@simple-auth-kit/cli 1.0.0

package/registry/admin-apps/nextjs/variants/base/src/components/ui/toggle-group.tsx

@@ -0,0 +1,83 @@
+"use client";
+
+import * as React from "react";
+import { ToggleGroup as ToggleGroupPrimitive } from "radix-ui";
+import { type VariantProps } from "class-variance-authority";
+
+import { cn } from "@/lib/utils";
+import { toggleVariants } from "@/components/ui/toggle";
+
+const ToggleGroupContext = React.createContext<
+	VariantProps<typeof toggleVariants> & {
+		spacing?: number;
+	}
+>({
+	size: "default",
+	variant: "default",
+	spacing: 0,
+});
+
+function ToggleGroup({
+	className,
+	variant,
+	size,
+	spacing = 0,
+	children,
+	...props
+}: React.ComponentProps<typeof ToggleGroupPrimitive.Root> &
+	VariantProps<typeof toggleVariants> & {
+		spacing?: number;
+	}) {
+	return (
+		<ToggleGroupPrimitive.Root
+			data-slot="toggle-group"
+			data-variant={variant}
+			data-size={size}
+			data-spacing={spacing}
+			style={{ "--gap": spacing } as React.CSSProperties}
+			className={cn(
+				"group/toggle-group flex w-fit items-center gap-[--spacing(var(--gap))] rounded-md data-[spacing=default]:data-[variant=outline]:shadow-xs",
+				className,
+			)}
+			{...props}
+		>
+			<ToggleGroupContext.Provider value={{ variant, size, spacing }}>
+				{children}
+			</ToggleGroupContext.Provider>
+		</ToggleGroupPrimitive.Root>
+	);
+}
+
+function ToggleGroupItem({
+	className,
+	children,
+	variant,
+	size,
+	...props
+}: React.ComponentProps<typeof ToggleGroupPrimitive.Item> &
+	VariantProps<typeof toggleVariants>) {
+	const context = React.useContext(ToggleGroupContext);
+
+	return (
+		<ToggleGroupPrimitive.Item
+			data-slot="toggle-group-item"
+			data-variant={context.variant || variant}
+			data-size={context.size || size}
+			data-spacing={context.spacing}
+			className={cn(
+				toggleVariants({
+					variant: context.variant || variant,
+					size: context.size || size,
+				}),
+				"w-auto min-w-0 shrink-0 px-3 focus:z-10 focus-visible:z-10",
+				"data-[spacing=0]:rounded-none data-[spacing=0]:shadow-none data-[spacing=0]:first:rounded-l-md data-[spacing=0]:last:rounded-r-md data-[spacing=0]:data-[variant=outline]:border-l-0 data-[spacing=0]:data-[variant=outline]:first:border-l",
+				className,
+			)}
+			{...props}
+		>
+			{children}
+		</ToggleGroupPrimitive.Item>
+	);
+}
+
+export { ToggleGroup, ToggleGroupItem };

package/registry/admin-apps/nextjs/variants/base/src/components/ui/toggle.tsx

@@ -0,0 +1,47 @@
+"use client";
+
+import * as React from "react";
+import { Toggle as TogglePrimitive } from "radix-ui";
+import { cva, type VariantProps } from "class-variance-authority";
+
+import { cn } from "@/lib/utils";
+
+const toggleVariants = cva(
+	"inline-flex items-center justify-center gap-2 rounded-md text-sm font-medium hover:bg-muted hover:text-muted-foreground disabled:pointer-events-none disabled:opacity-50 data-[state=on]:bg-accent data-[state=on]:text-accent-foreground [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 [&_svg]:shrink-0 focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] outline-none transition-[color,box-shadow] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive whitespace-nowrap",
+	{
+		variants: {
+			variant: {
+				default: "bg-transparent",
+				outline:
+					"border border-input bg-transparent shadow-xs hover:bg-accent hover:text-accent-foreground",
+			},
+			size: {
+				default: "h-9 px-2 min-w-9",
+				sm: "h-8 px-1.5 min-w-8",
+				lg: "h-10 px-2.5 min-w-10",
+			},
+		},
+		defaultVariants: {
+			variant: "default",
+			size: "default",
+		},
+	},
+);
+
+function Toggle({
+	className,
+	variant,
+	size,
+	...props
+}: React.ComponentProps<typeof TogglePrimitive.Root> &
+	VariantProps<typeof toggleVariants>) {
+	return (
+		<TogglePrimitive.Root
+			data-slot="toggle"
+			className={cn(toggleVariants({ variant, size, className }))}
+			{...props}
+		/>
+	);
+}
+
+export { Toggle, toggleVariants };

