@decohere/scaffold 0.0.1-dev.125 → 0.0.1-dev.18

package/commonjs/src/webapi/features/auth.feature.js

@@ -1,408 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "AuthFeature", {
-    enumerable: true,
-    get: function() {
-        return AuthFeature;
-    }
-});
-const _prompt = require("../../domain/prompt.js");
-const _const = require("../../models/const.js");
-const _auth0commands = require("../auth0-commands.js");
-const _authconfigmodel = require("../models/auth-config.model.js");
-const _controllersourcefilemodel = require("../models/controller-source-file.model.js");
-const _auth0cli = /*#__PURE__*/ _interop_require_wildcard(require("./auth0-cli.js"));
-function _getRequireWildcardCache(nodeInterop) {
-    if (typeof WeakMap !== "function") return null;
-    var cacheBabelInterop = new WeakMap();
-    var cacheNodeInterop = new WeakMap();
-    return (_getRequireWildcardCache = function(nodeInterop) {
-        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
-    })(nodeInterop);
-}
-function _interop_require_wildcard(obj, nodeInterop) {
-    if (!nodeInterop && obj && obj.__esModule) {
-        return obj;
-    }
-    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
-        return {
-            default: obj
-        };
-    }
-    var cache = _getRequireWildcardCache(nodeInterop);
-    if (cache && cache.has(obj)) {
-        return cache.get(obj);
-    }
-    var newObj = {
-        __proto__: null
-    };
-    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
-    for(var key in obj){
-        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
-            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
-            if (desc && (desc.get || desc.set)) {
-                Object.defineProperty(newObj, key, desc);
-            } else {
-                newObj[key] = obj[key];
-            }
-        }
-    }
-    newObj.default = obj;
-    if (cache) {
-        cache.set(obj, newObj);
-    }
-    return newObj;
-}
-const ADMIN_ROLE = "admin";
-const USER_ENTITY_TS = `import { Column, Entity, PrimaryGeneratedColumn } from "typeorm";
-import type { Entity as IEntity } from "@decohere/data";
-
-@Entity()
-export class UserEntity implements IEntity {
-\t@PrimaryGeneratedColumn()
-\tpublic id!: number;
-
-\t@Column({ unique: true })
-\tpublic sub!: string;
-
-\t@Column({ type: "varchar", nullable: true })
-\tpublic email!: string | null;
-
-\t@Column()
-\tpublic displayName!: string;
-
-\t/** App-owned roles. The \`admin\` role grants CASL \`manage\`/\`all\` (wildcard). */
-\t@Column({ type: "simple-json", default: "[]" })
-\tpublic roles!: string[];
-}
-`;
-const USER_REPOSITORY_TS = `import { injectable } from "@decohere/crucible/decorators";
-import { injectUnitOfWork } from "@decohere/data";
-import { TypeOrmRepository, TypeOrmUnitOfWork } from "@decohere/data-typeorm";
-import { UserEntity } from "../entities/user.entity.js";
-
-@injectable()
-export class UserEntityRepository extends TypeOrmRepository<UserEntity> {
-\tpublic constructor(@injectUnitOfWork() unitOfWork: TypeOrmUnitOfWork) {
-\t\tsuper(unitOfWork, UserEntity);
-\t}
-
-\tpublic findBySub(sub: string): Promise<UserEntity | null> {
-\t\treturn this.firstOrDefault({ where: { sub } });
-\t}
-}
-`;
-const USER_SERVICE_TS = `import { injectable } from "@decohere/crucible/decorators";
-import type { Principal } from "@decohere/http";
-import { UserEntity } from "../entities/user.entity.js";
-import { UserEntityRepository } from "../repositories/user.repository.js";
-
-function claimString(principal: Principal | undefined, key: string): string | undefined {
-\tconst value = principal?.[key];
-\treturn typeof value === "string" && value.length > 0 ? value : undefined;
-}
-
-@injectable()
-export class UserService {
-\tpublic constructor(private readonly users: UserEntityRepository) {}
-
-\t/**
-\t * Upsert a local profile keyed by JWT \`sub\`.
-\t * Profile fields from the token fill gaps; seeded rows keep displayName/email/roles.
-\t */
-\tpublic async ensureFromPrincipal(principal: Principal | undefined): Promise<UserEntity> {
-\t\tconst sub = principal?.sub;
-\t\tif (!sub) {
-\t\t\tthrow new Error("Authenticated request is missing principal.sub");
-\t\t}
-
-\t\tconst email =
-\t\t\tclaimString(principal, "email") ?? claimString(principal, "preferred_username");
-\t\tconst displayFromToken =
-\t\t\tclaimString(principal, "name") ??
