create-authenik8-app 2.4.12 → 2.4.14

package/templates/fullstack/packages/api-client/src/index.ts

@@ -0,0 +1,203 @@
+import { csrfTokenSchema, registerSchema } from "@authenik8/contracts";
+import type {
+  AdminUserUpdateInput,
+  AuditEvent,
+  AuthResponse,
+  ChangePasswordInput,
+  LinkedProvider,
+  LoginInput,
+  Page,
+  ProfileInput,
+  Project,
+  ProjectCreateInput,
+  ProjectUpdateInput,
+  RegisterInput,
+  Session,
+  User,
+} from "@authenik8/contracts";
+
+export class ApiError extends Error {
+  constructor(
+    public readonly status: number,
+    public readonly code: string,
+    message: string,
+    public readonly fields?: Record<string, string[]>,
+  ) {
+    super(message);
+    this.name = "ApiError";
+  }
+}
+
+let accessToken: string | null = null;
+let refreshRequest: Promise<boolean> | null = null;
+let csrfToken: string | null = null;
+let csrfRequest: Promise<string> | null = null;
+
+export function setAccessToken(token: string | null): void {
+  accessToken = token;
+}
+
+export function hasAccessToken(): boolean {
+  return accessToken !== null;
+}
+
+async function parseResponse<T>(response: Response): Promise<T> {
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const error = body?.error;
+    throw new ApiError(
+      response.status,
+      error?.code ?? "REQUEST_FAILED",
+      error?.message ?? "The request could not be completed",
+      error?.fields,
+    );
+  }
+  return body as T;
+}
+
+async function getCsrfToken(force = false): Promise<string> {
+  if (force) {
+    csrfToken = null;
+    csrfRequest = null;
+  }
+  if (csrfToken) return csrfToken;
+
+  if (!csrfRequest) {
+    csrfRequest = fetch("/api/auth/csrf", {
+      credentials: "include",
+      headers: { Accept: "application/json" },
+    })
+      .then((response) => parseResponse<{ csrfToken: unknown }>(response))
+      .then((body) => {
+        const token = csrfTokenSchema.parse(body.csrfToken);
+        csrfToken = token;
+        return token;
+      })
+      .finally(() => {
+        csrfRequest = null;
+      });
+  }
+
+  return await csrfRequest;
+}
+
+function isUnsafeMethod(method: string): boolean {
+  return !["GET", "HEAD", "OPTIONS"].includes(method);
+}
+
+async function isCsrfRejection(response: Response): Promise<boolean> {
+  if (response.status !== 403) return false;
+  const body = await response.clone().json().catch(() => null);
+  return body?.error?.code === "CSRF_REJECTED";
+}
+
+async function requestTokenRefresh(forceCsrf = false): Promise<Response> {
+  const token = await getCsrfToken(forceCsrf);
+  const response = await fetch("/api/auth/refresh", {
+    method: "POST",
+    credentials: "include",
+    headers: { Accept: "application/json", "X-CSRF-Token": token },
+  });
+  if (!forceCsrf && await isCsrfRejection(response)) return requestTokenRefresh(true);
+  return response;
+}
+
+async function refreshAccessToken(): Promise<boolean> {
+  if (!refreshRequest) {
+    refreshRequest = requestTokenRefresh()
+      .then(async (response) => {
+        if (!response.ok) return false;
+        const result = await response.json() as AuthResponse;
+        accessToken = result.accessToken;
+        return true;
+      })
+      .catch(() => false)
+      .finally(() => {
+        refreshRequest = null;
+      });
+  }
+  return refreshRequest;
+}
+
+export async function apiFetch<T>(path: string, init: RequestInit = {}, retry = true): Promise<T> {
+  const headers = new Headers(init.headers);
+  const method = (init.method ?? "GET").toUpperCase();
+  headers.set("Accept", "application/json");
+  if (init.body && !(init.body instanceof FormData)) headers.set("Content-Type", "application/json");
+  if (accessToken) headers.set("Authorization", `Bearer ${accessToken}`);
+  if (isUnsafeMethod(method)) headers.set("X-CSRF-Token", await getCsrfToken());
+
