@r8s/recipes 0.1.0

package/dist/app.d.ts

@@ -0,0 +1,94 @@
+import { type SecretRef, type VaultSecretRef } from './web-service';
+import type { TLSConfig } from '@r8s/k8s-types';
+export interface AppProps {
+    /** Resource name */
+    name: string;
+    /** Kubernetes namespace (defaults to 'default' or the Platform namespace) */
+    namespace?: string;
+    /** Container image (e.g., 'myapp/api:v1.2.3') */
+    image: string;
+    /** Container port the app listens on (defaults to 3000) */
+    port?: number;
+    /** Number of pod replicas (defaults to 2) */
+    replicas?: number;
+    /** Domain name (e.g., 'api.example.com') the endpoint should accept traffic for */
+    host: string;
+    /** TLS certificate configuration for HTTPS */
+    tls?: TLSConfig;
+    /** Plain environment variables (non-sensitive) */
+    env?: Record<string, string>;
+    /** Secrets from Kubernetes Secrets — safe by default */
+    secrets?: Record<string, SecretRef | string>;
+    /** Secrets from Vault — creates VaultStaticSecret objects */
+    vault?: Record<string, VaultSecretRef>;
+    /** CPU and memory requests/limits for the app container */
+    resources?: {
+        requests?: {
+            cpu?: string;
+            memory?: string;
+        };
+        limits?: {
+            cpu?: string;
+            memory?: string;
+        };
+    };
+    /** Add a Redis cache for this app (session store, cache, queue) */
+    cache?: boolean;
+    /** Create a DNS record via ExternalDNS (default: false) */
+    dns?: boolean;
+    /** Child components rendered as sibling resources (e.g., a BackgroundWorker) */
+    children?: unknown;
+}
+/**
+ * Simple application — Deployment + Service + Endpoint.
+ *
+ * @title App
+ * @category Complete Solution
+ *
+ * The simplest way to deploy an app to Kubernetes — Deployment, Service,
+ * and routing (Ingress or Gateway) with TLS.
+ *
+ * @example
+ * import { App } from '@r8s/recipes'
+ *
+ * export default <App name="myapp" image="myapp/web:v1.2.3" host="myapp.example.com" />
+ *
+ * @example
+ * import { Platform, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform routing="gateway" namespace="production">
+ *     <App name="myapp" image="myapp/web:v1.2.3" host="myapp.example.com" />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <App
+ *     name="myapp"
+ *     image="myapp/web:v1.2.3"
+ *     host="myapp.example.com"
+ *     env={{ LOG_LEVEL: 'info' }}
+ *     secrets={{ DATABASE_URL: 'app-secrets' }}
+ *   />
+ * )
+ *
+ * @example
+ * import { Database, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <>
+ *     <Database name="myapp-db" storage="20Gi" />
+ *     <App
+ *       name="myapp"
+ *       image="myapp/web:v1.2.3"
+ *       host="myapp.example.com"
+ *       tls={{ secretName: 'myapp-tls', clusterIssuer: 'letsencrypt' }}
+ *     />
+ *   </>
+ * )
+ */
+export declare function App(props: AppProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.tsx"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AAG/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAI/C,MAAM,WAAW,QAAQ;IACvB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC,CAAA;IAC5C,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACtC,2DAA2D;IAC3D,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC5C,MAAM,CAAC,EAAE;YAAE,GAAG,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,gFAAgF;IAChF,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,GAAG,CAAC,KAAK,EAAE,QAAQ,kCAuFlC"}

package/dist/app.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.App = App;
+const core_1 = require("@r8s/core");
+const web_service_1 = require("./web-service");
+const endpoint_1 = require("./endpoint");
+const defaults_1 = require("@r8s/core/defaults");
+const crds_1 = require("@r8s/crds");
+const redis_1 = require("@r8s/crds/redis");
+/**
+ * Simple application — Deployment + Service + Endpoint.
