@getstrata/starter 1.1.5 → 1.1.6

package/dist/cli.js

@@ -120,7 +120,7 @@ function extraApplies(extra, auth) {
   if (extra === "metrics" || extra === "billing" || extra === "webhooks") {
     return true;
   }
-  if (extra === "mfa" || extra === "oauthGithub") {
+  if (extra === "mfa" || extra === "oauthGithub" || extra === "oidc") {
     return htmlAuthKit(auth);
   }
   return authNeedsUsers(auth);
@@ -196,6 +196,7 @@ var noneExtras = {
   scim: false,
   metrics: false,
   oauthGithub: false,
+  oidc: false,
   billing: false,
   webhooks: false
 };
@@ -205,6 +206,7 @@ var enterpriseExtras = {
   scim: true,
   metrics: true,
   oauthGithub: false,
+  oidc: false,
   billing: false,
   webhooks: false
 };
@@ -274,9 +276,10 @@ Options:
   --scim / --no-scim
   --metrics / --no-metrics
   --oauth-github / --no-oauth-github
+  --oidc / --no-oidc
   --billing / --no-billing
   --webhooks / --no-webhooks
-  --extras            Interactive extras list (MFA, email verification, SCIM, metrics, GitHub OAuth, billing, webhooks)
+  --extras            Interactive extras list (MFA, email verification, SCIM, metrics, GitHub OAuth, OIDC, billing, webhooks)
   --docker            Write Docker Compose for every selected tool that needs a service
   --no-docker         Skip docker-compose.yml; use installs already on this machine
   --docker-services   Subset: postgres, mysql, redis, mailpit, adminer (comma-separated)
@@ -382,6 +385,8 @@ function parseCreateStrataArgs(argv) {
       ["--no-metrics", "metrics", false],
       ["--oauth-github", "oauthGithub", true],
       ["--no-oauth-github", "oauthGithub", false],
+      ["--oidc", "oidc", true],
+      ["--no-oidc", "oidc", false],
       ["--billing", "billing", true],
       ["--no-billing", "billing", false],
       ["--webhooks", "webhooks", true],
@@ -509,6 +514,9 @@ function extraFlagName(extra) {
   if (extra === "oauthGithub") {
     return "oauth-github";
   }
+  if (extra === "oidc") {
+    return "oidc";
+  }
   return extra;
 }
 function dropInapplicableExtras(layers, flags) {
@@ -912,6 +920,7 @@ var EXTRA_CHOICES = [
   { value: "scim", label: "scim: /Users adapter" },
   { value: "metrics", label: "metrics: Prometheus token" },
   { value: "oauthGithub", label: "oauth-github: GitHub cookie login at /auth/github" },
+  { value: "oidc", label: "oidc: OIDC cookie login at /auth/oidc (PKCE cookie)" },
   { value: "billing", label: "billing: Stripe webhook stub + GET /api/v1/billing/subscription" },
   { value: "webhooks", label: "webhooks: outbound notes.created job (webhook.dispatch)" }
 ];
@@ -1200,6 +1209,7 @@ function renderAuthModule(layers) {
   }
   const cookie = htmlAuthKit(layers.auth);
   const github = Boolean(layers.extras.oauthGithub && cookie);
+  const oidc = Boolean(layers.extras.oidc && cookie);
   const mfa = Boolean(layers.extras.mfa && cookie);
   const verify = Boolean(layers.extras.emailVerification);
   const jsonApi = authUsesToken(layers.auth) || authUsesJwt(layers.auth);
@@ -1221,6 +1231,11 @@ function renderAuthModule(layers) {
     imports.push(`import { createSamlServiceProvider } from "@getstrata/core/auth/saml/samlServiceProvider";`);
     if (github) {
       imports.push(`import { GitHubOAuthProvider } from "@getstrata/core/auth/oauth/providers";`);
+    }
+    if (oidc) {
+      imports.push(`import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";`);
+    }
+    if (github || oidc) {
       imports.push(`import { appUrl } from "@getstrata/core/runtime/appKeyPrefix";`);
     }
   }
@@ -1251,7 +1266,7 @@ function renderAuthModule(layers) {
     if (mfa) {
       imports.push(`import { sanitizeInternalPath } from "@getstrata/core/http/safeInternalPath";`);
     }
-    imports.push(`import { createOAuthState, verifyOAuthState } from "@getstrata/core/security/oauthState";`);