+  const response = await fetch(`/api${path}`, { ...init, headers, credentials: "include" });
+  if (retry && isUnsafeMethod(method) && await isCsrfRejection(response)) {
+    await getCsrfToken(true);
+    return apiFetch<T>(path, init, false);
+  }
+  if (response.status === 401 && retry && path !== "/auth/refresh") {
+    if (await refreshAccessToken()) return apiFetch<T>(path, init, false);
+    accessToken = null;
+  }
+  return parseResponse<T>(response);
+}
+
+const json = (value: unknown) => JSON.stringify(value);
+
+export const authApi = {
+  register: (input: RegisterInput) => apiFetch<{ message: string; devVerificationToken?: string }>("/auth/register", {
+    method: "POST",
+    body: json(registerSchema.parse(input)),
+  }),
+  login: async (input: LoginInput) => {
+    const result = await apiFetch<AuthResponse>("/auth/login", { method: "POST", body: json(input) });
+    setAccessToken(result.accessToken);
+    return result;
+  },
+  restore: async () => {
+    const ok = await refreshAccessToken();
+    if (!ok) return null;
+    return apiFetch<{ user: User }>("/auth/me", {}, false);
+  },
+  logout: async () => {
+    try {
+      await apiFetch<{ message: string }>("/auth/logout", { method: "POST" }, false);
+    } finally {
+      setAccessToken(null);
+    }
+  },
+  exchangeOAuth: async (code: string) => {
+    const result = await apiFetch<AuthResponse>("/auth/oauth/exchange", { method: "POST", body: json({ code }) });
+    setAccessToken(result.accessToken);
+    return result;
+  },
+  forgotPassword: (email: string) => apiFetch<{ message: string; devResetToken?: string }>("/auth/forgot-password", { method: "POST", body: json({ email }) }),
+  resetPassword: (token: string, password: string) => apiFetch<{ message: string }>("/auth/reset-password", { method: "POST", body: json({ token, password }) }),
+  verifyEmail: (token: string) => apiFetch<{ message: string }>("/auth/verify-email", { method: "POST", body: json({ token }) }),
+  resendVerification: () => apiFetch<{ message: string; devVerificationToken?: string }>("/auth/resend-verification", { method: "POST" }),
+};
+
+export const accountApi = {
+  updateProfile: (input: ProfileInput) => apiFetch<{ user: User }>("/account/profile", { method: "PATCH", body: json(input) }),
+  changePassword: (input: ChangePasswordInput) => apiFetch<{ message: string }>("/account/password", { method: "PUT", body: json(input) }),
+  sessions: () => apiFetch<{ sessions: Session[] }>("/account/sessions"),
+  revokeSession: (id: string) => apiFetch<{ message: string }>(`/account/sessions/${id}`, { method: "DELETE" }),
+  providers: () => apiFetch<{ providers: LinkedProvider[] }>("/account/providers"),
+  startProviderLink: (provider: "google" | "github") => apiFetch<{ url: string }>(`/auth/oauth/${provider}/link-intent`, { method: "POST" }),
+};
+
+export const projectApi = {
+  list: () => apiFetch<{ projects: Project[] }>("/projects"),
+  get: (id: string) => apiFetch<{ project: Project }>(`/projects/${id}`),
+  create: (input: ProjectCreateInput) => apiFetch<{ project: Project }>("/projects", { method: "POST", body: json(input) }),
+  update: (id: string, input: ProjectUpdateInput) => apiFetch<{ project: Project }>(`/projects/${id}`, { method: "PATCH", body: json(input) }),
+  remove: (id: string) => apiFetch<void>(`/projects/${id}`, { method: "DELETE" }),
+};
+
+export const adminApi = {
+  users: (page = 1) => apiFetch<Page<User>>(`/admin/users?page=${page}`),
+  updateUser: (id: string, input: AdminUserUpdateInput) => apiFetch<{ user: User }>(`/admin/users/${id}`, { method: "PATCH", body: json(input) }),
+  revokeSessions: (id: string) => apiFetch<{ message: string }>(`/admin/users/${id}/sessions`, { method: "DELETE" }),
+  audit: () => apiFetch<{ events: AuditEvent[] }>("/admin/audit"),
+};
+
+export const healthApi = {
+  status: () => apiFetch<{ status: string; database: string; redis: string }>("/health/ready"),
+};

