or3-provider-basic-auth 0.0.10 → 0.0.12

package/README.md

@@ -69,6 +69,7 @@ Strict-mode behavior:
 - Canonical OR3 users/workspaces are still resolved by the selected `AuthWorkspaceStore`.
 - In `invite_only` mode, signed-token, expiry, persisted invite state/token hash, and normalized-email validation runs before Basic Auth creates an account or session.
 - The selected `AuthWorkspaceStore` must support atomic invite provisioning; internal user/auth mapping, membership, and invite consumption are committed together by that provider.
+- Invite links (`/?invite=TOKEN`, copied from Admin → Workspaces, or carried in the lock page's `next`) open registration for signed-out visitors with the token filled in. The token is removed from the address bar on first read and kept in memory for that page; only one mounted auth control (sidebar, mobile More sheet or lock page) opens registration per link. On mobile the account control lives in More, so registration opens when the visitor opens More. This invite-link handoff requires published `or3-provider-basic-auth@0.0.11` or later.
 - Basic Auth account and initial refresh-session rows are created in one local SQLite transaction.
 - Access JWTs are short-lived and validated by `basicAuthProvider.getSession(event)`.
 - Refresh tokens are rotated and hashed at rest; replay attempts revoke active sessions.
@@ -154,3 +155,11 @@ provider's SQLite driver. If the source launcher selects Bun for sync, this
 native binding must also work under the project-pinned Bun version. The launcher
 checks it in that runtime before starting Nuxt and reports incompatible bindings
 or runtime crashes. Managed Cloud uses Node with `better-sqlite3`.
+
+## Instance signup invitations
+
+The updated host distinguishes signup invites from existing team invites. Signup invites create a private workspace with only the recipient as owner; team invites retain their selected workspace and role. This requires the updated host and rebuilt provider artifacts, rather than the existing published release alone.
+
+Registration preflight rejects invalid invites before credential creation, including in open mode. It resolves the explicit body token first, followed by the host's header, HttpOnly cookie, query, and Referer precedence. A valid token is retained in the invite cookie for canonical session resolution; an explicit replacement overrides a stale cookie. Without a token, open registration remains available. If credentials commit before canonical acceptance, use Already registered? Sign in with the same account and a valid or replacement invite. The sign-in request preserves manually pasted tokens, verifies the signed-in email, and uses the existing HttpOnly invite cookie. The selected sync store still owns atomic acceptance; provider-only credentials grant no protected OR3 access. No credential lifecycle or recovery service is added.
+
+Provider-only tests use the exact host registration and token sources pinned in `tests/fixtures/host`, with SHA-256 provenance verified by Vitest. No sibling checkout is required. To exercise the current host integration, run `OR3_CANONICAL_HOST_ROOT=/absolute/path/to/or3-chat bun run test`. Refresh the pinned files and provenance together when adopting a reviewed host contract change; do not replace the host validation logic with a provider-local implementation.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-basic-auth",
   "configKey": "or3-provider-basic-auth",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/components/BasicAuthLockPage.client.vue

@@ -17,24 +17,33 @@
 
     <BasicAuthSignInModal
       v-model="signInModalOpen"
+      :invite-token="inviteToken"
       @signed-in="handleSignedIn"
       @open-register="openRegisterFromSignIn"
     />
 
     <BasicAuthRegisterModal
       v-model="registerModalOpen"
+      :invite-token="inviteToken"
+      @open-sign-in="openSignInFromRegister"
       @registered="handleRegistered"
     />
   </div>
 </template>
 
 <script setup>
-import { nextTick, ref } from "vue";
+import { nextTick, onMounted, ref } from "vue";
 import BasicAuthRegisterModal from "./BasicAuthRegisterModal.client.vue";
 import BasicAuthSignInModal from "./BasicAuthSignInModal.client.vue";
+import { claimInviteLinkAutoOpen, readInviteLinkToken } from "../lib/invite-link.client";
 const loginIcon = "i-lucide-log-in";
 const signInModalOpen = ref(false);
 const registerModalOpen = ref(false);
+const inviteToken = ref(null);
+onMounted(() => {
+  inviteToken.value = readInviteLinkToken();
+  if (claimInviteLinkAutoOpen()) registerModalOpen.value = true;
+});
 function notifyAuthSessionChanged() {
   if (typeof window === "undefined") return;
   window.dispatchEvent(new CustomEvent("or3:auth-session-changed"));
@@ -52,4 +61,10 @@ async function openRegisterFromSignIn() {
     registerModalOpen.value = true;
   }, 0);
 }
+async function openSignInFromRegister(token) {
+  inviteToken.value = token || inviteToken.value;
+  registerModalOpen.value = false;
+  await nextTick();
+  signInModalOpen.value = true;
+}
 </script>

