[{"data":1,"prerenderedAt":2196},["ShallowReactive",2],{"navigation_docs":3,"-modules-identity-auth":587,"-modules-identity-auth-surround":2191},[4,50,155,441,504],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":49},"Get Started","i-lucide-rocket","\u002Fget-started","1.get-started",[10,15,20,25,30,35,40,45],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fget-started\u002Fintroduction","1.get-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fget-started\u002Finstallation","1.get-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Project structure","\u002Fget-started\u002Fproject-structure","1.get-started\u002F3.project-structure","i-lucide-folder-tree",{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fget-started\u002Fconfiguration","1.get-started\u002F4.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Authentication","\u002Fget-started\u002Fauthentication","1.get-started\u002F5.authentication","i-lucide-lock",{"title":36,"path":37,"stem":38,"icon":39},"Adding modules","\u002Fget-started\u002Fadding-modules","1.get-started\u002F6.adding-modules","i-lucide-puzzle",{"title":41,"path":42,"stem":43,"icon":44},"Database","\u002Fget-started\u002Fdatabase","1.get-started\u002F7.database","i-lucide-database",{"title":46,"path":47,"stem":48,"icon":6},"Deployment","\u002Fget-started\u002Fdeployment","1.get-started\u002F8.deployment",false,{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":49},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[56,90,115,125],{"title":57,"icon":49,"path":58,"stem":59,"children":60,"page":49},"Concepts","\u002Fguide\u002Fconcepts","2.guide\u002F1.concepts",[61,66,71,76,80,85],{"title":62,"path":63,"stem":64,"icon":65},"Architecture","\u002Fguide\u002Fconcepts\u002Farchitecture","2.guide\u002F1.concepts\u002F1.architecture","i-lucide-blocks",{"title":67,"path":68,"stem":69,"icon":70},"Access control","\u002Fguide\u002Fconcepts\u002Fauth-and-scopes","2.guide\u002F1.concepts\u002F2.auth-and-scopes","i-lucide-shield-check",{"title":72,"path":73,"stem":74,"icon":75},"Extension points","\u002Fguide\u002Fconcepts\u002Fextension-points","2.guide\u002F1.concepts\u002F3.extension-points","i-lucide-plug",{"title":77,"path":78,"stem":79,"icon":44},"Database extensions","\u002Fguide\u002Fconcepts\u002Fdatabase-extensions","2.guide\u002F1.concepts\u002F4.database-extensions",{"title":81,"path":82,"stem":83,"icon":84},"Identity","\u002Fguide\u002Fconcepts\u002Fidentity","2.guide\u002F1.concepts\u002F5.identity","i-lucide-fingerprint",{"title":86,"path":87,"stem":88,"icon":89},"Glossary","\u002Fguide\u002Fconcepts\u002Fglossary","2.guide\u002F1.concepts\u002F6.glossary","i-lucide-book-a",{"title":91,"icon":49,"path":92,"stem":93,"children":94,"page":49},"UX patterns","\u002Fguide\u002Fux-patterns","2.guide\u002F2.ux-patterns",[95,100,105,110],{"title":96,"path":97,"stem":98,"icon":99},"Layouts and navigation","\u002Fguide\u002Fux-patterns\u002Flayouts-and-navigation","2.guide\u002F2.ux-patterns\u002F1.layouts-and-navigation","i-lucide-layout-template",{"title":101,"path":102,"stem":103,"icon":104},"Pages","\u002Fguide\u002Fux-patterns\u002Fpages","2.guide\u002F2.ux-patterns\u002F2.pages","i-lucide-table",{"title":106,"path":107,"stem":108,"icon":109},"Forms and actions","\u002Fguide\u002Fux-patterns\u002Fforms-and-actions","2.guide\u002F2.ux-patterns\u002F3.forms-and-actions","i-lucide-square-pen",{"title":111,"path":112,"stem":113,"icon":114},"Text and formatting","\u002Fguide\u002Fux-patterns\u002Ftext-and-formatting","2.guide\u002F2.ux-patterns\u002F4.text-and-formatting","i-lucide-type",{"title":116,"icon":49,"path":117,"stem":118,"children":119,"page":49},"Best practices","\u002Fguide\u002Fbest-practices","2.guide\u002F3.best-practices",[120],{"title":121,"path":122,"stem":123,"icon":124},"HTTP routes","\u002Fguide\u002Fbest-practices\u002Fhttp-routes","2.guide\u002F3.best-practices\u002F1.http-routes","i-lucide-route",{"title":126,"icon":49,"path":127,"stem":128,"children":129,"page":49},"Going further","\u002Fguide\u002Fgoing-further","2.guide\u002F4.going-further",[130,135,140,145,150],{"title":131,"path":132,"stem":133,"icon":134},"Use your own OAuth server","\u002Fguide\u002Fgoing-further\u002Fown-oauth-server","2.guide\u002F4.going-further\u002F1.own-oauth-server","i-lucide-key-round",{"title":136,"path":137,"stem":138,"icon":139},"Create an OAuth application","\u002Fguide\u002Fgoing-further\u002Foauth-application","2.guide\u002F4.going-further\u002F2.oauth-application","i-lucide-app-window",{"title":141,"path":142,"stem":143,"icon":144},"Signing keys","\u002Fguide\u002Fgoing-further\u002Fsigning-keys","2.guide\u002F4.going-further\u002F3.signing-keys","i-lucide-key-square",{"title":146,"path":147,"stem":148,"icon":149},"Stripe setup","\u002Fguide\u002Fgoing-further\u002Fstripe-setup","2.guide\u002F4.going-further\u002F4.stripe-setup","i-lucide-credit-card",{"title":151,"path":152,"stem":153,"icon":154},"Migrate to the permission model","\u002Fguide\u002Fgoing-further\u002Fmigrate-access-control","2.guide\u002F4.going-further\u002F5.migrate-access-control","i-lucide-arrow-right-left",{"title":156,"icon":157,"path":158,"stem":159,"children":160},"Modules","i-lucide-boxes","\u002Fmodules","3.modules",[161,163,244,273,320,375],{"title":156,"path":158,"stem":162},"3.modules\u002Findex",{"title":81,"icon":49,"path":164,"stem":165,"children":166,"page":49},"\u002Fmodules\u002Fidentity","3.modules\u002F1.identity",[167,190,194,198,220,224,240],{"title":168,"path":169,"stem":170,"children":171},"Auth","\u002Fmodules\u002Fidentity\u002Fauth","3.modules\u002F1.identity\u002F1.auth\u002Findex",[172,174,178,182,186],{"title":173,"path":169,"stem":170},"Overview",{"title":175,"path":176,"stem":177},"Server API","\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver","3.modules\u002F1.identity\u002F1.auth\u002F2.server",{"title":179,"path":180,"stem":181},"Reference","\u002Fmodules\u002Fidentity\u002Fauth\u002Freference","3.modules\u002F1.identity\u002F1.auth\u002F3.reference",{"title":183,"path":184,"stem":185},"Client mode","\u002Fmodules\u002Fidentity\u002Fauth\u002Fclient-mode","3.modules\u002F1.identity\u002F1.auth\u002F4.client-mode",{"title":187,"path":188,"stem":189},"OAuth