hazo_auth 6.0.0 → 7.0.1

package/dist/lib/forgot_password_config.server.js

@@ -3,11 +3,6 @@
 import "server-only";
 // section: imports
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
-import { get_config_value } from "./config/config_loader.server.js";
-// Default image path - consuming apps should either:
-// 1. Configure their own image_src in hazo_auth_config.ini
-// 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
-const DEFAULT_FORGOT_PASSWORD_IMAGE_PATH = "/hazo_auth/images/forgot_password_default.jpg";
 // section: helpers
 /**
  * Reads forgot password layout configuration from hazo_auth_config.ini file
@@ -15,23 +10,13 @@ const DEFAULT_FORGOT_PASSWORD_IMAGE_PATH = "/hazo_auth/images/forgot_password_de
  * @returns Forgot password configuration options
  */
 export function get_forgot_password_config() {
-    const section = "hazo_auth__forgot_password_layout";
     // Get shared already logged in config
     const alreadyLoggedInConfig = get_already_logged_in_config();
-    // Read image configuration
-    // If not set in config, falls back to default path-based image
-    // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
-    const imageSrc = get_config_value(section, "image_src", DEFAULT_FORGOT_PASSWORD_IMAGE_PATH);
-    const imageAlt = get_config_value(section, "image_alt", "Password recovery illustration");
-    const imageBackgroundColor = get_config_value(section, "image_background_color", "#f1f5f9");
     return {
         alreadyLoggedInMessage: alreadyLoggedInConfig.message,
         showLogoutButton: alreadyLoggedInConfig.showLogoutButton,
         showReturnHomeButton: alreadyLoggedInConfig.showReturnHomeButton,
         returnHomeButtonLabel: alreadyLoggedInConfig.returnHomeButtonLabel,
         returnHomePath: alreadyLoggedInConfig.returnHomePath,
-        imageSrc,
-        imageAlt,
-        imageBackgroundColor,
     };
 }

package/dist/lib/login_config.server.d.ts

@@ -13,11 +13,14 @@ export type LoginConfig = {
     createAccountPath: string;
     createAccountLabel: string;
     showCreateAccountLink: boolean;
-    imageSrc: string;
-    imageAlt: string;
-    imageBackgroundColor: string;
     /** OAuth configuration */
     oauth: OAuthConfig;
+    /** Whether the OTP sign-in link is shown below the login form */
+    otpSigninEnabled: boolean;
+    /** Label for the OTP sign-in link */
+    otpSigninLabel: string;
+    /** href for the OTP sign-in link */
+    otpSigninHref: string;
 };
 /**
  * Reads login layout configuration from hazo_auth_config.ini file

package/dist/lib/login_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/login_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAKrB,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAQ3E,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,KAAK,EAAE,WAAW,CAAC;CACpB,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAyE9C"}
+{"version":3,"file":"login_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/login_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAKrB,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAG3E,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,0BAA0B;IAC1B,KAAK,EAAE,WAAW,CAAC;IACnB,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CA0D9C"}

package/dist/lib/login_config.server.js

@@ -5,10 +5,6 @@ import "server-only";
 import { get_config_value, get_config_value_allow_empty } from "./config/config_loader.server.js";
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_oauth_config } from "./oauth_config.server.js";
-// Default image path - consuming apps should either:
-// 1. Configure their own image_src in hazo_auth_config.ini
-// 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
-const DEFAULT_LOGIN_IMAGE_PATH = "/hazo_auth/images/login_default.jpg";
 // section: helpers
 /**
  * Reads login layout configuration from hazo_auth_config.ini file
@@ -30,14 +26,12 @@ export function get_login_config() {
     const showCreateAccountLink = get_config_value(section, "show_create_account_link", "true") === "true";
     // Get shared already logged in config
     const alreadyLoggedInConfig = get_already_logged_in_config();
-    // Read image configuration
-    // If not set in config, falls back to default path-based image
-    // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
-    const imageSrc = get_config_value(section, "image_src", DEFAULT_LOGIN_IMAGE_PATH);
-    const imageAlt = get_config_value(section, "image_alt", "Secure login illustration");
-    const imageBackgroundColor = get_config_value(section, "image_background_color", "#f1f5f9");
     // Get OAuth configuration
     const oauth = get_oauth_config();
+    // OTP sign-in link
+    const otpSigninEnabled = get_config_value(section, "otp_signin_enabled", "false") === "true";
+    const otpSigninLabel = get_config_value(section, "otp_signin_label", "Sign in with email code");
+    const otpSigninHref = get_config_value(section, "otp_signin_href", "/hazo_auth/otp");
     return {
         redirectRoute,
         successMessage,
@@ -51,9 +45,9 @@ export function get_login_config() {
         createAccountPath,
         createAccountLabel,
         showCreateAccountLink,
-        imageSrc,
-        imageAlt,
-        imageBackgroundColor,
         oauth,
+        otpSigninEnabled,
+        otpSigninLabel,
+        otpSigninHref,
     };
 }

