create-authenik8-app 2.4.12 → 2.4.13

package/dist/src/tests/templated-routes.test.js

@@ -1,325 +0,0 @@
-import express from "express";
-import { createRequire } from "node:module";
-import request from "supertest";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-const authenik8CoreMock = vi.hoisted(() => ({
-    createAuthenik8: vi.fn(),
-}));
-const dotenvMock = vi.hoisted(() => ({
-    config: vi.fn(),
-}));
-vi.mock("authenik8-core", () => ({
-    createAuthenik8: authenik8CoreMock.createAuthenik8,
-}));
-vi.mock("dotenv", () => ({
-    default: dotenvMock,
-    config: dotenvMock.config,
-}));
-const require = createRequire(import.meta.url);
-const jwt = require("jsonwebtoken");
-const jwtSecret = "templated-route-test-secret";
-class InMemoryRedis {
-    hashes = new Map();
-    async hset(key, field, value) {
-        const hash = this.hashes.get(key) ?? new Map();
-        hash.set(field, value);
-        this.hashes.set(key, hash);
-        return 1;
-    }
-    async hgetall(key) {
-        return Object.fromEntries(this.hashes.get(key) ?? []);
-    }
-    async hdel(key, field) {
-        const hash = this.hashes.get(key);
-        if (!hash)
-            return 0;
-        return hash.delete(field) ? 1 : 0;
-    }
-    async del(key) {
-        return this.hashes.delete(key) ? 1 : 0;
-    }
-    async expire(_key, _ttl) {
-        return 1;
-    }
-    clear() {
-        this.hashes.clear();
-    }
-    async seedSession(userId, session) {
-        const storedSession = {
-            token: session.token ?? `stored-token-${session.sessionId}`,
-            device: session.device ?? "Chrome on Linux",
-            ip: session.ip ?? "127.0.0.1",
-            sessionId: session.sessionId,
-            createdAt: session.createdAt ?? "2026-05-02T00:00:00.000Z",
-        };
-        await this.hset(`sessions:${userId}`, session.sessionId, JSON.stringify(storedSession));
-        await this.expire(`sessions:${userId}`, 60 * 60);
-        return storedSession;
-    }
-}
-const redis = new InMemoryRedis();
-let redisForAuthFactory;
-const signTestToken = (payload) => jwt.sign(payload, jwtSecret);
-const adminToken = () => signTestToken({ id: "admin-user", role: "admin" });
-const userToken = () => signTestToken({ id: "regular-user", role: "user" });
-const getBearerToken = (authorization) => {
-    if (typeof authorization !== "string")
-        return undefined;
-    const [scheme, token] = authorization.split(" ");
-    return scheme === "Bearer" ? token : undefined;
-};
-const createAdminActions = (sessionStore) => ({
-    async listSessions(userId) {
-        const rawSessions = await sessionStore.hgetall(`sessions:${userId}`);
-        return Object.values(rawSessions).map((serializedSession) => JSON.parse(serializedSession));
-    },
-    async revokeSession(userId, sessionId) {
-        await sessionStore.hdel(`sessions:${userId}`, sessionId);
-    },
-    async revokeAllSessions(userId) {
-        await sessionStore.del(`sessions:${userId}`);
-    },
-});
-const createMockAuth = (sessionStore) => ({
-    requireAdmin(req, res, next) {
-        const token = getBearerToken(req.headers.authorization);
-        if (!token) {
-            return res.status(401).json({ error: "Unauthorized" });
-        }
-        try {
-            const decoded = jwt.verify(token, jwtSecret);
-            if (decoded.role !== "admin") {
-                return res.status(403).json({ error: "Forbidden" });
-            }
-            if (sessionStore) {
-                req.adminActions =
-                    createAdminActions(sessionStore);
-            }
-            next();
-        }
-        catch {
-            res.status(403).json({ error: "Forbidden" });
-        }
-    },
-    authenticateJWT(req, res, next) {
-        const token = getBearerToken(req.headers.authorization);
-        if (!token) {
-            return res.status(401).json({ error: "Unauthorized" });
-        }
-        try {
-            jwt.verify(token, jwtSecret);
-            next();
-        }
-        catch {
-            res.status(403).json({ error: "Forbidden" });
-        }
-    },
-    signToken: (payload) => jwt.sign(payload, jwtSecret),
-    verifyToken: async (token) => jwt.verify(token, jwtSecret),
-    guestToken: async (payload) => jwt.sign(payload, jwtSecret),
-    refreshToken: async () => ({
-        accessToken: jwt.sign({ id: "refreshed-user", role: "user" }, jwtSecret),
-        refreshToken: "next-refresh-token",
-    }),
-    incognito: vi.fn(),
-    rateLimit: (_req, _res, next) => next(),
-    ipWhitelist: (_req, _res, next) => next(),
-    helmet: (_req, _res, next) => next(),
-});
