@jtl-software/create-cloud-app 0.2.2 → 0.3.0

package/dist/index.js

@@ -23,16 +23,33 @@ import pc from "picocolors";
 var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
 var CALLBACK_PORT = 9876;
 var REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/callback`;
-var DEFAULT_SCOPE = "openid offline_access";
 var DEFAULT_API_HOST = "https://api.jtl-cloud.com";
-var DEFAULT_AUTH_HOST = "https://auth.jtl-cloud.com";
+var DEFAULT_AUTH_HOST = "https://id.jtl-cloud.com";
 var DEFAULT_HUB_HOST = "https://hub.jtl-cloud.com";
 var DEFAULT_PARTNER_HOST = "https://partner.jtl-cloud.com";
 var CLIENT_IDS_BY_AUTH_HOST = {
-  "auth.jtl-cloud.com": "b6aca875-c9a3-4010-9fd7-7f8d2e0b0333",
-  "auth.dev.jtl-cloud.com": "9c230937-6a52-48d6-9a39-e97edd8ef511",
-  "auth.qa.jtl-cloud.com": "fdf8ec1d-b0d3-4f16-9f29-a2ebbbf62951"
+  // Registered as a native client in
+  // zitadel-terraform (services/cloud-apps-cli.yaml), which is what trusts the
+  // loopback redirect below. These are client ids, not the Zitadel app ids that
+  // appear in terraform apply logs - the authorize endpoint rejects those.
+  "id.jtl-cloud.com": "386095063207346992",
+  "id.dev.jtl-cloud.com": "385952106948949981",
+  "id.qa.jtl-cloud.com": "386094749154581156"
 };
+var ZITADEL_PROJECT_IDS = {
+  "id.dev.jtl-cloud.com": "380736094687225619",
+  "id.qa.jtl-cloud.com": "383246500387367093",
+  "id.jtl-cloud.com": "383246859386235061"
+};
+function defaultScopeFor(authBaseUrl) {
+  const projectId = ZITADEL_PROJECT_IDS[new URL(authBaseUrl).hostname];
+  const scopes = ["openid", "profile", "email", "offline_access"];
+  if (projectId) {
+    scopes.push(`urn:zitadel:iam:org:project:id:${projectId}:aud`);
+    scopes.push("urn:zitadel:iam:org:project:id:zitadel:aud");
+  }
+  return scopes.join(" ");
+}
 var TOKEN_EXPIRY_MARGIN_S = 60;
 function tokenCacheFile() {
   return process.env.JTL_CLI_TOKEN_CACHE_FILE ?? path.join(os.homedir(), ".config", "jtl-cli", "tokens.json");
@@ -237,8 +254,33 @@ Opening browser to sign in.`);
     });
   });
 }
-async function postTokenRequest(authBaseUrl, body) {
-  const res = await fetch(`${authBaseUrl}/oauth2/token`, {
+var oidcMetadataCache = /* @__PURE__ */ new Map();
+async function discoverOidc(authBaseUrl) {
+  const cached = oidcMetadataCache.get(authBaseUrl);
+  if (cached) return cached;
+  const pending = (async () => {
+    const url = `${authBaseUrl}/.well-known/openid-configuration`;
+    const res = await fetch(url, { headers: { Accept: "application/json" } });
+    if (!res.ok) {
+      throw new Error(`OIDC discovery failed: ${url} returned ${res.status}`);
+    }
+    const doc = await res.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new Error(
+        `OIDC discovery at ${url} is missing authorization_endpoint or token_endpoint`
+      );
+    }
+    return {
+      authorization_endpoint: doc.authorization_endpoint,
+      token_endpoint: doc.token_endpoint
+    };
+  })();
+  oidcMetadataCache.set(authBaseUrl, pending);
+  pending.catch(() => oidcMetadataCache.delete(authBaseUrl));
+  return pending;
+}
+async function postTokenRequest(tokenEndpoint, body) {
+  const res = await fetch(tokenEndpoint, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded",
@@ -262,8 +304,9 @@ async function postTokenRequest(authBaseUrl, body) {
   return parsed;
 }
 async function exchangeCodeForToken(authBaseUrl, clientId, code, verifier) {
+  const { token_endpoint } = await discoverOidc(authBaseUrl);
   return postTokenRequest(
-    authBaseUrl,
+    token_endpoint,
     new URLSearchParams({
       grant_type: "authorization_code",
       code,
@@ -274,8 +317,9 @@ async function exchangeCodeForToken(authBaseUrl, clientId, code, verifier) {
   );
 }
 async function refreshAccessToken(authBaseUrl, clientId, refreshToken) {
+  const { token_endpoint } = await discoverOidc(authBaseUrl);
   return postTokenRequest(
-    authBaseUrl,
+    token_endpoint,
     new URLSearchParams({
       grant_type: "refresh_token",
       refresh_token: refreshToken,
@@ -312,7 +356,8 @@ async function acquireAccessToken(opts) {
   }
   const pkce = generatePkce();
   const state = base64url(crypto.randomBytes(16));
-  const authorizeUrl = new URL("/oauth2/auth", auth);
+  const { authorization_endpoint } = await discoverOidc(auth);
+  const authorizeUrl = new URL(authorization_endpoint);
   authorizeUrl.searchParams.set("response_type", "code");
   authorizeUrl.searchParams.set("client_id", clientId);
   authorizeUrl.searchParams.set("redirect_uri", REDIRECT_URI);
@@ -320,7 +365,6 @@ async function acquireAccessToken(opts) {
   authorizeUrl.searchParams.set("state", state);
   authorizeUrl.searchParams.set("code_challenge", pkce.challenge);
