@getstrata/starter 1.1.5 → 1.1.7

package/dist/cli.js

@@ -120,7 +120,7 @@ function extraApplies(extra, auth) {
   if (extra === "metrics" || extra === "billing" || extra === "webhooks") {
     return true;
   }
-  if (extra === "mfa" || extra === "oauthGithub") {
+  if (extra === "mfa" || extra === "oauthGithub" || extra === "oidc") {
     return htmlAuthKit(auth);
   }
   return authNeedsUsers(auth);
@@ -196,6 +196,7 @@ var noneExtras = {
   scim: false,
   metrics: false,
   oauthGithub: false,
+  oidc: false,
   billing: false,
   webhooks: false
 };
@@ -205,6 +206,7 @@ var enterpriseExtras = {
   scim: true,
   metrics: true,
   oauthGithub: false,
+  oidc: false,
   billing: false,
   webhooks: false
 };
@@ -274,9 +276,10 @@ Options:
   --scim / --no-scim
   --metrics / --no-metrics
   --oauth-github / --no-oauth-github
+  --oidc / --no-oidc
   --billing / --no-billing
   --webhooks / --no-webhooks
-  --extras            Interactive extras list (MFA, email verification, SCIM, metrics, GitHub OAuth, billing, webhooks)
+  --extras            Interactive extras list (MFA, email verification, SCIM, metrics, GitHub OAuth, OIDC, billing, webhooks)
   --docker            Write Docker Compose for every selected tool that needs a service
   --no-docker         Skip docker-compose.yml; use installs already on this machine
   --docker-services   Subset: postgres, mysql, redis, mailpit, adminer (comma-separated)
@@ -382,6 +385,8 @@ function parseCreateStrataArgs(argv) {
       ["--no-metrics", "metrics", false],
       ["--oauth-github", "oauthGithub", true],
       ["--no-oauth-github", "oauthGithub", false],
+      ["--oidc", "oidc", true],
+      ["--no-oidc", "oidc", false],
       ["--billing", "billing", true],
       ["--no-billing", "billing", false],
       ["--webhooks", "webhooks", true],
@@ -509,6 +514,9 @@ function extraFlagName(extra) {
   if (extra === "oauthGithub") {
     return "oauth-github";
   }
+  if (extra === "oidc") {
+    return "oidc";
+  }
   return extra;
 }
 function dropInapplicableExtras(layers, flags) {
@@ -912,6 +920,7 @@ var EXTRA_CHOICES = [
   { value: "scim", label: "scim: /Users adapter" },
   { value: "metrics", label: "metrics: Prometheus token" },
   { value: "oauthGithub", label: "oauth-github: GitHub cookie login at /auth/github" },
+  { value: "oidc", label: "oidc: OIDC cookie login at /auth/oidc (PKCE cookie)" },
   { value: "billing", label: "billing: Stripe webhook stub + GET /api/v1/billing/subscription" },
   { value: "webhooks", label: "webhooks: outbound notes.created job (webhook.dispatch)" }
 ];
@@ -1200,6 +1209,7 @@ function renderAuthModule(layers) {
   }
   const cookie = htmlAuthKit(layers.auth);
   const github = Boolean(layers.extras.oauthGithub && cookie);
+  const oidc = Boolean(layers.extras.oidc && cookie);
   const mfa = Boolean(layers.extras.mfa && cookie);
   const verify = Boolean(layers.extras.emailVerification);
   const jsonApi = authUsesToken(layers.auth) || authUsesJwt(layers.auth);
@@ -1221,6 +1231,11 @@ function renderAuthModule(layers) {
     imports.push(`import { createSamlServiceProvider } from "@getstrata/core/auth/saml/samlServiceProvider";`);
     if (github) {
       imports.push(`import { GitHubOAuthProvider } from "@getstrata/core/auth/oauth/providers";`);
+    }
+    if (oidc) {
+      imports.push(`import { OidcProvider } from "@getstrata/core/auth/oauth/oidcProvider";`);
+    }
+    if (github || oidc) {
       imports.push(`import { appUrl } from "@getstrata/core/runtime/appKeyPrefix";`);
     }
   }