-const appWithRouter = (router) => {
-    const app = express();
-    app.use(express.json());
-    app.use(router);
-    return app;
-};
-const send = (app, method, path) => {
-    if (method === "delete") {
-        return request(app).delete(path);
-    }
-    return request(app).get(path);
-};
-const routeTemplates = [
-    {
-        name: "templates/express-auth/src/routes/protected.routes.ts",
-        guardedRoute: {
-            method: "get",
-            path: "/protected",
-            expectedBody: { message: "Protected route" },
-        },
-        async createApp(sessionStore) {
-            const { createProtectedRoutes } = await import("../../templates/express-auth/src/routes/protected.routes.js");
-            return appWithRouter(createProtectedRoutes(createMockAuth(sessionStore)));
-        },
-    },
-    {
-        name: "templates/express-base/routes/base.routes.ts",
-        guardedRoute: {
-            method: "get",
-            path: "/admin",
-            expectedBody: { message: "Admin only" },
-        },
-        async createApp(sessionStore) {
-            const { createBaseRoutes } = await import("../../templates/express-base/routes/base.routes.js");
-            return appWithRouter(createBaseRoutes(createMockAuth(sessionStore)));
-        },
-    },
-    //{
-    //name: "templates/express-auth+/src/auth/routes/protected.routes.ts",
-    // guardedRoute: {
-    // method: "get",
-    //path: "/protected",
-    //expectedBody: { message: "Protected route" },
-    //},
-    //async createApp(sessionStore?: InMemoryRedis) {
-    //redisForAuthFactory = sessionStore;
-    //const [  { default: protectedRoutes }] = await Promise.all([
-    //import("../../templates/express-auth+/src/auth/auth.js"),
-    //import("../../templates/express-auth+/src/auth/routes/protected.routes.js"),
-    //]);
-    //const authModule = await import("../../templates/express-auth+/src/auth/auth.js");
-    //const routesModule = await import("../../templates/express-auth+/src/auth/routes/protected.routes.js");
-    //await authModule.initAuth();
-    //      await initAuth();
-    // /const protectedRoutes = routesModule.default as unknown as Router ;
-    //  return appWithRouter(protectedRoutes);
-    //},
-    //},
-];
-const sessionRoutes = [
-    {
-        name: "list sessions",
-        method: "get",
-        path: "/admin/sessions/user-a",
-    },
-    {
-        name: "revoke one session",
-        method: "delete",
-        path: "/admin/sessions/user-a/session-a",
-    },
-    {
-        name: "revoke all sessions",
-        method: "delete",
-        path: "/admin/sessions/user-a",
-    },
-];
-beforeEach(() => {
-    vi.resetModules();
-    vi.stubEnv("JWT_SECRET", "templated-route-test-jwt-secret-32");
-    vi.stubEnv("REFRESH_SECRET", "templated-route-test-refresh-secret-32");
-    vi.stubEnv("GOOGLE_CLIENT_ID", "google-client-id");
-    vi.stubEnv("GOOGLE_CLIENT_SECRET", "google-client-secret");
-    vi.stubEnv("GOOGLE_REDIRECT_URI", "https://example.com/auth/google/callback");
-    vi.stubEnv("GITHUB_CLIENT_ID", "github-client-id");
-    vi.stubEnv("GITHUB_CLIENT_SECRET", "github-client-secret");
-    vi.stubEnv("GITHUB_REDIRECT_URI", "https://example.com/auth/github/callback");
-    redis.clear();
-    redisForAuthFactory = undefined;
-    dotenvMock.config.mockReset();
-    authenik8CoreMock.createAuthenik8.mockReset();
-    authenik8CoreMock.createAuthenik8.mockImplementation(async () => createMockAuth(redisForAuthFactory));
-});
-describe.each(routeTemplates)("$name", (template) => {
-    describe("admin guard", () => {
-        const guardedRoutes = [template.guardedRoute, ...sessionRoutes];
-        it.each(guardedRoutes)("returns 401 with no token for $method $path", async (route) => {
-            const app = await template.createApp(redis);
-            const response = await send(app, route.method, route.path);
-            expect(response.status).toBe(401);
-        });
-        it.each(guardedRoutes)("returns 403 for non-admin users on $method $path", async (route) => {
-            const app = await template.createApp(redis);
-            const response = await send(app, route.method, route.path).set("Authorization", `Bearer ${userToken()}`);
-            expect(response.status).toBe(403);
-        });
-        it.each(guardedRoutes)("returns 403 for unauthenticated invalid tokens on $method $path", async (route) => {
-            const app = await template.createApp(redis);
-            const response = await send(app, route.method, route.path).set("Authorization", "Bearer not-a-valid-token");
-            expect(response.status).toBe(403);
-        });
