@polymorphism-tech/morph-spec 4.17.0 → 4.18.0

package/framework/templates/integrations/neon-auth-config.cs

@@ -0,0 +1,133 @@
+// ==============================================================================
+// MORPH-SPEC - Neon Auth Configuration Template
+// Configuracao de autenticacao com Neon Auth (Better Auth) para .NET
+// ==============================================================================
+
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using System.Security.Claims;
+
+namespace {{Namespace}}.Infrastructure.Auth;
+
+// ==============================================================================
+// OPTIONS
+// ==============================================================================
+
+public class NeonAuthOptions
+{
+    public const string SectionName = "NeonAuth";
+
+    /// <summary>
+    /// Neon Auth Base URL (e.g., https://ep-xxx.neonauth.us-east-2.aws.neon.build/neondb/auth)
+    /// </summary>
+    public string BaseUrl { get; set; } = string.Empty;
+}
+
+// ==============================================================================
+// SERVICE EXTENSIONS
+// ==============================================================================
+
+public static class NeonAuthServiceExtensions
+{
+    /// <summary>
+    /// Adds Neon Auth JWT Bearer authentication to the project.
+    /// Validates JWTs issued by Neon Auth service.
+    /// </summary>
+    public static IServiceCollection AddNeonAuthentication(
+        this IServiceCollection services,
+        IConfiguration configuration)
+    {
+        services.Configure<NeonAuthOptions>(configuration.GetSection(NeonAuthOptions.SectionName));
+
+        var neonAuthOptions = configuration.GetSection(NeonAuthOptions.SectionName).Get<NeonAuthOptions>()!;
+
+        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+            .AddJwtBearer(options =>
+            {
+                options.Authority = neonAuthOptions.BaseUrl;
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidateAudience = false,
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    NameClaimType = "sub"
+                };
+            });
+
+        services.AddAuthorization();
+
+        return services;
+    }
+}
+
+// ==============================================================================
+// USER CONTEXT SERVICE
+// ==============================================================================
+
+public interface ICurrentUserService
+{
+    string? UserId { get; }
+    string? Email { get; }
+    bool IsAuthenticated { get; }
+}
+
+public class CurrentUserService(IHttpContextAccessor httpContextAccessor) : ICurrentUserService
+{
+    public string? UserId =>
+        httpContextAccessor.HttpContext?.User.FindFirstValue("sub");
+
+    public string? Email =>
+        httpContextAccessor.HttpContext?.User.FindFirstValue("email");
+
+    public bool IsAuthenticated =>
+        httpContextAccessor.HttpContext?.User.Identity?.IsAuthenticated ?? false;
+}
+
+// ==============================================================================
+// MIDDLEWARE PIPELINE
+// ==============================================================================
+
+public static class NeonAuthMiddlewareExtensions
+{
+    public static IApplicationBuilder UseNeonAuthentication(this IApplicationBuilder app)
+    {
+        app.UseAuthentication();
+        app.UseAuthorization();
+        return app;
+    }
+}
+
+// ==============================================================================
+// APPSETTINGS EXAMPLE
+// ==============================================================================
+
+/*
+{
+  "NeonAuth": {
+    "BaseUrl": "https://ep-xxx.neonauth.us-east-2.aws.neon.build/neondb/auth"
+  }
+}
+*/
+
+// ==============================================================================
+// PROGRAM.CS EXAMPLE
+// ==============================================================================
+
+/*
+var builder = WebApplication.CreateBuilder(args);
+
+// Add Neon Auth authentication
+builder.Services.AddNeonAuthentication(builder.Configuration);
+builder.Services.AddHttpContextAccessor();
+builder.Services.AddScoped<ICurrentUserService, CurrentUserService>();
+
+var app = builder.Build();
+
+app.UseNeonAuthentication();
+
+app.MapControllers().RequireAuthorization();
+
+app.Run();
+*/

package/framework/workflows/docs/full-morph.md

@@ -63,7 +63,7 @@ proposal.md, design-system.md, mockups.md, components.md, flows.md, spec.md, con
 
