@maka/maka-cli 5.1.45 → 5.1.46

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-config.js.tsx

@@ -0,0 +1,54 @@
+/**
+ * Auth0 Configuration
+ *
+ * This file contains the Auth0 configuration settings.
+ * Set your Auth0 credentials in Meteor settings or environment variables.
+ */
+
+export interface Auth0Config {
+  domain: string;
+  clientId: string;
+  audience?: string;
+  redirectUri: string;
+  scope: string;
+}
+
+/**
+ * Get Auth0 configuration from Meteor settings or environment variables
+ */
+export const getAuth0Config = (): Auth0Config => {
+  if (Meteor.isClient) {
+    const settings = Meteor.settings.public?.auth0;
+
+    if (!settings?.domain || !settings?.clientId) {
+      throw new Error(
+        'Auth0 configuration missing. Please add auth0 settings to your Meteor settings.json file.'
+      );
+    }
+
+    return {
+      domain: settings.domain,
+      clientId: settings.clientId,
+      audience: settings.audience || `https://${settings.domain}/api/v2/`,
+      redirectUri: settings.redirectUri || window.location.origin + '/auth/callback',
+      scope: settings.scope || 'openid profile email',
+    };
+  }
+
+  // Server-side configuration
+  const settings = Meteor.settings?.auth0;
+
+  if (!settings?.domain || !settings?.clientId) {
+    throw new Error(
+      'Auth0 configuration missing. Please add auth0 settings to your Meteor settings.json file.'
+    );
+  }
+
+  return {
+    domain: settings.domain,
+    clientId: settings.clientId,
+    audience: settings.audience || `https://${settings.domain}/api/v2/`,
+    redirectUri: settings.redirectUri || Meteor.absoluteUrl('auth/callback'),
+    scope: settings.scope || 'openid profile email',
+  };
+};

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-methods.js.jsx

@@ -0,0 +1,152 @@
+import { Meteor } from 'meteor/meteor';
+import { Accounts } from 'meteor/accounts-base';
+import { verifyAuth0Token, findOrCreateUserFromAuth0 } from '../auth0-validator';
+
+/**
+ * Meteor Methods for Auth0 Authentication
+ *
+ * These methods handle the server-side Auth0 authentication flow,
+ * including token verification and user account creation/linking.
+ */
+
+Meteor.methods({
+  /**
+   * Authenticate user with Auth0 ID token
+   *
+   * @param idToken - The Auth0 ID token received from the client
+   * @returns Object containing userId and login token
+   */
+  async 'auth0.login'(idToken) {
+    // Validate input
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+
+      // Find or create user from Auth0 data
+      const userId = await findOrCreateUserFromAuth0(tokenPayload);
+
+      // Generate Meteor login token
+      const stampedLoginToken = Accounts._generateStampedLoginToken();
+      const loginToken = stampedLoginToken.token;
+
+      // Store login token for the user
+      Accounts._insertLoginToken(userId, stampedLoginToken);
+
+      // Return userId and token for client-side login
+      return {
+        userId,
+        token: loginToken,
+        tokenExpires: stampedLoginToken.when,
+      };
+    } catch (error) {
+      console.error('Auth0 login error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-login-failed',
+        'Failed to authenticate with Auth0',
+        error.message
+      );
+    }
+  },
+
+  /**
+   * Link Auth0 account to existing Meteor user
+   *
+   * @param idToken - The Auth0 ID token
+   */
+  async 'auth0.linkAccount'(idToken) {
+    // Must be logged in to link account
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in to link Auth0 account');
+    }
+
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+      const auth0Id = tokenPayload.sub;
+
+      // Check if Auth0 account is already linked to another user
+      const existingUser = Meteor.users.findOne({
+        'services.auth0.id': auth0Id,
+        _id: { $ne: this.userId },
+      });
+
+      if (existingUser) {
+        throw new Meteor.Error(
+          'auth0-already-linked',
+          'This Auth0 account is already linked to another user'
+        );
+      }
+
+      // Link Auth0 account to current user
+      Meteor.users.update(this.userId, {
+        $set: {
+          'services.auth0': {
+            id: auth0Id,
+            email: tokenPayload.email,
+            name: tokenPayload.name,
+            picture: tokenPayload.picture,
+            email_verified: tokenPayload.email_verified,
+          },
+        },
+      });
+
+      return { success: true };
+    } catch (error) {
+      console.error('Auth0 link account error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-link-failed',
+        'Failed to link Auth0 account',
+        error.message
+      );
+    }
+  },
+
+  /**
+   * Unlink Auth0 account from current user
+   */
+  'auth0.unlinkAccount'() {
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in to unlink Auth0 account');
+    }
+
+    const user = Meteor.users.findOne(this.userId);
+
+    if (!user?.services?.auth0) {
+      throw new Meteor.Error('no-auth0-account', 'No Auth0 account linked');
+    }
+
+    // Make sure user has another way to login (password or other service)
+    if (!user.services.password && Object.keys(user.services).length === 1) {
+      throw new Meteor.Error(
+        'last-login-method',
+        'Cannot unlink Auth0 - it is your only login method. Add a password first.'
+      );
+    }
+
+    Meteor.users.update(this.userId, {
+      $unset: {
+        'services.auth0': '',
+      },
+    });
+
+    return { success: true };
+  },
+});

