@simple-auth-kit/cli 1.0.0

package/registry/mobile-apps/expo/variants/workspaces/src/store/workspaceStore.ts

@@ -0,0 +1,90 @@
+import { create } from "zustand";
+import { AuthApiError, type WorkspaceSummary } from "@simple-auth-kit/auth-client";
+import { authClient } from "../api/authClient";
+import { setActiveWorkspaceId, useActiveWorkspaceId } from "../workspace/activeWorkspace";
+
+/**
+ * The workspaces the signed-in user belongs to, and the operations that change which one is
+ * active. The *id* of the active workspace lives one layer down in
+ * `src/workspace/activeWorkspace.ts` so that `authClient` can read it without importing this
+ * store (which imports `authClient`).
+ *
+ * Deliberately does not touch `authStore`: selecting a workspace changes the roles and
+ * permissions `/auth/me` answers with, and the screen that selects is the one that re-fetches
+ * them. That keeps the two stores acyclic and the refresh visible at the call site.
+ */
+interface WorkspaceState {
+  workspaces: WorkspaceSummary[];
+  /** True while the list is being (re)fetched. */
+  isLoading: boolean;
+  /** True while creating a workspace. */
+  isSubmitting: boolean;
+  error: string | null;
+
+  /** Fetches `GET /workspaces` — not workspace-scoped, so it works before any workspace is chosen. */
+  load: () => Promise<WorkspaceSummary[]>;
+  /** Makes `workspaceId` the workspace every scoped call acts in, and persists that choice. */
+  select: (workspaceId: string) => Promise<void>;
+  /** Creates a workspace (the creator becomes its admin) and makes it active. */
+  create: (name: string) => Promise<WorkspaceSummary>;
+  /** Wipes list and active workspace — used on logout so the next user starts clean. */
+  reset: () => Promise<void>;
+  clearError: () => void;
+}
+
+function messageFor(err: unknown): string {
+  if (err instanceof AuthApiError) return err.message;
+  if (err instanceof Error) return err.message;
+  return "Something went wrong. Please try again.";
+}
+
+export const useWorkspaceStore = create<WorkspaceState>((set) => ({
+  workspaces: [],
+  isLoading: false,
+  isSubmitting: false,
+  error: null,
+
+  load: async () => {
+    set({ isLoading: true, error: null });
+    try {
+      const workspaces = await authClient.listWorkspaces();
+      set({ workspaces, isLoading: false });
+      return workspaces;
+    } catch (err) {
+      set({ isLoading: false, error: messageFor(err) });
+      throw err;
+    }
+  },
+
+  select: async (workspaceId) => {
+    await setActiveWorkspaceId(workspaceId);
+    set({ error: null });
+  },
+
+  create: async (name) => {
+    set({ isSubmitting: true, error: null });
+    try {
+      const workspace = await authClient.createWorkspace(name);
+      await setActiveWorkspaceId(workspace.id);
+      set((state) => ({ workspaces: [...state.workspaces, workspace], isSubmitting: false }));
+      return workspace;
+    } catch (err) {
+      set({ isSubmitting: false, error: messageFor(err) });
+      throw err;
+    }
+  },
+
+  reset: async () => {
+    await setActiveWorkspaceId(null);
+    set({ workspaces: [], isLoading: false, isSubmitting: false, error: null });
+  },
+
+  clearError: () => set({ error: null }),
+}));
+
+/** The active workspace as a full summary, or `null` while none is chosen (or not yet listed). */
+export const useActiveWorkspace = (): WorkspaceSummary | null => {
+  const activeWorkspaceId = useActiveWorkspaceId();
+  const workspaces = useWorkspaceStore((state) => state.workspaces);
+  return workspaces.find((workspace) => workspace.id === activeWorkspaceId) ?? null;
+};

package/registry/mobile-apps/expo/variants/workspaces/src/workspace/activeWorkspace.ts

@@ -0,0 +1,55 @@
+import AsyncStorage from "@react-native-async-storage/async-storage";
+import { create } from "zustand";
+import type { WorkspaceIdResolver } from "@simple-auth-kit/auth-client";
+
+/**
+ * The single source of truth for "which workspace am I acting in", and the app side of
+ * `AuthClient`'s `WorkspaceIdResolver` seam — the same injected-dependency shape as
+ * `TokenStorage`. The client never owns this; it asks.
+ *
+ * Deliberately dependency-free: `src/api/authClient.ts` imports this module, so this module
+ * must never import the client back. Anything that needs both (listing workspaces, creating
+ * one) lives in `src/store/workspaceStore.ts`, one layer up.
+ *
+ * Persisted to AsyncStorage so a relaunch lands back in the workspace you were last in.
