{"locator":"npm:@fullstackhouse/open-mercato-demo-auth","path":"@fullstackhouse/open-mercato-demo-auth","npm":"@fullstackhouse/open-mercato-demo-auth","github":"fullstackhouse/open-mercato-demo-auth","repoPath":null,"kind":"tool","type":"community","enterprise":false,"title":"Demo Auth","summary":"Dev-only widget that fills in and submits the login form from server env vars on dev and preview deployments.","whenToUse":"Use when a team signs in to dev or preview deployments many times a day and one image runs in every environment.","whenNotToUse":"Never set its env vars in production: leaving them unset is the only safety gate.","category":"devtools","tags":["dev-only","login","preview"],"providers":[],"moduleIds":[],"requires":[],"replaces":[],"slotConflicts":[],"renamedFrom":[],"supersededBy":null,"alternatives":[],"status":"active","listed":true,"featured":false,"license":{"spdx":"MIT","kind":"osi","mismatch":false},"version":{"latest":"0.3.0","preview":null,"publishedAt":"2026-04-24","integrity":"sha512-zd/Vpku6s92nLkxXwCpHHGQ0oY5LS0r+LQZTDKPYiW2f8PaAqNvaEqpDP1RI+RyrKtcN30TjNUCfHYUZ752RJw==","installableFrom":"2026-04-29","gitRef":"263ef0bed81d1c62ce3d0dfd6160228c855df543","recommended":{"0.9":null,"0.8":null,"next":null}},"identity":{"builtFrom":"verified","claimed":false,"source":"npm"},"compat":{"builtFor":{"range":null,"kind":"missing","lines":[]},"lines":{},"verifiedOn":[]},"anatomy":{"version":"0.3.0","coverage":"partial","counts":{"entities":0,"tables":0,"migrations":0,"routes":0,"publicRoutes":0,"aclFeatures":0,"eventsEmitted":0,"eventsConsumed":0,"backendPages":0,"frontendPages":0,"widgets":0,"workers":0,"cli":0,"aiTools":0,"aiAgents":0,"extends":0},"lists":{"aclFeatures":[],"eventsEmitted":[],"eventsConsumed":[],"env":[],"hosts":[],"tables":[],"publicRoutes":[],"credentials":[]},"callout":"FEW CONTRACTS","diff":{"from":"0.2.1","added":{"tables":0,"routes":0,"publicRoutes":0,"aclFeatures":0,"env":[],"hosts":[]},"removed":{"tables":0,"routes":0,"aclFeatures":0}}},"signals":{"receipt":{"0.9":"skipped","0.8":"skipped","next":"skipped"},"fit":{"0.9":"ok","0.8":"ok","next":"ok"},"anatomy":"partial","supplyChain":{"status":"ok","reasons":[]},"hygiene":{"status":"ok","failing":[]},"maintenance":{"status":"behind","lastRelease":"2026-04-24","catchUpDays":null},"declaredVsObserved":{"status":"match","notes":[]}},"tier":"listed","quality":null,"agentPolicy":{"0.9":{"decision":"ask","reasons":[{"code":"THIRD_PARTY","text":"Third-party code runs with access to all tenants' data."},{"code":"NOT_VERIFIED","text":"Not installed by the catalog: the nightly run installs modules, not tools."}],"consentText":"Install @fullstackhouse/open-mercato-demo-auth@0.3.0"},"0.8":{"decision":"ask","reasons":[{"code":"THIRD_PARTY","text":"Third-party code runs with access to all tenants' data."},{"code":"NOT_VERIFIED","text":"Not installed by the catalog: the nightly run installs modules, not tools."}],"consentText":"Install @fullstackhouse/open-mercato-demo-auth@0.3.0"},"next":{"decision":"ask","reasons":[{"code":"THIRD_PARTY","text":"Third-party code runs with access to all tenants' data."},{"code":"NOT_VERIFIED","text":"Not installed by the catalog: the nightly run installs modules, not tools."