   authorizeUrl.searchParams.set("code_challenge_method", "S256");
-  authorizeUrl.searchParams.set("prompt", "login");
   spinner4?.start("Waiting for browser login");
   try {
     const { code, verifier } = await captureAuthCode(
@@ -357,8 +401,13 @@ async function apiCall(url, init) {
   return body;
 }
 async function fetchTenants(apiBaseUrl, jwt) {
+  const fromToken = tenantsFromClaims(decodeJwtClaims(jwt));
+  if (fromToken.length > 0) return fromToken;
   const tenants = await apiCall(`${apiBaseUrl}/account/tenants`, {
-    headers: { Authorization: `Bearer ${jwt}`, Accept: "application/json" }
+    headers: {
+      Authorization: `Bearer ${apiTokenFor(jwt)}`,
+      Accept: "application/json"
+    }
   });
   if (!Array.isArray(tenants)) {
     throw new Error(
@@ -367,6 +416,62 @@ async function fetchTenants(apiBaseUrl, jwt) {
   }
   return tenants;
 }
+function apiTokenFor(jwt) {
+  const bridged = decodeJwtClaims(jwt)[ORY_TOKEN_CLAIM];
+  return typeof bridged === "string" && bridged ? bridged : jwt;
+}
+function decodeJwtClaims(jwt) {
+  const payload = jwt.split(".")[1];
+  if (!payload) return {};
+  try {
+    const json = Buffer.from(payload, "base64url").toString("utf-8");
+    const parsed = JSON.parse(json);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+var ORY_TOKEN_CLAIM = "urn:jtl:ory_token";
+var TENANTS_CLAIM = "urn:jtl:tenants";
+var TENANT_ID_CLAIM = "urn:jtl:tenant_id";
+var PROJECT_ROLES_CLAIM = "urn:zitadel:iam:org:project:roles";
+function tenantsFromClaims(claims) {
+  const tenants = /* @__PURE__ */ new Map();
+  const explicit = claims[TENANTS_CLAIM];
+  if (Array.isArray(explicit)) {
+    for (const entry of explicit) {
+      if (typeof entry !== "object" || entry === null) continue;
+      const { id, slug, name } = entry;
+      if (typeof id === "string" && id) {
+        tenants.set(id, {
+          id,
+          slug: slug ?? id,
+          name: name ?? slug ?? id
+        });
+      }
+    }
+  }
+  const roles = claims[PROJECT_ROLES_CLAIM];
+  if (tenants.size === 0 && typeof roles === "object" && roles !== null) {
+    for (const orgs of Object.values(roles)) {
+      if (typeof orgs !== "object" || orgs === null) continue;
+      for (const [orgId, domain] of Object.entries(
+        orgs
+      )) {
+        if (tenants.has(orgId)) continue;
+        const slug = typeof domain === "string" ? domain.split(".")[0] : orgId;
+        tenants.set(orgId, { id: orgId, slug, name: slug });
+      }
+    }
+  }
+  const ordered = [...tenants.values()];
+  const active = claims[TENANT_ID_CLAIM];
+  if (typeof active === "string") {
+    const index = ordered.findIndex((tenant) => tenant.id === active);
+    if (index > 0) ordered.unshift(...ordered.splice(index, 1));
+  }
+  return ordered;
+}
 function validateHost(input, flag) {
   let url;
   try {
@@ -408,7 +513,7 @@ function resolveCommonOptions(values) {
     hub,
     partner,
     clientId,
-    scope: values.scope ?? DEFAULT_SCOPE,
+    scope: values.scope ?? defaultScopeFor(auth),
     reauth: values.reauth ?? false,
     yes: values.yes ?? false,
     tenant: values.tenant
@@ -906,10 +1011,12 @@ async function register(argv = [], runOpts = {}) {
   } catch (err) {
     bail(err.message);
   }
+  const identityJwt = jwt;
+  jwt = apiTokenFor(jwt);
   spinner4.start("Fetching tenants");
   let tenants;
   try {
-    tenants = await fetchTenants(opts.api, jwt);
+    tenants = await fetchTenants(opts.api, identityJwt);
     spinner4.stop(
       `Found ${tenants.length} tenant${tenants.length === 1 ? "" : "s"}`
     );
@@ -1188,10 +1295,12 @@ async function listing(argv = [], runOpts = {}) {
   } catch (err) {
     bail(err.message);
   }
+  const identityJwt = jwt;
+  jwt = apiTokenFor(jwt);
   spinner4.start("Fetching tenants");
   let tenants;
   try {
-    tenants = await fetchTenants(opts.api, jwt);
+    tenants = await fetchTenants(opts.api, identityJwt);
     spinner4.stop(
       `Found ${tenants.length} tenant${tenants.length === 1 ? "" : "s"}`
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jtl-software/create-cloud-app",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "type": "module",
   "description": "CLI tool for scaffolding JTL Platform cloud apps",
   "bin": {
@@ -21,7 +21,7 @@
     "@jtl-software/cloud-app-template-backend-dotnet": "0.0.12",
     "@jtl-software/cloud-app-template-backend-node": "0.0.15",
     "@jtl-software/cloud-app-template-backend-php": "0.1.1",
-    "@jtl-software/cloud-app-template-frontend-react": "0.0.17",
+    "@jtl-software/cloud-app-template-frontend-react": "0.0.18",
     "@jtl-software/cloud-app-template-shared": "0.1.1",
     "picocolors": "^1.1.1",
     "posthog-node": "^5.45.2"