@decohere/scaffold 0.0.1-dev.126 → 0.0.1-dev.80

package/commonjs/src/webapi/authorize-scopes.js

@@ -1,79 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get OIDC_SCOPES () {
-        return OIDC_SCOPES;
-    },
-    get discoverAuthorizeScopes () {
-        return discoverAuthorizeScopes;
-    },
-    get mergeApiScopes () {
-        return mergeApiScopes;
-    },
-    get postmanRequestedScopes () {
-        return postmanRequestedScopes;
-    }
-});
-const _nodefs = require("node:fs");
-const _nodepath = require("node:path");
-const _apiname = require("./api-name.js");
-const OIDC_SCOPES = [
-    "openid",
-    "profile",
-    "email"
-];
-const AUTHORIZE_RE = /@Authorize\(\s*(["'])([^"']+)\1(?:\s*,\s*(["'])([^"']+)\3)?\s*\)/g;
-function isAppSource(fileName) {
-    return fileName.endsWith(".ts") && !fileName.endsWith(".spec.ts") && !fileName.endsWith(".test.ts") && !fileName.endsWith(".d.ts");
-}
-function discoverAuthorizeScopes(rootDir) {
-    const scopes = new Set();
-    for (const apiName of (0, _apiname.listExistingApiNames)(rootDir)){
-        collectFromDir((0, _nodepath.join)(rootDir, "projects", apiName, "src"), scopes);
-    }
-    return [
-        ...scopes
-    ].sort();
-}
-function collectFromDir(dir, scopes) {
-    if (!(0, _nodefs.existsSync)(dir)) return;
-    for (const entry of (0, _nodefs.readdirSync)(dir, {
-        withFileTypes: true
-    })){
-        const path = (0, _nodepath.join)(dir, entry.name);
-        if (entry.isDirectory()) {
-            collectFromDir(path, scopes);
-            continue;
-        }
-        if (!entry.isFile() || !isAppSource(entry.name)) continue;
-        const text = (0, _nodefs.readFileSync)(path, "utf8");
-        for (const match of text.matchAll(AUTHORIZE_RE)){
-            const action = match[2];
-            if (action == null || action === "") continue;
-            const subject = match[4] ?? "all";
-            scopes.add(`${action}:${subject}`);
-        }
-    }
-}
-function mergeApiScopes(discovered, existing) {
-    return [
-        ...new Set([
-            ...existing,
-            ...discovered
-        ])
-    ].sort();
-}
-function postmanRequestedScopes(apiScopes) {
-    return [
-        ...OIDC_SCOPES,
-        ...apiScopes
-    ].join(" ");
-}

package/es6/src/auth0-configure.action.js

@@ -1,18 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-import { injectable } from "@decohere/crucible/decorators";
-import { ActionResponse } from "@decohere/devkit/cli";
-import { runAuth0Configure } from "./webapi/auth0-commands.js";
-export class Auth0ConfigureAction {
-    async run(options) {
-        runAuth0Configure(typeof options.d === "string" ? options.d : ".");
-        return ActionResponse.Success("configure");
-    }
-}
-Auth0ConfigureAction = _ts_decorate([
-    injectable()
-], Auth0ConfigureAction);

package/es6/src/auth0-configure.command.js

@@ -1,14 +0,0 @@
-import { DecohereCommand } from "@decohere/devkit/cli";
-import { Auth0ConfigureAction } from "./auth0-configure.action.js";
-export class Auth0ConfigureCommand extends DecohereCommand {
-    get actions() {
-        return [
-            Auth0ConfigureAction
-        ];
-    }
-    constructor(name){
-        super(name);
-        this.description("Update Auth0 API permissions and Postman SPA from @Authorize in this workspace");
-        this.option("-d <directory>", "Workspace directory (default: current directory)", ".");
-    }
-}

package/es6/src/auth0-login.action.js

@@ -1,18 +0,0 @@
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-import { injectable } from "@decohere/crucible/decorators";
-import { ActionResponse } from "@decohere/devkit/cli";
-import { runAuth0Login } from "./webapi/auth0-commands.js";
-export class Auth0LoginAction {
-    async run() {
-        runAuth0Login();
-        return ActionResponse.Success("login");
-    }
-}
-Auth0LoginAction = _ts_decorate([
-    injectable()
-], Auth0LoginAction);

package/es6/src/auth0-login.command.js

@@ -1,13 +0,0 @@
-import { DecohereCommand } from "@decohere/devkit/cli";
-import { Auth0LoginAction } from "./auth0-login.action.js";
-export class Auth0LoginCommand extends DecohereCommand {
-    get actions() {
-        return [
-            Auth0LoginAction
-        ];
-    }
-    constructor(name){
-        super(name);
-        this.description("Authenticate the Auth0 CLI (device URL; tokens persist on the host)");
-    }
-}