-        it(`returns the happy path response for ${template.guardedRoute.method} ${template.guardedRoute.path}`, async () => {
-            const app = await template.createApp(redis);
-            const response = await send(app, template.guardedRoute.method, template.guardedRoute.path).set("Authorization", `Bearer ${adminToken()}`);
-            expect(response.status).toBe(200);
-            expect(response.body).toEqual(template.guardedRoute.expectedBody);
-        });
-    });
-    describe("session management", () => {
-        it.each(sessionRoutes)("returns 503 for $method $path when Redis is not configured", async (route) => {
-            const app = await template.createApp(undefined);
-            const response = await send(app, route.method, route.path).set("Authorization", `Bearer ${adminToken()}`);
-            expect(response.status).toBe(503);
-            expect(response.body).toEqual({
-                success: false,
-                message: "Session management unavailable",
-            });
-        });
-        it("lists sessions without exposing stored tokens", async () => {
-            const app = await template.createApp(redis);
-            await redis.seedSession("user-a", {
-                sessionId: "session-a",
-                token: "sensitive-token-a",
-                device: "Firefox on macOS",
-                ip: "10.0.0.1",
-            });
-            await redis.seedSession("user-a", {
-                sessionId: "session-b",
-                token: "sensitive-token-b",
-                device: "Safari on iOS",
-                ip: "10.0.0.2",
-            });
-            const response = await request(app)
-                .get("/admin/sessions/user-a")
-                .set("Authorization", `Bearer ${adminToken()}`);
-            expect(response.status).toBe(200);
-            expect(response.body.sessions).toEqual([
-                {
-                    device: "Firefox on macOS",
-                    ip: "10.0.0.1",
-                    sessionId: "session-a",
-                    createdAt: "2026-05-02T00:00:00.000Z",
-                },
-                {
-                    device: "Safari on iOS",
-                    ip: "10.0.0.2",
-                    sessionId: "session-b",
-                    createdAt: "2026-05-02T00:00:00.000Z",
-                },
-            ]);
-            expect(JSON.stringify(response.body)).not.toContain("sensitive-token");
-            expect(response.body.sessions).toEqual(expect.arrayContaining([expect.not.objectContaining({ token: expect.anything() })]));
-        });
-        it("revokes one session without affecting other sessions or users", async () => {
-            const app = await template.createApp(redis);
-            await redis.seedSession("user-a", { sessionId: "session-a", token: "user-a-token-a" });
-            await redis.seedSession("user-a", { sessionId: "session-b", token: "user-a-token-b" });
-            await redis.seedSession("user-b", { sessionId: "session-c", token: "user-b-token-c" });
-            const response = await request(app)
-                .delete("/admin/sessions/user-a/session-a")
-                .set("Authorization", `Bearer ${adminToken()}`);
-            expect(response.status).toBe(200);
-            expect(response.body).toEqual({ success: true, message: "Session revoked" });
-            expect(await redis.hgetall("sessions:user-a")).toEqual({
-                "session-b": expect.any(String),
-            });
-            expect(await redis.hgetall("sessions:user-b")).toEqual({
-                "session-c": expect.any(String),
-            });
-        });
-        it("revokes all sessions for only the targeted user", async () => {
-            const app = await template.createApp(redis);
-            await redis.seedSession("user-a", { sessionId: "session-a", token: "user-a-token-a" });
-            await redis.seedSession("user-a", { sessionId: "session-b", token: "user-a-token-b" });
-            await redis.seedSession("user-b", { sessionId: "session-c", token: "user-b-token-c" });
-            const response = await request(app)
-                .delete("/admin/sessions/user-a")
-                .set("Authorization", `Bearer ${adminToken()}`);
-            expect(response.status).toBe(200);
-            expect(response.body).toEqual({ success: true, message: "All sessions revoked" });
-            expect(await redis.hgetall("sessions:user-a")).toEqual({});
-            expect(await redis.hgetall("sessions:user-b")).toEqual({
-                "session-c": expect.any(String),
-            });
-        });
-    });
-});
-//# sourceMappingURL=templated-routes.test.js.map