+    imports.push(oidc ? `import { clearOidcPkceCookie, createOAuthState, readOidcPkceCookie, sealOidcPkceCookie, verifyOAuthState } from "@getstrata/core/security/oauthState";` : `import { createOAuthState, verifyOAuthState } from "@getstrata/core/security/oauthState";`);
   }
   if (jsonApi || cookie) {
     imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
@@ -1692,9 +1707,67 @@ async function completeBrowserSsoLogin(
             return completeBrowserSsoLogin(dependencies, profile, "GitHub");
           })),
         },` : "";
+  const oidcRoutes = oidc ? `
+        "/auth/oidc": {
+          GET: kernel.wrap("api", withErrorHandling(async () => {
+            if (process.env.FEATURE_OAUTH !== "true") {
+              return new Response("Not found", { status: 404 });
+            }
+            const issuer = process.env.OIDC_ISSUER?.trim();
+            const clientId = process.env.OIDC_CLIENT_ID?.trim();
+            const clientSecret = process.env.OIDC_CLIENT_SECRET?.trim();
+            if (!issuer || !clientId || !clientSecret) {
+              return new Response("Not found", { status: 404 });
+            }
+            const redirectUri = process.env.OIDC_REDIRECT_URI?.trim() || \`\${appUrl()}/auth/oidc/callback\`;
+            const issued = createOAuthState();
+            const provider = new OidcProvider({ name: "oidc", issuer, clientId, clientSecret, redirectUri });
+            const { url, handshake } = await provider.createAuthorization(issued.state);
+            const redirect = new Response(null, { status: 302, headers: { location: url } });
+            redirect.headers.append(
+              "set-cookie",
+              sealOidcPkceCookie({ state: issued.state, nonce: handshake.nonce, codeVerifier: handshake.codeVerifier }),
+            );
+            return redirect;
+          })),
+        },
+        "/auth/oidc/callback": {
+          GET: kernel.wrap("api", withErrorHandling(async (request) => {
+            if (process.env.FEATURE_OAUTH !== "true") {
+              return new Response("Not found", { status: 404 });
+            }
+            const issuer = process.env.OIDC_ISSUER?.trim();
+            const clientId = process.env.OIDC_CLIENT_ID?.trim();
+            const clientSecret = process.env.OIDC_CLIENT_SECRET?.trim();
+            if (!issuer || !clientId || !clientSecret) {
+              return new Response("Not found", { status: 404 });
+            }
+            const url = new URL(request.url);
+            const code = url.searchParams.get("code");
+            const state = url.searchParams.get("state");
+            const pkce = readOidcPkceCookie(request, state);
+            if (!code || !verifyOAuthState(request, state) || !pkce) {
+              const denied = jsonResponse({ error: "Invalid OIDC state." }, { status: 403 });
+              denied.headers.append("set-cookie", clearOidcPkceCookie());
+              return denied;
+            }
+            const redirectUri = process.env.OIDC_REDIRECT_URI?.trim() || \`\${appUrl()}/auth/oidc/callback\`;
+            const profile = await new OidcProvider({ name: "oidc", issuer, clientId, clientSecret, redirectUri })
+              .exchangeCode(code, redirectUri, pkce)
+              .catch(() => null);
+            if (!profile) {
+              const failed = jsonResponse({ error: "Invalid OIDC response." }, { status: 400 });
+              failed.headers.append("set-cookie", clearOidcPkceCookie());
+              return failed;
+            }
+            const login = await completeBrowserSsoLogin(dependencies, profile, "OIDC");
+            login.headers.append("set-cookie", clearOidcPkceCookie());
+            return login;
+          })),
+        },` : "";
   const apiRoutes = jsonApi || cookie ? `
