@gliderzone/auth-client

Shared React auth client + login UI for the gliding apps. A thin wrapper over Better Auth's React client, pre-pointed at auth.gliderzone.com. Part of the shared auth platform (GLI-175); see the auth service and ../AGENTS.md.

Published to npm as the public package @gliderzone/auth-client (GLI-176 decision — it's glue code with no secrets, so public exposure is benign and keeps consumer installs auth-free). Releases are cut by the auth repo's publish-client.yml on a version bump; see ../AGENTS.md.

Install

npm install @gliderzone/auth-client
# peer deps (already present in every gliding app):
npm install react react-dom

Usage

Most apps just use the production singleton:

import { AuthButton, useSession } from "@gliderzone/auth-client";

function Header() {
  const { data: session } = useSession();
  return (
    <header>
      {session ? <span>{session.user.name}</span> : null}
      <AuthButton className="btn" />
    </header>
  );
}

• AuthButton — sign-out when authed, Google sign-in otherwise.
• SignInButton / SignOutButton — the individual controls. Unstyled <button>s; pass className/children to match the app.
• useSession(), signIn, signOut — re-exports bound to the production client.

Pointing at a non-production auth service (local dev)

The singleton targets https://auth.gliderzone.com. For a different base URL, create your own client and pass it to the components:

import { createGlidingAuthClient, AuthButton } from "@gliderzone/auth-client";
import { resolveAuthBaseURL } from "@gliderzone/auth-client";

// Vite: pass import.meta.env so VITE_AUTH_URL can override locally.
const authClient = createGlidingAuthClient({
  baseURL: resolveAuthBaseURL(undefined, import.meta.env),
});

<AuthButton client={authClient} />;

Calling your own backend with a JWT

const { data } = await authClient.token(); // short-lived EdDSA JWT
fetch("/api/whatever", { headers: { authorization: `Bearer ${data.token}` } });

Your backend verifies it against https://auth.gliderzone.com/.well-known/jwks.json — see the claim contract in ../AGENTS.md.

Develop

npm install
npm run build       # tsup → dist/ (ESM + .d.ts)
npm test            # node --test (pure logic + API surface)
npm run typecheck

React/react-dom are peer dependencies.

Gotcha: dedupe React when consuming via a local link

A normal published install resolves React as a peer and is fine. But if you npm link / file:-link this package during local development, the link can pull the package's own dev copy of React, giving the app two React instances → "Invalid hook call". Dedupe React in the consumer (Vite: resolve: { dedupe: ["react", "react-dom"] }).