@team-codeme/crud-forge 0.0.0-stage → 1.0.0

package/src/commands/keycloak-options.js

@@ -0,0 +1,182 @@
+const path = require('path');
+const fs = require('fs-extra');
+const colors = require('../utils/colors');
+
+/**
+ * Apply Keycloak settings for developer generate from the loaded config file
+ * (crudforge.config.yml / --preferences). Optional CLI flags override config.
+ *
+ * Set in config:
+ *   auth.serverUrl
+ *   auth.clientId
+ *   auth.provision.adminServiceUrl
+ * Credentials stay out of YAML: KEYCLOAK_ADMIN_USERNAME / KEYCLOAK_ADMIN_PASSWORD
+ * in a local .env (names from auth.provision.adminUsernameEnv / adminPasswordEnv).
+ */
+async function applyDeveloperKeycloakOptions(config, options = {}, { cwd, outputDir } = {}) {
+  config.auth = config.auth || {};
+  config.auth.provision = config.auth.provision || {};
+
+  // Optional CLI overrides (advanced); config file is the primary source.
+  if (options.kcServerUrl) {
+    config.auth.serverUrl = String(options.kcServerUrl).trim().replace(/\/+$/, '');
+  }
+  if (options.kcRealm) {
+    config.auth.realm = String(options.kcRealm).trim();
+  }
+  if (options.kcClientId) {
+    const clientId = String(options.kcClientId).trim();
+    config.auth.clientId = clientId;
+    config.auth.provision.clientId = clientId;
+  }
+  if (options.kcAdminServiceUrl) {
+    config.auth.provision.adminServiceUrl = String(options.kcAdminServiceUrl).trim();
+  }
+  if (options.kcForwardedProto) {
+    config.auth.forwardedProto = String(options.kcForwardedProto).trim();
+  }
+  if (options.kcUsername) {
+    process.env.KEYCLOAK_ADMIN_USERNAME = String(options.kcUsername);
+  }
+  if (options.kcPassword) {
+    process.env.KEYCLOAK_ADMIN_PASSWORD = String(options.kcPassword);
+  }
+
+  const enableKeycloak =
+    options.keycloak ||
+    config.auth.provider === 'keycloak' ||
+    !!options.kcServerUrl ||
+    !!options.kcClientId ||
+    !!options.kcAdminServiceUrl;
+
+  if (!enableKeycloak) {
+    return { applied: false };
+  }
+
+  config.auth.provider = 'keycloak';
+  if (options.keycloak && options.iam !== false) {
+    config.iam = { ...(config.iam || {}), enabled: true };
+  }
+
+  if (config.auth.serverUrl) {
+    config.auth.serverUrl = String(config.auth.serverUrl).trim().replace(/\/+$/, '');
+  }
+  if (config.auth.clientId && !config.auth.provision.clientId) {
+    config.auth.provision.clientId = config.auth.clientId;
+  }
+  if (options.kcUseMockAuth === true) {
+    config.auth.useMockAuth = true;
+  } else if (config.auth.serverUrl || options.keycloak) {
+    config.auth.useMockAuth = false;
+  }
+
+  config.auth.provision.adminUsernameEnv =
+    config.auth.provision.adminUsernameEnv || 'KEYCLOAK_ADMIN_USERNAME';
+  config.auth.provision.adminPasswordEnv =
+    config.auth.provision.adminPasswordEnv || 'KEYCLOAK_ADMIN_PASSWORD';
+
+  const useAdminService = config.auth.useKeycloakAdminService !== false;
+  const missing = [];
+  if (!config.auth.serverUrl) missing.push('auth.serverUrl');
+  if (!config.auth.clientId) missing.push('auth.clientId');
+  // Admin Service URL is required only when using the middleware API (default).
+  // Native Keycloak Admin REST: set auth.useKeycloakAdminService: false and omit adminServiceUrl.