     routes({ kernel, dependencies }) {
-      return {${csrfRoute}${samlRoutes}${githubRoutes}${cookieJsonAuth}${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
+      return {${csrfRoute}${samlRoutes}${githubRoutes}${oidcRoutes}${cookieJsonAuth}${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
       };
     },` : "";
   const mfaLoginBranch = `const mfaResult = completePasswordLogin(user, { mfaCode: mfa_code });
@@ -2311,9 +2384,11 @@ function textField(name, label, type, extra = "") {
 function renderLoginView(layers) {
   const githubLink = layers.extras.oauthGithub && htmlAuthKit(layers.auth) ? `
     <a href="/auth/github">Sign in with GitHub</a>` : "";
+  const oidcLink = layers.extras.oidc && htmlAuthKit(layers.auth) ? `
+    <a href="/auth/oidc">Sign in with OIDC</a>` : "";
   return renderFormView("Sign in", `${textField("email", "Email", "email", 'required autocomplete="username"')}
     ${textField("password", "Password", "password", 'required autocomplete="current-password"')}`, "Sign in", `<a href="/register">Create account</a>
-    <a href="/forgot-password">Forgot password</a>${githubLink}`).replace('action="<%= it.action || "" %>"', 'action="/login"');
+    <a href="/forgot-password">Forgot password</a>${githubLink}${oidcLink}`).replace('action="<%= it.action || "" %>"', 'action="/login"');
 }
 function renderRegisterView() {
   return renderFormView("Create account", `${textField("name", "Name", "text", "required")}
@@ -2734,20 +2809,38 @@ function renderEnvExample(projectName, layers) {
   lines.push("# SAML_IDP_ISSUER=");
   lines.push("# SAML_WANT_RESPONSE_SIGNED=");
   lines.push("# SAML_DISABLE_REQUESTED_AUTHN_CONTEXT=");
-  const oauthOn = Boolean(layers.extras.oauthGithub);
-  lines.push(`FEATURE_OAUTH=${envFlag(oauthOn)}`);
-  if (oauthOn) {
+  const githubOn = Boolean(layers.extras.oauthGithub);
+  const oidcOn = Boolean(layers.extras.oidc);
+  lines.push(`FEATURE_OAUTH=${envFlag(githubOn || oidcOn)}`);
+  if (githubOn) {
     lines.push("GITHUB_CLIENT_ID=");
     lines.push("GITHUB_CLIENT_SECRET=");
     lines.push("GITHUB_REDIRECT_URI=http://localhost:3000/auth/github/callback");
-    lines.push("OAUTH_STATE_SECRET=dev-oauth-state-secret-change-me-please-32");
   } else {
     lines.push("# GITHUB_CLIENT_ID=");
     lines.push("# GITHUB_CLIENT_SECRET=");
     lines.push("# GITHUB_REDIRECT_URI=http://localhost:3000/auth/github/callback");
+  }
+  if (oidcOn) {
+    lines.push("OIDC_ISSUER=http://127.0.0.1:8080");
+    lines.push("OIDC_CLIENT_ID=");
+    lines.push("OIDC_CLIENT_SECRET=");
+    lines.push("OIDC_REDIRECT_URI=http://localhost:3000/auth/oidc/callback");
+    lines.push("# Loopback issuers are allowed when APP_ENV is not production. Other private IdPs:");
+    lines.push("# OIDC_ALLOW_PRIVATE=true");
+  } else {
+    lines.push("# OIDC_ISSUER=");
+    lines.push("# OIDC_CLIENT_ID=");
+    lines.push("# OIDC_CLIENT_SECRET=");
+    lines.push("# OIDC_REDIRECT_URI=http://localhost:3000/auth/oidc/callback");
+    lines.push("# OIDC_ALLOW_PRIVATE=true");
+  }
+  if (githubOn || oidcOn) {
+    lines.push("OAUTH_STATE_SECRET=dev-oauth-state-secret-change-me-please-32");
+  } else {
     lines.push("# OAUTH_STATE_SECRET=");
   }
-  lines.push("# OIDC cookie login is not generated. Use GitHub cookie routes (--oauth-github) or app-owned PKCE.");
+  lines.push("# --oidc (cookie HTML) seals PKCE in the oidc_pkce cookie. Do not call OidcProvider.getAuthorizationUrl().");
   const billingOn = Boolean(layers.extras.billing);
   lines.push(`FEATURE_BILLING=${envFlag(billingOn)}`);
   if (billingOn) {
@@ -2966,9 +3059,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^1.1.5",
-    "@getstrata/cli": "^1.1.5",
-    "@getstrata/core": "^1.1.5"
+    "@getstrata/bootstrap": "^1.1.6",
+    "@getstrata/cli": "^1.1.6",