@@ -1251,7 +1266,7 @@ function renderAuthModule(layers) {
     if (mfa) {
       imports.push(`import { sanitizeInternalPath } from "@getstrata/core/http/safeInternalPath";`);
     }
-    imports.push(`import { createOAuthState, verifyOAuthState } from "@getstrata/core/security/oauthState";`);
+    imports.push(oidc ? `import { clearOidcPkceCookie, createOAuthState, readOidcPkceCookie, sealOidcPkceCookie, verifyOAuthState } from "@getstrata/core/security/oauthState";` : `import { createOAuthState, verifyOAuthState } from "@getstrata/core/security/oauthState";`);
   }
   if (jsonApi || cookie) {
     imports.push(`import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";`);
@@ -1379,17 +1394,18 @@ async function completeBrowserSsoLogin(
   profile: { email: string; name: string },
   label: string,
 ): Promise<Response> {
-  let record = await starterAuthDirectory.findByEmail?.(profile.email);
+  const email = profile.email.trim().toLowerCase();
+  let record = await starterAuthDirectory.findByEmail?.(email);
   if (!record) {
     if ((process.env.FEATURE_REGISTRATION ?? "true") === "false") {
       return jsonResponse({ error: \`\${label} user is not provisioned.\` }, { status: 403 });
     }
     const hashed = await hashPassword(randomBytes(18).toString("hex"));
     try {
-      await runAuthWrite(profile.email, async () => {
+      await runAuthWrite(email, async () => {
         await User.create({
           name: profile.name,
-          email: profile.email,
+          email,
           password: hashed,
           is_admin: false,${samlTenantCreateField}
         });
@@ -1397,7 +1413,7 @@ async function completeBrowserSsoLogin(
     } catch {
       // Unique email: another request already provisioned this user.
     }
-    record = await starterAuthDirectory.findByEmail?.(profile.email);
+    record = await starterAuthDirectory.findByEmail?.(email);
   }
   if (!record) {
     return jsonResponse({ error: \`Could not complete \${label} login.\` }, { status: 500 });
@@ -1692,9 +1708,67 @@ async function completeBrowserSsoLogin(
             return completeBrowserSsoLogin(dependencies, profile, "GitHub");
           })),
         },` : "";
+  const oidcRoutes = oidc ? `
+        "/auth/oidc": {
+          GET: kernel.wrap("api", withErrorHandling(async () => {
+            if (process.env.FEATURE_OAUTH !== "true") {
+              return new Response("Not found", { status: 404 });
+            }
+            const issuer = process.env.OIDC_ISSUER?.trim();
+            const clientId = process.env.OIDC_CLIENT_ID?.trim();
+            const clientSecret = process.env.OIDC_CLIENT_SECRET?.trim();
+            if (!issuer || !clientId || !clientSecret) {
+              return new Response("Not found", { status: 404 });
+            }
+            const redirectUri = process.env.OIDC_REDIRECT_URI?.trim() || \`\${appUrl()}/auth/oidc/callback\`;
+            const issued = createOAuthState();
+            const provider = new OidcProvider({ name: "oidc", issuer, clientId, clientSecret, redirectUri });
+            const { url, handshake } = await provider.createAuthorization(issued.state);
+            const redirect = new Response(null, { status: 302, headers: { location: url } });
+            redirect.headers.append(
+              "set-cookie",
+              sealOidcPkceCookie({ state: issued.state, nonce: handshake.nonce, codeVerifier: handshake.codeVerifier }),
+            );
+            return redirect;
+          })),
+        },
+        "/auth/oidc/callback": {
+          GET: kernel.wrap("api", withErrorHandling(async (request) => {