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-methods.js.tsx

@@ -0,0 +1,152 @@
+import { Meteor } from 'meteor/meteor';
+import { Accounts } from 'meteor/accounts-base';
+import { verifyAuth0Token, findOrCreateUserFromAuth0 } from '../auth0-validator';
+
+/**
+ * Meteor Methods for Auth0 Authentication
+ *
+ * These methods handle the server-side Auth0 authentication flow,
+ * including token verification and user account creation/linking.
+ */
+
+Meteor.methods({
+  /**
+   * Authenticate user with Auth0 ID token
+   *
+   * @param idToken - The Auth0 ID token received from the client
+   * @returns Object containing userId and login token
+   */
+  async 'auth0.login'(idToken: string) {
+    // Validate input
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+
+      // Find or create user from Auth0 data
+      const userId = await findOrCreateUserFromAuth0(tokenPayload);
+
+      // Generate Meteor login token
+      const stampedLoginToken = Accounts._generateStampedLoginToken();
+      const loginToken = stampedLoginToken.token;
+
+      // Store login token for the user
+      Accounts._insertLoginToken(userId, stampedLoginToken);
+
+      // Return userId and token for client-side login
+      return {
+        userId,
+        token: loginToken,
+        tokenExpires: stampedLoginToken.when,
+      };
+    } catch (error) {
+      console.error('Auth0 login error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-login-failed',
+        'Failed to authenticate with Auth0',
+        error.message
+      );
+    }
+  },
+
+  /**
+   * Link Auth0 account to existing Meteor user
+   *
+   * @param idToken - The Auth0 ID token
+   */
+  async 'auth0.linkAccount'(idToken: string) {
+    // Must be logged in to link account
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in to link Auth0 account');
+    }
+
+    if (!idToken || typeof idToken !== 'string') {
+      throw new Meteor.Error('invalid-token', 'Invalid token provided');
+    }
+
+    try {
+      // Verify the Auth0 token
+      const tokenPayload = await verifyAuth0Token(idToken);
+      const auth0Id = tokenPayload.sub;
+
+      // Check if Auth0 account is already linked to another user
+      const existingUser = Meteor.users.findOne({
+        'services.auth0.id': auth0Id,
+        _id: { $ne: this.userId },
+      });
+
+      if (existingUser) {
+        throw new Meteor.Error(
+          'auth0-already-linked',
+          'This Auth0 account is already linked to another user'
+        );
+      }
+
+      // Link Auth0 account to current user
+      Meteor.users.update(this.userId, {
+        $set: {
+          'services.auth0': {
+            id: auth0Id,
+            email: tokenPayload.email,
+            name: tokenPayload.name,
+            picture: tokenPayload.picture,
+            email_verified: tokenPayload.email_verified,
+          },
+        },
+      });
+
+      return { success: true };
+    } catch (error) {
+      console.error('Auth0 link account error:', error);
+
+      if (error instanceof Meteor.Error) {
+        throw error;
+      }
+
+      throw new Meteor.Error(
+        'auth0-link-failed',
+        'Failed to link Auth0 account',
+        error.message
+      );
+    }
+  },
+
+  /**
+   * Unlink Auth0 account from current user
+   */
+  'auth0.unlinkAccount'() {
+    if (!this.userId) {
+      throw new Meteor.Error('not-authorized', 'Must be logged in to unlink Auth0 account');
+    }
+
+    const user = Meteor.users.findOne(this.userId);
+
+    if (!user?.services?.auth0) {
+      throw new Meteor.Error('no-auth0-account', 'No Auth0 account linked');
+    }
+
+    // Make sure user has another way to login (password or other service)
+    if (!user.services.password && Object.keys(user.services).length === 1) {
+      throw new Meteor.Error(
+        'last-login-method',
+        'Cannot unlink Auth0 - it is your only login method. Add a password first.'
+      );
+    }
+
+    Meteor.users.update(this.userId, {
+      $unset: {
+        'services.auth0': '',
+      },
+    });
+
+    return { success: true };
+  },
+});

