Skip to main content
Version: Next

wasp/server/auth

Server-side auth APIs: types for your auth hooks, defining extra signup fields, helpers for working with users' auth identities, the validators Wasp uses in its default auth flows, and the OAuth clients of your social auth providers. You can use the helpers and the validators in custom sign-up actions.

Only available if your app has auth enabled. Some exports also depend on the auth methods your app enables, as noted on each one.

Auth hooks work with all auth methods, unless noted otherwise. Wasp awaits them if they're async, so the auth process waits for them to finish before continuing. Wasp ignores their return values, except for OnBeforeOAuthRedirectHook's.

Type Aliases​

CreateUserResult​

CreateUserResult = UserEntity & object

The user that createUser creates: your user entity, with its auth relation.

Type Declaration​

auth​

auth: AuthEntity | null

The user's Auth entity.

EmailProviderData​

EmailProviderData = object

The data Wasp stores for a user's Email auth identity.

See​

Accessing user data

Properties​

emailVerificationSentAt​

emailVerificationSentAt: string | null

hashedPassword​

hashedPassword: string

isEmailVerified​

isEmailVerified: boolean

passwordResetSentAt​

passwordResetSentAt: string | null

GetPasswordResetEmailContentFn​

GetPasswordResetEmailContentFn = (params) => EmailContent

The type of the function that creates the content of the password reset email, which you can set as auth.methods.email.passwordReset.getEmailContentFn.

Only available with Email auth.

Parameters​

params​

string

Returns​

EmailContent

Example​

import type { GetPasswordResetEmailContentFn } from "wasp/server/auth";

export const getPasswordResetEmailContent: GetPasswordResetEmailContentFn = ({
  passwordResetLink,
}) => ({
  subject: "Password reset",
  text: `Click the link below to reset your password: ${passwordResetLink}`,
  html: `
    <p>Click the link below to reset your password</p>
    <a href="${passwordResetLink}">Reset password</a>
  `,
});

See​

EmailFlowConfig

GetVerificationEmailContentFn​

GetVerificationEmailContentFn = (params) => EmailContent

The type of the function that creates the content of the email verification email, which you can set as auth.methods.email.emailVerification.getEmailContentFn.

Only available with Email auth.

Parameters​

params​

string

Returns​

EmailContent

Example​

import type { GetVerificationEmailContentFn } from "wasp/server/auth";

export const getVerificationEmailContent: GetVerificationEmailContentFn = ({
  verificationLink,
}) => ({
  subject: "Verify your email",
  text: `Click the link below to verify your email: ${verificationLink}`,
  html: `
    <p>Click the link below to verify your email</p>
    <a href="${verificationLink}">Verify email</a>
  `,
});

See​

EmailFlowConfig

OAuthData​

OAuthData = object & ({ providerName: "google"; tokens: GoogleTokens; } | { providerName: "discord"; tokens: DiscordTokens; } | { providerName: "github"; tokens: GitHubTokens; } | { providerName: "keycloak"; tokens: KeycloakTokens; } | { providerName: "microsoft"; tokens: MicrosoftEntraIdTokens; } | { providerName: "slack"; tokens: SlackTokens; })

The data of the OAuth flow, which Wasp passes to the onAfterSignup and onAfterLogin hooks when the user authenticates with social auth.

Besides uniqueRequestId, it has the following fields:

  • providerName: the name of the OAuth provider the user authenticated with (e.g. "google", "github"). It's one of the social auth providers your app enables.
  • tokens: the OAuth tokens, which you can use to make requests to the provider's API on the user's behalf. Depending on the OAuth provider, the tokens object has different fields. For example, Google's has accessToken, refreshToken, idToken, and accessTokenExpiresAt.

Type Declaration​

uniqueRequestId​

uniqueRequestId: string

The unique request ID of the OAuth flow (you might know it as the state parameter in OAuth). You can use it to get the data you saved in the onBeforeOAuthRedirect hook.

Example​

To access the provider-specific token fields, first narrow down the oauth object's type by checking its providerName:

if (oauth && oauth.providerName === "google") {
  console.log(oauth.tokens.accessToken);
  //                  ^ Google-specific tokens are available here
  console.log(oauth.tokens.refreshToken);
  console.log(oauth.tokens.idToken);
  console.log(oauth.tokens.accessTokenExpiresAt);
}

See​

Refreshing the OAuth access token

OAuthProviderData​

OAuthProviderData = object

The data Wasp stores for a user's social auth identity. It's empty.

OnAfterEmailVerifiedHook​

OnAfterEmailVerifiedHook = (params) => void | Promise<void>

The type of the onAfterEmailVerified auth hook, which Wasp calls after a user verifies their email. It runs every time a valid verification token is submitted, so it can run more than once if the user opens the link again while the token is valid.

Use it to react to the verification, e.g. by sending a welcome email or syncing the user with a third-party service.

