@idevconn/create-icore 0.1.0

package/templates/libs/auth-client/project.json

@@ -0,0 +1,19 @@
+{
+  "name": "auth-client",
+  "$schema": "../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "libs/auth-client/src",
+  "projectType": "library",
+  "tags": [],
+  "targets": {
+    "build": {
+      "executor": "@nx/js:tsc",
+      "outputs": ["{options.outputPath}"],
+      "options": {
+        "outputPath": "dist/libs/auth-client",
+        "main": "libs/auth-client/src/index.ts",
+        "tsConfig": "libs/auth-client/tsconfig.lib.json",
+        "assets": ["libs/auth-client/*.md"]
+      }
+    }
+  }
+}

package/templates/libs/auth-client/src/index.ts

@@ -0,0 +1,2 @@
+export * from './lib/auth-client.module';
+export * from './lib/auth-client.service';

package/templates/libs/auth-client/src/lib/auth-client.module.ts

@@ -0,0 +1,25 @@
+import { DynamicModule, Module } from '@nestjs/common';
+import { ClientsModule } from '@nestjs/microservices';
+import { buildTransport } from '@icore/shared';
+import { AuthClientService } from './auth-client.service';
+
+export const AUTH_CLIENT = 'AUTH_CLIENT';
+
+@Module({})
+export class AuthClientModule {
+  static forRoot(): DynamicModule {
+    return {
+      module: AuthClientModule,
+      imports: [
+        ClientsModule.registerAsync([
+          {
+            name: AUTH_CLIENT,
+            useFactory: () => buildTransport('AUTH'),
+          },
+        ]),
+      ],
+      providers: [AuthClientService],
+      exports: [AuthClientService],
+    };
+  }
+}

package/templates/libs/auth-client/src/lib/auth-client.service.ts

@@ -0,0 +1,30 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { ClientProxy } from '@nestjs/microservices';
+import { firstValueFrom } from 'rxjs';
+import type { AuthSession, VerifiedToken } from '@icore/shared';
+import { AUTH_CLIENT } from './auth-client.module';
+
+@Injectable()
+export class AuthClientService {
+  constructor(@Inject(AUTH_CLIENT) private readonly client: ClientProxy) {}
+
+  verify(token: string): Promise<VerifiedToken> {
+    return firstValueFrom(this.client.send<VerifiedToken>('auth.verify', { token }));
+  }
+
+  login(email: string, password: string): Promise<AuthSession> {
+    return firstValueFrom(this.client.send<AuthSession>('auth.login', { email, password }));
+  }
+
+  signup(email: string, password: string): Promise<AuthSession> {
+    return firstValueFrom(this.client.send<AuthSession>('auth.signup', { email, password }));
+  }
+
+  refresh(refreshToken: string): Promise<AuthSession> {
+    return firstValueFrom(this.client.send<AuthSession>('auth.refresh', { refreshToken }));
+  }
+
+  setRole(uid: string, role: string): Promise<void> {
+    return firstValueFrom(this.client.send<void>('auth.setRole', { uid, role }));
+  }
+}

package/templates/libs/auth-client/tsconfig.json

@@ -0,0 +1,24 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "module": "node16",
+    "moduleResolution": "node16",
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "importHelpers": true,
+    "noImplicitOverride": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "noPropertyAccessFromIndexSignature": true
+  },
+  "files": [],
+  "include": [],
+  "references": [
+    {
+      "path": "./tsconfig.lib.json"
+    },
+    {
+      "path": "./tsconfig.spec.json"
+    }
+  ]
+}

package/templates/libs/auth-client/tsconfig.lib.json

@@ -0,0 +1,26 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../dist/out-tsc",
+    "declaration": true,
+    "types": ["node"],
+    "experimentalDecorators": true,
+    "emitDecoratorMetadata": true,
+    "target": "es2021"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vitest.config.ts",
+    "vitest.config.mts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.js",
+    "src/**/*.spec.js",
+    "src/**/*.test.jsx",
+    "src/**/*.spec.jsx"
+  ]
+}

package/templates/libs/auth-client/tsconfig.spec.json

@@ -0,0 +1,22 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../dist/out-tsc",
+    "types": ["vitest/globals", "vitest/importMeta", "vite/client", "node", "vitest"]
+  },
+  "include": [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vitest.config.ts",
+    "vitest.config.mts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.js",
+    "src/**/*.spec.js",
+    "src/**/*.test.jsx",
+    "src/**/*.spec.jsx",
+    "src/**/*.d.ts"
+  ]
+}

