@ofidj/generator-fidj 1.0.8 → 1.0.9

package/README.md

@@ -128,7 +128,7 @@ Readiness confirms this handler only. Register its trusted URL and independent s
 
 ## Beta OIDC input
 
-`--oidc-issuer` selects the OIDC entry for content/module apps while preserving branding and anonymous-entry configuration. This is beta: the API ships an integrated provider from 3.6.26, but it serves no `/oidc` routes until an operator configures an issuer and signing keys, so confirm the issuer you pass actually answers discovery before offering it.
+`--oidc-issuer` selects the OIDC entry for any generated app — a content site, a console module, or an app with its own backend — while preserving branding and anonymous-entry configuration. The entry becomes a single **Continue with Fidj** button, no password field, and the generated `.env` carries `FIDJ_OIDC_ISSUER` so the app's own server can serve it to its page. Register the app's exact callback first (`PUT /v3/apps/:appId/oidc`), or the provider refuses the authorization. This is beta: the API ships an integrated provider from 3.6.26, but it serves no `/oidc` routes until an operator configures an issuer and signing keys, so confirm the issuer you pass actually answers discovery before offering it.
 
 A compatible issuer, REST API and registered callback without a fragment are prerequisites. Validate that integration and coordinated SDK publication before offering it to app builders. Notes retains its existing authentication flow; no subject migration is implied.
 

package/generators/app/templates/typescript/server/index.ts

@@ -320,9 +320,16 @@ if (require.main === module) {
     throw new Error("Invalid Fidj API URL.");
   const port = Number(process.env.PORT || 8200);
   const host = process.env.HOST || "127.0.0.1";
+  // The page needs the issuer to start a redirect sign-in, and it may only be
+  // this API's own provider: an issuer on another origin would send people to
+  // type this app's credentials somewhere unrelated.
+  const oidcIssuer = process.env.FIDJ_OIDC_ISSUER || "";
+  if (oidcIssuer && new URL(oidcIssuer).href !== new URL("/oidc", api).href)
+    throw new Error("FIDJ_OIDC_ISSUER must be the Fidj API's own /oidc endpoint.");
   const settings = {
     appId,
     apiEndpoint,
+    oidcIssuer,
     dashboardUrl: process.env.FIDJ_DASHBOARD_URL || "https://fidj.ovh",
     title: process.env.APP_TITLE || "My workspace",
     releaseVersion: process.env.APP_VERSION || "",

package/generators/app/templates/typescript/src/main.ts

@@ -1,5 +1,5 @@
 import {agreementMarkup, bindAgreement, acceptedAgreement, signInErrorMessage} from "./service-agreement";
-import { FidjNodeService } from "@ofidj/node";
+import { FidjNodeService, FidjOidcClient } from "@ofidj/node";
 import "./style.css";
 import { showVersionBadge } from "./version";
 
