@team-codeme/crud-forge 0.0.0-stage → 1.0.0

package/src/generator/fuse-runtime.js

@@ -0,0 +1,344 @@
+const fs = require('fs-extra');
+const path = require('path');
+const { deriveAuthUrls, stripSecretsForGenerate } = require('../config/auth-config');
+
+const PROXY_PROD = 'proxy.conf.json';
+const PROXY_DEV = 'proxy.dev.conf.json';
+
+/**
+ * Patch Fuse environment*.ts and proxy*.json with Keycloak + api.services.
+ * Runs for any Fuse generate (not only when Keycloak is on).
+ */
+function applyFuseRuntimePack({ outputDir, config, writeOrPreview }) {
+  if (!config.fuse?.enabled) {
+    return { applied: false };
+  }
+
+  const auth = normalizeAuthForEnv(config.auth || {});
+  const services = normalizeServices(config.api?.services);
+  const writeTargets = resolveProxyFiles(config.proxy?.write);
+
+  patchEnvironmentFiles(outputDir, {
+    auth,
+    apiBaseUrl: config.api?.baseUrl || '/api',
+    services,
+    writeOrPreview,
+  });
+
+  patchProxyFiles(outputDir, {
+    auth,
+    services,
+    writeTargets,
+    writeOrPreview,
+    routes: config.proxy?.routes || {},
+  });
+
+  const angularPath = path.join(outputDir, 'angular.json');
+  if (fs.existsSync(angularPath) && config.devServer?.port) {
+    const angular = JSON.parse(fs.readFileSync(angularPath, 'utf8'));
+    for (const project of Object.values(angular.projects || {})) {
+      const serve = (project.architect || project.targets)?.serve;
+      if (serve?.configurations?.development) serve.configurations.development.port = config.devServer.port;
+    }
+    writeOrPreview(angularPath, JSON.stringify(angular, null, 2) + '\n');
+  }
+
+  return {
+    applied: true,
+    services: services.length,
+    proxyFiles: writeTargets,
+  };
+}
+
+function normalizeAuthForEnv(rawAuth) {
+  if (!rawAuth || rawAuth.provider !== 'keycloak') {
+    return null;
+  }
+  const derived = deriveAuthUrls({ ...rawAuth });
+  const auth = stripSecretsForGenerate(derived);
+  const realm = auth.realm || 'crudforge';
+  const keycloakServerAbsolute = String(auth.serverUrl || '')
+    .trim()
+    .replace(/\/+$/, '');
+  const adminServiceAbsolute = String((rawAuth.provision && rawAuth.provision.adminServiceUrl) || '')
+    .trim()
+    .replace(/\/+$/, '');
+  // Honor explicit auth.useKeycloakAdminService. When unset, enable middleware API only if
+  // provision.adminServiceUrl is set (Admin Service /api/v1 gateway).
+  const useAdminServiceApi =
+    rawAuth.useKeycloakAdminService === true ||
+    (rawAuth.useKeycloakAdminService !== false && !!adminServiceAbsolute);
+  // OIDC + native Admin REST target Keycloak; middleware mode prefers Admin Service for /realms too.
+  const gateway = useAdminServiceApi
+    ? adminServiceAbsolute || keycloakServerAbsolute
+    : keycloakServerAbsolute || adminServiceAbsolute;
+  const live = !auth.useMockAuth && !!gateway;
+  const tokenUrl = live
+    ? `/realms/${realm}/protocol/openid-connect/token`
+    : auth.tokenUrl || `/auth/realms/${realm}/protocol/openid-connect/token`;
+  // Native Keycloak Admin REST must use a proxied prefix — never bare /admin/realms
+  // (that collides with the Angular /admin SPA shell and returns index.html).