providers","\u002Fmodules\u002Fidentity\u002Fauth\u002Foauth-providers","3.modules\u002F1.identity\u002F1.auth\u002F5.oauth-providers",{"title":191,"path":192,"stem":193},"Users","\u002Fmodules\u002Fidentity\u002Fusers","3.modules\u002F1.identity\u002F2.users",{"title":195,"path":196,"stem":197},"Account","\u002Fmodules\u002Fidentity\u002Faccount","3.modules\u002F1.identity\u002F3.account",{"title":199,"path":200,"stem":201,"children":202},"Authorization","\u002Fmodules\u002Fidentity\u002Fauthorization","3.modules\u002F1.identity\u002F4.authorization\u002Findex",[203,204,208,212,216],{"title":173,"path":200,"stem":201},{"title":205,"path":206,"stem":207},"Roles and requirements","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Froles-and-requirements","3.modules\u002F1.identity\u002F4.authorization\u002F2.roles-and-requirements",{"title":209,"path":210,"stem":211},"Policies","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fpolicies","3.modules\u002F1.identity\u002F4.authorization\u002F3.policies",{"title":213,"path":214,"stem":215},"Client","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fclient","3.modules\u002F1.identity\u002F4.authorization\u002F4.client",{"title":217,"path":218,"stem":219},"Admin","\u002Fmodules\u002Fidentity\u002Fauthorization\u002Fadmin","3.modules\u002F1.identity\u002F4.authorization\u002F5.admin",{"title":221,"path":222,"stem":223},"Preferences","\u002Fmodules\u002Fidentity\u002Fpreferences","3.modules\u002F1.identity\u002F5.preferences",{"title":225,"path":226,"stem":227,"children":228},"OAuth Server","\u002Fmodules\u002Fidentity\u002Foauth-server","3.modules\u002F1.identity\u002F6.oauth-server\u002Findex",[229,230,233,237],{"title":173,"path":226,"stem":227},{"title":175,"path":231,"stem":232},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fserver","3.modules\u002F1.identity\u002F6.oauth-server\u002F2.server",{"title":234,"path":235,"stem":236},"Hooks","\u002Fmodules\u002Fidentity\u002Foauth-server\u002Fhooks","3.modules\u002F1.identity\u002F6.oauth-server\u002F3.hooks",{"title":179,"path":238,"stem":239},"\u002Fmodules\u002Fidentity\u002Foauth-server\u002Froutes-and-clients","3.modules\u002F1.identity\u002F6.oauth-server\u002F4.routes-and-clients",{"title":241,"path":242,"stem":243},"OAuth Resource","\u002Fmodules\u002Fidentity\u002Foauth-resource","3.modules\u002F1.identity\u002F8.oauth-resource",{"title":245,"icon":49,"path":246,"stem":247,"children":248,"page":49},"Commerce","\u002Fmodules\u002Fcommerce","3.modules\u002F2.commerce",[249,253,257],{"title":250,"path":251,"stem":252},"Stripe","\u002Fmodules\u002Fcommerce\u002Fstripe","3.modules\u002F2.commerce\u002F1.stripe",{"title":254,"path":255,"stem":256},"Payments","\u002Fmodules\u002Fcommerce\u002Fpayments","3.modules\u002F2.commerce\u002F2.payments",{"title":258,"path":259,"stem":260,"children":261},"Subscriptions","\u002Fmodules\u002Fcommerce\u002Fsubscriptions","3.modules\u002F2.commerce\u002F3.subscriptions\u002Findex",[262,263,266,270],{"title":173,"path":259,"stem":260},{"title":175,"path":264,"stem":265},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fserver","3.modules\u002F2.commerce\u002F3.subscriptions\u002F2.server",{"title":267,"path":268,"stem":269},"App","\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Fapp","3.modules\u002F2.commerce\u002F3.subscriptions\u002F3.app",{"title":179,"path":271,"stem":272},"\u002Fmodules\u002Fcommerce\u002Fsubscriptions\u002Freference","3.modules\u002F2.commerce\u002F3.subscriptions\u002F4.reference",{"title":274,"icon":49,"path":275,"stem":276,"children":277,"page":49},"Features","\u002Fmodules\u002Ffeatures","3.modules\u002F3.features",[278,293,312,316],{"title":279,"path":280,"stem":281,"children":282},"Events","\u002Fmodules\u002Ffeatures\u002Fevents","3.modules\u002F3.features\u002F1.events\u002Findex",[283,284,287,290],{"title":173,"path":280,"stem":281},{"title":175,"path":285,"stem":286},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fserver","3.modules\u002F3.features\u002F1.events\u002F2.server",{"title":267,"path":288,"stem":289},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Fapp","3.modules\u002F3.features\u002F1.events\u002F3.app",{"title":179,"path":291,"stem":292},"\u002Fmodules\u002Ffeatures\u002Fevents\u002Freference","3.modules\u002F3.features\u002F1.events\u002F4.reference",{"title":294,"path":295,"stem":296,"children":297},"Forms","\u002Fmodules\u002Ffeatures\u002Fforms","3.modules\u002F3.features\u002F2.forms\u002Findex",[298,299,303,306,309],{"title":173,"path":295,"stem":296},{"title":300,"path":301,"stem":302},"Definition","\u002Fmodules\u002Ffeatures\u002Fforms\u002Fdefinition","3.modules\u002F3.features\u002F2.forms\u002F2.definition",{"title":175,"path":304,"stem":305},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fserver","3.modules\u002F3.features\u002F2.forms\u002F3.server",{"title":267,"path":307,"stem":308},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Fapp","3.modules\u002F3.features\u002F2.forms\u002F4.app",{"title":179,"path":310,"stem":311},"\u002Fmodules\u002Ffeatures\u002Fforms\u002Freference","3.modules\u002F3.features\u002F2.forms\u002F5.reference",{"title":313,"path":314,"stem":315},"Cookie Consent","\u002Fmodules\u002Ffeatures\u002Fcookie-consent","3.modules\u002F3.features\u002F3.cookie-consent",{"title":317,"path":318,"stem":319},"MCP","\u002Fmodules\u002Ffeatures\u002Fmcp","3.modules\u002F3.features\u002F4.mcp",{"title":321,"icon":49,"path":322,"stem":323,"children":324,"page":49},"Interface","\u002Fmodules\u002Finterface","3.modules\u002F4.interface",[325,350,353,357,361],{"title":326,"path":327,"stem":328,"children":329},"UI","\u002Fmodules\u002Finterface\u002Fui","3.modules\u002F4.interface\u002F1.ui\u002Findex",[330,331,335,339,343,347],{"title":173,"path":327,"stem":328},{"title":332,"path":333,"stem":334},"Page components","\u002Fmodules\u002Finterface\u002Fui\u002Fpage-components","3.modules\u002F4.interface\u002F1.ui\u002F2.page-components",{"title":336,"path":337,"stem":338},"App shell","\u002Fmodules\u002Finterface\u002Fui\u002Fapp-shell","3.modules\u002F4.interface\u002F1.ui\u002F3.app-shell",{"title":340,"path":341,"stem":342},"Form inputs","\u002Fmodules\u002Finterface\u002Fui\u002Fform-inputs","3.modules\u002F4.interface\u002F1.ui\u002F4.form-inputs",{"title":344,"path":345,"stem":346},"Composables and