package/templates/libs/auth-client/vitest.config.mts

@@ -0,0 +1,22 @@
+import { defineConfig } from 'vitest/config';
+import { nxViteTsPaths } from '@nx/vite/plugins/nx-tsconfig-paths.plugin';
+import { nxCopyAssetsPlugin } from '@nx/vite/plugins/nx-copy-assets.plugin';
+
+export default defineConfig(() => ({
+  root: __dirname,
+  cacheDir: '../../node_modules/.vite/libs/auth-client',
+  plugins: [nxViteTsPaths(), nxCopyAssetsPlugin(['*.md'])],
+  test: {
+    name: 'auth-client',
+    watch: false,
+    globals: true,
+    environment: 'node',
+    include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
+    passWithNoTests: true,
+    reporters: ['default'],
+    coverage: {
+      reportsDirectory: '../../coverage/libs/auth-client',
+      provider: 'v8' as const,
+    },
+  },
+}));

package/templates/libs/auth-strategies/firebase/README.md

@@ -0,0 +1,11 @@
+# auth-firebase
+
+This library was generated with [Nx](https://nx.dev).
+
+## Building
+
+Run `nx build auth-firebase` to build the library.
+
+## Running unit tests
+
+Run `nx test auth-firebase` to execute the unit tests via [Vitest](https://vitest.dev/).

package/templates/libs/auth-strategies/firebase/eslint.config.mjs

@@ -0,0 +1,22 @@
+import baseConfig from '../../../eslint.config.mjs';
+
+export default [
+  ...baseConfig,
+  {
+    files: ['**/*.json'],
+    rules: {
+      '@nx/dependency-checks': [
+        'error',
+        {
+          ignoredFiles: [
+            '{projectRoot}/eslint.config.{js,cjs,mjs,ts,cts,mts}',
+            '{projectRoot}/vitest.config.{js,ts,mjs,mts}',
+          ],
+        },
+      ],
+    },
+    languageOptions: {
+      parser: await import('jsonc-eslint-parser'),
+    },
+  },
+];

package/templates/libs/auth-strategies/firebase/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@icore/auth-firebase",
+  "version": "0.0.1",
+  "private": true,
+  "type": "commonjs",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "dependencies": {
+    "@icore/shared": "*",
+    "tslib": "^2.3.0"
+  },
+  "devDependencies": {
+    "vitest": "^4.0.0"
+  }
+}

package/templates/libs/auth-strategies/firebase/project.json

@@ -0,0 +1,19 @@
+{
+  "name": "auth-firebase",
+  "$schema": "../../../node_modules/nx/schemas/project-schema.json",
+  "sourceRoot": "libs/auth-strategies/firebase/src",
+  "projectType": "library",
+  "tags": [],
+  "targets": {
+    "build": {
+      "executor": "@nx/js:tsc",
+      "outputs": ["{options.outputPath}"],
+      "options": {
+        "outputPath": "dist/libs/auth-strategies/firebase",
+        "main": "libs/auth-strategies/firebase/src/index.ts",
+        "tsConfig": "libs/auth-strategies/firebase/tsconfig.lib.json",
+        "assets": ["libs/auth-strategies/firebase/*.md"]
+      }
+    }
+  }
+}

package/templates/libs/auth-strategies/firebase/src/index.ts

@@ -0,0 +1,4 @@
+export * from './lib/firebase-auth.strategy';
+export * from './lib/identity-toolkit.client';
+export * from './lib/testing/mock-identity-toolkit';
+export * from './lib/testing/mock-admin-auth';

package/templates/libs/auth-strategies/firebase/src/lib/__tests__/firebase-auth.contract.unit.test.ts

@@ -0,0 +1,13 @@
+import { runAuthContract } from '@icore/shared';
+import { FirebaseAuthStrategy } from '../firebase-auth.strategy';
+import { createMockIdentityToolkit } from '../testing/mock-identity-toolkit';
+import { createMockAdminAuth } from '../testing/mock-admin-auth';
+
+runAuthContract('FirebaseAuthStrategy', () => {
+  const toolkit = createMockIdentityToolkit();
+  const adminAuth = createMockAdminAuth({ identityToolkit: toolkit });
+  return new FirebaseAuthStrategy({
+    identityToolkit: toolkit.client,
+    adminAuth,
+  });
+});

package/templates/libs/auth-strategies/firebase/src/lib/firebase-auth.strategy.ts