package/dist/src/tests/templated-routes.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"templated-routes.test.js","sourceRoot":"","sources":["../../../src/tests/templated-routes.test.ts"],"names":[],"mappings":"AAAA,OAAO,OAAsC,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,iBAAiB,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;CACzB,CAAC,CAAC,CAAC;AACJ,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;CAChB,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,eAAe,EAAE,iBAAiB,CAAC,eAAe;CACnD,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IACvB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,UAAU,CAAC,MAAM;CAC1B,CAAC,CAAC,CAAC;AAEJ,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAGjC,CAAC;AAEF,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAYhD,MAAM,aAAa;IACA,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEjE,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,KAAa;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;QAC/D,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,KAAa;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAAY;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,OAAuD;QACvF,MAAM,aAAa,GAAkB;YACnC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,gBAAgB,OAAO,CAAC,SAAS,EAAE;YAC3D,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,iBAAiB;YAC3C,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,WAAW;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,0BAA0B;SAC3D,CAAC;QAEF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,MAAM,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,OAAO,aAAa,CAAC;IACvB,CAAC;CACF;AAED,MAAM,KAAK,GAAG,IAAI,aAAa,EAAE,CAAC;AAClC,IAAI,mBAA8C,CAAC;AAEnD,MAAM,aAAa,GAAG,CAAC,OAAqC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAE9F,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5E,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5E,MAAM,cAAc,GAAG,CAAC,aAAsB,EAAE,EAAE;IAChD,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,YAA2B,EAAE,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;QAErE,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CACnC,CAAC,iBAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAkB,CACtE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,SAAiB;QACnD,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,MAAM,YAAY,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,YAA4B,EAAE,EAAE,CAAC,CAAC;IACxD,YAAY,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B;QAClF,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAExD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAE7C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,YAAY,EAAE,CAAC;gBAChB,GAAkF,CAAC,YAAY;oBAC9F,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,eAAe,CAAC,GAAoB,EAAE,GAAqB,EAAE,IAA0B;QACrF,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAExD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC7B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,SAAS,EAAE,CAAC,OAAgC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;IAC7E,WAAW,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;IAClE,UAAU,EAAE,KAAK,EAAE,OAAgC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;IACpF,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACzB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC;QACxE,YAAY,EAAE,oBAAoB;KACnC,CAAC;IACF,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE;IAClB,SAAS,EAAE,CAAC,IAAqB,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE,CAAC,IAAI,EAAE;IAChG,WAAW,EAAE,CAAC,IAAqB,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE,CAAC,IAAI,EAAE;IAClG,MAAM,EAAE,CAAC,IAAqB,EAAE,IAAsB,EAAE,IAA0B,EAAE,EAAE,CAAC,IAAI,EAAE;CAC9F,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,EAAE;IACvC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,MAAkB,EAAE,IAAY,EAAE,EAAE;IAC9D,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC;AAQF,MAAM,cAAc,GAAoB;IACtC;QACE,IAAI,EAAE,uDAAuD;QAC7D,YAAY,EAAE;YACZ,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY;YAClB,YAAY,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE;SAC7C;QACD,KAAK,CAAC,SAAS,CAAC,YAA4B;YAC1C,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAC5C,6DAA6D,CAC9D,CAAC;YAEF,OAAO,aAAa,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;KACF;IACD;QACE,IAAI,EAAE,8CAA8C;QACpD,YAAY,EAAE;YACZ,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;SACxC;QACD,KAAK,CAAC,SAAS,CAAC,YAA4B;YAC1C,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;YAEhG,OAAO,aAAa,CAAC,gBAAgB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;KACF;IACD,GAAG;IACD,sEAAsE;IACvE,kBAAkB;IAChB,iBAAiB;IAChB,qBAAqB;IACrB,+CAA+C;IACjD,IAAI;IACJ,iDAAiD;IAC/C,qCAAqC;IACrC,8DAA8D;IAC5D,2DAA2D;IAC3D,8EAA8E;IAChF,KAAK;IACX,oFAAoF;IAClF,yGAAyG;IAEzG,8BAA8B;IAEhC,yBAAyB;IACrB,uEAAuE;IACvE,0CAA0C;IAC1C,IAAI;IACN,IAAI;CACL,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB;QACE,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,KAAc;QACtB,IAAI,EAAE,wBAAwB;KAC/B;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,QAAiB;QACzB,IAAI,EAAE,kCAAkC;KACzC;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,QAAiB;QACzB,IAAI,EAAE,wBAAwB;KAC/B;CACF,CAAC;AAEF,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,YAAY,EAAE,CAAC;IAClB,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,oCAAoC,CAAC,CAAC;IAC/D,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC;IACvE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACnD,EAAE,CAAC,OAAO,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;IAC3D,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAC9E,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACnD,EAAE,CAAC,OAAO,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;IAC3D,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;IAC9E,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,mBAAmB,GAAG,SAAS,CAAC;IAChC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IAC9B,iBAAiB,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC;IAC9C,iBAAiB,CAAC,eAAe,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAC9D,cAAc,CAAC,mBAAmB,CAAC,CACpC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;IAClD,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,aAAa,CAAC,CAAC;QAEhE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,6CAA6C,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACpF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE3D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,kDAAkD,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACzF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAC5D,eAAe,EACf,UAAU,SAAS,EAAE,EAAE,CACxB,CAAC;YAEF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CACpB,iEAAiE,EACjE,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAC5D,eAAe,EACf,0BAA0B,CAC3B,CAAC;YAEF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC,CACF,CAAC;QAEF,EAAE,CAAC,uCAAuC,QAAQ,CAAC,YAAY,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;YACjH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CACzB,GAAG,EACH,QAAQ,CAAC,YAAY,CAAC,MAAM,EAC5B,QAAQ,CAAC,YAAY,CAAC,IAAI,CAC3B,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC,CAAC;YAEjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CACpB,4DAA4D,EAC5D,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAEhD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAC5D,eAAe,EACf,UAAU,UAAU,EAAE,EAAE,CACzB,CAAC;YAEF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC5B,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,gCAAgC;aAC1C,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;gBAChC,SAAS,EAAE,WAAW;gBACtB,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,kBAAkB;gBAC1B,EAAE,EAAE,UAAU;aACf,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;gBAChC,SAAS,EAAE,WAAW;gBACtB,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,eAAe;gBACvB,EAAE,EAAE,UAAU;aACf,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,GAAG,CAAC,wBAAwB,CAAC;iBAC7B,GAAG,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC,CAAC;YAElD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;gBACrC;oBACE,MAAM,EAAE,kBAAkB;oBAC1B,EAAE,EAAE,UAAU;oBACd,SAAS,EAAE,WAAW;oBACtB,SAAS,EAAE,0BAA0B;iBACtC;gBACD;oBACE,MAAM,EAAE,eAAe;oBACvB,EAAE,EAAE,UAAU;oBACd,SAAS,EAAE,WAAW;oBACtB,SAAS,EAAE,0BAA0B;iBACtC;aACF,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACvE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CACpC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CACpF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvF,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvF,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAEvF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,MAAM,CAAC,kCAAkC,CAAC;iBAC1C,GAAG,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC,CAAC;YAElD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;aAChC,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;aAChC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvF,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvF,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAEvF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,MAAM,CAAC,wBAAwB,CAAC;iBAChC,GAAG,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,EAAE,CAAC,CAAC;YAElD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAClF,MAAM,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;gBACrD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;aAChC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/templates/THREAT_MODEL.md

