@korajs/cli 0.4.0 → 0.6.0

package/templates/svelte-tailwind-sync/svelte.config.js

@@ -0,0 +1,5 @@
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte'
+
+export default {
+	preprocess: vitePreprocess(),
+}

package/templates/svelte-tailwind-sync/tsconfig.json.hbs

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "types": ["vite/client"]
+  },
+  "include": ["src/**/*.ts", "src/**/*.svelte"],
+  "exclude": ["node_modules"]
+}

package/templates/svelte-tailwind-sync/vite.config.ts

@@ -0,0 +1,80 @@
+import { copyFileSync, existsSync, readdirSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import tailwindcss from '@tailwindcss/vite'
+import { svelte } from '@sveltejs/vite-plugin-svelte'
+import type { Plugin } from 'vite'
+import { defineConfig } from 'vite'
+
+function crossOriginIsolation(): Plugin {
+	return {
+		name: 'cross-origin-isolation',
+		configureServer(server) {
+			server.middlewares.use((_req, res, next) => {
+				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
+				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				next()
+			})
+		},
+		configurePreviewServer(server) {
+			server.middlewares.use((_req, res, next) => {
+				res.setHeader('Cross-Origin-Opener-Policy', 'same-origin')
+				res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp')
+				next()
+			})
+		},
+	}
+}
+
+function sqliteWasmHotfix(): Plugin {
+	return {
+		name: 'sqlite-wasm-hotfix',
+		apply: 'build',
+		closeBundle() {
+			const assetsDir = resolve('dist', 'assets')
+			if (!existsSync(assetsDir)) return
+
+			for (const file of readdirSync(assetsDir)) {
+				if (/^sqlite3-.+\.wasm$/.test(file)) {
+					copyFileSync(join(assetsDir, file), join(assetsDir, 'sqlite3.wasm'))
+					break
+				}
+			}
+
+			const proxyFile = resolve(
+				'node_modules',
+				'@sqlite.org',
+				'sqlite-wasm',
+				'sqlite-wasm',
+				'jswasm',
+				'sqlite3-opfs-async-proxy.js',
+			)
+			if (existsSync(proxyFile)) {
+				copyFileSync(proxyFile, join(assetsDir, 'sqlite3-opfs-async-proxy.js'))
+			}
+		},
+	}
+}
+
+export default defineConfig({
+	plugins: [svelte(), tailwindcss(), crossOriginIsolation(), sqliteWasmHotfix()],
+	worker: {
+		format: 'es',
+	},
+	optimizeDeps: {
+		exclude: ['@sqlite.org/sqlite-wasm', '@korajs/store'],
+		include: ['yjs'],
+	},
+	resolve: {
+		dedupe: ['yjs'],
+	},
+	server: {
+		allowedHosts: true,
+		proxy: {
+			'/kora-sync': {
+				target: 'ws://localhost:3001',
+				ws: true,
+				rewriteWsOrigin: true,
+			},
+		},
+	},
+})

package/templates/tauri-react/.env.example

@@ -5,3 +5,23 @@
 
 # Sync server port
 PORT=3001
+
+# Server database
+# Leave DATABASE_URL empty to use SQLite at KORA_SERVER_DB.
+# Set DATABASE_URL for cloud Postgres deployments.
+KORA_SERVER_DB=./kora-server.db
+DATABASE_URL=
+
+# Operational endpoints (/__kora, /__kora/status, /__kora/events, /__kora/metrics, backups)
+# Set these in production. Use Authorization: Bearer <token> when calling protected endpoints.
+KORA_ADMIN_TOKEN=
+KORA_METRICS_TOKEN=
+KORA_BACKUP_TOKEN=
+
+# Optional sync path
+KORA_SYNC_PATH=/kora-sync
+
+# Auth
+# Set this to enable built-in /auth/* routes and authenticated sync.
+# Generate with: node -e "console.log(require('node:crypto').randomBytes(32).toString('hex'))"
+KORA_AUTH_SECRET=

package/templates/tauri-react/README.md.hbs

@@ -16,10 +16,17 @@ On first launch, you'll see a setup screen to enter your sync server URL. For lo
 
 ```
 src/
-  schema.ts          # Data schema definition
+  schema.ts          # Schema entry point
+  auth.ts            # Desktop auth client and OAuth callback helpers
   main.tsx           # Entry point
   AppShell.tsx       # Setup flow + Kora initialization
   App.tsx            # Main application UI
+  modules/
+    todos/
+      todo.schema.ts     # Todo collection definition
+      todo.queries.ts    # Reusable todo query builders
+      todo.mutations.ts  # Todo mutation helpers
+      useTodos.ts        # React hook connecting todos to the UI
   SetupScreen.tsx    # First-launch server configuration
   sync-config.ts     # Runtime sync URL storage
   updater.ts         # Auto-update checker
@@ -37,6 +44,9 @@ kora.config.ts       # Kora configuration
   release-desktop.yml  # CI/CD for cross-platform builds
 ```
 