-\t\t\tclaimString(principal, "nickname") ??
-\t\t\temail;
-
-\t\tconst existing = await this.users.findBySub(sub);
-\t\tif (existing) {
-\t\t\tlet dirty = false;
-\t\t\tif (!existing.email && email) {
-\t\t\t\texisting.email = email;
-\t\t\t\tdirty = true;
-\t\t\t}
-\t\t\tif (existing.displayName === existing.sub && displayFromToken) {
-\t\t\t\texisting.displayName = displayFromToken;
-\t\t\t\tdirty = true;
-\t\t\t}
-\t\t\treturn dirty ? this.users.save(existing) : existing;
-\t\t}
-
-\t\tconst created = new UserEntity();
-\t\tcreated.sub = sub;
-\t\tcreated.email = email ?? null;
-\t\tcreated.displayName = displayFromToken ?? sub;
-\t\tcreated.roles = Array.isArray(principal.roles)
-\t\t\t? principal.roles.filter((r): r is string => typeof r === "string")
-\t\t\t: [];
-\t\treturn this.users.save(created);
-\t}
-}
-`;
-const ABILITY_FACTORY_TS = `import type { Principal } from "@decohere/http";
-import {
-\tADMIN_ROLE,
-\tcreatePrincipalFromPayload,
-\tdefineAbilitiesFor as defaultDefineAbilitiesFor,
-} from "@decohere/http";
-
-/**
- * Customize CASL authorization here (product-specific rules).
- *
- * Default delegates to \`@decohere/http\`: \`admin\` role → \`manage\`/\`all\`; IdP scopes
- * (\`action:Subject\`) → abilities. Replace the body when you need app rules
- * beyond that — this file is the intentional extension point, not framework
- * infrastructure to copy.
- */
-export function defineAbilitiesFor(principal: Principal) {
-\treturn defaultDefineAbilitiesFor(principal);
-}
-
-/**
- * Customize JWT → Principal mapping here (IdP-specific claims).
- *
- * Elevates \`AUTH0_ADMIN_USER_SUB\` to the admin role so the seeded admin works
- * before/without roles on the access token.
- */
-export function mapPrincipal(payload: Record<string, unknown>): Principal {
-\tconst principal = createPrincipalFromPayload(payload);
-\tconst sub = principal.sub;
-\tif (sub && sub === process.env.AUTH0_ADMIN_USER_SUB) {
-\t\treturn {
-\t\t\t...principal,
-\t\t\troles: [...new Set([ADMIN_ROLE, ...(principal.roles ?? [])])],
-\t\t};
-\t}
-\treturn principal;
-}
-`;
-async function getOptions(workspace, cliOptions) {
-    if (cliOptions.authProvider === "auth0" && !cliOptions.issuerBaseUrl) {
-        return getAuth0Options(workspace, cliOptions);
-    }
-    if (cliOptions.authProvider != null) return {};
-    const choices = [
-        {
-            label: "none"
-        },
-        {
-            label: "auth0"
-        }
-    ];
-    const selected = await (0, _prompt.pick)("\n  Auth provider: ", choices, (c)=>c.label);
-    const provider = selected?.label ?? "none";
-    if (provider !== "auth0") return {
-        authProvider: "none"
-    };
-    return getAuth0Options(workspace, cliOptions);
-}
-async function getAuth0Options(workspace, cliOptions) {
-    const active = (0, _auth0commands.ensureLoggedIn)();
-    const issuerBaseUrl = `https://${active.name}`;
-    console.log(`\n  ✓ Auth0 tenant: ${issuerBaseUrl}`);
-    process.stdout.write("\n  Fetching Auth0 APIs...");
-    const userApis = _auth0cli.listApis().filter((a)=>!a.name.includes("Management API"));
-    process.stdout.write(` found ${userApis.length}.\n`);
-    const projectName = workspace.name;
-    const apiChoices = [
-        {
-            label: `<new> https://api.${projectName}`,
-            existing: null
-        },
-        ...userApis.map((a)=>({
-                label: `${a.name} — ${a.identifier}`,
-                existing: a.identifier
-            }))
-    ];
-    const apiSelected = await (0, _prompt.pick)("\n  Select Auth0 API: ", apiChoices, (c)=>c.label);
-    let audience;
-    if (!apiSelected || apiSelected.existing === null) {
-        const defaultId = `https://api.${projectName}`;
-        audience = await (0, _prompt.ask)(`  API Identifier [${defaultId}]: `, defaultId);
-        console.log("\n  Creating Auth0 API...");
-        audience = _auth0cli.createApi(`${projectName} API`, audience).identifier;
-        console.log(`  \u2713 API created: ${audience}`);
-    } else {
-        audience = apiSelected.existing;
-        console.log(`  \u2713 Selected: ${audience}`);
-        try {
-            _auth0cli.updateApiScopes(audience);
