Login: Removes `@hey-api/openapi-ts` from the login project by iOvergaard · Pull Request #22757 · umbraco/Umbraco-CMS

iOvergaard · 2026-05-07T15:06:36Z

Description

This removes the @hey-api/openapi-ts dependency from the Login project since the same types are exported from the Client.

The new login.js bundle is now down from 70+ to 59 KB:

../Umbraco.Cms.StaticAssets/wwwroot/umbraco/login/login.js               59.86 kB │ gzip: 13.37 kB │ map: 113.46 kB

Note

This is part of an ongoing project to merge 'login' into 'client' in the future.

Test plan

Verify that the Login screen works
Test out login procedure
Test that you can request a forgotten password (requires smtp setup)
Test that you can invite a user and set its password on the invite link
(Optional, but nice to test) Verify that you can setup 2fa on a user and log in (requires a bit more setup)

this is an ongoing project to be able to finally merge 'login' into 'client'

claude · 2026-05-07T15:10:29Z

Claude finished @iOvergaard's task in 3m 59s —— View job

PR Review

Target: origin/v18/dev · Based on commit: c951faf0 · Skipped: 15 noise files out of 23 total (all *.gen.ts + package-lock.json)

Removes the locally-generated @hey-api/openapi-ts API client from the Login project and replaces all usages with shared types and service classes imported from @umbraco-cms/backoffice/external/backend-api. Also removes the deprecated UmbProblemDetails type and the now-redundant is-problem-details.function.ts utility.

Other changes: Callers of resetPassword, validatePasswordResetCode, newPassword, validateInviteCode, and newInvitedUserPassword now use a try/catch pattern consistent with the backoffice client's ThrowOnError = true default; previously they used a { data, error } result-style pattern from the locally-generated client.

Suggestions

src/Umbraco.Web.UI.Login/CLAUDE.md: The project documentation is now stale. It still references @hey-api/openapi-ts in the API Generation section (including the generate:server-api script), lists @hey-api/openapi-ts ^0.85.0 under External Dependencies, includes the deleted src/api/ folder in the Folder Structure, and references a now-deleted file in Known Technical Debt ("api/client/client.gen.ts:207"). Worth updating in this PR to keep docs in sync.

Approved with Suggestions for improvement

Good to go, but please carefully consider the importance of the suggestions.

Copilot

Pull request overview

This PR removes the Login project’s locally generated Management API client (previously produced via @hey-api/openapi-ts) and switches Login to consume the same generated SDK/types exposed via @umbraco-cms/backoffice/external/backend-api, aligning with the longer-term goal of merging Login into Client.

Changes:

Removed @hey-api/openapi-ts usage in Login (config, generated files, npm script, and direct dependency).
Replaced Login’s local generated API calls with SecurityService/UserService from @umbraco-cms/backoffice/external/backend-api.
Removed deprecated local ProblemDetails type/guard in favor of isProblemDetailsLike from @umbraco-cms/backoffice/resources.

