@maka/maka-cli 5.1.45 → 5.1.47

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-validator.js.jsx

@@ -0,0 +1,179 @@
+import { Meteor } from 'meteor/meteor';
+import { Accounts } from 'meteor/accounts-base';
+import jwt from 'jsonwebtoken';
+import jwksClient from 'jwks-rsa';
+
+/**
+ * Auth0 JWT Token Validator
+ *
+ * This module handles server-side validation of Auth0 JWT tokens
+ * and creates/updates Meteor user accounts based on Auth0 user data.
+ */
+
+/**
+ * Normalize Auth0 domain by removing protocol and trailing slashes
+ */
+const normalizeDomain = (domain) => {
+  return domain
+    .replace(/^https?:\/\//, '') // Remove http:// or https://
+    .replace(/\/$/, ''); // Remove trailing slash
+};
+
+/**
+ * Create JWKS client for verifying Auth0 tokens
+ */
+const getJwksClient = () => {
+  const auth0Domain = Meteor.settings?.auth0?.domain;
+
+  if (!auth0Domain) {
+    throw new Meteor.Error('auth0-config-missing', 'Auth0 domain not configured');
+  }
+
+  const normalizedDomain = normalizeDomain(auth0Domain);
+
+  return jwksClient({
+    jwksUri: `https://${normalizedDomain}/.well-known/jwks.json`,
+    cache: true,
+    cacheMaxAge: 86400000, // 24 hours
+  });
+};
+
+/**
+ * Get signing key for JWT verification
+ */
+const getKey = (header, callback) => {
+  const client = getJwksClient();
+
+  client.getSigningKey(header.kid, (err, key) => {
+    if (err) {
+      callback(err);
+      return;
+    }
+    const signingKey = key?.getPublicKey();
+    callback(null, signingKey);
+  });
+};
+
+/**
+ * Verify Auth0 JWT token
+ */
+export const verifyAuth0Token = (token) => {
+  return new Promise((resolve, reject) => {
+    const auth0Config = Meteor.settings?.auth0;
+
+    if (!auth0Config?.domain || !auth0Config?.clientId) {
+      reject(new Meteor.Error('auth0-config-missing', 'Auth0 configuration missing'));
+      return;
+    }
+
+    const normalizedDomain = normalizeDomain(auth0Config.domain);
+
+    jwt.verify(
+      token,
+      getKey,
+      {
+        audience: auth0Config.clientId,
+        issuer: `https://${normalizedDomain}/`,
+        algorithms: ['RS256'],
+      },
+      (err, decoded) => {
+        if (err) {
+          reject(new Meteor.Error('auth0-invalid-token', 'Invalid Auth0 token', err));
+          return;
+        }
+        resolve(decoded);
+      }
+    );
+  });
+};
+
+/**
+ * Find or create a Meteor user from Auth0 data
+ */
+export const findOrCreateUserFromAuth0 = async (tokenPayload) => {
+  const auth0Id = tokenPayload.sub;
+  const email = tokenPayload.email;
+  const now = new Date();
+
+  // Try to find existing user by Auth0 ID
+  let user = await Meteor.users.findOneAsync({
+    'services.auth0.id': auth0Id,
+  });
+
+  if (user) {
+    // Update user profile and token data
+    await Meteor.users.updateAsync(user._id, {
+      $set: {
+        // Profile data (client-accessible)
+        'profile.auth0': {
+          name: tokenPayload.name,
+          picture: tokenPayload.picture,
+          email: email,
+          email_verified: tokenPayload.email_verified,
+        },
+        // Token data (server-only)
+        'services.auth0.id': auth0Id,
+        'services.auth0.accessToken': tokenPayload.aud,
+        'services.auth0.expiresAt': new Date(tokenPayload.exp * 1000),
+        'services.auth0.issuedAt': new Date(tokenPayload.iat * 1000),
+      },
+    });
+    return user._id;
+  }
+
+  // Try to find by email if email exists
+  if (email) {
+    user = await Meteor.users.findOneAsync({
+      'emails.address': email,
+    });
+
+    if (user) {
+      // Link Auth0 account to existing user
+      await Meteor.users.updateAsync(user._id, {
+        $set: {
+          // Profile data (client-accessible)
+          'profile.auth0': {
+            name: tokenPayload.name,
+            picture: tokenPayload.picture,
+            email: email,
+            email_verified: tokenPayload.email_verified,
+          },
+          // Token data (server-only)
+          'services.auth0': {
+            id: auth0Id,
+            accessToken: tokenPayload.aud,
+            expiresAt: new Date(tokenPayload.exp * 1000),
+            issuedAt: new Date(tokenPayload.iat * 1000),
+          },
+        },
+      });
+      return user._id;
+    }
+  }
+
+  // Create new user
+  const userId = Accounts.insertUserDoc({}, {
+    emails: email ? [{ address: email, verified: tokenPayload.email_verified || false }] : [],
+    profile: {
+      name: tokenPayload.name || tokenPayload.nickname || 'Auth0 User',
+      // Auth0 profile data (client-accessible)
+      auth0: {
+        name: tokenPayload.name,
+        picture: tokenPayload.picture,
+        email: email,
+        email_verified: tokenPayload.email_verified,
+      },
+    },
+    services: {
+      // Token data (server-only)
+      auth0: {
+        id: auth0Id,
+        accessToken: tokenPayload.aud,
+        expiresAt: new Date(tokenPayload.exp * 1000),
+        issuedAt: new Date(tokenPayload.iat * 1000),
+      },
+    },
+  });
+
+  return userId;
+};

