feat(auth): passwordless email magic-link login

[mikedegeofroy]

Summary

Adds opt-in passwordless "magic link" login for the in-memory auth mode. The user enters their email on the login screen, the framework emails a single-use link, and following it establishes a session — no password typed. It composes with password login (both render on the login card) and is inert in the OIDC / resource-server modes, where the IdP owns sign-in.

POST /api/auth/magic/request {email}   → find user, mint single-use token, store hash, email link  (always 202)
GET  /api/auth/magic/verify?token=…    → consume token (atomic, single-use), mint session, 302 into the app

What's included

Backend (onec-auth-starter, new com.onec.auth.magic package)

• MagicLinkController — the two endpoints; verify saves the SecurityContext to the session exactly like /api/auth/login.
• MagicLinkService — 256-bit SecureRandom tokens; only the SHA-256 hash is persisted; no account enumeration (request always 202).
• JdbcMagicLinkTokenStore — onec_auth_magic_link table (JDBI + SqlDialect, mirroring MailOutbox); atomic, expiry-checked, single-use consumption so links validate across nodes.
• Pluggable SPIs (@ConditionalOnMissingBean): MagicLinkTokenStore, MagicLinkUserLookup, MagicLinkSender. Default delivery emails the link via onec-mail-starter (added compileOnly, same optional-cross-starter pattern mail uses for print).

Config

• Optional email on onec.auth.users[*] — opt-in per account (mirrors how an SSO backend keys a user by an external identity). Email-shaped usernames work without it.
• onec.auth.magic-link.* block: enabled (default false), token-validity (15m), base-url, redirect-path, subject.

Login UI (onec-ui-starter)

• AuthMethods.magicLinkEnabled (backward-compatible new field) → LoginDivBuilder renders an onec-magic-link DivKit block.
• React widget + bridge mirroring the password onec-login-form, portaled on the login route.

Auto-config ordering fix

• The auth auto-config declared before = SecurityAutoConfiguration, which ordered it ahead of DataSourceAutoConfiguration / the mail auto-config, so @ConditionalOnBean(DataSource/MailService) evaluated before those beans existed (the app failed to start with the feature on, even with a datasource). Now ordered after them.

Requirements (fail-fast at startup if missing)

• The onec-mail-starter with a configured provider (default sender), or a custom MagicLinkSender bean.
• A DataSource (token persistence), or a custom MagicLinkTokenStore bean.

Test plan

• 18 new tests: token store (single-use/expiry/purge), service round-trip + no-enumeration, controller (MockMvc: 202 always, redirect + session, single-use), mail sender, and auto-config wiring + fail-fast guidance.
• ./gradlew check green across all 12 modules; frontend type-checks (tsc -b) + builds + vitest pass.
• Live end-to-end against the example app (launch-args only, no committed example change): login card showed both blocks → request for a known address wrote one email / unknown wrote none (both 202) → following the link signed in as ana@rentals.local (ROLE_CLEANER) → replaying the link was rejected to /login?error=link.
• Docs synced per the repo rule: docs/ARCHITECTURE.md, docs/CONFIGURATION.md (regenerated; checkConfigDocs passes), onec-auth-starter/README.md, onec-ui-starter/README.md.

Notes

• Off by default; the example app config is unchanged.
• Magic-link establishes a session only (no remember-me cookie) — deliberate; easy to add for parity.

🤖 Generated with Claude Code