EmDash Admin Login Classic: email and password sign-in for the admin, as a small package

[marks-zyz]

We built a small package that adds the classic WordPress-style login to the EmDash admin: email and password, "forgot my password" by email, and a page to set your own password. Passkeys and the email link keep working next to it. There is no public sign-up.

Why: we hand EmDash sites to lawyers and shop owners. A passkey is bound to the origin it was created on, so it does not survive a move from workers.dev to the final domain or a change of phone, and the recovery path ends in a message to us (see #3733, #409, #3705). Several clients simply want an email and a password in their password manager.

What it is: an AuthProviderDescriptor plus a native plugin. No migration (credentials live in _plugin_storage), PBKDF2-SHA256 at 100,000 iterations (the workerd ceiling) with a Worker-secret pepper, rate limits in D1, the same answer for unknown and wrong accounts. Administrators can create someone's access with a generated temporary password from a "Team access" page, so a site is handed over with an email and a password and nothing for the client to confirm. English and pt-BR ship, one file per language.

What it is not: a competitor to emdash-better-auth (#2927). That one targets public sign-up and membership sites; this one is admin-only and small on purpose.

Repo: https://github.com/marks-zyz/emdash-admin-login-classic, npm emdash-admin-login-classic, MIT. It runs in production on a law-firm site. Feedback, issues and PRs are welcome, translations included.

Written with AI assistance (Claude Code).