+ *
+ * @title App
+ * @category Complete Solution
+ *
+ * The simplest way to deploy an app to Kubernetes — Deployment, Service,
+ * and routing (Ingress or Gateway) with TLS.
+ *
+ * @example
+ * import { App } from '@r8s/recipes'
+ *
+ * export default <App name="myapp" image="myapp/web:v1.2.3" host="myapp.example.com" />
+ *
+ * @example
+ * import { Platform, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Platform routing="gateway" namespace="production">
+ *     <App name="myapp" image="myapp/web:v1.2.3" host="myapp.example.com" />
+ *   </Platform>
+ * )
+ *
+ * @example
+ * import { App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <App
+ *     name="myapp"
+ *     image="myapp/web:v1.2.3"
+ *     host="myapp.example.com"
+ *     env={{ LOG_LEVEL: 'info' }}
+ *     secrets={{ DATABASE_URL: 'app-secrets' }}
+ *   />
+ * )
+ *
+ * @example
+ * import { Database, App } from '@r8s/recipes'
+ *
+ * export default (
+ *   <>
+ *     <Database name="myapp-db" storage="20Gi" />
+ *     <App
+ *       name="myapp"
+ *       image="myapp/web:v1.2.3"
+ *       host="myapp.example.com"
+ *       tls={{ secretName: 'myapp-tls', clusterIssuer: 'letsencrypt' }}
+ *     />
+ *   </>
+ * )
+ */
+function App(props) {
+    const { name, namespace: namespaceProp, image, port = 3000, replicas = 2, host, tls, env = {}, secrets = {}, vault = {}, resources, cache = false, dns, children, } = props;
+    // Inherit namespace from <Platform> context if not explicitly set
+    const contextNamespace = (0, core_1.useContext)(defaults_1.Namespace);
+    const namespace = namespaceProp ?? (contextNamespace !== 'default' ? contextNamespace : undefined) ?? 'default';
+    const elements = [];
+    elements.push((0, core_1.jsx)(web_service_1.WebService, {
+        name,
+        namespace,
+        image,
+        port,
+        replicas,
+        env,
+        secrets,
+        vault,
+        resources,
+    }));
+    elements.push((0, core_1.jsx)(endpoint_1.Endpoint, {
+        name: `${name}-endpoint`,
+        namespace,
+        host,
+        serviceName: name,
+        servicePort: 80,
+        tls,
+        dns,
+    }));
+    // Redis cache
+    if (cache) {
+        const sharedOperators = (0, core_1.useContext)(defaults_1.OperatorContext);
+        const hasRedis = sharedOperators.some((op) => op.name === 'redis-operator');
+        if (!hasRedis) {
+            elements.push((0, core_1.declareOperator)(crds_1.operators['redis-operator']()));
+        }
+        elements.push((0, redis_1.RedisClusterComponent)({
+            metadata: { name: `${name}-cache`, namespace },
+            spec: {
+                clusterSize: 3,
+                kubernetesConfig: { image: 'redis:7.2-alpine' },
+                storage: {
+                    volumeClaimTemplate: {
+                        spec: {
+                            accessModes: ['ReadWriteOnce'],
+                            resources: { requests: { storage: '1Gi' } },
+                        },
+                    },
+                },
+            },
+        }));
+        // Auto-wire REDIS_URL env var
+        env.REDIS_URL = `redis://${name}-cache.${namespace}.svc.cluster.local:6379`;
+    }
+    // Children render as sibling resources (e.g. <BackgroundWorker />).
+    // WebService does not currently accept children as a prop, so we keep
+    // them as a Fragment sibling for the renderer to flatten.