+  const browserAdminBase = !live
+    ? auth.adminBaseUrl || '/auth'
+    : useAdminServiceApi
+      ? ''
+      : auth.adminBaseUrl || '/services/keycloak-admin';
+  return {
+    ...auth,
+    serverUrl: live ? gateway : auth.serverUrl || '',
+    keycloakServerAbsolute,
+    tokenUrl,
+    browserAdminBase,
+    adminServiceAbsolute: useAdminServiceApi ? adminServiceAbsolute : '',
+    adminServiceUrl: live && useAdminServiceApi ? '/services/keycloak-admin' : '',
+    useAdminServiceApi: live && useAdminServiceApi,
+    nativeAdminProxy: live && !useAdminServiceApi && !!keycloakServerAbsolute,
+    sessionIdleTimeoutMs: resolveIdleTimeoutMs(rawAuth),
+    sessionRefreshOnFocus: resolveSessionFlag(rawAuth, 'refreshOnFocus', true),
+    sessionCrossTabSync: resolveSessionFlag(rawAuth, 'crossTabSync', true),
+    sessionPersistAcrossReload: resolveSessionFlag(rawAuth, 'persistAcrossReload', true),
+    sessionStatusProbeIntervalMs: resolveStatusProbeIntervalMs(rawAuth),
+    disabledAccountEnabled: !!(rawAuth.disabledAccount && rawAuth.disabledAccount.enabled),
+    disabledAccountCountdownSeconds: resolveDisabledCountdown(rawAuth),
+    disabledAccountMessage: resolveDisabledMessage(rawAuth),
+    disabledAccountSound: !!(rawAuth.disabledAccount && rawAuth.disabledAccount.sound),
+  };
+}
+
+function resolveIdleTimeoutMs(rawAuth = {}) {
+  const nested = rawAuth.session && rawAuth.session.idleTimeoutMs;
+  const legacy = rawAuth.sessionIdleTimeoutMs;
+  const value = Number(nested != null ? nested : legacy);
+  return Number.isFinite(value) && value > 0 ? value : 0;
+}
+
+function resolveSessionFlag(rawAuth, key, defaultValue) {
+  if (rawAuth.session && Object.prototype.hasOwnProperty.call(rawAuth.session, key)) {
+    return rawAuth.session[key] !== false;
+  }
+  return defaultValue;
+}
+
+function resolveStatusProbeIntervalMs(rawAuth = {}) {
+  const value = Number(rawAuth.session && rawAuth.session.statusProbeIntervalMs);
+  return Number.isFinite(value) && value > 0 ? value : 60_000;
+}
+
+function resolveDisabledCountdown(rawAuth = {}) {
+  const value = Number(rawAuth.disabledAccount && rawAuth.disabledAccount.countdownSeconds);
+  return Number.isFinite(value) && value > 0 ? value : 20;
+}
+
+function resolveDisabledMessage(rawAuth = {}) {
+  const message = rawAuth.disabledAccount && rawAuth.disabledAccount.message;
+  return typeof message === 'string' && message.trim()
+    ? message.trim()
+    : 'Your account has been disabled. Please contact your administrator.';
+}
+
+/**
+ * api.services shapes:
+ *   identityaccessmodule: "http://host:30084"
+ *   identityaccessmodule: { target: "http://...", pathRewrite: "/backend-path" }
+ *   identityaccessmodule: { prod: "http://...", dev: "http://...", pathRewrite: "..." }
+ */
+function normalizeServices(services) {
+  if (!services || typeof services !== 'object' || Array.isArray(services)) {
+    return [];
+  }
+  return Object.entries(services)
+    .map(([name, value]) => {
+      const key = String(name || '').trim();
+      if (!key) return null;
+      const proxyPath = `/services/${key}`;
+      if (typeof value === 'string') {
+        const target = value.trim().replace(/\/+$/, '');
+        if (!target) return null;
+        return { name: key, proxyPath, prodTarget: target, devTarget: target, pathRewrite: null };
+      }
+      if (!value || typeof value !== 'object') return null;
+      const prodTarget = String(value.prod || value.target || value.url || '').trim().replace(/\/+$/, '');
+      const devTarget = String(value.dev || value.target || value.url || prodTarget)
+        .trim()
+        .replace(/\/+$/, '');
+      if (!prodTarget && !devTarget) return null;
+      const pathRewrite = value.pathRewrite != null ? String(value.pathRewrite).trim() : null;
+      return {
+        name: key,
+        proxyPath,
+        prodTarget: prodTarget || devTarget,
+        devTarget: devTarget || prodTarget,
+        pathRewrite: pathRewrite || null,
+      };
+    })
+    .filter(Boolean);
+}
+
+function resolveProxyFiles(writeMode) {
+  const mode = String(writeMode || 'both').trim().toLowerCase();
+  if (mode === 'prod' || mode === 'production') return [PROXY_PROD];
+  if (mode === 'dev' || mode === 'development') return [PROXY_DEV];
+  return [PROXY_PROD, PROXY_DEV];
+}
+
+function patchEnvironmentFiles(outputDir, { auth, apiBaseUrl, services, writeOrPreview }) {
+  const authUseMock = !!(auth && auth.useMockAuth);
+  const files = [
+    { name: 'environment.ts', production: false, mock: false, useMock: authUseMock },
+    // Keep mock flag consistent across file replacements — production serve must not
+    // flip a mock generate to live token calls (HTML 200 on /auth/realms/...).