+In a feature module, `schema` defines data shape, `queries` contain reads only, `mutations` contain
+writes, and `useTodos.ts` is the React binding that exposes todo data and actions to components.
+
 ## Scripts
 
 | Script | Description |
@@ -124,7 +134,32 @@ Users can also skip setup and use the app offline — they can connect later fro
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `VITE_SYNC_URL` | (none) | Pre-configure sync URL at build time |
+| `VITE_AUTH_URL` | derived from sync URL | HTTP URL for `/auth/*` routes |
 | `PORT` | `3001` | Sync server port |
+| `KORA_SERVER_DB` | `./kora-server.db` | SQLite file used by the sync server when `DATABASE_URL` is empty |
+| `KORA_AUTH_DB` | `./kora-auth.db` | SQLite file used by OAuth state and linked identities when `DATABASE_URL` is empty |
+| `DATABASE_URL` | (none) | PostgreSQL connection string for production sync server deployments |
+| `KORA_SYNC_PATH` | `/kora-sync` | WebSocket path exposed by the sync server |
+| `KORA_AUTH_SECRET` | (none) | Enables built-in `/auth/*` routes and authenticated sync when set |
+| `KORA_GOOGLE_CLIENT_ID` | (none) | Enables Google OAuth when set with `KORA_GOOGLE_REDIRECT_URI` |
+| `KORA_GOOGLE_CLIENT_SECRET` | (none) | Google OAuth client secret for confidential web clients |
+| `KORA_GOOGLE_REDIRECT_URI` | (none) | OAuth callback URL for loopback, custom scheme, or hosted handoff |
+| `KORA_OAUTH_PKCE` | `true` when no client secret | Enables PKCE for public desktop/mobile OAuth clients |
+| `KORA_ADMIN_TOKEN` | (none) | Protects `/__kora`, `/__kora/status`, and `/__kora/events` |
+| `KORA_METRICS_TOKEN` | (none) | Protects `/__kora/metrics` |
+| `KORA_BACKUP_TOKEN` | (none) | Protects server backup and restore endpoints |
+
+## Authentication
+
+Set `KORA_AUTH_SECRET` to enable built-in auth on the sync server. Generate a secret with:
+
+```bash
+node -e "console.log(require('node:crypto').randomBytes(32).toString('hex'))"
+```
+
+The template creates a desktop auth client, wraps the app in `AuthProvider`, and wires sync with `createKoraAuthSync({ authClient, schema })`. Google OAuth is enabled on the server when `KORA_GOOGLE_CLIENT_ID` and `KORA_GOOGLE_REDIRECT_URI` are set.
+
+For production desktop OAuth, use a loopback callback, custom URL scheme, or hosted handoff that returns `code` and `state` to the app, then complete the flow with `authClient.completeOAuthSignIn('google', { code, state })`. The generated `src/auth.ts` includes the callback completion helper. See the [Authentication Guide](https://ehoneahobed.github.io/kora/guide/authentication#desktop-and-tauri-apps).
 
 ## Code Signing
 

package/templates/tauri-react/dev.ts

@@ -1,4 +1,4 @@
-import { spawn, type ChildProcess } from 'node:child_process'
+import { type ChildProcess, spawn } from 'node:child_process'
 
 // Starts both the sync server and the Tauri app with a single command.
 // The sync server runs in the background so the desktop app can sync
@@ -7,10 +7,10 @@ import { spawn, type ChildProcess } from 'node:child_process'
 const children: ChildProcess[] = []
 
 function cleanup() {
-  for (const child of children) {
-    child.kill()
-  }
-  process.exit()
+	for (const child of children) {
+		child.kill()
+	}
+	process.exit()
 }
 
 process.on('SIGINT', cleanup)
@@ -18,20 +18,20 @@ process.on('SIGTERM', cleanup)
 
 // Start the sync server
 const syncServer = spawn('tsx', ['server.ts'], {
-  stdio: 'inherit',
-  shell: true,
+	stdio: 'inherit',
+	shell: true,
 })
 children.push(syncServer)
 
 // Start the Tauri app (manages Vite dev server + Rust build)
 const tauriApp = spawn('tauri', ['dev'], {
-  stdio: 'inherit',
-  shell: true,
+	stdio: 'inherit',
+	shell: true,
 })
 children.push(tauriApp)
 
