@simitgroup/simpleapp-generator 2.0.2-t-alpha → 2.0.2-v-alpha

package/ReleaseNote.md

@@ -1,3 +1,14 @@
+[2.0.2v-alpha]
+
+1. Stability on startup: app initialization no longer fatals on 401/302 from profile/session checks. it triggers the normal relogin flow
+3. Navigate to /login when XHR requests are transparently redirected, preventing retry loops
+
+[2.0.2u-alpha]
+
+1. Enforced strict Keycloak token validation on backend (via AuthGuard + UserContext), returning clear 401 for invalid/expired tokens
+2. Blocked user creation when required JWT claims are missing (e.g. uid, email)
+3. Improved frontend session handling: refresh-token failures and consistently redirect to login on 401
+
 [2.0.2t-alpha]
 
 1. Fix define type on service file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simitgroup/simpleapp-generator",
-  "version": "2.0.2t-alpha",
+  "version": "2.0.2v-alpha",
   "description": "frontend nuxtjs and backend nests code generator using jsonschema.",
   "main": "dist/index.js",
   "scripts": {

package/templates/nest/src/simple-app/_core/features/auth/keycloak/keycloak.guard.ts.eta

@@ -6,22 +6,26 @@
  */
 import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
-import { ResourceGuard } from 'nest-keycloak-connect';
+import { AuthGuard, ResourceGuard } from 'nest-keycloak-connect';
+import type { Request } from 'express';
 
 @Injectable()
 export class CustomKeycloakGuard implements CanActivate {
   constructor(
     private reflector: Reflector,
+    private authGuard: AuthGuard,
     private resourceGuard: ResourceGuard,
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
-    const request = context.switchToHttp().getRequest();
+    const request = context.switchToHttp().getRequest<Request>();
 
     //graphql no http request, exclude from capability of x-apikey
     if (request?.headers) {
-      const apiKey = request.headers['x-apikey'];
-      const apiSecret = request.headers['x-apisecret'];
+      const apiKeyHeader = request.headers['x-apikey'];
+      const apiSecretHeader = request.headers['x-apisecret'];
+      const apiKey = Array.isArray(apiKeyHeader) ? apiKeyHeader[0] : apiKeyHeader;
+      const apiSecret = Array.isArray(apiSecretHeader) ? apiSecretHeader[0] : apiSecretHeader;
       // validate apikey and apisecret at middleware level, reach here mean approved as robot
       if (apiKey && apiSecret) {
         return true;
@@ -30,8 +34,15 @@ export class CustomKeycloakGuard implements CanActivate {
 
     // If API key is not present, fall back to Keycloak authentication
     try {
-      const canActivate = await this.resourceGuard.canActivate(context);
-      return canActivate;
+      // validate and authenticate the token with keycloak
+      const authCanActivate = await this.authGuard.canActivate(context);
+      if (!authCanActivate) {
+        throw new UnauthorizedException('Invalid Keycloak token');
+      }
+
+      // then enforce resource and role based access control
+      const resourceCanActivate = await this.resourceGuard.canActivate(context);
+      return resourceCanActivate;
     } catch (error) {
       throw new UnauthorizedException('Invalid API key or Keycloak token');
     }

package/templates/nuxt/plugins/10.simpleapp-event.ts.eta

@@ -34,7 +34,9 @@ export default defineNuxtPlugin( async(nuxtApp) => {
         // console.log("error catch",error)
 
         if(error?.code && error.code == 'ERR_BAD_REQUEST'){
-          if(error.response && error.response.status==403){
+          if (error.response && (error.response.status == 401 || error.response.status == 302)) {
+            return Promise.reject(error);
+          } else if(error.response && error.response.status==403){
             console.warn("error status 403, redirect to external link /" )
             navigateTo('/',{external:true})
           }else{
@@ -74,7 +76,7 @@ export default defineNuxtPlugin( async(nuxtApp) => {
             fatal:true
           })           
         }
-        else if(error.response && error.response.status==302){        
+        else if(error.response && (error.response.status==302 || error.response.status==401)){        
           console.error("axios 302 session expired, start login flow")
         }else if(error.response && error.response.status){
           let errmsg = error.response.message

package/templates/nuxt/plugins/20.simpleapp-userstore.ts.eta

@@ -357,7 +357,7 @@ export default defineNuxtPlugin(async (nuxtApp) => {
         statusMessage: e.message,
         fatal: true,
       });
-    } else if (e?.response?.status == 302) {
+    } else if (e?.response?.status == 302 || e?.response?.status == 401) {
       //no session
       //need authentication, relogin
       if (useRoute().meta.auth !== false) {