+            if (process.env.FEATURE_OAUTH !== "true") {
+              return new Response("Not found", { status: 404 });
+            }
+            const issuer = process.env.OIDC_ISSUER?.trim();
+            const clientId = process.env.OIDC_CLIENT_ID?.trim();
+            const clientSecret = process.env.OIDC_CLIENT_SECRET?.trim();
+            if (!issuer || !clientId || !clientSecret) {
+              return new Response("Not found", { status: 404 });
+            }
+            const url = new URL(request.url);
+            const code = url.searchParams.get("code");
+            const state = url.searchParams.get("state");
+            const pkce = readOidcPkceCookie(request, state);
+            if (!code || !verifyOAuthState(request, state) || !pkce) {
+              const denied = jsonResponse({ error: "Invalid OIDC state." }, { status: 403 });
+              denied.headers.append("set-cookie", clearOidcPkceCookie());
+              return denied;
+            }
+            const redirectUri = process.env.OIDC_REDIRECT_URI?.trim() || \`\${appUrl()}/auth/oidc/callback\`;
+            const profile = await new OidcProvider({ name: "oidc", issuer, clientId, clientSecret, redirectUri })
+              .exchangeCode(code, redirectUri, pkce)
+              .catch(() => null);
+            if (!profile) {
+              const failed = jsonResponse({ error: "Invalid OIDC response." }, { status: 400 });
+              failed.headers.append("set-cookie", clearOidcPkceCookie());
+              return failed;
+            }
+            const login = await completeBrowserSsoLogin(dependencies, profile, "OIDC");
+            login.headers.append("set-cookie", clearOidcPkceCookie());
+            return login;
+          })),
+        },` : "";
   const apiRoutes = jsonApi || cookie ? `
     routes({ kernel, dependencies }) {
-      return {${csrfRoute}${samlRoutes}${githubRoutes}${cookieJsonAuth}${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
+      return {${csrfRoute}${samlRoutes}${githubRoutes}${oidcRoutes}${cookieJsonAuth}${tokenLogin}${jsonRegister}${jwtLogin}${apiUser}${jsonPassword}${jsonVerify}
       };
     },` : "";
   const mfaLoginBranch = `const mfaResult = completePasswordLogin(user, { mfaCode: mfa_code });
@@ -2311,9 +2385,11 @@ function textField(name, label, type, extra = "") {
 function renderLoginView(layers) {
   const githubLink = layers.extras.oauthGithub && htmlAuthKit(layers.auth) ? `
     <a href="/auth/github">Sign in with GitHub</a>` : "";
+  const oidcLink = layers.extras.oidc && htmlAuthKit(layers.auth) ? `
+    <% if (it.oidcLogin) { %><a href="/auth/oidc">Sign in with OIDC</a><% } %>` : "";
   return renderFormView("Sign in", `${textField("email", "Email", "email", 'required autocomplete="username"')}
     ${textField("password", "Password", "password", 'required autocomplete="current-password"')}`, "Sign in", `<a href="/register">Create account</a>
-    <a href="/forgot-password">Forgot password</a>${githubLink}`).replace('action="<%= it.action || "" %>"', 'action="/login"');
+    <a href="/forgot-password">Forgot password</a>${githubLink}${oidcLink}`).replace('action="<%= it.action || "" %>"', 'action="/login"');
 }
 function renderRegisterView() {
   return renderFormView("Create account", `${textField("name", "Name", "text", "required")}
@@ -2734,20 +2810,38 @@ function renderEnvExample(projectName, layers) {
   lines.push("# SAML_IDP_ISSUER=");
   lines.push("# SAML_WANT_RESPONSE_SIGNED=");
   lines.push("# SAML_DISABLE_REQUESTED_AUTHN_CONTEXT=");
