@pelygo/auth

@pelygo/auth

Sign-in, the signed-in user, and the chosen client for VCOMSUITE apps, in Vue 3 or React. Every Vcomsuite app uses it, so sign-in and client choice work the same everywhere.

Start here

All of these ship inside the package too, under node_modules/@pelygo/auth/. The code in dist/ is readable and has a comment on every export.

Install

npm install @pelygo/auth

Vue apps also need vue 3, pinia 2 or 3 and vue-router 4. React apps need react 18 or 19. These are optional peer dependencies: install the ones your app uses.

Quick start (Vue)

// src/stores/auth.ts
import { createAuthStore } from '@pelygo/auth/vue';

export const useAuthStore = createAuthStore();

// src/main.ts
import { createApp } from 'vue';
import { createPinia } from 'pinia';
import { configure } from '@pelygo/auth/core';
import { authPlugin } from '@pelygo/auth/vue';
import App from './App.vue';
import router from './router';
import { useAuthStore } from './stores/auth';

configure({
  apiBaseUrl: import.meta.env.VITE_JANUS_API_URL,
  authBaseUrl: import.meta.env.VITE_AUTH_BASE_URL,
});

createApp(App).use(createPinia()).use(authPlugin, { store: useAuthStore }).use(router).mount('#app');

Then protect routes with createAuthGuard({ getAuthStore: () => useAuthStore() }) and route meta (isLoginPage, requiresAuth, requiresClient, adminOnly), and use the ready-made LoginForm and SelectClientForm. The full setup is in docs/ai/recipes/vue/01-setup.md. For React, see docs/ai/recipes/react/01-setup.md.

How it works, in brief

• Two ways to sign in. On the Vcomsuite hub's addresses (vcomsuite.io, dev., staging., demo.vcomsuite.io) people sign in once at the hub, and every app on that address shares the sign-in. Anywhere else (your own computer, hosted previews) the app shows its own login form, which signs in against the same real sign-in server.
• Clients. A client is the customer account someone is working on. Admins may open any client; other users pick from their own list, and a user with exactly one client gets it automatically. The choice is kept per browser tab.
• API calls. createAuthApi() (or the Vue store's getApi()) adds the sign-in token to each request and handles an expired session: it signs the person out, tells them, and sends them to sign in.
• Sign-out ends the session for every app on the same address, in every tab. The package only removes its own stored data; the app's own data is left alone.
• Admin is the only role the package knows, and it's for showing and hiding things. The API must check permissions.

Details: docs/ai/storage-and-sso.md.

Entry points

Changes

See CHANGELOG.md. 1.2.0 changes some behaviour (hub sign-in on Vcomsuite, what sign-out clears, sign-in error messages); read its "check before upgrading" list.

License

Proprietary. Licensed exclusively for use in authorised VCOMSUITE applications. See LICENSE for details.