Only available with Email auth.

Parameters​

params​

OnAfterEmailVerifiedHookParams

Returns​

void | Promise<void>

Example​

import type { OnAfterEmailVerifiedHook } from "wasp/server/auth";
import { emailSender } from "wasp/server/email";

export const onAfterEmailVerified: OnAfterEmailVerifiedHook = async ({
  email,
}) => {
  await emailSender.send({
    from: {
      name: "John Doe",
      email: "john@doe.com",
    },
    to: email,
    subject: "Thank you for verifying your email!",
    text: `Your email ${email} has been successfully verified!`,
    html: `<p>Your email ${email} has been successfully verified!</p>`,
  });
};

See​

Executing code after a user verifies their email

OnAfterLoginHook​

OnAfterLoginHook = (params) => void | Promise<void>

The type of the onAfterLogin auth hook, which Wasp calls after the user logs in.

Use it to sync the user with a third-party service, or to update or refresh the user's OAuth access token.

When using social auth, Wasp calls it before it creates the session. Wasp creates the session quickly afterward, so it shouldn't make any difference in practice.

Parameters​

params​

OnAfterLoginHookParams

Returns​

void | Promise<void>

Example​

import type { OnAfterLoginHook } from "wasp/server/auth";

export const onAfterLogin: OnAfterLoginHook = async ({
  providerId,
  user,
  oauth,
  prisma,
  req,
}) => {
  console.log("user object", user);

  // If this is an OAuth login, you can get the data you saved in the onBeforeOAuthRedirect hook
  if (oauth) {
    const id = oauth.uniqueRequestId;
    const data = someKindOfStore.get(id);
    if (data) {
      console.log("saved data for the ID", data);
    }
    someKindOfStore.delete(id);
  }
};

See​

Executing code after the user logs in

OnAfterSignupHook​

OnAfterSignupHook = (params) => void | Promise<void>

The type of the onAfterSignup auth hook, which Wasp calls after it creates the user.

Use it to send the user a welcome email, sync the user with a third-party service, or store the OAuth access and refresh tokens in your database.

Parameters​

params​

OnAfterSignupHookParams

Returns​

void | Promise<void>

Example​

import type { OnAfterSignupHook } from "wasp/server/auth";

export const onAfterSignup: OnAfterSignupHook = async ({
  providerId,
  user,
  oauth,
  prisma,
  req,
}) => {
  console.log("user object", user);

  // If this is an OAuth signup, you have access to the OAuth tokens and the uniqueRequestId
  if (oauth) {
    console.log("accessToken", oauth.tokens.accessToken);
    console.log("uniqueRequestId", oauth.uniqueRequestId);
  }
};

See​

Executing code after the user signs up

OnBeforeLoginHook​

OnBeforeLoginHook = (params) => void | Promise<void>

The type of the onBeforeLogin auth hook, which Wasp calls before it logs the user in.

Use it to reject a user based on some criteria before they log in, by throwing an HttpError.

Parameters​

params​

OnBeforeLoginHookParams

Returns​

void | Promise<void>

Example​

import { HttpError } from "wasp/server";
import type { OnBeforeLoginHook } from "wasp/server/auth";

export const onBeforeLogin: OnBeforeLoginHook = async ({
  providerId,
  user,
  prisma,
  req,
}) => {
  if (
    providerId.providerName === "email" &&
    providerId.providerUserId === "some@email.com"
  ) {
    throw new HttpError(403, "You cannot log in with this email");
  }
};

See​

Executing code before the user logs in

OnBeforeOAuthRedirectHook​

OnBeforeOAuthRedirectHook = (params) => { url: URL; } | Promise<{ url: URL; }>

The type of the onBeforeOAuthRedirect auth hook, which Wasp calls after it generates the OAuth redirect URL, but before it redirects the user to the OAuth provider.

Use it to save data (e.g. request query parameters) that you can use later in the OAuth flow, in the onAfterSignup or onAfterLogin hooks, through the uniqueRequestId.

Only available with social auth.

Parameters​

params​

OnBeforeOAuthRedirectHookParams

Returns​

{ url: URL; } | Promise<{ url: URL; }>

An object with the URL that Wasp redirects the user to, e.g. the url the hook received.

Example​

import type { OnBeforeOAuthRedirectHook } from "wasp/server/auth";

export const onBeforeOAuthRedirect: OnBeforeOAuthRedirectHook = async ({
  url,
  oauth,
  prisma,
  req,
}) => {
  // Saving query parameters for later use in onAfterSignup or onAfterLogin hooks
  const id = oauth.uniqueRequestId;
  someKindOfStore.set(id, req.query);

  return { url };
};

See​

Executing code before the OAuth redirect

OnBeforeSignupHook​

OnBeforeSignupHook = (params) => void | Promise<void>

The type of the onBeforeSignup auth hook, which Wasp calls before it creates the user.

