@ofidj/generator-fidj 1.0.7 → 1.0.9

package/README.md

@@ -128,7 +128,7 @@ Readiness confirms this handler only. Register its trusted URL and independent s
 
 ## Beta OIDC input
 
-`--oidc-issuer` selects the OIDC entry for content/module apps while preserving branding and anonymous-entry configuration. This is beta: the API ships an integrated provider from 3.6.26, but it serves no `/oidc` routes until an operator configures an issuer and signing keys, so confirm the issuer you pass actually answers discovery before offering it.
+`--oidc-issuer` selects the OIDC entry for any generated app — a content site, a console module, or an app with its own backend — while preserving branding and anonymous-entry configuration. The entry becomes a single **Continue with Fidj** button, no password field, and the generated `.env` carries `FIDJ_OIDC_ISSUER` so the app's own server can serve it to its page. Register the app's exact callback first (`PUT /v3/apps/:appId/oidc`), or the provider refuses the authorization. This is beta: the API ships an integrated provider from 3.6.26, but it serves no `/oidc` routes until an operator configures an issuer and signing keys, so confirm the issuer you pass actually answers discovery before offering it.
 
 A compatible issuer, REST API and registered callback without a fragment are prerequisites. Validate that integration and coordinated SDK publication before offering it to app builders. Notes retains its existing authentication flow; no subject migration is implied.
 

package/generators/app/templates/typescript/server/index.ts

@@ -11,6 +11,7 @@ export interface Settings {
   apiEndpoint: string;
   dashboardUrl: string;
   title: string;
+  releaseVersion: string;
   localDemo: boolean;
 }
 class HttpError extends Error {
@@ -319,11 +320,19 @@ if (require.main === module) {
     throw new Error("Invalid Fidj API URL.");
   const port = Number(process.env.PORT || 8200);
   const host = process.env.HOST || "127.0.0.1";
+  // The page needs the issuer to start a redirect sign-in, and it may only be
+  // this API's own provider: an issuer on another origin would send people to
+  // type this app's credentials somewhere unrelated.
+  const oidcIssuer = process.env.FIDJ_OIDC_ISSUER || "";
+  if (oidcIssuer && new URL(oidcIssuer).href !== new URL("/oidc", api).href)
+    throw new Error("FIDJ_OIDC_ISSUER must be the Fidj API's own /oidc endpoint.");
   const settings = {
     appId,
     apiEndpoint,
+    oidcIssuer,
     dashboardUrl: process.env.FIDJ_DASHBOARD_URL || "https://fidj.ovh",
     title: process.env.APP_TITLE || "My workspace",
+    releaseVersion: process.env.APP_VERSION || "",
     localDemo:
       process.env.LOCAL_DEMO === "true" &&
       host === "127.0.0.1" &&

package/generators/app/templates/typescript/src/content.ts

@@ -7,7 +7,7 @@ import { showVersionBadge } from "./version";
 const sdk = new FidjNodeService();
 const oidc = config.oidcIssuer ? new FidjOidcClient({issuer: config.oidcIssuer, clientId: config.appId, redirectUri: window.location.origin + window.location.pathname, apiEndpoint: config.apiEndpoint, storage: sessionStorage}) : null;
 const root = document.querySelector<HTMLDivElement>("#app")!;
-showVersionBadge(config.releaseVersion);
+showVersionBadge(config.releaseVersion, config.title === "Fidj" ? config.apiEndpoint : undefined);
 const appPath = `/me/apps/${encodeURIComponent(config.appId)}`;
 let signedIn = false;
 let emailVerified = false;

package/generators/app/templates/typescript/src/main.ts

@@ -1,5 +1,5 @@
 import {agreementMarkup, bindAgreement, acceptedAgreement, signInErrorMessage} from "./service-agreement";
-import { FidjNodeService } from "@ofidj/node";
+import { FidjNodeService, FidjOidcClient } from "@ofidj/node";
 import "./style.css";
 import { showVersionBadge } from "./version";
 