+ * Unencrypted, for the same reason the tokens are — see `asyncStorageTokenStorage`.
+ */
+const STORAGE_KEY = "simple-auth-kit/active-workspace";
+
+interface ActiveWorkspaceState {
+  workspaceId: string | null;
+  /** False until `hydrateActiveWorkspace()` has read AsyncStorage — read before trusting `workspaceId === null`. */
+  isHydrated: boolean;
+}
+
+export const useActiveWorkspaceStore = create<ActiveWorkspaceState>(() => ({
+  workspaceId: null,
+  isHydrated: false,
+}));
+
+/** Call once, before the first workspace-scoped request, so it can carry the persisted workspace. */
+export async function hydrateActiveWorkspace(): Promise<string | null> {
+  const stored = await AsyncStorage.getItem(STORAGE_KEY);
+  const workspaceId = stored && stored.length > 0 ? stored : null;
+  useActiveWorkspaceStore.setState({ workspaceId, isHydrated: true });
+  return workspaceId;
+}
+
+/** `null` goes back to sending no `X-Workspace-Id` at all — which is what logging out does. */
+export async function setActiveWorkspaceId(workspaceId: string | null): Promise<void> {
+  useActiveWorkspaceStore.setState({ workspaceId, isHydrated: true });
+  if (workspaceId === null) await AsyncStorage.removeItem(STORAGE_KEY);
+  else await AsyncStorage.setItem(STORAGE_KEY, workspaceId);
+}
+
+export function getActiveWorkspaceId(): string | null {
+  return useActiveWorkspaceStore.getState().workspaceId;
+}
+
+/**
+ * Handed to `new AuthClient({ workspaceId })`. Resolved per request, so a workspace switch
+ * takes effect on the very next scoped call without rebuilding the client.
+ */
+export const activeWorkspaceIdResolver: WorkspaceIdResolver = () => getActiveWorkspaceId();
+
+export const useActiveWorkspaceId = (): string | null => useActiveWorkspaceStore((state) => state.workspaceId);

package/registry.json

@@ -0,0 +1,263 @@
+{
+  "core": {
+    "dir": "core",
+    "peerDependencies": [
+      "argon2",
+      "jose"
+    ]
+  },
+  "variants": {
+    "base": {
+      "flag": null,
+      "description": "Roles and permissions are global to the deployment. The default."
+    },
+    "workspaces": {
+      "flag": "--workspaces",
+      "description": "Users belong to workspaces and hold different roles in each. Workspace-scoped requests carry an X-Workspace-Id header."
+    }
+  },
+  "combos": {
+    "nestjs-prisma": {
+      "dir": "combos/nestjs-prisma",
+      "sharedDir": "shared",
+      "variantsDir": "variants",
+      "variants": [
+        "base",
+        "workspaces"
+      ],
+      "peerDependencies": [
+        "@nestjs/common",
+        "@nestjs/core",
+        "@nestjs/platform-express",
+        "@nestjs/swagger",
+        "@nestjs/throttler",
+        "reflect-metadata",
+        "rxjs",
+        "express",
+        "@prisma/client",
+        "@prisma/adapter-pg",
+        "prisma",
+        "@casl/ability"
+      ],
+      "postInstall": [
+        "Set DATABASE_URL in .env (see .env.example)",
+        "Set AUTH_JWT_SECRET in .env — a base64-encoded 256-bit (or longer) secret, e.g.: openssl rand -base64 32. The app refuses to start without it; there is no default and nothing is generated for you. Changing it invalidates every outstanding token.",
+        "Run: npx prisma generate",
+        "Run: npx prisma migrate deploy",
+        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/src/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
+        "Optional: set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD before seeding to also create an initial admin user. Without them the seeder skips the admin rather than inventing a password.",
+        "Import AuthModule.forRoot({...}) into your root app module",
+        "Optional: wire SwaggerModule.setup('docs', app, document) in your main.ts to serve the OpenAPI spec this combo's controller is already decorated for — see examples/nestjs-prisma-app/src/main.ts for a working example"
+      ],
+      "variantPostInstall": {
+        "workspaces": [
+          "Workspace-scoped requests must send an X-Workspace-Id header — see WorkspaceController and authz.guard.ts",
+          "A user has no roles until they belong to a workspace: POST /workspaces makes the caller its first admin",
+          "Roles are scoped to a workspace here, so the seeder also creates the first one — set SEED_WORKSPACE_NAME to name it (defaults to \"Default workspace\")"
+        ]
+      }
+    },
+    "nestjs-drizzle": {
+      "dir": "combos/nestjs-drizzle",
+      "sharedDir": "shared",
+      "variantsDir": "variants",
+      "variants": [
+        "base",
+        "workspaces"
+      ],
+      "peerDependencies": [
+        "@nestjs/common",
+        "@nestjs/core",
+        "@nestjs/platform-express",
+        "@nestjs/swagger",
+        "reflect-metadata",
+        "rxjs",
+        "express",
+        "drizzle-orm",
+        "pg",