Use it to reject a user based on some criteria before they sign up, by throwing an HttpError.

Parameters​

params​

OnBeforeSignupHookParams

Returns​

void | Promise<void>

Example​

import { HttpError } from "wasp/server";
import type { OnBeforeSignupHook } from "wasp/server/auth";

export const onBeforeSignup: OnBeforeSignupHook = async ({
  providerId,
  prisma,
  req,
}) => {
  const count = await prisma.user.count();
  if (count > 100) {
    throw new HttpError(403, "Too many users");
  }

  if (
    providerId.providerName === "email" &&
    providerId.providerUserId === "some@email.com"
  ) {
    throw new HttpError(403, "This email is not allowed");
  }
};

See​

Executing code before the user signs up

ProviderId​

ProviderId = object

Uniquely identifies a user's auth identity: the auth method and the user's ID for it. For example, the "email" provider with the user ID "test@test.com", or the "google" provider with the user ID "1234567890".

Wasp passes it to the onBeforeSignup, onAfterSignup, onBeforeLogin, and onAfterLogin hooks. Create one with createProviderId.

Properties​

providerName​

providerName: ProviderName

The auth method's name (e.g. "email", "google", "github").

providerUserId​

providerUserId: string

The user's unique ID in the provider's system (e.g. their email, Google ID, or GitHub ID).

ProviderName​

ProviderName = keyof PossibleProviderData

The name of an auth method, as used in ProviderId.

UsernameProviderData​

UsernameProviderData = object

The data Wasp stores for a user's Username & password auth identity.

See​

Accessing user data

Properties​

hashedPassword​

hashedPassword: string

Variables​

discord​

const discord: OAuthProvider<"discord", DiscordOAuthClient>

The Discord auth provider, with the OAuth client Wasp uses for it.

Only available with Discord auth.

github​

const github: OAuthProvider<"github", GitHubOAuthClient>

The GitHub auth provider, with the OAuth client Wasp uses for it.

Only available with GitHub auth.

google​

const google: OAuthProvider<"google", GoogleOAuthClient>

The Google auth provider, with the OAuth client Wasp uses for it.

Only available with Google auth.

Example​

Refreshing the user's access token:

import type { OnAfterLoginHook } from "wasp/server/auth";
import { google } from "wasp/server/auth";

export const onAfterLogin: OnAfterLoginHook = async ({ oauth }) => {
  if (
    oauth &&
    oauth.providerName === "google" &&
    oauth.tokens.refreshToken !== null
  ) {
    const newTokens = await google.oAuthClient.refreshAccessToken(
      oauth.tokens.refreshToken,
    );
    console.log("new tokens", newTokens);
  }
};

See​

Refreshing the OAuth access token

keycloak​

const keycloak: OAuthProvider<"keycloak", KeycloakOAuthClient>

The Keycloak auth provider, with the OAuth client Wasp uses for it.

Only available with Keycloak auth.

microsoft​

const microsoft: OAuthProvider<"microsoft", MicrosoftEntraIdOAuthClient>

The Microsoft auth provider, with the OAuth client Wasp uses for it.

Only available with Microsoft auth.

slack​

const slack: OAuthProvider<"slack", SlackOAuthClient>

The Slack auth provider, with the OAuth client Wasp uses for it.

Only available with Slack auth.

Functions​

createEmailVerificationLink(email, clientRoute): Promise<string>

Creates a link that verifies the user's email. The link points to the clientRoute of your app, with a token query parameter that expires in 30 minutes.

Only available with Email auth.

Parameters​

email​

string

The user's email.

clientRoute​

string

The path of the client route that verifies the email (e.g. "/email-verification"), where you use VerifyEmailForm or call verifyEmail.

Returns​

Promise<string>

The full verification link.

Example​

import {
  createEmailVerificationLink,
  sendEmailVerificationEmail,
} from "wasp/server/auth";

const verificationLink = await createEmailVerificationLink(
  args.email,
  "/email-verification",
);
await sendEmailVerificationEmail(args.email, {
  from: {
    name: "My App Postman",
    email: "hello@itsme.com",
  },
  to: args.email,
  subject: "Verify your email",
  text: `Click the link below to verify your email: ${verificationLink}`,
  html: `
    <p>Click the link below to verify your email</p>
    <a href="${verificationLink}">Verify email</a>
  `,
});

createPasswordResetLink(email, clientRoute): Promise<string>

Creates a link that lets the user reset their password. The link points to the clientRoute of your app, with a token query parameter that expires in 30 minutes.

Only available with Email auth.

Parameters​

email​

string

The user's email.

clientRoute​

string

The path of the client route that resets the password (e.g. "/password-reset"), where you use ResetPasswordForm or call resetPassword.