@@ -12,9 +12,13 @@ type Settings = {
   dashboardUrl: string;
   localDemo: boolean;
   releaseVersion: string;
+  oidcIssuer?: string;
 };
 const root = document.querySelector<HTMLDivElement>("#app")!;
 const sdk = new FidjNodeService();
+// When the app is configured with a provider it never sees a password: the
+// entry hands the person to Fidj and gets a code back.
+let oidc: FidjOidcClient | null = null;
 let settings: Settings;
 let session: Session | null = null;
 let notes: Note[] = [];
@@ -90,7 +94,7 @@ function render() {
   <main>${notice ? `<p class="notice" role="status">${escape(notice)}</p>` : ""}${error ? `<p class="error" role="alert">${escape(error)}</p>` : ""}
   ${
     !session
-      ? `<section class="welcome"><div><p class="eyebrow">A LITTLE SPACE FOR YOUR IDEAS</p><h1>Good ideas<br>start here.</h1><p>Keep your notes together, with access you understand and privacy you control.</p><div class="promise"><img src="/fidj-logo.png" alt=""><span>Your account connects through Fidj.<br>Your choices belong to this app.</span></div></div><form id="signin" class="card"><h2>Welcome to ${escape(settings.title)}</h2><p>Sign in with your Fidj account.</p><label for="email">Email</label><input id="email" type="email" value="${escape(signInEmail)}" autocomplete="username" required><label for="password">Password</label><input id="password" type="password" value="${escape(signInPassword)}" autocomplete="current-password" required>${agreementMarkup()}<button class="primary" type="submit">Continue</button>${settings.localDemo ? `<div class="demo"><strong>Try the local example</strong><p>Alex owns the app. Maya and Sam start with the Free role.</p><button type="button" data-demo="alex">Alex · owner</button><button type="button" data-demo="maya">Maya · member</button><button type="button" data-demo="sam">Sam · member</button></div>` : ""}</form></section>`
+      ? `<section class="welcome"><div><p class="eyebrow">A LITTLE SPACE FOR YOUR IDEAS</p><h1>Good ideas<br>start here.</h1><p>Keep your notes together, with access you understand and privacy you control.</p><div class="promise"><img src="/fidj-logo.png" alt=""><span>Your account connects through Fidj.<br>Your choices belong to this app.</span></div></div><form id="signin" class="card"><h2>Welcome to ${escape(settings.title)}</h2>${oidc ? `<p>Continue securely with your Fidj account. Your password stays with Fidj.</p>${agreementMarkup()}<button class="primary" type="submit">Continue with Fidj</button>` : `<p>Sign in with your Fidj account.</p><label for="email">Email</label><input id="email" type="email" value="${escape(signInEmail)}" autocomplete="username" required><label for="password">Password</label><input id="password" type="password" value="${escape(signInPassword)}" autocomplete="current-password" required>${agreementMarkup()}<button class="primary" type="submit">Continue</button>${settings.localDemo ? `<div class="demo"><strong>Try the local example</strong><p>Alex owns the app. Maya and Sam start with the Free role.</p><button type="button" data-demo="alex">Alex · owner</button><button type="button" data-demo="maya">Maya · member</button><button type="button" data-demo="sam">Sam · member</button></div>` : ""}`}</form></section>`
       : `
   <div class="page-heading"><div><p class="eyebrow">YOUR WORKSPACE</p><h1>A place to think.</h1><p>${escape(session.username)} <span class="roles">${session.roles.map(escape).join(" · ") || "No assigned roles"}</span></p></div><button id="signout">Sign out</button></div>
   <nav><button id="workspace-tab" class="${view === "workspace" ? "selected" : ""}">My notes</button><button id="privacy-tab" class="${view === "privacy" ? "selected" : ""}">My privacy</button><button id="refresh">Refresh access</button></nav>
@@ -115,8 +119,8 @@ function render() {
   void bindAgreement(el<HTMLFormElement>("signin"), settings.title, settings.apiEndpoint, settings.appId, signInAgreementAccepted);
   el<HTMLFormElement>("signin")?.addEventListener("submit", (event) => {
     event.preventDefault();
-    const email = el<HTMLInputElement>("email").value;
-    const password = el<HTMLInputElement>("password").value;
+    const email = el<HTMLInputElement>("email")?.value || "";
+    const password = el<HTMLInputElement>("password")?.value || "";
     signInEmail = email;
     signInPassword = password;
     signInAgreementAccepted = el<HTMLInputElement>("service-agreement").checked;
@@ -127,6 +131,10 @@ function render() {
       return;
     }
     void action(async () => {
+      if (oidc) {
+        window.location.assign(await oidc.beginLogin());
+        return;
+      }
       try {
         await sdk.login(email, password, { autoSignup: false, ...acceptance });
       } catch (reason) {
@@ -250,7 +258,22 @@ function render() {
 async function start() {
   try {
     settings = await (await fetch("/api/config")).json();
-    showVersionBadge(settings.releaseVersion);
+    showVersionBadge(settings.releaseVersion, settings.title === "Fidj" ? settings.apiEndpoint : undefined);
+    if (settings.oidcIssuer)
+      oidc = new FidjOidcClient({
+        issuer: settings.oidcIssuer,
+        clientId: settings.appId,
+        redirectUri: window.location.origin + window.location.pathname,
+        apiEndpoint: settings.apiEndpoint,
+        storage: sessionStorage,
+      });
+    // Coming back from Fidj: swap the code for a session, and take the code out
+    // of the address bar before anything can reload it.
+    if (oidc && new URL(window.location.href).searchParams.has("state")) {
+      const callback = new URL(window.location.href);
+      window.history.replaceState(null, "", window.location.pathname);
+      await oidc.completeLogin(callback);
+    }
     await sdk.init(settings.appId, {
       apiEndpoint: settings.apiEndpoint,
       prod: !settings.localDemo,

