feat(database): add signUp and changePassword to auth-js and server-js - #206
Merged
Conversation
2 tasks
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds database signup and password-change support to auth-js and server-js, wires it into ChangesDatabase client feature
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
3 tasks
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/auth0-auth-js/src/database/database-client.ts (1)
20-26: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winUnwrapped
response.json()can leak a non-SignUpErrorrejection.On a 2xx response with an empty or non-JSON body, Line 24 throws a raw
SyntaxError, bypassing the typedSignUpErrorcontract that#postotherwise guarantees. Consider wrapping the parse so callers always get aSignUpError.♻️ Proposed guard
const response = await this.#post('/dbconnections/signup', body, SignUpError, 'Failed to sign up'); - const raw = (await response.json()) as Record<string, unknown>; - return normalizeSignUpResult(raw); + let raw: Record<string, unknown>; + try { + raw = (await response.json()) as Record<string, unknown>; + } catch { + throw new SignUpError('Failed to sign up: invalid response body.'); + } + return normalizeSignUpResult(raw);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/auth0-auth-js/src/database/database-client.ts` around lines 20 - 26, The sign-up flow in database-client’s signUp method can leak a raw SyntaxError from response.json() instead of the expected SignUpError. Wrap the JSON parsing and normalize any parse failure into SignUpError, keeping the typed error contract consistent with `#post` and the existing signUp/normalizeSignUpResult path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/auth0-auth-js/src/database/database-client.ts`:
- Around line 20-26: The sign-up flow in database-client’s signUp method can
leak a raw SyntaxError from response.json() instead of the expected SignUpError.
Wrap the JSON parsing and normalize any parse failure into SignUpError, keeping
the typed error contract consistent with `#post` and the existing
signUp/normalizeSignUpResult path.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8096c958-4249-4ca4-beef-804d669f25b4
📒 Files selected for processing (15)
packages/auth0-auth-js/src/auth-client.spec.tspackages/auth0-auth-js/src/auth-client.tspackages/auth0-auth-js/src/database/database-client.spec.tspackages/auth0-auth-js/src/database/database-client.tspackages/auth0-auth-js/src/database/errors.spec.tspackages/auth0-auth-js/src/database/errors.tspackages/auth0-auth-js/src/database/index.tspackages/auth0-auth-js/src/database/types.tspackages/auth0-auth-js/src/database/utils.spec.tspackages/auth0-auth-js/src/database/utils.tspackages/auth0-auth-js/src/index.tspackages/auth0-server-js/src/index.tspackages/auth0-server-js/src/server-client.spec.tspackages/auth0-server-js/src/server-client.tspackages/auth0-server-js/src/types.ts
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/auth0-server-js/src/server-client.ts (1)
139-153: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winDuplicate domain-resolution logic between
databasegetter and top-levelsignUp/changePassword.
ServerDatabaseClient.signUp/changePassword(wired at Line 217-220) already implementresolveDomain→getAuthClient(domain).database.*. The newsignUp/changePasswordmethods at Lines 1174-1177 and 1189-1192 re-implement the exact same two lines instead of delegating tothis.#databaseClient. If the domain-resolution or error-wrapping logic inServerDatabaseClientchanges later, these two entry points can silently diverge.♻️ Delegate to the existing sub-client
public async signUp(options: SignUpOptions, storeOptions?: TStoreOptions): Promise<SignUpResult> { - const domain = await this.#resolveDomain(storeOptions); - return this.#getAuthClient(domain).database.signUp(options); + return this.#databaseClient.signUp(options, storeOptions); }public async changePassword(options: ChangePasswordOptions, storeOptions?: TStoreOptions): Promise<string> { - const domain = await this.#resolveDomain(storeOptions); - return this.#getAuthClient(domain).database.changePassword(options); + return this.#databaseClient.changePassword(options, storeOptions); }Also applies to: 1163-1192
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/auth0-server-js/src/server-client.ts` around lines 139 - 153, The top-level signUp and changePassword methods duplicate the domain-resolution and Auth0 call logic already handled by ServerDatabaseClient. Update ServerClient to delegate those methods to this.#databaseClient.signUp and this.#databaseClient.changePassword instead of reimplementing resolveDomain/getAuthClient(domain).database.* so the shared ServerDatabaseClient behavior stays consistent.
🧹 Nitpick comments (1)
examples/database-conns/src/index.ts (1)
5-6: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueMissing Helmet security headers.
Static analysis flags the Express app for lacking Helmet. Low risk for a local example, but since example code is often copy-pasted into real projects, adding it costs little.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@examples/database-conns/src/index.ts` around lines 5 - 6, The Express app setup in the app initialization block is missing Helmet security headers. Add Helmet middleware alongside the existing express.json() middleware by importing helmet and registering it on the Express instance early in the setup so copied example code includes basic security hardening.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/auth0-server-js/src/server-client.ts`:
- Around line 139-153: The top-level signUp and changePassword methods duplicate
the domain-resolution and Auth0 call logic already handled by
ServerDatabaseClient. Update ServerClient to delegate those methods to
this.#databaseClient.signUp and this.#databaseClient.changePassword instead of
reimplementing resolveDomain/getAuthClient(domain).database.* so the shared
ServerDatabaseClient behavior stays consistent.
