@ofidj/generator-fidj 3.7.4 → 3.8.0

package/README.md

@@ -44,6 +44,7 @@ one.
 > `test/parity.test.cjs` fails if either door ever gains an input the other
 > lacks. It is not an entry point to hand to anyone building an app.
 
+- `--signin button|inline|both`: how the app asks (default: `button`). `button` hands every sign-in to Fidj, which is the only shape where this app never sees a password. `inline` keeps the app's own email-and-password form and no Fidj door, for an owner who has decided their page is to be trusted with the credential. `both` leads with the Fidj door and folds the app's form under it — what mleweb passes. The older `--credentials true|false` still says what it always said (`true` is `both`); `--signin` wins when both are given.
 - `--anonymous true|false`: show or hide anonymous entry in content apps (default: `true`). Set `--anonymous false` for a sign-in-only entry flow, as mleweb does.
 - `--highlight "<heading>|<body>"`: add a numbered cell to the sign-in panel, repeatable up to six. These are the app's own selling points, so an app that passes none simply shows its identity — mleweb passes none, Fidj passes four.
 - `--badge <text>`: add a trust badge under the sign-in form, repeatable up to four, 40 characters each. None are supplied by default — "EU-hosted" or "GDPR art. 17 · 20" are claims about a particular app, not about every app the generator makes.
@@ -101,6 +102,23 @@ picks up whatever is published at the time.
 
 The generated content app opens on `/#/signin`. Sign in, or choose **Enter anonymously** when enabled, to open `/#/content`, containing the supplied HTML. Signed-in users can open **My privacy** separately. Sign-out and departure return to the sign-in screen. Anonymous content is public; this navigation flow is not a security boundary for static assets.
 
+**The entry leads with the Fidj door, and that door opens a window.** The button
+is the one control on the screen wearing `--fidj-accent`, because it is the one
+that belongs to Fidj rather than to the app — and it is the path where the app
+never sees a password. An app generated with `--signin both` keeps its own
+email-and-password form under an *Inline form* disclosure, with its service
+agreement: opening it folds the Fidj door away, because the two are alternatives
+rather than a list. That agreement gates the app's own door and nothing else, so
+an agreement that fails to load never shuts the Fidj door.
+
+Pressing it opens Fidj in a browser window of its own rather than navigating
+away. Fidj's screens are served from another origin and refuse to be framed, so
+a dialog drawn inside the page cannot hold them; a window can, and the page the
+person was reading stays exactly where it was. The window says which app it will
+return them to, hands the answer back when they are done, and closes itself. A
+browser that will not open one falls back to the full-page redirect. Fidj's own
+console takes the same door for the same reason — one journey, three apps.
+
 ## Compose an existing app as a module
 
 Build your application for the `/module/` base URL, then pass its public output to the same generator:
@@ -114,7 +132,7 @@ The result is one static website: the generated SDK sign-in entry and the module
 
 Hash routes other than the generated entry/content/privacy views are forwarded to the module, preserving existing public cards and console links. The module remains responsible for guarding private routes.
 
-The module entry receives a `meta[name="fidj-signin"]` URL, relative to its base URL. A module can send its sign-in, logout or expired-session flow there. Fidj's console implements this handoff and preserves departure status. The generated preview serves module assets from an explicit build manifest, including directory index URLs.
+Sign-in, sign-out and expired sessions belong to the shell, which owns those addresses: a module reaches them by leaving the document — the site root — rather than routing inside it, because the shell starts the module in place and only hears `hashchange`. A departure status travels as `?departure=completed|pending` on that address. Fidj's console implements this handover. The shell also names itself in that document — `meta[name="fidj-shell"]`, holding the base its addresses start from — so a module can offer what only a shell has, such as the account screen at `#/account`; standalone there is no such meta and nothing to offer. The generated preview serves module assets from an explicit build manifest, including directory index URLs, and the generated entry names the module's scripts and stylesheet in its head so the browser starts them without waiting for the shell's session.
 
 `fidj-app` now exercises this path with `npm run create:local`: its owner/profile/privacy features remain an explicit Angular console module, while the generator owns the shared entry and final assembly. The local launcher serves the generated Fidj output on port 4200. The source console is maintained outside disposable `.gen` and must be rebuilt before regenerating.
 

package/bin/create-fidj.cjs

@@ -19,6 +19,7 @@ try {
       favicon: { type: "string" },
       anonymous: { type: "string" },
       credentials: { type: "string" },
+      signin: { type: "string" },
       domain: { type: "string" },
       module: { type: "string" },
       "module-entry": { type: "string" },
@@ -29,7 +30,7 @@ try {
   });
   if (values.help || positionals.length !== 1) {
     console.log(
-      "Usage: create-fidj <directory> --app-id <fidjId> [--api-endpoint <url>] [--title <text> --welcome <text> --description <text> --content <html> --domain <hostname>] [--highlight '<heading>|<body>' ...] [--badge <text> ...] [--logo <image>] [--favicon <image>] [--module <built-directory> --module-entry <index.html#/route>] [--oidc-issuer https://api.example/oidc] [--anonymous true|false] [--credentials true|false] [--local] [--replace]",
+      "Usage: create-fidj <directory> --app-id <fidjId> [--api-endpoint <url>] [--title <text> --welcome <text> --description <text> --content <html> --domain <hostname>] [--highlight '<heading>|<body>' ...] [--badge <text> ...] [--logo <image>] [--favicon <image>] [--module <built-directory> --module-entry <index.html#/route>] [--oidc-issuer https://api.example/oidc] [--anonymous true|false] [--signin button|inline|both] [--credentials true|false] [--local] [--replace]",
     );
     process.exitCode = values.help ? 0 : 1;
   } else {
@@ -48,6 +49,7 @@ try {
       favicon: values.favicon,
       anonymous: values.anonymous,
       credentials: values.credentials,
+      signin: values.signin,
       domain: values.domain,
       module: values.module,
       moduleEntry: values["module-entry"],