-            console.log(`  \u2713 API scopes ensured (${_auth0cli.HELLO_API_SCOPES.join(", ")})`);
-        } catch  {
-            console.error("  ✗ Failed to update API scopes — add Hello scopes in the Auth0 dashboard.");
-        }
-    }
-    const withLocalUsers = cliOptions.databaseProvider === "postgres/typeorm";
-    let adminUsername;
-    let adminPassword;
-    if (withLocalUsers) {
-        adminUsername = cliOptions.adminUsername ?? await (0, _prompt.ask)("\n  Admin username [admin]: ", "admin");
-        adminPassword = cliOptions.adminPassword;
-        if (adminPassword == null) {
-            adminPassword = await (0, _prompt.ask)("  Admin password (leave blank to generate): ");
-            if (!adminPassword) {
-                adminPassword = _auth0cli.generateAdminPassword();
-                console.log(`  ✓ Generated admin password (written to .env): ${adminPassword}`);
-            }
-        }
-    }
-    return {
-        authProvider: "auth0",
-        issuerBaseUrl,
-        audience,
-        ...withLocalUsers ? {
-            adminUsername,
-            adminPassword
-        } : {}
-    };
-}
-function adminEmail(workspaceName, username) {
-    if (username.includes("@")) return username;
-    const slug = workspaceName.toLowerCase().replace(/[^a-z0-9-]/g, "-");
-    return `${username}@${slug}.example.com`;
-}
-function createAuth0AdminUser(workspace, options, authConfig) {
-    const username = options.adminUsername ?? "admin";
-    const password = options.adminPassword;
-    if (!password) return;
-    const email = adminEmail(workspace.name, username);
-    try {
-        const admin = _auth0cli.createAdminDatabaseUser({
-            email,
-            password,
-            username
-        });
-        authConfig.setAdminUser({
-            sub: admin.user_id,
-            email: admin.email,
-            password: admin.password,
-            username: admin.username
-        });
-        workspace.getModel(_const.WELL_KNOWN_FILES.ENV_FILE)?.addEntry("AUTH0_ADMIN_USER_SUB", admin.user_id).addEntry("AUTH0_ADMIN_USER_EMAIL", admin.email).addEntry("AUTH0_ADMIN_USER_PASSWORD", admin.password).addEntry("AUTH0_ADMIN_USERNAME", admin.username);
-        console.log(`  ✓ Auth0 admin user ready: ${admin.email} (role: ${ADMIN_ROLE})`);
-        console.log(`    Login with EMAIL (not username): ${admin.email}`);
-        console.log(`    Password: see AUTH0_ADMIN_USER_PASSWORD in .env`);
-    } catch (err) {
-        console.error(`  ✗ Failed to ensure Auth0 admin user (${email}): ${err instanceof Error ? err.message : err}`);
-    }
-}
-function scaffoldLocalUserProfile(workspace) {
-    for (const project of workspace.getProjects()){
-        project.getModel(_const.WELL_KNOWN_FILES.MAIN_TS)?.addEntity({
-            className: "UserEntity",
-            importPath: "./entities/user.entity.js"
-        }).addRepository({
-            className: "UserEntityRepository",
-            importPath: "./repositories/user.repository.js"
-        }).addService({
-            className: "UserService",
-            importPath: "./services/user.service.js",
-            scope: "request"
-        }).addImport("defineAbilitiesFor", "./auth/ability.factory.js").addImport("mapPrincipal", "./auth/ability.factory.js").setTypeOrmSeed([
-            "const sub = process.env.AUTH0_ADMIN_USER_SUB;",
-            "if (!sub) return;",
-            "const repo = dataSource.getRepository(UserEntity);",
-            "const existing = await repo.findOne({ where: { sub } });",
-            "if (existing) return;",
-            "await repo.save(repo.create({",
-            "  sub,",
-            "  email: process.env.AUTH0_ADMIN_USER_EMAIL ?? null,",
-            '  displayName: process.env.AUTH0_ADMIN_USERNAME ?? "admin",',
-            '  roles: ["admin"],',
-            "}));"
-        ].join(" "));
-        project.addFile({
-            files: ()=>[
-                    {
-                        filePath: "src/entities/user.entity.ts",
-                        content: USER_ENTITY_TS
-                    },
-                    {
-                        filePath: "src/repositories/user.repository.ts",
-                        content: USER_REPOSITORY_TS
-                    },
-                    {
