@decohere/scaffold 0.0.1-dev.18 → 0.0.1-dev.20261105.54

package/src/webapi/features/auth0-cli.ts

@@ -1,421 +0,0 @@
-import { execFileSync, spawnSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
-
-/** Management API scopes needed for API, SPA, connections, and admin users. */
-const REQUIRED_SCOPES = [
-	"create:clients",
-	"read:clients",
-	"update:clients",
-	"create:resource_servers",
-	"read:resource_servers",
-	"update:resource_servers",
-	"read:connections",
-	"update:connections",
-	"create:users",
-	"read:users",
-	"update:users",
-].join(",");
-
-/** Hard timeout for any Management API call. Prevents indefinite hangs on token re-auth. */
-const API_TIMEOUT_MS = 8_000;
-
-/** Default API scopes matching Hello CASL Authorize decorators. */
-export const HELLO_API_SCOPES = [
-	"read:Hello",
-	"create:Hello",
-	"update:Hello",
-	"delete:Hello",
-] as const;
-
-export const DB_CONNECTION_NAME = "Username-Password-Authentication";
-
-export class Auth0AuthError extends Error {
-	public constructor(message: string) {
-		super(message);
-		this.name = "Auth0AuthError";
-	}
-}
-
-/** Returns true if an error or stderr output looks like an expired/missing token. */
-function isAuthError(text: string): boolean {
-	return (
-		text.includes("renew access token") ||
-		text.includes("log in") ||
-		text.includes("Unauthorized")
-	);
-}
-
-/** Strip Auth0 CLI banner lines before JSON. */
-function parseJsonOutput<T>(stdout: string): T {
-	const start = stdout.indexOf("{");
-	const arrayStart = stdout.indexOf("[");
-	let idx = -1;
-	if (start === -1) idx = arrayStart;
-	else if (arrayStart === -1) idx = start;
-	else idx = Math.min(start, arrayStart);
-	if (idx < 0) throw new Error(`Expected JSON from auth0 CLI, got: ${stdout.slice(0, 200)}`);
-	return JSON.parse(stdout.slice(idx)) as T;
-}
-
-/** Run an auth0 CLI command with a hard timeout. Returns stdout on success, throws on failure. */
-function runAuth0(args: string[]): string {
-	const result = spawnSync("auth0", args, {
-		encoding: "utf8",
-		timeout: API_TIMEOUT_MS,
-		input: "",
-		stdio: "pipe",
-	});
-
-	if (result.error) {
-		const msg = result.error.message;
-		if (isAuthError(msg) || (result.error as NodeJS.ErrnoException).code === "ETIMEDOUT") {
-			throw new Auth0AuthError(msg);
-		}
-		throw result.error;
-	}
-
-	if (result.status !== 0) {
-		const stderr = result.stderr ?? "";
-		if (isAuthError(stderr)) throw new Auth0AuthError(stderr);
-		throw new Error(stderr || `auth0 exited with code ${result.status}`);
-	}
-
-	return result.stdout;
-}
-
-export interface Auth0Tenant {
-	name: string;
-	active?: boolean;
-}
-
-export function isInstalled(): boolean {
-	try {
-		execFileSync("auth0", ["--version"], { stdio: "pipe" });
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-export function listTenants(): Auth0Tenant[] {
-	try {
-		const out = execFileSync("auth0", ["tenants", "list", "--json"], {
-			encoding: "utf8",
-			stdio: "pipe",
-		});
-		return JSON.parse(out) as Auth0Tenant[];
-	} catch {
-		return [];
-	}
-}
-
-export function login(): boolean {
-	const result = spawnSync("auth0", ["login", "--scopes", REQUIRED_SCOPES], {
-		stdio: "inherit",
-	});
-	return result.status === 0;
-}
-
-export function listApis(): Array<{ identifier: string; name: string }> {
-	try {
-		const out = runAuth0(["apis", "list", "--json", "--no-input"]);
-		return parseJsonOutput(out);
-	} catch (err) {
-		if (err instanceof Auth0AuthError) throw err;
-		return [];
-	}
-}
-
-export function createApi(
-	name: string,
-	identifier: string,
-	scopes: readonly string[] = HELLO_API_SCOPES,
-): { identifier: string } {
-	const out = runAuth0([
-		"apis",
-		"create",
-		"--name",
-		name,
-		"--identifier",
-		identifier,
-		"--scopes",
-		scopes.join(","),
-		// RBAC: only permissions assigned to the user/role appear on the token.
-		"--enforce-policies",
-		// Include Auth0 `permissions[]` claim (consumed by sample principalMapper).
-		"--token-dialect",
-		"access_token_authz",
-		"--json",
-		"--no-input",
-	]);
-	return parseJsonOutput(out);
-}
-
-/**
- * Replace an API's scopes and enable RBAC policy enforcement.
- * Auth0 CLI `--scopes` replaces the full set.
