feat(auth): add opt-in password step to interactive login

[gjtorikian]

Summary

• --interactive-password / interactiveAuth: { password: true } adds the step hosted AuthKit puts after the email: a user who has a password gets a password page before any organization selection. The interactive page was email-only, so a Playwright suite written against hosted AuthKit had no password field to fill and no wrong-password path to assert. Opt-in, because the one-step email page is what every existing interactive suite was written against; plain --interactive is unchanged.
• A wrong password re-renders the page with an inline error (HTTP 401) and emits authentication.password_failed with invalid_credentials, the same event the password grant emits. Nothing reaches the callback until the password is right.
• The auth code records the method, so the exchange emits authentication.password_succeeded and returns "authentication_method": "Password" instead of claiming OAuth for a login it verified with a password.
• The organization page carries a short-lived token, not the password. A verified login is remembered server-side for ten minutes and spent when it mints a code. Posting an organization_id without that token lands back on the password page, so the check cannot be skipped.
• sealed_session is now always null from /user_management/authenticate. Production never seals on the server; the SDKs seal client-side with a cookie password the API never sees. The emulator's own sealing pushed authkit-nextjs session cookies past the 4096-byte browser cap. Fixes authenticate returns sealed_session on every SDK call, pushing authkit-nextjs session cookies past the 4096-byte browser cap #93.

Also ignores the local Dolt database and credential key that bd init writes.

Usage

workos-emulate --interactive-password --seed workos-emulate.config.yaml

await page.fill('input[name="email"]', 'alice@example.com');
await page.click('button[type="submit"]');
await page.fill('input[name="password"]', 'correct-horse');
await page.click('button[type="submit"]');

A user without a password skips the page. MFA challenges and the email-verification gate are not part of it. The README gains a "Requiring a password" section under Interactive Auth.

[greptile-apps]

Greptile Summary

The PR adds an opt-in password, email-verification, and MFA sequence to interactive AuthKit login while preserving the existing email-only mode. It also records the authentication method on authorization codes, returns sealed_session: null, and adds bounded cleanup for short-lived interactive-login state.

• Adds CLI and programmatic configuration for interactive password authentication.
• Carries verified browser logins through gates and organization selection using short-lived server-side tokens.
• Deletes spent tokens and sweeps expired tokens together with their associated verification or challenge records.
• Expands route and interactive-auth coverage for success, failure, replay, expiry, reset, and cleanup behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/workos/routes/auth.ts	Implements the staged interactive password flow, authorization-code method tracking, token consumption, and bounded cleanup of expired continuation state.
src/core/store.ts	Adds direct keyed deletion and predicate-based prefix deletion used to remove spent and expired interactive-login state.
src/workos/login-page.ts	Adds escaped, server-rendered password and one-time-code pages for the new interactive steps.
src/index.ts	Extends interactive-auth configuration and restores both interactive flags after emulator reset.
src/workos/interactive-auth.spec.ts	Covers password, verification, MFA, organization selection, replay prevention, expiry cleanup, and reset behavior.
src/workos/routes/auth.spec.ts	Updates the authenticate response contract to require sealed_session: null, including refresh-token requests.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Interactive email page] --> B{Password configured?}
    B -- No --> G{Organization selection needed?}
    B -- Yes --> C[Password page]
    C --> D{Email verified?}
    D -- No --> E[Email verification page]
    D -- Yes --> F{MFA enrolled?}
    E --> F
    F -- Yes --> H[MFA code page]
    F -- No --> G
    H --> G
    G -- Yes --> I[Organization page]
    G -- No --> J[Mint authorization code]
    I --> J
    J --> K[Delete interactive login token]
    L[Next token mint] --> M[Sweep expired login tokens]
    M --> N[Delete referenced verification or challenge]

Loading

_{Reviews (5): Last reviewed commit: "fix(auth): release gate records when an ..." | Re-trigger Greptile}