package/bundle/typescript/src/templates/react/kit/auth/service/auth0-validator.js.tsx

@@ -0,0 +1,194 @@
+import { Meteor } from 'meteor/meteor';
+import { Accounts } from 'meteor/accounts-base';
+import jwt from 'jsonwebtoken';
+import jwksClient from 'jwks-rsa';
+
+/**
+ * Auth0 JWT Token Validator
+ *
+ * This module handles server-side validation of Auth0 JWT tokens
+ * and creates/updates Meteor user accounts based on Auth0 user data.
+ */
+
+interface Auth0TokenPayload {
+  sub: string; // Auth0 user ID
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  nickname?: string;
+  picture?: string;
+  aud: string | string[];
+  iss: string;
+  exp: number;
+  iat: number;
+}
+
+/**
+ * Normalize Auth0 domain by removing protocol and trailing slashes
+ */
+const normalizeDomain = (domain: string): string => {
+  return domain
+    .replace(/^https?:\/\//, '') // Remove http:// or https://
+    .replace(/\/$/, ''); // Remove trailing slash
+};
+
+/**
+ * Create JWKS client for verifying Auth0 tokens
+ */
+const getJwksClient = () => {
+  const auth0Domain = Meteor.settings?.auth0?.domain;
+
+  if (!auth0Domain) {
+    throw new Meteor.Error('auth0-config-missing', 'Auth0 domain not configured');
+  }
+
+  const normalizedDomain = normalizeDomain(auth0Domain);
+
+  return jwksClient({
+    jwksUri: `https://${normalizedDomain}/.well-known/jwks.json`,
+    cache: true,
+    cacheMaxAge: 86400000, // 24 hours
+  });
+};
+
+/**
+ * Get signing key for JWT verification
+ */
+const getKey = (header: any, callback: any) => {
+  const client = getJwksClient();
+
+  client.getSigningKey(header.kid, (err, key) => {
+    if (err) {
+      callback(err);
+      return;
+    }
+    const signingKey = key?.getPublicKey();
+    callback(null, signingKey);
+  });
+};
+
+/**
+ * Verify Auth0 JWT token
+ */
+export const verifyAuth0Token = (token: string): Promise<Auth0TokenPayload> => {
+  return new Promise((resolve, reject) => {
+    const auth0Config = Meteor.settings?.auth0;
+
+    if (!auth0Config?.domain || !auth0Config?.clientId) {
+      reject(new Meteor.Error('auth0-config-missing', 'Auth0 configuration missing'));
+      return;
+    }
+
+    const normalizedDomain = normalizeDomain(auth0Config.domain);
+
+    jwt.verify(
+      token,
+      getKey,
+      {
+        audience: auth0Config.clientId,
+        issuer: `https://${normalizedDomain}/`,
+        algorithms: ['RS256'],
+      },
+      (err, decoded) => {
+        if (err) {
+          reject(new Meteor.Error('auth0-invalid-token', 'Invalid Auth0 token', err));
+          return;
+        }
+        resolve(decoded as Auth0TokenPayload);
+      }
+    );
+  });
+};
+
+/**
+ * Find or create a Meteor user from Auth0 data
+ */
+export const findOrCreateUserFromAuth0 = async (
+  tokenPayload: Auth0TokenPayload
+): Promise<string> => {
+  const auth0Id = tokenPayload.sub;
+  const email = tokenPayload.email;
+  const now = new Date();
+
+  // Try to find existing user by Auth0 ID
+  let user = await Meteor.users.findOneAsync({
+    'services.auth0.id': auth0Id,
+  });
+
+  if (user) {
+    // Update user profile and token data
+    await Meteor.users.updateAsync(user._id, {
+      $set: {
+        // Profile data (client-accessible)
+        'profile.auth0': {
+          name: tokenPayload.name,
+          picture: tokenPayload.picture,
+          email: email,
+          email_verified: tokenPayload.email_verified,
+        },
+        // Token data (server-only)
+        'services.auth0.id': auth0Id,
+        'services.auth0.accessToken': tokenPayload.aud,
+        'services.auth0.expiresAt': new Date(tokenPayload.exp * 1000),
+        'services.auth0.issuedAt': new Date(tokenPayload.iat * 1000),
+      },
+    });
+    return user._id;
+  }
+
+  // Try to find by email if email exists
+  if (email) {
+    user = await Meteor.users.findOneAsync({
+      'emails.address': email,
+    });
+
+    if (user) {
+      // Link Auth0 account to existing user
+      await Meteor.users.updateAsync(user._id, {
+        $set: {
+          // Profile data (client-accessible)
+          'profile.auth0': {
+            name: tokenPayload.name,
+            picture: tokenPayload.picture,
+            email: email,
+            email_verified: tokenPayload.email_verified,
+          },
+          // Token data (server-only)
+          'services.auth0': {
+            id: auth0Id,
+            accessToken: tokenPayload.aud,
+            expiresAt: new Date(tokenPayload.exp * 1000),
+            issuedAt: new Date(tokenPayload.iat * 1000),
+          },
+        },
+      });
+      return user._id;
+    }
+  }
+
+  // Create new user
+  const userId = Accounts.insertUserDoc({}, {
+    emails: email ? [{ address: email, verified: tokenPayload.email_verified || false }] : [],
+    profile: {
+      name: tokenPayload.name || tokenPayload.nickname || 'Auth0 User',
+      // Auth0 profile data (client-accessible)
+      auth0: {
+        name: tokenPayload.name,
+        picture: tokenPayload.picture,
+        email: email,
+        email_verified: tokenPayload.email_verified,
+      },
+    },
+    services: {
+      // Token data (server-only)
+      auth0: {
+        id: auth0Id,
+        accessToken: tokenPayload.aud,
+        expiresAt: new Date(tokenPayload.exp * 1000),
+        issuedAt: new Date(tokenPayload.iat * 1000),
+      },
+    },
+  });
+
+  return userId;
+};