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-validator.js.jsx

@@ -0,0 +1,143 @@
+import { Meteor } from 'meteor/meteor';
+import { Accounts } from 'meteor/accounts-base';
+import jwt from 'jsonwebtoken';
+import jwksClient from 'jwks-rsa';
+
+/**
+ * Auth0 JWT Token Validator
+ *
+ * This module handles server-side validation of Auth0 JWT tokens
+ * and creates/updates Meteor user accounts based on Auth0 user data.
+ */
+
+/**
+ * Create JWKS client for verifying Auth0 tokens
+ */
+const getJwksClient = () => {
+  const auth0Domain = Meteor.settings?.auth0?.domain;
+
+  if (!auth0Domain) {
+    throw new Meteor.Error('auth0-config-missing', 'Auth0 domain not configured');
+  }
+
+  return jwksClient({
+    jwksUri: `https://${auth0Domain}/.well-known/jwks.json`,
+    cache: true,
+    cacheMaxAge: 86400000, // 24 hours
+  });
+};
+
+/**
+ * Get signing key for JWT verification
+ */
+const getKey = (header, callback) => {
+  const client = getJwksClient();
+
+  client.getSigningKey(header.kid, (err, key) => {
+    if (err) {
+      callback(err);
+      return;
+    }
+    const signingKey = key?.getPublicKey();
+    callback(null, signingKey);
+  });
+};
+
+/**
+ * Verify Auth0 JWT token
+ */
+export const verifyAuth0Token = (token) => {
+  return new Promise((resolve, reject) => {
+    const auth0Config = Meteor.settings?.auth0;
+
+    if (!auth0Config?.domain || !auth0Config?.clientId) {
+      reject(new Meteor.Error('auth0-config-missing', 'Auth0 configuration missing'));
+      return;
+    }
+
+    jwt.verify(
+      token,
+      getKey,
+      {
+        audience: auth0Config.clientId,
+        issuer: `https://${auth0Config.domain}/`,
+        algorithms: ['RS256'],
+      },
+      (err, decoded) => {
+        if (err) {
+          reject(new Meteor.Error('auth0-invalid-token', 'Invalid Auth0 token', err));
+          return;
+        }
+        resolve(decoded);
+      }
+    );
+  });
+};
+
+/**
+ * Find or create a Meteor user from Auth0 data
+ */
+export const findOrCreateUserFromAuth0 = async (tokenPayload) => {
+  const auth0Id = tokenPayload.sub;
+  const email = tokenPayload.email;
+
+  // Try to find existing user by Auth0 ID
+  let user = Meteor.users.findOne({
+    'services.auth0.id': auth0Id,
+  });
+
+  if (user) {
+    // Update user profile if needed
+    Meteor.users.update(user._id, {
+      $set: {
+        'services.auth0.email': email,
+        'services.auth0.name': tokenPayload.name,
+        'services.auth0.picture': tokenPayload.picture,
+        'services.auth0.email_verified': tokenPayload.email_verified,
+      },
+    });
+    return user._id;
+  }
+
+  // Try to find by email if email exists
+  if (email) {
+    user = Meteor.users.findOne({
+      'emails.address': email,
+    });
+
+    if (user) {
+      // Link Auth0 account to existing user
+      Meteor.users.update(user._id, {
+        $set: {
+          'services.auth0': {
+            id: auth0Id,
+            email: email,
+            name: tokenPayload.name,
+            picture: tokenPayload.picture,
+            email_verified: tokenPayload.email_verified,
+          },
+        },
+      });
+      return user._id;
+    }
+  }
+
+  // Create new user
+  const userId = Accounts.insertUserDoc({}, {
+    emails: email ? [{ address: email, verified: tokenPayload.email_verified || false }] : [],
+    profile: {
+      name: tokenPayload.name || tokenPayload.nickname || 'Auth0 User',
+    },
+    services: {
+      auth0: {
+        id: auth0Id,
+        email: email,
+        name: tokenPayload.name,
+        picture: tokenPayload.picture,
+        email_verified: tokenPayload.email_verified,
+      },
+    },
+  });
+
+  return userId;
+};