helpers","\u002Fmodules\u002Finterface\u002Fui\u002Fcomposables","3.modules\u002F4.interface\u002F1.ui\u002F5.composables",{"title":179,"path":348,"stem":349},"\u002Fmodules\u002Finterface\u002Fui\u002Freference","3.modules\u002F4.interface\u002F1.ui\u002F6.reference",{"title":217,"path":351,"stem":352},"\u002Fmodules\u002Finterface\u002Fadmin","3.modules\u002F4.interface\u002F2.admin",{"title":354,"path":355,"stem":356},"Menu","\u002Fmodules\u002Finterface\u002Fmenu","3.modules\u002F4.interface\u002F3.menu",{"title":358,"path":359,"stem":360},"Widget","\u002Fmodules\u002Finterface\u002Fwidget","3.modules\u002F4.interface\u002F4.widget",{"title":362,"path":363,"stem":364,"children":365},"Mobile","\u002Fmodules\u002Finterface\u002Fmobile","3.modules\u002F4.interface\u002F5.mobile\u002Findex",[366,367,371],{"title":173,"path":363,"stem":364},{"title":368,"path":369,"stem":370},"CLI and devices","\u002Fmodules\u002Finterface\u002Fmobile\u002Fcli-and-devices","3.modules\u002F4.interface\u002F5.mobile\u002F2.cli-and-devices",{"title":372,"path":373,"stem":374},"Splash screen","\u002Fmodules\u002Finterface\u002Fmobile\u002Fsplash-screen","3.modules\u002F4.interface\u002F5.mobile\u002F3.splash-screen",{"title":376,"icon":49,"path":377,"stem":378,"children":379,"page":49},"Platform","\u002Fmodules\u002Fplatform","3.modules\u002F5.platform",[380,402,406,423],{"title":381,"path":382,"stem":383,"children":384},"Module Kit","\u002Fmodules\u002Fplatform\u002Fmodule-kit","3.modules\u002F5.platform\u002F1.module-kit\u002Findex",[385,386,390,394,398],{"title":173,"path":382,"stem":383},{"title":387,"path":388,"stem":389},"Server toolkit","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fserver-toolkit","3.modules\u002F5.platform\u002F1.module-kit\u002F2.server-toolkit",{"title":391,"path":392,"stem":393},"Registries and menus","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fregistries-and-menus","3.modules\u002F5.platform\u002F1.module-kit\u002F3.registries-and-menus",{"title":395,"path":396,"stem":397},"Translations","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fi18n","3.modules\u002F5.platform\u002F1.module-kit\u002F4.i18n",{"title":399,"path":400,"stem":401},"Database helpers","\u002Fmodules\u002Fplatform\u002Fmodule-kit\u002Fdatabase","3.modules\u002F5.platform\u002F1.module-kit\u002F5.database",{"title":403,"path":404,"stem":405},"Notify","\u002Fmodules\u002Fplatform\u002Fnotify","3.modules\u002F5.platform\u002F2.notify",{"title":407,"path":408,"stem":409,"children":410},"Email Templates","\u002Fmodules\u002Fplatform\u002Femail-templates","3.modules\u002F5.platform\u002F3.email-templates\u002Findex",[411,412,416,419],{"title":173,"path":408,"stem":409},{"title":413,"path":414,"stem":415},"Email components","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fcomponents","3.modules\u002F5.platform\u002F3.email-templates\u002F2.components",{"title":175,"path":417,"stem":418},"\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fserver","3.modules\u002F5.platform\u002F3.email-templates\u002F3.server",{"title":420,"path":421,"stem":422},"Module emails","\u002Fmodules\u002Fplatform\u002Femail-templates\u002Fmodule-emails","3.modules\u002F5.platform\u002F3.email-templates\u002F4.module-emails",{"title":424,"path":425,"stem":426,"children":427},"Base Layer","\u002Fmodules\u002Fplatform\u002Fbase-layer","3.modules\u002F5.platform\u002F4.base-layer\u002Findex",[428,429,433,437],{"title":173,"path":425,"stem":426},{"title":430,"path":431,"stem":432},"Content collections","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcontent-collections","3.modules\u002F5.platform\u002F4.base-layer\u002F2.content-collections",{"title":434,"path":435,"stem":436},"Layouts and routing","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Flayouts-and-routing","3.modules\u002F5.platform\u002F4.base-layer\u002F3.layouts-and-routing",{"title":438,"path":439,"stem":440},"Composables and utils","\u002Fmodules\u002Fplatform\u002Fbase-layer\u002Fcomposables-and-utils","3.modules\u002F5.platform\u002F4.base-layer\u002F4.composables-and-utils",{"title":442,"icon":443,"path":444,"stem":445,"children":446,"page":49},"Examples","i-lucide-code-xml","\u002Fexamples","4.examples",[447,466,476],{"title":448,"icon":49,"path":449,"stem":450,"children":451,"page":49},"Starters","\u002Fexamples\u002Fstarters","4.examples\u002F1.starters",[452,456,461],{"title":453,"path":454,"stem":455,"icon":6},"Workspace starter","\u002Fexamples\u002Fstarters\u002Fworkspace","4.examples\u002F1.starters\u002F1.workspace",{"title":457,"path":458,"stem":459,"icon":460},"Mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile","4.examples\u002F1.starters\u002F2.mobile","i-lucide-smartphone",{"title":462,"path":463,"stem":464,"icon":465},"Standalone mobile starter","\u002Fexamples\u002Fstarters\u002Fmobile-standalone","4.examples\u002F1.starters\u002F3.mobile-standalone","i-lucide-tablet-smartphone",{"title":467,"icon":49,"path":468,"stem":469,"children":470,"page":49},"Apps","\u002Fexamples\u002Fapps","4.examples\u002F2.apps",[471],{"title":472,"path":473,"stem":474,"icon":475},"Frigear website app","\u002Fexamples\u002Fapps\u002Ffrigear-nu-website","4.examples\u002F2.apps\u002F1.frigear-nu-website","i-lucide-layout-dashboard",{"title":477,"icon":49,"path":478,"stem":479,"children":480,"page":49},"Tasks","\u002Fexamples\u002Ftasks","4.examples\u002F3.tasks",[481,485,489,494,499],{"title":482,"path":483,"stem":484,"icon":70},"Protect a route","\u002Fexamples\u002Ftasks\u002Fprotect-a-route","4.examples\u002F3.tasks\u002F1.protect-a-route",{"title":486,"path":487,"stem":488,"icon":475},"Add an admin page","\u002Fexamples\u002Ftasks\u002Fadd-an-admin-page","4.examples\u002F3.tasks\u002F2.add-an-admin-page",{"title":490,"path":491,"stem":492,"icon":493},"Sell event tickets","\u002Fexamples\u002Ftasks\u002Fsell-event-tickets","4.examples\u002F3.tasks\u002F3.sell-event-tickets","i-lucide-ticket",{"title":495,"path":496,"stem":497,"icon":498},"Build a form","\u002Fexamples\u002Ftasks\u002Fbuild-a-form","4.examples\u002F3.tasks\u002F4.build-a-form","i-lucide-clipboard-list",{"title":500,"path":501,"stem":502,"icon":503},"Send an email","\u002Fexamples\u002Ftasks\u002Fsend-an-email","4.examples\u002F3.tasks\u002F5.send-an-email","i-lucide-mail",{"title":505,"icon":506,"path":507,"stem":508,"children":509,"page":49},"Contribute","i-lucide-git-pull-request","\u002Fcontribute","5.contribute",[510,513,518,544,549,552,556,571],{"title":173,"path":511,"stem":512,"icon":506},"\u002Fcontribute\u002Foverview","5.contribute\u002F1.overview",{"title":514,"path":515,"stem":516,"icon":517},"Local