Extract slug-auth npm package #234

New issue

Closed

opened 2026-06-28 22:33:12 -05:00 by erik · 3 comments

erik commented

2026-06-28 22:33:12 -05:00

Owner

Goal

Create @evcraddock/slug-auth for reusable Slugkit authentication primitives so generated sites can receive security fixes while keeping storage, admin policy, and UI integration under site ownership.

Requirements

Implement the work described in docs/npm-specs/03-slug-auth.md.
Create packages/slug-auth with TypeScript build, tests, README, package metadata, and public exports.
Design storage interfaces before moving implementation code.
Extract token hashing, API key helpers, session helpers, magic-link helpers, passkey/WebAuthn helpers, auth middleware primitives, and auth audit/logging helper types.
Update the template site to consume @evcraddock/slug-auth via workspace:*.
Keep local wrapper modules under template/site/src/auth/* for database access, admin config, delivery behavior, settings UI integration, and customization points.
Ensure generated sites created after release depend on the published @evcraddock/slug-auth package version.
Publish the package to npm and verify post-publish install/import behavior.

Acceptance criteria

@evcraddock/slug-auth exists as a workspace package.
Template site consumes @evcraddock/slug-auth via workspace:*.
Template-site auth behavior remains unchanged.
Generated sites created after release depend on the published @evcraddock/slug-auth package.
Local wrappers preserve database and policy customization points.
Public exports and storage interfaces are documented and tested.
Package is published and post-publish install/import verification succeeds.
./scripts/pre-pr.sh passes.

Dependencies

task-4f6fb4a9

## Goal Create `@evcraddock/slug-auth` for reusable Slugkit authentication primitives so generated sites can receive security fixes while keeping storage, admin policy, and UI integration under site ownership. ## Requirements - Implement the work described in `docs/npm-specs/03-slug-auth.md`. - Create `packages/slug-auth` with TypeScript build, tests, README, package metadata, and public exports. - Design storage interfaces before moving implementation code. - Extract token hashing, API key helpers, session helpers, magic-link helpers, passkey/WebAuthn helpers, auth middleware primitives, and auth audit/logging helper types. - Update the template site to consume `@evcraddock/slug-auth` via `workspace:*`. - Keep local wrapper modules under `template/site/src/auth/*` for database access, admin config, delivery behavior, settings UI integration, and customization points. - Ensure generated sites created after release depend on the published `@evcraddock/slug-auth` package version. - Publish the package to npm and verify post-publish install/import behavior. ## Acceptance criteria - [ ] `@evcraddock/slug-auth` exists as a workspace package. - [ ] Template site consumes `@evcraddock/slug-auth` via `workspace:*`. - [ ] Template-site auth behavior remains unchanged. - [ ] Generated sites created after release depend on the published `@evcraddock/slug-auth` package. - [ ] Local wrappers preserve database and policy customization points. - [ ] Public exports and storage interfaces are documented and tested. - [ ] Package is published and post-publish install/import verification succeeds. - [ ] `./scripts/pre-pr.sh` passes. ## Dependencies - task-4f6fb4a9

erik added the

labels

2026-06-28 22:33:12 -05:00

erik commented

2026-06-29 11:30:52 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-29T16:28:10.832Z

Review update

PR: #244 is open with Forgejo CI run #342 passing.
Result: approved for merge.
Verified: @evcraddock/slug-auth package extraction, template auth wrapper integration, generated-site dependency mapping, package pack/release dry-runs, ./scripts/pre-pr.sh, and Forgejo CI build-lint-test passed.
Follow-up: after merge, publish @evcraddock/slug-auth@0.1.0 through Forgejo CI and verify post-publish install/import before task closure.

_Synced from todu comment by @todu on 2026-06-29T16:28:10.832Z_ ### Review update - PR: #244 is open with Forgejo CI run #342 passing. - Result: approved for merge. - Verified: `@evcraddock/slug-auth` package extraction, template auth wrapper integration, generated-site dependency mapping, package pack/release dry-runs, `./scripts/pre-pr.sh`, and Forgejo CI `build-lint-test` passed. - Follow-up: after merge, publish `@evcraddock/slug-auth@0.1.0` through Forgejo CI and verify post-publish install/import before task closure.

erik

2026-06-29 11:47:38 -05:00

closed this issue
added
status:done
and removed
status:inprogress
labels

erik commented

2026-06-29 11:47:38 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-29T16:44:32.684Z

Completed

Merged PR #244 into main, adding @evcraddock/slug-auth under packages/slug-auth with package metadata, README, TypeScript build config, public exports, storage interfaces, and tests.
Updated the template site to consume @evcraddock/slug-auth@0.1.0 through npm workspace linking while preserving local auth wrapper modules for database access, admin policy, delivery behavior, sessions, passkeys, and settings/UI integration.
Updated generated-site dependency handling so future generated sites depend on published @evcraddock/slug-auth@0.1.0.
Verified template auth behavior through focused auth/API tests, full ./scripts/pre-pr.sh, PR CI, and post-merge push CI.
Published @evcraddock/slug-auth@0.1.0 through Forgejo CI and verified npm view plus temporary install/import of token helpers.

_Synced from todu comment by @todu on 2026-06-29T16:44:32.684Z_ ### Completed - Merged PR #244 into `main`, adding `@evcraddock/slug-auth` under `packages/slug-auth` with package metadata, README, TypeScript build config, public exports, storage interfaces, and tests. - Updated the template site to consume `@evcraddock/slug-auth@0.1.0` through npm workspace linking while preserving local auth wrapper modules for database access, admin policy, delivery behavior, sessions, passkeys, and settings/UI integration. - Updated generated-site dependency handling so future generated sites depend on published `@evcraddock/slug-auth@0.1.0`. - Verified template auth behavior through focused auth/API tests, full `./scripts/pre-pr.sh`, PR CI, and post-merge push CI. - Published `@evcraddock/slug-auth@0.1.0` through Forgejo CI and verified npm view plus temporary install/import of token helpers.

erik commented

2026-06-29 11:47:38 -05:00

Author

Owner

Synced from todu comment by @todu on 2026-06-29T16:43:35.469Z

Update

Merged PR #244 into main.
Published @evcraddock/slug-auth@0.1.0 through Forgejo CI.
Verified npm view @evcraddock/slug-auth@0.1.0 version returns 0.1.0.
Verified a temporary project can install/import @evcraddock/slug-auth@0.1.0 and access token helpers.
Forgejo release workflow run #345 passed after npm registry propagation completed.

_Synced from todu comment by @todu on 2026-06-29T16:43:35.469Z_ ### Update - Merged PR #244 into `main`. - Published `@evcraddock/slug-auth@0.1.0` through Forgejo CI. - Verified `npm view @evcraddock/slug-auth@0.1.0 version` returns `0.1.0`. - Verified a temporary project can install/import `@evcraddock/slug-auth@0.1.0` and access token helpers. - Forgejo release workflow run #345 passed after npm registry propagation completed.