package/registry/admin-apps/nextjs/variants/base/src/components/user-menu.tsx

@@ -0,0 +1,61 @@
+"use client";
+
+import { observer } from "mobx-react-lite";
+import { useRouter } from "next/navigation";
+import { KeyRoundIcon, LogOutIcon, UserIcon } from "lucide-react";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { DropdownMenu, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuSeparator, DropdownMenuTrigger } from "@/components/ui/dropdown-menu";
+import { useAuthStore } from "@/lib/stores/store-context";
+
+function initialsOf(label: string): string {
+  return (
+    label
+      .split(/[@.\s]+/)
+      .filter(Boolean)
+      .slice(0, 2)
+      .map((part) => part[0]?.toUpperCase())
+      .join("") || "?"
+  );
+}
+
+/** Top-right profile dropdown, alongside `NavUser` in the sidebar footer — the reference app's `Header`/`UserMenu` puts this in the top bar, not just the sidebar. */
+export const UserMenu = observer(function UserMenu() {
+  const store = useAuthStore();
+  const router = useRouter();
+
+  const label = store.currentUser?.displayName || store.currentUser?.email || store.currentUser?.sub || "Account";
+  const photo = store.currentUser?.photo ?? null;
+
+  async function handleLogOut() {
+    await store.logout();
+    router.push("/login");
+  }
+
+  return (
+    <DropdownMenu modal={false}>
+      <DropdownMenuTrigger asChild>
+        <Avatar className="size-8 cursor-pointer">
+          {photo && <AvatarImage src={photo} alt="" className="object-cover" />}
+          <AvatarFallback>{initialsOf(label)}</AvatarFallback>
+        </Avatar>
+      </DropdownMenuTrigger>
+      <DropdownMenuContent align="end" className="w-56">
+        <DropdownMenuGroup>
+          <DropdownMenuItem onClick={() => router.push("/account")}>
+            <UserIcon />
+            Profile
+          </DropdownMenuItem>
+          <DropdownMenuItem onClick={() => router.push("/account/change-password")}>
+            <KeyRoundIcon />
+            Change password
+          </DropdownMenuItem>
+        </DropdownMenuGroup>
+        <DropdownMenuSeparator />
+        <DropdownMenuItem variant="destructive" onClick={() => void handleLogOut()}>
+          <LogOutIcon />
+          Log out
+        </DropdownMenuItem>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  );
+});