}],"consentText":"Install @fullstackhouse/open-mercato-demo-auth@0.3.0"}},"install":{"cli":"yarn add @fullstackhouse/open-mercato-demo-auth@0.3.0","cmm":null,"needsAllowThirdParty":false,"moduleFlag":null},"stats":{"downloads30d":817,"stars":0},"sigil":{"glyph":"0000000","phase":288,"publicRoutes":false},"links":{"page":"https://modules.openmercato.com/m/@fullstackhouse/open-mercato-demo-auth","md":"https://modules.openmercato.com/m/@fullstackhouse/open-mercato-demo-auth.md","json":"https://modules.openmercato.com/m/@fullstackhouse/open-mercato-demo-auth.json","facts":"https://modules.openmercato.com/m/@fullstackhouse/open-mercato-demo-auth/v/0.3.0/facts.json","npm":"https://www.npmjs.com/package/@fullstackhouse/open-mercato-demo-auth","repo":"https://github.com/fullstackhouse/open-mercato-demo-auth","docs":null},"addedAt":"2026-10-23","updatedAt":"2026-10-25T17:33:15Z","_meta":{"com.openmercato.modules/installable":{"0.9":"0.3.0","0.8":"0.3.0","next":"0.3.0"}},"facts":{"factsVersion":1,"extractor":{"engine":"@open-mercato/cli@0.9.0 extractModuleFacts","factsContractVersion":2,"catalog":"om-modules rentgen 1","durationMs":2},"package":{"locator":"npm:@fullstackhouse/open-mercato-demo-auth","name":"@fullstackhouse/open-mercato-demo-auth","version":"0.3.0","integrity":"sha512-zd/Vpku6s92nLkxXwCpHHGQ0oY5LS0r+LQZTDKPYiW2f8PaAqNvaEqpDP1RI+RyrKtcN30TjNUCfHYUZ752RJw==","source":"npm-tarball","gitRef":"263ef0bed81d1c62ce3d0dfd6160228c855df543"},"gate":{"installable":false,"needsModuleFlag":false,"reason":"Package has no src/modules and dist/modules pair.","modules":[]},"kind":"tool","license":{"value":"MIT","kind":"osi","mismatch":false,"sources":{"packageJson":"MIT","licenseFile":"MIT","moduleInfo":null,"integrationTs":null}},"omPeers":{},"dependencies":{},"agentsMd":false,"readmeExcerpt":"# @fullstackhouse/open-mercato-demo-auth\n\nAuto-fill and auto-submit the login form on your dev and preview deployments so you don't have to retype `admin / secret` a hundred times a day.\n\n> **Dev only.** The server reads `DEMO_AUTH_LOGIN_EMAIL` / `DEMO_AUTH_LOGIN_PASSWORD` at request time and inlines them into the HTML. **Leave both unset in production** — that's the only safety gate, and it's by design.\n\n## Install\n\n```bash\nnpm install --save-dev @fullstackhouse/open-mercato-demo-auth\n# or\nyarn add -D @fullstackhouse/open-mercato-demo-auth\n```\n\n## Usage\n\nDrop both components into your root layout. The server component injects the credentials into the HTML; the client component watches for the login form, fills it in, and submits it:\n\n```tsx\n// app/layout.tsx\nimport { DemoAuthScript, DemoAuthAutofill } from '@fullstackhouse/open-mercato-demo-auth'\n\nexport default function RootLayout({ children }: { children: React.ReactNode }) {\n  return (\n    <html>\n      <head>\n        <DemoAuthScript />\n      </head>\n      <body>\n        <DemoAuthAutofill />\n        {children}\n      </body>\n    </html>\n  )\n}\n```\n\nBoth components short-circuit to nothing when the env vars aren't set, so they're safe to always mount.\n\n## Env vars\n\n```bash\nDEMO_AUTH_LOGIN_EMAIL=admin@acme.com\nDEMO_AUTH_LOGIN_PASSWORD=secret\n```\n\n- With **both** set, the form auto-fills and auto-submits.\n- With **only the email** set, just the email field is prefilled — no submit.\n- With **neither** set, nothing runs. Use this on prod.