release: WRNexusJS 0.5.10

packages/auth/test/components.test.ts

@@ -51,6 +51,48 @@ test("passwordless and passkey components preserve MFA continuation metadata", (
   expect(signIn).toContain('name="deviceName"');
 });
 
+test("recovery forms expose a form slot for CAPTCHA and policy controls", () => {
+  const source = readFileSync(join(directory, "ForgotPassword.wrn"), "utf8");
+  const formStart = source.indexOf("<form");
+  const formEnd = source.indexOf("</form>");
+  const slot = source.indexOf("<slot></slot>");
+
+  expect(formStart).toBeGreaterThanOrEqual(0);
+  expect(slot).toBeGreaterThan(formStart);
+  expect(slot).toBeLessThan(formEnd);
+});
+
+test("account forms use the dedicated password components", () => {
+  const signIn = readFileSync(join(directory, "SignIn.wrn"), "utf8");
+  const signUp = readFileSync(join(directory, "SignUp.wrn"), "utf8");
+
+  expect(signIn).toContain("<TogglePassword");
+  expect(signIn).not.toContain('id="auth-sign-in-password"');
+  expect(signUp).toContain("<StrongPassword");
+  expect(signUp).not.toContain('id="auth-sign-up-password"');
+});
+
+test("authentication journeys use themed UI form controls", () => {
+  const expected = {
+    "SignIn.wrn": ["<Input", "<TogglePassword", "<Checkbox", "<Button"],
+    "SignUp.wrn": ["<Input", "<StrongPassword", "<Checkbox", "<Button"],
+    "ForgotPassword.wrn": ["<Input", "<Button"],
+    "ResetPassword.wrn": ["<StrongPassword", "<Button"],
+    "MagicLinkSignIn.wrn": ["<Input", "<Button"],
+    "InvitationAccept.wrn": ["<Input", "<StrongPassword", "<Button"],
+    "OtpSignIn.wrn": ["<Input", "<PinInput", "<Button"],
+    "TwoFactorChallenge.wrn": ["<Select", "<PinInput", "<Button"],
+    "AuthenticatorSetup.wrn": ["<Input", "<PinInput", "<Button"],
+    "VerifyEmail.wrn": ["<Input", "<Button"],
+    "VerifyPhone.wrn": ["<PinInput", "<Button"],
+  };
+
+  for (const [file, controls] of Object.entries(expected)) {
+    const source = readFileSync(join(directory, file), "utf8");
+    for (const control of controls) expect(source).toContain(control);
+  }
+});
+
 test("verification components can resend without application-owned schema files", () => {
   const email = readFileSync(join(directory, "VerifyEmail.wrn"), "utf8");
   const phone = readFileSync(join(directory, "VerifyPhone.wrn"), "utf8");

packages/auth/test/plugin.test.ts

@@ -178,6 +178,26 @@ test("config.auth registers package routes", async () => {
 
   expect(contributions.migrations).toHaveLength(0);
 });
+test("config.auth contributes a reusable forward-auth verification route", async () => {
+  const runner = createPluginRunner(authPlugin(), {
+    root: process.cwd(),
+    mode: "development",
+    command: "dev",
+    metadata: new Map<string, unknown>(),
+    warn() {},
+  });
+  await runner.configure({
+    auth: {
+      engine: {} as never,
+      routes: true,
+    },
+  });
+  const contributions = await runner.contributions();
+  expect(contributions.routes.some((route) => route.path === "/api/auth/session/verify")).toBe(
+    true,
+  );
+});
+
 test("config.auth can disable route groups", async () => {
   const metadata = new Map<string, unknown>();