package/registry/admin-apps/nextjs/variants/base/src/lib/ability.ts

@@ -0,0 +1,90 @@
+import { Ability, AbilityBuilder } from "@casl/ability";
+import type { CurrentUser } from "@simple-auth-kit/auth-client";
+
+/**
+ * The one place the console decides what the signed-in user may do. Every screen asks this
+ * module and nothing else — no page reads `currentUser.permissions` (or `roles`) directly — so
+ * there is a single seam to move when the backend changes how it reports authority.
+ *
+ * ── When `/auth/me` grows `rules` ──────────────────────────────────────────────────────────
+ * The backend is about to serialize the caller's real CASL rules with `packRules` from
+ * `@casl/ability/extra` and return them as `CurrentUser.rules`. When that lands, the switch is
+ * this file alone:
+ *
+ *   import { unpackRules } from "@casl/ability/extra";
+ *   export function buildAbility(user: CurrentUser | null): AppAbility {
+ *     return new Ability(user ? unpackRules(user.rules) : []);
+ *   }
+ *
+ * `hasPermission` and every call site below it keep working unchanged, because they already
+ * phrase the question as "can I do this", not "is this string in that array". Until the field
+ * exists we build the same shape of ability out of `permissions`, which is what the server's
+ * AbilityGuard checks today — so the two cannot disagree.
+ */
+
+/** Permission keys are atomic capability flags, not action/subject pairs — see `PERMISSIONS`. */
+export type AppAbility = Ability<string>;
+
+/**
+ * The backend's permission catalog (`rbac.defaults.ts`), mirrored here so a screen names a
+ * capability rather than spelling a string. These are exactly the keys the server's
+ * `@CheckAbility` decorators demand: hiding a control on one of them and getting a 403
+ * from the matching route are the same fact, reported twice.
+ */
+export const PERMISSIONS = {
+  usersRead: "users:read",
+  usersManage: "users:manage",
+  usersBlock: "users:block",
+  rolesManage: "roles:manage",
+  rolesAssign: "roles:assign",
+  permissionsRead: "permissions:read",
+  permissionsDefine: "permissions:define",
+  permissionsGrant: "permissions:grant",
+  auditLogRead: "audit-log:read",
+  customersRead: "customers:read",
+  customersManage: "customers:manage",
+  customersStatus: "customers:status",
+  countriesRead: "countries:read",
+  countriesManage: "countries:manage",
+  countriesStatus: "countries:status",
+  languagesRead: "languages:read",
+  languagesManage: "languages:manage",
+  languagesStatus: "languages:status",
+} as const;
+
+export type PermissionKey = (typeof PERMISSIONS)[keyof typeof PERMISSIONS];
+
+/** The roles screen carries three independent capabilities; any one of them is worth opening it for. */
+export const ROLES_SCREEN_PERMISSIONS: readonly PermissionKey[] = [
+  PERMISSIONS.rolesManage,
+  PERMISSIONS.rolesAssign,
+  PERMISSIONS.permissionsGrant,
+];
+
+/**
+ * Permission keys ("users:block") aren't real action:subject pairs, so we don't model CASL
+ * subjects at all — `Ability<string>` treats each key as its own atomic "can I do this" flag.
+ *
+ * There is deliberately no role-name shortcut here. The server grants authority from permissions
+ * only — a role called "admin" that carries nothing gets the same 403 as no role at all — so a
+ * wildcard for `roles.includes("admin")` would make the console promise what the server refuses.
+ */
+export function buildAbility(user: CurrentUser | null): AppAbility {
+  const { can, build } = new AbilityBuilder<AppAbility>(Ability);
+  for (const permission of user?.permissions ?? []) can(permission);
+  return build();
+}
+
+export function hasPermission(ability: AppAbility, permissionKey: PermissionKey): boolean {
+  return ability.can(permissionKey);
+}
+
+/** For a screen that several capabilities can each open on their own — see the roles screen. */
+export function hasAnyPermission(ability: AppAbility, permissionKeys: readonly PermissionKey[]): boolean {
+  return permissionKeys.some((key) => ability.can(key));
+}
+
+/** The tooltip a disabled control carries, so "why is this greyed out" is answerable in place. */
+export function missingPermissionHint(permissionKey: PermissionKey): string {
+  return `You need the "${permissionKey}" permission to do this.`;
+}

package/registry/admin-apps/nextjs/variants/base/src/lib/auth-client.ts

@@ -0,0 +1,10 @@
+import { AuthClient } from "@simple-auth-kit/auth-client";
+import { AUTH_API_URL } from "./env";
+import { cookieTokenStorage } from "./token-storage";
+
+// One client for the whole app — cheap to construct, holds no mutable state of its own beyond
+// the injected storage adapter, so a module-level singleton is safe across client components.
+export const authClient = new AuthClient({
+  baseUrl: AUTH_API_URL,
+  storage: cookieTokenStorage,
+});

package/registry/admin-apps/nextjs/variants/base/src/lib/env.ts

@@ -0,0 +1,10 @@
+// The backend base URL is public by design — the browser talks to it directly with a Bearer
+// token, there's no server-side secret in this app to protect (see plan/README.md decision log:
+// frontend-managed cookies, not backend-issued httpOnly ones).
+export const AUTH_API_URL = process.env.NEXT_PUBLIC_AUTH_API_URL ?? "http://localhost:3001";
+
+// Server-side calls (NextAuth authorize(), proxy.ts token verify) run inside the app's own
+// process, where the browser-facing URL may not resolve — in docker compose, "localhost:3001"
+// is the console container itself, not the backend service. This override names the backend as
+// the server sees it (e.g. http://nestjs-prisma-app:3001); outside compose the two are the same.
+export const AUTH_API_INTERNAL_URL = process.env.AUTH_API_INTERNAL_URL ?? AUTH_API_URL;