+        "drizzle-kit",
+        "@casl/ability"
+      ],
+      "postInstall": [
+        "Set DATABASE_URL in .env (see .env.example)",
+        "Set AUTH_JWT_SECRET in .env — a base64-encoded 256-bit (or longer) secret, e.g.: openssl rand -base64 32. The app refuses to start without it; there is no default and nothing is generated for you. Changing it invalidates every outstanding token.",
+        "Run: npx drizzle-kit migrate — drizzle.config.ts installs at the project root, alongside drizzle/, so no cd is needed",
+        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/src/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
+        "Optional: set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD before seeding to also create an initial admin user. Without them the seeder skips the admin rather than inventing a password.",
+        "Import AuthModule.forRoot({...}) into your root app module",
+        "Optional: wire SwaggerModule.setup('docs', app, document) in your main.ts to serve the OpenAPI spec this combo's controller is already decorated for — see examples/nestjs-drizzle-app/src/main.ts for a working example"
+      ],
+      "variantPostInstall": {
+        "workspaces": [
+          "Workspace-scoped requests must send an X-Workspace-Id header — see WorkspaceController and authz.guard.ts",
+          "A user has no roles until they belong to a workspace: POST /workspaces makes the caller its first admin",
+          "Roles are scoped to a workspace here, so the seeder also creates the first one — set SEED_WORKSPACE_NAME to name it (defaults to \"Default workspace\")"
+        ]
+      }
+    },
+    "express-prisma": {
+      "dir": "combos/express-prisma",
+      "sharedDir": "shared",
+      "variantsDir": "variants",
+      "variants": [
+        "base",
+        "workspaces"
+      ],
+      "peerDependencies": [
+        "express",
+        "@prisma/client",
+        "@prisma/adapter-pg",
+        "prisma",
+        "swagger-ui-express",
+        "@casl/ability"
+      ],
+      "postInstall": [
+        "Set DATABASE_URL in .env (see .env.example)",
+        "Set AUTH_JWT_SECRET in .env — a base64-encoded 256-bit (or longer) secret, e.g.: openssl rand -base64 32. The app refuses to start without it; there is no default and nothing is generated for you. Changing it invalidates every outstanding token.",
+        "Run: npx prisma generate",
+        "Run: npx prisma migrate deploy",
+        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/src/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
+        "Optional: set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD before seeding to also create an initial admin user. Without them the seeder skips the admin rather than inventing a password.",
+        "Call createAuthApp({...}) and mount or listen on the Express app it returns",
+        "The OpenAPI spec this combo hand-authors is already served at /docs and /docs-json — see examples/express-prisma-app/src/main.ts for a working example"
+      ],
+      "variantPostInstall": {
+        "workspaces": [
+          "Workspace-scoped requests must send an X-Workspace-Id header — see workspace.router.ts and authz.middleware.ts",
+          "A user has no roles until they belong to a workspace: POST /workspaces makes the caller its first admin",
+          "Roles are scoped to a workspace here, so the seeder also creates the first one — set SEED_WORKSPACE_NAME to name it (defaults to \"Default workspace\")"
+        ]
+      }
+    },
+    "express-drizzle": {
+      "dir": "combos/express-drizzle",
+      "sharedDir": "shared",
+      "variantsDir": "variants",
+      "variants": [
+        "base",
+        "workspaces"
+      ],
+      "peerDependencies": [
+        "express",
+        "drizzle-orm",
+        "pg",
+        "drizzle-kit",
+        "swagger-ui-express",
+        "@casl/ability"
+      ],
+      "postInstall": [
+        "Set DATABASE_URL in .env (see .env.example)",
+        "Set AUTH_JWT_SECRET in .env — a base64-encoded 256-bit (or longer) secret, e.g.: openssl rand -base64 32. The app refuses to start without it; there is no default and nothing is generated for you. Changing it invalidates every outstanding token.",
+        "Run: npx drizzle-kit migrate — drizzle.config.ts installs at the project root, alongside drizzle/, so no cd is needed",
+        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/src/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
+        "Optional: set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD before seeding to also create an initial admin user. Without them the seeder skips the admin rather than inventing a password.",
+        "Call createAuthApp({...}) and mount or listen on the Express app it returns",