+    if (children) {
+        elements.push((0, core_1.jsx)(core_1.Fragment, { children }));
+    }
+    return (0, core_1.jsx)(core_1.Fragment, { children: elements });
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.tsx"],"names":[],"mappings":";;AA6FA,kBAuFC;AApLD,oCAAsE;AACtE,+CAA+E;AAC/E,yCAAqC;AACrC,iDAA+D;AAE/D,oCAAqC;AACrC,2CAAuD;AAoCvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,SAAgB,GAAG,CAAC,KAAe;IACjC,MAAM,EACJ,IAAI,EACJ,SAAS,EAAE,aAAa,EACxB,KAAK,EACL,IAAI,GAAG,IAAI,EACX,QAAQ,GAAG,CAAC,EACZ,IAAI,EACJ,GAAG,EACH,GAAG,GAAG,EAAE,EACR,OAAO,GAAG,EAAE,EACZ,KAAK,GAAG,EAAE,EACV,SAAS,EACT,KAAK,GAAG,KAAK,EACb,GAAG,EACH,QAAQ,GACT,GAAG,KAAK,CAAA;IAET,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAA,iBAAU,EAAC,oBAAS,CAAC,CAAA;IAC9C,MAAM,SAAS,GACb,aAAa,IAAI,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAA;IAE/F,MAAM,QAAQ,GAA6B,EAAE,CAAA;IAE7C,QAAQ,CAAC,IAAI,CACX,IAAA,UAAG,EAAC,wBAAU,EAAE;QACd,IAAI;QACJ,SAAS;QACT,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,GAAG;QACH,OAAO;QACP,KAAK;QACL,SAAS;KACV,CAAC,CACH,CAAA;IAED,QAAQ,CAAC,IAAI,CACX,IAAA,UAAG,EAAC,mBAAQ,EAAE;QACZ,IAAI,EAAE,GAAG,IAAI,WAAW;QACxB,SAAS;QACT,IAAI;QACJ,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,EAAE;QACf,GAAG;QACH,GAAG;KACJ,CAAC,CACH,CAAA;IAED,cAAc;IACd,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,eAAe,GAAG,IAAA,iBAAU,EAAC,0BAAe,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAA;QAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,IAAA,sBAAe,EAAC,gBAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/D,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,IAAA,6BAAqB,EAAC;YACpB,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,QAAQ,EAAE,SAAS,EAAE;YAC9C,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC;gBACd,gBAAgB,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;gBAC/C,OAAO,EAAE;oBACP,mBAAmB,EAAE;wBACnB,IAAI,EAAE;4BACJ,WAAW,EAAE,CAAC,eAAe,CAAC;4BAC9B,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;yBAC5C;qBACF;iBACF;aACF;SACF,CAAC,CACH,CAAA;QACD,8BAA8B;QAC9B,GAAG,CAAC,SAAS,GAAG,WAAW,IAAI,UAAU,SAAS,yBAAyB,CAAA;IAC7E,CAAC;IAED,oEAAoE;IACpE,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;AAC9C,CAAC"}

package/dist/auth/components.d.ts

@@ -0,0 +1,163 @@
+/**
+ * Realm configuration for Keycloak.
+ *
+ * A realm manages a set of users, credentials, roles, and groups.
+ * Realms are isolated from one another and can only manage users
+ * that belong to them.
+ */
+export interface RealmConfig {
+    /** Realm name (e.g., 'company', 'customer') */
+    id: string;
+    /** Display name shown in login screens */
+    displayName?: string;
+    /** Whether the realm is enabled */
+    enabled?: boolean;
+    /** Identity providers for federation (e.g., EntraID, Google) */
+    identityProviders?: IdentityProviderConfig[];
+    /** Clients in this realm */
+    clients?: ClientConfig[];
+}
+export interface IdentityProviderConfig {
+    /** Provider alias (e.g., 'entra-id', 'google') */
+    alias: string;
+    /** Display name */
+    displayName: string;
+    /** Provider type (e.g., 'oidc', 'saml') */
+    providerId: string;
+    /** Whether the provider is enabled */
+    enabled?: boolean;
+    /** Trust email from this provider */
+    trustEmail?: boolean;
+    /** Provider-specific configuration */
+    config: Record<string, string>;
+}
+/**
+ * EntraID (Azure AD) identity provider configuration.