-  const oauthOn = Boolean(layers.extras.oauthGithub);
-  lines.push(`FEATURE_OAUTH=${envFlag(oauthOn)}`);
-  if (oauthOn) {
+  const githubOn = Boolean(layers.extras.oauthGithub);
+  const oidcOn = Boolean(layers.extras.oidc);
+  lines.push(`FEATURE_OAUTH=${envFlag(githubOn || oidcOn)}`);
+  if (githubOn) {
     lines.push("GITHUB_CLIENT_ID=");
     lines.push("GITHUB_CLIENT_SECRET=");
     lines.push("GITHUB_REDIRECT_URI=http://localhost:3000/auth/github/callback");
-    lines.push("OAUTH_STATE_SECRET=dev-oauth-state-secret-change-me-please-32");
   } else {
     lines.push("# GITHUB_CLIENT_ID=");
     lines.push("# GITHUB_CLIENT_SECRET=");
     lines.push("# GITHUB_REDIRECT_URI=http://localhost:3000/auth/github/callback");
+  }
+  if (oidcOn) {
+    lines.push("OIDC_ISSUER=http://127.0.0.1:8080");
+    lines.push("OIDC_CLIENT_ID=");
+    lines.push("OIDC_CLIENT_SECRET=");
+    lines.push("OIDC_REDIRECT_URI=http://localhost:3000/auth/oidc/callback");
+    lines.push("# Loopback issuers are allowed when APP_ENV is not production. Other private IdPs:");
+    lines.push("# OIDC_ALLOW_PRIVATE=true");
+  } else {
+    lines.push("# OIDC_ISSUER=");
+    lines.push("# OIDC_CLIENT_ID=");
+    lines.push("# OIDC_CLIENT_SECRET=");
+    lines.push("# OIDC_REDIRECT_URI=http://localhost:3000/auth/oidc/callback");
+    lines.push("# OIDC_ALLOW_PRIVATE=true");
+  }
+  if (githubOn || oidcOn) {
+    lines.push("OAUTH_STATE_SECRET=dev-oauth-state-secret-change-me-please-32");
+  } else {
     lines.push("# OAUTH_STATE_SECRET=");
   }
-  lines.push("# OIDC cookie login is not generated. Use GitHub cookie routes (--oauth-github) or app-owned PKCE.");
+  lines.push("# --oidc (cookie HTML) seals PKCE in the oidc_pkce cookie. Do not call OidcProvider.getAuthorizationUrl().");
   const billingOn = Boolean(layers.extras.billing);
   lines.push(`FEATURE_BILLING=${envFlag(billingOn)}`);
   if (billingOn) {
@@ -2966,9 +3060,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^1.1.5",
-    "@getstrata/cli": "^1.1.5",
-    "@getstrata/core": "^1.1.5"
+    "@getstrata/bootstrap": "^1.1.7",
+    "@getstrata/cli": "^1.1.7",
+    "@getstrata/core": "^1.1.7"
   };
   coreDeps.eta = "^4.6.0";
   if (options.layers?.database === "mysql") {
@@ -3092,6 +3186,9 @@ function renderApiDocs(projectName, layers) {
   if (layers.extras.oauthGithub && authUsesCookie(layers.auth)) {
     rows.push("| `GET` | `/auth/github` | Redirects to GitHub. 404 unless `FEATURE_OAUTH=true`. |", "| `GET` | `/auth/github/callback` | Exchanges the code, JIT user, MFA gate, cookie session. |");
   }
+  if (layers.extras.oidc && authUsesCookie(layers.auth)) {
+    rows.push("| `GET` | `/auth/oidc` | OIDC `createAuthorization()` plus `oidc_pkce` cookie. 404 unless `FEATURE_OAUTH=true`. |", "| `GET` | `/auth/oidc/callback` | Reads PKCE, exchanges the code, JIT user, MFA gate, cookie session. |");
+  }
   const authNote = layers.auth === "headers" ? `Auth is \`headers\`. Send \`x-authenticated-user-id\` (and optional \`x-authenticated-user-role\`) for local work and tests. There are no login endpoints and no \`users\` table. Production must set \`AUTH_DEV_HEADERS=false\`, which turns those headers off and leaves you without a guard, so pick another auth layer before you ship.` : authUsesToken(layers.auth) ? `Sign in with \`GET /api/v1/auth/csrf\` then \`POST /api/v1/auth/login\` (send \`X-CSRF-Token\`), then send \`Authorization: Bearer <token>\` on every request. Tokens are stored hashed in \`api_tokens\` and expire after \`API_TOKEN_DEFAULT_EXPIRY_DAYS\` (30 in \`.env.example\`). The response includes \`expires_at\`.` : `Mint a JWT with \`POST /api/auth/token\`, then send \`Authorization: Bearer <jwt>\`. JWTs expire; re-mint rather than refreshing in place.`;