+    { name: 'environment.prod.ts', production: true, mock: false, useMock: authUseMock },
+    { name: 'environment.mock.ts', production: false, mock: true, useMock: true },
+  ];
+
+  const servicesMap = {};
+  for (const svc of services) {
+    servicesMap[svc.name] = svc.proxyPath;
+  }
+
+  for (const file of files) {
+    const filePath = path.join(outputDir, 'src/environments', file.name);
+    // Always (re)write when Keycloak/services need a consistent typed object.
+    if (!fs.existsSync(filePath) && !auth && !Object.keys(servicesMap).length) {
+      continue;
+    }
+
+    const lines = [
+      'export const environment = {',
+      `  production: ${file.production},`,
+      `  mock: ${file.mock},`,
+      `  apiUrl: ${jsString(apiBaseUrl || '/api')},`,
+    ];
+
+    if (Object.keys(servicesMap).length) {
+      lines.push(`  services: ${JSON.stringify(servicesMap, null, 2).replace(/\n/g, '\n  ')},`);
+    }
+
+    if (auth) {
+      lines.push(`  kcRealm: ${jsString(auth.realm || 'crudforge')},`);
+      lines.push(`  kcClientId: ${jsString(auth.clientId || 'crudforge-admin')},`);
+      lines.push(`  sso: ${jsString(auth.tokenUrl)},`);
+      lines.push(`  adminBaseUrl: ${jsString(auth.browserAdminBase)},`);
+      lines.push(`  useMockAuth: ${file.useMock},`);
+      lines.push(`  adminRoles: ${JSON.stringify(auth.adminRoles || ['ROLE_ADMIN'])},`);
+      lines.push(`  sessionIdleTimeoutMs: ${Number(auth.sessionIdleTimeoutMs) || 0},`);
+      lines.push(`  sessionRefreshOnFocus: ${auth.sessionRefreshOnFocus !== false ? 'true' : 'false'},`);
+      lines.push(`  sessionCrossTabSync: ${auth.sessionCrossTabSync !== false ? 'true' : 'false'},`);
+      lines.push(`  sessionPersistAcrossReload: ${auth.sessionPersistAcrossReload !== false ? 'true' : 'false'},`);
+      lines.push(`  sessionStatusProbeIntervalMs: ${Number(auth.sessionStatusProbeIntervalMs) || 60_000},`);
+      lines.push(`  disabledAccountEnabled: ${auth.disabledAccountEnabled ? 'true' : 'false'},`);
+      lines.push(`  disabledAccountCountdownSeconds: ${Number(auth.disabledAccountCountdownSeconds) || 20},`);
+      lines.push(`  disabledAccountMessage: ${jsString(auth.disabledAccountMessage || '')},`);
+      lines.push(`  disabledAccountSound: ${auth.disabledAccountSound ? 'true' : 'false'},`);
+      lines.push(`  kcServerUrl: ${jsString(auth.keycloakServerAbsolute || auth.serverUrl || '')},`);
+      lines.push(`  kcForwardedProto: ${jsString(auth.forwardedProto || '')},`);
+      lines.push(`  kcAdminServiceUrl: ${jsString(auth.adminServiceUrl || '/services/keycloak-admin')},`);
+      lines.push(`  useKeycloakAdminService: ${auth.useAdminServiceApi ? 'true' : 'false'},`);
+    }
+
+    // Drop trailing comma on last property for prettier TS.