Returns​

Promise<string>

The full password reset link.

createProviderId()​

createProviderId(providerName, providerUserId): ProviderId

Creates a ProviderId that identifies a user's auth identity.

It normalizes the user ID: emails and usernames are case-insensitive, so it lowercases them.

Parameters​

providerName​

keyof PossibleProviderData

The auth method's name, e.g. "email".

providerUserId​

string

The user's ID for the auth method, e.g. their email.

Returns​

ProviderId

Example​

import { createProviderId } from "wasp/server/auth";

const providerId = createProviderId("email", "Test@Test.com");
// { providerName: "email", providerUserId: "test@test.com" }

createUser()​

createUser(providerId, serializedProviderData?, userFields?): Promise<CreateUserResult>

Creates a user with an auth identity.

It's a more convenient way to create the User, Auth, and AuthIdentity entities than using Prisma's User.create directly.

Parameters​

providerId​

ProviderId

The user's auth identity.

serializedProviderData?​

string

The auth method's data for the user. Create it with sanitizeAndSerializeProviderData.

userFields?​

{[field: string]: unknown; }

Any additional data you want to store on the user entity.

Returns​

Promise<CreateUserResult>

Example​

import {
  createProviderId,
  sanitizeAndSerializeProviderData,
  createUser,
} from "wasp/server/auth";

const providerId = createProviderId("username", args.username);
const providerData = await sanitizeAndSerializeProviderData<"username">({
  hashedPassword: args.password,
});

await createUser(providerId, providerData, {});

// This is equivalent to:
// await User.create({
//   data: {
//     auth: {
//       create: {
//         identities: {
//           create: {
//             providerName: "username",
//             providerUserId: providerId.providerUserId,
//             providerData,
//           },
//         },
//       },
//     },
//   },
// });

See​

Custom signup action

defineUserSignupFields()​

defineUserSignupFields<T>(fields): T

Defines the extra fields Wasp saves on your user entity when a user signs up, with the correct types.

Export its result and pass it as the userSignupFields option of an auth method in your app spec (e.g. auth.methods.usernameAndPassword.userSignupFields).

The object's keys are the field names, and they need to exist on your user entity. The values are functions that receive the data sent from the client and return the value of the field. Wasp excludes the password field from that data, so it isn't saved as plain text in the database; Wasp's auth backend handles the password.

If the value the function received is invalid, the function should throw an error. Wasp then rejects the signup with that error message.

For social auth providers, the functions don't receive client data. They receive { profile }, the user's profile from the provider; see each provider's docs.

Type Parameters​

T​

T extends UserSignupFields

Parameters​

fields​

T

The extra signup fields.

Returns​

T

The same fields object, typed.

Examples​

// main.wasp.ts
import { app } from "@wasp/spec";
import { userSignupFields } from "./src/auth/signup" with { type: "ref" };

export default app({
  // ...
  auth: {
    userEntity: "User",
    methods: {
      usernameAndPassword: {
        userSignupFields,
      },
    },
    onAuthFailedRedirectTo: "/login",
  },
});
// src/auth/signup.ts
import { defineUserSignupFields } from "wasp/server/auth";

export const userSignupFields = defineUserSignupFields({
  address: async (data) => {
    const address = data.address;
    if (typeof address !== "string") {
      throw new Error("Address is required");
    }
    if (address.length < 5) {
      throw new Error("Address must be at least 5 characters long");
    }
    return address;
  },
});

You can use any validation library in the functions, e.g. zod:

import { defineUserSignupFields } from "wasp/server/auth";
import * as z from "zod";

export const userSignupFields = defineUserSignupFields({
  address: (data) => {
    const AddressSchema = z
      .string({
        error: (issue) =>
          issue.input === undefined
            ? "Address is required"
            : "Address must be a string",
      })
      .min(10, "Address must be at least 10 characters long");
    const result = AddressSchema.safeParse(data.address);
    if (result.success === false) {
      throw new Error(result.error.issues[0].message);
    }
    return result.data;
  },
});

See​

Customizing the signup process

ensurePasswordIsPresent()​

ensurePasswordIsPresent(args): void

Checks that args.password is present, and throws an HttpError with status 422 if it isn't.

Parameters​

args​

object

The data sent from the client.

Returns​

void

Example​

import {
  ensurePasswordIsPresent,
  ensureValidPassword,
  ensureValidUsername,
} from "wasp/server/auth";
import type { CustomSignup } from "wasp/server/operations";

export const customSignup: CustomSignup<
  { username: string; password: string },
  void
> = async (args, context) => {
  ensureValidUsername(args);
  ensurePasswordIsPresent(args);
  ensureValidPassword(args);
  // ...
};

ensureTokenIsPresent()​

ensureTokenIsPresent(args): void

Checks that args.token is present, and throws an HttpError with status 422 if it isn't.

Parameters​

args​

object

The data sent from the client.