@@ -0,0 +1,77 @@
+import type { AuthSession, AuthStrategy, VerifiedToken } from '@icore/shared';
+import type { IdentityToolkitClient } from './identity-toolkit.client';
+
+export interface FirebaseAdminAuthLike {
+  verifyIdToken(idToken: string): Promise<{ uid: string; email?: string; role?: string }>;
+  setCustomUserClaims(uid: string, claims: Record<string, unknown>): Promise<void>;
+  getUser(
+    uid: string,
+  ): Promise<{ uid: string; email?: string; customClaims?: Record<string, unknown> }>;
+}
+
+export interface FirebaseAuthStrategyOptions {
+  identityToolkit: IdentityToolkitClient;
+  adminAuth: FirebaseAdminAuthLike;
+}
+
+export class FirebaseAuthStrategy implements AuthStrategy {
+  private readonly identityToolkit: IdentityToolkitClient;
+  private readonly adminAuth: FirebaseAdminAuthLike;
+
+  constructor(opts: FirebaseAuthStrategyOptions) {
+    this.identityToolkit = opts.identityToolkit;
+    this.adminAuth = opts.adminAuth;
+  }
+
+  async signUp(email: string, password: string): Promise<AuthSession> {
+    const res = await this.identityToolkit.signUp(email, password);
+    return {
+      accessToken: res.idToken,
+      refreshToken: res.refreshToken,
+      expiresIn: Number(res.expiresIn),
+      user: { id: res.localId, email: res.email },
+    };
+  }
+
+  async signIn(email: string, password: string): Promise<AuthSession> {
+    const res = await this.identityToolkit.signIn(email, password);
+    return {
+      accessToken: res.idToken,
+      refreshToken: res.refreshToken,
+      expiresIn: Number(res.expiresIn),
+      user: { id: res.localId, email: res.email },
+    };
+  }
+
+  async refresh(refreshToken: string): Promise<AuthSession> {
+    const res = await this.identityToolkit.refresh(refreshToken);
+    // Firebase doesn't return email on the refresh endpoint; backfill via verifyIdToken
+    const verified = await this.adminAuth.verifyIdToken(res.id_token);
+    return {
+      accessToken: res.id_token,
+      refreshToken: res.refresh_token,
+      expiresIn: Number(res.expires_in),
+      user: { id: res.user_id, email: verified.email ?? '' },
+    };
+  }
+
+  async verifyToken(token: string): Promise<VerifiedToken> {
+    const decoded = await this.adminAuth.verifyIdToken(token);
+    return {
+      uid: decoded.uid,
+      email: decoded.email,
+      role: decoded.role,
+    };
+  }
+
+  async setRole(uid: string, role: string): Promise<void> {
+    await this.adminAuth.setCustomUserClaims(uid, { role });
+  }
+
+  async getRole(uid: string): Promise<string | null> {
+    const user = await this.adminAuth.getUser(uid);
+    const claims = user.customClaims ?? {};
+    const role = claims['role'];
+    return typeof role === 'string' ? role : null;
+  }
+}

package/templates/libs/auth-strategies/firebase/src/lib/identity-toolkit.client.ts

@@ -0,0 +1,72 @@
+export interface IdentityToolkitSignUpResponse {
+  localId: string;
+  email: string;
+  idToken: string;
+  refreshToken: string;
+  expiresIn: string;
+}
+
+export interface IdentityToolkitSignInResponse extends IdentityToolkitSignUpResponse {
+  registered: boolean;
+}
+
+export interface IdentityToolkitRefreshResponse {
+  id_token: string;
+  refresh_token: string;
+  expires_in: string;
+  user_id: string;
+}
+
+export interface IdentityToolkitClient {
+  signUp(email: string, password: string): Promise<IdentityToolkitSignUpResponse>;
+  signIn(email: string, password: string): Promise<IdentityToolkitSignInResponse>;
+  refresh(refreshToken: string): Promise<IdentityToolkitRefreshResponse>;
+}
+
+interface IdentityToolkitError {
+  error?: { message?: string; code?: number };
+}
+
+export class HttpIdentityToolkitClient implements IdentityToolkitClient {
+  constructor(private readonly apiKey: string) {}
+
+  async signUp(email: string, password: string): Promise<IdentityToolkitSignUpResponse> {
+    return this.post<IdentityToolkitSignUpResponse>(
+      'https://identitytoolkit.googleapis.com/v1/accounts:signUp',
+      { email, password, returnSecureToken: true },
+    );
+  }
+
+  async signIn(email: string, password: string): Promise<IdentityToolkitSignInResponse> {
+    return this.post<IdentityToolkitSignInResponse>(
+      'https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword',
+      { email, password, returnSecureToken: true },
+    );
+  }
+
+  async refresh(refreshToken: string): Promise<IdentityToolkitRefreshResponse> {
+    const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${this.apiKey}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken }),
+    });
+    if (!res.ok) {
+      const payload = (await res.json().catch(() => ({}))) as IdentityToolkitError;
+      throw new Error(payload.error?.message ?? `firebase_refresh_failed_${res.status}`);
+    }
+    return res.json() as Promise<IdentityToolkitRefreshResponse>;
+  }
+
+  private async post<T>(url: string, body: Record<string, unknown>): Promise<T> {
+    const res = await fetch(`${url}?key=${this.apiKey}`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+      const payload = (await res.json().catch(() => ({}))) as IdentityToolkitError;
+      throw new Error(payload.error?.message ?? `firebase_request_failed_${res.status}`);
+    }
+    return res.json() as Promise<T>;
+  }
+}

