Class: AuthGatePlugin

AppKit plugin adapting @dbx-tools/auth to tunnel traffic. On setup() it registers the login routes (/api/email/auth/*) and a gating middleware on the app’s OWN Express server via this.context, so a public portr caller must prove an email before reaching the app’s /api/* - see ./gate. Front-door (platform) traffic and other local callers pass through untouched (the gate keys on the Host header).

Extends

Plugin<AuthGateConfig>

Constructors

Constructor

new AuthGatePlugin(config): AuthGatePlugin

Parameters

config

AuthGateConfig

Returns

AuthGatePlugin

Inherited from

Plugin<AuthGateConfig>.constructor

Properties

app

protected app: AppManager

Inherited from

Plugin.app

cache

protected cache: CacheManager

Inherited from

Plugin.cache

config

protected config: AuthGateConfig

Inherited from

Plugin.config

context?

protected optional context?: PluginContext

Inherited from

Plugin.context

devFileReader

protected devFileReader: DevFileReader

Inherited from

Plugin.devFileReader

isReady

protected isReady: boolean

Inherited from

Plugin.isReady

name

name: string

Plugin name identifier.

Inherited from

Plugin.name

streamManager

protected streamManager: StreamManager

Inherited from

Plugin.streamManager

telemetry

protected telemetry: ITelemetry

Inherited from

Plugin.telemetry

manifest

static manifest: object

description

description: string = "Better Auth email OTP and passkey access gate for a public tunnel."

displayName

displayName: string = "Auth Gate"

name

name: "authGate" = "authGate"

resources

resources: object

resources.optional

optional: object[]

resources.required

required: never[] = []

stability

stability: "beta" = "beta"

phase

static phase: PluginPhase

Plugin initialization phase.

‘core’: Initialized first (e.g., config plugins)
‘normal’: Initialized second (most plugins)
‘deferred’: Initialized last (e.g., server plugin)

Inherited from

Plugin.phase

Methods

abortActiveOperations()

abortActiveOperations(): void

Cancel in-flight work (abort signals, SSE streams). Runs in the first phase of graceful shutdown, BEFORE any plugin’s shutdown() hook — so it must not tear down shared resources (e.g. connection pools) that other plugins’ hooks may still need. Put teardown in shutdown().

Returns

void

Inherited from

Plugin.abortActiveOperations

asUser()

asUser(req): this

Execute operations using the user’s identity from the request. Returns a proxy of this plugin where all method calls execute with the user’s Databricks credentials instead of the service principal.

Parameters

req

Request

The Express request containing the user token in headers

Returns

this

A proxied plugin instance that executes as the user

Throws

AuthenticationError if user token is not available in request headers (production only). In development mode (NODE_ENV=development), skips user impersonation instead of throwing.

Inherited from

Plugin.asUser

attachContext()

attachContext(deps?): void

Binds runtime dependencies (telemetry provider, cache, plugin context) to this plugin. Called by AppKit._createApp after construction and before setup(). Idempotent: safe to call if the constructor already bound them eagerly. Kept separate so factories can eagerly construct plugin instances without running this before TelemetryManager.initialize() / CacheManager.getInstance() have run.

Parameters

deps?

context?

unknown

telemetryConfig?

TelemetryOptions

Returns

void

Inherited from

Plugin.attachContext

clientConfig()

clientConfig(): Record<string, unknown>

Returns startup config to expose to the client. Override this to surface server-side values that are safe to publish to the frontend, such as feature flags, resource IDs, or other app boot settings.

This runs once when the server starts, so it should not depend on request-scoped or user-specific state.

String values that match non-public environment variables are redacted unless you intentionally expose them via a matching PUBLIC_APPKIT_ env var.

Values must be JSON-serializable plain data (no functions, Dates, classes, Maps, Sets, BigInts, or circular references). By default returns an empty object (plugin contributes nothing to client config).