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/Umbraco.Web.UI.Login/src/utils/is-problem-details.function.ts	Removed deprecated local ProblemDetails type guard.
src/Umbraco.Web.UI.Login/src/types.ts	Switched password configuration types to come from `@umbraco-cms/backoffice/external/backend-api`; removed deprecated local types.
src/Umbraco.Web.UI.Login/src/mocks/handlers/login.handlers.ts	Removed dependency on locally generated API types; minor formatting updates.
src/Umbraco.Web.UI.Login/src/contexts/auth.repository.ts	Replaced local SDK calls with `SecurityService`/`UserService` calls and updated error handling.
src/Umbraco.Web.UI.Login/src/api/types.gen.ts	Deleted locally generated API types.
src/Umbraco.Web.UI.Login/src/api/sdk.gen.ts	Deleted locally generated API SDK functions.
src/Umbraco.Web.UI.Login/src/api/index.ts	Deleted local API barrel export.
src/Umbraco.Web.UI.Login/src/api/core/utils.gen.ts	Deleted local generated client core utilities.
src/Umbraco.Web.UI.Login/src/api/core/types.gen.ts	Deleted local generated core types.
src/Umbraco.Web.UI.Login/src/api/core/serverSentEvents.gen.ts	Deleted local generated SSE client.
src/Umbraco.Web.UI.Login/src/api/core/queryKeySerializer.gen.ts	Deleted local generated query key serialization helpers.
src/Umbraco.Web.UI.Login/src/api/core/pathSerializer.gen.ts	Deleted local generated URL/path serializers.
src/Umbraco.Web.UI.Login/src/api/core/params.gen.ts	Deleted local generated client params builder.
src/Umbraco.Web.UI.Login/src/api/core/bodySerializer.gen.ts	Deleted local generated body/query serializers.
src/Umbraco.Web.UI.Login/src/api/core/auth.gen.ts	Deleted local generated auth helpers.
src/Umbraco.Web.UI.Login/src/api/client/utils.gen.ts	Deleted local generated fetch client utilities.
src/Umbraco.Web.UI.Login/src/api/client/types.gen.ts	Deleted local generated fetch client types.
src/Umbraco.Web.UI.Login/src/api/client/index.ts	Deleted local generated client barrel export.
src/Umbraco.Web.UI.Login/src/api/client/client.gen.ts	Deleted local generated fetch client implementation.
src/Umbraco.Web.UI.Login/src/api/client.gen.ts	Deleted local generated client instantiation entrypoint.
src/Umbraco.Web.UI.Login/package.json	Removed `generate:server-api` script and direct `@hey-api/openapi-ts` devDependency.
src/Umbraco.Web.UI.Login/package-lock.json	Updated lockfile to reflect dependency/script changes (and associated dependency graph updates).
src/Umbraco.Web.UI.Login/openapi-ts.config.ts	Deleted local OpenAPI generator configuration.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…braco/Umbraco-CMS into v18/feature/login-pure-client

claude · 2026-05-08T09:24:03Z

Claude finished @leekelleher's task in 6m 49s —— View job

PR Review

Target: origin/v18/dev · Based on commit: 225b1212 · Skipped: 15 noise files out of 24 total (all *.gen.ts deleted files + package-lock.json)

Removes the locally-generated @hey-api/openapi-ts client from the Login project and switches all 5 API calls in auth.repository.ts to SecurityService/UserService from @umbraco-cms/backoffice/external/backend-api, adapting error handling from the old result-style ({ data, error }) to try/catch consistent with the shared client's throwOnError: true default.

Other changes: Removes deprecated UmbProblemDetails type and the is-problem-details.function.ts guard; re-exports PasswordConfigurationModel via the shared type. CLAUDE.md updated to reflect the removal.

Suggestions

src/Umbraco.Web.UI.Login/src/contexts/auth.repository.ts:115,153: validatePasswordResetCode and validateInviteCode previously guarded if (error || !data) — the !data branch covered 200 responses with a null/empty body. The new code returns data directly. The client fills an empty body with {} (not undefined), so this is safe in practice, but callers expecting passwordConfiguration to always be present will silently get {} if the server ever returns an empty 200. Worth a comment noting the assumption, or a guard: return data ?? {};.
src/Umbraco.Web.UI.Login/src/types.ts:1,41: The import-alias + bottom re-export pattern for PasswordConfigurationModel is the right approach when a type is both used locally and exported — no change needed — but having both import type { ... as PasswordConfigurationModel } at the top and export type { PasswordConfigurationModel } at the bottom could confuse a first reader. A short comment (// re-export for consumers) on line 41 would clarify intent. Fix this →

Approved

The migration is correct and clean. Error handling is behaviorally equivalent — the backoffice client's throw jsonError ?? textError path throws the raw ProblemDetails body, so isProblemDetailsLike(error) in #getApiErrorDetailText matches the same object shape as the old result-style error. Return types for validatePasswordResetCode / validateInviteCode are structurally compatible (VerifyResetPasswordResponseModel / VerifyInviteUserResponseModel both satisfy their respective response interfaces). No breaking changes — the Login project publishes only its compiled bundle (public/), not TypeScript types. Good to go, but please do a manual sanity check and testing before merging.