package/bundle/typescript/src/templates/react/kit/mui/auth0/auth-callback.js.jsx

@@ -0,0 +1,71 @@
+import React, { useEffect, useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { Box, CircularProgress, Typography, Alert } from '@mui/material';
+import AuthService from '<%= authServicePath %>';
+
+/**
+ * Auth0 Callback Component
+ *
+ * This component handles the OAuth callback from Auth0.
+ * It exchanges the authorization code for tokens and logs the user into Meteor.
+ */
+export const AuthCallback = () => {
+  const navigate = useNavigate();
+  const [error, setError] = useState(null);
+
+  useEffect(() => {
+    const handleCallback = async () => {
+      try {
+        // Handle the Auth0 callback and login to Meteor
+        await AuthService.handleAuth0Callback();
+
+        // Redirect to home page after successful login
+        navigate('/', { replace: true });
+      } catch (err) {
+        console.error('Auth0 callback error:', err);
+        setError(err instanceof Error ? err.message : 'Authentication failed');
+
+        // Redirect to login page after a delay
+        setTimeout(() => {
+          navigate('/login', { replace: true });
+        }, 3000);
+      }
+    };
+
+    handleCallback();
+  }, [navigate]);
+
+  return (
+    <Box
+      sx={{
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        justifyContent: 'center',
+        minHeight: '100vh',
+        gap: 2,
+      }}
+    >
+      {error ? (
+        <>
+          <Alert severity="error" sx={{ maxWidth: 600 }}>
+            {error}
+          </Alert>
+          <Typography variant="body2" color="text.secondary">
+            Redirecting to login page...
+          </Typography>
+        </>
+      ) : (
+        <>
+          <CircularProgress size={60} />
+          <Typography variant="h6" sx={{ mt: 2 }}>
+            Completing authentication...
+          </Typography>
+          <Typography variant="body2" color="text.secondary">
+            Please wait while we log you in.
+          </Typography>
+        </>
+      )}
+    </Box>
+  );
+};