package/templates/fullstack/packages/api-client/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "lib": ["ES2022", "DOM"]
+  },
+  "include": ["src"]
+}

package/templates/fullstack/packages/contracts/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@authenik8/contracts",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3"
+  }
+}

package/templates/fullstack/packages/contracts/src/index.ts

@@ -0,0 +1,146 @@
+import { z } from "zod";
+
+const normalizedSingleLine = (minimum: number, maximum: number) => z.string()
+  .transform((value) => value.normalize("NFKC").trim().replace(/\s+/g, " "))
+  .pipe(z.string().min(minimum).max(maximum))
+  .refine((value) => !/[\u0000-\u001f\u007f]/.test(value), "Remove unsupported control characters");
+
+const normalizedDescription = z.string()
+  .transform((value) => value.normalize("NFKC").replace(/\r\n?/g, "\n").trim())
+  .pipe(z.string().max(2000))
+  .refine((value) => !/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value), "Remove unsupported control characters");
+
+export const roleSchema = z.enum(["USER", "ADMIN"]);
+export const userStatusSchema = z.enum(["ACTIVE", "SUSPENDED"]);
+export const projectStatusSchema = z.enum(["DRAFT", "ACTIVE", "ARCHIVED"]);
+export const oauthProviderSchema = z.enum(["google", "github"]);
+export const identifierSchema = z.string().trim().uuid("A valid identifier is required");
+export const pageSchema = z.coerce.number().int().min(1).max(10_000).default(1);
+export const csrfTokenSchema = z.string()
+  .regex(/^[A-Za-z0-9_-]{43}\.[A-Za-z0-9_-]{43}$/, "A valid CSRF token is required");
+
+const emailSchema = z.string()
+  .trim()
+  .toLowerCase()
+  .email("Enter a valid email address")
+  .max(254);
+
+const passwordSchema = z.string()
+  .min(10, "Use at least 10 characters")
+  .max(128)
+  .regex(/[a-z]/, "Include a lowercase letter")
+  .regex(/[A-Z]/, "Include an uppercase letter")
+  .regex(/[0-9]/, "Include a number")
+  .refine((value) => !/[\u0000-\u001f\u007f]/.test(value), "Password contains unsupported control characters");
+
+export const loginSchema = z.strictObject({
+  email: emailSchema,
+  password: z.string().min(1).max(128),
+});
+
+export const registerSchema = z.strictObject({
+  name: normalizedSingleLine(2, 80),
+  email: emailSchema,
+  password: passwordSchema,
+});
+
+export const forgotPasswordSchema = z.strictObject({ email: emailSchema });
+
+export const resetPasswordSchema = z.strictObject({
+  token: z.string().trim().min(32).max(256),
+  password: passwordSchema,
+});
+
+export const verificationSchema = z.strictObject({ token: z.string().trim().min(32).max(256) });
+export const oauthExchangeSchema = z.strictObject({ code: z.string().trim().min(32).max(256) });
+export const oauthLinkQuerySchema = z.strictObject({ ticket: z.string().trim().min(32).max(256) });
+
+export const profileSchema = z.strictObject({
+  name: normalizedSingleLine(2, 80),
+});
+
+export const changePasswordSchema = z.strictObject({
+  currentPassword: z.string().min(1).max(128),
+  newPassword: passwordSchema,
+});
+
+export const projectCreateSchema = z.strictObject({
+  name: normalizedSingleLine(2, 120),
+  description: normalizedDescription.default(""),
+  status: projectStatusSchema.default("DRAFT"),
+});
+
+export const projectUpdateSchema = projectCreateSchema.partial().refine(
+  (value) => Object.keys(value).length > 0,
+  "Provide at least one field",
+);
+
+export const adminUserUpdateSchema = z.strictObject({
+  role: roleSchema.optional(),
+  status: userStatusSchema.optional(),
+}).refine((value) => value.role !== undefined || value.status !== undefined, "Provide a role or status");
+
+export type Role = z.infer<typeof roleSchema>;
+export type UserStatus = z.infer<typeof userStatusSchema>;
+export type ProjectStatus = z.infer<typeof projectStatusSchema>;
+export type OAuthProvider = z.infer<typeof oauthProviderSchema>;
+export type CsrfToken = z.infer<typeof csrfTokenSchema>;
+export type LoginInput = z.infer<typeof loginSchema>;
+export type RegisterInput = z.infer<typeof registerSchema>;
+export type ProfileInput = z.infer<typeof profileSchema>;
+export type ChangePasswordInput = z.infer<typeof changePasswordSchema>;
+export type ProjectCreateInput = z.infer<typeof projectCreateSchema>;
+export type ProjectUpdateInput = z.infer<typeof projectUpdateSchema>;
+export type AdminUserUpdateInput = z.infer<typeof adminUserUpdateSchema>;
+
+export type User = {
+  id: string;
+  email: string;
+  name: string;
+  role: Role;
+  status: UserStatus;
+  verified: boolean;
+  createdAt: string;
+};
+
+export type Project = {
+  id: string;
+  name: string;
+  description: string;
+  status: ProjectStatus;
+  ownerId: string;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type Session = {
+  id: string;
+  userAgent: string;
+  ipAddress: string;
+  createdAt: string;
+  lastUsedAt: string;
+  expiresAt: string;
+  current: boolean;
+};
+
+export type LinkedProvider = {
+  provider: OAuthProvider;
+  providerEmail: string;
+  linkedAt: string;
+};
+
+export type AuditEvent = {
+  id: string;
+  action: string;
+  actorEmail: string | null;
+  targetType: string;
+  targetId: string | null;
+  createdAt: string;
+};
+
+export type AuthResponse = { accessToken: string; user: User };
+export type Page<T> = { items: T[]; total: number; page: number; pageSize: number };
+export type ApiErrorBody = {
+  error: { code: string; message: string; fields?: Record<string, string[]> };
+  requestId?: string;
+};