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-validator.js.tsx

@@ -0,0 +1,158 @@
+import { Meteor } from 'meteor/meteor';
+import { Accounts } from 'meteor/accounts-base';
+import jwt from 'jsonwebtoken';
+import jwksClient from 'jwks-rsa';
+
+/**
+ * Auth0 JWT Token Validator
+ *
+ * This module handles server-side validation of Auth0 JWT tokens
+ * and creates/updates Meteor user accounts based on Auth0 user data.
+ */
+
+interface Auth0TokenPayload {
+  sub: string; // Auth0 user ID
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  nickname?: string;
+  picture?: string;
+  aud: string | string[];
+  iss: string;
+  exp: number;
+  iat: number;
+}
+
+/**
+ * Create JWKS client for verifying Auth0 tokens
+ */
+const getJwksClient = () => {
+  const auth0Domain = Meteor.settings?.auth0?.domain;
+
+  if (!auth0Domain) {
+    throw new Meteor.Error('auth0-config-missing', 'Auth0 domain not configured');
+  }
+
+  return jwksClient({
+    jwksUri: `https://${auth0Domain}/.well-known/jwks.json`,
+    cache: true,
+    cacheMaxAge: 86400000, // 24 hours
+  });
+};
+
+/**
+ * Get signing key for JWT verification
+ */
+const getKey = (header: any, callback: any) => {
+  const client = getJwksClient();
+
+  client.getSigningKey(header.kid, (err, key) => {
+    if (err) {
+      callback(err);
+      return;
+    }
+    const signingKey = key?.getPublicKey();
+    callback(null, signingKey);
+  });
+};
+
+/**
+ * Verify Auth0 JWT token
+ */
+export const verifyAuth0Token = (token: string): Promise<Auth0TokenPayload> => {
+  return new Promise((resolve, reject) => {
+    const auth0Config = Meteor.settings?.auth0;
+
+    if (!auth0Config?.domain || !auth0Config?.clientId) {
+      reject(new Meteor.Error('auth0-config-missing', 'Auth0 configuration missing'));
+      return;
+    }
+
+    jwt.verify(
+      token,
+      getKey,
+      {
+        audience: auth0Config.clientId,
+        issuer: `https://${auth0Config.domain}/`,
+        algorithms: ['RS256'],
+      },
+      (err, decoded) => {
+        if (err) {
+          reject(new Meteor.Error('auth0-invalid-token', 'Invalid Auth0 token', err));
+          return;
+        }
+        resolve(decoded as Auth0TokenPayload);
+      }
+    );
+  });
+};
+
+/**
+ * Find or create a Meteor user from Auth0 data
+ */
+export const findOrCreateUserFromAuth0 = async (
+  tokenPayload: Auth0TokenPayload
+): Promise<string> => {
+  const auth0Id = tokenPayload.sub;
+  const email = tokenPayload.email;
+
+  // Try to find existing user by Auth0 ID
+  let user = Meteor.users.findOne({
+    'services.auth0.id': auth0Id,
+  });
+
+  if (user) {
+    // Update user profile if needed
+    Meteor.users.update(user._id, {
+      $set: {
+        'services.auth0.email': email,
+        'services.auth0.name': tokenPayload.name,
+        'services.auth0.picture': tokenPayload.picture,
+        'services.auth0.email_verified': tokenPayload.email_verified,
+      },
+    });
+    return user._id;
+  }
+
+  // Try to find by email if email exists
+  if (email) {
+    user = Meteor.users.findOne({
+      'emails.address': email,
+    });
+
+    if (user) {
+      // Link Auth0 account to existing user
+      Meteor.users.update(user._id, {
+        $set: {
+          'services.auth0': {
+            id: auth0Id,
+            email: email,
+            name: tokenPayload.name,
+            picture: tokenPayload.picture,
+            email_verified: tokenPayload.email_verified,
+          },
+        },
+      });
+      return user._id;
+    }
+  }
+
+  // Create new user
+  const userId = Accounts.insertUserDoc({}, {
+    emails: email ? [{ address: email, verified: tokenPayload.email_verified || false }] : [],
+    profile: {
+      name: tokenPayload.name || tokenPayload.nickname || 'Auth0 User',
+    },
+    services: {
+      auth0: {
+        id: auth0Id,
+        email: email,
+        name: tokenPayload.name,
+        picture: tokenPayload.picture,
+        email_verified: tokenPayload.email_verified,
+      },
+    },
+  });
+
+  return userId;
+};