@getstrata/starter 1.1.6 → 1.1.7

package/dist/cli.js

@@ -1394,17 +1394,18 @@ async function completeBrowserSsoLogin(
   profile: { email: string; name: string },
   label: string,
 ): Promise<Response> {
-  let record = await starterAuthDirectory.findByEmail?.(profile.email);
+  const email = profile.email.trim().toLowerCase();
+  let record = await starterAuthDirectory.findByEmail?.(email);
   if (!record) {
     if ((process.env.FEATURE_REGISTRATION ?? "true") === "false") {
       return jsonResponse({ error: \`\${label} user is not provisioned.\` }, { status: 403 });
     }
     const hashed = await hashPassword(randomBytes(18).toString("hex"));
     try {
-      await runAuthWrite(profile.email, async () => {
+      await runAuthWrite(email, async () => {
         await User.create({
           name: profile.name,
-          email: profile.email,
+          email,
           password: hashed,
           is_admin: false,${samlTenantCreateField}
         });
@@ -1412,7 +1413,7 @@ async function completeBrowserSsoLogin(
     } catch {
       // Unique email: another request already provisioned this user.
     }
-    record = await starterAuthDirectory.findByEmail?.(profile.email);
+    record = await starterAuthDirectory.findByEmail?.(email);
   }
   if (!record) {
     return jsonResponse({ error: \`Could not complete \${label} login.\` }, { status: 500 });
@@ -2385,7 +2386,7 @@ function renderLoginView(layers) {
   const githubLink = layers.extras.oauthGithub && htmlAuthKit(layers.auth) ? `
     <a href="/auth/github">Sign in with GitHub</a>` : "";
   const oidcLink = layers.extras.oidc && htmlAuthKit(layers.auth) ? `
-    <a href="/auth/oidc">Sign in with OIDC</a>` : "";
+    <% if (it.oidcLogin) { %><a href="/auth/oidc">Sign in with OIDC</a><% } %>` : "";
   return renderFormView("Sign in", `${textField("email", "Email", "email", 'required autocomplete="username"')}
     ${textField("password", "Password", "password", 'required autocomplete="current-password"')}`, "Sign in", `<a href="/register">Create account</a>
     <a href="/forgot-password">Forgot password</a>${githubLink}${oidcLink}`).replace('action="<%= it.action || "" %>"', 'action="/login"');
@@ -3059,9 +3060,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^1.1.6",
-    "@getstrata/cli": "^1.1.6",
-    "@getstrata/core": "^1.1.6"
+    "@getstrata/bootstrap": "^1.1.7",
+    "@getstrata/cli": "^1.1.7",
+    "@getstrata/core": "^1.1.7"
   };
   coreDeps.eta = "^4.6.0";
   if (options.layers?.database === "mysql") {
@@ -3273,7 +3274,9 @@ bunx strata openapi:generate
 bunx strata openapi:check
 \`\`\`
 
