@apso/cli 0.44.0 → 0.45.0

package/dist/lib/types/auth.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isApiKeyAuth = exports.isJwtAuth = exports.isDbSessionAuth = exports.API_KEY_AUTH_DEFAULTS = exports.JWT_AUTH_DEFAULTS = exports.DB_SESSION_AUTH_DEFAULTS = void 0;
+exports.resolveApiKeyAuth = exports.resolveJwtAuth = exports.isApiKeyAuth = exports.isJwtAuth = exports.isDbSessionAuth = exports.API_KEY_AUTH_DEFAULTS = exports.JWT_AUTH_DEFAULTS = exports.DB_SESSION_AUTH_DEFAULTS = void 0;
 /**
  * Default values for DB session auth configuration
  */
@@ -28,6 +28,7 @@ exports.JWT_AUTH_DEFAULTS = {
 exports.API_KEY_AUTH_DEFAULTS = {
     apiKeyHeader: "x-api-key",
     apiKeyEntity: "ApiKey",
+    keyField: "keyHash",
 };
 /**
  * Type guard: Check if auth config is DB session based
@@ -46,7 +47,8 @@ exports.isDbSessionAuth = isDbSessionAuth;
 function isJwtAuth(auth) {
     return (auth.provider === "auth0" ||
         auth.provider === "clerk" ||
-        auth.provider === "cognito");
+        auth.provider === "cognito" ||
+        auth.provider === "jwt");
 }
 exports.isJwtAuth = isJwtAuth;
 /**
@@ -58,3 +60,60 @@ function isApiKeyAuth(auth) {
     return auth.provider === "api-key";
 }
 exports.isApiKeyAuth = isApiKeyAuth;
+/**
+ * Claim defaults per provider. Clerk's v2 session token nests the active
+ * organization under `o`; Cognito puts group membership in `cognito:groups`.
+ */
+const PROVIDER_CLAIMS = {
+    auth0: { userId: "sub", email: "email" },
+    clerk: { userId: "sub", email: "email", workspaceId: "o.id", roles: "o.rol" },
+    cognito: { userId: "sub", email: "email", roles: "cognito:groups" },
+    jwt: { userId: "sub", email: "email", roles: "roles" },
+};
+const ALLOWED_ALGORITHMS = new Set([
+    "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384",
+    "EdDSA",
+]);
+/**
+ * Fill JWT defaults and reject configs that would generate an unsafe check.
+ * Only asymmetric algorithms are accepted: the key comes from the issuer's
+ * JWKS, so there is no shared secret to configure or leak.
+ */
+function resolveJwtAuth(auth) {
+    var _a, _b, _c, _d, _e, _f;
+    const issuer = (_b = (_a = auth.jwt) === null || _a === void 0 ? void 0 : _a.issuer) === null || _b === void 0 ? void 0 : _b.trim();
+    if (!issuer)
+        throw new Error(`auth.jwt.issuer is required for the "${auth.provider}" provider`);
+    const algorithms = ((_c = auth.jwt.algorithms) === null || _c === void 0 ? void 0 : _c.length)
+        ? auth.jwt.algorithms
+        : ["RS256"];
+    const bad = algorithms.filter((a) => !ALLOWED_ALGORITHMS.has(a));
+    if (bad.length > 0)
+        throw new Error(`auth.jwt.algorithms: ${bad.join(", ")} not supported; use ${[
+            ...ALLOWED_ALGORITHMS,
+        ].join(", ")}`);
+    const claims = { ...PROVIDER_CLAIMS[auth.provider], ...auth.claims };
+    return {
+        provider: auth.provider,
+        issuer,
+        audience: ((_d = auth.jwt.audience) === null || _d === void 0 ? void 0 : _d.trim()) || undefined,
+        jwksUri: ((_e = auth.jwt.jwksUri) === null || _e === void 0 ? void 0 : _e.trim()) ||
+            `${issuer.replace(/\/+$/, "")}/.well-known/jwks.json`,
+        algorithms,
+        authorizedParties: (_f = auth.jwt.authorizedParties) !== null && _f !== void 0 ? _f : [],
+        claims: { ...claims, userId: claims.userId || "sub" },
+    };
+}
+exports.resolveJwtAuth = resolveJwtAuth;
+/** Fill API key defaults. */
+function resolveApiKeyAuth(auth) {
+    return {
+        provider: "api-key",
+        apiKeyHeader: (auth.apiKeyHeader || exports.API_KEY_AUTH_DEFAULTS.apiKeyHeader).toLowerCase(),
+        apiKeyEntity: auth.apiKeyEntity || exports.API_KEY_AUTH_DEFAULTS.apiKeyEntity,
+        keyField: auth.keyField || exports.API_KEY_AUTH_DEFAULTS.keyField,
+        workspaceField: auth.workspaceField || "organizationId",
+        roleField: auth.roleField,
+    };
+}
+exports.resolveApiKeyAuth = resolveApiKeyAuth;