package/registry/admin-apps/nextjs/variants/base/src/lib/server-token-storage.ts

@@ -0,0 +1,33 @@
+import { cookies } from "next/headers";
+import type { AuthTokens, TokenStorage } from "@simple-auth-kit/auth-client";
+
+// Server-side twin of lib/token-storage.ts — same cookie name and JSON shape, so tokens written
+// here (NextAuth authorize()) are immediately readable by the browser-side AuthClient and vice
+// versa. Only usable where the Next.js cookie jar is mutable (server actions, route handlers).
+const COOKIE_NAME = "simple_auth_kit_tokens";
+const COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+
+export const serverCookieTokenStorage: TokenStorage = {
+  async get(): Promise<AuthTokens | null> {
+    const raw = (await cookies()).get(COOKIE_NAME)?.value;
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw) as AuthTokens;
+    } catch {
+      return null;
+    }
+  },
+
+  async set(tokens: AuthTokens): Promise<void> {
+    (await cookies()).set(COOKIE_NAME, JSON.stringify(tokens), {
+      maxAge: COOKIE_MAX_AGE_SECONDS,
+      sameSite: "lax",
+      path: "/",
+      secure: process.env.NODE_ENV === "production",
+    });
+  },
+
+  async clear(): Promise<void> {
+    (await cookies()).delete(COOKIE_NAME);
+  },
+};

package/registry/admin-apps/nextjs/variants/base/src/lib/stores/auth-store.ts

@@ -0,0 +1,117 @@
+"use client";
+
+import { makeAutoObservable, runInAction } from "mobx";
+import type { CurrentUser, SessionSummary } from "@simple-auth-kit/auth-client";
+import { authClient } from "../auth-client";
+
+export type LoginOutcome = { status: "success" } | { status: "twoFactorRequired"; challengeToken: string };
+
+export class AuthStore {
+  currentUser: CurrentUser | null = null;
+  status: "idle" | "initializing" | "ready" = "idle";
+
+  constructor() {
+    makeAutoObservable(this, {}, { autoBind: true });
+  }
+
+  get isAuthenticated(): boolean {
+    return this.currentUser !== null;
+  }
+
+  /** Runs once on app mount: if a cached token pair exists, hydrate `currentUser` from it. */
+  async initialize(): Promise<void> {
+    if (this.status !== "idle") return;
+    this.status = "initializing";
+    const hasTokens = await authClient.isAuthenticated();
+    if (!hasTokens) {
+      runInAction(() => {
+        this.status = "ready";
+      });
+      return;
+    }
+    try {
+      const me = await authClient.me();
+      runInAction(() => {
+        this.currentUser = me;
+        this.status = "ready";
+      });
+    } catch {
+      runInAction(() => {
+        this.currentUser = null;
+        this.status = "ready";
+      });
+    }
+  }
+
+  /** Re-fetches `/auth/me` — used after anything that can change roles/permissions/2FA status. */
+  async refreshCurrentUser(): Promise<void> {
+    const me = await authClient.me();
+    runInAction(() => {
+      this.currentUser = me;
+    });
+  }
+
+  async signup(input: { email: string; password: string }): Promise<void> {
+    await authClient.signup(input);
+    await this.refreshCurrentUser();
+  }
+
+  async login(input: { identifier: string; password: string }): Promise<LoginOutcome> {
+    const result = await authClient.login(input);
+    if ("twoFactorRequired" in result) {
+      return { status: "twoFactorRequired", challengeToken: result.challengeToken };
+    }
+    await this.refreshCurrentUser();
+    return { status: "success" };
+  }
+
+  async loginTwoFactor(input: { challengeToken: string; code: string }): Promise<void> {
+    await authClient.loginTwoFactor(input);
+    await this.refreshCurrentUser();
+  }
+
+  async logout(): Promise<void> {
+    try {
+      await authClient.logout();
+    } finally {
+      // End the NextAuth session too — otherwise proxy.ts still sees a live session cookie and
+      // only notices the missing tokens one navigation later.
+      const { signOut } = await import("next-auth/react");
+      await signOut({ redirect: false });
+      runInAction(() => {
+        this.currentUser = null;
+      });
+    }
+  }
+
+  async logoutAll(): Promise<void> {
+    try {
+      await authClient.logoutAll();
+    } finally {
+      const { signOut } = await import("next-auth/react");
+      await signOut({ redirect: false });
+      runInAction(() => {
+        this.currentUser = null;
+      });
+    }
+  }
+
+  async listSessions(): Promise<SessionSummary[]> {
+    return authClient.sessions();
+  }
+
+  async enrollTwoFactor(): Promise<{ secret: string; provisioningUri: string }> {
+    return authClient.enrollTwoFactor();
+  }
+
+  async confirmTwoFactor(code: string): Promise<{ backupCodes: string[] }> {
+    const result = await authClient.confirmTwoFactor(code);
+    await this.refreshCurrentUser(); // picks up the now-true `twoFactorEnabled` flag
+    return result;
+  }
+
+  async disableTwoFactor(code: string): Promise<void> {
+    await authClient.disableTwoFactor(code);
+    await this.refreshCurrentUser(); // picks up the now-false `twoFactorEnabled` flag
+  }
+}

package/registry/admin-apps/nextjs/variants/base/src/lib/stores/store-context.tsx