@@ -1,138 +0,0 @@
-# Authenik8 Generated App Threat Model
-
-This document describes what a generated Authenik8 app is designed to help with, what it does not solve for you, and what you must configure before production use.
-
-## System Boundary
-
-A generated app includes:
-
-- Express API routes.
-- JWT access tokens.
-- Redis-backed refresh-token rotation.
-- Prisma database schema.
-- Optional Google/GitHub OAuth.
-- Authenik8 security middleware: Helmet, rate limiting, and optional IP whitelist.
-- Optional PM2 production process config.
-
-External systems are outside the generated app boundary:
-
-- Browser or mobile frontend.
-- OAuth provider dashboards.
-- Redis hosting.
-- SQL database hosting.
-- TLS termination and reverse proxy.
-- Secret management.
-- Email delivery, MFA, and password reset flows unless you add them.
-
-## Assets Protected
-
-- Access tokens.
-- Refresh tokens.
-- OAuth authorization state.
-- OAuth identity records.
-- User IDs, emails, roles, and provider links.
-- Redis-backed session state.
-- Admin-only routes.
-
-## Trust Assumptions
-
-- `JWT_SECRET` and `REFRESH_SECRET` are long, random, private values.
-- Redis is private to the app and not exposed to the public internet.
-- Database credentials are private.
-- OAuth callback URLs match provider dashboard settings exactly.
-- Production traffic uses HTTPS.
-- Reverse proxy headers are trusted only when you control the proxy.
-- Developers validate and authorize their own business-domain routes.
-
-## Threats Addressed
-
-### Refresh-token replay
-
-Refresh tokens are stateful. The currently valid refresh token is stored in Redis under `refresh:<userId>`. When a refresh succeeds, Authenik8-core rotates the refresh token and replaces the Redis value. Reusing an old refresh token fails.
-
-### Concurrent refresh abuse
-
-Refresh requests acquire a Redis lock under `lock:<userId>`. Two simultaneous refresh attempts for the same user should not both rotate successfully.
-
-### Stateless JWT logout limitations
-
-Access-token sessions are persisted in Redis under `sessions:<userId>`. Admin helpers can list sessions and revoke one or all sessions for a user.
-
-### Basic request flooding
-
-`auth.rateLimit` uses Redis-backed rate limiting. Generated apps apply it globally by default.
-
-### Common HTTP header risks
-
-`auth.helmet` applies secure HTTP headers through Helmet.
-
-### OAuth CSRF/state tampering
-
-OAuth redirects generate random state and store it in Redis for five minutes under `oauth:state:<state>`. Callback handlers reject missing, invalid, or expired state.
-
-### Duplicate OAuth identities
-
-OAuth profiles are normalized into provider, provider ID, email, name, and email verification status. The Identity Engine checks provider and email records before creating a new identity.
-
-### Unverified OAuth email token issuance
-
-`issueTokensFromProfile` rejects OAuth profiles whose email is not verified.
-
-### Admin-route access
-
-`auth.requireAdmin` checks for a valid JWT with `role: "admin"`.
-
-## Threats Not Fully Addressed
-
-### XSS in your frontend
-
-If frontend JavaScript is compromised, tokens stored in memory or browser storage can be stolen. Use a strong frontend CSP, avoid unsafe HTML rendering, and choose token storage deliberately.
-
-### CSRF for cookie-based auth
-
-Generated examples use bearer tokens. If you move tokens into cookies, add CSRF protection and strict cookie settings.
-
-### Weak or leaked secrets
-
-Authenik8 cannot protect tokens if `JWT_SECRET` or `REFRESH_SECRET` is short, reused, committed, logged, or leaked.
-
-### Public Redis exposure
-
-Redis must not be reachable from the public internet. Use private networking, authentication, TLS where available, and provider-level access controls.
-
-### Database authorization bugs
-
-Authenik8 authenticates users and provides route middleware. Your application must still enforce object-level authorization, ownership checks, and tenant isolation.
-
-### Password reset, email verification, MFA, and WebAuthn
-
-These are not included unless you add them.
-
-### OAuth provider compromise or misconfiguration
-
-Provider dashboard settings, app approval screens, callback URLs, and provider secrets must be managed outside the generated app.
-
-### Brute-force protection per credential
-
-Global rate limiting is included. Add stricter per-email or per-account login throttling for high-risk apps.
-
-### Token theft before expiry
-
-Short-lived access tokens reduce exposure, but a stolen access token can be used until it expires or is rejected by your session policy.
-
-## Production Checklist
-
-- Replace generated development secrets with long random values.
-- Run Redis on private networking.
-- Run Postgres or your database on private networking.
-- Use HTTPS only.
-- Set exact OAuth callback URLs in Google/GitHub dashboards.
-- Use `npx prisma migrate deploy` in production.
-- Review CORS policy before connecting a frontend.
-- Add business-level authorization checks to every protected resource route.
-- Add logging and alerting for refresh failures, OAuth failures, and admin actions.
-- Keep `authenik8-core` and generated dependencies updated.
-
-## Security Reporting
-
-If you find a vulnerability in the generated app or Authenik8-core integration, do not publish exploit details publicly first. Open a private security report or contact the maintainer through the repository security policy.