package/es6/src/auth0.command.js

@@ -1,12 +0,0 @@
-import { DecohereCommand } from "@decohere/devkit/cli";
-export class Auth0Command extends DecohereCommand {
-    constructor(commands, handler){
-        super(Auth0Command);
-        this.description("Log in to Auth0 and update a scaffolded client");
-        this.exitOverride();
-        this.registerSubcommand(commands, handler);
-    }
-    run(_actions, _options) {
-        return this.help();
-    }
-}

package/es6/src/auth0.module.js

@@ -1,18 +0,0 @@
-import { ModuleManifest } from "@decohere/devkit/cli";
-import { Auth0Command } from "./auth0.command.js";
-import { Auth0ConfigureAction } from "./auth0-configure.action.js";
-import { Auth0ConfigureCommand } from "./auth0-configure.command.js";
-import { Auth0LoginAction } from "./auth0-login.action.js";
-import { Auth0LoginCommand } from "./auth0-login.command.js";
-export class Auth0Module extends ModuleManifest {
-    id = "auth0";
-    command = Auth0Command;
-    commands = {
-        login: Auth0LoginCommand,
-        configure: Auth0ConfigureCommand
-    };
-    actions = {
-        login: Auth0LoginAction,
-        configure: Auth0ConfigureAction
-    };
-}

package/es6/src/webapi/auth0-commands.js

@@ -1,185 +0,0 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, join, resolve } from "node:path";
-import { CreateCliError, isDecohereWorkspace } from "./api-name.js";
-import { discoverAuthorizeScopes, mergeApiScopes, postmanRequestedScopes } from "./authorize-scopes.js";
-import * as auth0Cli from "./features/auth0-cli.js";
-/** Same Postman OAuth callbacks as `PostmanFeature`. */ const POSTMAN_CALLBACKS = [
-    "https://oauth.pstmn.io/v1/callback",
-    "https://oauth.pstmn.io/v1/browser-callback"
-];
-const SPA_SUFFIX = " Postman";
-export const AUTH0_CLI_INSTALL_MESSAGE = "The Auth0 CLI is required.\n" + "  It is bundled in the Decohere create image (`npx @decohere/create auth0 login`).\n" + "  Host install: brew install auth0/auth0-cli/auth0\n" + "  Or visit: https://github.com/auth0/auth0-cli";
-function fail(message) {
-    throw new CreateCliError(message);
-}
-/** Throw if the `auth0` binary is missing. */ export function requireInstalled() {
-    if (auth0Cli.isInstalled()) return;
-    fail(AUTH0_CLI_INSTALL_MESSAGE);
-}
-/**
- * Log in when there is no tenant session or the Management API token is expired.
- * Returns the active tenant.
- */ export function ensureLoggedIn() {
-    requireInstalled();
-    process.stdout.write("\n  Checking Auth0 credentials...");
-    let tenants = auth0Cli.listTenants();
-    if (tenants.length === 0) {
-        process.stdout.write(" not logged in.\n");
-        console.log("  Logging in to Auth0 (open the URL in your browser)...");
-        if (!auth0Cli.login()) fail("Auth0 login failed.");
-        tenants = auth0Cli.listTenants();
-    }
-    try {
-        auth0Cli.listApis();
-        process.stdout.write(" ok.\n");
-    } catch (err) {
-        if (err instanceof auth0Cli.Auth0AuthError) {
-            process.stdout.write(" token expired.\n");
-            console.log("  Re-authenticating (open the URL in your browser)...");
-            if (!auth0Cli.login()) fail("Auth0 login failed.");
-            tenants = auth0Cli.listTenants();
-        }
-    }
-    const active = tenants.find((t)=>t.active) ?? tenants[0];
-    if (active == null) fail("No Auth0 tenant after login.");
-    return active;
-}
-export function runAuth0Login() {
-    requireInstalled();
-    console.log("  Logging in to Auth0 (open the URL in your browser)...");
-    if (!auth0Cli.login()) fail("Auth0 login failed.");
-    const tenants = auth0Cli.listTenants();
-    const active = tenants.find((t)=>t.active) ?? tenants[0];
-    if (active == null) fail("No Auth0 tenant after login.");
-    console.log(`\n  ✓ Auth0 tenant: https://${active.name}`);
-    console.log("    Tokens are stored in ~/.config/auth0 (mounted into the create image).");
-    console.log("    Next: npx @decohere/create auth0 configure");
-}
-export function runAuth0Configure(directory = ".") {
-    const targetDir = resolve(directory);
-    if (!isDecohereWorkspace(targetDir)) {
-        throw new CreateCliError(`Not a Decohere workspace: ${targetDir}. Scaffold one first with \`npx @decohere/create webapi\`.`);
-    }
-    const active = ensureLoggedIn();
-    const issuerBaseUrl = `https://${active.name}`;
-    const projectName = process.env.DECOHERE_PROJECT_NAME?.trim() || basename(targetDir);
-    const envPath = join(targetDir, ".env");
-    const existing = readEnvFile(envPath);
-    const existingAudience = existing.AUTH0_AUDIENCE?.trim();
-    const discovered = discoverAuthorizeScopes(targetDir);
-    let existingScopes = [];
-    if (existingAudience) {
-        try {
-            existingScopes = auth0Cli.listApiScopes(existingAudience);
-        } catch (err) {
-            if (err instanceof auth0Cli.Auth0AuthError) throw err;
-        }
-    }
-    const apiScopes = resolveApiScopes(discovered, existingScopes);
-    console.log(discovered.length > 0 ? `  ✓ Scanned @Authorize — ${discovered.length} scope(s) from controllers` : "  ✓ No @Authorize in projects/*/src — keeping existing / Hello scopes");
-    let audience = existingAudience;
-    if (audience) {
-        try {
-            auth0Cli.updateApiScopes(audience, apiScopes);
-            console.log(`  ✓ API scopes ensured (${apiScopes.join(", ")})`);
-        } catch (err) {
-            console.error(`  ✗ Failed to update API scopes: ${err instanceof Error ? err.message : err}`);
-        }
-    } else {
-        const identifier = `https://api.${projectName}`;
-        console.log(`\n  Creating Auth0 API ${identifier}...`);
-        audience = auth0Cli.createApi(`${projectName} API`, identifier, apiScopes).identifier;
-        console.log(`  ✓ API created: ${audience}`);
-    }
-    const appName = `${projectName}${SPA_SUFFIX}`;
-    const app = auth0Cli.ensureSpaApp(appName, [
-        ...POSTMAN_CALLBACKS
-    ]);
-    console.log(app.reused ? `  ✓ Reusing Auth0 SPA app (${app.client_id})` : `  ✓ Auth0 SPA app created (${app.client_id})`);
-    try {
-        auth0Cli.enableConnectionForClient(auth0Cli.DB_CONNECTION_NAME, app.client_id);
-        console.log(`  ✓ Enabled ${auth0Cli.DB_CONNECTION_NAME} on SPA`);
-    } catch (err) {
-        console.error(`  ✗ Failed to enable DB connection on SPA: ${err instanceof Error ? err.message : err}`);
-    }
-    upsertEnv(envPath, {
-        AUTH0_ISSUER_BASE_URL: issuerBaseUrl,
-        AUTH0_AUDIENCE: audience
-    });
-    console.log(`  ✓ Wrote AUTH0_ISSUER_BASE_URL and AUTH0_AUDIENCE to .env`);
-    const adminSub = existing.AUTH0_ADMIN_USER_SUB?.trim();
-    if (adminSub) {
-        try {
-            auth0Cli.assignUserPermissions(adminSub, audience, apiScopes);
-            console.log(`  ✓ Assigned ${apiScopes.length} API permission(s) to admin user`);
-        } catch (err) {
-            console.error(`  ✗ Failed to assign admin permissions: ${err instanceof Error ? err.message : err}`);
-        }
-    }
-    const domain = issuerBaseUrl.replace(/^https?:\/\//, "");
-    patchPostmanAuth(targetDir, projectName, {
-        domain,
-        audience,
-        clientId: app.client_id,
-        scopes: postmanRequestedScopes(apiScopes)
-    });
-}
-function readEnvFile(path) {
-    if (!existsSync(path)) return {};
-    const out = {};
-    for (const line of readFileSync(path, "utf8").split("\n")){
-        const trimmed = line.trim();
-        if (trimmed === "" || trimmed.startsWith("#")) continue;
-        const eq = line.indexOf("=");
-        if (eq <= 0) continue;
-        out[line.slice(0, eq).trim()] = line.slice(eq + 1);
-    }
-    return out;
-}
-function resolveApiScopes(discovered, existing) {
-    const merged = mergeApiScopes(discovered, existing);
-    return merged.length > 0 ? merged : [
-        ...auth0Cli.HELLO_API_SCOPES
-    ].sort();
-}
-function upsertEnv(path, entries) {
-    let text = existsSync(path) ? readFileSync(path, "utf8") : "";
-    for (const [key, value] of Object.entries(entries)){
-        const re = new RegExp(`^${key}=.*$`, "m");
-        if (re.test(text)) {
-            text = text.replace(re, `${key}=${value}`);
-        } else {
-            text = `${text}${text === "" || text.endsWith("\n") ? "" : "\n"}${key}=${value}\n`;
-        }
-    }
-    if (text !== "" && !text.endsWith("\n")) text = `${text}\n`;
-    writeFileSync(path, text);
-}
-function patchPostmanAuth(targetDir, projectName, auth) {
-    const envYaml = join(targetDir, "postman/environments", `${projectName}-Local.environment.yaml`);
-    if (existsSync(envYaml)) {
-        let yaml = readFileSync(envYaml, "utf8");
-        yaml = replaceYamlKeyedValue(yaml, "auth0Domain", auth.domain);
-        yaml = replaceYamlKeyedValue(yaml, "auth0Audience", auth.audience);
-        yaml = replaceYamlKeyedValue(yaml, "auth0ClientId", auth.clientId);
-        yaml = replaceYamlKeyedValue(yaml, "authUrl", `https://${auth.domain}/authorize?audience=${auth.audience}`);
-        yaml = replaceYamlKeyedValue(yaml, "accessTokenUrl", `https://${auth.domain}/oauth/token`);
-        yaml = replaceYamlKeyedValue(yaml, "scope", auth.scopes);
-        writeFileSync(envYaml, yaml);
-        console.log(`  ✓ Updated Postman environment auth0ClientId (${auth.clientId})`);
-        console.log(`  ✓ Updated Postman token scopes`);
-    }
-    const collectionDef = join(targetDir, "postman/collections", `${projectName} WebAPI`, ".resources/definition.yaml");
-    if (existsSync(collectionDef)) {
-        let yaml = readFileSync(collectionDef, "utf8");
-        yaml = yaml.replace(/^(\s*clientId:\s*).+$/m, `$1${JSON.stringify(auth.clientId)}`);
-        yaml = yaml.replace(/^(\s*scope:\s*).+$/m, `$1${JSON.stringify(auth.scopes)}`);
-        writeFileSync(collectionDef, yaml);
-    }
-}
-/** Replace `key: <name>` / `value: …` pairs in Postman Local View environment YAML. */ function replaceYamlKeyedValue(yaml, key, value) {
-    const quoted = JSON.stringify(value);
-    const re = new RegExp(`(key:\\s*${key}\\s*\\n\\s*value:\\s*)[^\\n]+`, "m");
-    if (!re.test(yaml)) return yaml;
-    return yaml.replace(re, `$1${quoted}`);
-}