+ *
+ * @example
+ * import { Realm, EntraID } from '@r8s/recipes/auth'
+ *
+ * <Realm id="company">
+ *   <EntraID
+ *     tenantId="your-tenant-id"
+ *     clientId="your-client-id"
+ *     clientSecret="${env:ENTRA_CLIENT_SECRET}"
+ *   />
+ * </Realm>
+ */
+export interface EntraIDConfig {
+    /** Azure AD tenant ID */
+    tenantId: string;
+    /** Application (client) ID */
+    clientId: string;
+    /** Client secret (from secrets backend) */
+    clientSecret: string;
+    /** Display name (defaults to 'Entra ID') */
+    displayName?: string;
+    /** Whether the provider is enabled (defaults to true) */
+    enabled?: boolean;
+    /** Trust email from this provider (defaults to true) */
+    trustEmail?: boolean;
+}
+export interface EntraIDProps extends EntraIDConfig {
+}
+/**
+ * EntraID — Microsoft Entra ID (Azure AD) identity provider.
+ *
+ * Adds EntraID as an identity provider to the parent Realm.
+ */
+export declare function EntraID(props: EntraIDProps): import("@r8s/core").r8sElement;
+export interface GoogleConfig {
+    /** Google OAuth client ID */
+    clientId: string;
+    /** Google OAuth client secret */
+    clientSecret: string;
+    /** Display name (defaults to 'Google') */
+    displayName?: string;
+    /** Whether the provider is enabled (defaults to true) */
+    enabled?: boolean;
+    /** Trust email from this provider (defaults to true) */
+    trustEmail?: boolean;
+}
+export interface GoogleProps extends GoogleConfig {
+}
+/**
+ * Google — Google OAuth identity provider.
+ *
+ * Adds Google as an identity provider to the parent Realm.
+ */
+export declare function Google(props: GoogleProps): import("@r8s/core").r8sElement;
+export declare const RealmContext: import("../../../core/src/context").Context<RealmConfig[]>;
+export interface RealmProps extends RealmConfig {
+    /** Child components (Clients) */
+    children?: unknown;
+}
+/**
+ * Realm — a security domain in Keycloak.
+ *
+ * @example
+ * import { Realm, Clients, Client } from '@r8s/recipes'
+ *
+ * <Realm id="company" displayName="Company">
+ *   <Clients>
+ *     <Client id="api" type="bearer-only" />
+ *     <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
+ *   </Clients>
+ * </Realm>
+ */
+export declare function Realm(props: RealmProps): import("@r8s/core").r8sElement;
+export interface ClientsProps {
+    /** Child components (Client) */
+    children?: unknown;
+}
+/**
+ * Clients — container for Client components.
+ */
+export declare function Clients(props: ClientsProps): import("@r8s/core").r8sElement;
+/**
+ * Client configuration for Keycloak.
+ *
+ * Clients are applications and services that can request authentication
+ * of a user. Types:
+ * - 'public': SPA, mobile app (no secret, PKCE recommended)
+ * - 'confidential': Backend service (requires secret)
+ * - 'bearer-only': API service (only validates tokens)
+ */
+export interface ClientConfig {
+    /** Client ID */
+    id: string;
+    /** Client name */
+    name?: string;
+    /** Client type */
+    type: 'public' | 'confidential' | 'bearer-only';
+    /** Redirect URIs for the client */
+    redirectUris?: string[];
+    /** Web origins for CORS */
+    webOrigins?: string[];
+    /** Service account enabled (for confidential clients) */
+    serviceAccountsEnabled?: boolean;
+    /** Direct access grants enabled */
+    directAccessGrantsEnabled?: boolean;
+    /** Client secret (from secrets backend) */
+    secret?: string;
+}
+export interface ClientProps extends ClientConfig {
+}
+/**
+ * Client — an application that authenticates via Keycloak.
