Auth and registration for local dev by artemdemo · Pull Request #475 · base44/cli

artemdemo · 2026-04-12T12:22:36Z

Note

Description

Adds a local authentication router to the base44 dev server, enabling developers to test registration, OTP verification, and login flows locally without hitting the production API. The auth router issues JWT tokens signed with a local secret and stores user credentials in a private in-memory NeDB collection, keeping sensitive data (passwords, OTP codes) separate from the public User collection. A dedicated entities-user-router is also introduced to give the User entity special handling (auth-gated reads/writes, restricted fields, role-based access) that mirrors production behavior.

Related Issue

None

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Refactoring (no functional changes)
Other (please describe):

Changes Made

routes/auth-router.ts (new): Express router mounted at /api/apps/:appId/auth with three endpoints — POST /login, POST /register (generates a 6-digit OTP printed to the dev-server log), and POST /verify-otp (completes registration and issues a JWT)
routes/entities/entities-user-router.ts (new): Auth-gated CRUD router for the User entity; admins can list all users, regular users only see themselves; restricted fields (full_name, email, role) cannot be updated via the entities API, matching production behavior
db/entity-queries.ts (new): Extracted queryEntity helper supporting sort, limit, skip, fields, and q (JSON query) parameters — shared by the entity router and user router
db/database.ts: Added PRIVATE_USER_COLLECTION ($user) for storing passwords and OTP codes out of reach of public API clients
dev-server/main.ts: Registered the new authRouter and wired in the entities-user-router via the entity routes
package.json / bun.lock: Moved jsonwebtoken + @types/jsonwebtoken from the root workspace to packages/cli (where they are actually used); added qs for typed query-string parsing
tests/cli/dev-auth.spec.ts (new): Integration test covering the full register → OTP verify → login flow
Version bump: 0.0.47 → 0.0.50

Testing

I have tested these changes locally
I have added/updated tests as needed
All tests pass (npm test)

Checklist

My code follows the project's style guidelines
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (if applicable)
My changes generate no new warnings
I have updated docs/ (AGENTS.md) if I made architectural changes

Additional Notes

The OTP code is intentionally printed to the dev-server log (via devLogger) rather than sent by email, since local development has no email delivery. The JWT is signed with the hard-coded constant LOCAL_DEV_SECRET — this is intentional and safe for local-only use. Auth routes that involve OAuth redirects (/api/apps/auth/…) are still redirected to base44.app via the existing proxy redirect middleware.

_{🤖 Generated by Claude | 2026-04-14 08:44 UTC | 3ca36bb}

github-actions · 2026-04-12T12:24:20Z

🚀 Package Preview Available!

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.0.50-pr.475.3ca36bb

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.0.50-pr.475.3ca36bb"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.0.50-pr.475.3ca36bb"
  }
}

📦 Preview Package: @base44-preview/cli@0.0.50-pr.475.3ca36bb
🔗 View this commit on GitHub

_{Preview published to npm registry — try new features instantly!}

artemdemo · 2026-04-12T13:06:11Z

@claude review

artemdemo · 2026-04-13T06:46:37Z

packages/cli/package.json

-    "engines": {
-        "node": ">=20.19.0"
-    }
+  "name": "base44",


just formatting - replaced 4 spaces with 2

artemdemo · 2026-04-13T06:47:12Z

package.json

  "scripts": {
    "lint": "biome check packages/*/src packages/*/tests",
    "lint:fix": "biome check --write packages/*/src packages/*/tests",
+    "typecheck": "bun --workspaces --if-present --sequential run typecheck",


This allows to run bun run typecheck from the root of the project

artemdemo · 2026-04-13T07:39:48Z

@claude review

artemdemo · 2026-04-13T12:47:51Z

packages/cli/src/cli/dev/dev-server/db/entity-queries.ts

+  return Object.keys(projection).length > 0 ? projection : undefined;
+}
+
+export const queryEntity = async (


Moved this logic from entities-router.ts‎
So I can share it.

artemdemo · 2026-04-14T08:35:46Z

packages/cli/tests/cli/dev.spec.ts

+      join(
+        t.getTempDir(),
+        "project",
+        "base44",
+        "functions",
+        "hello",
+        "index.ts",
+      ),


No related to PR, fixing windows thingy

artemdemo · 2026-04-14T08:35:55Z

packages/cli/src/cli/dev/dev-server/function-manager.ts

      env: {
        ...globalThis.process.env,
-        FUNCTION_PATH: func.entryPath,
+        FUNCTION_PATH: pathToFileURL(func.entryPath).href,


No related to PR, fixing windows thingy

artemdemo force-pushed the auth-and-stuff branch 2 times, most recently from f104342 to 795a527 Compare April 12, 2026 13:05

base44 deleted a comment from claude bot Apr 12, 2026

artemdemo commented Apr 13, 2026

View reviewed changes

base44 deleted a comment from claude bot Apr 13, 2026

artemdemo force-pushed the auth-and-stuff branch from 4da5171 to 76fd3cb Compare April 13, 2026 10:30

base44 deleted a comment from claude bot Apr 13, 2026

artemdemo force-pushed the auth-and-stuff branch from 5254e7a to e8c7ae7 Compare April 13, 2026 11:27

artemdemo commented Apr 13, 2026

View reviewed changes

artemdemo marked this pull request as ready for review April 13, 2026 12:48

artemdemo changed the title ~~Auth and stuff~~ Auth and registration for local dev Apr 13, 2026

artemdemo force-pushed the auth-and-stuff branch from e8c7ae7 to d87fe51 Compare April 13, 2026 13:00

artemdemo commented Apr 14, 2026

View reviewed changes

Auth Router

a44a76a

artemdemo force-pushed the auth-and-stuff branch from be32076 to a44a76a Compare April 14, 2026 08:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Auth and registration for local dev#475

Auth and registration for local dev#475
artemdemo wants to merge 1 commit intomainfrom
auth-and-stuff

artemdemo commented Apr 12, 2026 •

edited by claude bot

Loading

Uh oh!

github-actions bot commented Apr 12, 2026 •

edited

Loading

Uh oh!

artemdemo commented Apr 12, 2026

Uh oh!

artemdemo Apr 13, 2026

Uh oh!

artemdemo Apr 13, 2026

Uh oh!

artemdemo commented Apr 13, 2026

Uh oh!

artemdemo Apr 13, 2026

Uh oh!

artemdemo Apr 14, 2026

Uh oh!

artemdemo Apr 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

artemdemo commented Apr 12, 2026 • edited by claude bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Type of Change

Changes Made

Testing

Checklist

Additional Notes

Uh oh!

github-actions bot commented Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Package Preview Available!

Uh oh!

artemdemo commented Apr 12, 2026

Uh oh!

artemdemo Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

artemdemo Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

artemdemo commented Apr 13, 2026

Uh oh!

artemdemo Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

artemdemo Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

artemdemo Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

artemdemo commented Apr 12, 2026 •

edited by claude bot

Loading

github-actions bot commented Apr 12, 2026 •

edited

Loading