development","\u002Fcontribute\u002Flocal-development","5.contribute\u002F2.local-development","i-lucide-terminal",{"title":519,"icon":49,"path":520,"stem":521,"children":522,"page":49},"Writing a module","\u002Fcontribute\u002Fwriting-a-module","5.contribute\u002F3.writing-a-module",[523,527,532,536,541],{"title":524,"path":525,"stem":526,"icon":39},"Scaffold a module","\u002Fcontribute\u002Fwriting-a-module\u002Fscaffold","5.contribute\u002F3.writing-a-module\u002F1.scaffold",{"title":528,"path":529,"stem":530,"icon":531},"Setup checklist","\u002Fcontribute\u002Fwriting-a-module\u002Fsetup-checklist","5.contribute\u002F3.writing-a-module\u002F2.setup-checklist","i-lucide-list-checks",{"title":533,"path":534,"stem":535,"icon":44},"Database tables","\u002Fcontribute\u002Fwriting-a-module\u002Fdatabase-tables","5.contribute\u002F3.writing-a-module\u002F3.database-tables",{"title":537,"path":538,"stem":539,"icon":540},"Testing","\u002Fcontribute\u002Fwriting-a-module\u002Ftesting","5.contribute\u002F3.writing-a-module\u002F4.testing","i-lucide-flask-conical",{"title":67,"path":542,"stem":543,"icon":70},"\u002Fcontribute\u002Fwriting-a-module\u002Faccess-control","5.contribute\u002F3.writing-a-module\u002F5.access-control",{"title":545,"path":546,"stem":547,"icon":548},"Publishing","\u002Fcontribute\u002Fpublishing","5.contribute\u002F4.publishing","i-lucide-package-check",{"title":448,"path":550,"stem":551,"icon":6},"\u002Fcontribute\u002Fstarters","5.contribute\u002F5.starters",{"title":553,"path":554,"stem":555,"icon":52},"Documentation","\u002Fcontribute\u002Fdocumentation","5.contribute\u002F6.documentation",{"title":557,"icon":49,"path":558,"stem":559,"children":560,"page":49},"Tooling","\u002Fcontribute\u002Ftooling","5.contribute\u002F7.tooling",[561,566],{"title":562,"path":563,"stem":564,"icon":565},"CLI","\u002Fcontribute\u002Ftooling\u002Fcli","5.contribute\u002F7.tooling\u002F1.cli","i-lucide-square-terminal",{"title":567,"path":568,"stem":569,"icon":570},"ESLint config","\u002Fcontribute\u002Ftooling\u002Feslint-config","5.contribute\u002F7.tooling\u002F2.eslint-config","i-lucide-spell-check",{"title":572,"icon":49,"path":573,"stem":574,"children":575},"Decisions","\u002Fcontribute\u002Fdecisions","5.contribute\u002F8.decisions\u002Findex",[576,578,583],{"title":572,"path":573,"stem":574,"icon":577},"i-lucide-scale",{"title":579,"path":580,"stem":581,"icon":582},"Session lifetimes per OAuth client","\u002Fcontribute\u002Fdecisions\u002Foauth-token-lifetimes","5.contribute\u002F8.decisions\u002F1.oauth-token-lifetimes","i-lucide-timer",{"title":584,"path":585,"stem":586,"icon":70},"One permission model","\u002Fcontribute\u002Fdecisions\u002Fpermission-model","5.contribute\u002F8.decisions\u002F2.permission-model",{"id":588,"title":168,"body":589,"description":2184,"extension":2185,"links":2186,"meta":2187,"navigation":2188,"path":169,"seo":2189,"stem":170,"__hash__":2190},"docs\u002F3.modules\u002F1.identity\u002F1.auth\u002Findex.md",{"type":590,"value":591,"toc":2170},"minimark",[592,603,623,628,736,740,803,807,1093,1107,1111,1117,1675,1703,1718,1732,1746,1775,1884,1887,1898,1913,1922,1938,1945,1960,1969,1973,1986,2008,2012,2032,2060,2068,2072,2136,2140,2166],[593,594,595,596,599,600,602],"p",{},"Auth lets people sign in to your app with a password, an emailed link, a passkey or an account at GitHub, Google or\nanother provider. It also tells every server route who is calling, whether that is a browser, a script or another app.\nInstall it when your app has users; ",[597,598,191],"a",{"href":192}," installs it for you. To let other apps sign in\nthrough yours, add ",[597,601,225],{"href":226}," as well.",[593,604,605,606,610,611,614,615,618,619,622],{},"The package is ",[607,608,609],"code",{},"@frigear-nu\u002Fauth",". It runs in ",[597,612,613],{"href":87},"server mode"," by default: people sign in on your\napp's own server and stay signed in through a cookie ",[597,616,617],{"href":87},"session",". An app without a server of\nits own, such as a single-page application (SPA) or a Capacitor app, uses\n",[597,620,621],{"href":184},"client mode",".",[624,625,627],"h2",{"id":626},"what-you-get","What you get",[629,630,631,662,680,692,727],"ul",{},[632,633,634,637,638,641,642,645,646,649,650,653,654,657,658,661],"li",{},[635,636,101],"strong",{}," (opt-in, need ",[607,639,640],{},"@nuxt\u002Fui","): a sign-in page (",[607,643,644],{},"\u002Flogin","), a sign-up page (",[607,647,648],{},"\u002Fregister","), ",[607,651,652],{},"\u002Fforgot-password"," and\n",[607,655,656],{},"\u002Freset-password",", and ",[607,659,660],{},"\u002Fauth\u002Fmagic-link"," for emailed links.",[632,663,664,667,668,671,672,675,676,622],{},[635,665,666],{},"Server routes"," under ",[607,669,670],{},"\u002Fapi\u002Fauth",": password sign-in and sign-up (on by default), password reset (on with\npasswords), emailed sign-in links and passkeys (opt-in), and sign-in through an\n",[597,673,674],{"href":87},"OAuth provider"," (on once its credentials are set). See\n",[597,677,679],{"href":678},"\u002Fmodules\u002Fidentity\u002Fauth\u002Freference#routes","Routes",[632,681,682,685,686,688,689,691],{},[635,683,684],{},"API tokens"," (on by default): users create long-lived ",[597,687,684],{"href":87}," for scripts and\nagents, on the ",[597,690,195],{"href":196}," page or through the API.",[632,693,694,696,697,700,701,704,705,707,708,711,712,715,716,719,720,723,724,726],{},[635,695,344],{},": on the server, ",[607,698,699],{},"authorize"," decides whether the caller may do something and ",[607,702,703],{},"getAuth"," tells a route who is calling (see\n",[597,706,175],{"href":176},"). In the app, ",[607,709,710],{},"useUserSession()"," says who is signed in, ",[607,713,714],{},"useAuth()"," holds\nthe sign-in and sign-out actions, and ",[607,717,718],{},"$api"," \u002F ",[607,721,722],{},"useApi()"," call your API. The same names work in both modes. Roles\nand the guards of the interface come from ",[597,725,199],{"href":200}," in both.",[632,728,729,732,733,735],{},[635,730,731],{},"Emails",": the emailed sign-in link, address verification and password reset, sent through\n",[597,734,403],{"href":404}," when those flows are on.",[737,738],"module-runtime",{":client":739,":mobile":739,":server":739},"true",[741,742,743,765,775],"note",{},[593,744,745,748,749,752,753,653,758,761,762,764],{},[635,746,747],{},"Installed for you:"," in