package/templates/nuxt/server/api/auth/[...].ts.eta

@@ -107,6 +107,7 @@ export default NuxtAuthHandler({
                 return {
                     ...token,
                     accessToken: null,
+                    refreshToken: null,
                     expiresAt: 0,
                     error: "RefreshAccessTokenError"
                   };
@@ -126,6 +127,13 @@ export default NuxtAuthHandler({
             // console.log("session", session);
             // Send properties to the client, like an access_token from a provider.
             const sessiondata:any = {...session}
+
+            if (!token.accessToken || token['error'] === 'RefreshAccessTokenError') {
+                sessiondata.accessToken = null;
+                sessiondata.error = token['error'] ?? 'MissingAccessToken';
+                return sessiondata;
+            }
+
             sessiondata.accessToken = <string>token.accessToken;
             return sessiondata;
         },

package/templates/nuxt/server/api/profile/[...].ts.eta

@@ -6,6 +6,7 @@
  */
  
 import axios from 'axios';
+import fs from "node:fs";
 import { getServerSession } from '#auth'
 import type { Session } from 'next-auth';
 import { pathJoin } from '~/server/utils/path';
@@ -22,7 +23,7 @@ export default defineEventHandler(async (event:any) => {
         return sendRedirect(event, '/login', 401)
     }
     if(!session) {
-        throw createError({ statusText: 'Unauthorized', status: 302 })
+        return sendRedirect(event, "/login", 302);
      }
     return new Promise<any>(async (resolve, reject) => {
         
@@ -33,6 +34,10 @@ export default defineEventHandler(async (event:any) => {
 
         const req = event.node.req;
 
+        if (!accessToken || typeof accessToken !== "string") {
+            return sendRedirect(event, "/login", 302);
+        }
+
         if(req.method == 'POST' || req.method == 'PUT'  || req.method == 'PATCH') {
 
             forwardData = await readBody(event);
@@ -135,7 +140,9 @@ export default defineEventHandler(async (event:any) => {
             }else{
 
                 if (error.response?.status && error.response.status == 401) {
-                    return sendRedirect(event, '/login', 401)
+                    // rejecting would bubble a 401 into the client and often renders the Nuxt error page.
+                    // Instead, end the request with a redirect so the browser can enter the login flow.
+                    return sendRedirect(event, "/login", 401);
                 }
                 reject({ 
                     statusMessage: error.response.statusText, 

package/templates/nuxt/server/api/profile/index.ts.eta

@@ -16,15 +16,13 @@ export default defineEventHandler(async (event:any) => {
     
     try {
         session = await getServerSession(event)
-        
     } catch (error) {
-        return sendRedirect(event, '/login', 401)
+        return sendRedirect(event, '/login', 302)
     }
 
     return new Promise<any>(async (resolve, reject) => {
         if(!session) {
-            reject({ statusMessage: 'Unauthorized', statusCode: 401 });
-            throw createError({ statusMessage: 'Unauthorized', statusCode: 401 })
+            return sendRedirect(event, '/login', 302)
         }
         const seperateSymbol = '.';
         const accessToken = session?.accessToken;
@@ -33,6 +31,10 @@ export default defineEventHandler(async (event:any) => {
 
         const req = event.node.req;
 
+        if (!accessToken || typeof accessToken !== 'string') {
+            return sendRedirect(event, '/login', 302);
+        }
+
         if(req.method == 'POST' || req.method == 'PUT'  || req.method == 'PATCH') {
 
             forwardData = await readBody(event);
@@ -78,16 +80,13 @@ export default defineEventHandler(async (event:any) => {
             // console.log('#####################################')
             // console.log(axiosConfig);
             // console.log('#####################################')
-            if (error.response?.status && error.response.status == '401') {
-                //return reject({ statusMessage: 'Unauthorized', statusCode: 401 });
-                return sendRedirect(event, '/login', 401)
-                // throw createError({ statusMessage: 'Unauthorized', statusCode: 401 })
+            if (error.response?.status && error.response.status == 401) {
+                return sendRedirect(event, '/login', 302)
             }
 
-            // reject(error.data)
-            reject({ 
-                statusMessage: error.response.statusText, 
-                statusCode: error.response.status ,
+            reject({
+                statusMessage: error.response.statusText,
+                statusCode: error.response.status,
                 data: error.response.data
             });            // resolve({ status: 'ok' })
             // throw createError({ statusMessage: 'Bad Requests', statusCode: 404 })