The EmDash admin login page always renders passkey as the primary method with providers under "OR CONTINUE WITH" and a magic-link fallback. A site standardizing on Hellō wants the login screen to show only "ō Continue with Hellō".
There is no config for this today (verified against emdash-cms/emdash: LoginPage.tsx hardcodes the layout; the public /_emdash/api/auth/mode endpoint returns authMode + providers with no per-method visibility). The only exclusive mode is the transparent external-auth descriptor (Cloudflare Access style), which replaces the page entirely.
Proposed shape (belongs upstream in emdash-cms/emdash; tracked here for the Hellō integration):
emdash({
authProviders: [hello({})],
loginMethods: { passkey: false, magicLink: false }, // default: both true
})
mode.ts returns the enabled methods alongside providers.LoginPage.tsx: when passkey is off and exactly one provider is configured, promote its button to the primary position; drop the divider and magic-link row.- Enforcement, not just cosmetics: gate the passkey and magic-link API routes when disabled.
- Lockout valve:
?method=passkey on the login URL as a documented break-glass override (provider outage or client misconfiguration would otherwise lock out admins).
Plan: implement in the patched monorepo used for the blog test deployment, prove it there, then propose upstream via emdash-cms Discussion alongside the tokenVerifiers PR.
The EmDash admin login page always renders passkey as the primary method with providers under "OR CONTINUE WITH" and a magic-link fallback. A site standardizing on Hellō wants the login screen to show only "ō Continue with Hellō".
There is no config for this today (verified against emdash-cms/emdash:
LoginPage.tsxhardcodes the layout; the public/_emdash/api/auth/modeendpoint returnsauthMode+ providers with no per-method visibility). The only exclusive mode is the transparent external-auth descriptor (Cloudflare Access style), which replaces the page entirely.Proposed shape (belongs upstream in emdash-cms/emdash; tracked here for the Hellō integration):
mode.tsreturns the enabled methods alongsideproviders.LoginPage.tsx: when passkey is off and exactly one provider is configured, promote its button to the primary position; drop the divider and magic-link row.?method=passkeyon the login URL as a documented break-glass override (provider outage or client misconfiguration would otherwise lock out admins).Plan: implement in the patched monorepo used for the blog test deployment, prove it there, then propose upstream via emdash-cms Discussion alongside the
tokenVerifiersPR.