feat(auth): add auth config discovery endpoint for dynamic SSO UI rendering by Claude · Pull Request #1141 · objectstack-ai/framework

Claude · 2026-04-14T12:04:17Z

Frontend applications need to discover server-side auth configuration to dynamically render appropriate login buttons (email/password, Google, GitHub, etc.) without hardcoding provider lists.

Changes

Protocol Layer (`packages/spec/src/api/auth-endpoints.zod.ts`)

Added AuthProviderInfoSchema - public OAuth provider metadata (id, name, enabled)
Added EmailPasswordConfigPublicSchema - email/password auth settings
Added AuthFeaturesConfigSchema - feature flags (2FA, passkeys, magic link, organization)
Added GetAuthConfigResponseSchema - complete config discovery response
All sensitive fields (clientSecret, secret) excluded by design

Backend (`packages/plugins/plugin-auth/`)

Added AuthManager.getPublicConfig() - extracts safe config from internal state
- Filters disabled providers
- Maps provider IDs to friendly names (google → Google)
- Returns only non-sensitive configuration
Registered GET /api/v1/auth/config endpoint in AuthPlugin
- Returns standard JSON envelope format
- Includes error handling

Client SDK (`packages/client/src/index.ts`)

Added client.auth.getConfig() method
Exported config types: GetAuthConfigResponse, AuthProviderInfo, etc.

Tests

Comprehensive test coverage for getPublicConfig()
Validates sensitive data exclusion
Tests provider filtering and name mapping
Verifies default values

Usage Example

// Frontend discovers available auth methods
const client = new ObjectStackClient({ baseUrl: window.location.origin });
const config = await client.auth.getConfig();

// Dynamically render social login buttons
config.socialProviders.forEach(provider => {
  renderButton({
    label: `Login with ${provider.name}`,
    onClick: () => window.location.href = `/api/v1/auth/authorize/${provider.id}`
  });
});

Response Format

{
  "success": true,
  "data": {
    "emailPassword": {
      "enabled": true,
      "disableSignUp": false,
      "requireEmailVerification": false
    },
    "socialProviders": [
      { "id": "google", "name": "Google", "enabled": true },
      { "id": "github", "name": "GitHub", "enabled": true }
    ],
    "features": {
      "twoFactor": true,
      "passkeys": false,
      "magicLink": false,
      "organization": true
    }
  }
}

- Add GetAuthConfigResponse schema to auth-endpoints.zod.ts - Add getPublicConfig() method to AuthManager - Add GET /api/v1/auth/config endpoint in AuthPlugin - Add auth.getConfig() method to client SDK - Add comprehensive tests for getPublicConfig() - Export auth config types from client Agent-Logs-Url: https://github.com/objectstack-ai/framework/sessions/51ee5fa2-1949-4db5-aba9-7011af6f329a Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

vercel · 2026-04-14T12:04:22Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectstack-demo	Error		Apr 14, 2026 0:18am
spec	Ready	Preview, Comment	Apr 14, 2026 0:18am

packages/plugins/plugin-auth/src/auth-plugin.test.ts

hotlong · 2026-04-14T12:08:15Z

@claude[agent] 从主分支更新最新代码

…to claude/add-third-party-sso-support Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

- Remove unused AuthManager import from auth-plugin.test.ts - Merge latest changes from main branch Agent-Logs-Url: https://github.com/objectstack-ai/framework/sessions/021c7504-f94b-4009-bc35-fb44d8348988 Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Claude · 2026-04-14T12:09:37Z

@claude[agent] 从主分支更新最新代码

已完成主分支更新和代码修复。更改包括：

移除了未使用的 AuthManager 导入（修复 CodeQL 警告）
成功合并主分支最新代码

Commit: 15ad086

Copilot

Pull request overview

Adds an authentication configuration discovery capability so frontends can render login UI dynamically based on server-side auth settings, spanning spec (protocol), server plugin (endpoint + config extraction), client SDK, and tests.

Changes:

Added public auth config discovery schemas/types to the API spec.
Implemented AuthManager.getPublicConfig() and exposed it via GET /api/v1/auth/config in the auth plugin.
Added client.auth.getConfig() plus new exported SDK types, with tests validating safe output.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
packages/spec/src/api/auth-endpoints.zod.ts	Adds Zod schemas/types for the public auth config discovery response payload.
packages/plugins/plugin-auth/src/auth-plugin.ts	Registers `GET {basePath}/config` endpoint returning a standard JSON envelope.
packages/plugins/plugin-auth/src/auth-manager.ts	Implements `getPublicConfig()` to derive non-sensitive, frontend-safe auth configuration.
packages/plugins/plugin-auth/src/auth-manager.test.ts	Adds tests for provider filtering, name mapping, defaults, and sensitive data exclusion.
packages/client/src/index.ts	Adds `auth.getConfig()` and exports the new config discovery types from spec.