package/templates/fullstack/packages/contracts/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": true,
+    "skipLibCheck": true
+  },
+  "include": ["src"]
+}

package/templates/fullstack/packages/ui/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@authenik8/ui",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": ["dist"],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "peerDependencies": {
+    "react": "^19.2.0"
+  },
+  "devDependencies": {
+    "@types/react": "^19.2.0",
+    "react": "^19.2.0",
+    "typescript": "^6.0.3"
+  }
+}

package/templates/fullstack/packages/ui/src/index.tsx

@@ -0,0 +1,33 @@
+import type { ButtonHTMLAttributes, InputHTMLAttributes, ReactNode } from "react";
+import { forwardRef } from "react";
+
+export function Button({ className = "", variant = "primary", ...props }: ButtonHTMLAttributes<HTMLButtonElement> & { variant?: "primary" | "secondary" | "danger" | "ghost" }) {
+  return <button className={`button button-${variant} ${className}`.trim()} {...props} />;
+}
+
+export const Input = forwardRef<HTMLInputElement, InputHTMLAttributes<HTMLInputElement>>(function Input({ className = "", ...props }, ref) {
+  return <input ref={ref} className={`input ${className}`.trim()} {...props} />;
+});
+
+export function Card({ children, className = "" }: { children: ReactNode; className?: string }) {
+  return <section className={`card ${className}`.trim()}>{children}</section>;
+}
+
+export function Badge({ children, tone = "neutral" }: { children: ReactNode; tone?: "neutral" | "success" | "warning" | "danger" | "accent" }) {
+  return <span className={`badge badge-${tone}`}>{children}</span>;
+}
+
+export function Spinner({ label = "Loading" }: { label?: string }) {
+  return <span className="spinner" role="status" aria-label={label} />;
+}
+
+export function EmptyState({ icon, title, children, action }: { icon: ReactNode; title: string; children: ReactNode; action?: ReactNode }) {
+  return (
+    <div className="empty-state">
+      <div className="empty-icon" aria-hidden="true">{icon}</div>
+      <h2>{title}</h2>
+      <p>{children}</p>
+      {action}
+    </div>
+  );
+}

package/templates/fullstack/packages/ui/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "rootDir": "src",
+    "outDir": "dist",
+    "declaration": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "jsx": "react-jsx"
+  },
+  "include": ["src"]
+}

