feat: add auth password-login, pull, and push commands by moranshe-max · Pull Request #422 · base44/cli

moranshe-max · 2026-03-17T07:20:07Z

Note

Description

Adds a new base44 auth command group for managing app authentication configuration. The feature introduces three subcommands (password-login, pull, push) backed by a new auth-config core resource module that handles reading/writing local auth config files and syncing them with the Base44 API. Auth config is also integrated into the existing base44 deploy pipeline so it is pushed automatically alongside entities, functions, agents, and connectors.

Related Issue

None

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Refactoring (no functional changes)
Other (please describe):

Changes Made

New auth command group (packages/cli/src/cli/commands/auth/):
- auth password-login <enable|disable> — toggle username/password authentication in the local auth config file; warns if disabling would leave no login methods enabled
- auth pull — fetch auth config from the Base44 API and write it to the local auth/ directory
- auth push — push the local auth config file to the Base44 API, with an interactive confirmation prompt (skippable via --yes)
- Command group registered as hidden in program.ts
New auth-config core resource (packages/cli/src/core/resources/auth-config/):
- Zod schemas for API response (snake_case → camelCase transform) and local file format
- hasAnyLoginMethod() utility and toAuthConfigPayload() serializer
- Resource<T>-compatible module for unified read/push lifecycle
- Local config read/write with JSON5 support
Deploy integration — authDir added to project config schema (default "auth"), authConfig included in ProjectData, read in parallel during readProjectConfig(), pushed during deployAll(), and shown in the deploy summary
Tests — CLI integration tests for auth password-login and core unit tests covering API pull/push, local file I/O, and schema validation

Testing

I have tested these changes locally
I have added/updated tests as needed
All tests pass (npm test)

Checklist

My code follows the project's style guidelines
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (if applicable)
My changes generate no new warnings
I have updated docs/ (AGENTS.md) if I made architectural changes

Additional Notes

The auth command group is currently hidden from top-level help (registered with { hidden: true }) while the feature is in early rollout. The authDir project config field defaults to "auth" so existing projects don't require any config changes to pick it up.

_{🤖 Generated by Claude | 2026-03-25 10:48 UTC}

github-actions · 2026-03-17T07:20:37Z

🚀 Package Preview Available!

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.0.47-pr.422.8b60a4a

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.0.47-pr.422.8b60a4a"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.0.47-pr.422.8b60a4a"
  }
}

📦 Preview Package: @base44-preview/cli@0.0.47-pr.422.8b60a4a
🔗 View this commit on GitHub

_{Preview published to npm registry — try new features instantly!}

Paveltarno

claude is pretty dumb sometimes

kfirstri · 2026-03-23T14:12:08Z

packages/cli/src/core/resources/auth-config/api.ts

+/**
+ * Returns true if at least one login method is enabled in the given config.
+ */
+export function hasAnyLoginMethod(config: AuthConfig): boolean {


I think this should be in config / schema or somewhere else because it's not really API.ts file

kfirstri · 2026-03-23T14:13:39Z

packages/cli/src/core/resources/auth-config/api.ts

+
+  let response: KyResponse;
+  try {
+    response = await base44Client.get(`api/apps/${id}`);


I wonder if this should really big in project/api.ts file since it's the entire project data.. but maybe it's a future refactor

kfirstri · 2026-03-23T14:17:38Z

packages/cli/src/core/resources/auth-config/config.ts

+ * Reads the auth config file from the given directory.
+ * Returns [config] if the file exists, or [] if the directory or file doesn't exist.
+ */
+export async function readAuthConfig(authDir: string): Promise<AuthConfig[]> {


why are we returning an array of AuthConfig instead just the AuthConfig? is it possible to have multiple AuthConfigs? 🤔

kfirstri · 2026-03-23T14:18:56Z

packages/cli/src/core/resources/auth-config/config.ts

+export async function updateAuthConfigFile(
+  authDir: string,
+  updates: Partial<AuthConfig>,
+): Promise<AuthConfig> {


I wonder if we need a read / write / update functions, maybe just read and write? write will also do updates or updates will happen before calling the config.ts?

kfirstri · 2026-03-23T14:21:11Z

packages/cli/src/core/resources/auth-config/push.ts

+    return;
+  }
+
+  await pushAuthConfigToApi(configs[0]);


I commented it in the config.ts file, can AuthConfig be just singular and not an array? then we don't need to keep putting into an array and out of an array 💪

kfirstri · 2026-03-23T14:29:42Z

packages/cli/src/cli/commands/auth/password-login.ts

+    .option("--enable", "Enable password authentication")
+    .option("--disable", "Disable password authentication")


what do you think about using commander's .choices instead of 2 different flags? and then the command will look like base44 auth password-login enable

// something like .argument('<state>').choices(['enable', 'disable'])

Great tip! Claude claims it's easier for it to consume the cli that way.

kfirstri · 2026-03-23T14:32:07Z

packages/cli/src/cli/commands/auth/password-login.ts

+  const authDir = join(configDir, project.authDir);
+
+  const updated = await runTask(
+    `${shouldEnable ? "Enabling" : "Disabling"} username & password authentication`,


maybe the message should be something like "Updating authenticaiton configuration" or something? so make sure it's only locally

i just saw the outro message, so maybe it's fine

kfirstri · 2026-03-23T14:33:38Z

packages/cli/src/cli/commands/auth/password-login.ts

+      return await updateAuthConfigFile(authDir, {
+        enableUsernamePassword: shouldEnable,
+      });


I also commented baout this inside the updateAuthConfigFile function, i just feel writeAuthConfigFile can do everything?

kfirstri · 2026-03-23T14:34:28Z

packages/cli/src/cli/commands/auth/pull.ts

+
+export function getAuthPullCommand(): Command {
+  return new Base44Command("pull")
+    .description("Pull auth config from Base44 to local file")


