feat: add auth password-login, pull, and push commands by moranshe-max · Pull Request #422 · base44/cli

moranshe-max · 2026-03-17T07:20:07Z

Note

Description

This PR introduces a new base44 auth command group that allows developers to manage app authentication settings from the CLI. It adds auth password-login, auth pull, and auth push subcommands, backed by a new auth-config resource module in the core SDK layer. Auth config is also integrated into the deploy pipeline so it is pushed automatically alongside other resources.

Related Issue

None

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Refactoring (no functional changes)
Other (please describe):

Changes Made

Added packages/cli/src/cli/commands/auth/ with three subcommands:
- auth password-login <enable|disable> — toggles username/password authentication in the local auth config file, with a lockout warning if no login methods remain enabled
- auth pull — fetches the remote auth config from Base44 and writes it to the local auth/config.jsonc file
- auth push [-y] — pushes the local auth config to Base44, with an interactive confirmation prompt (skippable with --yes)
Added packages/cli/src/core/resources/auth-config/ resource module following the Resource<T> pattern:
- schema.ts — Zod schemas for AuthConfig, API response, and file format (camelCase ↔ snake_case transforms)
- api.ts — getAuthConfig() and pushAuthConfigToApi() HTTP client functions
- config.ts — local file read/write helpers with deep-equality check to avoid unnecessary writes
- pull.ts / push.ts — resource-level pull/push operations
- resource.ts — Resource<AuthConfig> interface implementation for use in readProjectConfig / deployAll
Updated core/project/config.ts to read authConfig as part of readProjectConfig()
Updated core/project/deploy.ts (hasResourcesToDeploy, deployAll) to include auth config in the deploy pipeline
Added authDir field (default "auth") to ProjectConfigSchema
Registered getAuthCommand() in program.ts
Added integration tests (tests/cli/auth_password_setup.spec.ts) and unit tests (tests/core/auth-password.spec.ts)

Testing

I have tested these changes locally
I have added/updated tests as needed
All tests pass (npm test)

Checklist

My code follows the project's style guidelines
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (if applicable)
My changes generate no new warnings
I have updated docs/ (AGENTS.md) if I made architectural changes

Additional Notes

The auth push command warns users before pushing a config that disables all login methods, preventing accidental lockouts. The password-login command similarly warns when disabling the last remaining login method. The deploy flow integrates auth config seamlessly — if an auth/config.jsonc file exists in the project, it is pushed as part of base44 deploy.

_{🤖 Generated by Claude | 2026-03-24 00:00 UTC}

github-actions · 2026-03-17T07:20:37Z

🚀 Package Preview Available!

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.0.47-pr.422.d37d331

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.0.47-pr.422.d37d331"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.0.47-pr.422.d37d331"
  }
}

📦 Preview Package: @base44-preview/cli@0.0.47-pr.422.d37d331
🔗 View this commit on GitHub

_{Preview published to npm registry — try new features instantly!}

Paveltarno

claude is pretty dumb sometimes

kfirstri · 2026-03-23T14:12:08Z

packages/cli/src/core/resources/auth-config/api.ts

+/**
+ * Returns true if at least one login method is enabled in the given config.
+ */
+export function hasAnyLoginMethod(config: AuthConfig): boolean {


I think this should be in config / schema or somewhere else because it's not really API.ts file

kfirstri · 2026-03-23T14:13:39Z

packages/cli/src/core/resources/auth-config/api.ts

+
+  let response: KyResponse;
+  try {
+    response = await base44Client.get(`api/apps/${id}`);


I wonder if this should really big in project/api.ts file since it's the entire project data.. but maybe it's a future refactor

kfirstri · 2026-03-23T14:17:38Z

packages/cli/src/core/resources/auth-config/config.ts

+ * Reads the auth config file from the given directory.
+ * Returns [config] if the file exists, or [] if the directory or file doesn't exist.
+ */
+export async function readAuthConfig(authDir: string): Promise<AuthConfig[]> {


why are we returning an array of AuthConfig instead just the AuthConfig? is it possible to have multiple AuthConfigs? 🤔

kfirstri · 2026-03-23T14:18:56Z

packages/cli/src/core/resources/auth-config/config.ts

+export async function updateAuthConfigFile(
+  authDir: string,
+  updates: Partial<AuthConfig>,
+): Promise<AuthConfig> {


I wonder if we need a read / write / update functions, maybe just read and write? write will also do updates or updates will happen before calling the config.ts?

kfirstri · 2026-03-23T14:21:11Z

packages/cli/src/core/resources/auth-config/push.ts

+    return;
+  }
+
+  await pushAuthConfigToApi(configs[0]);


I commented it in the config.ts file, can AuthConfig be just singular and not an array? then we don't need to keep putting into an array and out of an array 💪

kfirstri · 2026-03-23T14:29:42Z

packages/cli/src/cli/commands/auth/password-login.ts

+    .option("--enable", "Enable password authentication")
+    .option("--disable", "Disable password authentication")


what do you think about using commander's .choices instead of 2 different flags? and then the command will look like base44 auth password-login enable

// something like .argument('<state>').choices(['enable', 'disable'])

Great tip! Claude claims it's easier for it to consume the cli that way.

kfirstri · 2026-03-23T14:32:07Z

packages/cli/src/cli/commands/auth/password-login.ts

+  const authDir = join(configDir, project.authDir);
+
+  const updated = await runTask(
+    `${shouldEnable ? "Enabling" : "Disabling"} username & password authentication`,


maybe the message should be something like "Updating authenticaiton configuration" or something? so make sure it's only locally

i just saw the outro message, so maybe it's fine

kfirstri · 2026-03-23T14:33:38Z

packages/cli/src/cli/commands/auth/password-login.ts

+      return await updateAuthConfigFile(authDir, {
+        enableUsernamePassword: shouldEnable,
+      });