+ *
+ * @example
+ * <Client id="api" type="bearer-only" />
+ * <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
+ * <Client id="backend" type="confidential" secret="${env:BACKEND_SECRET}" />
+ */
+export declare function Client(props: ClientProps): import("@r8s/core").r8sElement;
+export interface RealmsProps {
+    /** Child components (Realm) */
+    children?: unknown;
+}
+/**
+ * Realms — container for Realm components.
+ */
+export declare function Realms(props: RealmsProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=components.d.ts.map

package/dist/auth/components.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"components.d.ts","sourceRoot":"","sources":["../../src/auth/components.tsx"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAA;IACV,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAA;IAC5C,4BAA4B;IAC5B,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;IACb,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qCAAqC;IACrC,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAA;IACpB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,YAAa,SAAQ,aAAa;CAAG;AAEtD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,kCAE1C;AAED,MAAM,WAAW,YAAY;IAC3B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,YAAY,EAAE,MAAM,CAAA;IACpB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;CAAG;AAEpD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,kCAExC;AAED,eAAO,MAAM,YAAY,4DAAmC,CAAA;AAE5D,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,iCAAiC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,UAAU,kCAkFtC;AAED,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,kCAE1C;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,gBAAgB;IAChB,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kBAAkB;IAClB,IAAI,EAAE,QAAQ,GAAG,cAAc,GAAG,aAAa,CAAA;IAC/C,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,yDAAyD;IACzD,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,mCAAmC;IACnC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;CAAG;AAEpD;;;;;;;GAOG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,kCAExC;AAED,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,kCAExC"}

package/dist/auth/components.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RealmContext = void 0;
+exports.EntraID = EntraID;
+exports.Google = Google;
+exports.Realm = Realm;
+exports.Clients = Clients;
+exports.Client = Client;
+exports.Realms = Realms;
+const core_1 = require("@r8s/core");
+const defaults_1 = require("@r8s/core/defaults");
+/**
+ * EntraID — Microsoft Entra ID (Azure AD) identity provider.
+ *
+ * Adds EntraID as an identity provider to the parent Realm.
+ */
+function EntraID(props) {
+    return (0, core_1.jsx)(core_1.Fragment, {});
+}
+/**
+ * Google — Google OAuth identity provider.
+ *
+ * Adds Google as an identity provider to the parent Realm.
+ */
+function Google(props) {
+    return (0, core_1.jsx)(core_1.Fragment, {});
+}
+exports.RealmContext = (0, defaults_1.createContext)([]);
+/**
+ * Realm — a security domain in Keycloak.
+ *
+ * @example
+ * import { Realm, Clients, Client } from '@r8s/recipes'
+ *
+ * <Realm id="company" displayName="Company">
+ *   <Clients>
+ *     <Client id="api" type="bearer-only" />
+ *     <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
+ *   </Clients>
+ * </Realm>
+ */
+function Realm(props) {
+    const { id, displayName, enabled = true, identityProviders: propIdentityProviders = [], clients: propClients = [], children, } = props;
+    // Collect clients and identity providers from children
+    const clients = [...propClients];
+    const identityProviders = [...propIdentityProviders];
+    const childArray = Array.isArray(children) ? children : [children];
+    for (const child of childArray) {
+        if (child && typeof child === 'object' && 'type' in child) {
+            // Collect Clients
+            if (child.type === Clients) {