-Put \`openapi:check\` in CI. A failure means \`docs/openapi.json\` does not match the live route map (billing, auth, webhooks, and anything else you added).
+Put \`openapi:check\` in CI. A failure means \`docs/openapi.json\` does not match the live JSON API route map (billing, auth, webhooks, and anything else you added).
+
+\`openapi:generate\` lists API routes only. HTML admin and storefront paths are not in that file.
 `;
 }
 function renderReadmeIntro(projectName, options) {
@@ -3352,7 +3355,7 @@ HTML auth kit (restyle \`views/\` and \`public/assets/site.css\`):
 - Register: \`/register\`
 - Forgot password: \`/forgot-password\`
 - Reset password: signed \`/reset-password\` (mail log when \`MAIL_DRIVER=log\`)
-${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}${layers.extras.oauthGithub ? "- GitHub: `/auth/github` (needs `FEATURE_OAUTH=true`)\n" : ""}${layers.extras.oidc ? "- OIDC: `/auth/oidc` (needs `FEATURE_OAUTH=true`; PKCE cookie `oidc_pkce`)\n" : ""}
+${layers.extras.emailVerification ? "- Verify email: `/email/verify`\n" : ""}${layers.extras.mfa ? "- MFA challenge: `/login/mfa` and setup: `/account/mfa`\n" : ""}${layers.extras.oauthGithub ? "- GitHub: `/auth/github` (needs `FEATURE_OAUTH=true`). Failures on the callback are JSON, not the login page. State is the signed query value from `createOAuthState()`, not `createOAuthStateCookie()`.\n" : ""}${layers.extras.oidc ? "- OIDC: `/auth/oidc` (needs `FEATURE_OAUTH=true` plus `OIDC_CLIENT_ID` and `OIDC_CLIENT_SECRET`; otherwise the login link stays hidden and the route is 404). PKCE cookie `oidc_pkce`. Callback failures are JSON, not the login page.\n" : ""}
 Cookie name is \`strata_session\`. Forms send CSRF as \`_token\`.
 ` : ""}${authUsesToken(layers.auth) ? `
 Opaque token login: \`POST /api/v1/auth/login\` with \`{ "email", "password" }\`. Register: \`POST /api/v1/auth/register\`. Forgot/reset: \`POST /api/v1/auth/forgot-password\` and signed \`POST /api/v1/auth/reset-password\`. Send \`Authorization: Bearer\` after login.
@@ -4866,10 +4869,13 @@ export async function renderPage(
 ): Promise<Response> {
   const csrfToken = request ? resolveCsrfTokenForRequest(request) : "";
   const flash = currentRequestMeta().flash ?? null;
-${userBlock}
+${userBlock}${layers.extras.oidc ? `
+  const oidcLogin =
+    process.env.FEATURE_OAUTH === "true" &&
+    Boolean(process.env.OIDC_CLIENT_ID?.trim() && process.env.OIDC_CLIENT_SECRET?.trim());` : ""}
   const html = await engine.render(
     template,
-    { ...data, csrfToken, flash, currentUser },
+    { ...data, csrfToken, flash, currentUser${layers.extras.oidc ? ", oidcLogin" : ""} },
     { request },
   );
   return htmlResponse(html, { status });
@@ -4991,16 +4997,22 @@ function renderBillingMigration(layers) {
   ];
   return renderFileMigration(name, up, down);
 }
-function renderDispatchOutboundWebhookJob() {
+function sqlParams(database, count) {
+  return Array.from({ length: count }, (_, index) => database === "postgres" ? `$${index + 1}` : "?").join(", ");
+}
+function renderDispatchOutboundWebhookJob(layers) {
+  const values = sqlParams(layers.database, 6);
   return `import { Job } from "@getstrata/core/queue";
 import { isProductionEnv } from "@getstrata/core/runtime/appEnv";
 import { webhookSignatureHeader } from "@getstrata/core/runtime/appKeyPrefix";
 import { safeFetch } from "@getstrata/core/security/safeFetch";
 import { signWebhookBody } from "@getstrata/core/security/webhookSignature";
+import { runWithMigrationBypass } from "@getstrata/core/tenant/databaseTenantContext";
 import { getSql } from "../bootstrap/database.ts";
 
 interface DispatchOutboundWebhookPayload {
   webhookId: number;
+  event: string;
   url: string;
   secret: string;
   body: string;
@@ -5034,10 +5046,12 @@ class DispatchOutboundWebhookJob extends Job<DispatchOutboundWebhookPayload> {
       error = caught instanceof Error ? caught.message : "webhook dispatch failed";
     }
 
-    await getSql().unsafe(
-      "INSERT INTO webhook_deliveries (webhook_id, event, payload, response_status, attempt, error) VALUES (?, ?, ?, ?, ?, ?)",
-      [payload.webhookId, "notes.created", payload.body, responseStatus, 1, error],
-    );
+    await runWithMigrationBypass(async () => {
+      await getSql().unsafe(
+        "INSERT INTO webhook_deliveries (webhook_id, event, payload, response_status, attempt, error) VALUES (${values})",
+        [payload.webhookId, payload.event, payload.body, responseStatus, 1, error],
+      );
+    });
   }
 }
 