package/dist/templates/express-auth/src/controllers/protected.controller.d.ts

@@ -1,8 +0,0 @@
-import { Request, Response } from "express";
-export declare const createProtectedController: () => {
-    protected(req: Request, res: Response): void;
-    listSessions(req: Request, res: Response): Promise<Response<any, Record<string, any>> | undefined>;
-    revokeSession(req: Request, res: Response): Promise<Response<any, Record<string, any>> | undefined>;
-    revokeAllSessions(req: Request, res: Response): Promise<Response<any, Record<string, any>> | undefined>;
-};
-//# sourceMappingURL=protected.controller.d.ts.map

package/dist/templates/express-auth/src/controllers/protected.controller.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"protected.controller.d.ts","sourceRoot":"","sources":["../../../../../templates/express-auth/src/controllers/protected.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG5C,eAAO,MAAM,yBAAyB;mBACrB,OAAO,OAAO,QAAQ;sBAIb,OAAO,OAAO,QAAQ;uBAcrB,OAAO,OAAO,QAAQ;2BAclB,OAAO,OAAO,QAAQ;CAanD,CAAC"}

package/dist/templates/express-auth/src/controllers/protected.controller.js

@@ -1,50 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createProtectedController = void 0;
-const security_1 = require("../utils/security");
-const createProtectedController = () => ({
-    protected(req, res) {
-        res.json({ message: "Protected route" });
-    },
-    async listSessions(req, res) {
-        try {
-            const actions = req.adminActions;
-            if (!actions) {
-                return res.status(503).json({ success: false, message: "Session management unavailable" });
-            }
-            const sessions = await actions.listSessions(req.params.userId);
-            res.json({ sessions: (0, security_1.sanitizeSessionResponse)(sessions) });
-        }
-        catch {
-            res.status(500).json({ success: false, message: "Failed to retrieve sessions" });
-        }
-    },
-    async revokeSession(req, res) {
-        try {
-            const actions = req.adminActions;
-            if (!actions) {
-                return res.status(503).json({ success: false, message: "Session management unavailable" });
-            }
-            await actions.revokeSession(req.params.userId, req.params.sessionId);
-            res.json({ success: true, message: "Session revoked" });
-        }
-        catch {
-            res.status(500).json({ success: false, message: "Failed to revoke session" });
-        }
-    },
-    async revokeAllSessions(req, res) {
-        try {
-            const actions = req.adminActions;
-            if (!actions) {
-                return res.status(503).json({ success: false, message: "Session management unavailable" });
-            }
-            await actions.revokeAllSessions(req.params.userId);
-            res.json({ success: true, message: "All sessions revoked" });
-        }
-        catch {
-            res.status(500).json({ success: false, message: "Failed to revoke sessions" });
-        }
-    },
-});
-exports.createProtectedController = createProtectedController;
-//# sourceMappingURL=protected.controller.js.map

package/dist/templates/express-auth/src/controllers/protected.controller.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"protected.controller.js","sourceRoot":"","sources":["../../../../../templates/express-auth/src/controllers/protected.controller.ts"],"names":[],"mappings":";;;AACA,gDAA4D;AAErD,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAAC,CAAC;IAC9C,SAAS,CAAC,GAAY,EAAE,GAAa;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa;QAC5C,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,GAAW,CAAC,YAAY,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC7F,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAA,kCAAuB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,GAAW,CAAC,YAAY,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC7F,CAAC;YAED,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAY,EAAE,GAAa;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,GAAW,CAAC,YAAY,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAC7F,CAAC;YAED,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AA9CU,QAAA,yBAAyB,6BA8CnC"}

package/dist/templates/express-auth/src/routes/protected.routes.d.ts

@@ -1,2 +0,0 @@
-export declare const createProtectedRoutes: (auth: any) => import("express-serve-static-core").Router;
-//# sourceMappingURL=protected.routes.d.ts.map

package/dist/templates/express-auth/src/routes/protected.routes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"protected.routes.d.ts","sourceRoot":"","sources":["../../../../../templates/express-auth/src/routes/protected.routes.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,qBAAqB,GAAI,MAAM,GAAG,+CAU9C,CAAC"}