package/dist/runtime/components/BasicAuthRegisterModal.client.d.vue.ts

@@ -1,11 +1,15 @@
 type __VLS_Props = {
     modelValue: boolean;
+    /** Token from an invite link; filled in when the form opens. */
+    inviteToken?: string | null;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;
     registered: () => any;
+    "open-sign-in": (inviteToken: string) => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
     "onUpdate:modelValue"?: ((value: boolean) => any) | undefined;
     onRegistered?: (() => any) | undefined;
+    "onOpen-sign-in"?: ((inviteToken: string) => any) | undefined;
 }>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 export default _default;

package/dist/runtime/components/BasicAuthRegisterModal.client.vue

@@ -73,7 +73,10 @@
             />
           </UFormField>
 
-          <UFormField label="Invite token (optional)" name="inviteToken">
+          <UFormField
+            :label="props.inviteToken ? 'Invite token (from your invite link)' : 'Invite token (optional)'"
+            name="inviteToken"
+          >
             <UInput
               v-model="state.inviteToken"
               type="text"
@@ -90,6 +93,7 @@
             {{ errorMessage }}
           </div>
 
+          <UButton type="button" color="neutral" variant="ghost" :disabled="pending" @click="emit('open-sign-in', state.inviteToken)">Already registered? Sign in</UButton>
           <div class="flex justify-end gap-2 pt-1">
             <UButton
               color="neutral"
@@ -111,16 +115,17 @@
 </template>
 
 <script setup>
-import { computed, reactive, ref } from "vue";
+import { computed, reactive, ref, watch } from "vue";
 import { newPasswordFitsBcrypt } from "../password-policy";
 const modalUi = {
   overlay: "basic-auth-modal-overlay",
   content: "basic-auth-modal-content sm:max-w-[420px]"
 };
 const props = defineProps({
-  modelValue: { type: Boolean, required: true }
+  modelValue: { type: Boolean, required: true },
+  inviteToken: { type: [String, null], required: false }
 });
-const emit = defineEmits(["update:modelValue", "registered"]);
+const emit = defineEmits(["update:modelValue", "registered", "open-sign-in"]);
 const state = reactive({
   email: "",
   displayName: "",
@@ -136,6 +141,9 @@ const isOpen = computed({
     emit("update:modelValue", value);
   }
 });
+watch(() => [props.modelValue, props.inviteToken], ([open, token]) => {
+  if (open && token && !state.inviteToken.trim()) state.inviteToken = token;
+}, { immediate: true });
 function close() {
   errorMessage.value = "";
   emit("update:modelValue", false);
@@ -194,7 +202,7 @@ async function onSubmit() {
     } else if (statusCode === 403) {
       errorMessage.value = serverMessage || "Registration is restricted for this instance.";
     } else if (statusCode === 401) {
-      errorMessage.value = "Email is already in use.";
+      errorMessage.value = "Unable to register. If you already registered, sign in to continue.";
     } else if (statusCode === 409) {
       errorMessage.value = "Email is already in use.";
     } else {

package/dist/runtime/components/BasicAuthRegisterModal.client.vue.d.ts

@@ -1,11 +1,15 @@
 type __VLS_Props = {
     modelValue: boolean;
+    /** Token from an invite link; filled in when the form opens. */
+    inviteToken?: string | null;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;
     registered: () => any;
+    "open-sign-in": (inviteToken: string) => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
     "onUpdate:modelValue"?: ((value: boolean) => any) | undefined;
     onRegistered?: (() => any) | undefined;
+    "onOpen-sign-in"?: ((inviteToken: string) => any) | undefined;
 }>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 export default _default;

package/dist/runtime/components/BasicAuthSignInModal.client.d.vue.ts

@@ -1,5 +1,6 @@
 type __VLS_Props = {
     modelValue: boolean;
+    inviteToken?: string;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;