package/dist/lib/types/generator.d.ts

@@ -153,6 +153,11 @@ export interface ControllerGenerationOptions extends EntityGenerationOptions {
      * Relationship map for join queries
      */
     relationshipMap: RelationshipMap;
+    /**
+     * The .apsorc auth config; with scopeBy it limits every query to the
+     * caller's tenant
+     */
+    auth?: AuthConfig;
 }
 /**
  * Options for generating services
@@ -247,6 +252,7 @@ export interface LanguageGenerator {
     generateIndexModule(entities: Entity[], apiType: string, opts?: {
         emitEvents?: boolean;
         http?: boolean;
+        auth?: AuthConfig;
     }): Promise<GeneratedFile[]>;
     /**
      * Generate guard files (auth, scope, etc.)

package/dist/lib/types/index.d.ts

@@ -3,5 +3,5 @@ export { FieldType, Field, ComputedField } from "./field";
 export { Index } from "./indices";
 export { JSONValue } from "./json";
 export { RelationshipType, Association, ApsorcRelationship, Relationship, RelationshipForTemplate, RelationshipMap, } from "./relationship";
-export { AuthProviderType, BaseAuthConfig, DbSessionAuthConfig, JwtConfig, JwtClaimsMapping, JwtAuthConfig, ApiKeyAuthConfig, AuthConfig, AuthContext, DB_SESSION_AUTH_DEFAULTS, JWT_AUTH_DEFAULTS, API_KEY_AUTH_DEFAULTS, isDbSessionAuth, isJwtAuth, isApiKeyAuth, } from "./auth";
+export { AuthProviderType, BaseAuthConfig, DbSessionAuthConfig, JwtConfig, JwtClaimsMapping, JwtAuthConfig, ApiKeyAuthConfig, AuthConfig, AuthContext, DB_SESSION_AUTH_DEFAULTS, JWT_AUTH_DEFAULTS, API_KEY_AUTH_DEFAULTS, isDbSessionAuth, isJwtAuth, isApiKeyAuth, ResolvedJwtAuth, ResolvedApiKeyAuth, resolveJwtAuth, resolveApiKeyAuth, } from "./auth";
 export { TargetLanguage, GeneratedFile, ValidationResult, PythonLanguageConfig, GoLanguageConfig, TypeScriptLanguageConfig, LanguageConfig, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, LanguageGenerator, GeneratorFactory, GeneratorRegistry, } from "./generator";

package/dist/lib/types/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isApiKeyAuth = exports.isJwtAuth = exports.isDbSessionAuth = exports.API_KEY_AUTH_DEFAULTS = exports.JWT_AUTH_DEFAULTS = exports.DB_SESSION_AUTH_DEFAULTS = void 0;
+exports.resolveApiKeyAuth = exports.resolveJwtAuth = exports.isApiKeyAuth = exports.isJwtAuth = exports.isDbSessionAuth = exports.API_KEY_AUTH_DEFAULTS = exports.JWT_AUTH_DEFAULTS = exports.DB_SESSION_AUTH_DEFAULTS = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "DB_SESSION_AUTH_DEFAULTS", { enumerable: true, get: function () { return auth_1.DB_SESSION_AUTH_DEFAULTS; } });
 Object.defineProperty(exports, "JWT_AUTH_DEFAULTS", { enumerable: true, get: function () { return auth_1.JWT_AUTH_DEFAULTS; } });
@@ -8,3 +8,5 @@ Object.defineProperty(exports, "API_KEY_AUTH_DEFAULTS", { enumerable: true, get:
 Object.defineProperty(exports, "isDbSessionAuth", { enumerable: true, get: function () { return auth_1.isDbSessionAuth; } });
 Object.defineProperty(exports, "isJwtAuth", { enumerable: true, get: function () { return auth_1.isJwtAuth; } });
 Object.defineProperty(exports, "isApiKeyAuth", { enumerable: true, get: function () { return auth_1.isApiKeyAuth; } });
+Object.defineProperty(exports, "resolveJwtAuth", { enumerable: true, get: function () { return auth_1.resolveJwtAuth; } });
+Object.defineProperty(exports, "resolveApiKeyAuth", { enumerable: true, get: function () { return auth_1.resolveApiKeyAuth; } });