Copilot · 2026-04-14T12:16:33Z

packages/spec/src/api/auth-endpoints.zod.ts

+// ==========================================
+// Auth Configuration Discovery
+// ==========================================
+
+/**
+ * Auth Provider Information (Public)
+ *
+ * Public-facing information about an OAuth/social provider.
+ * Does NOT include sensitive configuration (clientSecret, etc.)
+ */
+export const AuthProviderInfoSchema = z.object({
+  id: z.string().describe('Provider ID (e.g., google, github, microsoft)'),
+  name: z.string().describe('Display name (e.g., Google, GitHub)'),
+  enabled: z.boolean().describe('Whether this provider is enabled'),
+});
+
+/**
+ * Email/Password Configuration (Public)
+ */
+export const EmailPasswordConfigPublicSchema = z.object({
+  enabled: z.boolean().describe('Whether email/password auth is enabled'),
+  disableSignUp: z.boolean().optional().describe('Whether new user registration is disabled'),
+  requireEmailVerification: z.boolean().optional().describe('Whether email verification is required'),
+});
+
+/**
+ * Auth Features Configuration (Public)
+ */
+export const AuthFeaturesConfigSchema = z.object({
+  twoFactor: z.boolean().default(false).describe('Two-factor authentication enabled'),
+  passkeys: z.boolean().default(false).describe('Passkey/WebAuthn support enabled'),
+  magicLink: z.boolean().default(false).describe('Magic link login enabled'),
+  organization: z.boolean().default(false).describe('Multi-tenant organization support enabled'),
+});
+
+/**
+ * Get Auth Config Response
+ *
+ * Returns the public authentication configuration that the frontend
+ * can use to render appropriate login UI (social provider buttons, etc.)
+ */
+export const GetAuthConfigResponseSchema = z.object({
+  emailPassword: EmailPasswordConfigPublicSchema.describe('Email/password authentication config'),
+  socialProviders: z.array(AuthProviderInfoSchema).describe('Available social/OAuth providers'),
+  features: AuthFeaturesConfigSchema.describe('Enabled authentication features'),
+});


The protocol file adds schemas for the auth config discovery response, but it does not add the actual /config endpoint to AuthEndpointPaths / AuthEndpointSchema. This leaves the documented auth endpoint contract incomplete and forces downstream callers (e.g. the client SDK) to hardcode the path. Please add a getConfig (GET) entry and path constant (and any alias/mapping if you want it discoverable via existing helpers).

Copilot · 2026-04-14T12:16:34Z

packages/plugins/plugin-auth/src/auth-plugin.ts

    const basePath = this.options.basePath || '/api/v1/auth';

    // Get raw Hono app to use native wildcard routing
    // Type assertion is safe here because we explicitly require Hono server as a dependency
    if (!('getRawApp' in httpServer) || typeof (httpServer as any).getRawApp !== 'function') {
      ctx.logger.error('HTTP server does not support getRawApp() - wildcard routing requires Hono server');
      throw new Error(
        'AuthPlugin requires HonoServerPlugin for wildcard routing support. ' +
        'Please ensure HonoServerPlugin is loaded before AuthPlugin.'
      );
    }

    const rawApp = (httpServer as any).getRawApp();

+    // Register auth config endpoint - public endpoint for frontend discovery
+    rawApp.get(`${basePath}/config`, async (c: any) => {
+      try {


basePath is concatenated directly into route strings. If a caller configures basePath with a trailing slash (e.g. /api/v1/auth/), the registered routes become //config and //*, and may also diverge from the basePath passed into better-auth. Consider normalizing once (e.g. trim a trailing /) before registering routes and before passing it to AuthManager/better-auth.

Copilot · 2026-04-14T12:16:34Z

packages/plugins/plugin-auth/src/auth-plugin.ts

+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error('Auth config error:', err);
+
+        return c.json({
+          success: false,
+          error: {
+            code: 'auth_config_error',
+            message: err.message,
+          },
+        }, 500);


This is a public endpoint; returning err.message directly can leak internal details to unauthenticated callers. Prefer logging the full error server-side, but returning a generic client-facing message (while keeping a stable code) unless you have a vetted, user-safe error message.