package/es6/src/webapi/authorize-scopes.js

@@ -1,55 +0,0 @@
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { listExistingApiNames } from "./api-name.js";
-/** OIDC scopes requested on the Postman SPA token (not Auth0 API permissions). */ export const OIDC_SCOPES = [
-    "openid",
-    "profile",
-    "email"
-];
-const AUTHORIZE_RE = /@Authorize\(\s*(["'])([^"']+)\1(?:\s*,\s*(["'])([^"']+)\3)?\s*\)/g;
-function isAppSource(fileName) {
-    return fileName.endsWith(".ts") && !fileName.endsWith(".spec.ts") && !fileName.endsWith(".test.ts") && !fileName.endsWith(".d.ts");
-}
-/** Collect action:Subject scopes from Authorize decorators in each API src tree. */ export function discoverAuthorizeScopes(rootDir) {
-    const scopes = new Set();
-    for (const apiName of listExistingApiNames(rootDir)){
-        collectFromDir(join(rootDir, "projects", apiName, "src"), scopes);
-    }
-    return [
-        ...scopes
-    ].sort();
-}
-function collectFromDir(dir, scopes) {
-    if (!existsSync(dir)) return;
-    for (const entry of readdirSync(dir, {
-        withFileTypes: true
-    })){
-        const path = join(dir, entry.name);
-        if (entry.isDirectory()) {
-            collectFromDir(path, scopes);
-            continue;
-        }
-        if (!entry.isFile() || !isAppSource(entry.name)) continue;
-        const text = readFileSync(path, "utf8");
-        for (const match of text.matchAll(AUTHORIZE_RE)){
-            const action = match[2];
-            if (action == null || action === "") continue;
-            const subject = match[4] ?? "all";
-            scopes.add(`${action}:${subject}`);
-        }
-    }
-}
-/** Additive union so Auth0 CLI scope replace does not drop permissions already on the API. */ export function mergeApiScopes(discovered, existing) {
-    return [
-        ...new Set([
-            ...existing,
-            ...discovered
-        ])
-    ].sort();
-}
-export function postmanRequestedScopes(apiScopes) {
-    return [
-        ...OIDC_SCOPES,
-        ...apiScopes
-    ].join(" ");
-}