   return `# ${projectName} API
 
@@ -3146,6 +3243,7 @@ Import from \`@getstrata/core/...\` subpaths rather than the package root, so si
 function renderIntegrationsReadme(layers) {
   const enabled = [
     layers.extras.oauthGithub ? "GitHub OAuth cookie login (`/auth/github`)" : null,
+    layers.extras.oidc ? "OIDC cookie login (`/auth/oidc`, PKCE in `oidc_pkce`)" : null,
     layers.extras.billing ? "Stripe billing stub (`POST /billing/webhooks/stripe`, `GET /api/v1/billing/subscription`)" : null,
     layers.extras.webhooks ? "Outbound webhooks (`notes.created` listener + `webhook.dispatch` job)" : null
   ].filter((row) => row !== null);
@@ -3154,7 +3252,7 @@ function renderIntegrationsReadme(layers) {
     "",
     "OAuth, billing, outbound webhooks, SIEM, and SAML are **off by default**. Commented placeholders live in `.env.example`. Framework map: [INTEGRATIONS.md](https://github.com/EyK-26/strata/blob/main/docs/INTEGRATIONS.md).",
     "",
-    "Wizard flags (any stack unless noted): `--oauth-github` (cookie HTML), `--billing`, `--webhooks`. They emit modules, migrations, jobs, or listeners. `createApp` still calls `discoverListeners()` and `discoverJobs()`.",
+    "Wizard flags (any stack unless noted): `--oauth-github` and `--oidc` (cookie HTML), `--billing`, `--webhooks`. They emit modules, migrations, jobs, or listeners. `createApp` still calls `discoverListeners()` and `discoverJobs()`.",
     ""
   ];
   if (enabled.length > 0) {
@@ -3176,7 +3274,9 @@ bunx strata openapi:generate
 bunx strata openapi:check
 \`\`\`
 
-Put \`openapi:check\` in CI. A failure means \`docs/openapi.json\` does not match the live route map (billing, auth, webhooks, and anything else you added).
+Put \`openapi:check\` in CI. A failure means \`docs/openapi.json\` does not match the live JSON API route map (billing, auth, webhooks, and anything else you added).
+
+\`openapi:generate\` lists API routes only. HTML admin and storefront paths are not in that file.
 `;
 }
 function renderReadmeIntro(projectName, options) {
@@ -3255,7 +3355,7 @@ HTML auth kit (restyle \`views/\` and \`public/assets/site.css\`):
 - Register: \`/register\`
 - Forgot password: \`/forgot-password\`
 - Reset password: signed \`/reset-password\` (mail log when \`MAIL_DRIVER=log\`)
-${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}${layers.extras.oauthGithub ? "- GitHub: `/auth/github` (needs `FEATURE_OAUTH=true`)\n" : ""}
+${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}${layers.extras.oauthGithub ? "- GitHub: `/auth/github` (needs `FEATURE_OAUTH=true`). Failures on the callback are JSON, not the login page. State is the signed query value from `createOAuthState()`, not `createOAuthStateCookie()`.\n" : ""}${layers.extras.oidc ? "- OIDC: `/auth/oidc` (needs `FEATURE_OAUTH=true` plus `OIDC_CLIENT_ID` and `OIDC_CLIENT_SECRET`; otherwise the login link stays hidden and the route is 404). PKCE cookie `oidc_pkce`. Callback failures are JSON, not the login page.\n" : ""}
 Cookie name is \`strata_session\`. Forms send CSRF as \`_token\`.
 ` : ""}${authUsesToken(layers.auth) ? `
 Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Register: \`POST /api/v1/auth/register\`. Forgot/reset: \`POST /api/v1/auth/forgot-password\` and signed \`POST /api/v1/auth/reset-password\`. Send \`Authorization: Bearer\` after login.