Returns​

void

ensureValidEmail()​

ensureValidEmail(args): void

Checks that args.email is present and a valid email address, and throws an HttpError with status 422 if it isn't.

Wasp's definition of a valid email address is the HTML5 one, widened to support Unicode.

Only available with Email auth.

Parameters​

args​

object

The data sent from the client.

Returns​

void

See​

Default validations

ensureValidPassword()​

ensureValidPassword(args): void

Checks that args.password is a valid password, and throws an HttpError with status 422 if it isn't.

A valid password has at least 8 characters and contains a number.

Parameters​

args​

object

The data sent from the client.

Returns​

void

See​

Default validations

ensureValidUsername()​

ensureValidUsername(args): void

Checks that args.username is present, and throws an HttpError with status 422 if it isn't.

Only available with Username & password auth.

Parameters​

args​

object

The data sent from the client.

Returns​

void

See​

Default validations

findAuthIdentity()​

findAuthIdentity(providerId): Promise<AuthIdentityEntity | null>

Finds the auth identity of a user.

Parameters​

providerId​

ProviderId

The auth identity to find.

Returns​

Promise<AuthIdentityEntity | null>

The AuthIdentity entity, or null if it doesn't exist.

Example​

import { HttpError } from "wasp/server";
import { createProviderId, findAuthIdentity } from "wasp/server/auth";

const providerId = createProviderId("email", args.email);
const authIdentity = await findAuthIdentity(providerId);
if (!authIdentity) {
  throw new HttpError(400, "Unknown user");
}

getProviderData()​

getProviderData<PN>(providerData): Omit<PossibleProviderData[PN], "hashedPassword">

Reads the auth method's data from an AuthIdentity entity's providerData field, without the hashed password.

Pass the auth method's name as the type parameter to get the right type.

Type Parameters​

PN​

PN extends keyof PossibleProviderData

Parameters​

providerData​

string

The providerData field of an AuthIdentity entity.

Returns​

Omit<PossibleProviderData[PN], "hashedPassword">

Example​

import { getProviderData } from "wasp/server/auth";

const providerData = getProviderData<"email">(authIdentity.providerData);
if (providerData.isEmailVerified) {
  // ...
}

getProviderDataWithPassword()​

getProviderDataWithPassword<PN>(providerData): PossibleProviderData[PN]

Works like getProviderData, but it includes the hashed password. Use it, for example, to read the data you pass to updateAuthIdentityProviderData.

Type Parameters​

PN​

PN extends keyof PossibleProviderData

Parameters​

providerData​

string

The providerData field of an AuthIdentity entity.

Returns​

PossibleProviderData[PN]

isEmailResendAllowed()​

isEmailResendAllowed<Field>(fields, field, resendInterval?): object

Checks if enough time has passed since Wasp sent the user an email, so you can send it again. Use it to rate-limit sending emails.

Only available with Email auth.

Type Parameters​

Field​

Field extends "emailVerificationSentAt" | "passwordResetSentAt"

Parameters​

fields​

{ [field in "emailVerificationSentAt" | "passwordResetSentAt"]: string | null }

The user's EmailProviderData.

field​

Field

The field with the time the email was sent: "emailVerificationSentAt" or "passwordResetSentAt".

resendInterval?​

number

The minimum time between emails, in milliseconds. Defaults to 1 minute.

Returns​

object

Whether you can resend the email (isResendAllowed), and if not, how many seconds are left until you can (timeLeft).

isResendAllowed​

isResendAllowed: boolean

timeLeft​

timeLeft: number

Example​

import { HttpError } from "wasp/server";
import { getProviderData, isEmailResendAllowed } from "wasp/server/auth";

const providerData = getProviderData<"email">(authIdentity.providerData);
const { isResendAllowed, timeLeft } = isEmailResendAllowed(
  providerData,
  "passwordResetSentAt",
);
if (!isResendAllowed) {
  throw new HttpError(
    400,
    `Please wait ${timeLeft} seconds before trying again.`,
  );
}

sanitizeAndSerializeProviderData()​

sanitizeAndSerializeProviderData<PN>(providerData): Promise<string>

Prepares an auth method's data for saving in an AuthIdentity entity's providerData field: hashes the password (if the data has a hashedPassword field) and serializes the data as JSON.

Pass the auth method's name as the type parameter to get the right type.

Type Parameters​

PN​

PN extends keyof PossibleProviderData

Parameters​

providerData​

PossibleProviderData[PN]

The auth method's data, with the plain-text password in the hashedPassword field.

Returns​

Promise<string>

The serialized data, to pass to createUser.

Example​

import { sanitizeAndSerializeProviderData } from "wasp/server/auth";

const providerData = await sanitizeAndSerializeProviderData<"email">({
  hashedPassword: args.password,
  isEmailVerified: false,
  emailVerificationSentAt: null,
  passwordResetSentAt: null,
});

sendEmailVerificationEmail()​

sendEmailVerificationEmail(email, content): Promise<void>

Sends the email verification email to a user, and saves when it was sent (in the emailVerificationSentAt field of their EmailProviderData).

