create-authenik8-app 2.4.12 → 2.4.14

package/templates/express-auth+/src/utils/security.ts

@@ -1,49 +1,130 @@
+import { z } from "zod";
+import type { AgentIdentityConfig, Authenik8JwkConfig } from "authenik8-core";
+
 const sensitiveKeys = new Set(["token", "accessToken", "refreshToken"]);
 
-export function requiredSecret(name: string): string {
-  const value = process.env[name];
+const passwordSchema = z.string()
+  .min(8, "Password must be between 8 and 1024 characters")
+  .max(1024, "Password must be between 8 and 1024 characters")
+  .refine((password) => !/[\u0000-\u001f\u007f]/.test(password), "Password contains unsupported control characters");
+
+export const credentialsSchema = z.strictObject({
+  email: z.string().trim().toLowerCase().email("A valid email is required").max(254),
+  password: passwordSchema,
+});
+
+const secretSchema = z.string().trim().min(32);
+const environmentValueSchema = z.string().trim().min(1);
+const portSchema = z.coerce.number().int().min(1).max(65535);
+const signingJwkSchema = z.object({
+  kty: z.literal("EC"),
+  crv: z.literal("P-256"),
+  x: z.string().min(1),
+  y: z.string().min(1),
+  d: z.string().min(1).optional(),
+  kid: z.string().min(1),
+  alg: z.literal("ES256").optional(),
+  use: z.literal("sig").optional(),
+});
+const identifierSchema = z.string()
+  .trim()
+  .min(1)
+  .max(128)
+  .regex(/^[A-Za-z0-9._:-]+$/);
+const agentIdSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+const agentScopeSchema = z.string().max(128).regex(/^[a-z][a-z0-9._/-]*(?::[a-z][a-z0-9._/-]*)+$/);
+const agentRegistrySchema = z.record(
+  agentIdSchema,
+  z.array(agentScopeSchema).min(1).max(64),
+);
+
+export class InputValidationError extends Error {}
+
+function validationMessage(error: z.ZodError, fallback: string): string {
+  return error.issues[0]?.message ?? fallback;
+}
 
-  if (typeof value !== "string" || value.trim().length < 32) {
-    throw new Error(`${name} must be set to at least 32 characters`);
+export function requiredSecret(name: string): string {
+  const result = secretSchema.safeParse(process.env[name]);
+  if (!result.success) {
+    throw new InputValidationError(`${name} must be set to at least 32 characters`);
   }
-
-  return value;
+  return result.data;
 }
 
 export function requiredEnv(name: string): string {
-  const value = process.env[name];
-
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw new Error(`${name} must be set`);
-  }
+  const result = environmentValueSchema.safeParse(process.env[name]);
+  if (!result.success) throw new InputValidationError(`${name} must be set`);
+  return result.data;
+}
 
-  return value;
+export function requiredPort(): number {
+  const result = portSchema.safeParse(process.env.PORT ?? 3000);
+  if (!result.success) throw new InputValidationError("PORT must be between 1 and 65535");
+  return result.data;
 }
 
-export function parseCredentials(body: unknown) {
-  if (!body || typeof body !== "object") {
-    throw new Error("Email and password are required");
+export function authJwkConfig(): Authenik8JwkConfig {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(requiredEnv("AUTHENIK8_SIGNING_JWKS"));
+  } catch {
+    throw new InputValidationError("AUTHENIK8_SIGNING_JWKS must be a valid JSON array");
   }
-
-  const { email, password } = body as { email?: unknown; password?: unknown };
-
-  if (typeof email !== "string" || typeof password !== "string") {
-    throw new Error("Email and password are required");
+  const result = z.array(signingJwkSchema).min(1).safeParse(parsed);
+  if (!result.success) {
+    throw new InputValidationError("AUTHENIK8_SIGNING_JWKS must contain ES256 P-256 JWKs");
   }
+  const activeKid = requiredEnv("AUTHENIK8_ACTIVE_KID");
+  const activeKey = result.data.find((key) => key.kid === activeKid);
+  if (!activeKey?.d) throw new InputValidationError("AUTHENIK8_ACTIVE_KID must select a private signing JWK");
+  return {
+    keys: result.data,
+    activeKid,
+    issuer: requiredEnv("AUTHENIK8_ISSUER"),
+    audience: requiredEnv("AUTHENIK8_AUDIENCE"),
+  };
+}
 
