feat(system-config): add a public system config response contract - #23
Merged
Conversation
The sign-in screens in the SDKs have no session when they render, so they fall back to a hardcoded list of login methods. That list can advertise a method an instance has turned off, and it is a second source of truth for something the server already knows. PublicSystemConfigResponseSchema is the slice of the configuration a signed-out client may read. It carries loginMethods and nothing else, so a client can ask which methods an instance offers rather than guess, and can tell whether declining a passkey during registration would leave a user with no way back in. Additive. No existing schema, type, or export changes.
This was referenced Jul 30, 2026
feat(system-config): serve the public system config unauthenticated
fells-code/seamless-auth-api#136
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First of three PRs adding the ability to skip passkey registration. This one is the contract only.
Why
The bundled sign-in screens render with no session, so they cannot read the system configuration. Today the React SDK falls back to a hardcoded
DEFAULT_LOGIN_METHODS = ['passkey', 'magic_link', 'phone_otp'], which does not match this project's ownSYSTEM_CONFIG_DEFAULTS.login_methods = ['passkey', 'magic_link']. So a client can advertise a method an instance has turned off, and the configured method list has two sources of truth.It also blocks a specific gap: registration currently forces a passkey. Offering a skip is only safe when some other login method is enabled, otherwise a user who declines can never sign back in. A client cannot check that today.
What
PublicSystemConfigResponseSchemacarriesloginMethodsand nothing else. Everything else inSystemConfigSchemastays behind the admin routes, and the doc comment says so, so the next person does not treat this as a general-purpose config dump..min(1)on the array is deliberate: an empty list would leave a client with nothing to offer and no way to tell that apart from a parse it should retry.Follow-ups
seamless-auth-api: serve this from an unauthenticatedGET /system-config/public, alongside the existing publicGET /oauth/providersseamless-auth-react: consume it, gate a skip control on the passkey registration screen, and drop the hardcoded fallbackVerification
npm run typecheck,npm test(159 passing),npm run lint, andnpm run format:checkall clean. Four tests added covering the enum, the empty-list rejection, and that unknown config keys are stripped rather than passed through.Additive, so a minor changeset. No existing schema, type, or export changes.