 ## Exemplos
 - "Sistema de relatórios com jobs agendados Hangfire"
-- "Autenticação completa com Clerk (login, signup, OAuth)"
+- "Autenticação completa com Neon Auth (login, signup, OAuth)"
 - "Dashboard com gráficos, tabelas e filtros complexos"
 - "RAG pipeline com AI Search e embeddings"
 - "Infraestrutura completa com Docker/Easypanel"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polymorphism-tech/morph-spec",
-  "version": "4.17.0",
+  "version": "4.18.0",
   "description": "MORPH-SPEC: AI-First development framework with validation pipeline and multi-stack support",
   "keywords": [
     "claude-code",

package/src/lib/detectors/index.js

@@ -74,8 +74,8 @@ export function detectProject(targetPath, opts = {}) {
       if (depNames.includes('@neondatabase/serverless') || depNames.includes('postgres') || depNames.includes('pg')) {
         structure.integrations.push('neon');
       }
-      if (depNames.includes('@clerk/nextjs') || depNames.includes('@clerk/clerk-sdk-node')) {
-        structure.integrations.push('clerk');
+      if (depNames.includes('@neondatabase/auth')) {
+        structure.integrations.push('neon-auth');
       }
       if (depNames.includes('stripe')) {
         structure.integrations.push('stripe');

package/src/lib/generators/architecture-scanner.js

@@ -223,7 +223,7 @@ export async function scanIntegrations(projectPath) {
     );
 
     const knownServices = {
-      'Clerk': 'auth',
+      'NeonAuth': 'auth',
       'AsaaS': 'payment',
       'Resend': 'email',
       'Hangfire': 'background-jobs',
@@ -266,8 +266,7 @@ export async function scanIntegrations(projectPath) {
 
     // Scan .env files for known prefixes
     const envPrefixes = {
-      'NEXT_PUBLIC_CLERK': 'Clerk',
-      'CLERK_': 'Clerk',
+      'NEON_AUTH_': 'NeonAuth',
       'DATABASE_URL': 'Neon',
       'NEON_': 'Neon',
       'RESEND_': 'Resend',

package/framework/agents/integrations/clerk-auth.md

@@ -1,109 +0,0 @@
----
-name: clerk-auth
-description: Clerk Auth specialist for Clerk SDK integration, social login, JWT session management, and user management in Next.js and .NET projects. Use when integrating Clerk authentication, implementing social login flows, managing user sessions with Clerk JWT, or protecting routes with Clerk middleware.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - clerk
-color: teal
-effort: medium
----
-
-# Clerk Auth
-
-Autenticação SaaS com Clerk para .NET e Next.js. SDK: `Clerk.Net.AspNetCore.Security` (.NET) / `@clerk/nextjs` (Next.js).
-
-## Setup
-
-```csharp
-// appsettings.json
-{ "Clerk": { "SecretKey": "${CLERK_SECRET_KEY}", "PublishableKey": "pk_test_xxx" } }
-
-// Program.cs
-builder.Services.AddClerk(builder.Configuration);
-builder.Services.AddAuthentication(ClerkAuthenticationDefaults.AuthenticationScheme)
-    .AddClerk(o => { o.Authority = "https://clerk.{instance}.com"; o.ValidAudiences = ["your-app-id"]; });
-builder.Services.AddAuthorization();
-app.UseAuthentication();
-app.UseAuthorization();
-```
-
-## Protected Endpoints
-
-```csharp
-// Minimal API
-app.MapGet("/api/profile", async (ClaimsPrincipal user, IClerkClient clerk) =>
-{
-    var userId = user.FindFirstValue(ClaimTypes.NameIdentifier);
-    if (userId is null) return Results.Unauthorized();
-    var u = await clerk.Users.GetUserAsync(userId);
-    return Results.Ok(new { u.Id, Email = u.EmailAddresses.FirstOrDefault()?.EmailAddress });
-}).RequireAuthorization();
-
-// Controller: same pattern with [Authorize] + User.FindFirstValue()
-// Role-based: [Authorize(Roles = "admin")]
-```
-
-## Next.js Integration
-
-```tsx
-// middleware.ts
-import { clerkMiddleware } from '@clerk/nextjs/server';
-export default clerkMiddleware();
-export const config = { matcher: ['/((?!.*\\..*|_next).*)', '/'] };
-
-// Protected page
-import { auth } from '@clerk/nextjs/server';
-export default async function DashboardPage() {
-  const { userId } = await auth();
-  if (!userId) redirect('/sign-in');
-  return <Dashboard />;
-}
-
-// Client component
-'use client';
-import { useUser } from '@clerk/nextjs';
-const { user, isLoaded } = useUser();
-```
-
-## Client Operations (.NET)
-
-```csharp
-var user = await _clerk.Users.GetUserAsync(userId);                    // Get
-var users = await _clerk.Users.GetUserListAsync(new() { Limit = 10 }); // List
-await _clerk.Users.UpdateUserMetadataAsync(userId, new()               // Update metadata
-    { PublicMetadata = new Dictionary<string, object> { ["plan"] = "pro" } });
-await _clerk.Users.DeleteUserAsync(userId);                            // Delete
-```
-
-## Webhooks
-
-```csharp
-[ApiController, Route("api/webhooks/clerk")]
-public class ClerkWebhookController(IUserService users) : ControllerBase
-{
-    [HttpPost]
-    public async Task<IActionResult> Handle([FromBody] ClerkWebhookPayload payload)
-    {
-        switch (payload.Type)
-        {
-            case "user.created": await users.SyncUserAsync(payload.Data); break;
-            case "user.updated": await users.UpdateUserAsync(payload.Data); break;
-            case "user.deleted": await users.DeleteUserAsync(payload.Data.Id); break;
-        }
-        return Ok();
-    }
-}
-```
-
-## Checklist
-
-- [ ] Secret Key in environment variables (not hardcoded)
-- [ ] Authentication scheme configured
-- [ ] Authorization policies defined
-- [ ] Webhook endpoint + signature validation
-- [ ] Redirect after login configured
-- [ ] Error handling for expired sessions
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/rules/clerk-standards.md