…e-client

leekelleher

Tested out, all working as described! 🚀
Great reduction and step towards bringing Login into the (backoffice) Client project. 💪

Backports #22757 from main. The login project generated its own API client for five operations that the backoffice client already exports, so it now imports SecurityService and UserService from @umbraco-cms/backoffice/external/backend-api instead. This removes the dependency entirely rather than upgrading it, which takes the login app from 1 critical + 1 high advisory to zero: every advisory against it came from the openapi-ts chain (handlebars, then json-schema-ref-parser -> js-yaml), and no release of openapi-ts is currently free of both. login.js drops from 76.24 kB to 60.65 kB (gzip 17.88 -> 13.44 kB). Unlike on main, the deprecated UmbProblemDetails type and isProblemDetails() are kept: they were deprecated in V16 (#19495), so the earliest removal is V18. They are hand-written and independent of the generated client, so keeping them costs nothing and this stays non-breaking. Closes #23500 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Resolves the TODO left by the previous commit. UmbProblemDetails and isProblemDetails() were kept out of caution for the V16 deprecation window, but the login project is private with no exports, main or types, nothing outside it can import from it, and its only internal use is isProblemDetailsLike from @umbraco-cms/backoffice/resources — the replacement. So there is no consumer to break and no reason to hold them until V18. Brings this fully in line with #22757 on main. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…) (#23501) * improvement(login): remove @hey-api/openapi-ts from the login project Backports #22757 from main. The login project generated its own API client for five operations that the backoffice client already exports, so it now imports SecurityService and UserService from @umbraco-cms/backoffice/external/backend-api instead. This removes the dependency entirely rather than upgrading it, which takes the login app from 1 critical + 1 high advisory to zero: every advisory against it came from the openapi-ts chain (handlebars, then json-schema-ref-parser -> js-yaml), and no release of openapi-ts is currently free of both. login.js drops from 76.24 kB to 60.65 kB (gzip 17.88 -> 13.44 kB). Unlike on main, the deprecated UmbProblemDetails type and isProblemDetails() are kept: they were deprecated in V16 (#19495), so the earliest removal is V18. They are hand-written and independent of the generated client, so keeping them costs nothing and this stays non-breaking. Closes #23500 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * docs(login): correct CLAUDE.md drift from the backport The cherry-pick pulled main's wording over two v17-accurate details: the runtime line (v17 enforces node >=24.13 / npm >=11 in package.json) and the utils listing, which dropped is-problem-details.function.ts even though this backport deliberately keeps that file. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * improvement(login): remove the deprecated problem-details helpers Resolves the TODO left by the previous commit. UmbProblemDetails and isProblemDetails() were kept out of caution for the V16 deprecation window, but the login project is private with no exports, main or types, nothing outside it can import from it, and its only internal use is isProblemDetailsLike from @umbraco-cms/backoffice/resources — the replacement. So there is no consumer to break and no reason to hold them until V18. Brings this fully in line with #22757 on main. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * improvement(login): bump typescript to 6 and sync CLAUDE.md TS 6 was held back on v17 for the published backoffice types, but the login project is private with no exports, so its compiler version affects nothing downstream. Matches main. Verified that tsc 6.0.3 still type-checks the Client source it reaches through the tsconfig path aliases, not just the login source. CLAUDE.md: drops the deleted is-problem-details helper from the folder listing, and makes the type-resolution note version-agnostic — it claimed the types align with "the in-repo v18 backoffice", which was already wrong on v17 and would drift again on every merge-up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