It sends the email in the background: it doesn't wait for it to be sent, and it logs any errors sending it.

Only available with Email auth.

Parameters​

email​

string

The email of the user. It throws an error if there's no user with that email.

content​

Email

The email to send. Create its verification link with createEmailVerificationLink.

Returns​

Promise<void>

sendPasswordResetEmail()​

sendPasswordResetEmail(email, content): Promise<void>

Sends the password reset email to a user, and saves when it was sent (in the passwordResetSentAt field of their EmailProviderData). It sends the email in the background, like sendEmailVerificationEmail.

Only available with Email auth.

Parameters​

email​

string

The email of the user. It throws an error if there's no user with that email.

content​

Email

The email to send. Create its password reset link with createPasswordResetLink.

Returns​

Promise<void>

updateAuthIdentityProviderData()​

updateAuthIdentityProviderData<PN>(providerId, existingProviderData, providerDataUpdates): Promise<AuthIdentityEntity>

Updates the auth method's data of a user's auth identity.

It hashes the password if you update the hashedPassword field, so pass the new password not hashed.

Type Parameters​

PN​

PN extends keyof PossibleProviderData

Parameters​

providerId​

ProviderId

The auth identity to update.

existingProviderData​

PossibleProviderData[PN]

The identity's current data. Wasp replaces the stored data with this data plus the updates, so read it with getProviderDataWithPassword to keep the hashed password.

providerDataUpdates​

Partial<PossibleProviderData[PN]>

The fields to update.

Returns​

Promise<AuthIdentityEntity>

The updated AuthIdentity entity.

Example​

import { HttpError } from "wasp/server";
import {
  createProviderId,
  findAuthIdentity,
  updateAuthIdentityProviderData,
  getProviderDataWithPassword,
} from "wasp/server/auth";
import type { UpdatePassword } from "wasp/server/operations";

export const updatePassword: UpdatePassword<
  { email: string; password: string },
  void
> = async (args, context) => {
  const providerId = createProviderId("email", args.email);
  const authIdentity = await findAuthIdentity(providerId);
  if (!authIdentity) {
    throw new HttpError(400, "Unknown user");
  }

  const providerData = getProviderDataWithPassword<"email">(
    authIdentity.providerData,
  );

  // Updates the password and hashes it automatically.
  await updateAuthIdentityProviderData(providerId, providerData, {
    hashedPassword: args.password,
  });
};

See​

Password hashing

Referenced Types​

AuthEntity​

Wasp's Auth entity, which connects a user to their auth identities.

See​

The Auth entity

Properties​

id​

id: string

The Auth entity's ID.

AuthIdentityEntity​

Wasp's AuthIdentity entity, which stores a user's data for one auth method.

See​

The AuthIdentity entity

Properties​

authId​

authId: string

The ID of the Auth entity this identity belongs to.

providerData​

providerData: string

The auth method's data for the user, serialized as JSON. Use getProviderData to read it.

providerName​

providerName: string

The auth method's name, e.g. "email" or "google".

providerUserId​

providerUserId: string

The user's ID for the auth method, e.g. their email or Google ID.

AuthorizationURLOptions​

The parameters for creating an authorization URL.

Properties​

scopes?​

optional scopes?: string[]

The OAuth scopes to request.

CommonAuthHookParams​

The input all auth hooks receive.

Extended by​

Properties​

prisma​

prisma: PrismaClient

The Prisma client instance, which you can use to query your database. It's the same as prisma from wasp/server.

req​

req: Request

The Express request object of the request that triggered the hook, from which you can access the request headers, cookies, etc.

DiscordOAuthClient​

Arctic's OAuth client for Discord.

Methods​

createAuthorizationURL()​

createAuthorizationURL(state, options?): Promise<URL>

Parameters​
state​

string

options?​

AuthorizationURLOptions

Returns​

Promise<URL>

refreshAccessToken()​

refreshAccessToken(refreshToken): Promise<DiscordTokens>

Parameters​
refreshToken​

string

Returns​

Promise<DiscordTokens>

validateAuthorizationCode()​

validateAuthorizationCode(code): Promise<DiscordTokens>

Parameters​
code​

string

Returns​

Promise<DiscordTokens>

DiscordTokens​

The OAuth tokens Discord returns.

Properties​

accessToken​

accessToken: string

accessTokenExpiresAt​

accessTokenExpiresAt: Date

refreshToken​

refreshToken: string

GitHubOAuthClient​

Arctic's OAuth client for GitHub.