@@ -1,13 +0,0 @@
----
-paths:
-  - "**/Auth/**"
-  - "**/auth/**"
-  - "**/Identity/**"
-  - "**/Clerk/**"
-stacks:
-  - dotnet
----
-
-# Clerk Authentication Standards
-
-@.morph/framework/standards/backend/integrations/clerk/clerk-auth.md

package/framework/standards/backend/integrations/clerk/clerk-auth.md

@@ -1,292 +0,0 @@
-# Clerk Authentication Integration Standard
-
-> **Scope:** universal
-> **Layer:** 2 (on keyword)
-> **Keywords:** clerk, auth, authentication, nextjs, user management
-> **Load When:** clerk authentication keywords detected
-
-Modern authentication and user management for Next.js applications.
-
----
-
-## Overview
-
-Clerk provides:
-- Pre-built UI components (SignIn, SignUp, UserProfile)
-- Social auth (Google, GitHub, etc.)
-- Multi-factor authentication
-- Session management
-- User metadata and organizations
-
-**Primary Use Case:** Next.js 15 + App Router
-
----
-
-## Core Principles
-
-1. **Server-First**: Use server-side auth checks with `auth()` helper
-2. **Route Protection**: Middleware-based protection for private routes
-3. **Type Safety**: Use Clerk's TypeScript types
-4. **Edge Compatible**: Works with Edge Runtime
-
----
-
-## Installation & Setup
-
-### Install Packages
-
-```bash
-npm install @clerk/nextjs
-```
-
-### Environment Variables
-
-```bash
-# .env.local
-NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_...
-CLERK_SECRET_KEY=sk_test_...
-NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
-NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-up
-NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL=/dashboard
-NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL=/onboarding
-```
-
-### Root Layout Wrapper
-
-```typescript
-// app/layout.tsx
-import { ClerkProvider } from '@clerk/nextjs';
-
-export default function RootLayout({ children }: { children: React.ReactNode }) {
-  return (
-    <ClerkProvider>
-      <html lang="en">
-        <body>{children}</body>
-      </html>
-    </ClerkProvider>
-  );
-}
-```
-
-### Middleware Protection
-
-```typescript
-// middleware.ts
-import { authMiddleware } from '@clerk/nextjs';
-
-export default authMiddleware({
-  publicRoutes: ['/', '/api/webhooks/clerk'],
-  ignoredRoutes: ['/api/public']
-});
-
-export const config = {
-  matcher: ['/((?!.+\\.[\\w]+$|_next).*)', '/', '/(api|trpc)(.*)'],
-};
-```
-
----
-
-## Common Patterns
-
-### Sign In Page
-
-```typescript
-// app/sign-in/[[...sign-in]]/page.tsx
-import { SignIn } from '@clerk/nextjs';
-
-export default function SignInPage() {
-  return (
-    <div className="flex items-center justify-center min-h-screen">
-      <SignIn />
-    </div>
-  );
-}
-```
-
-### Server-Side Auth Check
-
-```typescript
-// app/dashboard/page.tsx
-import { auth } from '@clerk/nextjs';
-import { redirect } from 'next/navigation';
-
-export default async function DashboardPage() {
-  const { userId } = auth();
-
-  if (!userId) {
-    redirect('/sign-in');
-  }
-
-  return <div>Dashboard for user {userId}</div>;
-}
-```
-
-### Client Component with User Data
-
-```typescript
-// components/UserProfile.tsx
-'use client';
-import { useUser } from '@clerk/nextjs';
-
-export function UserProfile() {
-  const { user, isLoaded, isSignedIn } = useUser();
-
-  if (!isLoaded) return <div>Loading...</div>;
-  if (!isSignedIn) return <div>Not signed in</div>;
-
-  return (
-    <div>
-      <p>Welcome, {user.firstName}!</p>
