or3-provider-basic-auth 0.0.11 → 0.0.12

package/README.md

@@ -155,3 +155,11 @@ provider's SQLite driver. If the source launcher selects Bun for sync, this
 native binding must also work under the project-pinned Bun version. The launcher
 checks it in that runtime before starting Nuxt and reports incompatible bindings
 or runtime crashes. Managed Cloud uses Node with `better-sqlite3`.
+
+## Instance signup invitations
+
+The updated host distinguishes signup invites from existing team invites. Signup invites create a private workspace with only the recipient as owner; team invites retain their selected workspace and role. This requires the updated host and rebuilt provider artifacts, rather than the existing published release alone.
+
+Registration preflight rejects invalid invites before credential creation, including in open mode. It resolves the explicit body token first, followed by the host's header, HttpOnly cookie, query, and Referer precedence. A valid token is retained in the invite cookie for canonical session resolution; an explicit replacement overrides a stale cookie. Without a token, open registration remains available. If credentials commit before canonical acceptance, use Already registered? Sign in with the same account and a valid or replacement invite. The sign-in request preserves manually pasted tokens, verifies the signed-in email, and uses the existing HttpOnly invite cookie. The selected sync store still owns atomic acceptance; provider-only credentials grant no protected OR3 access. No credential lifecycle or recovery service is added.
+
+Provider-only tests use the exact host registration and token sources pinned in `tests/fixtures/host`, with SHA-256 provenance verified by Vitest. No sibling checkout is required. To exercise the current host integration, run `OR3_CANONICAL_HOST_ROOT=/absolute/path/to/or3-chat bun run test`. Refresh the pinned files and provenance together when adopting a reviewed host contract change; do not replace the host validation logic with a provider-local implementation.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "or3-provider-basic-auth",
   "configKey": "or3-provider-basic-auth",
-  "version": "0.0.11",
+  "version": "0.0.12",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/components/BasicAuthLockPage.client.vue

@@ -17,6 +17,7 @@
 
     <BasicAuthSignInModal
       v-model="signInModalOpen"
+      :invite-token="inviteToken"
       @signed-in="handleSignedIn"
       @open-register="openRegisterFromSignIn"
     />
@@ -24,6 +25,7 @@
     <BasicAuthRegisterModal
       v-model="registerModalOpen"
       :invite-token="inviteToken"
+      @open-sign-in="openSignInFromRegister"
       @registered="handleRegistered"
     />
   </div>
@@ -59,4 +61,10 @@ async function openRegisterFromSignIn() {
     registerModalOpen.value = true;
   }, 0);
 }
+async function openSignInFromRegister(token) {
+  inviteToken.value = token || inviteToken.value;
+  registerModalOpen.value = false;
+  await nextTick();
+  signInModalOpen.value = true;
+}
 </script>

package/dist/runtime/components/BasicAuthRegisterModal.client.d.vue.ts

@@ -6,8 +6,10 @@ type __VLS_Props = {
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;
     registered: () => any;
+    "open-sign-in": (inviteToken: string) => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
     "onUpdate:modelValue"?: ((value: boolean) => any) | undefined;
     onRegistered?: (() => any) | undefined;
+    "onOpen-sign-in"?: ((inviteToken: string) => any) | undefined;
 }>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 export default _default;

package/dist/runtime/components/BasicAuthRegisterModal.client.vue

@@ -93,6 +93,7 @@
             {{ errorMessage }}
           </div>
 
+          <UButton type="button" color="neutral" variant="ghost" :disabled="pending" @click="emit('open-sign-in', state.inviteToken)">Already registered? Sign in</UButton>
           <div class="flex justify-end gap-2 pt-1">
             <UButton
               color="neutral"
@@ -124,7 +125,7 @@ const props = defineProps({
   modelValue: { type: Boolean, required: true },
   inviteToken: { type: [String, null], required: false }
 });
-const emit = defineEmits(["update:modelValue", "registered"]);
+const emit = defineEmits(["update:modelValue", "registered", "open-sign-in"]);
 const state = reactive({
   email: "",
   displayName: "",
@@ -201,7 +202,7 @@ async function onSubmit() {
     } else if (statusCode === 403) {
       errorMessage.value = serverMessage || "Registration is restricted for this instance.";
     } else if (statusCode === 401) {
-      errorMessage.value = "Email is already in use.";
+      errorMessage.value = "Unable to register. If you already registered, sign in to continue.";
     } else if (statusCode === 409) {
       errorMessage.value = "Email is already in use.";
     } else {

package/dist/runtime/components/BasicAuthRegisterModal.client.vue.d.ts

@@ -6,8 +6,10 @@ type __VLS_Props = {
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;
     registered: () => any;
+    "open-sign-in": (inviteToken: string) => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
     "onUpdate:modelValue"?: ((value: boolean) => any) | undefined;
     onRegistered?: (() => any) | undefined;
+    "onOpen-sign-in"?: ((inviteToken: string) => any) | undefined;
 }>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 export default _default;

package/dist/runtime/components/BasicAuthSignInModal.client.d.vue.ts

@@ -1,5 +1,6 @@
 type __VLS_Props = {
     modelValue: boolean;
+    inviteToken?: string;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;

package/dist/runtime/components/BasicAuthSignInModal.client.vue

@@ -89,7 +89,8 @@ const modalUi = {
   content: "basic-auth-modal-content sm:max-w-[380px]"
 };
 const props = defineProps({
-  modelValue: { type: Boolean, required: true }
+  modelValue: { type: Boolean, required: true },
+  inviteToken: { type: String, required: false }
 });
 const emit = defineEmits(["update:modelValue", "signed-in", "open-register"]);
 const state = reactive({
@@ -116,7 +117,8 @@ async function onSubmit() {
       method: "POST",
       body: {
         email: state.email,
-        password: state.password
+        password: state.password,
+        inviteToken: props.inviteToken?.trim() || void 0
       }
     });
     emit("signed-in");