+  if (useAdminService && !config.auth.provision.adminServiceUrl) {
+    missing.push('auth.provision.adminServiceUrl');
+  }
+
+  if (missing.length) {
+    throw new Error(
+      [
+        'Keycloak generate requires these keys in your config file (crudforge.config.yml):',
+        ...missing.map((k) => `  - ${k}`),
+        'Provisioning credentials are only needed for bootstrap, not frontend login.',
+        'Example (Admin Service middleware):',
+        '  auth:',
+        '    provider: keycloak',
+        '    serverUrl: http://host:30080',
+        '    clientId: my-app-client',
+        '    useKeycloakAdminService: true',
+        '    provision:',
+        '      adminServiceUrl: http://host:31740/',
+        'Example (native Keycloak Admin REST):',
+        '  auth:',
+        '    useKeycloakAdminService: false',
+        '    adminBaseUrl: /services/keycloak-admin',
+        '    serverUrl: http://host:30080',
+      ].join('\n')
+    );
+  }
+
+  const userEnv = config.auth.provision.adminUsernameEnv;
+  const passEnv = config.auth.provision.adminPasswordEnv;
+  const username = process.env[userEnv];
+  const password = process.env[passEnv];
+
+  if ((username || password) && outputDir && !config.dryRun) {
+    await writeLocalEnvFile(outputDir, {
+      [userEnv]: username || '',
+      [passEnv]: password || '',
+      CRUDFORGE_KC_SERVER_URL: config.auth.serverUrl || '',
+      CRUDFORGE_KC_REALM: config.auth.realm || '',
+      CRUDFORGE_KC_CLIENT_ID: config.auth.clientId || '',
+      CRUDFORGE_KC_ADMIN_SERVICE_URL: config.auth.provision.adminServiceUrl || '',
+    });
+    console.log(
+      colors.dim(
+        `🔵 Wrote Keycloak env refs to ${path.join(path.relative(cwd || process.cwd(), outputDir) || '.', '.env')} (gitignored)`
+      )
+    );
+  }
+
+  console.log(colors.cyan('🔵 Keycloak from config:'));
+  console.log(colors.dim(`   serverUrl        : ${config.auth.serverUrl}`));
+  console.log(colors.dim(`   clientId         : ${config.auth.clientId}`));
+  console.log(colors.dim(`   adminServiceUrl  : ${config.auth.provision.adminServiceUrl}`));
+  console.log(colors.dim(`   credentials      : ${userEnv} / ${passEnv} (env only)`));
+
+  return {
+    applied: true,
+    serverUrl: config.auth.serverUrl,
+    clientId: config.auth.clientId,
+    adminServiceUrl: config.auth.provision.adminServiceUrl,
+  };
+}
+
+async function writeLocalEnvFile(outputDir, values) {
+  await fs.ensureDir(outputDir);
+  const envPath = path.join(outputDir, '.env');
+  let existing = '';
+  if (await fs.pathExists(envPath)) {
+    existing = await fs.readFile(envPath, 'utf8');
+  }
+  const map = {};
+  for (const line of existing.split(/\r?\n/)) {
+    if (!line || line.trim().startsWith('#') || !line.includes('=')) continue;
+    const idx = line.indexOf('=');
+    map[line.slice(0, idx)] = line.slice(idx + 1);
+  }
+  for (const [key, value] of Object.entries(values)) {
+    if (value != null && String(value) !== '') {
+      map[key] = String(value);
+    }
+  }
+  const body = [
+    '# Local Keycloak credentials for this generated app — never commit.',
+    '# Loaded by: crudforge bootstrap --env-file ./.env',
+    ...Object.entries(map).map(([k, v]) => `${k}=${v}`),
+    '',
+  ].join('\n');
+  await fs.writeFile(envPath, body, 'utf8');
+
+  const gi = path.join(outputDir, '.gitignore');
+  let giText = (await fs.pathExists(gi)) ? await fs.readFile(gi, 'utf8') : '';
+  if (!/(^|\n)\.env(\n|$)/.test(giText)) {
