@fluixi/cli 0.1.0-alpha.82 → 0.1.0-alpha.83

package/dist/scaffold/templates.js

@@ -0,0 +1,216 @@
+/** What the env, module, service, api, server-fn and oauth2 generators write. */
+export const camel = (name) => name.toLowerCase().replace(/_+([a-z0-9])/g, (_, ch) => ch.toUpperCase());
+export const envConfig = (names) => {
+    const fields = names.length
+        ? names.map((n) => `  ${camel(n)}: '${n}',`).join('\n')
+        : `  // apiUrl: 'API_URL',`;
+    return `import { pickEnv } from '@fluixi/start/env';
+
+// Every missing variable is reported at once, when this module loads. A field that may be
+// unset takes { key, optional: true } or { key, default }; parse: asNumber and friends convert.
+export const config = pickEnv({
+${fields}
+});
+`;
+};
+export const moduleFile = (Name, name) => `import { defineModule } from '@fluixi/start/app';
+
+export const ${Name}Module = defineModule({
+  name: '${name}',
+  imports: [],
+  providers: [],
+});
+`;
+export const serviceFile = (Name, name, server) => `${server ? `// Server only: the browser build refuses a page that imports this file.\n` : ''}import { injectionToken } from '@fluixi/start/di';
+import { defineModule } from '@fluixi/start/app';
+
+export class ${Name}Service {}
+
+export const ${Name}Token = injectionToken<${Name}Service>('${Name}');
+
+export const ${Name}Module = defineModule({
+  name: '${name}',
+  providers: [{ provide: ${Name}Token, useFactory: () => new ${Name}Service() }],
+});
+`;
+export const apiRoute = () => `export function GET(request: Request) {
+  return Response.json({ path: new URL(request.url).pathname });
+}
+`;
+export const guardedApiRoute = (guardImport, role) => `import { guard } from '${guardImport}';
+
+export const GET = guard(
+  async (request, claims) => {
+    return Response.json({ sub: claims.sub });
+  },
+  { role: '${role}' },
+);
+`;
+export const verifyServer = () => `import { createTokenVerifier, createApiGuard } from '@fluixi/oauth2/verify';
+import { auth } from '../config/env.js';
+
+// Checks a bearer token's signature, issuer, audience and expiry against the provider.
+export const verify = createTokenVerifier(auth.provider.verifier(auth.clientId));
+
+// Answers 401 without a valid token and 403 without the role.
+export const guard = createApiGuard({ verify, roles: auth.provider.roles });
+`;
+export const serverFn = (name) => `export async function ${name}(input: { id: string }) {
+  'use server';
+  // Runs on the server only. The browser calls it over RPC, so input and result are plain data.
+  return { id: input.id };
+}
+`;
+// ── oauth2 ──────────────────────────────────────────────────────────────────
+export const PROVIDERS = ['oidc', 'keycloak', 'auth0', 'okta', 'google', 'dex', 'oauth2'];
+/** Providers that refuse a public client, so tokens must stay on the server. */
+export const SERVER_ONLY = {
+    google: 'Google answers a token request without a client secret with `client_secret is missing`',
+    dex: 'Dex sends no CORS headers on discovery or the token endpoint',
+};
+/** The variables each preset needs beyond the common ones, with a placeholder. */
+export const PROVIDER_VARS = {
+    oidc: { AUTH_ISSUER: 'https://id.example.com' },
+    keycloak: { AUTH_BASE_URL: 'http://localhost:8080', AUTH_REALM: 'master' },
+    auth0: { AUTH_DOMAIN: 'example.eu.auth0.com', AUTH_AUDIENCE: 'https://api.example.com' },
+    okta: { AUTH_DOMAIN: 'example.okta.com' },
+    google: {},
+    dex: { AUTH_BASE_URL: 'http://localhost:5556/dex' },
+    oauth2: {
+        AUTH_ISSUER: 'https://id.example.com',
+        AUTH_AUTHORIZATION_ENDPOINT: 'https://id.example.com/authorize',
+        AUTH_TOKEN_ENDPOINT: 'https://id.example.com/token',
+    },
+};
+export const AUTH_READER = `// Provider, issuer, client and token mode from the AUTH_* variables in env.public. Moving to
+// another provider is a change to .env.