@@ -12,9 +12,13 @@ type Settings = {
   dashboardUrl: string;
   localDemo: boolean;
   releaseVersion: string;
+  oidcIssuer?: string;
 };
 const root = document.querySelector<HTMLDivElement>("#app")!;
 const sdk = new FidjNodeService();
+// When the app is configured with a provider it never sees a password: the
+// entry hands the person to Fidj and gets a code back.
+let oidc: FidjOidcClient | null = null;
 let settings: Settings;
 let session: Session | null = null;
 let notes: Note[] = [];
@@ -90,7 +94,7 @@ function render() {
   <main>${notice ? `<p class="notice" role="status">${escape(notice)}</p>` : ""}${error ? `<p class="error" role="alert">${escape(error)}</p>` : ""}
   ${
     !session
-      ? `<section class="welcome"><div><p class="eyebrow">A LITTLE SPACE FOR YOUR IDEAS</p><h1>Good ideas<br>start here.</h1><p>Keep your notes together, with access you understand and privacy you control.</p><div class="promise"><img src="/fidj-logo.png" alt=""><span>Your account connects through Fidj.<br>Your choices belong to this app.</span></div></div><form id="signin" class="card"><h2>Welcome to ${escape(settings.title)}</h2><p>Sign in with your Fidj account.</p><label for="email">Email</label><input id="email" type="email" value="${escape(signInEmail)}" autocomplete="username" required><label for="password">Password</label><input id="password" type="password" value="${escape(signInPassword)}" autocomplete="current-password" required>${agreementMarkup()}<button class="primary" type="submit">Continue</button>${settings.localDemo ? `<div class="demo"><strong>Try the local example</strong><p>Alex owns the app. Maya and Sam start with the Free role.</p><button type="button" data-demo="alex">Alex · owner</button><button type="button" data-demo="maya">Maya · member</button><button type="button" data-demo="sam">Sam · member</button></div>` : ""}</form></section>`
+      ? `<section class="welcome"><div><p class="eyebrow">A LITTLE SPACE FOR YOUR IDEAS</p><h1>Good ideas<br>start here.</h1><p>Keep your notes together, with access you understand and privacy you control.</p><div class="promise"><img src="/fidj-logo.png" alt=""><span>Your account connects through Fidj.<br>Your choices belong to this app.</span></div></div><form id="signin" class="card"><h2>Welcome to ${escape(settings.title)}</h2>${oidc ? `<p>Continue securely with your Fidj account. Your password stays with Fidj.</p>${agreementMarkup()}<button class="primary" type="submit">Continue with Fidj</button>` : `<p>Sign in with your Fidj account.</p><label for="email">Email</label><input id="email" type="email" value="${escape(signInEmail)}" autocomplete="username" required><label for="password">Password</label><input id="password" type="password" value="${escape(signInPassword)}" autocomplete="current-password" required>${agreementMarkup()}<button class="primary" type="submit">Continue</button>${settings.localDemo ? `<div class="demo"><strong>Try the local example</strong><p>Alex owns the app. Maya and Sam start with the Free role.</p><button type="button" data-demo="alex">Alex · owner</button><button type="button" data-demo="maya">Maya · member</button><button type="button" data-demo="sam">Sam · member</button></div>` : ""}`}</form></section>`
       : `
   <div class="page-heading"><div><p class="eyebrow">YOUR WORKSPACE</p><h1>A place to think.</h1><p>${escape(session.username)} <span class="roles">${session.roles.map(escape).join(" · ") || "No assigned roles"}</span></p></div><button id="signout">Sign out</button></div>
   <nav><button id="workspace-tab" class="${view === "workspace" ? "selected" : ""}">My notes</button><button id="privacy-tab" class="${view === "privacy" ? "selected" : ""}">My privacy</button><button id="refresh">Refresh access</button></nav>
@@ -115,8 +119,8 @@ function render() {
   void bindAgreement(el<HTMLFormElement>("signin"), settings.title, settings.apiEndpoint, settings.appId, signInAgreementAccepted);
   el<HTMLFormElement>("signin")?.addEventListener("submit", (event) => {
     event.preventDefault();
-    const email = el<HTMLInputElement>("email").value;
-    const password = el<HTMLInputElement>("password").value;
+    const email = el<HTMLInputElement>("email")?.value || "";
+    const password = el<HTMLInputElement>("password")?.value || "";
     signInEmail = email;
     signInPassword = password;
     signInAgreementAccepted = el<HTMLInputElement>("service-agreement").checked;
@@ -127,6 +131,10 @@ function render() {
       return;
     }
     void action(async () => {
+      if (oidc) {
+        window.location.assign(await oidc.beginLogin());
+        return;
+      }
       try {
         await sdk.login(email, password, { autoSignup: false, ...acceptance });
       } catch (reason) {
@@ -251,6 +259,21 @@ async function start() {
   try {
     settings = await (await fetch("/api/config")).json();
     showVersionBadge(settings.releaseVersion, settings.title === "Fidj" ? settings.apiEndpoint : undefined);
+    if (settings.oidcIssuer)
+      oidc = new FidjOidcClient({
+        issuer: settings.oidcIssuer,
+        clientId: settings.appId,
+        redirectUri: window.location.origin + window.location.pathname,
+        apiEndpoint: settings.apiEndpoint,
+        storage: sessionStorage,
+      });
+    // Coming back from Fidj: swap the code for a session, and take the code out
+    // of the address bar before anything can reload it.
+    if (oidc && new URL(window.location.href).searchParams.has("state")) {
+      const callback = new URL(window.location.href);
+      window.history.replaceState(null, "", window.location.pathname);
+      await oidc.completeLogin(callback);
+    }
     await sdk.init(settings.appId, {
       apiEndpoint: settings.apiEndpoint,
       prod: !settings.localDemo,

package/lib/scaffold.cjs

@@ -36,7 +36,6 @@ function scaffold(destination, options) {
   if (options.oidcIssuer) {
     const issuer = new URL(options.oidcIssuer);
     if (issuer.origin !== api.origin || issuer.pathname !== "/oidc" || issuer.hash || issuer.search || issuer.username || issuer.password) throw new Error("OIDC issuer must share the API origin and use /oidc.");
-    if (options.content === undefined && !options.module) throw new Error("OIDC currently requires a content app or console module.");
   }
   const title = options.title || name;
   if (/[\r\n]/.test(title)) throw new Error("Title must be one line.");
@@ -127,7 +126,10 @@ function scaffold(destination, options) {
   );
   fs.renameSync(path.join(dir, "gitignore"), path.join(dir, ".gitignore"));
   const releaseVersion = new Date().toISOString().slice(2, 10).replaceAll("-", ".");
-  const settings = `FIDJ_APP_ID=${options.appId}\nFIDJ_API_ENDPOINT=${api.href.replace(/\/$/, "")}\nFIDJ_DASHBOARD_URL=https://fidj.ovh\nAPP_TITLE=${title}\nAPP_VERSION=${releaseVersion}\nPORT=8200\nHOST=127.0.0.1\nLOCAL_DEMO=false\nFIDJ_DATA_DIR=../.fidj-data/${name}\nFIDJ_PRIVACY_ADAPTER_KEY=\n`;
+  // The app's own server serves this to its page: the entry cannot redirect to
+  // a provider it was never told about.
+  const issuerSetting = options.oidcIssuer ? `FIDJ_OIDC_ISSUER=${options.oidcIssuer}\n` : "";
+  const settings = `FIDJ_APP_ID=${options.appId}\nFIDJ_API_ENDPOINT=${api.href.replace(/\/$/, "")}\n${issuerSetting}FIDJ_DASHBOARD_URL=https://fidj.ovh\nAPP_TITLE=${title}\nAPP_VERSION=${releaseVersion}\nPORT=8200\nHOST=127.0.0.1\nLOCAL_DEMO=false\nFIDJ_DATA_DIR=../.fidj-data/${name}\nFIDJ_PRIVACY_ADAPTER_KEY=\n`;
   const localApi = options.local
     ? "http://localhost:3201/v3"
     : api.href.replace(/\/$/, "");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ofidj/generator-fidj",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Generate a TypeScript app with Fidj sign-in, live server-side roles and per-app privacy.",
   "homepage": "https://fidj.ovh",
   "bugs": {