package/dist/lib/my_settings_config.server.d.ts

@@ -21,7 +21,6 @@ export type MySettingsConfig = {
         user_photo_default_priority2?: "library" | "gravatar";
         library_photo_path: string;
     };
-    heading?: string;
     subHeading?: string;
     profilePhotoLabel?: string;
     profilePhotoRecommendation?: string;

package/dist/lib/my_settings_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"my_settings_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/my_settings_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAYrB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE;QACV,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,mBAAmB,EAAE,OAAO,CAAC;KAC9B,CAAC;IACF,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,cAAc,EAAE;QACd,kBAAkB,EAAE,OAAO,CAAC;QAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,4BAA4B,EAAE,UAAU,GAAG,SAAS,CAAC;QACrD,4BAA4B,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;QACtD,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE;QACR,6BAA6B,EAAE,MAAM,CAAC;QACtC,sBAAsB,EAAE,MAAM,CAAC;QAC/B,2BAA2B,EAAE,MAAM,CAAC;QACpC,uBAAuB,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,yBAAyB,EAAE,MAAM,CAAC;QAClC,uBAAuB,EAAE,MAAM,CAAC;QAChC,0BAA0B,EAAE,MAAM,CAAC;QACnC,0BAA0B,EAAE,MAAM,CAAC;QACnC,+BAA+B,EAAE,MAAM,CAAC;QACxC,4BAA4B,EAAE,MAAM,CAAC;KACtC,CAAC;IACF,SAAS,EAAE;QACT,wBAAwB,EAAE,MAAM,EAAE,CAAC;QACnC,wBAAwB,EAAE,MAAM,EAAE,CAAC;KACpC,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,gBAAgB,CAyDzD"}
+{"version":3,"file":"my_settings_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/my_settings_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAYrB,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE;QACV,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,mBAAmB,EAAE,OAAO,CAAC;KAC9B,CAAC;IACF,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,cAAc,EAAE;QACd,kBAAkB,EAAE,OAAO,CAAC;QAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,OAAO,CAAC;QAC5B,4BAA4B,EAAE,UAAU,GAAG,SAAS,CAAC;QACrD,4BAA4B,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;QACtD,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE;QACR,6BAA6B,EAAE,MAAM,CAAC;QACtC,sBAAsB,EAAE,MAAM,CAAC;QAC/B,2BAA2B,EAAE,MAAM,CAAC;QACpC,uBAAuB,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,yBAAyB,EAAE,MAAM,CAAC;QAClC,uBAAuB,EAAE,MAAM,CAAC;QAChC,0BAA0B,EAAE,MAAM,CAAC;QACnC,0BAA0B,EAAE,MAAM,CAAC;QACnC,+BAA+B,EAAE,MAAM,CAAC;QACxC,4BAA4B,EAAE,MAAM,CAAC;KACtC,CAAC;IACF,SAAS,EAAE;QACT,wBAAwB,EAAE,MAAM,EAAE,CAAC;QACnC,wBAAwB,EAAE,MAAM,EAAE,CAAC;KACpC,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,gBAAgB,CAuDzD"}

package/dist/lib/my_settings_config.server.js

@@ -28,7 +28,6 @@ export function get_my_settings_config() {
     const uiSizes = get_ui_sizes_config();
     const fileTypes = get_file_types_config();
     // Read optional labels with defaults
-    const heading = get_config_value(section, "heading", "Account Settings");
     const subHeading = get_config_value(section, "sub_heading", "Manage your profile, password, and email preferences.");
     const profilePhotoLabel = get_config_value(section, "profile_photo_label", "Profile Photo");
     const profilePhotoRecommendation = get_config_value(section, "profile_photo_recommendation", "Recommended size: 200x200px. JPG, PNG.");
@@ -47,7 +46,6 @@ export function get_my_settings_config() {
         userFields,
         passwordRequirements,
         profilePicture,
-        heading,
         subHeading,
         profilePhotoLabel,
         profilePhotoRecommendation,