@@ -5060,13 +5074,15 @@ function registerNoteCreatedWebhookListener(): void {
       active: number | boolean;
     }>("SELECT id, url, secret, active FROM webhooks");
     const queue = resolveApplicationQueue();
-    const body = JSON.stringify({ event: "notes.created", data: payload });
+    const event = "notes.created";
+    const body = JSON.stringify({ event, data: payload });
     for (const hook of rows) {
       if (!hook.active) {
         continue;
       }
       await queue.dispatch(new DispatchOutboundWebhookJob(), {
         webhookId: hook.id,
+        event,
         url: hook.url,
         secret: hook.secret,
         body,
@@ -5078,8 +5094,29 @@ function registerNoteCreatedWebhookListener(): void {
 export default registerNoteCreatedWebhookListener;
 `;
 }
+function renderApplyStripeWebhook() {
+  return `interface StripeWebhookEvent {
+  id?: string;
+  type?: string;
+  data?: { object?: Record<string, unknown> };
+}
+
+/**
+ * Called after the Stripe signature verifies. The default does nothing.
+ * Plan and tenant updates belong in this function, not in framework core.
+ * Stripe POSTs have no tenant ALS. See docs/INTEGRATIONS.md before writing tenant tables.
+ */
+async function applyStripeWebhook(_event: StripeWebhookEvent): Promise<void> {
+  return;
+}
+
+export type { StripeWebhookEvent };
+export { applyStripeWebhook };
+`;
+}
 function renderBillingModule(layers) {
   const tenancyOn = usesTenantTable(layers.tenancy);
+  const tenantPlaceholder = layers.database === "postgres" ? "$1" : "?";
   const tenantImport = tenancyOn ? `import { currentTenant } from "@getstrata/core/tenant/tenantContext";
 ` : "";
   const subscriptionQuery = tenancyOn ? `        const tenant = currentTenant();
@@ -5087,7 +5124,7 @@ function renderBillingModule(layers) {
           return jsonResponse({ error: "Tenant context is required." }, { status: 500 });
         }
         const rows = await getSql().unsafe<Record<string, unknown>>(
-          "SELECT plan, status, stripe_subscription_id, current_period_end FROM subscription WHERE tenant_id = ? LIMIT 1",
+          "SELECT plan, status, stripe_subscription_id, current_period_end FROM subscription WHERE tenant_id = ${tenantPlaceholder} LIMIT 1",
           [tenant.id],
         );` : `        const rows = await getSql().unsafe<Record<string, unknown>>(
           "SELECT plan, status, stripe_subscription_id, current_period_end FROM subscription LIMIT 1",
@@ -5095,6 +5132,7 @@ function renderBillingModule(layers) {
   return `import type { AppModule } from "@getstrata/bootstrap/contracts";
 import { jsonResponse, withErrorHandling } from "@getstrata/core/http/response";
 import { verifyStripeWebhookSignature } from "@getstrata/core/security/stripeWebhook";
+import { applyStripeWebhook } from "../../billing/applyStripeWebhook.ts";
 ${tenantImport}import { getSql } from "../../bootstrap/database.ts";
 
 function billingEnabled(): boolean {
@@ -5125,10 +5163,7 @@ const billingModule: AppModule = {
             } catch {
               return jsonResponse({ error: "Invalid JSON." }, { status: 400 });
             }
-            // Persist event.id on stripe_webhook_event yourself. Stripe POSTs have no tenant ALS.
-            // Wrap those writes in runWithMigrationBypass when TENANCY_DRIVER=rls.
-            // See https://github.com/EyK-26/strata/blob/main/docs/INTEGRATIONS.md
-            void event.data;
+            await applyStripeWebhook(event);
             return jsonResponse({ received: true, id: event.id ?? null, type: event.type ?? null });
           }),
         ),
@@ -5623,12 +5658,14 @@ function writeGeneratedFiles(options) {
     removeIfExists(join2(src, "modules/scim/index.ts"));
   }
   if (layers.extras.billing) {
+    writeText(join2(src, "billing/applyStripeWebhook.ts"), renderApplyStripeWebhook());
     writeText(join2(src, "modules/billing/index.ts"), renderBillingModule(layers));
   } else {
+    removeIfExists(join2(src, "billing/applyStripeWebhook.ts"));
     removeIfExists(join2(src, "modules/billing/index.ts"));
   }
   if (layers.extras.webhooks) {
-    writeText(join2(src, "jobs/dispatchOutboundWebhookJob.ts"), renderDispatchOutboundWebhookJob());
+    writeText(join2(src, "jobs/dispatchOutboundWebhookJob.ts"), renderDispatchOutboundWebhookJob(layers));
     writeText(join2(src, "listeners/noteCreatedWebhookListener.ts"), renderNoteCreatedWebhookListener());
   } else {
     removeIfExists(join2(src, "jobs/dispatchOutboundWebhookJob.ts"));

package/dist/templates/overlays/spa-react/frontend/src/pages/HomePage.tsx

@@ -32,10 +32,11 @@ export default function HomePage() {
         </table>
       </div>
 
-      <h2>Add your first resource</h2>
+      <h2>Starter-only example</h2>
       <p>
-        Create a module under <code>src/modules/</code> and return routes from it. The kernel picks
-        it up on the next boot.
+        This empty app already serves <code>GET /api/v1/auth/me</code>. It does not serve{" "}
+        <code>GET /api/v1/notes</code>. The module below is an example you add yourself. Create it
+        under <code>src/modules/</code> and the kernel picks it up on the next boot.
       </p>
 
       <pre className="card">

package/dist/templates/package.json

@@ -12,9 +12,9 @@
     "check": "tsc --noEmit"
   },
   "dependencies": {
-    "@getstrata/bootstrap": "^1.1.6",
-    "@getstrata/cli": "^1.1.6",
-    "@getstrata/core": "^1.1.6",
+    "@getstrata/bootstrap": "^1.1.7",
+    "@getstrata/cli": "^1.1.7",
+    "@getstrata/core": "^1.1.7",
     "eta": "^4.6.0"
   },
   "devDependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/starter",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "description": "Interactive create-strata wizard. Choose each layer; one database engine.",
   "type": "module",
   "license": "MIT",