package/templates/prisma/postgresql/.env.example

@@ -1,6 +1,10 @@
 DATABASE_URL="postgresql://postgres:postgres@localhost:5432/authenik8?schema=public"
-JWT_SECRET="dev-jwt-secret-change-before-production-123456"
-REFRESH_SECRET="dev-refresh-secret-change-before-production-123456"
+AUTHENIK8_SIGNING_JWKS=
+AUTHENIK8_ACTIVE_KID=
+AUTHENIK8_ISSUER="http://localhost:3000"
+AUTHENIK8_AUDIENCE="authenik8-app-api"
+AUTHENIK8_AGENTS={}
+REFRESH_SECRET="replace-with-at-least-32-random-characters"
 REDIS_HOST="127.0.0.1"
 REDIS_PORT="6379"
 GOOGLE_CLIENT_ID="change-me-google-client-id"

package/templates/prisma/postgresql/client.ts

@@ -0,0 +1,17 @@
+import "dotenv/config";
+import { PrismaPg } from "@prisma/adapter-pg";
+import { PrismaClient } from "@prisma/client";
+
+const globalForPrisma = globalThis as unknown as {
+  prisma: PrismaClient | undefined;
+};
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) throw new Error("DATABASE_URL is required");
+
+const adapter = new PrismaPg({ connectionString: databaseUrl });
+export const prisma = globalForPrisma.prisma ?? new PrismaClient({ adapter });
+
+if (process.env.NODE_ENV !== "production") {
+  globalForPrisma.prisma = prisma;
+}

package/templates/prisma/postgresql/prisma.config.ts

@@ -0,0 +1,12 @@
+import "dotenv/config";
+import { defineConfig, env } from "prisma/config";
+
+export default defineConfig({
+  schema: "prisma/schema.prisma",
+  migrations: {
+    path: "prisma/migrations",
+  },
+  datasource: {
+    url: env("DATABASE_URL"),
+  },
+});

package/templates/prisma/postgresql/schema.prisma

@@ -4,7 +4,6 @@ generator client {
 
 datasource db {
   provider = "postgresql"
-  url      = env("DATABASE_URL")
 }
 
 model User {

package/templates/prisma/sqlite/.env.example

@@ -1,6 +1,10 @@
 DATABASE_URL="file:./dev.db"
-JWT_SECRET="dev-jwt-secret-change-before-production-123456"
-REFRESH_SECRET="dev-refresh-secret-change-before-production-123456"
+AUTHENIK8_SIGNING_JWKS=
+AUTHENIK8_ACTIVE_KID=
+AUTHENIK8_ISSUER="http://localhost:3000"
+AUTHENIK8_AUDIENCE="authenik8-app-api"
+AUTHENIK8_AGENTS={}
+REFRESH_SECRET="replace-with-at-least-32-random-characters"
 REDIS_HOST="127.0.0.1"
 REDIS_PORT="6379"
 GOOGLE_CLIENT_ID="change-me-google-client-id"

package/templates/prisma/sqlite/client.ts

@@ -0,0 +1,16 @@
+import "dotenv/config";
+import { PrismaBetterSqlite3 } from "@prisma/adapter-better-sqlite3";
+import { PrismaClient } from "@prisma/client";
+
+const globalForPrisma = globalThis as unknown as {
+  prisma: PrismaClient | undefined;
+};
+
+const adapter = new PrismaBetterSqlite3({
+  url: process.env.DATABASE_URL ?? "file:./dev.db",
+});
+export const prisma = globalForPrisma.prisma ?? new PrismaClient({ adapter });
+
+if (process.env.NODE_ENV !== "production") {
+  globalForPrisma.prisma = prisma;
+}

package/templates/prisma/sqlite/prisma.config.ts

@@ -0,0 +1,12 @@
+import "dotenv/config";
+import { defineConfig, env } from "prisma/config";
+
+export default defineConfig({
+  schema: "prisma/schema.prisma",
+  migrations: {
+    path: "prisma/migrations",
+  },
+  datasource: {
+    url: env("DATABASE_URL"),
+  },
+});

package/templates/prisma/sqlite/schema.prisma

@@ -4,7 +4,6 @@ generator client {
 
 datasource db {
   provider = "sqlite"
-  url      = env("DATABASE_URL")
 }
 
 model User {

package/dist/src/tests/templated-routes.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=templated-routes.test.d.ts.map

package/dist/src/tests/templated-routes.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"templated-routes.test.d.ts","sourceRoot":"","sources":["../../../src/tests/templated-routes.test.ts"],"names":[],"mappings":""}