\n\n## Kubernetes example\n\nPut the two keys in the dev/preview ConfigMap and leave them out of prod:\n\n```yaml\n# configmap-dev.yaml\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: my-app-config\ndata:\n  DEMO_AUTH_LOGIN_EMAIL: admin@acme.com\n  DEMO_AUTH_LOGIN_PASSWORD: secret\n  # ... other env vars\n```\n\n```yaml\n# configmap-prod.yaml — same ConfigMap, without the two demo keys\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: my-app-config\ndata:\n  # ... other env vars, no DEMO_AUTH_* here\n```\n\n## Why not `NEXT_PUBLIC_*`?\n\n`NEXT_PUBLIC_*` values are inlined into the client bundle at build time. If you ship a single Docker image across dev/preview/prod — the common pattern — any value you bake in for dev leaks to prod. This package reads ordinary server-side env vars at request time and writes them into the HTML that's served, so one image + per-environment ConfigMaps gives you per-environment behavior.\n\n## Form shape it targets\n\n`DemoAuthAutofill` looks for:\n\n```html\n<form data-auth-ready=\"1\">\n  <input name=\"email\" />\n  <input name=\"password\" />\n</form>\n```\n\nOpen Mercato's core login form already exposes `data-auth-ready=\"1\"` once hydrated; this package was designed against that, but any form following the same convention works.\n\n## Security\n\n- The JSON payload is HTML-escaped (`<`, `>`, `&`, U+2028, U+2029) before being inlined into the `<script>` tag. Injection-hardened against adversarial values, but **don't pipe untrusted input into these env vars** — they execute on every page load.\n- There is deliberately no `NODE_ENV === 'production'` kill-switch. Many setups (including Open Mercato) set `NODE_ENV=production` on every environment, which would defeat the purpose. **Keep prod safe by leaving the env vars unset there** — the server component emits nothing and the client component short-circuits.\n- Zero runtime dependencies.\n\n## Migrating from 0.2.x\n\n1. Delete any `src/modules/demo_auth/` re-export shim you created.\n2. Remove `{ id: 'demo_auth', from: '@app' | '@fullstackhouse/open-mercato-demo-auth' }` from `src/modules.ts`.\n3. Add `<DemoAuthAutofill />` to your root layout next to `<DemoAuthScript />`.\n\nThe env-var names (`DEMO_AUTH_LOGIN_EMAIL` / `DEMO_AUTH_LOGIN_PASSWORD`) are unchanged.\n\n## Peer dependencies\n\n- `react >= 18`\n- `react-dom >= 18`\n\n## License\n\nMIT — Full Stack House.\n","modules":[],"coverage":{"routesAuthResolved":1,"integrationTs":"absent"},"diagnostics":[]},"receipts":[],"rules":[{"id":"LST-1","pass":true,"detail":"Descriptor is valid."},{"id":"LST-2","pass":true,"detail":"Stable version exists and is not deprecated."},{"id":"LST-3","pass":true,"detail":"Kind tool read from package.json."},{"id":"LST-4","pass":true,"detail":"License: MIT."},{"id":"LST-5","pass":true,"detail":"No known malware or open critical advisory."},{"id":"LST-6","pass":true,"detail":"Name reviewed at merge."},{"id":"VER-1","pass":false,"detail":"Receipt on 0.9: skipped."},{"id":"VER-2","pass":true,"detail":"Fits statically on 0.9: ok."},{"id":"VER-3","pass":true,"detail":"Supply chain: ok."},{"id":"VER-4","pass":true,"detail":"No lint errors."},{"id":"VER-5","pass":true,"detail":"Tarball repository.url matches the descriptor."}],"maintainers":["jtomaszewski"]}