+        "The OpenAPI spec this combo hand-authors is already served at /docs and /docs-json — see examples/express-drizzle-app/src/main.ts for a working example"
+      ],
+      "variantPostInstall": {
+        "workspaces": [
+          "Workspace-scoped requests must send an X-Workspace-Id header — see workspace.router.ts and authz.middleware.ts",
+          "A user has no roles until they belong to a workspace: POST /workspaces makes the caller its first admin",
+          "Roles are scoped to a workspace here, so the seeder also creates the first one — set SEED_WORKSPACE_NAME to name it (defaults to \"Default workspace\")"
+        ]
+      }
+    },
+    "admin-react": {
+      "dir": "admin-apps/react",
+      "sharedDir": "shared",
+      "variantsDir": "variants",
+      "variants": [
+        "base",
+        "workspaces"
+      ],
+      "kind": "admin",
+      "installMode": "scaffold",
+      "peerDependencies": [],
+      "postInstall": [
+        "Copy .env.example to .env and set VITE_AUTH_API_URL to your running simple-auth-kit backend's URL",
+        "Run: npm install (or pnpm install) in the generated directory",
+        "Run: npm run dev — starts the Vite dev server"
+      ],
+      "variantPostInstall": {
+        "workspaces": [
+          "Pair with a workspaces-variant backend (e.g. nestjs-prisma --workspaces) — this console sends X-Workspace-Id on every workspace-scoped request"
+        ]
+      }
+    },
+    "mobile-expo": {
+      "dir": "mobile-apps/expo",
+      "sharedDir": "shared",
+      "variantsDir": "variants",
+      "variants": [
+        "base",
+        "workspaces"
+      ],
+      "kind": "mobile",
+      "installMode": "scaffold",
+      "peerDependencies": [],
+      "postInstall": [
+        "Run: npm install (or pnpm install) in the generated directory",
+        "Set EXPO_PUBLIC_API_BASE_URL if your backend isn't at http://localhost:3001 — on an Android emulator that's http://10.0.2.2:3001, not localhost",
+        "Run: npm start — opens the Expo dev tools (android/ios/web from there)"
+      ],
+      "variantPostInstall": {
+        "workspaces": [
+          "Pair with a workspaces-variant backend (e.g. nestjs-prisma --workspaces) — this app sends X-Workspace-Id on every workspace-scoped request, and gates on selecting/creating a workspace before showing the main app"
+        ]
+      }
+    },
+    "mobile-bare-rn": {
+      "dir": "mobile-apps/bare-rn",
+      "sharedDir": "shared",
+      "variantsDir": "variants",
+      "variants": [
+        "base",
+        "workspaces"
+      ],
+      "kind": "mobile",
+      "installMode": "scaffold",
+      "nativeIdentity": {
+        "name": "MobileBareRn",
+        "package": "com.mobilebarern"
+      },
+      "peerDependencies": [],
+      "postInstall": [
+        "Run: npm install (or pnpm install) in the generated directory",
+        "iOS only: run pod install inside ios/ before the first build",
+        "Set the backend URL your platform actually needs — see src/api/authClient.ts (Android emulator: 10.0.2.2, not localhost)",
+        "Run: npm run android (or npm run ios) — the Android applicationId / iOS bundle id were re-templated from --name so multiple generated apps don't collide"
+      ],
+      "variantPostInstall": {
+        "workspaces": [
+          "Pair with a workspaces-variant backend (e.g. nestjs-prisma --workspaces) — this app sends X-Workspace-Id on every workspace-scoped request, and gates on selecting/creating a workspace before showing the main app"
+        ]
+      }
+    },
+    "admin-nextjs": {
+      "dir": "admin-apps/nextjs",
+      "sharedDir": "shared",
+      "variantsDir": "variants",
+      "variants": [
+        "base",
+        "workspaces"
+      ],
+      "kind": "admin",
+      "installMode": "scaffold",
+      "peerDependencies": [],
+      "postInstall": [
+        "Copy .env.example to .env and set NEXT_PUBLIC_AUTH_API_URL to your running simple-auth-kit backend's URL",
+        "Run: npm install (or pnpm install) in the generated directory",
+        "Run: npm run dev — starts the Next.js dev server on port 3000",
+        "Note: base and workspaces variants deliberately use different route-guarding trust models — base uses NextAuth edge middleware (src/proxy.ts), workspaces uses a client-side session recheck on every navigation. Both are correct for their own architecture; see registry/admin-apps/README.md for why they aren't unified."
+      ],
+      "variantPostInstall": {
+        "base": [
+          "Also set AUTH_SECRET in .env — the NextAuth v5 session-JWT signing secret. Generate one with: npx auth secret (or: openssl rand -base64 32)"
+        ],
+        "workspaces": [
+          "Pair with a workspaces-variant backend (e.g. nestjs-prisma --workspaces) — this console sends X-Workspace-Id on every workspace-scoped request"
+        ]
+      }
+    }
+  }
+}