package/bundle/typescript/src/templates/react/kit/mui/auth0/auth-callback.js.tsx

@@ -0,0 +1,71 @@
+import React, { useEffect, useState } from 'react';
+import { useNavigate } from 'react-router-dom';
+import { Box, CircularProgress, Typography, Alert } from '@mui/material';
+import AuthService from '<%= authServicePath %>';
+
+/**
+ * Auth0 Callback Component
+ *
+ * This component handles the OAuth callback from Auth0.
+ * It exchanges the authorization code for tokens and logs the user into Meteor.
+ */
+export const AuthCallback = () => {
+  const navigate = useNavigate();
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    const handleCallback = async () => {
+      try {
+        // Handle the Auth0 callback and login to Meteor
+        await AuthService.handleAuth0Callback();
+
+        // Redirect to home page after successful login
+        navigate('/', { replace: true });
+      } catch (err) {
+        console.error('Auth0 callback error:', err);
+        setError(err instanceof Error ? err.message : 'Authentication failed');
+
+        // Redirect to login page after a delay
+        setTimeout(() => {
+          navigate('/login', { replace: true });
+        }, 3000);
+      }
+    };
+
+    handleCallback();
+  }, [navigate]);
+
+  return (
+    <Box
+      sx={{
+        display: 'flex',
+        flexDirection: 'column',
+        alignItems: 'center',
+        justifyContent: 'center',
+        minHeight: '100vh',
+        gap: 2,
+      }}
+    >
+      {error ? (
+        <>
+          <Alert severity="error" sx={{ maxWidth: 600 }}>
+            {error}
+          </Alert>
+          <Typography variant="body2" color="text.secondary">
+            Redirecting to login page...
+          </Typography>
+        </>
+      ) : (
+        <>
+          <CircularProgress size={60} />
+          <Typography variant="h6" sx={{ mt: 2 }}>
+            Completing authentication...
+          </Typography>
+          <Typography variant="body2" color="text.secondary">
+            Please wait while we log you in.
+          </Typography>
+        </>
+      )}
+    </Box>
+  );
+};

package/bundle/typescript/src/templates/react/kit/mui/auth0/auth0-account-settings.js.jsx

@@ -0,0 +1,123 @@
+import React, { useContext, useState } from 'react';
+import {
+  Box,
+  Card,
+  CardContent,
+  Typography,
+  Button,
+  Alert,
+  CircularProgress,
+} from '@mui/material';
+import { Meteor } from 'meteor/meteor';
+import { AuthContext } from '<%= authContextPath %>';
+
+/**
+ * Auth0 Account Settings Component
+ *
+ * Displays Auth0 account status and allows linking/unlinking
+ * Auth0 account to/from the current Meteor user.
+ */
+export const Auth0AccountSettings = () => {
+  const auth = useContext(AuthContext);
+  const [loading, setLoading] = useState(false);
+  const [message, setMessage] = useState(null);
+
+  if (!auth?.currentUser) {
+    return null;
+  }
+
+  const user = Meteor.user();
+  const hasAuth0Account = Boolean(user?.services?.auth0);
+
+  const handleLinkAccount = async () => {
+    setLoading(true);
+    setMessage(null);
+
+    try {
+      const success = await auth.linkAuth0Account?.();
+      if (success) {
+        setMessage({ type: 'success', text: 'Auth0 account linked successfully!' });
+      }
+    } catch (error) {
+      setMessage({
+        type: 'error',
+        text: error instanceof Error ? error.message : 'Failed to link Auth0 account',
+      });
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleUnlinkAccount = async () => {
+    setLoading(true);
+    setMessage(null);
+
+    try {
+      const success = await auth.unlinkAuth0Account?.();
+      if (success) {
+        setMessage({ type: 'success', text: 'Auth0 account unlinked successfully!' });
+      }
+    } catch (error) {
+      setMessage({
+        type: 'error',
+        text: error instanceof Error ? error.message : 'Failed to unlink Auth0 account',
+      });
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <Card>
+      <CardContent>
+        <Typography variant="h6" gutterBottom>
+          Auth0 Integration
+        </Typography>
+
+        {message && (
+          <Alert severity={message.type} sx={{ mb: 2 }}>
+            {message.text}
+          </Alert>
+        )}
+
+        {hasAuth0Account ? (
+          <Box>
+            <Alert severity="success" sx={{ mb: 2 }}>
+              Your account is linked with Auth0
+            </Alert>
+            <Typography variant="body2" color="text.secondary" gutterBottom>
+              Email: {user?.services?.auth0?.email || 'N/A'}
+            </Typography>
+            <Typography variant="body2" color="text.secondary" gutterBottom>
+              Name: {user?.services?.auth0?.name || 'N/A'}
+            </Typography>
+            <Button
+              variant="outlined"
+              color="error"
+              onClick={handleUnlinkAccount}
+              disabled={loading}
+              sx={{ mt: 2 }}
+              startIcon={loading ? <CircularProgress size={20} /> : undefined}
+            >
+              {loading ? 'Unlinking...' : 'Unlink Auth0 Account'}
+            </Button>
+          </Box>
+        ) : (
+          <Box>
+            <Alert severity="info" sx={{ mb: 2 }}>
+              Link your account with Auth0 for easier login
+            </Alert>
+            <Button
+              variant="contained"
+              onClick={handleLinkAccount}
+              disabled={loading}
+              startIcon={loading ? <CircularProgress size={20} /> : undefined}
+            >
+              {loading ? 'Linking...' : 'Link Auth0 Account'}
+            </Button>
+          </Box>
+        )}
+      </CardContent>
+    </Card>
+  );
+};