@@ -3302,7 +3402,7 @@ The image sets \`APP_ENV=production\` and \`AUTH_DEV_HEADERS=false\`; everything
 - Set \`FEATURE_PUBLIC_READS=false\`. Generated \`.env.example\` already ships \`false\` so \`wrapWebPublicRead\` requires a login. Local storefronts may set \`true\` in \`.env\` for an anonymous catalog; \`assertProductionSecrets()\` rejects \`true\` in production. Do not ship a public-reads production boot.
 - Cross-origin browser calls are off in production until you set \`CORS_ALLOWED_ORIGINS\` to explicit origins. A \`*\` entry is rejected. Non-browser clients are unaffected.
 - Behind a reverse proxy or load balancer, set \`TRUST_FORWARDED_FOR=true\` so throttles and session records see the client address instead of the proxy. Only the rightmost public hop of \`X-Forwarded-For\` is trusted.
-${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}${layers.extras.oauthGithub ? "- Set `OAUTH_STATE_SECRET` and `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`.\n" : ""}${layers.extras.billing ? "- Set `STRIPE_WEBHOOK_SECRET` when `FEATURE_BILLING=true`.\n" : ""}${layers.tenancy === "rls" ? `- \`DATABASE_URL\` must be a \`NOBYPASSRLS\` role, not the \`postgres\` superuser. Generated apps create \`${GENERATED_POSTGRES_APP_ROLE}\` via \`db/ensure-postgres-app-role.sql\` (and Compose init on first empty volume). \`MIGRATION_DATABASE_URL\` may stay the superuser for CREATE ROLE / GRANT / migrate. Production boot rejects username \`postgres\` or \`root\`, then inspects \`pg_roles\` for \`rolsuper\` / \`rolbypassrls\`.
+${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" : ""}${authUsesToken(layers.auth) ? "- Set `TOKEN_HASH_PEPPER`.\n" : ""}${layers.extras.scim ? "- Set `SCIM_BEARER_TOKEN`.\n" : ""}${layers.extras.metrics ? "- Set `METRICS_TOKEN`.\n" : ""}${layers.extras.oauthGithub ? "- Set `OAUTH_STATE_SECRET` and `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET`.\n" : ""}${layers.extras.oidc ? "- Set `OAUTH_STATE_SECRET`, `OIDC_ISSUER`, `OIDC_CLIENT_ID`, and `OIDC_CLIENT_SECRET`. Loopback issuers work outside production; set `OIDC_ALLOW_PRIVATE=true` for other private IdPs.\n" : ""}${layers.extras.billing ? "- Set `STRIPE_WEBHOOK_SECRET` when `FEATURE_BILLING=true`.\n" : ""}${layers.tenancy === "rls" ? `- \`DATABASE_URL\` must be a \`NOBYPASSRLS\` role, not the \`postgres\` superuser. Generated apps create \`${GENERATED_POSTGRES_APP_ROLE}\` via \`db/ensure-postgres-app-role.sql\` (and Compose init on first empty volume). \`MIGRATION_DATABASE_URL\` may stay the superuser for CREATE ROLE / GRANT / migrate. Production boot rejects username \`postgres\` or \`root\`, then inspects \`pg_roles\` for \`rolsuper\` / \`rolbypassrls\`.
 ` : ""}
 \`strata start\` does not migrate when \`APP_ENV=production\`. Run \`bun run db:migrate\` as a deploy step. \`GET /health\` is 200 when \`notes\` is readable (including zero rows) and 503 when that read fails. Redis jobs need a worker: \`bun run queue:work\` (requires \`REDIS_URL\`).