- */
-export function updateApiScopes(
-	identifier: string,
-	scopes: readonly string[] = HELLO_API_SCOPES,
-): void {
-	runAuth0([
-		"apis",
-		"update",
-		identifier,
-		"--scopes",
-		scopes.join(","),
-		"--enforce-policies",
-		"--token-dialect",
-		"access_token_authz",
-		"--no-input",
-	]);
-}
-
-/** True when Auth0 refuses create because the tenant hit its Applications quota. */
-export function isAuth0EntityLimitError(err: unknown): boolean {
-	const text = err instanceof Error ? err.message : String(err);
-	return /limit of entities|reached the limit|tenant application limit reached/i.test(text);
-}
-
-/**
- * Actionable message when Auth0 will not create another application.
- * Does not suggest reusing unrelated apps — free tenants must delete unused ones.
- */
-export function formatSpaEntityLimitError(appName: string, apps: Auth0App[]): string {
-	const listed =
-		apps.length === 0
-			? "Could not list existing applications."
-			: `This tenant already has ${apps.length} application(s):\n${apps
-					.map((a) => `  - ${a.name} (${a.client_id})`)
-					.join("\n")}`;
-
-	return [
-		`Auth0 refused to create SPA "${appName}": tenant application limit reached.`,
-		listed,
-		"",
-		"Fix: Auth0 Dashboard → Applications → Applications → delete unused apps,",
-		`then re-run the scaffold (or choose Postman "none" to skip SPA creation).`,
-		"Re-scaffold of the same project name reuses an exact-name match when it still exists.",
-	].join("\n");
-}
-
-export function createSpaApp(
-	name: string,
-	callbackUrls: string | readonly string[],
-): { client_id: string } {
-	const callbacks = typeof callbackUrls === "string" ? callbackUrls : callbackUrls.join(",");
-	const out = runAuth0([
-		"apps",
-		"create",
-		"--name",
-		name,
-		"--type",
-		"spa",
-		"--callbacks",
-		callbacks,
-		"--json",
-		"--no-input",
-	]);
-	const app = parseJsonOutput<{ client_id?: string; clientId?: string }>(out);
-	const clientId = app.client_id ?? app.clientId;
-	if (!clientId) {
-		throw new Error(
-			`Auth0 create SPA response missing client_id. stdout: ${out.slice(0, 300)}`,
-		);
-	}
-	return { client_id: clientId };
-}
-
-export type Auth0App = { client_id: string; name: string };
-
-export function listApps(): Auth0App[] {
-	try {
-		const out = runAuth0(["apps", "list", "--json", "--no-input"]);
-		const apps =
-			parseJsonOutput<Array<{ client_id?: string; clientId?: string; name?: string }>>(out);
-		return apps
-			.map((a) => ({
-				client_id: a.client_id ?? a.clientId ?? "",
-				name: a.name ?? "",
-			}))
-			.filter((a) => a.client_id && a.name);
-	} catch (err) {
-		if (err instanceof Auth0AuthError) throw err;
-		return [];
-	}
-}
-
-export function updateSpaCallbacks(
-	clientId: string,
-	callbackUrls: string | readonly string[],
-): void {
-	const callbacks = typeof callbackUrls === "string" ? callbackUrls : callbackUrls.join(",");
-	runAuth0(["apps", "update", clientId, "--callbacks", callbacks, "--no-input"]);
-}
-
-/**
- * Create a Postman SPA, or reuse an existing app with the same name (re-scaffold).
- * Always returns a client_id suitable for Postman auth0ClientId.
- * On Auth0 application-quota errors, throws a clear delete-apps message (no cross-app reuse).
- */
-export function ensureSpaApp(
-	name: string,
-	callbackUrls: string | readonly string[],
-): { client_id: string; reused: boolean } {
-	const apps = listApps();
-	const existing = apps.find((a) => a.name === name);
-	if (existing) {
-		try {
-			updateSpaCallbacks(existing.client_id, callbackUrls);
-		} catch {
-			// Callbacks may already match; still usable for Postman.
-		}
-		return { client_id: existing.client_id, reused: true };
-	}
-	try {
-		return { ...createSpaApp(name, callbackUrls), reused: false };
-	} catch (err) {
-		if (isAuth0EntityLimitError(err)) {
-			throw new Error(formatSpaEntityLimitError(name, apps));
-		}
-		throw err;
-	}
-}
-
-type Auth0Connection = { id: string; name: string; strategy: string };
-
-/** Enable a database connection for an application (required for username/password login). */
-export function enableConnectionForClient(connectionName: string, clientId: string): void {
-	const listOut = runAuth0(["api", "get", "connections", "--no-input"]);
-	const connections = parseJsonOutput<Auth0Connection[]>(listOut);
-	const connection = connections.find((c) => c.name === connectionName);
-	if (!connection) {
-		throw new Error(`Auth0 connection not found: ${connectionName}`);
-	}
-
-	const clientsOut = runAuth0([
-		"api",
-		"get",
-		`connections/${connection.id}/clients`,
-		"--no-input",
-	]);
-	const { clients } = parseJsonOutput<{ clients: Array<{ client_id: string }> }>(clientsOut);
-	if (clients.some((c) => c.client_id === clientId)) return;
-
-	// Dedicated enabled-clients endpoint (enabled_clients on connection PATCH is deprecated).