package/dist/lib/oauth_config.server.d.ts

@@ -2,12 +2,20 @@ import "server-only";
 export type OAuthConfig = {
     /** Enable Google OAuth login */
     enable_google: boolean;
+    /** Enable Facebook OAuth login */
+    enable_facebook: boolean;
     /** Enable traditional email/password login */
     enable_email_password: boolean;
     /** Auto-link Google login to existing unverified email/password accounts */
     auto_link_unverified_accounts: boolean;
+    /** Auto-link Google login to existing unverified email/password accounts (per-provider override) */
+    auto_link_unverified_accounts_google: boolean;
+    /** Auto-link Facebook login to existing unverified email/password accounts */
+    auto_link_unverified_accounts_facebook: boolean;
     /** Text displayed on the Google sign-in button */
     google_button_text: string;
+    /** Text displayed on the Facebook sign-in button */
+    facebook_button_text: string;
     /** Text displayed on the divider between OAuth and email/password form */
     oauth_divider_text: string;
     /** NextAuth signIn page path */
@@ -22,6 +30,10 @@ export type OAuthConfig = {
     skip_invitation_check: boolean;
     /** Redirect when skip_invitation_check=true and user has no scope */
     no_scope_redirect: string;
+    /** Facebook App ID from env HAZO_AUTH_FACEBOOK_APP_ID */
+    facebook_client_id: string | undefined;
+    /** Facebook App Secret from env HAZO_AUTH_FACEBOOK_APP_SECRET */
+    facebook_client_secret: string | undefined;
 };
 /**
  * Reads OAuth configuration from hazo_auth_config.ini file
@@ -39,4 +51,9 @@ export declare function is_google_oauth_enabled(): boolean;
  * @returns true if email/password login is enabled in config
  */
 export declare function is_email_password_enabled(): boolean;
+/**
+ * Helper to check if Facebook OAuth is enabled and credentials are present
+ * @returns true if Facebook OAuth is enabled and env vars are set
+ */
+export declare function is_facebook_oauth_enabled(): boolean;
 //# sourceMappingURL=oauth_config.server.d.ts.map

package/dist/lib/oauth_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/oauth_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,MAAM,MAAM,WAAW,GAAG;IACxB,gCAAgC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,8CAA8C;IAC9C,qBAAqB,EAAE,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,6BAA6B,EAAE,OAAO,CAAC;IACvC,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,qBAAqB,EAAE,OAAO,CAAC;IAC/B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAgF9C;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAMnD"}
+{"version":3,"file":"oauth_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/oauth_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAOrB,MAAM,MAAM,WAAW,GAAG;IACxB,gCAAgC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,kCAAkC;IAClC,eAAe,EAAE,OAAO,CAAC;IACzB,8CAA8C;IAC9C,qBAAqB,EAAE,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,6BAA6B,EAAE,OAAO,CAAC;IACvC,oGAAoG;IACpG,oCAAoC,EAAE,OAAO,CAAC;IAC9C,8EAA8E;IAC9E,sCAAsC,EAAE,OAAO,CAAC;IAChD,kDAAkD;IAClD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oDAAoD;IACpD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,qBAAqB,EAAE,OAAO,CAAC;IAC/B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,iEAAiE;IACjE,sBAAsB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C,CAAC;AAMF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAoH9C;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAEjD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAMnD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAInD"}

package/dist/lib/oauth_config.server.js

@@ -14,9 +14,16 @@ const SECTION_NAME = "hazo_auth__oauth";
  */
 export function get_oauth_config() {
     const enable_google = get_config_boolean(SECTION_NAME, "enable_google", DEFAULT_OAUTH.enable_google);
+    const enable_facebook = get_config_boolean(SECTION_NAME, "enable_facebook", false);
     const enable_email_password = get_config_boolean(SECTION_NAME, "enable_email_password", DEFAULT_OAUTH.enable_email_password);
+    // Generic key (backward compat)
     const auto_link_unverified_accounts = get_config_boolean(SECTION_NAME, "auto_link_unverified_accounts", DEFAULT_OAUTH.auto_link_unverified_accounts);
+    // Per-provider Google key (falls back to generic)
+    const auto_link_unverified_accounts_google = get_config_boolean(SECTION_NAME, "auto_link_unverified_accounts_google", auto_link_unverified_accounts);
+    // Per-provider Facebook key (defaults to false — don't auto-link Facebook unverified)
+    const auto_link_unverified_accounts_facebook = get_config_boolean(SECTION_NAME, "auto_link_unverified_accounts_facebook", false);
     const google_button_text = get_config_value(SECTION_NAME, "google_button_text", DEFAULT_OAUTH.google_button_text);
+    const facebook_button_text = get_config_value(SECTION_NAME, "facebook_button_text", "Continue with Facebook");
     const oauth_divider_text = get_config_value(SECTION_NAME, "oauth_divider_text", DEFAULT_OAUTH.oauth_divider_text);
     const sign_in_page = get_config_value(SECTION_NAME, "sign_in_page", DEFAULT_OAUTH.sign_in_page);
     const error_page = get_config_value(SECTION_NAME, "error_page", DEFAULT_OAUTH.error_page);
@@ -24,11 +31,17 @@ export function get_oauth_config() {
     const default_redirect = get_config_value(SECTION_NAME, "default_redirect", DEFAULT_OAUTH.default_redirect);
     const skip_invitation_check = get_config_boolean(SECTION_NAME, "skip_invitation_check", DEFAULT_OAUTH.skip_invitation_check);
     const no_scope_redirect = get_config_value(SECTION_NAME, "no_scope_redirect", DEFAULT_OAUTH.no_scope_redirect);
+    const facebook_client_id = process.env.HAZO_AUTH_FACEBOOK_APP_ID;
+    const facebook_client_secret = process.env.HAZO_AUTH_FACEBOOK_APP_SECRET;
     return {
         enable_google,
+        enable_facebook,
         enable_email_password,
         auto_link_unverified_accounts,
+        auto_link_unverified_accounts_google,
+        auto_link_unverified_accounts_facebook,
         google_button_text,
+        facebook_button_text,
         oauth_divider_text,
         sign_in_page,
         error_page,
@@ -36,6 +49,8 @@ export function get_oauth_config() {
         default_redirect,
         skip_invitation_check,
         no_scope_redirect,
+        facebook_client_id,
+        facebook_client_secret,
     };
 }
 /**
@@ -52,3 +67,13 @@ export function is_google_oauth_enabled() {
 export function is_email_password_enabled() {
     return get_config_boolean(SECTION_NAME, "enable_email_password", DEFAULT_OAUTH.enable_email_password);
 }
+/**
+ * Helper to check if Facebook OAuth is enabled and credentials are present
+ * @returns true if Facebook OAuth is enabled and env vars are set
+ */
+export function is_facebook_oauth_enabled() {
+    const enabled = get_config_boolean(SECTION_NAME, "enable_facebook", false);
+    if (!enabled)
+        return false;
+    return !!(process.env.HAZO_AUTH_FACEBOOK_APP_ID && process.env.HAZO_AUTH_FACEBOOK_APP_SECRET);
+}