Methods​

createAuthorizationURL()​

createAuthorizationURL(state, options?): Promise<URL>

Parameters​
state​

string

options?​

AuthorizationURLOptions

Returns​

Promise<URL>

validateAuthorizationCode()​

validateAuthorizationCode(code): Promise<GitHubTokens>

Parameters​
code​

string

Returns​

Promise<GitHubTokens>

GitHubTokens​

The OAuth tokens GitHub returns.

Properties​

accessToken​

accessToken: string

GoogleOAuthClient​

Arctic's OAuth client for Google.

Methods​

createAuthorizationURL()​

createAuthorizationURL(state, codeVerifier, options?): Promise<URL>

Parameters​
state​

string

codeVerifier​

string

options?​

AuthorizationURLOptions

Returns​

Promise<URL>

refreshAccessToken()​

refreshAccessToken(refreshToken): Promise<GoogleRefreshedTokens>

Parameters​
refreshToken​

string

Returns​

Promise<GoogleRefreshedTokens>

validateAuthorizationCode()​

validateAuthorizationCode(code, codeVerifier): Promise<GoogleTokens>

Parameters​
code​

string

codeVerifier​

string

Returns​

Promise<GoogleTokens>

GoogleRefreshedTokens​

The OAuth tokens Google returns when refreshing the access token.

Properties​

accessToken​

accessToken: string

accessTokenExpiresAt​

accessTokenExpiresAt: Date

GoogleTokens​

The OAuth tokens Google returns.

Properties​

accessToken​

accessToken: string

accessTokenExpiresAt​

accessTokenExpiresAt: Date

idToken​

idToken: string

refreshToken​

refreshToken: string | null

KeycloakOAuthClient​

Arctic's OAuth client for Keycloak.

Methods​

createAuthorizationURL()​

createAuthorizationURL(state, codeVerifier, options?): Promise<URL>

Parameters​
state​

string

codeVerifier​

string

options?​

AuthorizationURLOptions

Returns​

Promise<URL>

refreshAccessToken()​

refreshAccessToken(refreshToken): Promise<KeycloakTokens>

Parameters​
refreshToken​

string

Returns​

Promise<KeycloakTokens>

validateAuthorizationCode()​

validateAuthorizationCode(code, codeVerifier): Promise<KeycloakTokens>

Parameters​
code​

string

codeVerifier​

string

Returns​

Promise<KeycloakTokens>

KeycloakTokens​

The OAuth tokens Keycloak returns.

Properties​

accessToken​

accessToken: string

accessTokenExpiresAt​

accessTokenExpiresAt: Date

idToken​

idToken: string

refreshToken​

refreshToken: string | null

refreshTokenExpiresAt​

refreshTokenExpiresAt: Date | null

MicrosoftEntraIdOAuthClient​

Arctic's OAuth client for Microsoft Entra ID.

Methods​

createAuthorizationURL()​

createAuthorizationURL(state, codeVerifier, options?): Promise<URL>

Parameters​
state​

string

codeVerifier​

string

options?​

AuthorizationURLOptions

Returns​

Promise<URL>

refreshAccessToken()​

refreshAccessToken(refreshToken): Promise<MicrosoftEntraIdTokens>

Parameters​
refreshToken​

string

Returns​

Promise<MicrosoftEntraIdTokens>

validateAuthorizationCode()​

validateAuthorizationCode(code, codeVerifier): Promise<MicrosoftEntraIdTokens>

Parameters​
code​

string

codeVerifier​

string

Returns​

Promise<MicrosoftEntraIdTokens>

MicrosoftEntraIdTokens​

The OAuth tokens Microsoft Entra ID returns.

Properties​

accessToken​

accessToken: string

accessTokenExpiresAt​

accessTokenExpiresAt: Date

idToken​

idToken: string

refreshToken​

refreshToken: string | null

OAuthProvider​

A social auth provider, with the OAuth client Wasp uses for it.

Type Parameters​

Id​

Id extends string

OAuthClient​

OAuthClient

Properties​

displayName​

displayName: string

The provider's name, e.g. "Google".

id​

id: Id

The provider's ID, e.g. "google".

oAuthClient​

oAuthClient: OAuthClient

The provider's OAuth client, from the Arctic library. You can use it e.g. to refresh the user's access token, if the provider supports it.

OnAfterEmailVerifiedHookParams​

The input of the onAfterEmailVerified hook.

Extends​

Properties​

email​

email: string

The user's verified email address.

prisma​

prisma: PrismaClient

The Prisma client instance, which you can use to query your database. It's the same as prisma from wasp/server.

Inherited from​

CommonAuthHookParams.prisma

req​

req: Request

The Express request object of the request that triggered the hook, from which you can access the request headers, cookies, etc.

Inherited from​

CommonAuthHookParams.req

user​

user: UserEntity

The user who completed email verification.

OnAfterLoginHookParams​

The input of the onAfterLogin hook.