package/types/src/auth0-configure.action.d.ts

@@ -1,7 +0,0 @@
-import { type Action, ActionResponse } from "@decohere/devkit/cli";
-export type Auth0ConfigureOptions = {
-    d?: string;
-};
-export declare class Auth0ConfigureAction implements Action<Auth0ConfigureOptions> {
-    run(options: Auth0ConfigureOptions): Promise<ActionResponse>;
-}

package/types/src/auth0-configure.command.d.ts

@@ -1,6 +0,0 @@
-import { DecohereCommand } from "@decohere/devkit/cli";
-import { Auth0ConfigureAction } from "./auth0-configure.action.js";
-export declare class Auth0ConfigureCommand extends DecohereCommand {
-    get actions(): (typeof Auth0ConfigureAction)[];
-    constructor(name: string);
-}

package/types/src/auth0-login.action.d.ts

@@ -1,4 +0,0 @@
-import { type Action, ActionResponse } from "@decohere/devkit/cli";
-export declare class Auth0LoginAction implements Action {
-    run(): Promise<ActionResponse>;
-}

package/types/src/auth0-login.command.d.ts

@@ -1,6 +0,0 @@
-import { DecohereCommand } from "@decohere/devkit/cli";
-import { Auth0LoginAction } from "./auth0-login.action.js";
-export declare class Auth0LoginCommand extends DecohereCommand {
-    get actions(): (typeof Auth0LoginAction)[];
-    constructor(name: string);
-}

package/types/src/auth0.command.d.ts

@@ -1,6 +0,0 @@
-import type { Actions } from "@decohere/devkit/cli";
-import { type CommandHandler, type CommandResponse, type CommandType, DecohereCommand } from "@decohere/devkit/cli";
-export declare class Auth0Command extends DecohereCommand {
-    constructor(commands: Record<string, CommandType>, handler: CommandHandler);
-    run(_actions: Actions, _options: never): Promise<CommandResponse>;
-}

package/types/src/auth0.module.d.ts

@@ -1,18 +0,0 @@
-import { ModuleManifest } from "@decohere/devkit/cli";
-import { Auth0Command } from "./auth0.command.js";
-import { Auth0ConfigureAction } from "./auth0-configure.action.js";
-import { Auth0ConfigureCommand } from "./auth0-configure.command.js";
-import { Auth0LoginAction } from "./auth0-login.action.js";
-import { Auth0LoginCommand } from "./auth0-login.command.js";
-export declare class Auth0Module extends ModuleManifest {
-    readonly id = "auth0";
-    readonly command: typeof Auth0Command;
-    readonly commands: {
-        login: typeof Auth0LoginCommand;
-        configure: typeof Auth0ConfigureCommand;
-    };
-    readonly actions: {
-        login: typeof Auth0LoginAction;
-        configure: typeof Auth0ConfigureAction;
-    };
-}

package/types/src/webapi/auth0-commands.d.ts

@@ -1,11 +0,0 @@
-import * as auth0Cli from "./features/auth0-cli.js";
-export declare const AUTH0_CLI_INSTALL_MESSAGE: string;
-/** Throw if the `auth0` binary is missing. */
-export declare function requireInstalled(): void;
-/**
- * Log in when there is no tenant session or the Management API token is expired.
- * Returns the active tenant.
- */
-export declare function ensureLoggedIn(): auth0Cli.Auth0Tenant;
-export declare function runAuth0Login(): void;
-export declare function runAuth0Configure(directory?: string): void;

package/types/src/webapi/authorize-scopes.d.ts

@@ -1,7 +0,0 @@
-/** OIDC scopes requested on the Postman SPA token (not Auth0 API permissions). */
-export declare const OIDC_SCOPES: readonly ["openid", "profile", "email"];
-/** Collect action:Subject scopes from Authorize decorators in each API src tree. */
-export declare function discoverAuthorizeScopes(rootDir: string): string[];
-/** Additive union so Auth0 CLI scope replace does not drop permissions already on the API. */
-export declare function mergeApiScopes(discovered: readonly string[], existing: readonly string[]): string[];
-export declare function postmanRequestedScopes(apiScopes: readonly string[]): string;