package/dist/runtime/components/BasicAuthSignInModal.client.vue.d.ts

@@ -1,5 +1,6 @@
 type __VLS_Props = {
     modelValue: boolean;
+    inviteToken?: string;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     "update:modelValue": (value: boolean) => any;

package/dist/runtime/components/SidebarAuthButtonBasic.client.vue

@@ -51,6 +51,7 @@
 
     <BasicAuthSignInModal
       v-model="signInModalOpen"
+      :invite-token="inviteToken"
       @signed-in="onSignedIn"
       @open-register="openRegisterFromSignIn"
     />
@@ -58,6 +59,7 @@
     <BasicAuthRegisterModal
       v-model="registerModalOpen"
       :invite-token="inviteToken"
+      @open-sign-in="openSignInFromRegister"
       @registered="onRegistered"
     />
 
@@ -181,6 +183,12 @@ onMounted(async () => {
     registerModalOpen.value = true;
   }
 });
+async function openSignInFromRegister(token) {
+  inviteToken.value = token || inviteToken.value;
+  registerModalOpen.value = false;
+  await nextTick();
+  signInModalOpen.value = true;
+}
 </script>
 
 <style>

package/dist/runtime/server/api/basic-auth/register.post.js

@@ -4,6 +4,7 @@ import { createError, defineEventHandler, setCookie } from "h3";
 import { z } from "zod";
 import { getAuthWorkspaceStore } from "~~/server/auth/store/registry";
 import {
+  getInviteTokenFromEvent,
   resolveRegistrationMode,
   validateInviteRegistration
 } from "~~/server/auth/registration";
@@ -68,10 +69,11 @@ export async function handleRegister(event) {
   if (mode === "disabled") {
     mapRegistrationErrorToHttp("disabled");
   }
-  if (mode === "invite_only" && !body.inviteToken?.trim()) {
+  const inviteToken = body.inviteToken ?? getInviteTokenFromEvent(event);
+  if (mode === "invite_only" && !inviteToken) {
     mapRegistrationErrorToHttp("invite_required");
   }
-  if (mode === "invite_only") {
+  if (inviteToken) {
     const syncConfig = runtimeConfig;
     const storeId = syncConfig.sync?.provider ?? syncConfig.public?.sync?.provider ?? "convex";
     const store = getAuthWorkspaceStore(storeId);
@@ -83,7 +85,7 @@ export async function handleRegister(event) {
       store,
       mode,
       email,
-      inviteToken: body.inviteToken
+      inviteToken
     });
     if (!decision.allowed) {
       mapRegistrationErrorToHttp(decision.reason);
@@ -129,8 +131,8 @@ export async function handleRegister(event) {
   });
   setAccessCookie(event, accessToken, config.accessTtlSeconds);
   setRefreshCookie(event, refreshToken, config.refreshTtlSeconds);
-  if (mode === "invite_only" && body.inviteToken?.trim()) {
-    setCookie(event, "or3_invite_token", body.inviteToken.trim(), {
+  if (inviteToken) {
+    setCookie(event, "or3_invite_token", inviteToken, {
       httpOnly: true,
       sameSite: "lax",
       secure: process.env.NODE_ENV === "production",

package/dist/runtime/server/api/basic-auth/sign-in.post.js

@@ -1,5 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { defineEventHandler } from "h3";
+import { defineEventHandler, setCookie } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { verifyInviteToken } from "~~/server/auth/invite-token";
 import { z } from "zod";
 import { clearAuthCookies, setAccessCookie, setRefreshCookie } from "../../lib/cookies.js";
 import { getBasicAuthConfig } from "../../lib/config.js";
@@ -21,7 +23,8 @@ import { assertBasicAuthReady, noStore, parseBodyWithSchema } from "./_helpers.j
 const signInSchema = z.object({
   email: z.string().email().max(320),
   // Sign-in must allow legacy short passwords; strength is enforced at set/change time.
-  password: z.string().min(1).max(512)
+  password: z.string().min(1).max(512),
+  inviteToken: z.string().trim().min(1).max(4096).optional()
 });
 const DUMMY_PASSWORD_HASH = "$2a$12$1XCXpgmbzURDdc0AGJiAsemtT39PAw8WwV7fBOq6A5VQv6.qN6Va.";
 export async function handleSignIn(event) {
@@ -68,6 +71,19 @@ export async function handleSignIn(event) {
   });
   setAccessCookie(event, accessToken, config.accessTtlSeconds);
   setRefreshCookie(event, refreshToken, config.refreshTtlSeconds);
+  const secret = useRuntimeConfig().auth?.invite?.tokenSecret;
+  if (input.inviteToken && secret) {
+    const verified = verifyInviteToken(input.inviteToken, secret);
+    if (verified.ok && normalizeEmail(verified.payload.email) === email) {
+      setCookie(event, "or3_invite_token", input.inviteToken, {
+        httpOnly: true,
+        sameSite: "lax",
+        secure: process.env.NODE_ENV === "production",
+        path: "/",
+        maxAge: Math.min(600, verified.payload.exp - Math.floor(Date.now() / 1e3))
+      });
+    }
+  }
   return { ok: true };
 }
 export default defineEventHandler(async (event) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "or3-provider-basic-auth",
-  "version": "0.0.11",
+  "version": "0.0.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Saluana/or3-provider-basic-auth.git"