package/dist/runtime/components/BasicAuthSignInModal.client.vue

@@ -89,7 +89,8 @@ const modalUi = {
   content: "basic-auth-modal-content sm:max-w-[380px]"
 };
 const props = defineProps({
-  modelValue: { type: Boolean, required: true }
+  modelValue: { type: Boolean, required: true },
+  inviteToken: { type: String, required: false }
 });
 const emit = defineEmits(["update:modelValue", "signed-in", "open-register"]);
 const state = reactive({
@@ -116,7 +117,8 @@ async function onSubmit() {
       method: "POST",
       body: {
         email: state.email,
-        password: state.password
+        password: state.password,
+        inviteToken: props.inviteToken?.trim() || void 0
       }
     });
     emit("signed-in");

package/dist/runtime/components/BasicAuthSignInModal.client.vue.d.ts

@@ -1,5 +1,6 @@
 type __VLS_Props = {
     modelValue: boolean;
+    inviteToken?: string;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;

package/dist/runtime/components/SidebarAuthButtonBasic.client.vue

@@ -51,12 +51,15 @@
 
     <BasicAuthSignInModal
       v-model="signInModalOpen"
+      :invite-token="inviteToken"
       @signed-in="onSignedIn"
       @open-register="openRegisterFromSignIn"
     />
 
     <BasicAuthRegisterModal
       v-model="registerModalOpen"
+      :invite-token="inviteToken"
+      @open-sign-in="openSignInFromRegister"
       @registered="onRegistered"
     />
 
@@ -76,6 +79,7 @@ import {
   AUTH_UI_LAYOUT_KEY
 } from "../lib/auth-ui-layout";
 import { silentRefreshOnce } from "../lib/silent-refresh.client";
+import { claimInviteLinkAutoOpen, readInviteLinkToken } from "../lib/invite-link.client";
 import BasicAuthSignInModal from "./BasicAuthSignInModal.client.vue";
 import BasicAuthRegisterModal from "./BasicAuthRegisterModal.client.vue";
 import BasicAuthUserMenu from "./BasicAuthUserMenu.client.vue";
@@ -171,9 +175,20 @@ async function onRegistered() {
   await refreshSession({ allowSilentRefresh: false });
   notifyAuthSessionChanged();
 }
-onMounted(() => {
-  void refreshSession();
+const inviteToken = ref(null);
+onMounted(async () => {
+  inviteToken.value = readInviteLinkToken();
+  await refreshSession();
+  if (!isSignedIn.value && isBasicAuthProvider.value && claimInviteLinkAutoOpen()) {
+    registerModalOpen.value = true;
+  }
 });
+async function openSignInFromRegister(token) {
+  inviteToken.value = token || inviteToken.value;
+  registerModalOpen.value = false;
+  await nextTick();
+  signInModalOpen.value = true;
+}
 </script>
 
 <style>

package/dist/runtime/lib/invite-link.client.d.ts

@@ -0,0 +1,4 @@
+export declare function readInviteLinkToken(): string | null;
+/** True for the one caller that should open registration for this link. */
+export declare function claimInviteLinkAutoOpen(): boolean;
+export declare function resetInviteLinkForTests(): void;

package/dist/runtime/lib/invite-link.client.js

@@ -0,0 +1,39 @@
+let token;
+let autoOpenClaimed = false;
+function takeInvite(url) {
+  const direct = url.searchParams.get("invite")?.trim();
+  if (direct) {
+    url.searchParams.delete("invite");
+    return direct;
+  }
+  const next = url.searchParams.get("next");
+  if (!next) return null;
+  const target = new URL(next, url.origin);
+  const carried = target.searchParams.get("invite")?.trim();
+  if (!carried) return null;
+  target.searchParams.delete("invite");
+  url.searchParams.set("next", target.pathname + target.search + target.hash);
+  return carried;
+}
+export function readInviteLinkToken() {
+  if (token !== void 0) return token;
+  token = null;
+  if (typeof window === "undefined") return token;
+  try {
+    const url = new URL(window.location.href);
+    token = takeInvite(url);
+    if (token) window.history.replaceState(window.history.state, "", url.pathname + url.search + url.hash);
+  } catch {
+    token = null;
+  }
+  return token;
+}
+export function claimInviteLinkAutoOpen() {
+  if (!readInviteLinkToken() || autoOpenClaimed) return false;
+  autoOpenClaimed = true;
+  return true;
+}
+export function resetInviteLinkForTests() {
+  token = void 0;
+  autoOpenClaimed = false;
+}