package/dist/lib/otp_config.server.d.ts

@@ -0,0 +1,49 @@
+import "server-only";
+export declare const OTP_CONFIG_DEFAULTS: {
+    readonly auto_register: false;
+    readonly code_ttl_seconds: 600;
+    readonly session_ttl_seconds: 604800;
+    readonly slide_when_within_seconds: 86400;
+    readonly email_rate_limit_max: 3;
+    readonly email_rate_limit_window_seconds: 900;
+    readonly ip_rate_limit_max: 20;
+    readonly ip_rate_limit_window_seconds: 3600;
+    readonly max_verify_attempts: 5;
+    readonly auto_assign_scope_id: "00000000-0000-0000-0000-000000000001";
+    readonly auto_assign_role_name: "member";
+};
+export type OtpConfig = {
+    /** Whether to automatically register a new user when an unrecognised email requests an OTP */
+    auto_register: boolean;
+    /** How long (seconds) a generated OTP code is valid */
+    code_ttl_seconds: number;
+    /** How long (seconds) the session created after successful OTP verification lasts */
+    session_ttl_seconds: number;
+    /** Slide the session expiry when the remaining TTL falls below this many seconds */
+    slide_when_within_seconds: number;
+    /** Maximum OTP requests allowed per email address within the rate-limit window */
+    email_rate_limit_max: number;
+    /** Rate-limit window (seconds) for per-email OTP requests */
+    email_rate_limit_window_seconds: number;
+    /** Maximum OTP requests allowed per IP address within the rate-limit window */
+    ip_rate_limit_max: number;
+    /** Rate-limit window (seconds) for per-IP OTP requests */
+    ip_rate_limit_window_seconds: number;
+    /** Maximum failed verify attempts before the OTP code is invalidated */
+    max_verify_attempts: number;
+    /** Scope ID to auto-assign a newly registered OTP user to */
+    auto_assign_scope_id: string;
+    /** Role name to assign within the auto-assign scope */
+    auto_assign_role_name: string;
+};
+/**
+ * Reads OTP configuration from hazo_auth_config.ini [hazo_auth__otp] section.
+ * Falls back to defaults if the config file or section is missing.
+ */
+export declare function get_otp_config(): OtpConfig;
+/**
+ * Convenience accessor — returns just the session TTL seconds from OTP config.
+ * Suitable for passing to token-creation utilities.
+ */
+export declare function hazo_auth_otp_session_ttl_seconds(): number;
+//# sourceMappingURL=otp_config.server.d.ts.map

package/dist/lib/otp_config.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/otp_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;CAYtB,CAAC;AAGX,MAAM,MAAM,SAAS,GAAG;IACtB,8FAA8F;IAC9F,aAAa,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAC;IACzB,qFAAqF;IACrF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,yBAAyB,EAAE,MAAM,CAAC;IAClC,kFAAkF;IAClF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6DAA6D;IAC7D,+BAA+B,EAAE,MAAM,CAAC;IACxC,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,4BAA4B,EAAE,MAAM,CAAC;IACrC,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAAC;AAGF;;;GAGG;AACH,wBAAgB,cAAc,IAAI,SAAS,CA6B1C;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,IAAI,MAAM,CAE1D"}

package/dist/lib/otp_config.server.js

@@ -0,0 +1,48 @@
+// file_description: server-only helper to read OTP sign-in configuration from hazo_auth_config.ini
+// section: server-only-guard
+import "server-only";
+// section: imports
+import { get_config_value, get_config_boolean, get_config_number } from "./config/config_loader.server.js";
+// section: defaults
+export const OTP_CONFIG_DEFAULTS = {
+    auto_register: false,
+    code_ttl_seconds: 600,
+    session_ttl_seconds: 604800,
+    slide_when_within_seconds: 86400,
+    email_rate_limit_max: 3,
+    email_rate_limit_window_seconds: 900,
+    ip_rate_limit_max: 20,
+    ip_rate_limit_window_seconds: 3600,
+    max_verify_attempts: 5,
+    auto_assign_scope_id: "00000000-0000-0000-0000-000000000001",
+    auto_assign_role_name: "member",
+};
+// section: helpers
+/**
+ * Reads OTP configuration from hazo_auth_config.ini [hazo_auth__otp] section.
+ * Falls back to defaults if the config file or section is missing.
+ */
+export function get_otp_config() {
+    const section = "hazo_auth__otp";
+    const d = OTP_CONFIG_DEFAULTS;
+    return {
+        auto_register: get_config_boolean(section, "otp_auto_register", d.auto_register),
+        code_ttl_seconds: get_config_number(section, "otp_code_ttl_seconds", d.code_ttl_seconds),
+        session_ttl_seconds: get_config_number(section, "otp_session_ttl_seconds", d.session_ttl_seconds),
+        slide_when_within_seconds: get_config_number(section, "otp_slide_when_within_seconds", d.slide_when_within_seconds),
+        email_rate_limit_max: get_config_number(section, "otp_email_rate_limit_max", d.email_rate_limit_max),
+        email_rate_limit_window_seconds: get_config_number(section, "otp_email_rate_limit_window_seconds", d.email_rate_limit_window_seconds),
+        ip_rate_limit_max: get_config_number(section, "otp_ip_rate_limit_max", d.ip_rate_limit_max),
+        ip_rate_limit_window_seconds: get_config_number(section, "otp_ip_rate_limit_window_seconds", d.ip_rate_limit_window_seconds),
+        max_verify_attempts: get_config_number(section, "otp_max_verify_attempts", d.max_verify_attempts),
+        auto_assign_scope_id: get_config_value(section, "otp_auto_assign_scope_id", d.auto_assign_scope_id),
+        auto_assign_role_name: get_config_value(section, "otp_auto_assign_role_name", d.auto_assign_role_name),
+    };
+}
+/**
+ * Convenience accessor — returns just the session TTL seconds from OTP config.
+ * Suitable for passing to token-creation utilities.
+ */
+export function hazo_auth_otp_session_ttl_seconds() {
+    return get_otp_config().session_ttl_seconds;
+}