+                const clientsProps = child.props;
+                const clientChildren = Array.isArray(clientsProps.children)
+                    ? clientsProps.children
+                    : [clientsProps.children];
+                for (const clientChild of clientChildren) {
+                    if (clientChild &&
+                        typeof clientChild === 'object' &&
+                        'type' in clientChild &&
+                        clientChild.type === Client) {
+                        clients.push(clientChild.props);
+                    }
+                }
+            }
+            // Collect EntraID
+            if (child.type === EntraID) {
+                const entraProps = child.props;
+                identityProviders.push({
+                    alias: 'entra-id',
+                    displayName: entraProps.displayName ?? 'Entra ID',
+                    providerId: 'oidc',
+                    enabled: entraProps.enabled ?? true,
+                    trustEmail: entraProps.trustEmail ?? true,
+                    config: {
+                        clientId: entraProps.clientId,
+                        clientSecret: entraProps.clientSecret,
+                        tokenUrl: `https://login.microsoftonline.com/${entraProps.tenantId}/oauth2/v2.0/token`,
+                        authorizationUrl: `https://login.microsoftonline.com/${entraProps.tenantId}/oauth2/v2.0/authorize`,
+                    },
+                });
+            }
+            // Collect Google
+            if (child.type === Google) {
+                const googleProps = child.props;
+                identityProviders.push({
+                    alias: 'google',
+                    displayName: googleProps.displayName ?? 'Google',
+                    providerId: 'oidc',
+                    enabled: googleProps.enabled ?? true,
+                    trustEmail: googleProps.trustEmail ?? true,
+                    config: {
+                        clientId: googleProps.clientId,
+                        clientSecret: googleProps.clientSecret,
+                    },
+                });
+            }
+        }
+    }
+    const realm = {
+        id,
+        displayName,
+        enabled,
+        identityProviders,
+    };
+    // Store realm with clients in context for Auth to collect
+    const existingRealms = (0, core_1.useContext)(exports.RealmContext);
+    const allRealms = [...existingRealms, { ...realm, clients }];
+    // Render children so nested components (Clients, EntraID, Google) are processed
+    return (0, core_1.jsx)(exports.RealmContext.Provider, { value: allRealms, children });
+}
+/**
+ * Clients — container for Client components.
+ */
+function Clients(props) {
+    return (0, core_1.jsx)(core_1.Fragment, { children: props.children });
+}
+/**
+ * Client — an application that authenticates via Keycloak.
+ *
+ * @example
+ * <Client id="api" type="bearer-only" />
+ * <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
+ * <Client id="backend" type="confidential" secret="${env:BACKEND_SECRET}" />
+ */
+function Client(props) {
+    return (0, core_1.jsx)(core_1.Fragment, {});
+}
+/**
+ * Realms — container for Realm components.
+ */
+function Realms(props) {
+    return (0, core_1.jsx)(core_1.Fragment, { children: props.children });
+}
+//# sourceMappingURL=components.js.map