-	runAuth0([
-		"api",
-		"patch",
-		`connections/${connection.id}/clients`,
-		"--data",
-		JSON.stringify([{ client_id: clientId, status: true }]),
-		"--no-input",
-	]);
-}
-
-export type AdminDatabaseUser = {
-	user_id: string;
-	email: string;
-	password: string;
-	username: string;
-};
-
-/** Strong default password when the scaffolder caller leaves password blank. */
-export function generateAdminPassword(): string {
-	return `${randomBytes(12).toString("base64url")}aA1!`;
-}
-
-function isUserAlreadyExistsError(err: unknown): boolean {
-	const text = err instanceof Error ? err.message : String(err);
-	return /already exists|user exists|Conflict|409/i.test(text);
-}
-
-/** Look up a user by email (Management API users-by-email). */
-export function findUserByEmail(email: string): { user_id: string; email: string } | null {
-	const out = runAuth0([
-		"api",
-		"get",
-		`users-by-email?email=${encodeURIComponent(email)}`,
-		"--no-input",
-	]);
-	const users = parseJsonOutput<Array<{ user_id?: string; email?: string }>>(out);
-	const user = users.find((u) => u.user_id && u.email);
-	if (!user?.user_id || !user.email) return null;
-	return { user_id: user.user_id, email: user.email };
-}
-
-/** Reset password so a re-scaffold can write a known password to .env. */
-export function updateUserPassword(userId: string, password: string): void {
-	runAuth0([
-		"api",
-		"patch",
-		`users/${encodeURIComponent(userId)}`,
-		"--data",
-		JSON.stringify({ password, connection: DB_CONNECTION_NAME }),
-		"--no-input",
-	]);
-}
-
-/**
- * Create a DB connection root-admin user for local / Postman login.
- * If the user already exists, look them up, reset password to `input.password`,
- * and return that identity so callers can still write .env credentials.
- */
-export function createAdminDatabaseUser(input: {
-	email: string;
-	password: string;
-	username: string;
-}): AdminDatabaseUser {
-	const body = {
-		email: input.email,
-		connection: DB_CONNECTION_NAME,
-		password: input.password,
-		name: input.username,
-		email_verified: true,
-		verify_email: false,
-		app_metadata: { roles: ["admin"] },
-	};
-
-	try {
-		const out = runAuth0([
-			"api",
-			"post",
-			"users",
-			"--data",
-			JSON.stringify(body),
-			"--no-input",
-		]);
-		const user = parseJsonOutput<{ user_id?: string; email?: string }>(out);
-		if (!user.user_id || !user.email) {
-			throw new Error(
-				`Auth0 create user response missing user_id/email. stdout: ${out.slice(0, 300)}`,
-			);
-		}
-		return {
-			user_id: user.user_id,
-			email: user.email,
-			password: input.password,
-			username: input.username,
-		};
-	} catch (err) {
-		if (!isUserAlreadyExistsError(err)) throw err;
-
-		const existing = findUserByEmail(input.email);
-		if (!existing) {
-			throw new Error(
-				`Auth0 user already exists for ${input.email}, but lookup by email returned no user.`,
-			);
-		}
-
-		updateUserPassword(existing.user_id, input.password);
-		return {
-			user_id: existing.user_id,
-			email: existing.email,
-			password: input.password,
-			username: input.username,
-		};
-	}
-}
-
-export { REQUIRED_SCOPES };

package/src/webapi/features/biome-format.ts

@@ -1,34 +0,0 @@
-import { spawnSync } from "node:child_process";
-
-/**
- * Format/lint-fix all files in the scaffolded workspace with Biome.
- * Prefer a global `biome` binary (builder image); fall back to `npx`.
- */
-export function formatScaffoldedFiles(targetDir: string, paths: string[] = ["."]): void {
-	process.stdout.write("\n  Formatting scaffolded files with Biome...");
-
-	let result = spawnSync("biome", ["check", "--write", ...paths], {
-		cwd: targetDir,
-		encoding: "utf8",
-		stdio: "pipe",
-	});
-
-	if (result.error && (result.error as NodeJS.ErrnoException).code === "ENOENT") {
-		result = spawnSync("npx", ["--yes", "@biomejs/biome", "check", "--write", ...paths], {
-			cwd: targetDir,
-			encoding: "utf8",
-			stdio: "pipe",
-		});
-	}
-
-	if (result.status === 0) {
-		process.stdout.write(" done.\n");
-		return;
-	}
-
-	const detail = (result.stderr || result.stdout || result.error?.message || "").trim();
-	process.stdout.write(" failed.\n");
-	if (detail) {
-		console.error(`  ✗ Biome: ${detail.slice(0, 400)}`);
-	}
-}