package/dist/lib/register_config.server.d.ts

@@ -15,14 +15,13 @@ export type RegisterConfig = {
     returnHomePath: string;
     signInPath: string;
     signInLabel: string;
-    imageSrc: string;
-    imageAlt: string;
-    imageBackgroundColor: string;
     /** OAuth configuration */
     oauth: {
         enable_google: boolean;
+        enable_facebook: boolean;
         enable_email_password: boolean;
         google_button_text: string;
+        facebook_button_text: string;
         oauth_divider_text: string;
     };
 };

package/dist/lib/register_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/register_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAerB,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,KAAK,EAAE;QACL,aAAa,EAAE,OAAO,CAAC;QACvB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CA8EpD"}
+{"version":3,"file":"register_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/register_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAUrB,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,KAAK,EAAE;QACL,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;QACzB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAgEpD"}

package/dist/lib/register_config.server.js

@@ -7,10 +7,6 @@ import { get_password_requirements_config } from "./password_requirements_config
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_user_fields_config } from "./user_fields_config.server.js";
 import { get_oauth_config } from "./oauth_config.server.js";
-// Default image path - consuming apps should either:
-// 1. Configure their own image_src in hazo_auth_config.ini
-// 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
-const DEFAULT_REGISTER_IMAGE_PATH = "/hazo_auth/images/register_default.jpg";
 // section: helpers
 /**
  * Reads register layout configuration from hazo_auth_config.ini file
@@ -32,16 +28,12 @@ export function get_register_config() {
     // Read sign in link configuration
     const signInPath = get_config_value("hazo_auth__register_layout", "sign_in_path", "/hazo_auth/login");
     const signInLabel = get_config_value("hazo_auth__register_layout", "sign_in_label", "Sign in");
-    // Read image configuration
-    // If not set in config, falls back to default path-based image
-    // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
-    const imageSrc = get_config_value("hazo_auth__register_layout", "image_src", DEFAULT_REGISTER_IMAGE_PATH);
-    const imageAlt = get_config_value("hazo_auth__register_layout", "image_alt", "Modern building representing user registration");
-    const imageBackgroundColor = get_config_value("hazo_auth__register_layout", "image_background_color", "#e2e8f0");
     // Get OAuth configuration (shared with login)
     const oauthConfig = get_oauth_config();
     // For the register page, default button text to "Sign up with Google" unless overridden
     const registerGoogleButtonText = get_config_value("hazo_auth__oauth", "google_button_text_register", "Sign up with Google");
+    // For the register page, default Facebook button text to "Sign up with Facebook" unless overridden
+    const registerFacebookButtonText = get_config_value("hazo_auth__oauth", "facebook_button_text_register", "Sign up with Facebook");
     return {
         showNameField,
         passwordRequirements,
@@ -52,13 +44,12 @@ export function get_register_config() {
         returnHomePath: alreadyLoggedInConfig.returnHomePath,
         signInPath,
         signInLabel,
-        imageSrc,
-        imageAlt,
-        imageBackgroundColor,
         oauth: {
             enable_google: oauthConfig.enable_google,
+            enable_facebook: oauthConfig.enable_facebook,
             enable_email_password: oauthConfig.enable_email_password,
             google_button_text: registerGoogleButtonText,
+            facebook_button_text: registerFacebookButtonText,
             oauth_divider_text: oauthConfig.oauth_divider_text,
         },
     };