 `;
@@ -4769,10 +4869,13 @@ export async function renderPage(
 ): Promise<Response> {
   const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
   const flash = currentRequestMeta().flash ?? null;
-${userBlock}
+${userBlock}${layers.extras.oidc ? `
+  const oidcLogin =
+    process.env.FEATURE_OAUTH === "true" &&
+    Boolean(process.env.OIDC_CLIENT_ID?.trim() && process.env.OIDC_CLIENT_SECRET?.trim());` : ""}
   const html = await engine.render(
     template,
-    { ...data, csrfToken, flash, currentUser },
+    { ...data, csrfToken, flash, currentUser${layers.extras.oidc ? ", oidcLogin" : ""} },
     { request },
   );
   return htmlResponse(html, { status });
@@ -4894,16 +4997,22 @@ function renderBillingMigration(layers) {
   ];
   return renderFileMigration(name, up, down);
 }
-function renderDispatchOutboundWebhookJob() {
+function sqlParams(database, count) {
+  return Array.from({ length: count }, (_, index) => database === "postgres" ? `$${index + 1}` : "?").join(", ");
+}
+function renderDispatchOutboundWebhookJob(layers) {
+  const values = sqlParams(layers.database, 6);
   return `import { Job } from "@getstrata/core/queue";
 import { isProductionEnv } from "@getstrata/core/runtime/appEnv";
 import { webhookSignatureHeader } from "@getstrata/core/runtime/appKeyPrefix";
 import { safeFetch } from "@getstrata/core/security/safeFetch";
 import { signWebhookBody } from "@getstrata/core/security/webhookSignature";
+import { runWithMigrationBypass } from "@getstrata/core/tenant/databaseTenantContext";
 import { getSql } from "../bootstrap/database.ts";
 
 interface DispatchOutboundWebhookPayload {
   webhookId: number;
+  event: string;
   url: string;
   secret: string;
   body: string;
@@ -4937,10 +5046,12 @@ class DispatchOutboundWebhookJob extends Job<DispatchOutboundWebhookPayload> {
       error = caught instanceof Error ? caught.message : "webhook dispatch failed";
     }
 
-    await getSql().unsafe(
-      "INSERT INTO webhook_deliveries (webhook_id, event, payload, response_status, attempt, error) VALUES (?, ?, ?, ?, ?, ?)",
-      [payload.webhookId, "notes.created", payload.body, responseStatus, 1, error],
-    );
+    await runWithMigrationBypass(async () => {
+      await getSql().unsafe(
+        "INSERT INTO webhook_deliveries (webhook_id, event, payload, response_status, attempt, error) VALUES (${values})",
+        [payload.webhookId, payload.event, payload.body, responseStatus, 1, error],
+      );
+    });
   }
 }
 
@@ -4963,13 +5074,15 @@ function registerNoteCreatedWebhookListener(): void {
       active: number | boolean;
     }>("SELECT id, url, secret, active FROM webhooks");
     const queue = resolveApplicationQueue();
-    const body = JSON.stringify({ event: "notes.created", data: payload });
+    const event = "notes.created";
+    const body = JSON.stringify({ event, data: payload });
     for (const hook of rows) {
       if (!hook.active) {
         continue;
       }
       await queue.dispatch(new DispatchOutboundWebhookJob(), {
         webhookId: hook.id,
+        event,
         url: hook.url,
         secret: hook.secret,
         body,
@@ -4981,8 +5094,29 @@ function registerNoteCreatedWebhookListener(): void {
 export default registerNoteCreatedWebhookListener;
 `;
 }
+function renderApplyStripeWebhook() {
+  return `interface StripeWebhookEvent {
+  id?: string;
+  type?: string;
+  data?: { object?: Record<string, unknown> };
+}
+
+/**
+ * Called after the Stripe signature verifies. The default does nothing.
+ * Plan and tenant updates belong in this function, not in framework core.
+ * Stripe POSTs have no tenant ALS. See docs/INTEGRATIONS.md before writing tenant tables.