package/templates/libs/auth-strategies/firebase/src/lib/testing/mock-admin-auth.ts

@@ -0,0 +1,41 @@
+import type { MockHandle } from './mock-identity-toolkit';
+
+interface FakeAdminAuthOptions {
+  identityToolkit: MockHandle;
+}
+
+export interface FakeAdminAuth {
+  verifyIdToken(idToken: string): Promise<{ uid: string; email?: string; role?: string }>;
+  setCustomUserClaims(uid: string, claims: Record<string, unknown>): Promise<void>;
+  getUser(
+    uid: string,
+  ): Promise<{ uid: string; email?: string; customClaims?: Record<string, unknown> }>;
+}
+
+export function createMockAdminAuth(opts: FakeAdminAuthOptions): FakeAdminAuth {
+  const roles = new Map<string, string>();
+
+  return {
+    async verifyIdToken(idToken) {
+      const uid = opts.identityToolkit.tokensToUid.get(idToken);
+      if (!uid) throw new Error('TOKEN_NOT_FOUND');
+      const user = [...opts.identityToolkit.users.values()].find((u) => u.localId === uid);
+      if (!user) throw new Error('USER_NOT_FOUND');
+      return { uid: user.localId, email: user.email, role: roles.get(uid) };
+    },
+    async setCustomUserClaims(uid, claims) {
+      const role = claims['role'];
+      if (typeof role === 'string') roles.set(uid, role);
+    },
+    async getUser(uid) {
+      const user = [...opts.identityToolkit.users.values()].find((u) => u.localId === uid);
+      if (!user) throw new Error('USER_NOT_FOUND');
+      const role = roles.get(uid);
+      return {
+        uid: user.localId,
+        email: user.email,
+        customClaims: role ? { role } : undefined,
+      };
+    },
+  };
+}

package/templates/libs/auth-strategies/firebase/src/lib/testing/mock-identity-toolkit.ts

@@ -0,0 +1,76 @@
+import { randomUUID } from 'node:crypto';
+import type {
+  IdentityToolkitClient,
+  IdentityToolkitRefreshResponse,
+  IdentityToolkitSignInResponse,
+  IdentityToolkitSignUpResponse,
+} from '../identity-toolkit.client';
+
+interface FakeUser {
+  localId: string;
+  email: string;
+  password: string;
+}
+
+export interface MockHandle {
+  client: IdentityToolkitClient;
+  users: Map<string, FakeUser>;
+  tokensToUid: Map<string, string>;
+  refreshToUid: Map<string, string>;
+}
+
+export function createMockIdentityToolkit(): MockHandle {
+  const users = new Map<string, FakeUser>();
+  const tokensToUid = new Map<string, string>();
+  const refreshToUid = new Map<string, string>();
+
+  function issue(user: FakeUser) {
+    const idToken = `id_${user.localId}_${randomUUID()}`;
+    const refreshToken = `rt_${user.localId}_${randomUUID()}`;
+    tokensToUid.set(idToken, user.localId);
+    refreshToUid.set(refreshToken, user.localId);
+    return { idToken, refreshToken, expiresIn: '3600' };
+  }
+
+  const client: IdentityToolkitClient = {
+    async signUp(email, password) {
+      for (const u of users.values()) {
+        if (u.email === email) throw new Error('EMAIL_EXISTS');
+      }
+      const user: FakeUser = { localId: `uid_${users.size + 1}`, email, password };
+      users.set(user.localId, user);
+      const session = issue(user);
+      return { localId: user.localId, email, ...session } as IdentityToolkitSignUpResponse;
+    },
+    async signIn(email, password) {
+      for (const u of users.values()) {
+        if (u.email === email && u.password === password) {
+          const session = issue(u);
+          return {
+            localId: u.localId,
+            email,
+            registered: true,
+            ...session,
+          } as IdentityToolkitSignInResponse;
+        }
+      }
+      throw new Error('EMAIL_NOT_FOUND_OR_INVALID_PASSWORD');
+    },
+    async refresh(refreshToken) {
+      const uid = refreshToUid.get(refreshToken);
+      if (!uid) throw new Error('INVALID_REFRESH_TOKEN');
+      refreshToUid.delete(refreshToken); // Firebase rotates
+      const user = [...users.values()].find((u) => u.localId === uid);
+      if (!user) throw new Error('USER_NOT_FOUND');
+      const session = issue(user);
+      return {
+        id_token: session.idToken,
+        refresh_token: session.refreshToken,
+        expires_in: session.expiresIn,
+        user_id: user.localId,
+      } satisfies IdentityToolkitRefreshResponse;
+    },
+  };
+
+  return { client, users, tokensToUid, refreshToUid };
+}