+    const last = lines.length - 1;
+    if (lines[last].endsWith(',')) {
+      lines[last] = lines[last].slice(0, -1);
+    }
+    lines.push('};', '');
+    writeOrPreview(filePath, lines.join('\n'));
+  }
+}
+
+function patchProxyFiles(outputDir, { auth, services, writeTargets, writeOrPreview, routes }) {
+  for (const fileName of writeTargets) {
+    const filePath = path.join(outputDir, fileName);
+    const hasLiveGateway =
+      auth && !auth.useMockAuth && (auth.adminServiceAbsolute || auth.serverUrl);
+    if (!fs.existsSync(filePath) && services.length === 0 && !hasLiveGateway) {
+      continue;
+    }
+
+    let parsed = {};
+    if (fs.existsSync(filePath)) {
+      try {
+        parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+      } catch {
+        parsed = {};
+      }
+    }
+
+    const isDev = fileName === PROXY_DEV;
+
+    if (hasLiveGateway) {
+      // Prefer middleware (:31740) for Admin Service API; native mode proxies Keycloak :30080.
+      const oidcTarget = String(
+        auth.useAdminServiceApi
+          ? auth.adminServiceAbsolute || auth.serverUrl
+          : auth.keycloakServerAbsolute || auth.serverUrl
+      ).replace(/\/+$/, '');
+      const proxyEntry = {
+        target: oidcTarget,
+        secure: false,
+        changeOrigin: true,
+        logLevel: 'info',
+      };
+      if (auth.forwardedProto) {
+        proxyEntry.headers = { 'X-Forwarded-Proto': auth.forwardedProto };
+      }
+      // Narrow prefixes only — never steal SPA /auth or /admin routes.
+      delete parsed['/auth'];
+      delete parsed['/admin'];
+      delete parsed['/admin/realms'];
+      parsed['/realms'] = { ...proxyEntry };
+
+      if (auth.useAdminServiceApi && auth.adminServiceAbsolute) {
+        parsed['/services/keycloak-admin'] = {
+          target: auth.adminServiceAbsolute,
+          secure: false,
+          changeOrigin: true,
+          logLevel: 'info',
+          pathRewrite: { '^/services/keycloak-admin': '' },
+        };
+      } else if (auth.nativeAdminProxy) {
+        // Browser calls /services/keycloak-admin/admin/realms/... → Keycloak /admin/realms/...
+        parsed['/services/keycloak-admin'] = {
+          target: String(auth.keycloakServerAbsolute || auth.serverUrl).replace(/\/+$/, ''),
+          secure: false,
+          changeOrigin: true,
+          logLevel: 'info',
+          pathRewrite: { '^/services/keycloak-admin': '' },
+        };
+      }
+    }
+
+    for (const svc of services) {
+      const target = isDev ? svc.devTarget : svc.prodTarget;
+      if (!target) continue;
+      const entry = {
+        target,
+        secure: false,
+        changeOrigin: true,
+        logLevel: 'info',
+      };
+      if (svc.pathRewrite) {
+        entry.pathRewrite = { [`^${svc.proxyPath}`]: svc.pathRewrite };
+      }
+      parsed[svc.proxyPath] = entry;
+    }
+
+    // Explicit routes retain source aliases, WebSocket flags, and rewrite behavior.
+    // Specific routes must precede catch-all prefixes such as /api and /services.