package/generators/app/index.js

@@ -15,6 +15,7 @@ const TEXT_OPTIONS = [
   "content",
   "anonymous",
   "credentials",
+  "signin",
   "domain",
   "module",
   "module-entry",
@@ -89,6 +90,7 @@ module.exports = class extends Generator {
       content: this.options.content,
       anonymous: this.options.anonymous,
       credentials: this.options.credentials,
+      signin: this.options.signin,
       highlights: repeated("highlight", this.options.highlight),
       badges: repeated("badge", this.options.badge),
       logo: this.options.logo,

package/generators/app/templates/typescript/README.md

@@ -51,7 +51,7 @@ Set `--anonymous false` in the generator command to remove anonymous entry and r
 
 ## Application modules
 
-When generated with `--module`, successful sign-in opens the copied module configured by `moduleEntry`. It runs under `/module/` on the same origin and must validate sessions/permissions independently. Its entry contains a `fidj-signin` meta URL for returning to this shared sign-in page. Module code is public static output; user data belongs behind authorized APIs. Rebuild the maintained module source and regenerate to update it; never patch its copied files here.
+When generated with `--module`, successful sign-in starts the copied module at the address configured by `moduleEntry`, inside this document rather than as a second page. Its assets are served from `/module/` on the same origin and it must validate sessions/permissions independently. To return to this shared sign-in page it leaves the document for the site root, optionally with `?departure=completed|pending`. Module code is public static output; user data belongs behind authorized APIs. Rebuild the maintained module source and regenerate to update it; never patch its copied files here.
 
 ## Connect app data rights
 

package/generators/app/templates/typescript/package.json

@@ -15,7 +15,7 @@
     "privacy:rehearse": "npm run build && node --test test/server.test.mjs"
   },
   "dependencies": {
-    "@ofidj/node": "^3.7.3"
+    "@ofidj/node": "^3.8.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/generators/app/templates/typescript/scripts/render-content.mjs

@@ -6,9 +6,32 @@ const escape = (value) =>
         char
       ],
   );
+// The mounted app's scripts are injected by the shell once its own bundle has
+// arrived and run, so the browser's preload scanner never sees them in the
+// document and the larger download waits on the smaller one. Naming them here
+// starts both at once. Preloaded, never applied: the module's stylesheet over
+// the shell's own sign-in screen would be one design on another's markup. An app
+// that carries a module is an app people open to reach that module, so this is
+// worth its bytes there — and an app without one names nothing extra.
+function mountedHead(config) {
+  const mount = config.moduleMount;
+  if (!mount) return "";
+  return [
+    // A hosted console cannot tell from its own code that it is hosted, and some
+    // of what it shows depends on it: verification and recovery are the shell's
+    // own screens. This says a shell is here, and where its addresses start.
+    `<meta name="fidj-shell" content="./">`,
+    ...mount.scripts.map(
+      (script) => `<link rel="modulepreload" href="${escape(script.src)}">`,
+    ),
+    ...mount.styles.map(
+      (href) => `<link rel="preload" as="style" href="${escape(href)}">`,
+    ),
+  ].join("");
+}
 export function renderContent(config) {
   // HTML is supplied by the developer at generation time, never by an app visitor.
-  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>${escape(config.title)}</title><link rel="icon" href="${escape(config.favicon)}"><link rel="stylesheet" href="./main.css"></head><body>
-  <header class="topbar"><a class="brand" href="#/content"><img src="${escape(config.logo)}" alt="">${escape(config.title)}</a></header>
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>${escape(config.title)}</title><link rel="icon" href="${escape(config.favicon)}"><link rel="stylesheet" href="./main.css">${mountedHead(config)}</head><body>
+  <header class="topbar"><a class="brand" href="#/content"><img src="${escape(config.logo)}" alt="">${escape(config.title)}</a><nav class="content-nav" id="app-nav" aria-label="App navigation" hidden></nav></header>
   <main><template id="public-content"><section class="card public-content"><h1>${escape(config.welcome)}</h1><div>${config.content}</div></section></template><div id="app" aria-live="polite"></div><footer>Built with Fidj · Your choices belong to this app.</footer></main><script type="module" src="./main.js"></script></body></html>`;
 }

package/generators/app/templates/typescript/server/index.ts

@@ -333,6 +333,12 @@ if (require.main === module) {
     dashboardUrl: process.env.FIDJ_DASHBOARD_URL || "https://fidj.ovh",
     title: process.env.APP_TITLE || "My workspace",
     releaseVersion: process.env.APP_VERSION || "",
+    // How this app asks. The generator writes it; anything it does not
+    // recognise means the shape that keeps the promise — Fidj asks, and this
+    // app never sees a password.
+    signin: ["button", "inline", "both"].includes(process.env.FIDJ_SIGNIN || "")
+      ? (process.env.FIDJ_SIGNIN as "button" | "inline" | "both")
+      : "button",
     localDemo:
       process.env.LOCAL_DEMO === "true" &&
       host === "127.0.0.1" &&