Might worth adding some text about overwriting existing file

packages/cli/src/cli/commands/auth/push.ts

kfirstri

Good work 💪, Added some comments

kfirstri · 2026-03-24T14:25:03Z

packages/cli/src/core/project/deploy.ts

    onResult: options?.onFunctionResult,
  });
  await agentResource.push(agents);
+  if (authConfig) {


You should have a resource.ts file inside resources/auth-config/resource.ts with the "readAll" and "push" command configured, this is basically our interface for resourced, i don't want deploy.ts to be too familiar with resources implementation

move the if(authConfig) check to be inside the resource push function, like all other resourced do

kfirstri

one small change about adding a resource.ts to the auth-config, and then call the push method from deploy.ts.

kfirstri

🚀

Add `base44 auth password-login` command for enabling/disabling username & password authentication. Introduces the `auth` command group and the core `auth-config` module with Zod schemas, API client, and camelCase transforms. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Remove interactive prompts in favor of explicit --enable and --disable flags. Add comprehensive input validation with agent-friendly error hints. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Migrate auth-config from standalone core module to the unified resources pattern. Add `auth pull` and `auth push` CLI commands for syncing auth configuration. Extend project config and deploy to support auth-config as a deployable resource. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace removed runCommand/RunCommandResult imports with Base44Command and import RunCommandResult from @/cli/types.js to match the new command pattern introduced on main. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Move hasAnyLoginMethod from api.ts to schema.ts (not an API concern) - Use singular AuthConfig | null instead of AuthConfig[] everywhere - Remove Resource<T> adapter (resource.ts) — call readAuthConfig/pushAuthConfig directly - Remove updateAuthConfigFile — inline read-merge-write in password-login command - Switch password-login from --enable/--disable flags to positional argument (enable|disable) - Update task spinner message to "Updating local auth config" - Add overwrite warning to auth pull outro message - Add confirmation prompt and lockout warning to auth push (with --yes flag) - Update tests for new signatures and positional arg syntax Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ace in deploy Move auth-config back to the standard Resource<T> pattern so deploy.ts doesn't need to know about the resource's internal null-vs-array semantics. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Update password-login, pull, and push commands to receive CLIContext as the first argument, matching the refactored Base44Command pattern. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

moranshe-max requested a review from kfirstri March 17, 2026 09:05

moranshe-max force-pushed the feature/add-password-login-command branch from 53d8672 to 60fd351 Compare March 17, 2026 11:52

kfirstri added this to CLI Development Mar 18, 2026

github-project-automation bot moved this to Backlog in CLI Development Mar 18, 2026

kfirstri moved this from Backlog to In review in CLI Development Mar 18, 2026

Paveltarno reviewed Mar 18, 2026

View reviewed changes

moranshe-max changed the title ~~feat: add auth password-login command~~ feat: add auth password-login, pull, and push commands Mar 22, 2026

moranshe-max force-pushed the feature/add-password-login-command branch from 837aaa9 to 3cd3e7a Compare March 22, 2026 12:40

moranshe-max requested a review from Paveltarno March 22, 2026 13:30

kfirstri reviewed Mar 23, 2026

View reviewed changes

packages/cli/src/cli/commands/auth/push.ts Show resolved Hide resolved

kfirstri reviewed Mar 23, 2026

View reviewed changes

moranshe-max force-pushed the feature/add-password-login-command branch from fdced31 to 2916115 Compare March 23, 2026 19:26

kfirstri reviewed Mar 24, 2026

View reviewed changes

kfirstri requested changes Mar 24, 2026

View reviewed changes

github-project-automation bot moved this from In review to Ready in CLI Development Mar 24, 2026

kfirstri previously approved these changes Mar 24, 2026

View reviewed changes

github-project-automation bot moved this from Ready to In review in CLI Development Mar 24, 2026

moranshe-max and others added 3 commits March 24, 2026 20:02

feat: make password-login non-interactive with --enable/--disable flags

243fb9d

Remove interactive prompts in favor of explicit --enable and --disable flags. Add comprehensive input validation with agent-friendly error hints. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

moranshe-max and others added 4 commits March 24, 2026 20:02

fix: adapt auth commands to new CLIContext action signature

6d96b8e

Update password-login, pull, and push commands to receive CLIContext as the first argument, matching the refactored Base44Command pattern. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

moranshe-max dismissed kfirstri’s stale review via 6d96b8e March 24, 2026 18:04

moranshe-max force-pushed the feature/add-password-login-command branch from 05e3522 to 6d96b8e Compare March 24, 2026 18:04

kfirstri previously approved these changes Mar 25, 2026

View reviewed changes

chore: hide auth command from top-level help

963f62f

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

moranshe-max dismissed kfirstri’s stale review via 963f62f March 25, 2026 10:48

kfirstri approved these changes Mar 25, 2026

View reviewed changes

moranshe-max merged commit 550b3cc into main Mar 25, 2026
10 checks passed

moranshe-max deleted the feature/add-password-login-command branch March 25, 2026 11:45

github-project-automation bot moved this from In review to Done in CLI Development Mar 25, 2026

		.option("--enable", "Enable password authentication")
		.option("--disable", "Disable password authentication")

Conversation

moranshe-max commented Mar 17, 2026 • edited by claude bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Type of Change

Changes Made

Testing

Checklist

Additional Notes

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Package Preview Available!

Uh oh!

Paveltarno left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kfirstri Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kfirstri left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kfirstri left a comment

Choose a reason for hiding this comment

Uh oh!

kfirstri left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

moranshe-max commented Mar 17, 2026 •

edited by claude bot

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

Paveltarno left a comment •

edited

Loading

kfirstri Mar 23, 2026 •

edited

Loading