+export const auth = authFromEnv(publicEnv(), { clientPrefix: '' });
+`;
+export const authEnvConfig = () => `import { publicEnv } from '@fluixi/start/env';
+import { authFromEnv } from '@fluixi/oauth2/env';
+
+${AUTH_READER}`;
+export const authServiceFile = (tokens) => `import { createAuthService, authModule } from '@fluixi/oauth2';
+import { env } from '@fluixi/start/env';
+${tokens === 'browser' ? `import { auth as authEnv } from '../config/env.js';\n` : ''}
+export interface User {
+  sub: string;
+  email?: string;
+  name?: string;
+}
+
+const appUrl = env('APP_URL') ?? 'http://localhost:3000';
+
+export const auth = createAuthService<User>({
+${tokens === 'browser'
+    ? `  config: {
+    ...authEnv.client,
+    tokens: 'browser',
+    redirectUri: \`\${appUrl}/callback\`,
+    postLogoutRedirectUri: \`\${appUrl}/login\`,
+  },`
+    : `  // The tokens stay on the server behind an httpOnly cookie. The browser calls the routes
+  // auth.server.ts mounts under basePath and never sees a token.
+  config: {
+    tokens: 'server',
+    redirectUri: \`\${appUrl}/auth/callback\`,
+    postLogoutRedirectUri: \`\${appUrl}/login\`,
+    basePath: '/auth',
+  },`}
+});
+
+export const AuthModule = authModule(auth);
+export const { protectedRoute, Protect, Can, useUser } = auth;
+`;
+export const authServerFile = () => `import { authServerModule } from '@fluixi/oauth2/server';
+import { publicEnv, serverEnv } from '@fluixi/start/env';
+import { auth } from '../config/env.js';
+
+// A function: serverEnv with required throws when a secret is unset, and it is only read
+// when app.config.server.ts registers this.
+export function authServer() {
+  const appUrl = publicEnv().APP_URL ?? 'http://localhost:3000';
+  return authServerModule({
+    ...auth.client,
+    clientSecret: serverEnv('OIDC_CLIENT_SECRET', { required: true }),
+    cookieSecret: serverEnv('SESSION_SECRET', { required: true }),
+    redirectUri: \`\${appUrl}/auth/callback\`,
+    defaultReturnTo: '/',
+    secureCookie: appUrl.startsWith('https://'),
+  });
+}
+`;
+export const callbackRoute = (html) => html
+    ? `import { html } from '@fluixi/core';
+import { OAuthCallback } from '@fluixi/oauth2/callback';
+
+export default OAuthCallback({
+  pending: () => html\`<p>Signing you in</p>\`,
+  failed: (reason) => html\`<p>\${reason}</p><a href="/login">Try again</a>\`,
+});
+`
+    : `import { OAuthCallback } from '@fluixi/oauth2/callback';
+
+export default OAuthCallback({
+  pending: () => <p>Signing you in</p>,
+  failed: (reason) => (
+    <>
+      <p>{reason}</p>
+      <a href="/login">Try again</a>
+    </>
+  ),
+});
+`;
+export const loginRoute = (html) => html
+    ? `import { html } from '@fluixi/core';
+import { auth } from '../services/auth.js';
+
+export default function Login() {
+  return html\`<button @click=\${() => auth.signIn({ returnTo: '/' })}>Sign in</button>\`;
+}
+`
+    : `import { auth } from '../services/auth.js';
+
+export default function Login() {
+  return <button onClick={() => auth.signIn({ returnTo: '/' })}>Sign in</button>;
+}
+`;
+// ── better-auth ─────────────────────────────────────────────────────────────
+export const betterAuthConfig = () => `import { betterAuth } from 'better-auth';
+import { defineAuth } from '@fluixi/auth/server';
+
+export type AppUser = { id: string; email: string; name?: string; role?: string };
+
+// Better Auth owns the audited primitives; defineAuth registers it with @fluixi/auth.
+export const auth = defineAuth<AppUser>(
+  betterAuth({
+    // database: <your adapter>,
+    emailAndPassword: { enabled: true },
+    // socialProviders: { google: { … }, github: { … } },
+  } as Parameters<typeof betterAuth>[0]),
+);
+`;
+export const betterAuthClient = () => `import { createAuthClient } from 'better-auth/client';
+import { createAuthHooks } from '@fluixi/auth/client';
+import type { AppUser } from './auth.config.js';
+
+const client = createAuthClient({ baseURL: '/api/auth' });
+
+// Or, to reuse an existing reactive session: createAuthHooks({ session: yourSessionStore }).
+export const { useUser, useSession, useAuth, useSignIn, useSignOut, protectedRoute } =
+  createAuthHooks<AppUser>({ client, loginPath: '/login' });
+`;
+export const betterAuthMiddleware = () => `import { defineMiddleware } from '@fluixi/start';
+import { authMiddleware } from '@fluixi/auth/server';
+import './auth.config.js';
+
+export default defineMiddleware([authMiddleware()]);
+`;
+export const betterAuthRoute = () => `import { mountAuthRoutes } from '@fluixi/auth/server';
+import '../../auth.config.js';
+
+const handler = mountAuthRoutes();
+export const GET = handler;
+export const POST = handler;
+export default handler;
+`;

package/dist/scaffold/templates.mjs

@@ -0,0 +1,229 @@
+// src/scaffold/templates.ts
+var camel = (name) => name.toLowerCase().replace(/_+([a-z0-9])/g, (_, ch) => ch.toUpperCase());
+var envConfig = (names) => {
+  const fields = names.length ? names.map((n) => `  ${camel(n)}: '${n}',`).join("\n") : `  // apiUrl: 'API_URL',`;
+  return `import { pickEnv } from '@fluixi/start/env';
+
+// Every missing variable is reported at once, when this module loads. A field that may be
+// unset takes { key, optional: true } or { key, default }; parse: asNumber and friends convert.