 // If the Tauri app exits, stop everything
 tauriApp.on('close', (code) => {
-  syncServer.kill()
-  process.exit(code ?? 0)
+	syncServer.kill()
+	process.exit(code ?? 0)
 })

package/templates/tauri-react/package.json.hbs

@@ -13,6 +13,7 @@
   },
   "dependencies": {
     "korajs": "{{koraVersion}}",
+    "@korajs/auth": "{{koraVersion}}",
     "@korajs/core": "{{koraVersion}}",
     "@korajs/react": "{{koraVersion}}",
     "@korajs/tauri": "{{koraVersion}}",
@@ -30,6 +31,7 @@
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^4.3.0",
     "better-sqlite3": "^12.9.0",
+    "postgres": "^3.4.0",
     "tsx": "^4.19.0",
     "typescript": "^5.7.0",
     "vite": "^6.0.0",

package/templates/tauri-react/server.ts

@@ -1,4 +1,16 @@
-import { createProductionServer, createSqliteServerStore } from '@korajs/server'
+import {
+	type CreateKoraAuthServerOptions,
+	createKoraAuthServer,
+	createPostgresOAuthStores,
+	createSqliteOAuthStores,
+	googleProvider,
+} from '@korajs/auth/server'
+import {
+	createPostgresServerStore,
+	createProductionServer,
+	createSqliteServerStore,
+} from '@korajs/server'
+import schema from './src/schema'
 
 // Sync server for your Kora desktop app.
 // Started automatically by `pnpm dev`, or run standalone with `pnpm dev:server`.
@@ -8,16 +20,78 @@ import { createProductionServer, createSqliteServerStore } from '@korajs/server'
 // For production, deploy this server and set VITE_SYNC_URL when building
 // the desktop app: VITE_SYNC_URL=wss://your-server.com/kora-sync pnpm build
 
-const store = createSqliteServerStore({ filename: './kora-server.db' })
+async function createStore() {
+	if (process.env.DATABASE_URL) {
+		return createPostgresServerStore({
+			connectionString: process.env.DATABASE_URL,
+		})
+	}
 
-const server = createProductionServer({
-  store,
-  port: Number(process.env.PORT) || 3001,
-  staticDir: './dist',
-  syncPath: '/kora-sync',
-})
+	return createSqliteServerStore({
+		filename: process.env.KORA_SERVER_DB || './kora-server.db',
+	})
+}
 
-server.start().then((url) => {
-  console.log(`Kora sync server running at ${url}`)
-  console.log(`  Sync endpoint: ${url.replace('http', 'ws')}/kora-sync`)
-})
+async function start() {
+	const store = await createStore()
+	await store.setSchema(schema)
+
+	const syncPath = process.env.KORA_SYNC_PATH || '/kora-sync'
+	const auth = await createAuth()
+	const server = createProductionServer({
+		store,
+		port: Number(process.env.PORT) || 3001,
+		syncPath,
+		httpRoutes: auth ? [{ path: '/auth', handle: auth.handleRequest }] : undefined,
+		syncOptions: auth ? { auth: auth.auth } : undefined,
+		operationalAuth: {
+			adminToken: process.env.KORA_ADMIN_TOKEN,
+			metricsToken: process.env.KORA_METRICS_TOKEN,
+			backupToken: process.env.KORA_BACKUP_TOKEN,
+		},
+	})
+
+	const url = await server.start()
+	console.log(`Kora sync server running at ${url}`)
+	console.log(`  Sync endpoint: ${url.replace('http', 'ws')}${syncPath}`)
+	if (auth) console.log(`  Auth endpoint: ${url}/auth`)
+}
+
+void start()
+
+async function createAuth() {
+	if (!process.env.KORA_AUTH_SECRET) {
+		return null
+	}
+
+	const oauth = await createOAuthConfig()
+	return createKoraAuthServer({
+		jwtSecret: process.env.KORA_AUTH_SECRET,
+		...(oauth ? { oauth } : {}),
+	})
+}
+
+async function createOAuthConfig(): Promise<CreateKoraAuthServerOptions['oauth'] | undefined> {
+	if (!process.env.KORA_GOOGLE_CLIENT_ID || !process.env.KORA_GOOGLE_REDIRECT_URI) {
+		return undefined
+	}
+
+	const oauthStores = process.env.DATABASE_URL
+		? await createPostgresOAuthStores({ connectionString: process.env.DATABASE_URL })
+		: await createSqliteOAuthStores({
+				filename: process.env.KORA_AUTH_DB || './kora-auth.db',
+			})
+
+	return {
+		providers: [
+			googleProvider({
+				clientId: process.env.KORA_GOOGLE_CLIENT_ID,
+				clientSecret: process.env.KORA_GOOGLE_CLIENT_SECRET,
+				redirectUri: process.env.KORA_GOOGLE_REDIRECT_URI,
+				pkce: process.env.KORA_OAUTH_PKCE === 'true' || !process.env.KORA_GOOGLE_CLIENT_SECRET,
+			}),
+		],
+		stateStore: oauthStores.stateStore,
+		linkedIdentityStore: oauthStores.linkedIdentityStore,
+	}
+}