package/dist/lib/reset_password_config.server.d.ts

@@ -16,9 +16,6 @@ export type ResetPasswordConfig = {
         require_number: boolean;
         require_special: boolean;
     };
-    imageSrc: string;
-    imageAlt: string;
-    imageBackgroundColor: string;
 };
 /**
  * Reads reset password layout configuration from hazo_auth_config.ini file

package/dist/lib/reset_password_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset_password_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/reset_password_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAarB,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAgE/D"}
+{"version":3,"file":"reset_password_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/reset_password_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAyC/D"}

package/dist/lib/reset_password_config.server.js

@@ -5,10 +5,6 @@ import "server-only";
 import { get_config_value } from "./config/config_loader.server.js";
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_password_requirements_config } from "./password_requirements_config.server.js";
-// Default image path - consuming apps should either:
-// 1. Configure their own image_src in hazo_auth_config.ini
-// 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
-const DEFAULT_RESET_PASSWORD_IMAGE_PATH = "/hazo_auth/images/reset_password_default.jpg";
 // section: helpers
 /**
  * Reads reset password layout configuration from hazo_auth_config.ini file
@@ -29,12 +25,6 @@ export function get_reset_password_config() {
     const forgotPasswordPath = get_config_value(section, "forgot_password_path", "/hazo_auth/forgot_password");
     // Get shared password requirements
     const passwordRequirements = get_password_requirements_config();
-    // Read image configuration
-    // If not set in config, falls back to default path-based image
-    // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
-    const imageSrc = get_config_value(section, "image_src", DEFAULT_RESET_PASSWORD_IMAGE_PATH);
-    const imageAlt = get_config_value(section, "image_alt", "Reset password illustration");
-    const imageBackgroundColor = get_config_value(section, "image_background_color", "#f1f5f9");
     return {
         errorMessage,
         successMessage,
@@ -46,8 +36,5 @@ export function get_reset_password_config() {
         returnHomeButtonLabel: alreadyLoggedInConfig.returnHomeButtonLabel,
         returnHomePath: alreadyLoggedInConfig.returnHomePath,
         passwordRequirements,
-        imageSrc,
-        imageAlt,
-        imageBackgroundColor,
     };
 }

package/dist/lib/services/email_service.d.ts

@@ -7,7 +7,7 @@ export type EmailOptions = {
     html_body?: string;
     text_body?: string;
 };
-export type EmailTemplateType = "forgot_password" | "email_verification" | "password_changed";
+export type EmailTemplateType = "forgot_password" | "email_verification" | "password_changed" | "otp_signin_code";
 export type EmailTemplateData = {
     token?: string;
     verification_url?: string;

package/dist/lib/services/email_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/email_service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAE9F,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC,CAAC;AAiBF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAE3E;AA8LD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwErG;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,iBAAiB,EAChC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyF/C"}
+{"version":3,"file":"email_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/email_service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAGxE,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC;AAElH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC,CAAC;AAiBF;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAE3E;AAgMD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwErG;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,iBAAiB,EAChC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyF/C"}

package/dist/lib/services/email_service.js

@@ -200,6 +200,8 @@ function get_email_subject(template_type) {
             return "Reset Your Password";
         case "password_changed":
             return "Password Changed Successfully";
+        case "otp_signin_code":
+            return "Your sign-in code";
         default:
             return "Email from hazo_auth";
     }

package/dist/lib/services/email_template_manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email_template_manifest.d.ts","sourceRoot":"","sources":["../../../src/lib/services/email_template_manifest.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAiB3E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAAsB,EAuE/D,CAAC"}
+{"version":3,"file":"email_template_manifest.d.ts","sourceRoot":"","sources":["../../../src/lib/services/email_template_manifest.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAiB3E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAAsB,EAwF/D,CAAC"}

package/dist/lib/services/email_template_manifest.js

@@ -92,4 +92,21 @@ export const hazo_auth_template_manifest = [
             },
         ],
     },
+    {
+        template_name: "otp_signin_code",
+        template_label: "OTP sign-in code",
+        category: SYSTEM_CATEGORY,
+        html: read_template("otp_signin_code", "html"),
+        text: read_template("otp_signin_code", "txt"),
+        variables: [
+            {
+                variable_name: "otp_code",
+                variable_description: "6-digit OTP code for email sign-in (v6.1.0+)",
+            },
+            {
+                variable_name: "expires_in_minutes",
+                variable_description: "Number of minutes until the OTP code expires",
+            },
+        ],
+    },
 ];