package/dist/auth/components.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"components.js","sourceRoot":"","sources":["../../src/auth/components.tsx"],"names":[],"mappings":";;;AA0EA,0BAEC;AAsBD,wBAEC;AAsBD,sBAkFC;AAUD,0BAEC;AAwCD,wBAEC;AAUD,wBAEC;AA9QD,oCAAqD;AACrD,iDAAkD;AAoElD;;;;GAIG;AACH,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,CAAC,CAAA;AAC1B,CAAC;AAiBD;;;;GAIG;AACH,SAAgB,MAAM,CAAC,KAAkB;IACvC,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,CAAC,CAAA;AAC1B,CAAC;AAEY,QAAA,YAAY,GAAG,IAAA,wBAAa,EAAgB,EAAE,CAAC,CAAA;AAO5D;;;;;;;;;;;;GAYG;AACH,SAAgB,KAAK,CAAC,KAAiB;IACrC,MAAM,EACJ,EAAE,EACF,WAAW,EACX,OAAO,GAAG,IAAI,EACd,iBAAiB,EAAE,qBAAqB,GAAG,EAAE,EAC7C,OAAO,EAAE,WAAW,GAAG,EAAE,EACzB,QAAQ,GACT,GAAG,KAAK,CAAA;IAET,uDAAuD;IACvD,MAAM,OAAO,GAAmB,CAAC,GAAG,WAAW,CAAC,CAAA;IAChD,MAAM,iBAAiB,GAA6B,CAAC,GAAG,qBAAqB,CAAC,CAAA;IAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAElE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1D,kBAAkB;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,MAAM,YAAY,GAAI,KAAa,CAAC,KAAK,CAAA;gBACzC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC;oBACzD,CAAC,CAAC,YAAY,CAAC,QAAQ;oBACvB,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;gBAC3B,KAAK,MAAM,WAAW,IAAI,cAAc,EAAE,CAAC;oBACzC,IACE,WAAW;wBACX,OAAO,WAAW,KAAK,QAAQ;wBAC/B,MAAM,IAAI,WAAW;wBACrB,WAAW,CAAC,IAAI,KAAK,MAAM,EAC3B,CAAC;wBACD,OAAO,CAAC,IAAI,CAAE,WAAmB,CAAC,KAAK,CAAC,CAAA;oBAC1C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,kBAAkB;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,MAAM,UAAU,GAAI,KAAa,CAAC,KAAqB,CAAA;gBACvD,iBAAiB,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,UAAU;oBACjB,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,UAAU;oBACjD,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,IAAI;oBACnC,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,IAAI;oBACzC,MAAM,EAAE;wBACN,QAAQ,EAAE,UAAU,CAAC,QAAQ;wBAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;wBACrC,QAAQ,EAAE,qCAAqC,UAAU,CAAC,QAAQ,oBAAoB;wBACtF,gBAAgB,EAAE,qCAAqC,UAAU,CAAC,QAAQ,wBAAwB;qBACnG;iBACF,CAAC,CAAA;YACJ,CAAC;YACD,iBAAiB;YACjB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,WAAW,GAAI,KAAa,CAAC,KAAoB,CAAA;gBACvD,iBAAiB,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,QAAQ;oBACf,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,QAAQ;oBAChD,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,IAAI;oBACpC,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,IAAI;oBAC1C,MAAM,EAAE;wBACN,QAAQ,EAAE,WAAW,CAAC,QAAQ;wBAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;qBACvC;iBACF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAgB;QACzB,EAAE;QACF,WAAW;QACX,OAAO;QACP,iBAAiB;KAClB,CAAA;IAED,0DAA0D;IAC1D,MAAM,cAAc,GAAG,IAAA,iBAAU,EAAC,oBAAY,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,CAAC,GAAG,cAAc,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAE5D,gFAAgF;IAChF,OAAO,IAAA,UAAG,EAAC,oBAAY,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAA;AACnE,CAAC;AAOD;;GAEG;AACH,SAAgB,OAAO,CAAC,KAAmB;IACzC,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;AACpD,CAAC;AAgCD;;;;;;;GAOG;AACH,SAAgB,MAAM,CAAC,KAAkB;IACvC,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,CAAC,CAAA;AAC1B,CAAC;AAOD;;GAEG;AACH,SAAgB,MAAM,CAAC,KAAkB;IACvC,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;AACpD,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,2 @@
+export { Realm, Realms, Clients, Client, EntraID, Google, RealmContext, type RealmConfig, type ClientConfig, type IdentityProviderConfig, type EntraIDConfig, type GoogleConfig, } from './components';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,EACL,MAAM,EACN,OAAO,EACP,MAAM,EACN,OAAO,EACP,MAAM,EACN,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,14 @@
+"use strict";
+// Auth sub-components — hierarchical Keycloak configuration
+// Import from '@r8s/recipes/auth' to keep the main index clean
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RealmContext = exports.Google = exports.EntraID = exports.Client = exports.Clients = exports.Realms = exports.Realm = void 0;
+var components_1 = require("./components");
+Object.defineProperty(exports, "Realm", { enumerable: true, get: function () { return components_1.Realm; } });
+Object.defineProperty(exports, "Realms", { enumerable: true, get: function () { return components_1.Realms; } });
+Object.defineProperty(exports, "Clients", { enumerable: true, get: function () { return components_1.Clients; } });