-      <p>Email: {user.primaryEmailAddress?.emailAddress}</p>
-    </div>
-  );
-}
-```
-
-### API Route Protection
-
-```typescript
-// app/api/protected/route.ts
-import { auth } from '@clerk/nextjs';
-
-export async function GET() {
-  const { userId } = auth();
-
-  if (!userId) {
-    return new Response('Unauthorized', { status: 401 });
-  }
-
-  // Fetch user-specific data
-  const data = await fetchUserData(userId);
-
-  return Response.json(data);
-}
-```
-
----
-
-## Webhook Integration
-
-### Setup Webhook Endpoint
-
-```typescript
-// app/api/webhooks/clerk/route.ts
-import { Webhook } from 'svix';
-import { headers } from 'next/headers';
-
-export async function POST(req: Request) {
-  const WEBHOOK_SECRET = process.env.CLERK_WEBHOOK_SECRET!;
-
-  const headerPayload = headers();
-  const svix_id = headerPayload.get('svix-id');
-  const svix_timestamp = headerPayload.get('svix-timestamp');
-  const svix_signature = headerPayload.get('svix-signature');
-
-  if (!svix_id || !svix_timestamp || !svix_signature) {
-    return new Response('Missing svix headers', { status: 400 });
-  }
-
-  const payload = await req.json();
-  const body = JSON.stringify(payload);
-
-  const wh = new Webhook(WEBHOOK_SECRET);
-
-  let evt;
-  try {
-    evt = wh.verify(body, {
-      'svix-id': svix_id,
-      'svix-timestamp': svix_timestamp,
-      'svix-signature': svix_signature,
-    });
-  } catch (err) {
-    return new Response('Invalid signature', { status: 400 });
-  }
-
-  // Handle events
-  switch (evt.type) {
-    case 'user.created':
-      await handleUserCreated(evt.data);
-      break;
-    case 'user.updated':
-      await handleUserUpdated(evt.data);
-      break;
-    case 'user.deleted':
-      await handleUserDeleted(evt.data);
-      break;
-  }
-
-  return new Response('OK');
-}
-```
-
----
-
-## Neon Integration
-
-### Sync Users to Neon PostgreSQL (via EF Core / Npgsql)
-
-```csharp
-// Services/ClerkUserSyncService.cs
-public sealed class ClerkUserSyncService(IDbContextFactory<AppDbContext> dbFactory)
-{
-    public async Task HandleUserCreatedAsync(ClerkUserData userData, CancellationToken ct)
-    {
-        await using var db = await dbFactory.CreateDbContextAsync(ct);
-
-        db.Profiles.Add(new Profile
-        {
-            ClerkUserId = userData.Id,
-            Email = userData.EmailAddresses[0].EmailAddress,
-            FirstName = userData.FirstName,
-            LastName = userData.LastName,
-            AvatarUrl = userData.ImageUrl
-        });
-
-        await db.SaveChangesAsync(ct);
-    }
-}
-```
-
----
-
-## Best Practices
-
-### Custom Claims
-
-```typescript
-// Add custom claims in Clerk Dashboard or via API
-const { sessionClaims } = auth();
-const role = sessionClaims?.metadata?.role as string;
-
-if (role !== 'admin') {
-  return new Response('Forbidden', { status: 403 });
-}
-```
-
-### Organizations
-
-```typescript
-import { auth } from '@clerk/nextjs';
-
-const { orgId, orgRole } = auth();
-
-if (!orgId) {
-  redirect('/create-organization');
-}
-
-if (orgRole !== 'admin') {
-  return <div>Admin access required</div>;
-}
-```
-
----
-
-## References
-
-- [Clerk Next.js Documentation](https://clerk.com/docs/nextjs)
-- [Clerk API Reference](https://clerk.com/docs/reference/backend-api)
-- [Webhooks Guide](https://clerk.com/docs/integrations/webhooks)
-
----
-
-*MORPH-SPEC by Polymorphism Tech*