-  const normalizedEmail = email.trim().toLowerCase();
-  const atIndex = normalizedEmail.indexOf("@");
-  const dotIndex = normalizedEmail.lastIndexOf(".");
+export function agentIdentityConfig(): AgentIdentityConfig | undefined {
+  const source = process.env.AUTHENIK8_AGENTS?.trim();
+  if (!source) return undefined;
 
-  if (atIndex < 1 || atIndex !== normalizedEmail.lastIndexOf("@") || dotIndex < atIndex + 2 || dotIndex === normalizedEmail.length - 1) {
-	  throw new Error("A valid email is required");
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(source);
+  } catch {
+    throw new InputValidationError("AUTHENIK8_AGENTS must be a JSON object of agent scope arrays");
   }
+  const result = agentRegistrySchema.safeParse(parsed);
+  if (!result.success) {
+    throw new InputValidationError("AUTHENIK8_AGENTS must map valid agent IDs to resource:action scopes");
+  }
+  if (!Object.keys(result.data).length) return undefined;
+
+  const registry = result.data;
+  return {
+    resolveAgent: async (agentId) => {
+      const scopes = Object.prototype.hasOwnProperty.call(registry, agentId)
+        ? registry[agentId]
+        : undefined;
+      return scopes ? { agentId, scopes, active: true } : null;
+    },
+  };
+}
 
-  if (password.length < 8 || password.length > 1024) {
-    throw new Error("Password must be between 8 and 1024 characters");
+export function parseCredentials(body: unknown): z.infer<typeof credentialsSchema> {
+  const result = credentialsSchema.safeParse(body);
+  if (!result.success) {
+    throw new InputValidationError(validationMessage(result.error, "Email and password are required"));
   }
+  return result.data;
+}
 
-  return { email: normalizedEmail, password };
+export function parseIdentifier(value: unknown, label: string): string {
+  const result = identifierSchema.safeParse(value);
+  if (!result.success) throw new InputValidationError(`${label} is invalid`);
+  return result.data;
 }
 
 export function sanitizeSessionResponse(value: unknown): unknown {

package/templates/express-base/README.md

@@ -15,14 +15,18 @@ For SQLite, Postgres in `docker-compose.yml` is optional. Redis is required for
 
 ## Environment
 
-Review `.env` before running. The generated secrets are development placeholders and must be replaced before deployment.
+The generator writes a unique signing key and refresh secret to git-ignored `.env`. Move them into your deployment secret manager and never commit the private JWK.
 
 Required:
 
 ```bash
 DATABASE_URL=file:./dev.db
-JWT_SECRET=dev-jwt-secret-change-before-production-123456
-REFRESH_SECRET=dev-refresh-secret-change-before-production-123456
+AUTHENIK8_SIGNING_JWKS='[{"kty":"EC","crv":"P-256","kid":"<generated>","x":"...","y":"...","d":"...","alg":"ES256"}]'
+AUTHENIK8_ACTIVE_KID=<generated>
+AUTHENIK8_ISSUER=http://localhost:3000
+AUTHENIK8_AUDIENCE=your-app-api
+AUTHENIK8_AGENTS={}
+REFRESH_SECRET=<generated-random-secret>
 REDIS_HOST=127.0.0.1
 REDIS_PORT=6379
 ```
@@ -69,7 +73,10 @@ Expected result: the route should reject the request because no access token was
 ## Environment Variables
 
