Publish bwh-auth (npm) and auth-laravel (Packagist) from CI on tag - #15
Merged
Conversation
…footguns Four integration bugs surfaced in a consuming app (vora); this commit prevents the package-preventable ones: **Finding 1 (P1 — access-control bypass)** - Add `AuthUserPolicy::canLogin()` to the contract with a docblock explaining it is the single gate for account state (active, approved, not disabled). The default implementation duck-types `$user->canLogin()` then falls back to `is_disabled`, matching the previous `canPasskeyLogin()` logic. - `DefaultAuthUserPolicy::canPasskeyLogin()` now delegates to `canLogin()` so both code paths share one implementation. - New `RequireActiveUser` middleware calls `policy->canLogin()` and aborts 403 when the user is not allowed in. Applied automatically on all package audit-log routes (previously only `auth` middleware was applied, letting a pending/disabled admin reach the admin endpoint if their Gate ability only checked role). - Config comment on `audit.admin_ability` warns that the gate definition must check both role and account state. **Finding 2 (P1 — lockout-after-migration)** - Package does not own the `approved_at` column (it is app-side), so there is nothing to migrate-fix. Added prominent README guidance with a code example showing how to backfill the column in the migration that adds it, so integrators do not lock out existing users. **Finding 3 (P2 — onboarding redirect divergence)** - Package does not ship an email-verification controller (app-owned), so the hardcoded `/pending` redirect was not in this repo. - Added README guidance: after email verification the app must call `AuthUserPolicy::redirectAfterLogin()` (not a hardcoded path), so an already-approved user who verifies their email is sent to the correct destination instead of the pending page. **Finding 4 (P3 — dropdown outside-click)** - The package ships no navbar/dropdown/menu components; this bug is entirely app-side. No change. Tests: 7 new assertions covering `canLogin()`, the `is_disabled` fallback, the `canPasskeyLogin()` delegation, and the middleware pass/block/unauthenticated cases. All 40 tests pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adding canLogin() to the AuthUserPolicy contract is a BC break for direct implementers. Document that this must ship as v0.5.0 (not a 0.4.x patch, which ^0.4 consumers would auto-pull and fatal on) and how integrators migrate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add .github/workflows/release.yml: pushing a `bwh-auth-v*` tag builds the JS package, publishes it to npm, and creates a GitHub release with the packed tarball; pushing a `v*` tag refreshes the PHP package on Packagist. Both jobs use the `prod` environment for the NPM_TOKEN / PACKAGIST_TOKEN secrets. Simplify release.mjs to only bump, tag, and push — publishing and the GitHub release are now CI's responsibility, so it no longer publishes locally or needs gh. Pushing the tag is the single trigger. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The npm job now requests an id-token and publishes via `npm publish --provenance`, letting npm exchange the GitHub OIDC token for a short-lived credential. Drops the NPM_TOKEN secret entirely and attests provenance automatically. Upgrades npm to >= 11.5.0 first (required for trusted publishing). The prod environment is kept so the OIDC claim matches the trusted-publisher environment scope. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/release.yml:bwh-auth-v*tag → build the JS package, publish to npm via OIDC trusted publishing (with provenance), and create a GitHub release with the packed.tgz.v*tag → refreshbherila/auth-laravelon Packagist.ui/scripts/release.mjsto only bump → tag → push; publishing and the GitHub release are now CI's job, so it no longer publishes locally or requiresgh.Required configuration
bherila, repoauth, workflow filenamerelease.yml, environmentprod. NoNPM_TOKENsecret needed — thenpmjob usesid-token: writeOIDC.prodenvironment secret:PACKAGIST_TOKEN.bherilain the workflow — change it if the token owner differs.🤖 Generated with Claude Code