@@ -0,0 +1,50 @@
+"use client";
+
+import { AbilityProvider } from "@casl/react";
+import { observer } from "mobx-react-lite";
+import { createContext, useContext, useEffect, useState, type ReactNode } from "react";
+import { buildAbility } from "../ability";
+import { AuthStore } from "./auth-store";
+
+/**
+ * One bag rather than one context per store: a second store is then a field here and a `useX()`
+ * export below, not a new provider wrapped around the tree. `admin-nextjs-workspaces` is the
+ * same file with a `workspace` field added, which is exactly the shape this is here to keep.
+ */
+interface Stores {
+  auth: AuthStore;
+}
+
+const StoresContext = createContext<Stores | null>(null);
+
+function useStores(): Stores {
+  const stores = useContext(StoresContext);
+  if (!stores) throw new Error("useAuthStore must be used within <AppProviders>");
+  return stores;
+}
+
+export function useAuthStore(): AuthStore {
+  return useStores().auth;
+}
+
+/**
+ * Owns the app's stores and re-derives the CASL ability from `auth.currentUser` on every change
+ * (login, logout, 2FA, a permission granted to you elsewhere). Wrapped in `observer` so this
+ * component itself re-renders when the MobX-observable `currentUser` changes, which is what
+ * keeps the `AbilityProvider` value in sync.
+ */
+export const AppProviders = observer(function AppProviders({ children }: { children: ReactNode }) {
+  const [stores] = useState<Stores>(() => ({ auth: new AuthStore() }));
+
+  useEffect(() => {
+    void stores.auth.initialize();
+  }, [stores]);
+
+  const ability = buildAbility(stores.auth.currentUser);
+
+  return (
+    <StoresContext.Provider value={stores}>
+      <AbilityProvider value={ability}>{children}</AbilityProvider>
+    </StoresContext.Provider>
+  );
+});

package/registry/admin-apps/nextjs/variants/base/src/proxy.ts

@@ -0,0 +1,81 @@
+import { NextResponse } from "next/server";
+import { auth } from "@/auth";
+import { AUTH_API_INTERNAL_URL } from "@/lib/env";
+import { apiAuthPrefix, authRoutes, DEFAULT_LOGIN_REDIRECT, publicRoutes } from "@/routes";
+
+const TOKEN_COOKIE = "simple_auth_kit_tokens";
+
+function loginRedirect(nextUrl: URL) {
+  let callbackUrl = nextUrl.pathname;
+  if (nextUrl.search) callbackUrl += nextUrl.search;
+  return NextResponse.redirect(new URL(`/login?callbackUrl=${encodeURIComponent(callbackUrl)}`, nextUrl));
+}
+
+export default auth(async (req) => {
+  const isLoggedIn = !!req.auth;
+  const { nextUrl } = req;
+
+  const isApiAuthRoute = nextUrl.pathname.startsWith(apiAuthPrefix);
+  const isPublicRoute = publicRoutes.includes(nextUrl.pathname);
+  const isAuthRoute = authRoutes.includes(nextUrl.pathname);
+
+  if (isPublicRoute || isApiAuthRoute) return;
+
+  if (isAuthRoute) {
+    if (isLoggedIn) return NextResponse.redirect(new URL(DEFAULT_LOGIN_REDIRECT, nextUrl));
+    return;
+  }
+
+  if (!isLoggedIn) return loginRedirect(nextUrl);
+
+  // The NextAuth session being alive doesn't mean the backend session behind it still is —
+  // verify the cached access token server-side on every protected navigation, so a revocation
+  // (logout-all, block, deactivate) takes effect at the next click, not at session expiry.
+  const raw = req.cookies.get(TOKEN_COOKIE)?.value;
+  let accessToken: string | undefined;
+  try {
+    accessToken = raw ? (JSON.parse(raw) as { accessToken?: string }).accessToken : undefined;
+  } catch {
+    accessToken = undefined;
+  }
+  if (!accessToken) {
+    const res = loginRedirect(nextUrl);
+    res.cookies.delete(TOKEN_COOKIE);
+    return res;
+  }
+
+  try {
+    const verify = await fetch(`${AUTH_API_INTERNAL_URL}/auth/me`, {
+      headers: { authorization: `Bearer ${accessToken}` },
+    });
+    // 401 alone isn't a verdict — the access token may merely need the refresh rotation the
+    // client performs itself. Only an explicitly dead session (403 blocked/deactivated) or a
+    // 401 with no refresh token to fall back on forces a logout here.
+    if (verify.status === 401) {
+      const hasRefreshToken = (() => {
+        try {
+          return raw ? !!(JSON.parse(raw) as { refreshToken?: string }).refreshToken : false;
+        } catch {
+          return false;
+        }
+      })();
+      if (!hasRefreshToken) {
+        const res = loginRedirect(nextUrl);
+        res.cookies.delete(TOKEN_COOKIE);
+        return res;
+      }
+    } else if (verify.status === 403) {
+      const res = loginRedirect(nextUrl);
+      res.cookies.delete(TOKEN_COOKIE);
+      return res;
+    }
+  } catch {
+    // Backend unreachable — let the page render; client-side calls will surface the error.
+  }
+
+  return;
+});
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\.(?:png|jpg|jpeg|gif|svg|webp|ico)$).*)"],
+};