-                        filePath: "src/services/user.service.ts",
-                        content: USER_SERVICE_TS
-                    },
-                    {
-                        filePath: "src/auth/ability.factory.ts",
-                        content: ABILITY_FACTORY_TS
-                    }
-                ]
-        });
-    }
-    for (const controller of workspace.getModels(_controllersourcefilemodel.ControllerSourceFile)){
-        controller.addImport("UserService", "../services/user.service.js").addImport("inject", "@decohere/crucible/decorators").addConstructorParam("@inject(UserService) private readonly users: UserService");
-        controller.getMethod("getOne").setAsync(true).setBody([
-            "const user = await this.users.ensureFromPrincipal(this.principalProvider.currentPrincipal);",
-            "return { id, message: `Hello ${user.displayName}!`, username: user.displayName };"
-        ]);
-    }
-}
-function scaffold(workspace, options) {
-    if (options.authProvider !== "auth0") return;
-    const resource = "Hello";
-    const withLocalUsers = options.databaseProvider === "postgres/typeorm";
-    for (const controller of workspace.getModels(_controllersourcefilemodel.ControllerSourceFile)){
-        controller.addDecorator(`@Authorize("read", "${resource}")`).addCortexImport("AllowAnonymous").addCortexImport("Authorize").addCortexImport("IPrincipalProviderToken").addCortexImport("IPrincipalProvider", true).addImport("inject", "@decohere/crucible/decorators").addConstructorParam(`@inject(IPrincipalProviderToken) private readonly principalProvider: IPrincipalProvider`);
-        controller.getMethod("getAll").addDecorator("@AllowAnonymous()");
-        if (!withLocalUsers) {
-            controller.getMethod("getOne").setBody([
-                "const principal = this.principalProvider.currentPrincipal;",
-                "const username =",
-                '\t(typeof principal?.name === "string" && principal.name) ||',
-                '\t(typeof principal?.nickname === "string" && principal.nickname) ||',
-                '\t(typeof principal?.email === "string" && principal.email) ||',
-                '\t(typeof principal?.preferred_username === "string" && principal.preferred_username) ||',
-                "\tprincipal?.sub ||",
-                '\t"unknown";',
-                "return { id, message: `Hello ${username}!`, username };"
-            ]);
-        }
-        controller.getMethod("create").addDecorator(`@Authorize("create", "${resource}")`);
-        controller.getMethod("update").addDecorator(`@Authorize("update", "${resource}")`);
-        controller.getMethod("remove").addDecorator(`@Authorize("delete", "${resource}")`);
-    }
-    for (const project of workspace.getProjects()){
-        project.getModel(_const.WELL_KNOWN_FILES.MAIN_TS)?.addSideEffectImport("@decohere/http/auth");
-    }
-    if (withLocalUsers) {
-        scaffoldLocalUserProfile(workspace);
-        for (const project of workspace.getProjects()){
-            project.getModel(_const.WELL_KNOWN_FILES.MAIN_TS)?.addBuilderCall(".withAuth(defineAbilitiesFor, { principalMapper: mapPrincipal })");
-        }
-    } else {
-        for (const project of workspace.getProjects()){
-            project.getModel(_const.WELL_KNOWN_FILES.MAIN_TS)?.addBuilderCall(".withAuth()");
-        }
-    }
-    const issuerPlaceholder = "${AUTH0_ISSUER_BASE_URL}";
-    const audPlaceholder = "${AUTH0_AUDIENCE}";
-    const configSection = `auth:\n  discoveryUrl: ${issuerPlaceholder}\n  audience: ${audPlaceholder}\n`;
-    workspace.getModel(_const.WELL_KNOWN_FILES.CONFIG_YAML)?.addSection(configSection);
-    workspace.getModel(_const.WELL_KNOWN_FILES.ENV_FILE)?.addEntry("AUTH0_ISSUER_BASE_URL", options.issuerBaseUrl ?? "").addEntry("AUTH0_AUDIENCE", options.audience ?? "");
-    const authConfig = new _authconfigmodel.AuthConfigModel({
-        issuerBaseUrl: options.issuerBaseUrl ?? "",
-        audience: options.audience ?? ""
-    });
-    workspace.addModel(authConfig);
-    if (withLocalUsers && options.adminPassword) {
-        createAuth0AdminUser(workspace, options, authConfig);
-    }
-}
-const AuthFeature = {
-    getOptions,
-    scaffold
-};