+export const config = pickEnv({
+${fields}
+});
+`;
+};
+var moduleFile = (Name, name) => `import { defineModule } from '@fluixi/start/app';
+
+export const ${Name}Module = defineModule({
+  name: '${name}',
+  imports: [],
+  providers: [],
+});
+`;
+var serviceFile = (Name, name, server) => `${server ? `// Server only: the browser build refuses a page that imports this file.
+` : ""}import { injectionToken } from '@fluixi/start/di';
+import { defineModule } from '@fluixi/start/app';
+
+export class ${Name}Service {}
+
+export const ${Name}Token = injectionToken<${Name}Service>('${Name}');
+
+export const ${Name}Module = defineModule({
+  name: '${name}',
+  providers: [{ provide: ${Name}Token, useFactory: () => new ${Name}Service() }],
+});
+`;
+var apiRoute = () => `export function GET(request: Request) {
+  return Response.json({ path: new URL(request.url).pathname });
+}
+`;
+var guardedApiRoute = (guardImport, role) => `import { guard } from '${guardImport}';
+
+export const GET = guard(
+  async (request, claims) => {
+    return Response.json({ sub: claims.sub });
+  },
+  { role: '${role}' },
+);
+`;
+var verifyServer = () => `import { createTokenVerifier, createApiGuard } from '@fluixi/oauth2/verify';
+import { auth } from '../config/env.js';
+
+// Checks a bearer token's signature, issuer, audience and expiry against the provider.
+export const verify = createTokenVerifier(auth.provider.verifier(auth.clientId));
+
+// Answers 401 without a valid token and 403 without the role.
+export const guard = createApiGuard({ verify, roles: auth.provider.roles });
+`;
+var serverFn = (name) => `export async function ${name}(input: { id: string }) {
+  'use server';
+  // Runs on the server only. The browser calls it over RPC, so input and result are plain data.
+  return { id: input.id };
+}
+`;
+var PROVIDERS = ["oidc", "keycloak", "auth0", "okta", "google", "dex", "oauth2"];
+var SERVER_ONLY = {
+  google: "Google answers a token request without a client secret with `client_secret is missing`",
+  dex: "Dex sends no CORS headers on discovery or the token endpoint"
+};
+var PROVIDER_VARS = {
+  oidc: { AUTH_ISSUER: "https://id.example.com" },
+  keycloak: { AUTH_BASE_URL: "http://localhost:8080", AUTH_REALM: "master" },
+  auth0: { AUTH_DOMAIN: "example.eu.auth0.com", AUTH_AUDIENCE: "https://api.example.com" },
+  okta: { AUTH_DOMAIN: "example.okta.com" },
+  google: {},
+  dex: { AUTH_BASE_URL: "http://localhost:5556/dex" },
+  oauth2: {
+    AUTH_ISSUER: "https://id.example.com",
+    AUTH_AUTHORIZATION_ENDPOINT: "https://id.example.com/authorize",
+    AUTH_TOKEN_ENDPOINT: "https://id.example.com/token"
+  }
+};
+var AUTH_READER = `// Provider, issuer, client and token mode from the AUTH_* variables in env.public. Moving to
+// another provider is a change to .env.
+export const auth = authFromEnv(publicEnv(), { clientPrefix: '' });
+`;
+var authEnvConfig = () => `import { publicEnv } from '@fluixi/start/env';
+import { authFromEnv } from '@fluixi/oauth2/env';
+
+${AUTH_READER}`;
+var authServiceFile = (tokens) => `import { createAuthService, authModule } from '@fluixi/oauth2';
+import { env } from '@fluixi/start/env';
+${tokens === "browser" ? `import { auth as authEnv } from '../config/env.js';
+` : ""}
+export interface User {
+  sub: string;
+  email?: string;
+  name?: string;
+}
+
+const appUrl = env('APP_URL') ?? 'http://localhost:3000';
+
+export const auth = createAuthService<User>({
+${tokens === "browser" ? `  config: {
+    ...authEnv.client,
+    tokens: 'browser',
+    redirectUri: \`\${appUrl}/callback\`,
+    postLogoutRedirectUri: \`\${appUrl}/login\`,
+  },` : `  // The tokens stay on the server behind an httpOnly cookie. The browser calls the routes
+  // auth.server.ts mounts under basePath and never sees a token.