---
Nitpick comments:
In `@examples/database-conns/src/index.ts`:
- Around line 5-6: The Express app setup in the app initialization block is
missing Helmet security headers. Add Helmet middleware alongside the existing
express.json() middleware by importing helmet and registering it on the Express
instance early in the setup so copied example code includes basic security
hardening.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 70e81f4d-980d-4e5f-a40e-16e4e39de081
📒 Files selected for processing (7)
examples/database-conns/.env.exampleexamples/database-conns/README.mdexamples/database-conns/package.jsonexamples/database-conns/src/auth0.tsexamples/database-conns/src/index.tsexamples/database-conns/tsconfig.jsonpackages/auth0-server-js/src/server-client.ts
✅ Files skipped from review due to trivial changes (3)
- examples/database-conns/tsconfig.json
- examples/database-conns/src/auth0.ts
- examples/database-conns/README.md
Replace flat serverClient.signUp/changePassword with serverClient.database.* (new ServerDatabaseClient), matching the mfa/passkey sub-client pattern and the auth0-auth-js authClient.database surface. Disambiguates that these operate on database connections.
Accept either email or username on changePassword (username-only DB connections); require at least one and forward both on the wire when present. Widen SignUpResult.userMetadata to Record<string, unknown> since server output may be non-string, and note deferred phone_number signUp support behind the fuji connection-attribute feature flag. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…nge-password Signed re-add of the database-conns example that previously entered the branch via an unsigned upstream merge lineage. Content matches the validated PR tree.
tusharpandey13
force-pushed
the
feat/database-conns-impl
branch
from
July 8, 2026 12:03
372263c to
0fc6203
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@examples/database-conns/src/index.ts`:
- Around line 27-29: The change-password route is passing req.body.email
directly into auth0.database.changePassword without validating it first, which
can lead to a confusing SDK error. Update the /change-password handler in the
app.post callback to check for a present email before calling
auth0.database.changePassword, and return a clear client error response when it
is missing, following the same validation pattern used in the /signup flow.
- Around line 9-15: Add a minimal request-body guard before calling the SDK in
the /signup and /change-password handlers so missing email or password returns a
clear 400 response instead of an opaque SDK failure. Update the route handlers
in index.ts around auth0.database.signUp and auth0.database.changePassword to
validate req.body.email and req.body.password first, and short-circuit with a
simple client error response if either value is absent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: dfe3e772-7c3a-40c1-ba09-5c37e8821dfb
📒 Files selected for processing (25)
examples/database-conns/.env.exampleexamples/database-conns/README.mdexamples/database-conns/package.jsonexamples/database-conns/src/auth0.tsexamples/database-conns/src/index.tsexamples/database-conns/tsconfig.jsonpackages/auth0-auth-js/src/auth-client.spec.tspackages/auth0-auth-js/src/auth-client.tspackages/auth0-auth-js/src/database/database-client.spec.tspackages/auth0-auth-js/src/database/database-client.tspackages/auth0-auth-js/src/database/errors.spec.tspackages/auth0-auth-js/src/database/errors.tspackages/auth0-auth-js/src/database/index.tspackages/auth0-auth-js/src/database/types.tspackages/auth0-auth-js/src/database/utils.spec.tspackages/auth0-auth-js/src/database/utils.tspackages/auth0-auth-js/src/index.tspackages/auth0-server-js/src/database/index.tspackages/auth0-server-js/src/database/server-database-client.spec.tspackages/auth0-server-js/src/database/server-database-client.tspackages/auth0-server-js/src/database/types.tspackages/auth0-server-js/src/index.tspackages/auth0-server-js/src/server-client.spec.tspackages/auth0-server-js/src/server-client.tspackages/auth0-server-js/src/types.ts
✅ Files skipped from review due to trivial changes (5)
- examples/database-conns/package.json
- packages/auth0-server-js/src/index.ts
- examples/database-conns/README.md
- examples/database-conns/tsconfig.json
- packages/auth0-auth-js/src/database/types.ts
🚧 Files skipped from review as they are similar to previous changes (17)
- packages/auth0-auth-js/src/database/index.ts
- packages/auth0-server-js/src/database/types.ts
- packages/auth0-auth-js/src/index.ts
- packages/auth0-auth-js/src/auth-client.spec.ts
- packages/auth0-server-js/src/database/server-database-client.spec.ts
- packages/auth0-server-js/src/types.ts
- packages/auth0-auth-js/src/database/errors.spec.ts
- examples/database-conns/src/auth0.ts
- packages/auth0-auth-js/src/auth-client.ts
- packages/auth0-auth-js/src/database/utils.spec.ts
- packages/auth0-server-js/src/server-client.ts
- packages/auth0-server-js/src/database/server-database-client.ts
- packages/auth0-auth-js/src/database/utils.ts
- packages/auth0-server-js/src/server-client.spec.ts
- packages/auth0-server-js/src/database/index.ts
- packages/auth0-auth-js/src/database/database-client.ts
- packages/auth0-auth-js/src/database/database-client.spec.ts
Comment on lines
+9
to
+15
| app.post('/signup', async (req, res) => { | ||
| try { | ||
| const result = await auth0.database.signUp({ | ||
| email: req.body.email, | ||
| password: req.body.password, | ||
| connection, | ||
| }); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Add basic input validation before calling the SDK.