+    "@getstrata/core": "^1.1.6"
   };
   coreDeps.eta = "^4.6.0";
   if (options.layers?.database === "mysql") {
@@ -3092,6 +3185,9 @@ function renderApiDocs(projectName, layers) {
   if (layers.extras.oauthGithub && authUsesCookie(layers.auth)) {
     rows.push("| `GET` | `/auth/github` | Redirects to GitHub. 404 unless `FEATURE_OAUTH=true`. |", "| `GET` | `/auth/github/callback` | Exchanges the code, JIT user, MFA gate, cookie session. |");
   }
+  if (layers.extras.oidc && authUsesCookie(layers.auth)) {
+    rows.push("| `GET` | `/auth/oidc` | OIDC `createAuthorization()` plus `oidc_pkce` cookie. 404 unless `FEATURE_OAUTH=true`. |", "| `GET` | `/auth/oidc/callback` | Reads PKCE, exchanges the code, JIT user, MFA gate, cookie session. |");
+  }
   const authNote = layers.auth === "headers" ? `Auth is \`headers\`. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`) for local work and tests. There are no login endpoints and no \`users\` table. Production must set \`AUTH_DEV_HEADERS=false\`, which turns those headers off and leaves you without a guard, so pick another auth layer before you ship.` : authUsesToken(layers.auth) ? `Sign in with \`GET /api/v1/auth/csrf\` then \`POST /api/v1/auth/login\` (send \`X-CSRF-Token\`), then send \`Authorization: Bearer <token>\` on every request. Tokens are stored hashed in \`api_tokens\` and expire after \`API_TOKEN_DEFAULT_EXPIRY_DAYS\` (30 in \`.env.example\`). The response includes \`expires_at\`.` : `Mint a JWT with \`POST /api/auth/token\`, then send \`Authorization: Bearer <jwt>\`. JWTs expire; re-mint rather than refreshing in place.`;
   return `# ${projectName} API
 
@@ -3146,6 +3242,7 @@ Import from \`@getstrata/core/...\` subpaths rather than the package root, so si
 function renderIntegrationsReadme(layers) {
   const enabled = [
     layers.extras.oauthGithub ? "GitHub OAuth cookie login (`/auth/github`)" : null,
+    layers.extras.oidc ? "OIDC cookie login (`/auth/oidc`, PKCE in `oidc_pkce`)" : null,
     layers.extras.billing ? "Stripe billing stub (`POST /billing/webhooks/stripe`, `GET /api/v1/billing/subscription`)" : null,
     layers.extras.webhooks ? "Outbound webhooks (`notes.created` listener + `webhook.dispatch` job)" : null
   ].filter((row) => row !== null);
@@ -3154,7 +3251,7 @@ function renderIntegrationsReadme(layers) {
     "",
     "OAuth, billing, outbound webhooks, SIEM, and SAML are **off by default**. Commented placeholders live in `.env.example`. Framework map: [INTEGRATIONS.md](https://github.com/EyK-26/strata/blob/main/docs/INTEGRATIONS.md).",
     "",
-    "Wizard flags (any stack unless noted): `--oauth-github` (cookie HTML), `--billing`, `--webhooks`. They emit modules, migrations, jobs, or listeners. `createApp` still calls `discoverListeners()` and `discoverJobs()`.",
+    "Wizard flags (any stack unless noted): `--oauth-github` and `--oidc` (cookie HTML), `--billing`, `--webhooks`. They emit modules, migrations, jobs, or listeners. `createApp` still calls `discoverListeners()` and `discoverJobs()`.",
     ""
   ];
   if (enabled.length > 0) {
@@ -3255,7 +3352,7 @@ HTML auth kit (restyle \`views/\` and \`public/assets/site.css\`):
 - Register: \`/register\`
 - Forgot password: \`/forgot-password\`
 - Reset password: signed \`/reset-password\` (mail log when \`MAIL_DRIVER=log\`)
-${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}${layers.extras.oauthGithub ? "- GitHub: `/auth/github` (needs `FEATURE_OAUTH=true`)\n" : ""}
+${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}${layers.extras.oauthGithub ? "- GitHub: `/auth/github` (needs `FEATURE_OAUTH=true`)\n" : ""}${layers.extras.oidc ? "- OIDC: `/auth/oidc` (needs `FEATURE_OAUTH=true`; PKCE cookie `oidc_pkce`)\n" : ""}
 Cookie name is \`strata_session\`. Forms send CSRF as \`_token\`.