package/registry/admin-apps/nextjs/variants/base/src/routes.ts

@@ -0,0 +1,7 @@
+export const publicRoutes: string[] = [];
+
+export const authRoutes = ["/login", "/signup"];
+
+export const apiAuthPrefix = "/api/auth";
+
+export const DEFAULT_LOGIN_REDIRECT = "/dashboard";

package/registry/admin-apps/nextjs/variants/workspaces/.env.example

@@ -0,0 +1,7 @@
+# The simple-auth-kit backend this console administers — the *workspaces* variant
+# (`simple-auth-kit add <combo> --workspaces`), which scopes requests with an X-Workspace-Id header.
+# For the plain, workspace-free console see apps/admin-nextjs.
+#
+# Public by design: the browser talks to the backend directly with a Bearer token, so there is no
+# server-side secret in this app to protect.
+NEXT_PUBLIC_AUTH_API_URL=http://localhost:3005

package/registry/admin-apps/nextjs/variants/workspaces/Dockerfile

@@ -0,0 +1,32 @@
+# Build context MUST be the repo root (not this directory) — this app is a pnpm workspace
+# member that depends on @simple-auth-kit/auth-client via `workspace:*`, which is compiled to
+# dist/ and must be built from source (it's not consumed as raw TS). That requires the
+# whole workspace (pnpm-workspace.yaml, the lockfile, packages/auth-client) in scope.
+#
+# Runs `next dev` (not a production build): a generic image can't sensibly bake
+# NEXT_PUBLIC_* values at build time (Next.js inlines them then), and this is a
+# convenience local/demo stack, not a production deploy.
+FROM node:26-bookworm-slim
+
+WORKDIR /repo
+
+# pnpm v11 per the repo's Prerequisites — resolved via corepack rather than hardcoding an
+# install method, pinned to an exact version for reproducible builds. Node 26 no longer
+# bundles corepack, so it's installed explicitly first.
+RUN npm install -g corepack@latest && corepack enable && corepack prepare pnpm@11.21.0 --activate
+
+COPY . .
+
+# Scoped to admin-nextjs-workspaces + its workspace dependencies (auth-client) — avoids installing the
+# unrelated combos/mobile-app dependency trees (argon2, prisma, etc.). pnpm v10+ still
+# refuses to run even the remaining (harmless, platform-binary-linking) build scripts like
+# esbuild's without explicit approval; --config here only affects this image layer, not the
+# repo's own pnpm config.
+RUN pnpm install --frozen-lockfile --filter "admin-nextjs-workspaces..." --config.dangerously-allow-all-builds=true
+RUN pnpm --filter @simple-auth-kit/auth-client run build
+
+WORKDIR /repo/apps/admin-nextjs-workspaces
+EXPOSE 3010
+# `pnpm exec` (not `pnpm run dev -- ...`) so the -H flag actually reaches next's CLI parser
+# instead of being swallowed as a literal "--" argument.
+CMD ["pnpm", "exec", "next", "dev", "-H", "0.0.0.0", "-p", "3010"]