I also commented baout this inside the updateAuthConfigFile function, i just feel writeAuthConfigFile can do everything?

kfirstri · 2026-03-23T14:34:28Z

packages/cli/src/cli/commands/auth/pull.ts

+
+export function getAuthPullCommand(): Command {
+  return new Base44Command("pull")
+    .description("Pull auth config from Base44 to local file")


Might worth adding some text about overwriting existing file

packages/cli/src/cli/commands/auth/push.ts

kfirstri

Good work 💪, Added some comments

kfirstri · 2026-03-24T14:25:03Z

packages/cli/src/core/project/deploy.ts

    onResult: options?.onFunctionResult,
  });
  await agentResource.push(agents);
+  if (authConfig) {


You should have a resource.ts file inside resources/auth-config/resource.ts with the "readAll" and "push" command configured, this is basically our interface for resourced, i don't want deploy.ts to be too familiar with resources implementation

move the if(authConfig) check to be inside the resource push function, like all other resourced do

kfirstri

one small change about adding a resource.ts to the auth-config, and then call the push method from deploy.ts.

kfirstri

🚀

Add `base44 auth password-login` command for enabling/disabling username & password authentication. Introduces the `auth` command group and the core `auth-config` module with Zod schemas, API client, and camelCase transforms. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Remove interactive prompts in favor of explicit --enable and --disable flags. Add comprehensive input validation with agent-friendly error hints. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Migrate auth-config from standalone core module to the unified resources pattern. Add `auth pull` and `auth push` CLI commands for syncing auth configuration. Extend project config and deploy to support auth-config as a deployable resource. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Replace removed runCommand/RunCommandResult imports with Base44Command and import RunCommandResult from @/cli/types.js to match the new command pattern introduced on main. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Move hasAnyLoginMethod from api.ts to schema.ts (not an API concern) - Use singular AuthConfig | null instead of AuthConfig[] everywhere - Remove Resource<T> adapter (resource.ts) — call readAuthConfig/pushAuthConfig directly - Remove updateAuthConfigFile — inline read-merge-write in password-login command - Switch password-login from --enable/--disable flags to positional argument (enable|disable) - Update task spinner message to "Updating local auth config" - Add overwrite warning to auth pull outro message - Add confirmation prompt and lockout warning to auth push (with --yes flag) - Update tests for new signatures and positional arg syntax Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…ace in deploy Move auth-config back to the standard Resource<T> pattern so deploy.ts doesn't need to know about the resource's internal null-vs-array semantics. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Update password-login, pull, and push commands to receive CLIContext as the first argument, matching the refactored Base44Command pattern. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

moranshe-max requested a review from kfirstri March 17, 2026 09:05

moranshe-max force-pushed the feature/add-password-login-command branch from 53d8672 to 60fd351 Compare March 17, 2026 11:52

kfirstri added this to CLI Development Mar 18, 2026

github-project-automation bot moved this to Backlog in CLI Development Mar 18, 2026

kfirstri moved this from Backlog to In review in CLI Development Mar 18, 2026

Paveltarno reviewed Mar 18, 2026

View reviewed changes

moranshe-max changed the title ~~feat: add auth password-login command~~ feat: add auth password-login, pull, and push commands Mar 22, 2026

moranshe-max force-pushed the feature/add-password-login-command branch from 837aaa9 to 3cd3e7a Compare March 22, 2026 12:40

moranshe-max requested a review from Paveltarno March 22, 2026 13:30

kfirstri reviewed Mar 23, 2026

View reviewed changes

packages/cli/src/cli/commands/auth/push.ts Show resolved Hide resolved

kfirstri reviewed Mar 23, 2026

View reviewed changes

moranshe-max force-pushed the feature/add-password-login-command branch from fdced31 to 2916115 Compare March 23, 2026 19:26

kfirstri reviewed Mar 24, 2026

View reviewed changes

kfirstri requested changes Mar 24, 2026

View reviewed changes

github-project-automation bot moved this from In review to Ready in CLI Development Mar 24, 2026

kfirstri previously approved these changes Mar 24, 2026

View reviewed changes

github-project-automation bot moved this from Ready to In review in CLI Development Mar 24, 2026

moranshe-max and others added 3 commits March 24, 2026 20:02

feat: make password-login non-interactive with --enable/--disable flags

243fb9d

Remove interactive prompts in favor of explicit --enable and --disable flags. Add comprehensive input validation with agent-friendly error hints. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

moranshe-max and others added 4 commits March 24, 2026 20:02

fix: adapt auth commands to new CLIContext action signature

6d96b8e

Update password-login, pull, and push commands to receive CLIContext as the first argument, matching the refactored Base44Command pattern. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

moranshe-max dismissed kfirstri’s stale review via 6d96b8e March 24, 2026 18:04

moranshe-max force-pushed the feature/add-password-login-command branch from 05e3522 to 6d96b8e Compare March 24, 2026 18:04

		.option("--enable", "Enable password authentication")
		.option("--disable", "Disable password authentication")

Conversation

moranshe-max commented Mar 17, 2026 • edited by claude bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Type of Change

Changes Made

Testing

Checklist

Additional Notes

Uh oh!

github-actions bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Package Preview Available!

Uh oh!

Paveltarno left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kfirstri Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kfirstri left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kfirstri left a comment

Choose a reason for hiding this comment

Uh oh!

kfirstri left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

moranshe-max commented Mar 17, 2026 •

edited by claude bot

Loading

github-actions bot commented Mar 17, 2026 •

edited

Loading

Paveltarno left a comment •

edited

Loading

kfirstri Mar 23, 2026 •

edited

Loading