package/dist/templates/express-auth/src/routes/protected.routes.js

@@ -1,16 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createProtectedRoutes = void 0;
-const express_1 = require("express");
-const protected_controller_1 = require("../controllers/protected.controller");
-const createProtectedRoutes = (auth) => {
-    const router = (0, express_1.Router)();
-    const controller = (0, protected_controller_1.createProtectedController)();
-    router.get("/protected", auth.requireAdmin, controller.protected);
-    router.get("/admin/sessions/:userId", auth.requireAdmin, controller.listSessions);
-    router.delete("/admin/sessions/:userId/:sessionId", auth.requireAdmin, controller.revokeSession);
-    router.delete("/admin/sessions/:userId", auth.requireAdmin, controller.revokeAllSessions);
-    return router;
-};
-exports.createProtectedRoutes = createProtectedRoutes;
-//# sourceMappingURL=protected.routes.js.map

package/dist/templates/express-auth/src/routes/protected.routes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"protected.routes.js","sourceRoot":"","sources":["../../../../../templates/express-auth/src/routes/protected.routes.ts"],"names":[],"mappings":";;;AAAA,qCAAiC;AACjC,8EAAgF;AAEzE,MAAM,qBAAqB,GAAG,CAAC,IAAS,EAAE,EAAE;IACjD,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IACxB,MAAM,UAAU,GAAG,IAAA,gDAAyB,GAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;IAClF,MAAM,CAAC,MAAM,CAAC,oCAAoC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IACjG,MAAM,CAAC,MAAM,CAAC,yBAAyB,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAE1F,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAVW,QAAA,qBAAqB,yBAUhC"}

package/dist/templates/express-auth/src/utils/security.d.ts

@@ -1,8 +0,0 @@
-export declare function requiredSecret(name: string): string;
-export declare function parseCredentials(body: unknown): {
-    email: string;
-    password: string;
-};
-export declare function parseRefreshToken(body: unknown): string;
-export declare function sanitizeSessionResponse(value: unknown): unknown;
-//# sourceMappingURL=security.d.ts.map

package/dist/templates/express-auth/src/utils/security.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../../templates/express-auth/src/utils/security.ts"],"names":[],"mappings":"AAEA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO;;;EAyB7C;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,UAY9C;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAc/D"}

package/dist/templates/express-auth/src/utils/security.js

@@ -1,55 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredSecret = requiredSecret;
-exports.parseCredentials = parseCredentials;
-exports.parseRefreshToken = parseRefreshToken;
-exports.sanitizeSessionResponse = sanitizeSessionResponse;
-const sensitiveKeys = new Set(["token", "accessToken", "refreshToken"]);
-function requiredSecret(name) {
-    const value = process.env[name];
-    if (typeof value !== "string" || value.trim().length < 32) {
-        throw new Error(`${name} must be set to at least 32 characters`);
-    }
-    return value;
-}
-function parseCredentials(body) {
-    if (!body || typeof body !== "object") {
-        throw new Error("Email and password are required");
-    }
-    const { email, password } = body;
-    if (typeof email !== "string" || typeof password !== "string") {
-        throw new Error("Email and password are required");
-    }
-    const normalizedEmail = email.trim().toLowerCase();
-    const atIndex = normalizedEmail.indexOf("@");
-    const dotIndex = normalizedEmail.lastIndexOf(".");
-    if (atIndex < 1 || atIndex !== normalizedEmail.lastIndexOf("@") || dotIndex < atIndex + 2 || dotIndex === normalizedEmail.length - 1) {
-        throw new Error("A valid email is required");
-    }
-    if (password.length < 8 || password.length > 1024) {
-        throw new Error("Password must be between 8 and 1024 characters");
-    }
-    return { email: normalizedEmail, password };
-}
-function parseRefreshToken(body) {
-    if (!body || typeof body !== "object") {
-        throw new Error("Refresh token is required");
-    }
-    const { refreshToken } = body;
-    if (typeof refreshToken !== "string" || refreshToken.trim().length < 16) {
-        throw new Error("Refresh token is required");
-    }
-    return refreshToken;
-}
-function sanitizeSessionResponse(value) {
-    if (Array.isArray(value)) {
-        return value.map(sanitizeSessionResponse);
-    }
-    if (!value || typeof value !== "object") {
-        return value;
-    }
-    return Object.fromEntries(Object.entries(value)
-        .filter(([key]) => !sensitiveKeys.has(key))
-        .map(([key, nestedValue]) => [key, sanitizeSessionResponse(nestedValue)]));
-}
-//# sourceMappingURL=security.js.map