+    giText = `${giText.replace(/\s+$/, '')}\n.env\n`;
+    await fs.writeFile(gi, giText, 'utf8');
+  }
+}
+
+module.exports = {
+  applyDeveloperKeycloakOptions,
+};

package/src/commands/validate.js

@@ -0,0 +1,52 @@
+const fs = require("fs-extra");
+const path = require("path");
+const { loadConfig } = require("../config/load-config");
+const {
+  analyzeSchema,
+  formatDiagnostics,
+} = require("../validator/diagnostics");
+async function validate(file, options = {}, typeOverride = null) {
+  let diagnostics = [];
+  let parsed;
+  const filePath = path.resolve(file);
+  try {
+    const { config } = await loadConfig(process.cwd(), options.preferences, {
+      projectPaths: true,
+    });
+    ({ diagnostics, parsed } = analyzeSchema(
+      await fs.readFile(filePath, "utf8"),
+      {
+        file: filePath,
+        isGdl: (typeOverride || path.extname(filePath).slice(1)) === "gdl",
+        config,
+      },
+    ));
+  } catch (error) {
+    diagnostics = [
+      {
+        severity: "error",
+        code: "input",
+        file: filePath,
+        message: error.message,
+        suggestion: "Check the schema and configuration paths and syntax.",
+      },
+    ];
+  }
+  const ok = !diagnostics.some((d) => d.severity === "error");
+  if (options.json)
+    console.log(
+      JSON.stringify(
+        { ok, diagnostics, entities: parsed?.entities.length || 0 },
+        null,
+        2,
+      ),
+    );
+  else
+    console.log(
+      formatDiagnostics(diagnostics) +
+        (ok ? "\nValidation passed." : "\nValidation failed."),
+    );
+  process.exitCode = ok ? 0 : 1;
+  return { ok, diagnostics };
+}
+module.exports = { validate };

package/src/config/auth-config.js

@@ -0,0 +1,183 @@
+const { resolveEnv } = require('./env-refs');
+
+const ALLOWED_PROVIDERS = ['none', 'keycloak'];
+const ALLOWED_ADAPTERS = ['admin-service', 'keycloak-admin-rest'];
+
+class AuthConfigError extends Error {
+  constructor(messages) {
+    const list = Array.isArray(messages) ? messages : [messages];
+    super(`Auth configuration is invalid:\n${list.map((message) => `  - ${message}`).join('\n')}`);
+    this.name = 'AuthConfigError';
+    this.messages = list;
+  }
+}
+
+function isBlank(value) {
+  return value == null || String(value).trim() === '';
+}
+
+function normalizeBaseUrl(url) {
+  if (isBlank(url)) {
+    return '';
+  }
+  return String(url).trim().replace(/\/+$/, '');
+}
+
+function getAuth(config = {}) {
+  if (config.auth != null && typeof config.auth === 'object') {
+    return config.auth;
+  }
+  return config;
+}
+
+/**
+ * Fill issuerUrl / tokenUrl from serverUrl + realm when they are empty.
+ * Normalizes serverUrl (no trailing slash). Mutates and returns auth.
+ * @param {object} auth
+ */
+function deriveAuthUrls(auth = {}) {
+  if (auth.serverUrl) {
+    auth.serverUrl = normalizeBaseUrl(auth.serverUrl);
+  }
+  if (auth.issuerUrl) {
+    auth.issuerUrl = normalizeBaseUrl(auth.issuerUrl);
+  }
+  if (auth.tokenUrl) {
+    auth.tokenUrl = String(auth.tokenUrl).trim();
+  }
+
+  if (isBlank(auth.issuerUrl) && !isBlank(auth.serverUrl) && !isBlank(auth.realm)) {
+    auth.issuerUrl = `${auth.serverUrl}/realms/${String(auth.realm).trim()}`;
+  }
+  if (isBlank(auth.tokenUrl) && !isBlank(auth.issuerUrl)) {
+    auth.tokenUrl = `${auth.issuerUrl}/protocol/openid-connect/token`;
+  }
+  return auth;
+}
+
+/**
+ * Copy of auth safe to feed into generate / Angular environments.