package/dist/runtime/server/api/basic-auth/register.post.js

@@ -4,6 +4,7 @@ import { createError, defineEventHandler, setCookie } from "h3";
 import { z } from "zod";
 import { getAuthWorkspaceStore } from "~~/server/auth/store/registry";
 import {
+  getInviteTokenFromEvent,
   resolveRegistrationMode,
   validateInviteRegistration
 } from "~~/server/auth/registration";
@@ -68,10 +69,11 @@ export async function handleRegister(event) {
   if (mode === "disabled") {
     mapRegistrationErrorToHttp("disabled");
   }
-  if (mode === "invite_only" && !body.inviteToken?.trim()) {
+  const inviteToken = body.inviteToken ?? getInviteTokenFromEvent(event);
+  if (mode === "invite_only" && !inviteToken) {
     mapRegistrationErrorToHttp("invite_required");
   }
-  if (mode === "invite_only") {
+  if (inviteToken) {
     const syncConfig = runtimeConfig;
     const storeId = syncConfig.sync?.provider ?? syncConfig.public?.sync?.provider ?? "convex";
     const store = getAuthWorkspaceStore(storeId);
@@ -83,7 +85,7 @@ export async function handleRegister(event) {
       store,
       mode,
       email,
-      inviteToken: body.inviteToken
+      inviteToken
     });
     if (!decision.allowed) {
       mapRegistrationErrorToHttp(decision.reason);
@@ -129,8 +131,8 @@ export async function handleRegister(event) {
   });
   setAccessCookie(event, accessToken, config.accessTtlSeconds);
   setRefreshCookie(event, refreshToken, config.refreshTtlSeconds);
-  if (mode === "invite_only" && body.inviteToken?.trim()) {
-    setCookie(event, "or3_invite_token", body.inviteToken.trim(), {
+  if (inviteToken) {
+    setCookie(event, "or3_invite_token", inviteToken, {
       httpOnly: true,
       sameSite: "lax",
       secure: process.env.NODE_ENV === "production",

package/dist/runtime/server/api/basic-auth/sign-in.post.js

@@ -1,5 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { defineEventHandler } from "h3";
+import { defineEventHandler, setCookie } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { verifyInviteToken } from "~~/server/auth/invite-token";
 import { z } from "zod";
 import { clearAuthCookies, setAccessCookie, setRefreshCookie } from "../../lib/cookies.js";
 import { getBasicAuthConfig } from "../../lib/config.js";
@@ -21,7 +23,8 @@ import { assertBasicAuthReady, noStore, parseBodyWithSchema } from "./_helpers.j
 const signInSchema = z.object({
   email: z.string().email().max(320),
   // Sign-in must allow legacy short passwords; strength is enforced at set/change time.
-  password: z.string().min(1).max(512)
+  password: z.string().min(1).max(512),
+  inviteToken: z.string().trim().min(1).max(4096).optional()
 });
 const DUMMY_PASSWORD_HASH = "$2a$12$1XCXpgmbzURDdc0AGJiAsemtT39PAw8WwV7fBOq6A5VQv6.qN6Va.";
 export async function handleSignIn(event) {
@@ -68,6 +71,19 @@ export async function handleSignIn(event) {
   });
   setAccessCookie(event, accessToken, config.accessTtlSeconds);
   setRefreshCookie(event, refreshToken, config.refreshTtlSeconds);
+  const secret = useRuntimeConfig().auth?.invite?.tokenSecret;
+  if (input.inviteToken && secret) {
+    const verified = verifyInviteToken(input.inviteToken, secret);
+    if (verified.ok && normalizeEmail(verified.payload.email) === email) {
+      setCookie(event, "or3_invite_token", input.inviteToken, {
+        httpOnly: true,
+        sameSite: "lax",
+        secure: process.env.NODE_ENV === "production",
+        path: "/",
+        maxAge: Math.min(600, verified.payload.exp - Math.floor(Date.now() / 1e3))
+      });
+    }
+  }
   return { ok: true };
 }
 export default defineEventHandler(async (event) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "or3-provider-basic-auth",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Saluana/or3-provider-basic-auth.git"