package/generators/app/templates/typescript/src/version.ts

@@ -1,8 +1,19 @@
-export function showVersionBadge(version: string): void {
+export function showVersionBadge(version: string, apiEndpoint?: string): void {
   if (!/^\d{2}\.\d{2}\.\d{2}$/.test(version || "")) return;
   const badge = document.createElement("div");
   badge.className = "fidj-version";
   badge.setAttribute("aria-label", `App version ${version}`);
   badge.textContent = `v${version}`;
   document.body.append(badge);
+  if (apiEndpoint) {
+    void fetch(`${apiEndpoint.replace(/\/$/, "")}/status`)
+      .then(response => response.ok ? response.json() : null)
+      .then(status => {
+        const apiVersion = status?.version || status?.built;
+        if (!apiVersion) return;
+        badge.textContent = `v${version} · API ${apiVersion}`;
+        badge.setAttribute("aria-label", `App version ${version}, API version ${apiVersion}`);
+      })
+      .catch(() => undefined);
+  }
 }

package/lib/scaffold.cjs

@@ -36,7 +36,6 @@ function scaffold(destination, options) {
   if (options.oidcIssuer) {
     const issuer = new URL(options.oidcIssuer);
     if (issuer.origin !== api.origin || issuer.pathname !== "/oidc" || issuer.hash || issuer.search || issuer.username || issuer.password) throw new Error("OIDC issuer must share the API origin and use /oidc.");
-    if (options.content === undefined && !options.module) throw new Error("OIDC currently requires a content app or console module.");
   }
   const title = options.title || name;
   if (/[\r\n]/.test(title)) throw new Error("Title must be one line.");
@@ -126,7 +125,11 @@ function scaffold(destination, options) {
     JSON.stringify(pkg, null, 2) + "\n",
   );
   fs.renameSync(path.join(dir, "gitignore"), path.join(dir, ".gitignore"));
-  const settings = `FIDJ_APP_ID=${options.appId}\nFIDJ_API_ENDPOINT=${api.href.replace(/\/$/, "")}\nFIDJ_DASHBOARD_URL=https://fidj.ovh\nAPP_TITLE=${title}\nPORT=8200\nHOST=127.0.0.1\nLOCAL_DEMO=false\nFIDJ_DATA_DIR=../.fidj-data/${name}\nFIDJ_PRIVACY_ADAPTER_KEY=\n`;
+  const releaseVersion = new Date().toISOString().slice(2, 10).replaceAll("-", ".");
+  // The app's own server serves this to its page: the entry cannot redirect to
+  // a provider it was never told about.
+  const issuerSetting = options.oidcIssuer ? `FIDJ_OIDC_ISSUER=${options.oidcIssuer}\n` : "";
+  const settings = `FIDJ_APP_ID=${options.appId}\nFIDJ_API_ENDPOINT=${api.href.replace(/\/$/, "")}\n${issuerSetting}FIDJ_DASHBOARD_URL=https://fidj.ovh\nAPP_TITLE=${title}\nAPP_VERSION=${releaseVersion}\nPORT=8200\nHOST=127.0.0.1\nLOCAL_DEMO=false\nFIDJ_DATA_DIR=../.fidj-data/${name}\nFIDJ_PRIVACY_ADAPTER_KEY=\n`;
   const localApi = options.local
     ? "http://localhost:3201/v3"
     : api.href.replace(/\/$/, "");
@@ -136,7 +139,7 @@ function scaffold(destination, options) {
     apiEndpoint: localApi,
     dashboardUrl: options.local ? "http://localhost:4200" : "https://fidj.ovh",
     title,
-    releaseVersion: new Date().toISOString().slice(2, 10).replaceAll("-", "."),
+    releaseVersion,
     localDemo: Boolean(options.local),
     allowAnonymous: anonymous === true || anonymous === "true",
     welcome: options.welcome || title,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ofidj/generator-fidj",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "Generate a TypeScript app with Fidj sign-in, live server-side roles and per-app privacy.",
   "homepage": "https://fidj.ovh",
   "bugs": {