Extends​

Properties​

oauth?​

optional oauth?: OAuthData

The OAuth flow's data. Only present if the user logged in with social auth.

prisma​

prisma: PrismaClient

The Prisma client instance, which you can use to query your database. It's the same as prisma from wasp/server.

Inherited from​

CommonAuthHookParams.prisma

providerId​

providerId: ProviderId

The auth identity the user logged in with.

req​

req: Request

The Express request object of the request that triggered the hook, from which you can access the request headers, cookies, etc.

Inherited from​

CommonAuthHookParams.req

user​

user: UserEntity

The logged-in user.

OnAfterSignupHookParams​

The input of the onAfterSignup hook.

Extends​

Properties​

oauth?​

optional oauth?: OAuthData

The OAuth flow's data. Only present if the user signed up with social auth.

prisma​

prisma: PrismaClient

The Prisma client instance, which you can use to query your database. It's the same as prisma from wasp/server.

Inherited from​

CommonAuthHookParams.prisma

providerId​

providerId: ProviderId

The auth identity the user signed up with.

req​

req: Request

The Express request object of the request that triggered the hook, from which you can access the request headers, cookies, etc.

Inherited from​

CommonAuthHookParams.req

user​

user: CreateUserResult

The user that was created.

OnBeforeLoginHookParams​

The input of the onBeforeLogin hook.

Extends​

Properties​

prisma​

prisma: PrismaClient

The Prisma client instance, which you can use to query your database. It's the same as prisma from wasp/server.

Inherited from​

CommonAuthHookParams.prisma

providerId​

providerId: ProviderId

The auth identity the user is logging in with.

req​

req: Request

The Express request object of the request that triggered the hook, from which you can access the request headers, cookies, etc.

Inherited from​

CommonAuthHookParams.req

user​

user: UserEntity

The user that is trying to log in.

OnBeforeOAuthRedirectHookParams​

The input of the onBeforeOAuthRedirect hook.

Extends​

Properties​

oauth​

oauth: object

The OAuth flow's data.

uniqueRequestId​

uniqueRequestId: string

The unique request ID of the OAuth flow (you might know it as the state parameter in OAuth). The onAfterSignup and onAfterLogin hooks receive the same ID in OAuthData.

prisma​

prisma: PrismaClient

The Prisma client instance, which you can use to query your database. It's the same as prisma from wasp/server.

Inherited from​

CommonAuthHookParams.prisma

req​

req: Request

The Express request object of the request that triggered the hook, from which you can access the request headers, cookies, etc.

Inherited from​

CommonAuthHookParams.req

url​

url: URL

The URL of the OAuth provider that Wasp will redirect the user to.

OnBeforeSignupHookParams​

The input of the onBeforeSignup hook.

Extends​

Properties​

prisma​

prisma: PrismaClient

The Prisma client instance, which you can use to query your database. It's the same as prisma from wasp/server.

Inherited from​

CommonAuthHookParams.prisma

providerId​

providerId: ProviderId

The auth identity the user is signing up with.

req​

req: Request

The Express request object of the request that triggered the hook, from which you can access the request headers, cookies, etc.

Inherited from​

CommonAuthHookParams.req

SlackOAuthClient​

Arctic's OAuth client for Slack.

Methods​

createAuthorizationURL()​

createAuthorizationURL(state, options?): Promise<URL>

Parameters​
state​

string

options?​

AuthorizationURLOptions

Returns​

Promise<URL>

validateAuthorizationCode()​

validateAuthorizationCode(code): Promise<SlackTokens>

Parameters​
code​

string

Returns​

Promise<SlackTokens>

SlackTokens​

The OAuth tokens Slack returns.

Properties​

accessToken​

accessToken: string

idToken​

idToken: string

UserEntity​

Your app's user entity: the Prisma model you set as auth.userEntity in your app spec (usually User).

Wasp generates the real type from your Prisma schema, so it has the fields you defined on that model.

EmailContent​

EmailContent = object

Properties​

html​

html: string

subject​

subject: string

text​

text: string

PossibleProviderData​

PossibleProviderData = object

This type is used for type-level programming e.g. to enumerate all possible provider data types.

The keys of this type are the names of the providers and the values are the types of the provider data.

Properties​

discord​

discord: OAuthProviderData

email​

email: EmailProviderData

github​

github: OAuthProviderData

google​

google: OAuthProviderData

keycloak​

keycloak: OAuthProviderData

microsoft​

microsoft: OAuthProviderData

slack​

slack: OAuthProviderData

username​

username: UsernameProviderData

UserSignupFieldFn​

UserSignupFieldFn = (data) => unknown

A function that computes the value of an extra signup field. See defineUserSignupFields.

Parameters​

data​

{[key: string]: unknown; }

Returns​

unknown

UserSignupFields​

UserSignupFields = object

The object defineUserSignupFields receives.

Index Signature​

[field: string]: UserSignupFieldFn