Copilot · 2026-04-14T12:16:34Z

packages/plugins/plugin-auth/src/auth-manager.ts

+  getPublicConfig() {
+    // Extract social providers info (without sensitive data)
+    const socialProviders = [];
+    if (this.config.socialProviders) {
+      for (const [id, providerConfig] of Object.entries(this.config.socialProviders)) {
+        if (providerConfig.enabled !== false) {
+          // Map provider ID to friendly name
+          const nameMap: Record<string, string> = {
+            google: 'Google',
+            github: 'GitHub',
+            microsoft: 'Microsoft',
+            apple: 'Apple',
+            facebook: 'Facebook',
+            twitter: 'Twitter',
+            discord: 'Discord',
+            gitlab: 'GitLab',
+            linkedin: 'LinkedIn',
+          };
+
+          socialProviders.push({
+            id,
+            name: nameMap[id] || id.charAt(0).toUpperCase() + id.slice(1),
+            enabled: true,
+          });


nameMap is recreated on every loop iteration. Since this method is called per request, move the provider display-name map outside the loop (or to a module-level constant) to avoid repeated allocations, and consider typing getPublicConfig()'s return type to the spec contract (e.g. GetAuthConfigResponse) so the server implementation can’t drift from the protocol.

Copilot · 2026-04-14T12:16:34Z

packages/client/src/index.ts

+    getConfig: async () => {
+      const route = this.getRoute('auth');
+      const res = await this.fetch(`${this.baseUrl}${route}/config`);
+      return this.unwrapResponse(res);
+    },


auth.getConfig() currently returns an untyped unwrapResponse(res) and hardcodes '/config'. Since the PR introduces GetAuthConfigResponse (and ideally an endpoint path constant in the spec), please type this as Promise<GetAuthConfigResponse> and call unwrapResponse<GetAuthConfigResponse>(res) (and use the spec’s path constant once it exists) to keep the SDK aligned with the protocol.

Claude AI assigned Claude and hotlong Apr 14, 2026

Claude created this pull request from a session on behalf of hotlong April 14, 2026 12:04 View session

github-actions bot added tests size/m labels Apr 14, 2026

vercel bot deployed to Preview – spec April 14, 2026 12:05 View deployment

github-advanced-security AI found potential problems Apr 14, 2026

View reviewed changes

packages/plugins/plugin-auth/src/auth-plugin.test.ts Fixed Show fixed Hide fixed

Claude started work on behalf of hotlong April 14, 2026 12:08 View session

Claude AI and others added 2 commits April 14, 2026 12:09

Merge branch 'main' of https://github.com/objectstack-ai/framework in…

98ce857

…to claude/add-third-party-sso-support Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Claude AI requested a review from hotlong April 14, 2026 12:10

Claude finished work on behalf of hotlong April 14, 2026 12:10

vercel bot had a problem deploying to Preview – objectstack-demo April 14, 2026 12:11 Failure

hotlong marked this pull request as ready for review April 14, 2026 12:11

Copilot AI review requested due to automatic review settings April 14, 2026 12:11

hotlong merged commit 9e6650e into main Apr 14, 2026
9 of 13 checks passed

Copilot started reviewing on behalf of hotlong April 14, 2026 12:12 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

vercel bot deployed to Preview – spec April 14, 2026 12:18 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(auth): add auth config discovery endpoint for dynamic SSO UI rendering#1141

feat(auth): add auth config discovery endpoint for dynamic SSO UI rendering#1141
hotlong merged 3 commits intomainfrom
claude/add-third-party-sso-support

Claude AI commented Apr 14, 2026

Uh oh!

vercel bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

hotlong commented Apr 14, 2026

Uh oh!

Claude AI commented Apr 14, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Claude AI commented Apr 14, 2026

Changes

Protocol Layer (packages/spec/src/api/auth-endpoints.zod.ts)

Backend (packages/plugins/plugin-auth/)

Client SDK (packages/client/src/index.ts)

Tests

Usage Example

Response Format

Uh oh!

vercel bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

hotlong commented Apr 14, 2026

Uh oh!

Claude AI commented Apr 14, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Protocol Layer (`packages/spec/src/api/auth-endpoints.zod.ts`)

Backend (`packages/plugins/plugin-auth/`)

Client SDK (`packages/client/src/index.ts`)

vercel bot commented Apr 14, 2026 •

edited

Loading