+    Object.assign(parsed, routes);
+    parsed = Object.fromEntries(Object.entries(parsed).sort(([a], [b]) => b.length - a.length));
+    writeOrPreview(filePath, `${JSON.stringify(parsed, null, 2)}\n`);
+  }
+}
+
+function jsString(value) {
+  return `'${String(value == null ? '' : value).replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+}
+
+module.exports = {
+  applyFuseRuntimePack,
+  normalizeServices,
+  resolveProxyFiles,
+  PROXY_PROD,
+  PROXY_DEV,
+};

package/src/generator/generated-banner.js

@@ -0,0 +1,137 @@
+const path = require('path');
+
+const MARKER = '@generated by @crudforge/cli';
+const LEGACY_MARKERS = [
+  MARKER,
+  'Generated by `@crudforge/cli`',
+  'Generated by **`@crudforge/cli`**',
+  'Generated by @crudforge/cli',
+];
+
+const SKIP_EXTENSIONS = new Set([
+  '.mp3',
+  '.wav',
+  '.ogg',
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.webp',
+  '.ico',
+  '.woff',
+  '.woff2',
+  '.ttf',
+  '.eot',
+  '.pdf',
+  '.zip',
+  '.gz',
+  '.tgz',
+  '.lock',
+  '.json', // JSON has no comment syntax
+]);
+
+const SKIP_BASENAMES = new Set([
+  'package-lock.json',
+  'yarn.lock',
+  'pnpm-lock.yaml',
+  '.DS_Store',
+]);
+
+/**
+ * Prepend a Generated-by @crudforge/cli banner suited to the file type.
+ * Idempotent — skips when a banner/marker is already present.
+ * @param {string} filePath
+ * @param {string|Buffer} content
+ * @returns {string|Buffer}
+ */
+function stampGeneratedBanner(filePath, content) {
+  if (content == null || Buffer.isBuffer(content)) {
+    return content;
+  }
+  if (typeof content !== 'string') {
+    return content;
+  }
+
+  const base = path.basename(filePath);
+  if (SKIP_BASENAMES.has(base)) {
+    return content;
+  }
+
+  const ext = path.extname(filePath).toLowerCase();
+  if (SKIP_EXTENSIONS.has(ext)) {
+    return content;
+  }
+
+  if (LEGACY_MARKERS.some((m) => content.includes(m))) {
+    return content;
+  }
+
+  const banner = bannerForExtension(ext);
+  if (!banner) {
+    return content;
+  }
+
+  // Preserve UTF-8 BOM if present.
+  if (content.charCodeAt(0) === 0xfeff) {
+    return `\uFEFF${banner}${content.slice(1)}`;
+  }
+
+  // Keep shebang as the first line when present.
+  if (content.startsWith('#!')) {
+    const nl = content.indexOf('\n');
+    if (nl === -1) {
+      return `${content}\n${banner}`;
+    }
+    return `${content.slice(0, nl + 1)}${banner}${content.slice(nl + 1)}`;
+  }
+
+  return `${banner}${content}`;
+}
+
+function bannerForExtension(ext) {
+  const line = `${MARKER} — do not edit as source of truth; regenerate with \`crudforge generate\`.`;
+  switch (ext) {
+    case '.ts':
+    case '.js':
+    case '.mjs':
+    case '.cjs':
+      return `// ${line}\n`;
+    case '.css':
+    case '.scss':
+    case '.sass':
+    case '.less':
+      return `/* ${line} */\n`;
+    case '.html':
+    case '.htm':
+    case '.svg':
+      return `<!-- ${line} -->\n`;
+    case '.md':
+    case '.markdown':
+      return `<!-- ${line} -->\n\n`;
+    case '.yml':
+    case '.yaml':
+    case '.env':
+    case '.gitignore':
+    case '.npmrc':
+    case '.editorconfig':
+      return `# ${line}\n`;
+    case '.sh':
+    case '.bash':
+      return `# ${line}\n`;
+    case '.csv':
+      // CSV: keep as a first comment-like row some tools ignore; prefer hash for our screen catalog.
+      return `# ${line}\n`;
+    default:
+      // Unknown text-ish extensions: use hash comments when safe enough for docs/config.
+      if (!ext) {
+        return null;
+      }
+      return null;
+  }
+}
+
+module.exports = {
+  MARKER,
+  stampGeneratedBanner,
+  bannerForExtension,
+};