feat: removes @hey-api/openapi-ts from the login project

c951faf

this is an ongoing project to be able to finally merge 'login' into 'client'

iOvergaard changed the title ~~feat: removes @hey-api/openapi-ts from the login project~~ Login: Remove @hey-api/openapi-ts from the login project May 7, 2026

iOvergaard marked this pull request as ready for review May 7, 2026 15:09

Copilot AI review requested due to automatic review settings May 7, 2026 15:09

Copilot started reviewing on behalf of iOvergaard May 7, 2026 15:10 View session

claude Bot added the category/refactor label May 7, 2026

Copilot AI reviewed May 7, 2026

View reviewed changes

Comment thread src/Umbraco.Web.UI.Login/src/types.ts Outdated

Comment thread src/Umbraco.Web.UI.Login/src/mocks/handlers/login.handlers.ts

Comment thread src/Umbraco.Web.UI.Login/package-lock.json Outdated

docs(login): update CLAUDE.md to reflect removal of @hey-api/openapi-ts

d9f0f09

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iOvergaard added area/frontend dependencies Pull requests that update a dependency file type/feature labels May 7, 2026

iOvergaard and others added 2 commits May 7, 2026 17:24

Potential fix for pull request finding

57bc528

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Merge branch 'v18/feature/login-pure-client' of https://github.com/um…

c9a8c50

…braco/Umbraco-CMS into v18/feature/login-pure-client

iOvergaard changed the title ~~Login: Remove @hey-api/openapi-ts from the login project~~ Login: Removes @hey-api/openapi-ts from the login project May 7, 2026

iOvergaard added 3 commits May 7, 2026 21:11

Merge branch 'v18/dev' into v18/feature/login-pure-client

d8e4fe4

Merge branch 'v18/dev' into v18/feature/login-pure-client

49f7766

Merge branch 'v18/dev' into v18/feature/login-pure-client

225b121

iOvergaard added the release/18.1.0 label May 8, 2026

leekelleher deleted the branch main May 8, 2026 09:05

leekelleher closed this May 8, 2026

leekelleher reopened this May 8, 2026

leekelleher changed the base branch from v18/dev to main May 8, 2026 09:30

iOvergaard added 6 commits May 8, 2026 12:40

Merge branch 'main' into v18/feature/login-pure-client

55518fd

Merge branch 'main' into v18/feature/login-pure-client

d589c7c

Merge remote-tracking branch 'origin/main' into v18/feature/login-pur…

1a66bb0

…e-client

Merge branch 'main' into v18/feature/login-pure-client

d6c0e35

Merge branch 'main' into v18/feature/login-pure-client

8b77e4a

Merge branch 'main' into v18/feature/login-pure-client

bd5f751

leekelleher self-requested a review May 28, 2026 15:11

leekelleher approved these changes May 28, 2026

View reviewed changes

leekelleher merged commit 5cd0f22 into main May 28, 2026
28 checks passed

leekelleher deleted the v18/feature/login-pure-client branch May 28, 2026 15:57

Navigation Menu

Uh oh!

Login: Removes `@hey-api/openapi-ts` from the login project - #22757

Login: Removes `@hey-api/openapi-ts` from the login project#22757
leekelleher merged 13 commits into
mainfrom
v18/feature/login-pure-client

iOvergaard commented May 7, 2026 •

edited by leekelleher

Loading

Uh oh!

claude Bot commented May 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

claude Bot commented May 8, 2026 •

edited

Loading

Uh oh!

leekelleher left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

iOvergaard commented May 7, 2026 • edited by leekelleher Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Test plan

Uh oh!

claude Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Suggestions

Approved with Suggestions for improvement

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

claude Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review

Suggestions

Approved

Uh oh!

leekelleher left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

iOvergaard commented May 7, 2026 •

edited by leekelleher

Loading

claude Bot commented May 7, 2026 •

edited

Loading

claude Bot commented May 8, 2026 •

edited

Loading