Both /signup and /change-password pass req.body.email (and req.body.password) directly to the SDK without checking for presence. If either is undefined, the SDK call will fail with an opaque error rather than a clear 400 response. Since this is an example app that users may copy as a starting pattern, adding a minimal guard improves the pattern being set.
💚 Proposed validation guard
app.post('/signup', async (req, res) => {
+ const { email, password } = req.body;
+ if (!email || !password) {
+ return res.status(400).json({ ok: false, message: 'email and password are required' });
+ }
try {
const result = await auth0.database.signUp({
- email: req.body.email,
- password: req.body.password,
+ email,
+ password,
connection,
});📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| app.post('/signup', async (req, res) => { | |
| try { | |
| const result = await auth0.database.signUp({ | |
| email: req.body.email, | |
| password: req.body.password, | |
| connection, | |
| }); | |
| app.post('/signup', async (req, res) => { | |
| const { email, password } = req.body; | |
| if (!email || !password) { | |
| return res.status(400).json({ ok: false, message: 'email and password are required' }); | |
| } | |
| try { | |
| const result = await auth0.database.signUp({ | |
| email, | |
| password, | |
| connection, | |
| }); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@examples/database-conns/src/index.ts` around lines 9 - 15, Add a minimal
request-body guard before calling the SDK in the /signup and /change-password
handlers so missing email or password returns a clear 400 response instead of an
opaque SDK failure. Update the route handlers in index.ts around
auth0.database.signUp and auth0.database.changePassword to validate
req.body.email and req.body.password first, and short-circuit with a simple
client error response if either value is absent.
Comment on lines
+27
to
+29
| app.post('/change-password', async (req, res) => { | ||
| try { | ||
| const message = await auth0.database.changePassword({ email: req.body.email, connection }); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Validate email presence in the change-password route.
Same concern as /signup — req.body.email is passed unvalidated. A missing email will produce a confusing SDK error instead of a clear client error.
💚 Proposed validation guard
app.post('/change-password', async (req, res) => {
+ const { email } = req.body;
+ if (!email) {
+ return res.status(400).json({ ok: false, message: 'email is required' });
+ }
try {
- const message = await auth0.database.changePassword({ email: req.body.email, connection });
+ const message = await auth0.database.changePassword({ email, connection });📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| app.post('/change-password', async (req, res) => { | |
| try { | |
| const message = await auth0.database.changePassword({ email: req.body.email, connection }); | |
| app.post('/change-password', async (req, res) => { | |
| const { email } = req.body; | |
| if (!email) { | |
| return res.status(400).json({ ok: false, message: 'email is required' }); | |
| } | |
| try { | |
| const message = await auth0.database.changePassword({ email, connection }); |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@examples/database-conns/src/index.ts` around lines 27 - 29, The
change-password route is passing req.body.email directly into
auth0.database.changePassword without validating it first, which can lead to a
confusing SDK error. Update the /change-password handler in the app.post
callback to check for a present email before calling
auth0.database.changePassword, and return a clear client error response when it
is missing, following the same validation pattern used in the /signup flow.
Piyush-85
approved these changes
Jul 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds database-connection self-service operations to the SDK:
DatabaseClientsub-client exposed asauthClient.databasewithsignUp()andchangePassword(), request/response transforms (camelCase ↔ snake_case wire), id normalization (id ?? _id ?? user_id),SignUpError/ChangePasswordError(sanitizedcause), and adatabase/barrel export.ServerClient.signUp()/changePassword()as pure passthrough — no session/state writes; resolver-mode domain resolution supported.Design notes
/dbconnections/*are public endpoints: onlyclientIdis sent (no secret/assertion).changePasswordreturns the server's plain-text confirmation (read viaresponse.text()).causeis sanitized to{ error, error_description, message }(parity withMfaError).Test plan
npm run build— auth-js, server-js, api-jsnpm run test:ci— auth-js 329 pass, server-js 336 passnpm run lint— auth-js, server-js, api-jsRelated PRs
feat/database-conns-examplefeat/database-conns-docsSummary by CodeRabbit
databasesub-client to both client and server SDKs withsignUpandchangePassword.SignUpErrorandChangePasswordErrorfor typed failure handling.