On the client, read the config with the usePluginClientConfig hook (React) or the getPluginClientConfig function (vanilla JS), both from @databricks/appkit-ui.

Returns

Record<string, unknown>

Example

// Server — plugin definition
class MyPlugin extends Plugin<MyConfig> {
  clientConfig() {
    return {
      warehouseId: this.config.warehouseId,
      features: { darkMode: true },
    };
  }
}

// Client — React component
import { usePluginClientConfig } from "@databricks/appkit-ui/react";

interface MyPluginConfig { warehouseId: string; features: { darkMode: boolean } }

const config = usePluginClientConfig<MyPluginConfig>("myPlugin");
config.warehouseId; // "abc-123"

// Client — vanilla JS
import { getPluginClientConfig } from "@databricks/appkit-ui/js";

const config = getPluginClientConfig<MyPluginConfig>("myPlugin");

Inherited from

Plugin.clientConfig

execute()

protected execute<T>(fn, options, userKey?): Promise<ExecutionResult<T>>

Execute a function with the plugin’s interceptor chain.

Returns an ExecutionResult discriminated union:

{ ok: true, data: T } on success
{ ok: false, status: number, message: string } on failure

Errors are never thrown — the method is production-safe.

Type Parameters

T

T

Parameters

fn

(signal?) => Promise<T>

options

PluginExecutionSettings

userKey?

string

Returns

Promise<ExecutionResult<T>>

Inherited from

Plugin.execute

executeStream()

protected executeStream<T>(res, fn, options, userKey?): Promise<void>

Type Parameters

T

T

Parameters

res

IAppResponse

fn

StreamExecuteHandler<T>

options

StreamExecutionSettings

userKey?

string

Returns

Promise<void>

Inherited from

Plugin.executeStream

exports()

exports(): AuthGateApi

Returns the public exports for this plugin. Override this to define a custom public API. By default, returns an empty object.

The returned object becomes the plugin’s public API on the AppKit instance (e.g. appkit.myPlugin.method()). AppKit automatically binds method context and adds asUser(req) for user-scoped execution.

Returns

AuthGateApi

Example

class MyPlugin extends Plugin {
  private getData() { return []; }

  exports() {
    return { getData: this.getData };
  }
}

// After registration:
const appkit = await createApp({ plugins: [myPlugin()] });
appkit.myPlugin.getData();

Overrides

Plugin.exports

getEndpoints()

getEndpoints(): PluginEndpointMap

Returns

PluginEndpointMap

Inherited from

Plugin.getEndpoints

getSkipBodyParsingPaths()

getSkipBodyParsingPaths(): ReadonlySet<string>

Returns

ReadonlySet<string>

Inherited from

Plugin.getSkipBodyParsingPaths

injectRoutes()

injectRoutes(_): void

Parameters

_

Router

Returns

void

Inherited from

Plugin.injectRoutes

registerEndpoint()

protected registerEndpoint(name, path): void

Parameters

name

string

path

string

Returns

void

Inherited from

Plugin.registerEndpoint

resolveUserId()

protected resolveUserId(req): string

Resolve the effective user ID from a request.

Returns the x-forwarded-user header when present. In development mode (NODE_ENV=development) falls back to the current context user ID so that callers outside an active runInUserContext scope still get a consistent value.

Parameters

req

Request

Returns

string

Throws

AuthenticationError in production when no user header is present.

Inherited from

Plugin.resolveUserId

route()

protected route<_TResponse>(router, config): void

Type Parameters

_TResponse

_TResponse

Parameters

router

Router

config

RouteConfig

Returns

void

Inherited from

Plugin.route

setup()

setup(): Promise<void>

Returns

Promise<void>

Overrides

Plugin.setup

shutdown()

shutdown(): Promise<void>

Returns

Promise<void>

getResourceRequirements()

static getResourceRequirements(config): ResourceRequirement[]

Parameters

config

AuthGateConfig

Returns

ResourceRequirement[]