+ * Drops clientSecret and any literal provision user passwords.
+ * @param {object} auth
+ */
+function stripSecretsForGenerate(auth = {}) {
+  const copy = { ...auth };
+  delete copy.clientSecret;
+
+  if (auth.provision && typeof auth.provision === 'object') {
+    copy.provision = { ...auth.provision };
+    if (Array.isArray(auth.provision.users)) {
+      copy.provision.users = auth.provision.users.map((user) => {
+        if (!user || typeof user !== 'object') {
+          return user;
+        }
+        const next = { ...user };
+        delete next.password;
+        delete next.clientSecret;
+        return next;
+      });
+    }
+  }
+
+  return copy;
+}
+
+function requireResolvedEnv(errors, envName, label) {
+  if (isBlank(envName)) {
+    errors.push(`${label} must name an environment variable.`);
+    return;
+  }
+  const name = String(envName).trim();
+  const value = resolveEnv(name);
+  if (isBlank(value)) {
+    errors.push(`${label} environment variable "${name}" is not set or is empty.`);
+  }
+}
+
+/**
+ * Validate auth / provision settings. Never includes secret values in errors.
+ * @param {object} config full CRUDForge config (or an auth object)
+ * @param {{ requireProvision?: boolean }} [options]
+ */
+function validateAuthConfig(config = {}, options = {}) {
+  const requireProvision = !!options.requireProvision;
+  const auth = getAuth(config);
+  const errors = [];
+
+  const provider = isBlank(auth.provider) ? 'none' : String(auth.provider).trim();
+  if (!ALLOWED_PROVIDERS.includes(provider)) {
+    errors.push(`auth.provider must be one of: ${ALLOWED_PROVIDERS.join(', ')}.`);
+  }
+
+  const useMockAuth = !!auth.useMockAuth;
+  if (provider === 'keycloak' && !useMockAuth) {
+    if (isBlank(auth.serverUrl)) {
+      errors.push('auth.serverUrl is required when auth.provider is keycloak and auth.useMockAuth is false.');
+    }
+    if (isBlank(auth.realm)) {
+      errors.push('auth.realm is required when auth.provider is keycloak and auth.useMockAuth is false.');
+    }
+    if (isBlank(auth.clientId)) {
+      errors.push('auth.clientId is required when auth.provider is keycloak and auth.useMockAuth is false.');
+    }
+  }
+
+  const provision = auth.provision && typeof auth.provision === 'object' ? auth.provision : {};
+  const provisionEnabled = !!provision.enabled;
+
+  if (requireProvision && !provisionEnabled) {
+    errors.push('auth.provision.enabled must be true to run bootstrap. The generate command never provisions.');
+  }
+
+  if (provisionEnabled) {
+    if (isBlank(provision.adapter)) {
+      errors.push('auth.provision.adapter is required when auth.provision.enabled is true (admin-service | keycloak-admin-rest).');
+    } else if (!ALLOWED_ADAPTERS.includes(String(provision.adapter).trim())) {
+      errors.push(`auth.provision.adapter must be one of: ${ALLOWED_ADAPTERS.join(', ')}.`);
+    }
+
+    if (isBlank(auth.realm)) {
+      errors.push('auth.realm is required when auth.provision.enabled is true.');
+    }
+
+    const adapter = String(provision.adapter || '').trim();
+    if (adapter === 'admin-service' && isBlank(provision.adminServiceUrl)) {
+      errors.push('auth.provision.adminServiceUrl is required when auth.provision.adapter is admin-service.');
+    }
+    if (adapter === 'keycloak-admin-rest' && isBlank(auth.serverUrl)) {
+      errors.push('auth.serverUrl is required when auth.provision.adapter is keycloak-admin-rest.');
+    }
+
+    requireResolvedEnv(errors, provision.adminUsernameEnv, 'auth.provision.adminUsernameEnv');
+    requireResolvedEnv(errors, provision.adminPasswordEnv, 'auth.provision.adminPasswordEnv');
+
+    const users = Array.isArray(provision.users) ? provision.users : [];
+    users.forEach((user, index) => {
+      const label = user && user.username
+        ? `auth.provision.users[${index}] (username "${user.username}")`