+ */
+async function applyStripeWebhook(_event: StripeWebhookEvent): Promise<void> {
+  return;
+}
+
+export type { StripeWebhookEvent };
+export { applyStripeWebhook };
+`;
+}
 function renderBillingModule(layers) {
   const tenancyOn = usesTenantTable(layers.tenancy);
+  const tenantPlaceholder = layers.database === "postgres" ? "$1" : "?";
   const tenantImport = tenancyOn ? `import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 ` : "";
   const subscriptionQuery = tenancyOn ? `        const tenant = currentTenant();
@@ -4990,7 +5124,7 @@ function renderBillingModule(layers) {
           return jsonResponse({ error: "Tenant context is required." }, { status: 500 });
         }
         const rows = await getSql().unsafe<Record<string, unknown>>(
-          "SELECT plan, status, stripe_subscription_id, current_period_end FROM subscription WHERE tenant_id = ? LIMIT 1",
+          "SELECT plan, status, stripe_subscription_id, current_period_end FROM subscription WHERE tenant_id = ${tenantPlaceholder} LIMIT 1",
           [tenant.id],
         );` : `        const rows = await getSql().unsafe<Record<string, unknown>>(
           "SELECT plan, status, stripe_subscription_id, current_period_end FROM subscription LIMIT 1",
@@ -4998,6 +5132,7 @@ function renderBillingModule(layers) {
   return `import type { AppModule } from "@getstrata/bootstrap/contracts";
 import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";
 import { verifyStripeWebhookSignature } from "@getstrata/core/security/stripeWebhook";
+import { applyStripeWebhook } from "../../billing/applyStripeWebhook.ts";
 ${tenantImport}import { getSql } from "../../bootstrap/database.ts";
 
 function billingEnabled(): boolean {
@@ -5028,10 +5163,7 @@ const billingModule: AppModule = {
             } catch {
               return jsonResponse({ error: "Invalid JSON." }, { status: 400 });
             }
-            // Persist event.id on stripe_webhook_event yourself. Stripe POSTs have no tenant ALS.
-            // Wrap those writes in runWithMigrationBypass when TENANCY_DRIVER=rls.
-            // See https://github.com/EyK-26/strata/blob/main/docs/INTEGRATIONS.md
-            void event.data;
+            await applyStripeWebhook(event);
             return jsonResponse({ received: true, id: event.id ?? null, type: event.type ?? null });
           }),
         ),
@@ -5526,12 +5658,14 @@ function writeGeneratedFiles(options) {
     removeIfExists(join2(src, "modules/scim/index.ts"));
   }
   if (layers.extras.billing) {
+    writeText(join2(src, "billing/applyStripeWebhook.ts"), renderApplyStripeWebhook());
     writeText(join2(src, "modules/billing/index.ts"), renderBillingModule(layers));
   } else {
+    removeIfExists(join2(src, "billing/applyStripeWebhook.ts"));
     removeIfExists(join2(src, "modules/billing/index.ts"));
   }
   if (layers.extras.webhooks) {
-    writeText(join2(src, "jobs/dispatchOutboundWebhookJob.ts"), renderDispatchOutboundWebhookJob());
+    writeText(join2(src, "jobs/dispatchOutboundWebhookJob.ts"), renderDispatchOutboundWebhookJob(layers));
     writeText(join2(src, "listeners/noteCreatedWebhookListener.ts"), renderNoteCreatedWebhookListener());
   } else {
     removeIfExists(join2(src, "jobs/dispatchOutboundWebhookJob.ts"));

package/dist/templates/overlays/spa-react/frontend/src/pages/HomePage.tsx

@@ -32,10 +32,11 @@ export default function HomePage() {
         </table>
       </div>
 
-      <h2>Add your first resource</h2>
+      <h2>Starter-only example</h2>
       <p>
-        Create a module under <code>src/modules/</code> and return routes from it. The kernel picks
-        it up on the next boot.
+        This empty app already serves <code>GET /api/v1/auth/me</code>. It does not serve{" "}
+        <code>GET /api/v1/notes</code>. The module below is an example you add yourself. Create it
+        under <code>src/modules/</code> and the kernel picks it up on the next boot.
       </p>
 
       <pre className="card">

package/dist/templates/package.json

@@ -12,9 +12,9 @@
     "check": "tsc --noEmit"
   },
   "dependencies": {
-    "@getstrata/bootstrap": "^1.1.5",
-    "@getstrata/cli": "^1.1.5",
-    "@getstrata/core": "^1.1.5",
+    "@getstrata/bootstrap": "^1.1.7",
+    "@getstrata/cli": "^1.1.7",
+    "@getstrata/core": "^1.1.7",
     "eta": "^4.6.0"
   },
   "devDependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/starter",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Interactive create-strata wizard. Choose each layer; one database engine.",
   "type": "module",
   "license": "MIT",