package/dist/lib/services/email_templates/otp_signin_code.html

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <title>Your sign-in code</title>
+</head>
+<body style="font-family: Arial, sans-serif; line-height: 1.6; color: #333; max-width: 600px; margin: 0 auto; padding: 20px;">
+  <p>Your sign-in code is:</p>
+  <p style="font-size: 28px; font-weight: bold; letter-spacing: 0.2em; font-family: monospace; margin: 16px 0;">{{otp_code}}</p>
+  <p>This code expires in {{expires_in_minutes}} minutes.</p>
+  <p style="color: #666; font-size: 12px;">If you didn't request this code, you can safely ignore this email.</p>
+</body>
+</html>

package/dist/lib/services/email_templates/otp_signin_code.txt

@@ -0,0 +1,5 @@
+Your sign-in code is: {{otp_code}}
+
+This code expires in {{expires_in_minutes}} minutes.
+
+If you didn't request this code, you can safely ignore this email.

package/dist/lib/services/index.d.ts

@@ -18,4 +18,6 @@ export * from "./scope_service.js";
 export * from "./user_scope_service.js";
 export * from "./oauth_service.js";
 export * from "./branding_service.js";
+export { request_email_otp, verify_email_otp, generate_otp_code, hash_otp_code, verify_otp_code, } from "./otp_service.js";
+export type { RequestEmailOTPResult, VerifyEmailOTPResult } from "./otp_service";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAEA,cAAc,iBAAiB,CAAC;AAChC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAEA,cAAc,iBAAiB,CAAC;AAChC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/lib/services/index.js

@@ -20,3 +20,4 @@ export * from "./scope_service.js";
 export * from "./user_scope_service.js";
 export * from "./oauth_service.js";
 export * from "./branding_service.js";
+export { request_email_otp, verify_email_otp, generate_otp_code, hash_otp_code, verify_otp_code, } from "./otp_service.js";

package/dist/lib/services/oauth_service.d.ts

@@ -24,6 +24,16 @@ export type OAuthLoginResult = {
     name?: string;
     error?: string;
 };
+export type FacebookOAuthData = {
+    /** Facebook's unique user ID */
+    facebook_id: string;
+    /** User's email address from Facebook (may be null if user denied email permission) */
+    email: string | null;
+    /** User's full name from Facebook profile */
+    name?: string;
+    /** User's profile picture URL from Facebook */
+    profile_picture_url?: string;
+};
 export type LinkGoogleResult = {
     success: boolean;
     error?: string;
@@ -45,6 +55,20 @@ export type AuthProvidersResult = {
  * @returns OAuth login result with user_id and status flags
  */
 export declare function handle_google_oauth_login(adapter: HazoConnectAdapter, data: GoogleOAuthData): Promise<OAuthLoginResult>;
+/**
+ * Handles Facebook OAuth login/registration flow
+ * 1. Check if user exists with facebook_id -> login
+ * 2. Check if user exists with email -> link Facebook account (respects auto_link_unverified)
+ * 3. Create new user with Facebook data (email_verified always false — never trust Facebook)
+ *
+ * @param adapter - The hazo_connect adapter instance
+ * @param data - Facebook OAuth user data
+ * @param opts - Options (auto_link_unverified: whether to link unverified accounts)
+ * @returns OAuth login result with user_id and status flags
+ */
+export declare function handle_facebook_oauth_login(adapter: HazoConnectAdapter, data: FacebookOAuthData, opts?: {
+    auto_link_unverified?: boolean;
+}): Promise<OAuthLoginResult>;
 /**
  * Links a Google account to an existing user
  * @param adapter - The hazo_connect adapter instance

package/dist/lib/services/oauth_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/oauth_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AASvD,MAAM,MAAM,eAAe,GAAG;IAC5B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6CAA6C;IAC7C,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAiL3B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAgE3B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CA2C9B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0D/C"}
+{"version":3,"file":"oauth_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/oauth_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AASvD,MAAM,MAAM,eAAe,GAAG;IAC5B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6CAA6C;IAC7C,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAE9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAiL3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,iBAAiB,EACvB,IAAI,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAwK3B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAgE3B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CA2C9B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0D/C"}