feat(auth): print the OTP banner on client demand, with expiry and requester info - #368
Conversation
…quester info
The interactive-auth banner now prints only when an untrusted browser
client asks for a code (auth notice view mount, its new re-issue button,
or a custom UI via the client's requestAuthCode()), instead of on the
first served request - opening an already-authorized page prints nothing.
- new anonymous:devframe:auth:request-code RPC; reissue: true rotates
the code first so the manual button always yields a fresh code
- AuthBannerFunction now receives { code, url, expireAt, requester? }
and the built-in banner renders the expiry and requesting browser
- the code exchange no longer reprints the rotated code
- hub-ui auth notice requests the banner on mount and gains a
"Re-issue one-time password" button; both custom hub examples request
it when their auth overlay shows
◈ PR Lens
Architecture 
10 components touched across 3 lanes. Inside the changed components — 2 viewsComponent view — Server Auth Recipe and State Internal components of Devframe handling on-demand banner formatting, code rotation, and origin derivation 
Component view — Client Auth UI and RPC Dispatch Client UI notice and RPC transport methods requesting terminal banner prints 
Data flow 
The other flows — 1 sequence
Drill down
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
- `@unocss/inspector` 66.10 imports `@devframes/vite/single` at module load, and pnpm links it to the workspace package, so the two example builds that load `unocss/vite` in their vite config now declare a turbo edge on `@devframes/vite#build` instead of racing it - dedupe the auto-installed `@unocss/core` peer to 66.10.0 (the stale 66.8.1 copy made `design/uno.config.ts` fail typecheck) - capture the DP_MESSAGES_0001 warning in a plain array: vitest 5 clears spy call history recorded during `beforeAll` - refresh the a11y client-script API snapshot for tsnapi 1.4.2's default export rendering
…mes/devframe into feat/otp-banner-on-demand
Its SPA vite config loads unocss/vite, which since unocss 66.10 eagerly imports the workspace-linked @devframes/vite; every unocss/vite-loading build task now reaches @devframes/vite#build transitively.
Windows runners check *.patch out with CRLF (autocrlf), which pnpm 12's patch parser rejects with ERR_PNPM_INVALID_PATCH.
2 participants
What
Makes the interactive-auth code/magic-link banner on demand: it prints only when an untrusted browser client actually needs a code, never on plain page loads. Opening a page that is already authorized prints nothing.
anonymous:devframe:auth:request-codeRPC (client:rpc.requestAuthCode(options?)): asks the server to print its banner.reissue: truerotates the code first, so the manual action always yields a freshly-valid code; a plain request prints each code at most once (per-code dedupe).AuthBannerFunctionnow receives{ code, url, expireAt, requester? }—requesteris the asking browser's parsed UA label + origin — and the built-increateAuthBannerbox renders the expiry and requester rows.ViewBuiltinClientAuthNoticeview on first mount, its new “Re-issue one-time password” button, a user's custom auth UI callingrequestAuthCode()(both custom hub examples updated, at parity), the native-prompt fallback, or a host callingauth.printBanner()directly.Why
The banner previously printed on the first request that reached the server — including pages already trusted by a stored token — and gave the user no way to get a fresh code printed when theirs expired or rotated away.
Docs (security guide, client guide, initiate adapter, interactive-auth + node-api references) and API snapshots updated; origin-adoption tests reworked to trigger printing over the new RPC.
Created with the help of an agent.