+Object.defineProperty(exports, "Client", { enumerable: true, get: function () { return components_1.Client; } });
+Object.defineProperty(exports, "EntraID", { enumerable: true, get: function () { return components_1.EntraID; } });
+Object.defineProperty(exports, "Google", { enumerable: true, get: function () { return components_1.Google; } });
+Object.defineProperty(exports, "RealmContext", { enumerable: true, get: function () { return components_1.RealmContext; } });
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";AAAA,4DAA4D;AAC5D,+DAA+D;;;AAE/D,2CAaqB;AAZnB,mGAAA,KAAK,OAAA;AACL,oGAAA,MAAM,OAAA;AACN,qGAAA,OAAO,OAAA;AACP,oGAAA,MAAM,OAAA;AACN,qGAAA,OAAO,OAAA;AACP,oGAAA,MAAM,OAAA;AACN,0GAAA,YAAY,OAAA"}

package/dist/auth.d.ts

@@ -0,0 +1,92 @@
+import type { TLSConfig } from '@r8s/k8s-types';
+export interface AuthProps {
+    /** Resource name */
+    name: string;
+    /** Public hostname for the identity provider (e.g., 'auth.example.com') */
+    host: string;
+    /** Kubernetes namespace (defaults to 'default') */
+    namespace?: string;
+    /** Number of Keycloak replicas (defaults to 1) */
+    instances?: number;
+    /** Database storage size (defaults to '10Gi') */
+    storage?: string;
+    /** TLS certificate configuration */
+    tls?: TLSConfig;
+    /** Child components (Realms) */
+    children?: unknown;
+}
+/**
+ * Identity and access management — Keycloak with database, TLS, and routing.
+ *
+ * @title Auth
+ * @category Security & Identity
+ *
+ * Composes Keycloak (identity provider), CNPG (PostgreSQL database),
+ * cert-manager (TLS), and routing (Ingress/Gateway) into a single
+ * identity solution with good defaults.
+ *
+ * The database is auto-wired: Keycloak connects to its own PostgreSQL
+ * cluster. Credentials are managed by CNPG's bootstrap secret.
+ *
+ * @example
+ * // Simple Keycloak instance
+ * import { Auth } from '@r8s/recipes'
+ *
+ * export default <Auth name="auth" host="auth.example.com" />
+ *
+ * @example
+ * // Keycloak with custom storage and TLS
+ * import { Auth } from '@r8s/recipes'
+ *
+ * export default (
+ *   <Auth
+ *     name="auth"
+ *     host="auth.example.com"
+ *     instances={2}
+ *     storage="20Gi"
+ *     tls={{ secretName: 'auth-tls', clusterIssuer: 'letsencrypt-prod' }}
+ *   />
+ * )
+ *
+ * @example
+ * // Keycloak with realms and clients
+ * import { Auth } from '@r8s/recipes'
+ * import { Realms, Realm, Clients, Client } from '@r8s/recipes/auth'
+ *
+ * export default (
+ *   <Auth name="auth" host="auth.example.com">
+ *     <Realms>
+ *       <Realm id="company" displayName="Company">
+ *         <Clients>
+ *           <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
+ *           <Client id="api" type="bearer-only" />
+ *         </Clients>
+ *       </Realm>
+ *     </Realms>
+ *   </Auth>
+ * )
+ *
+ * @example
+ * // Keycloak with EntraID federation
+ * import { Auth } from '@r8s/recipes'
+ * import { Realms, Realm, Clients, Client, EntraID } from '@r8s/recipes/auth'
+ *
+ * export default (
+ *   <Auth name="auth" host="auth.example.com">
+ *     <Realms>
+ *       <Realm id="company" displayName="Company">
+ *         <EntraID
+ *           tenantId="your-tenant-id"
+ *           clientId="your-client-id"
+ *           clientSecret="${env:ENTRA_CLIENT_SECRET}"
+ *         />
+ *         <Clients>
+ *           <Client id="web" type="public" redirectUris={['https://app.example.com/*']} />
+ *         </Clients>
+ *       </Realm>
+ *     </Realms>
+ *   </Auth>
+ * )
+ */
+export declare function Auth(props: AuthProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAa/C,MAAM,WAAW,SAAS;IACxB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oCAAoC;IACpC,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,gCAAgC;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,IAAI,CAAC,KAAK,EAAE,SAAS,kCAmHpC"}