+        : `auth.provision.users[${index}]`;
+      if (!user || typeof user !== 'object') {
+        errors.push(`${label} must be an object with username and passwordEnv.`);
+        return;
+      }
+      if (isBlank(user.passwordEnv)) {
+        errors.push(`${label} is missing passwordEnv.`);
+        return;
+      }
+      requireResolvedEnv(errors, user.passwordEnv, `${label}.passwordEnv`);
+    });
+  }
+
+  if (errors.length > 0) {
+    throw new AuthConfigError(errors);
+  }
+
+  return auth;
+}
+
+module.exports = {
+  AuthConfigError,
+  validateAuthConfig,
+  deriveAuthUrls,
+  stripSecretsForGenerate,
+};

package/src/config/default-values.js

@@ -0,0 +1,235 @@
+module.exports = {
+  project: {
+    name: 'CRUDForge App',
+    description: 'Angular Material CRUD generated by CRUDForge',
+    repositoryUrl: ''
+  },
+  input: {
+    file: '',
+    type: 'jdl',
+    // Multi-service schemas: [{ name, file, microservice?, type?, folder? }]
+    sources: [],
+  },
+  output: {
+    directory: './generated-app',
+    structure: 'entity-folder',
+    embedConfig: true,
+    teamPack: {
+      enabled: true,
+      cursorAgents: true,
+      codexAgents: true,
+      antigravityAgents: true,
+      vscodeExtensions: true
+    },
+    aiDocs: {
+      enabled: true
+    }
+  },
+  backend: { kind: 'custom' },
+  testing: { ci: false, fixtures: {} },
+  doctor: { timeoutMs: 3000, endpoints: [] },
+  git: {
+    enabled: true
+  },
+  preset: 'crud',
+  dryRun: false,
+  validation: true,
+  branding: {
+    banner: true,
+    bannerColor: 'green'
+  },
+  fuse: {
+    rendering: 'spa',
+    ssrAllowedHosts: ['localhost', '127.0.0.1'],
+    enabled: false,
+    starterPackPath: require('path').resolve(__dirname, '../../fuse-starter-pack/fuse-v21.1'),
+    routesFile: 'src/app/domains/admin/routes.ts',
+    navigationFile: 'src/app/domains/admin/layout/data/navigation.ts',
+    cleanLayout: false,
+    folderType: '',
+    theme: {
+      scheme: 'system',
+      primary: '#0D1E3A',
+      error: '#dc2626'
+    }
+  },
+  generate: {
+    models: true,
+    services: true,
+    formServices: true,
+    routes: true,
+    enums: true,
+    relationships: true,
+    components: {
+      list: true,
+      card: true,
+      detail: true
+    },
+    forms: {
+      form: true,
+      formPage: true,
+      update: true,
+      validators: true,
+      mappers: true
+    },
+    interaction: {
+      actions: true,
+      filter: true
+    },
+    globals: {
+      constants: true,
+      tests: false,
+      sharedAssets: true
+    },
+    registrations: {
+      navigation: true,
+      routes: true
+    }
+  },
+  ui: {
+    framework: 'material',
+    useSkeletonLoading: true,
+    snackbarPositionTop: false,
+    viewMode: 'table',
+    formMode: 'sidebar',
+    searchMode: 'field',
+    cardBreakpointPx: 640,
+    gridCols: {
+      mobile: 1,
+      tablet: 2,
+      desktop: 3
+    },
+    styling: {
+      snackbarSuccessColor: '#16a34a',
+      snackbarErrorColor: '#dc2626'
+    }
+  },
+  api: {
+    baseUrl: '/api',
+    microservice: '',
+    endpointStyle: 'kebab-plural',
+    dateLibrary: 'dayjs',
+    responseType: 'http-response',
+    // name -> absolute origin (or { prod, dev, pathRewrite })
+    services: {},
+  },
+  // Which Fuse proxy file(s) to update: both | prod | dev
+  proxy: {
+    write: 'both',
+    routes: {},
+  },
+  devServer: { port: 4200 },
+  fields: {
+    entities: {},
+    audit: {
+      enabled: true,
+      hideInForms: true,
+      hideInFilters: true,
+      hideInSearch: true,
+      hideInLists: true,
+      showInDetail: true,
+      names: [
+        'createdBy',
+        'createdDate',
+        'lastModifiedBy',
+        'lastModifiedDate'
+      ]
+    },
+    // Backend plumbing — kept on the model/API, never rendered in list/form/detail/card/filter/search UI.