package/dist/lib/utils/crud-deps.d.ts

@@ -24,3 +24,16 @@ export declare function ensureCrudDeps(projectDir: string): string[];
  * @returns {string[]} Names added (empty when nothing changed or no package.json).
  */
 export declare function addMissingDeps(projectDir: string, deps: Record<string, string>): string[];
+/** JWT verification library the generated TypeScript JWT guard imports. */
+export declare const JOSE_DEP: Record<string, string>;
+/** JWT verification library the generated Python auth module imports. */
+export declare const PYJWT_DEP = "PyJWT[crypto]>=2.8.0";
+/**
+ * Add a requirement to pyproject.toml's [project] dependencies list unless a
+ * requirement for the same package is already there.
+ *
+ * @param {string} projectDir - Directory holding pyproject.toml.
+ * @param {string} requirement - A PEP 508 requirement, e.g. "PyJWT[crypto]>=2.8.0".
+ * @returns {boolean} True when pyproject.toml was changed.
+ */
+export declare function addMissingPythonDep(projectDir: string, requirement: string): boolean;

package/dist/lib/utils/crud-deps.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.addMissingDeps = exports.ensureCrudDeps = exports.APSO_CRUD_DEPS = void 0;
+exports.addMissingPythonDep = exports.PYJWT_DEP = exports.JOSE_DEP = exports.addMissingDeps = exports.ensureCrudDeps = exports.APSO_CRUD_DEPS = void 0;
 const tslib_1 = require("tslib");
 const fs = tslib_1.__importStar(require("fs"));
 const path = tslib_1.__importStar(require("path"));
@@ -56,3 +56,39 @@ function addMissingDeps(projectDir, deps) {
     return missing;
 }
 exports.addMissingDeps = addMissingDeps;
+/** JWT verification library the generated TypeScript JWT guard imports. */
+exports.JOSE_DEP = { jose: "^5.10.0" };
+/** JWT verification library the generated Python auth module imports. */
+exports.PYJWT_DEP = "PyJWT[crypto]>=2.8.0";
+/**
+ * Add a requirement to pyproject.toml's [project] dependencies list unless a
+ * requirement for the same package is already there.
+ *
+ * @param {string} projectDir - Directory holding pyproject.toml.
+ * @param {string} requirement - A PEP 508 requirement, e.g. "PyJWT[crypto]>=2.8.0".
+ * @returns {boolean} True when pyproject.toml was changed.
+ */
+function addMissingPythonDep(projectDir, requirement) {
+    var _a;
+    const file = path.join(projectDir, "pyproject.toml");
+    if (!fs.existsSync(file))
+        return false;
+    const text = fs.readFileSync(file, "utf8");
+    const name = requirement.split(/[ !<=>[~]/)[0].toLowerCase();
+    // The list's closing bracket sits on its own line, or ends a one-line list;
+    // brackets inside requirements ("uvicorn[standard]") are not the end.
+    const list = (_a = /^dependencies\s*=\s*\[(.*)][^\S\n]*$/m.exec(text)) !== null && _a !== void 0 ? _a : /^dependencies\s*=\s*\[([\S\s]*?)^]/m.exec(text);
+    if (!list)
+        return false;
+    const declared = [...list[1].matchAll(/["']([^"']+)["']/g)].map((m) => m[1].split(/[ !<=>[~]/)[0].toLowerCase());
+    if (declared.includes(name))
+        return false;
+    const body = list[1].replace(/\s*$/, "");
+    const sep = body.trim() === "" || body.trim().endsWith(",") ? "" : ",";
+    const updated = text.slice(0, list.index) +
+        `dependencies = [${body}${sep}\n    "${requirement}",\n]` +
+        text.slice(list.index + list[0].length);
+    fs.writeFileSync(file, updated);
+    return true;
+}
+exports.addMissingPythonDep = addMissingPythonDep;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@apso/cli",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@apso/cli",
-      "version": "0.44.0",
+      "version": "0.45.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@apso/schema-tools": "^0.2.0",

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.44.0",
+  "version": "0.45.0",
   "commands": {
     "config": {
       "id": "config",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apso/cli",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "mcpName": "io.github.apsoai/apso",
   "description": "Apso CLI",
   "author": "Apso by Mavric - @mavric",