server mode, ",[607,750,751],{},"@frigear-nu\u002Fmodule-kit",", ",[597,754,755],{"href":404},[607,756,757],{},"@frigear-nu\u002Fnotify",[607,759,760],{},"nuxt-auth-utils","; in client mode, ",[607,763,751],{}," only.",[593,766,767,770,771,774],{},[635,768,769],{},"You add:"," ",[607,772,773],{},"@nuxthub\u002Fcore"," in server mode.",[593,776,777,770,780,785,786,788,789,792,793,796,797,802],{},[635,778,779],{},"Optional:",[597,781,782],{"href":355},[607,783,784],{},"@frigear-nu\u002Fmenu"," (the sign-out item), ",[607,787,640],{}," (the shipped pages),\n",[607,790,791],{},"@simplewebauthn\u002Fbrowser"," and ",[607,794,795],{},"@simplewebauthn\u002Fserver"," (passkeys), and\n",[597,798,799],{"href":408},[607,800,801],{},"@frigear-nu\u002Femail-templates"," (rendered emails).",[624,804,806],{"id":805},"quick-setup","Quick setup",[808,809,810,815,820,848,852,867,877,1047,1051,1058,1069,1081],"steps",{},[811,812,814],"h3",{"id":813},"install-auth","Install Auth",[593,816,817,819],{},[597,818,191],{"href":192}," installs Auth for you. Add it yourself only when you use it without Users:",[821,822,827],"pre",{"className":823,"code":824,"language":825,"meta":826,"style":826},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","pnpm add @frigear-nu\u002Fauth @nuxthub\u002Fcore\n","bash","",[607,828,829],{"__ignoreMap":826},[830,831,834,838,842,845],"span",{"class":832,"line":833},"line",1,[830,835,837],{"class":836},"sBMFI","pnpm",[830,839,841],{"class":840},"sfazB"," add",[830,843,844],{"class":840}," @frigear-nu\u002Fauth",[830,846,847],{"class":840}," @nuxthub\u002Fcore\n",[811,849,851],{"id":850},"add-it-to-nuxtconfigts","Add it to nuxt.config.ts",[853,854,855,856,859,860,863,864,866],"warning",{},"The config key is ",[607,857,858],{},"authentication",", not ",[607,861,862],{},"auth",". The ",[607,865,862],{}," key belongs to nuxt-auth-utils.",[593,868,869,870,872,873,876],{},"This turns on password sign-in with a sign-in page at ",[607,871,644],{}," and a sign-up page at ",[607,874,875],{},"\u002Fsign-up",":",[821,878,883],{"className":879,"code":880,"filename":881,"language":882,"meta":826,"style":826},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default defineNuxtConfig({\n  modules: [\n    '@nuxthub\u002Fcore',\n    '@frigear-nu\u002Fauth', \u002F\u002F omit when Users is installed\n  ],\n  authentication: {\n    settings: {\n      password: true,\n      pages: { login: true, register: '\u002Fsign-up' },\n    },\n  },\n})\n","nuxt.config.ts","ts",[607,884,885,906,918,932,948,956,967,977,991,1026,1032,1038],{"__ignoreMap":826},[830,886,887,891,894,898,902],{"class":832,"line":833},[830,888,890],{"class":889},"s7zQu","export",[830,892,893],{"class":889}," default",[830,895,897],{"class":896},"s2Zo4"," defineNuxtConfig",[830,899,901],{"class":900},"sTEyZ","(",[830,903,905],{"class":904},"sMK4o","{\n",[830,907,909,913,915],{"class":832,"line":908},2,[830,910,912],{"class":911},"swJcz","  modules",[830,914,876],{"class":904},[830,916,917],{"class":900}," [\n",[830,919,921,924,926,929],{"class":832,"line":920},3,[830,922,923],{"class":904},"    '",[830,925,773],{"class":840},[830,927,928],{"class":904},"'",[830,930,931],{"class":904},",\n",[830,933,935,937,939,941,944],{"class":832,"line":934},4,[830,936,923],{"class":904},[830,938,609],{"class":840},[830,940,928],{"class":904},[830,942,943],{"class":904},",",[830,945,947],{"class":946},"sHwdD"," \u002F\u002F omit when Users is installed\n",[830,949,951,954],{"class":832,"line":950},5,[830,952,953],{"class":900},"  ]",[830,955,931],{"class":904},[830,957,959,962,964],{"class":832,"line":958},6,[830,960,961],{"class":911},"  authentication",[830,963,876],{"class":904},[830,965,966],{"class":904}," {\n",[830,968,970,973,975],{"class":832,"line":969},7,[830,971,972],{"class":911},"    settings",[830,974,876],{"class":904},[830,976,966],{"class":904},[830,978,980,983,985,989],{"class":832,"line":979},8,[830,981,982],{"class":911},"      password",[830,984,876],{"class":904},[830,986,988],{"class":987},"sfNiH"," true",[830,990,931],{"class":904},[830,992,994,997,999,1002,1005,1007,1009,1011,1014,1016,1019,1021,1023],{"class":832,"line":993},9,[830,995,996],{"class":911},"      pages",[830,998,876],{"class":904},[830,1000,1001],{"class":904}," {",[830,1003,1004],{"class":911}," login",[830,1006,876],{"class":904},[830,1008,988],{"class":987},[830,1010,943],{"class":904},[830,1012,1013],{"class":911}," register",[830,1015,876],{"class":904},[830,1017,1018],{"class":904}," '",[830,1020,875],{"class":840},[830,1022,928],{"class":904},[830,1024,1025],{"class":904}," },\n",[830,1027,1029],{"class":832,"line":1028},10,[830,1030,1031],{"class":904},"    },\n",[830,1033,1035],{"class":832,"line":1034},11,[830,1036,1037],{"class":904},"  },\n",[830,1039,1041,1044],{"class":832,"line":1040},12,[830,1042,1043],{"class":904},"}",[830,1045,1046],{"class":900},")\n",[811,1048,1050],{"id":1049},"generate-the-migration","Generate the migration",[853,1052,1053,1054,1057],{},"Without a ",[597,1055,1056],{"href":87},"migration",", sign-up and API tokens fail, because the database lacks Auth's columns\nand tables.",[593,1059,1060,1061,1064,1065,1068],{},"Auth adds its own tables and adds sign-in columns to the ",[607,1062,1063],{},"users"," table of Users (see\n",[597,1066,41],{"href":1067},"\u002Fmodules\u002Fidentity\u002Fauth\u002Freference#database","). That only changes the generated Drizzle schema, so generate a\nmigration and commit it:",[821,1070,1072],{"className":823,"code":1071,"language":825,"meta":826,"style":826},"pnpm db:generate\n",[607,1073,1074],{"__ignoreMap":826},[830,1075,1076,1078],{"class":832,"line":833},[830,1077,837],{"class":836},[830,1079,1080],{"class":840}," db:generate\n",[593,1082,1083,1084,1087,1088,792,1091,622],{},"Module authors do the same in every ",[597,1085,1086],{"href":87},"test fixture"," that installs Auth. See\n",[597,1089,41],{"href":1090},"\u002Fget-started\u002Fdatabase#migrations",[597,1092,381],{"href":382},[1094,1095,1098,770,1101,1103,1104,1106],"callout",{"color":1096,"icon":1097},"success","i-lucide-check",[635,1099,1100],{},"What you should see:",[607,1102,644],{}," shows an email and password form. After you create an account at ",[607,1105,875],{},", you are\nsigned in.",[624,1108,1110],{"id":1109},"options","Options",[593,1112,1113,1114,1116],{},"Options go under the ",[607,1115,858],{}," key.",[1118,1119,1120,1139],"table",{},[1121,1122,1123],"thead",{},[1124,1125,1126,1130,1133,1136],"tr",{},[1127,1128,1129],"th",{},"Option",[1127,1131,1132],{},"Type",[1127,1134,1135],{},"Default",[1127,1137,1138],{},"Purpose",[1140,1141,1142,1165,1183,1206,1229,1248,1271,1291,1309,1334,1354,1372,1390,1408,1426,1444,1462,1486,1508,1529,1547,1566,1593,1611,1628,1652],"tbody",{},[1124,1143,1144,1150,1155,1160],{},[1145,1146,1147],"td",{},[607,1148,1149],{},"mode",[1145,1151,1152],{},[607,1153,1154],{},"'server' | 'client'",[1145,1156,1157],{},[607,1158,1159],{},"'server'",[1145,1161,1162,1163,622],{},"Server mode or ",[597,1164,621],{"href":184},[1124,1166,1167,1172,1177,1180],{},[1145,1168,1169],{},[607,1170,1171],{},"client",[1145,1173,1174],{},[607,1175,1176],{},"ClientModuleOptions",[1145,1178,1179],{},"–",[1145,1181,1182],{},"Client mode only: the issuer and how the app talks to it.",[1124,1184,1185,1190,1195,1199],{},[1145,1186,1187],{},[607,1188,1189],{},"apiTokens",[1145,1191,1192],{},[607,1193,1194],{},"boolean | { prefix?: string }",[1145,1196,1197],{},[607,1198,739],{},[1145,1200,1201,1202,1205],{},"API tokens. ",[607,1203,1204],{},"false"," turns them off.",[1124,1207,1208,1213,1218,1223],{},[1145,1209,1210],{},[607,1211,1212],{},"apiTokens.prefix",[1145,1214,1215],{},[607,1216,1217],{},"string",[1145,1219,1220],{},[607,1221,1222],{},"'fnu_'",[1145,1224,1225,1226,622],{},"What new API tokens start with. See ",[597,1227,684],{"href":1228},"\u002Fmodules\u002Fidentity\u002Fauth\u002Fserver#user-api-tokens",[1124,1230,1231,1236,1241,1245],{},[1145,1232,1233],{},[607,1234,1235],{},"apiTokens.revokeOnReset",[1145,1237,1238],{},[607,1239,1240],{},"boolean",[1145,1242,1243],{},[607,1244,739],{},[1145,1246,1247],{},"Revoke a user's API tokens when their password is reset by email or an email change is undone.",[1124,1249,1250,1255,1260,1265],{},[1145,1251,1252],{},[607,1253,1254],{},"tokenTtlDays",[1145,1256,1257],{},[607,1258,1259],{},"number | null",[1145,1261,1262],{},[607,1263,1264],{},"null",[1145,1266,1267,1268,1270],{},"Default lifetime of new API tokens. ",[607,1269,1264],{}," means they never expire.",[1124,1272,1273,1278,1282,1285],{},[1145,1274,1275],{},[607,1276,1277],{},"userStore",[1145,1279,1280],{},[607,1281,1217],{},[1145,1283,1284],{},"the one from Users",[1145,1286,1287,1288,622],{},"Path to a module whose default export is an ",[607,1289,1290],{},"AuthUserStore",[1124,1292,1293,1298,1302,1306],{},[1145,1294,1295],{},[607,1296,1297],{},"settings.password",[1145,1299,1300],{},[607,1301,1240],{},[1145,1303,1304],{},[607,1305,739],{},[1145,1307,1308],{},"Email and password sign-in and sign-up: routes, composables and pages.",[1124,1310,1311,1316,1321,1329],{},[1145,1312,1313],{},[607,1314,1315],{},"settings.passwordReset",[1145,1317,1318],{},[607,1319,1320],{},"boolean | { cooldown? }",[1145,1322,1323,1325,1326],{},[607,1324,739],{}," with ",[607,1327,1328],{},"password",[1145,1330,1331,1332,622],{},"Forgot and reset password routes. Needs ",[607,1333,1328],{},[1124,1335,1336,1341,1346,1351],{},[1145,1337,1338],{},[607,1339,1340],{},"settings.passwordReset.cooldown",[1145,1342,1343],{},[607,1344,1345],{},"number",[1145,1347,1348],{},[607,1349,1350],{},"60",[1145,1352,1353],{},"Minimum seconds between two reset emails for one user.",[1124,1355,1356,1361,1365,1369],{},[1145,1357,1358],{},[607,1359,1360],{},"settings.webAuthn",[1145,1362,1363],{},[607,1364,1240],{},[1145,1366,1367],{},[607,1368,1204],{},[1145,1370,1371],{},"Passkeys: routes, composables and a table.",[1124,1373,1374,1379,1384,1387],{},[1145,1375,1376],{},[607,1377,1378],{},"settings.magicLink",[1145,1380,1381],{},[607,1382,1383],{},"boolean | { signUp?, cooldown? }",[1145,1385,1386],{},"off",[1145,1388,1389],{},"An emailed single-use sign-in link. Following it verifies the address, and clears what was set on an unverified account.",[1124,1391,1392,1397,1401,1403],{},[1145,1393,1394],{},[607,1395,1396],{},"settings.magicLink.signUp",[1145,1398,1399],{},[607,1400,1240],{},[1145,1402,1179],{},[1145,1404,1405,1407],{},[607,1406,739],{}," creates accounts for unknown addresses.",[1124,1409,1410,1415,1419,1423],{},[1145,1411,1412],{},[607,1413,1414],{},"settings.magicLink.cooldown",[1145,1416,1417],{},[607,1418,1345],{},[1145,1420,1421],{},[607,1422,1350],{},[1145,1424,1425],{},"Minimum seconds between two links for one user.",[1124,1427,1428,1433,1437,1441],{},[1145,1429,1430],{},[607,1431,1432],{},"settings.verifyEmail",[1145,1434,1435],{},[607,1436,1240],{},[1145,1438,1439],{},[607,1440,1204],{},[1145,1442,1443],{},"Users verify their address before they can sign in, with a password or a passkey.",[1124,1445,1446,1451,1456,1459],{},[1145,1447,1448],{},[607,1449,1450],{},"settings.rateLimit",[1145,1452,1453],{},[607,1454,1455],{},"false | { … }",[1145,1457,1458],{},"on",[1145,1460,1461],{},"Throttles the anonymous sign-in routes, counted in NuxtHub KV. See below.",[1124,1463,1464,1469,1474,1479],{},[1145,1465,1466],{},[607,1467,1468],{},"settings.cleanup",[1145,1470,1471],{},[607,1472,1473],{},"string | false",[1145,1475,1476],{},[607,1477,1478],{},"'0 3 * * *'",[1145,1480,1481,1482,1485],{},"When the ",[607,1483,1484],{},"auth:clear-expired-tokens"," task removes expired links and resets.",[1124,1487,1488,1493,1498,1500],{},[1145,1489,1490],{},[607,1491,1492],{},"settings.pages.login",[1145,1494,1495],{},[607,1496,1497],{},"string | boolean",[1145,1499,1386],{},[1145,1501,1502,1503,1505,1506,622],{},"The sign-in page. ",[607,1504,739],{}," means ",[607,1507,644],{},[1124,1509,1510,1515,1519,1521],{},[1145,1511,1512],{},[607,1513,1514],{},"settings.pages.register",[1145,1516,1517],{},[607,1518,1497],{},[1145,1520,1386],{},[1145,1522,1523,1524,1505,1526,1528],{},"The sign-up page. ",[607,1525,739],{},[607,1527,648],{},". May be an absolute URL.",[1124,1530,1531,1536,1540,1544],{},[1145,1532,1533],{},[607,1534,1535],{},"settings.pages.callback",[1145,1537,1538],{},[607,1539,1240],{},[1145,1541,1542],{},[607,1543,739],{},[1145,1545,1546],{},"Client mode only: the callback page.",[1124,1548,1549,1554,1558,1563],{},[1145,1550,1551],{},[607,1552,1553],{},"settings.afterLogin",[1145,1555,1556],{},[607,1557,1217],{},[1145,1559,1560],{},[607,1561,1562],{},"'\u002F'",[1145,1564,1565],{},"Where users land after signing in.",[1124,1567,1568,1573,1577,1582],{},[1145,1569,1570],{},[607,1571,1572],{},"settings.siteUrl",[1145,1574,1575],{},[607,1576,1217],{},[1145,1578,1579],{},[607,1580,1581],{},"NUXT_SITE_URL",[1145,1583,1584,1585,1588,1589,1592],{},"The