+    technical: {
+      enabled: true,
+      names: ['debug', 'refType', 'refId'],
+    },
+    formatting: {
+      dateMediumFormat: 'medium',
+      numberFormat: '1.0-2',
+      stringCase: 'default'
+    }
+  },
+  formBehavior: {
+    uppercaseInputs: false,
+    updateOn: 'change',
+    showErrorMessages: true,
+    autoFocusFirstInput: true
+  },
+  mock: {
+    enabled: false,
+    recordsPerEntity: 10,
+    values: {
+      stringPrefix: 'Mock ',
+      numberMin: 1,
+      numberMax: 1000,
+      booleanDefault: true
+    }
+  },
+  auth: {
+    provider: 'none',
+    serverUrl: '',
+    realm: 'CRUD-FORDGE',
+    clientId: '',
+    clientSecret: '',
+    issuerUrl: '',
+    tokenUrl: '',
+    adminBaseUrl: '/auth',
+    useMockAuth: false,
+    forwardedProto: '',
+    signInPrefill: {
+      username: '',
+      password: '',
+    },
+    adminRoles: ['ROLE_ADMIN', 'ADMIN', 'ROLE_SUPER_ADMIN'],
+    /** @deprecated Prefer auth.session.idleTimeoutMs */
+    sessionIdleTimeoutMs: 0,
+    session: {
+      /** 0 = stay signed in until explicit logout (default). */
+      idleTimeoutMs: 0,
+      persistAcrossReload: true,
+      crossTabSync: true,
+      refreshOnFocus: true,
+      /** Refresh probe interval when disabled-account monitoring is on (ms). */
+      statusProbeIntervalMs: 60_000,
+    },
+    disabledAccount: {
+      enabled: false,
+      countdownSeconds: 20,
+      message: 'Your account has been disabled. Please contact your administrator.',
+      sound: false,
+    },
+    provision: {
+      enabled: false,
+      dryRun: false,
+      adapter: 'admin-service',
+      adminServiceUrl: '',
+      adminUsernameEnv: 'KEYCLOAK_ADMIN_USERNAME',
+      adminPasswordEnv: 'KEYCLOAK_ADMIN_PASSWORD',
+      tokenClientId: 'admin-cli',
+      clientId: '',
+      clientName: '',
+      publicClient: true,
+      directAccessGrantsEnabled: true,
+      redirectUris: [],
+      webOrigins: [],
+      roles: [],
+      users: [],
+      resetExistingPasswords: false,
+      stateFile: '.crudforge/provision-state.json'
+    }
+  },
+  iam: {
+    enabled: false,
+    users: true,
+    roles: true,
+    rolePermissions: true,
+    userAccess: true,
+    userPermissions: true,
+    inheritance: true,
+    screens: []
+  },
+  namingConventions: {
+    entityPrefix: '',
+    entitySuffix: '',
+    modelInterfacePrefix: 'I',
+    kebabCaseFiles: true,
+    enumValueCasing: 'uppercase'
+  }
+};