 ` : ""}${authUsesToken(layers.auth) ? `
 Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Register: \`POST /api/v1/auth/register\`. Forgot/reset: \`POST /api/v1/auth/forgot-password\` and signed \`POST /api/v1/auth/reset-password\`. Send \`Authorization: Bearer\` after login.
@@ -3302,7 +3399,7 @@ The image sets \`APP_ENV=production\` and \`AUTH_DEV_HEADERS=false\`; everything
 - Set \`FEATURE_PUBLIC_READS=false\`. Generated \`.env.example\` already ships \`false\` so \`wrapWebPublicRead\` requires a login. Local storefronts may set \`true\` in \`.env\` for an anonymous catalog; \`assertProductionSecrets()\` rejects \`true\` in production. Do not ship a public-reads production boot.
 - Cross-origin browser calls are off in production until you set \`CORS_ALLOWED_ORIGINS\` to explicit origins. A \`*\` entry is rejected. Non-browser clients are unaffected.
 - Behind a reverse proxy or load balancer, set \`TRUST_FORWARDED_FOR=true\` so throttles and session records see the client address instead of the proxy. Only the rightmost public hop of \`X-Forwarded-For\` is trusted.
-${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}${layers.extras.oauthGithub ? "- Set `OAUTH_STATE_SECRET` and `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`.\n" : ""}${layers.extras.billing ? "- Set `STRIPE_WEBHOOK_SECRET` when `FEATURE_BILLING=true`.\n" : ""}${layers.tenancy === "rls" ? `- \`DATABASE_URL\` must be a \`NOBYPASSRLS\` role, not the \`postgres\` superuser. Generated apps create \`${GENERATED_POSTGRES_APP_ROLE}\` via \`db/ensure-postgres-app-role.sql\` (and Compose init on first empty volume). \`MIGRATION_DATABASE_URL\` may stay the superuser for CREATE ROLE / GRANT / migrate. Production boot rejects username \`postgres\` or \`root\`, then inspects \`pg_roles\` for \`rolsuper\` / \`rolbypassrls\`.
+${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}${layers.extras.oauthGithub ? "- Set `OAUTH_STATE_SECRET` and `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`.\n" : ""}${layers.extras.oidc ? "- Set `OAUTH_STATE_SECRET`, `OIDC_ISSUER`, `OIDC_CLIENT_ID`, and `OIDC_CLIENT_SECRET`. Loopback issuers work outside production; set `OIDC_ALLOW_PRIVATE=true` for other private IdPs.\n" : ""}${layers.extras.billing ? "- Set `STRIPE_WEBHOOK_SECRET` when `FEATURE_BILLING=true`.\n" : ""}${layers.tenancy === "rls" ? `- \`DATABASE_URL\` must be a \`NOBYPASSRLS\` role, not the \`postgres\` superuser. Generated apps create \`${GENERATED_POSTGRES_APP_ROLE}\` via \`db/ensure-postgres-app-role.sql\` (and Compose init on first empty volume). \`MIGRATION_DATABASE_URL\` may stay the superuser for CREATE ROLE / GRANT / migrate. Production boot rejects username \`postgres\` or \`root\`, then inspects \`pg_roles\` for \`rolsuper\` / \`rolbypassrls\`.
 ` : ""}
 \`strata start\` does not migrate when \`APP_ENV=production\`. Run \`bun run db:migrate\` as a deploy step. \`GET /health\` is 200 when \`notes\` is readable (including zero rows) and 503 when that read fails. Redis jobs need a worker: \`bun run queue:work\` (requires \`REDIS_URL\`).
 `;

package/dist/templates/package.json

@@ -12,9 +12,9 @@
     "check": "tsc --noEmit"
   },
   "dependencies": {
-    "@getstrata/bootstrap": "^1.1.5",
-    "@getstrata/cli": "^1.1.5",
-    "@getstrata/core": "^1.1.5",
+    "@getstrata/bootstrap": "^1.1.6",
+    "@getstrata/cli": "^1.1.6",
+    "@getstrata/core": "^1.1.6",
     "eta": "^4.6.0"
   },
   "devDependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/starter",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "description": "Interactive create-strata wizard. Choose each layer; one database engine.",
   "type": "module",
   "license": "MIT",