musora-content-services 2.182.0 → 2.183.0

package/.claude/settings.local.json

@@ -1,14 +1,4 @@
 {
-  "permissions": {
-    "allow": [
-      "Bash(rg:*)",
-      "Bash(npm run lint:*)",
-      "Bash(ls:*)",
-      "Bash(npm test *)",
-      "Bash(npx jest *)"
-    ],
-    "deny": []
-  },
   "enabledMcpjsonServers": [
     "1password",
     "atlassian",
@@ -19,15 +9,15 @@
     "hex",
     "sanity",
     "mysql",
+    "mysql-staging",
+    "mysql-local",
     "slack",
     "langfuse",
     "chrome-devtools",
+    "mobile",
     "railway",
     "github",
     "asana",
-    "nightwatch",
-    "mysql-staging",
-    "mysql-local",
-    "mobile"
+    "nightwatch"
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.183.0](https://github.com/railroadmedia/musora-content-services/compare/v2.182.0...v2.183.0) (2026-09-24)
+
+
+### Features
+
+* **MU2-1970:** Add magic link login services ([#1056](https://github.com/railroadmedia/musora-content-services/issues/1056)) ([964dc8e](https://github.com/railroadmedia/musora-content-services/commit/964dc8ee532b2bd30e36b697527cee8d5a039ae6))
+
 ## [2.182.0](https://github.com/railroadmedia/musora-content-services/compare/v2.181.0...v2.182.0) (2026-09-21)
 
 

package/CLAUDE.md

@@ -11,6 +11,24 @@ Do not run tests or try to run tests with npm test unless explicitly asked.
 
 ## Code Style Standards
 
+### TypeScript Is Required for New Code
+
+This repository is migrating from JavaScript to TypeScript. **All new code must be written in TypeScript.**
+
+- New files are `.ts`, never `.js`.
+- New functionality added to an existing `.js` service belongs in a `.ts` file, not appended to the `.js` one. Add it to the existing `.ts` module for that domain (e.g. `session.ts` rather than the legacy `sessions.js`), or create a new `.ts` file if none fits.
+- Do not convert an existing `.js` file to `.ts` as a side effect of an unrelated change - migrations are their own commit.
+- Type every exported function's parameters and return value. Use `Promise<void>` rather than leaving a return untyped.
+- Declare request/response shapes as exported `interface`s. Extend the shared types in `src/services/user/types.d.ts` where one already fits, rather than redeclaring it.
+- JSDoc is for explaining behavior the types cannot express (for example, that an endpoint deliberately resolves on both success and failure). Do not restate parameter and return types in JSDoc - the signature is the documentation.
+- Typecheck before considering a change done:
+
+```bash
+npx tsc --noEmit -p tsconfig.json
+```
+
+The index generator handles `.js` and `.ts` alike, so a new `.ts` service is picked up by `npm run build-index` with no extra step.
+
 ### Self-Documenting Code
 - Write clear, descriptive function and variable names that eliminate the need for comments
 - Never add comments explaining what code does - the code itself should be clear
@@ -125,6 +143,8 @@ All services are located in `src/services/` and organized by domain:
 
 **User Services** (`src/services/user/`)
 - `account.ts` - Account management, email changes, password resets
+- `session.ts` - OAuth providers, admin impersonation, magic link login
+- `sessions.js` - Legacy password login, logout, auth-key URLs
 - `profile.js` - User profiles, pictures, signatures
 - `permissions.js` - User permission checking
 - `notifications.js` - Notification management

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "musora-content-services",
-  "version": "2.182.0",
+  "version": "2.183.0",
   "description": "A package for Musoras content services ",
   "main": "src/index.js",
   "type": "module",

package/src/index.d.ts

@@ -515,7 +515,9 @@ import {
 import {
 	listOAuthProviders,
 	loginAsUser,
+	loginWithMagicLink,
 	redirectToOAuthProvider,
+	requestMagicLoginLink,
 	unlinkOAuthProvider,
 	verifyOAuthToken
 } from './services/user/session.ts';
@@ -833,6 +835,7 @@ declare module 'musora-content-services' {
 		lockThread,
 		login,
 		loginAsUser,
+		loginWithMagicLink,
 		logout,
 		mapContentToParent,
 		markAllNotificationsAsRead,
@@ -869,6 +872,7 @@ declare module 'musora-content-services' {
 		reportComment,
 		reportPlaylist,
 		requestEmailChange,
+		requestMagicLoginLink,
 		rescindInvite,
 		reset,
 		resetActiveLearningPath,

package/src/index.js

@@ -519,7 +519,9 @@ import {
 import {
 	listOAuthProviders,
 	loginAsUser,
+	loginWithMagicLink,
 	redirectToOAuthProvider,
+	requestMagicLoginLink,
 	unlinkOAuthProvider,
 	verifyOAuthToken
 } from './services/user/session.ts';
@@ -832,6 +834,7 @@ export {
 	lockThread,
 	login,
 	loginAsUser,
+	loginWithMagicLink,
 	logout,
 	mapContentToParent,
 	markAllNotificationsAsRead,
@@ -868,6 +871,7 @@ export {
 	reportComment,
 	reportPlaylist,
 	requestEmailChange,
+	requestMagicLoginLink,
 	rescindInvite,
 	reset,
 	resetActiveLearningPath,

package/src/services/user/session.ts

@@ -58,3 +58,37 @@ export async function loginAsUser(userId: string): Promise<AuthResponse> {
     {}
   )
 }
+
+export interface MagicLinkAuthResponse extends AuthResponse {
+  refresh_token: string | null
+  redirect_to: string | null
+}
+
+export interface MagicLinkDeviceParams {
+  device_name?: string
+  device_token?: string
+  platform?: 'ios' | 'android'
+}
+
+/**
+ * Resolves whether or not an account exists for the email, so the endpoint
+ * cannot be used to discover which addresses are registered.
+ */
+export async function requestMagicLoginLink(
+  email: string,
+  redirectTo: string | null = null
+): Promise<void> {
+  const apiUrl = '/api/user-management-system/v1/sessions/magic-link'
+  const httpClient = new HttpClient(globalConfig.baseUrl)
+  await httpClient.post(apiUrl, { email, redirect_to: redirectTo })
+}
+
+export async function loginWithMagicLink(
+  email: string,
+  token: string,
+  params: MagicLinkDeviceParams = {}
+): Promise<MagicLinkAuthResponse> {
+  const apiUrl = '/api/user-management-system/v1/sessions/magic-link/exchange'
+  const httpClient = new HttpClient(globalConfig.baseUrl)
+  return httpClient.post<MagicLinkAuthResponse>(apiUrl, { email, token, ...params })
+}

package/src/version-info.js

@@ -1 +1 @@
-export const MCS_VERSION = '2.182.0'
+export const MCS_VERSION = '2.183.0'

package/dist/services/api/types.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });