AUTH_REGISTER_ROLES` | the role a new sign-up gets when activated (`Viewer`). **Required to register:** unset, or naming a role that does not exist, and registration is refused |
|
|
46
|
+
| `EMAIL_PROVIDER` and its settings | needed to register, resend an activation link, invite or reset a password — each is refused while email does not work. Signing in works without it |
|
|
47
|
+
|
|
48
|
+
## Sign-up
|
|
49
|
+
|
|
50
|
+
Register → an activation email → the link (or an admin's **Activate** on the User Roles screen) → sign in. Lost the email? `/auth/resend-activation` sends a new one. Invited people set their password at `/auth/accept-invite`.
|
|
@@ -65,6 +65,16 @@ AUTH_TENANT_HEADER=none
|
|
|
65
65
|
# email template can carry a token as a value but cannot build an address.
|
|
66
66
|
AUTH_ACTIVATION_URL=http://localhost:__UI_PORT__/auth/activate
|
|
67
67
|
AUTH_INVITE_URL=http://localhost:__UI_PORT__/auth/accept-invite
|
|
68
|
+
# Never taken from the request: a link built from its Host header could point
|
|
69
|
+
# a real user's reset mail at someone else's site. Unset, reset is refused.
|
|
70
|
+
AUTH_RESET_URL=http://localhost:__UI_PORT__/auth/reset-password
|
|
71
|
+
|
|
72
|
+
# ── The role a new sign-up gets ──
|
|
73
|
+
# Given when the account is activated. Without a role a person can sign in
|
|
74
|
+
# and do nothing — not even open their own profile. No default: unset, or a
|
|
75
|
+
# role that does not exist, and registration is refused. Comma-separate for
|
|
76
|
+
# more than one; Super Admin is never allowed here.
|
|
77
|
+
AUTH_REGISTER_ROLES=Viewer
|
|
68
78
|
|
|
69
79
|
# ── Uploaded files ──
|
|
70
80
|
# Where a form's FILE field puts what people upload. The path is what the
|
|
@@ -72,10 +82,12 @@ AUTH_INVITE_URL=http://localhost:__UI_PORT__/auth/accept-invite
|
|
|
72
82
|
# which checks the caller the way reading a record does. Relative to api/.
|
|
73
83
|
FACTORY_FILES_DIR=./uploads/factory
|
|
74
84
|
|
|
75
|
-
# ── Email
|
|
76
|
-
#
|
|
77
|
-
#
|
|
78
|
-
#
|
|
85
|
+
# ── Email ──
|
|
86
|
+
# Needed for anyone but the super admin to get in: registration, resending an
|
|
87
|
+
# activation link, invites and password reset all send a link, and each is
|
|
88
|
+
# refused while email does not work — no half-made accounts. Signing in keeps
|
|
89
|
+
# working without it. The sign-in service checks it at start and says so in
|
|
90
|
+
# its banner: "email ✓ smtp — host:587, connected" or "✗ NOT WORKING — reason".
|
|
79
91
|
# Providers: smtp | brevo | aws | azure — see @xeplr/utils' README.
|
|
80
92
|
# EMAIL_PROVIDER=smtp
|
|
81
93
|
# SMTP_HOST=
|
|
@@ -83,4 +95,3 @@ FACTORY_FILES_DIR=./uploads/factory
|
|
|
83
95
|
# SMTP_USER=
|
|
84
96
|
# SMTP_PASS=
|
|
85
97
|
# SMTP_FROM=
|
|
86
|
-
# (smtp also needs `npm install nodemailer` in this folder)
|
|
@@ -9,7 +9,9 @@
|
|
|
9
9
|
*/
|
|
10
10
|
module.exports = [
|
|
11
11
|
// ENCRYPTION_KEY, AUTH_JWT_SECRET, AUTH_PORT, AUTH_DB_NAME,
|
|
12
|
-
// XEPLR_AUTH_MIGRATIONS, AUTH_SUPER_ADMIN_EMAIL / _PASSWORD, REDIS_PREFIX
|
|
12
|
+
// XEPLR_AUTH_MIGRATIONS, AUTH_SUPER_ADMIN_EMAIL / _PASSWORD, REDIS_PREFIX,
|
|
13
|
+
// AUTH_TENANT_HEADER, and the sign-up settings: AUTH_REGISTER_ROLES,
|
|
14
|
+
// AUTH_ACTIVATION_URL, AUTH_RESET_URL
|
|
13
15
|
...require('@xeplr/auth').requiredEnv,
|
|
14
16
|
|
|
15
17
|
// ── this app's own ──
|
|
@@ -17,7 +17,7 @@
|
|
|
17
17
|
"start-api": "node ./bin/www"
|
|
18
18
|
},
|
|
19
19
|
"dependencies": {
|
|
20
|
-
"@xeplr/auth": "^1.
|
|
20
|
+
"@xeplr/auth": "^1.3.0",
|
|
21
21
|
"@xeplr/base-apis": "^2.0.0",
|
|
22
22
|
"@xeplr/db": "^1.0.6",
|
|
23
23
|
"@xeplr/factory": "^2.0.0",
|
|
@@ -26,6 +26,7 @@
|
|
|
26
26
|
"dotenv": "^17.4.2",
|
|
27
27
|
"express": "^5.2.0",
|
|
28
28
|
"multer": "^2.0.2",
|
|
29
|
+
"nodemailer": "^10.0.2",
|
|
29
30
|
"@xeplr/actions": "^1.4.0",
|
|
30
31
|
"@xeplr/workflow-api": "^1.1.0"
|
|
31
32
|
},
|