CWA 2 is a prerelease (2.0.0-alpha), heading for a beta. It runs production sites; configuration can still change between releases, always with upgrade notes. View versions and support
Cwa Api
cwa.auth
Authentication state and all user account actions — sign in, sign out, password reset, and email verification.
Authentication state and all user account actions.
State
cwa.auth.signedIn // ComputedRef<boolean>
cwa.auth.user // CwaUser | undefined — reactive, no .value
cwa.auth.roles // (string | CwaUserRoles)[] | undefined — no .value; undefined when signed out
cwa.auth.isAdmin // ComputedRef<boolean> — exact match for the ROLE_ADMIN string in the user's roles
cwa.auth.status // ComputedRef<CwaAuthStatus> (0=SIGNED_OUT, 1=LOADING, 2=SIGNED_IN)
cwa.auth.hasRole('ROLE_ADMIN') // boolean — check a specific role
user and roles are plain reactive getters, not refs — reading .value on them gives undefined. There is no role hierarchy client-side: isAdmin and hasRole() check for the exact role string in user.roles.Actions
// Sign in with username/password
const result = await cwa.auth.signIn({ username: 'alice@example.com', password: 'secret' })
if (result instanceof FetchError) {
console.error('Login failed', result.statusCode)
}
// Sign out
await cwa.auth.signOut()
// Request a password reset email
await cwa.auth.forgotPassword('alice@example.com')
// Complete a password reset (from link parameters)
await cwa.auth.resetPassword({
username: 'alice',
token: 'abc123',
passwords: { first: 'new_password', second: 'new_password' }
})
// Verify email address (from link parameters)
await cwa.auth.verifyEmail({ username: 'alice', token: 'abc123' })
// Confirm email address change (from link parameters)
await cwa.auth.confirmEmail({ username: 'alice', token: 'abc123', newEmail: 'new@example.com' })
// Re-send verification email
await cwa.auth.resendVerifyEmail('alice')
await cwa.auth.resendVerifyNewEmail('alice')
// forgotPassword and both resends return a FetchError on a 429 (throttled,
// with Retry-After) or a 503 (not sent) rather than throwing
// Re-hydrate user from the /me endpoint (e.g. after updating profile)
await cwa.auth.refreshUser()
// Load the user once, if it hasn't been loaded yet
await cwa.auth.init()
init()
init() loads the signed-in user from /me, the first time it is called. Later calls do nothing, unless the cwa_auth cookie says the user is signed in but no user is loaded, when it loads the user again. The module calls it when the app starts in the browser, and the cwa-auth and cwa-admin middleware call it before they check the user. Call it in your own route middleware before you read user, roles or hasRole(), as in Protecting Pages.
refreshUser() always requests /me. When the request fails, it ends the session.