WRNexusJS/docs/AUTH-SCHEMA-CONFIG.md

Auth schemas and route configuration

@wrnexus/auth registers its browser validation schemas automatically. Applications using packaged components do not create default files under app/schemas and do not duplicate package API routes.

Default use

import type { AuthConfig } from "@wrnexus/auth";
import type { AppConfig } from "@wrnexus/styles";
import { auth } from "./app/lib/auth.ts";

const config = {
  auth: {
    engine: auth,
    routes: true,
    middleware: true,
    migrations: false,
  },
} satisfies AppConfig & { auth: AuthConfig };

export default config;

Keep behavioral hooks such as delivery, tokenUrl, onSignedIn, and onSignedOut in the application's createAuthEngine(...) call. config.auth selects framework integration features such as routes, middleware, migrations, components, schemas, base URL, CSRF, and passkey HTTP settings.

Components such as <SignUp />, <SignIn />, and <ForgotPassword /> use built-in schemas in the browser and the same resolved schemas on the server.

Route groups

routes: {
  enabled: true,
  registration: true,
  login: true,
  verification: true,
  password: true,
  invitations: true,
  magicLink: true,
  otp: true,
  mfa: true,
  sessions: true,
  impersonation: false,
  passkeys: true,
}

Set routes: false to disable every package route. Set a route group to false only when the application intentionally owns that feature's endpoints. No explicit exclusion list is required.

Customize one schema

Create a file only when application behavior differs from the package default:

// app/schemas/custom-password-request.ts
import { authSchemas } from "@wrnexus/auth";
import { v } from "@wrnexus/validation";

export default authSchemas.passwordResetRequest.extend({
  identifier: v
    .string()
    .trim()
    .required("Enter your registered email address")
    .email("Enter a valid registered email address"),
});

// wrnexus.config.ts
import customPasswordRequest from "./app/schemas/custom-password-request.ts";

export default {
  auth: {
    engine: auth,
    schemas: {
      passwordResetRequest: customPasswordRequest,
    },
  },
};

The override is used by both the package API handler and the package browser runtime. <ForgotPassword /> keeps its normal schema="auth-password-request"; all other auth schemas continue using package defaults.