package/templates/libs/auth-strategies/firebase/tsconfig.json

@@ -0,0 +1,24 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "module": "node16",
+    "moduleResolution": "node16",
+    "forceConsistentCasingInFileNames": true,
+    "strict": true,
+    "importHelpers": true,
+    "noImplicitOverride": true,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": true,
+    "noPropertyAccessFromIndexSignature": true
+  },
+  "files": [],
+  "include": [],
+  "references": [
+    {
+      "path": "./tsconfig.lib.json"
+    },
+    {
+      "path": "./tsconfig.spec.json"
+    }
+  ]
+}

package/templates/libs/auth-strategies/firebase/tsconfig.lib.json

@@ -0,0 +1,23 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "declaration": true,
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vitest.config.ts",
+    "vitest.config.mts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.js",
+    "src/**/*.spec.js",
+    "src/**/*.test.jsx",
+    "src/**/*.spec.jsx"
+  ]
+}

package/templates/libs/auth-strategies/firebase/tsconfig.spec.json

@@ -0,0 +1,22 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "outDir": "../../../dist/out-tsc",
+    "types": ["vitest/globals", "vitest/importMeta", "vite/client", "node", "vitest"]
+  },
+  "include": [
+    "vite.config.ts",
+    "vite.config.mts",
+    "vitest.config.ts",
+    "vitest.config.mts",
+    "src/**/*.test.ts",
+    "src/**/*.spec.ts",
+    "src/**/*.test.tsx",
+    "src/**/*.spec.tsx",
+    "src/**/*.test.js",
+    "src/**/*.spec.js",
+    "src/**/*.test.jsx",
+    "src/**/*.spec.jsx",
+    "src/**/*.d.ts"
+  ]
+}

package/templates/libs/auth-strategies/firebase/vitest.config.mts

@@ -0,0 +1,22 @@
+import { defineConfig } from 'vitest/config';
+import { nxViteTsPaths } from '@nx/vite/plugins/nx-tsconfig-paths.plugin';
+import { nxCopyAssetsPlugin } from '@nx/vite/plugins/nx-copy-assets.plugin';
+
+export default defineConfig(() => ({
+  root: __dirname,
+  cacheDir: '../../../node_modules/.vite/libs/auth-strategies/firebase',
+  plugins: [nxViteTsPaths(), nxCopyAssetsPlugin(['*.md'])],
+  test: {
+    name: 'auth-firebase',
+    watch: false,
+    globals: true,
+    environment: 'node',
+    include: ['{src,tests}/**/*.{test,spec}.{js,mjs,cjs,ts,mts,cts,jsx,tsx}'],
+    passWithNoTests: true,
+    reporters: ['default'],
+    coverage: {
+      reportsDirectory: '../../../coverage/libs/auth-strategies/firebase',
+      provider: 'v8' as const,
+    },
+  },
+}));

package/templates/libs/auth-strategies/supabase/README.md

@@ -0,0 +1,11 @@
+# auth-supabase
+
+This library was generated with [Nx](https://nx.dev).
+
+## Building
+
+Run `nx build auth-supabase` to build the library.
+
+## Running unit tests
+
+Run `nx test auth-supabase` to execute the unit tests via [Vitest](https://vitest.dev/).