+  config: {
+    tokens: 'server',
+    redirectUri: \`\${appUrl}/auth/callback\`,
+    postLogoutRedirectUri: \`\${appUrl}/login\`,
+    basePath: '/auth',
+  },`}
+});
+
+export const AuthModule = authModule(auth);
+export const { protectedRoute, Protect, Can, useUser } = auth;
+`;
+var authServerFile = () => `import { authServerModule } from '@fluixi/oauth2/server';
+import { publicEnv, serverEnv } from '@fluixi/start/env';
+import { auth } from '../config/env.js';
+
+// A function: serverEnv with required throws when a secret is unset, and it is only read
+// when app.config.server.ts registers this.
+export function authServer() {
+  const appUrl = publicEnv().APP_URL ?? 'http://localhost:3000';
+  return authServerModule({
+    ...auth.client,
+    clientSecret: serverEnv('OIDC_CLIENT_SECRET', { required: true }),
+    cookieSecret: serverEnv('SESSION_SECRET', { required: true }),
+    redirectUri: \`\${appUrl}/auth/callback\`,
+    defaultReturnTo: '/',
+    secureCookie: appUrl.startsWith('https://'),
+  });
+}
+`;
+var callbackRoute = (html) => html ? `import { html } from '@fluixi/core';
+import { OAuthCallback } from '@fluixi/oauth2/callback';
+
+export default OAuthCallback({
+  pending: () => html\`<p>Signing you in</p>\`,
+  failed: (reason) => html\`<p>\${reason}</p><a href="/login">Try again</a>\`,
+});
+` : `import { OAuthCallback } from '@fluixi/oauth2/callback';
+
+export default OAuthCallback({
+  pending: () => <p>Signing you in</p>,
+  failed: (reason) => (
+    <>
+      <p>{reason}</p>
+      <a href="/login">Try again</a>
+    </>
+  ),
+});
+`;
+var loginRoute = (html) => html ? `import { html } from '@fluixi/core';
+import { auth } from '../services/auth.js';
+
+export default function Login() {
+  return html\`<button @click=\${() => auth.signIn({ returnTo: '/' })}>Sign in</button>\`;
+}
+` : `import { auth } from '../services/auth.js';
+
+export default function Login() {
+  return <button onClick={() => auth.signIn({ returnTo: '/' })}>Sign in</button>;
+}
+`;
+var betterAuthConfig = () => `import { betterAuth } from 'better-auth';
+import { defineAuth } from '@fluixi/auth/server';
+
+export type AppUser = { id: string; email: string; name?: string; role?: string };
+
+// Better Auth owns the audited primitives; defineAuth registers it with @fluixi/auth.
+export const auth = defineAuth<AppUser>(
+  betterAuth({
+    // database: <your adapter>,
+    emailAndPassword: { enabled: true },
+    // socialProviders: { google: { … }, github: { … } },
+  } as Parameters<typeof betterAuth>[0]),
+);
+`;
+var betterAuthClient = () => `import { createAuthClient } from 'better-auth/client';
+import { createAuthHooks } from '@fluixi/auth/client';
+import type { AppUser } from './auth.config.js';
+
+const client = createAuthClient({ baseURL: '/api/auth' });
+
+// Or, to reuse an existing reactive session: createAuthHooks({ session: yourSessionStore }).
+export const { useUser, useSession, useAuth, useSignIn, useSignOut, protectedRoute } =
+  createAuthHooks<AppUser>({ client, loginPath: '/login' });
+`;
+var betterAuthMiddleware = () => `import { defineMiddleware } from '@fluixi/start';
+import { authMiddleware } from '@fluixi/auth/server';
+import './auth.config.js';
+
+export default defineMiddleware([authMiddleware()]);
+`;
+var betterAuthRoute = () => `import { mountAuthRoutes } from '@fluixi/auth/server';
+import '../../auth.config.js';
+
+const handler = mountAuthRoutes();
+export const GET = handler;
+export const POST = handler;
+export default handler;
+`;
+export {
+  AUTH_READER,
+  PROVIDERS,
+  PROVIDER_VARS,
+  SERVER_ONLY,
+  apiRoute,
+  authEnvConfig,
+  authServerFile,
+  authServiceFile,
+  betterAuthClient,
+  betterAuthConfig,
+  betterAuthMiddleware,
+  betterAuthRoute,
+  callbackRoute,
+  camel,
+  envConfig,
+  guardedApiRoute,
+  loginRoute,
+  moduleFile,
+  serverFn,
+  serviceFile,
+  verifyServer
+};