public URL emailed links point at. Becomes ",[607,1586,1587],{},"runtimeConfig.public.siteUrl"," (",[607,1590,1591],{},"NUXT_PUBLIC_SITE_URL",").",[1124,1594,1595,1600,1604,1608],{},[1145,1596,1597],{},[607,1598,1599],{},"settings.trustRequestOrigin",[1145,1601,1602],{},[607,1603,1240],{},[1145,1605,1606],{},[607,1607,1204],{},[1145,1609,1610],{},"Without a site URL, build emailed links from the request's origin in production too.",[1124,1612,1613,1618,1622,1625],{},[1145,1614,1615],{},[607,1616,1617],{},"settings.session.mapper",[1145,1619,1620],{},[607,1621,1217],{},[1145,1623,1624],{},"pass-through",[1145,1626,1627],{},"Path to a default-export function that maps the stored user to the session user.",[1124,1629,1630,1635,1640,1646],{},[1145,1631,1632],{},[607,1633,1634],{},"settings.session.maxAge",[1145,1636,1637],{},[607,1638,1639],{},"number | false",[1145,1641,1642,1645],{},[607,1643,1644],{},"2592000"," (30 days)",[1145,1647,1648,1649,1651],{},"How long a session lasts, in seconds from sign-in. ",[607,1650,1204],{}," turns the limit off.",[1124,1653,1654,1659,1664,1669],{},[1145,1655,1656],{},[607,1657,1658],{},"settings.oauth",[1145,1660,1661],{},[607,1662,1663],{},"Record\u003Cprovider, boolean | { … }>",[1145,1665,1666],{},[607,1667,1668],{},"{}",[1145,1670,1671,1672,1674],{},"Changes per OAuth provider. ",[607,1673,1204],{}," keeps one off.",[593,1676,1677,1681,1682,1684,1685,1688,1689,1691,1692,1695,1696,1699,1700,1702],{},[635,1678,1679,622],{},[607,1680,1572],{}," Password reset, magic link and verification emails (and the email change emails of\n",[597,1683,191],{"href":192},") link to this URL, never to the request's ",[607,1686,1687],{},"Host"," header, which the client chooses.\nSet ",[607,1690,1591],{}," in production. Without it those emails fail with ",[607,1693,1694],{},"500 site_url_missing",", and the server warns\nat startup. ",[607,1697,1698],{},"nuxt dev"," uses the request's origin. Turn on ",[607,1701,1599],{}," only on a platform that routes\nby host, so a request for another host never reaches the app, such as Cloudflare Workers.",[593,1704,1705,1706,1709,1710,1713,1714,1717],{},"Sign-in, sign-up, sign-out, the magic link confirmation and the password reset refuse requests that another site made\nthe browser send: ",[607,1707,1708],{},"Sec-Fetch-Site: cross-site",", or an ",[607,1711,1712],{},"Origin"," other than the request's host or the site URL. They\nanswer ",[607,1715,1716],{},"403 cross_site_request",". Clients that send neither header, such as native apps and servers, are not affected.",[593,1719,1720,1724,1725,1588,1728,1731],{},[635,1721,1722,622],{},[607,1723,1634],{}," A session ends this long after sign-in, however active the user is: the cookie expires,\nand the server refuses a session signed in earlier (it is stamped at sign-in, and saving the profile or a preference\nkeeps the stamp). Signing in again starts a new one. nuxt-auth-utils'\n",[607,1726,1727],{},"runtimeConfig.session.maxAge",[607,1729,1730],{},"NUXT_SESSION_MAX_AGE",") wins over this setting.",[593,1733,1734,1737,1738,1741,1742,1745],{},[635,1735,1736],{},"Ending sessions."," A password change or reset, an email change or its revert, and clearing an unverified account's\ncredentials end every other session of the user: the module bumps the user's ",[607,1739,1740],{},"sessionVersion"," column, and a session\nsigned in before that is refused. The session that made the change stays signed in. A password reset and an undone email\nchange also revoke the user's API tokens, since the account may have been in someone else's hands. Set\n",[607,1743,1744],{},"apiTokens.revokeOnReset: false"," to keep them, for example when integrations must not break.",[593,1747,1748,1752,1753,1756,1757,1760,1761,1764,1765,1767,1768,1771,1772,1774],{},[635,1749,1750,622],{},[607,1751,1450],{}," Past a limit the route answers ",[607,1754,1755],{},"429 rate_limited"," with a ",[607,1758,1759],{},"retry-after"," header. The counters\nlive in NuxtHub KV: without ",[607,1762,1763],{},"hub.kv"," nothing is throttled and the build warns. Throttling is off under ",[607,1766,1698],{},". ",[607,1769,1770],{},"0","\nturns one limit off, ",[607,1773,1204],{}," all of them.",[1118,1776,1777,1788],{},[1121,1778,1779],{},[1124,1780,1781,1783,1785],{},[1127,1782,1129],{},[1127,1784,1135],{},[1127,1786,1787],{},"Counts",[1140,1789,1790,1805,1820,1835,1850,1866],{},[1124,1791,1792,1797,1802],{},[1145,1793,1794],{},[607,1795,1796],{},"windowSeconds",[1145,1798,1799],{},[607,1800,1801],{},"900",[1145,1803,1804],{},"The length of the fixed window.",[1124,1806,1807,1812,1817],{},[1145,1808,1809],{},[607,1810,1811],{},"login",[1145,1813,1814],{},[607,1815,1816],{},"10",[1145,1818,1819],{},"Failed password sign-ins per client IP and account.",[1124,1821,1822,1827,1832],{},[1145,1823,1824],{},[607,1825,1826],{},"loginIp",[1145,1828,1829],{},[607,1830,1831],{},"100",[1145,1833,1834],{},"Failed password sign-ins per client IP, for any account.",[1124,1836,1837,1842,1847],{},[1145,1838,1839],{},[607,1840,1841],{},"requests",[1145,1843,1844],{},[607,1845,1846],{},"30",[1145,1848,1849],{},"Requests per client IP to each of register, forgot password, magic link and the passkey options.",[1124,1851,1852,1857,1863],{},[1145,1853,1854],{},[607,1855,1856],{},"ipHeader",[1145,1858,1859,1862],{},[607,1860,1861],{},"cf-connecting-ip"," on Cloudflare",[1145,1864,1865],{},"The header holding the client IP. Otherwise the socket address is used.",[1124,1867,1868,1873,1877],{},[1145,1869,1870],{},[607,1871,1872],{},"xForwardedFor",[1145,1874,1875],{},[607,1876,1204],{},[1145,1878,1879,1880,1883],{},"Read the client IP from ",[607,1881,1882],{},"X-Forwarded-For",". Only behind a proxy that overwrites it.",[593,1885,1886],{},"A sign-in for an unknown account checks a password all the same, so it answers as slowly as a wrong password.",[593,1888,1889,1893,1894,1897],{},[635,1890,1891,622],{},[607,1892,1149],{}," Set it in your app's own ",[607,1895,1896],{},"nuxt.config",". A mode from inline module options or from another module's\ndefault fails the build.",[593,1899,1900,1904,1905,1908,1909,1912],{},[635,1901,1902,622],{},[607,1903,1432],{}," The address is verified through an emailed link. Signing up creates no session. Passkey\nsign-in to an unverified account answers ",[607,1906,1907],{},"403 email_not_verified",", like password sign-in. A passkey proves nothing\nabout the address, so signing up with one is refused (",[607,1910,1911],{},"403 email_verification_required","): sign up with a password or an\nemailed link first, then add the passkey from the account.",[593,1914,1915,770,1919,1921],{},[635,1916,1917,622],{},[607,1918,1468],{},[607,1920,1204],{}," schedules nothing. The task stays registered, so you can run it yourself.",[593,1923,1924,1928,1929,792,1931,1933,1934,1937],{},[635,1925,1926,622],{},[607,1927,1492],{}," With it, the module also registers ",[607,1930,652],{},[607,1932,656],{}," (when\n",[607,1935,1936],{},"passwordReset"," is on). The sign-in page shows only the controls that are on: the password form, passkeys, the emailed\nlink and OAuth buttons.",[593,1939,1940,1944],{},[635,1941,1942,622],{},[607,1943,1514],{}," An absolute URL adds no local page. The sign-in page links to that URL instead.",[593,1946,1947,1951,1952,1955,1956,1959],{},[635,1948,1949,622],{},[607,1950,1553],{}," It applies after every kind of sign-in: password, passkey, emailed link and OAuth provider.\nIt must be an absolute path on this site. A ",[607,1953,1954],{},"?redirect="," on the sign-in page or on ",[607,1957,1958],{},"\u002Fapi\u002Fauth\u002F\u003Cprovider>"," takes\nprecedence.",[593,1961,1962,1966,1967,622],{},[635,1963,1964,622],{},[607,1965,1658],{}," Providers, Sign in with frigear.nu and keeping provider tokens are on\n",[597,1968,187],{"href":188},[811,1970,1972],{"id":1971},"why-the-sign-in-page-opened","Why the sign-in page opened",[593,1974,1975,1976,1978,1979,1982,1983,1985],{},"The sign-in page may be opened with ",[607,1977,1954],{},", for example by the ",[607,1980,1981],{},"redirectTo"," option of\n",[597,1984,199],{"href":200},". It then shows an alert that you have to sign in to continue. After\nsign-in it returns to that page.",[593,1987,1988,1989,1992,1993,653,1996,1999,2000,2003,2004,2007],{},"A page can say why with ",[607,1990,1991],{},"?reason=\u003Cnamespace>",". The alert then reads the i18n keys ",[607,1994,1995],{},"\u003Cnamespace>.signInReason.title",[607,1997,1998],{},"\u003Cnamespace>.signInReason.description",", so each module words its own reason. An example is\n",[607,2001,2002],{},"?reason=users.emailChange",". An unknown reason shows the generic ",[607,2005,2006],{},"auth.signInReason"," text.",[811,2009,2011],{"id":2010},"emailed-links","Emailed links",[593,2013,2014,2015,2018,2019,2022,2023,2025,2026,2028,2029,622],{},"With ",[607,2016,2017],{},"magicLink"," or ",[607,2020,2021],{},"verifyEmail",", the module also registers the ",[607,2024,660],{}," page that the emailed links open.\nIt does so whenever ",[607,2027,640],{}," is installed, with or without ",[607,2030,2031],{},"pages.login",[629,2033,2034,2037,2047,2057],{},[632,2035,2036],{},"Opening the page changes nothing, because mail scanners and link previews follow links too.",[632,2038,2039,2040,2043,2044,622],{},"Its ",[635,2041,2042],{},"Continue signing in"," button posts the code to ",[607,2045,2046],{},"\u002Fapi\u002Fauth\u002Fmagic-link\u002Fconfirm",[632,2048,2049,2050,2053,2054,622],{},"It then goes to the link's ",[607,2051,2052],{},"redirect",", or to ",[607,2055,2056],{},"afterLogin",[632,2058,2059],{},"A used or expired link shows an error on the page.",[593,2061,2062,2063,2065,2066,622],{},"Without ",[607,2064,640],{},", add your own page at that path that posts the ",[607,2067,607],{},[624,2069,2071],{"id":2070},"module-pages","Module pages",[1118,2073,2074,2087],{},[1121,2075,2076],{},[1124,2077,2078,2081,2084],{},[1127,2079,2080],{},"Page",[1127,2082,2083],{},"What it covers",[1127,2085,2086],{},"For",[1140,2088,2089,2101,2113,2124],{},[1124,2090,2091,2095,2098],{},[1145,2092,2093],{},[597,2094,175],{"href":176},[1145,2096,2097],{},"Authorizing routes, defining permissions, roles and scopes, the before hook, API tokens, access tokens and auth emails.",[1145,2099,2100],{},"App developers and module authors, server mode",[1124,2102,2103,2107,2110],{},[1145,2104,2105],{},[597,2106,179],{"href":180},[1145,2108,2109],{},"Composables, hooks, routes, database tables and translations.",[1145,2111,2112],{},"App developers, server mode",[1124,2114,2115,2119,2122],{},[1145,2116,2117],{},[597,2118,187],{"href":188},[1145,2120,2121],{},"Sign-in through GitHub, Google, frigear.nu or any OpenID Connect provider, and kept provider tokens.",[1145,2123,2112],{},[1124,2125,2126,2130,2133],{},[1145,2127,2128],{},[597,2129,183],{"href":184},[1145,2131,2132],{},"Sign-in for an SPA or a Capacitor app at an issuer, with tokens instead of a session.",[1145,2134,2135],{},"App developers, client mode",[624,2137,2139],{"id":2138},"next-steps","Next steps",[629,2141,2142,2147,2155,2161],{},[632,2143,2144,2146],{},[597,2145,482],{"href":483}," – require a signed-in user on a route of your own.",[632,2148,2149,2151,2152,2154],{},[597,2150,175],{"href":176}," – look up ",[607,2153,699],{},", the build APIs and tokens.",[632,2156,2157,2160],{},[597,2158,2159],{"href":68},"Auth and scopes"," – how sessions, API tokens and access tokens differ.",[632,2162,2163,2165],{},[597,2164,187],{"href":188}," – add GitHub, Google or Sign in with frigear.nu.",[2167,2168,2169],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":826,"searchDepth":908,"depth":908,"links":2171},[2172,2173,2178,2182,2183],{"id":626,"depth":908,"text":627},{"id":805,"depth":908,"text":806,"children":2174},[2175,2176,2177],{"id":813,"depth":920,"text":814},{"id":850,"depth":920,"text":851},{"id":1049,"depth":920,"text":1050},{"id":1109,"depth":908,"text":1110,"children":2179},[2180,2181],{"id":1971,"depth":920,"text":1972},{"id":2010,"depth":920,"text":2011},{"id":2070,"depth":908,"text":2071},{"id":2138,"depth":908,"text":2139},"Lets people sign in to your app and tells every server route who is calling and what they may do.","md",null,{},{"title":173},{"title":168,"description":2184},"3chjcX3VlMDqattP7l83PHJ8NK3uyHkTfdvWHFr995o",[2192,2194],{"title":156,"path":158,"stem":162,"description":2193,"children":-1},"Which Frigear module gives your app each feature, what each one does and which others it installs for you.",{"title":175,"path":176,"stem":177,"description":2195,"children":-1},"The server helpers that authorize your routes, define permissions, roles and scopes, and handle tokens and auth emails.",1794503145793]