 - `DATABASE_URL`: Prisma database connection. SQLite uses `file:./dev.db`; Postgres uses a `postgresql://...` URL.
-- `JWT_SECRET`: signs short-lived access tokens. Use a long random value in production.
+- `AUTHENIK8_SIGNING_JWKS`: JSON array containing the active private ES256 key and any previous public verification keys.
+- `AUTHENIK8_ACTIVE_KID`: selects the private key used to sign new access tokens.
+- `AUTHENIK8_ISSUER` / `AUTHENIK8_AUDIENCE`: required claims checked during verification.
+- `AUTHENIK8_AGENTS`: optional JSON map of agent IDs to exact `resource:action` scopes; keep `{}` to disable agent identity. See `AGENT_IDENTITY.md`.
 - `REFRESH_SECRET`: signs refresh tokens. Use a different long random value in production.
 - `REDIS_HOST`: Redis host for refresh-token/session security.
 - `REDIS_PORT`: Redis port, usually `6379` locally.
@@ -98,9 +105,9 @@ export async function getProtected(accessToken: string) {
 
 `Prisma Client did not initialize`: run `npm run prisma:migrate`, then restart `npm run dev`.
 
-`JWT_SECRET must be set to at least 32 characters`: check `.env`; both token secrets must be long strings.
+`AUTHENIK8_SIGNING_JWKS must be a valid JSON array`: restore the generated `.env` value or provide an ES256 P-256 key ring and matching `AUTHENIK8_ACTIVE_KID`.
 
-`Port 3000 already in use`: stop the other process or change the `app.listen(3000)` port in `src/server.ts`.
+`Port 3000 already in use`: stop the other process or set `PORT` in `.env`.
 
 `DATABASE_URL is wrong`: for SQLite use `file:./dev.db`; for local Docker Postgres use `postgresql://postgres:postgres@localhost:5432/authenik8?schema=public`.
 

package/templates/express-base/app.ts

@@ -9,6 +9,8 @@ export const createApp = (auth: any) => {
   app.use(auth.helmet);
   app.use(auth.rateLimit);
 
+  app.get("/.well-known/jwks.json", (_req, res) => res.json(auth.getJwks()));
+
   app.use("/", createBaseRoutes(auth));
 
   return app;

package/templates/express-base/controllers/base.controller.ts

@@ -1,5 +1,10 @@
 import { Request, Response } from "express";
-import { getBearerToken, parseRefreshToken, sanitizeSessionResponse } from "../utils/security";
+import {
+  InputValidationError,
+  parseIdentifier,
+  parseRefreshToken,
+  sanitizeSessionResponse,
+} from "../utils/security";
 
 export const createBaseController = (auth: any) => ({
   publicRoute(req: Request, res: Response) {
@@ -11,15 +16,8 @@ export const createBaseController = (auth: any) => ({
     res.json({ token });
   },
 
-  async protected(req: Request, res: Response) {
-    const token = getBearerToken(req.headers.authorization);
-
-    try {
-      const decoded = await auth.verifyToken(token);
-      res.json({ message: "Protected data", user: decoded });
-    } catch {
-      res.status(401).json({ error: "Unauthorized" });
-    }
+  protected(req: Request, res: Response) {
+    res.json({ message: "Protected data", user: (req as any).user });
   },
 
   async refresh(req: Request, res: Response) {
@@ -43,10 +41,15 @@ export const createBaseController = (auth: any) => ({
         return res.status(503).json({ success: false, message: "Session management unavailable" });
       }
 
-      const sessions = await actions.listSessions(req.params.userId);
+      const userId = parseIdentifier(req.params.userId, "User ID");
+      const sessions = await actions.listSessions(userId);
       res.json({ sessions: sanitizeSessionResponse(sessions) });
-    } catch {
-      res.status(500).json({ success: false, message: "Failed to retrieve sessions" });
+    } catch (error) {
+      const validationError = error instanceof InputValidationError;
+      res.status(validationError ? 400 : 500).json({
+        success: false,
+        message: validationError ? error.message : "Failed to retrieve sessions",
+      });
     }
   },
 
@@ -57,10 +60,16 @@ export const createBaseController = (auth: any) => ({
         return res.status(503).json({ success: false, message: "Session management unavailable" });
       }
 
-      await actions.revokeSession(req.params.userId, req.params.sessionId);
+      const userId = parseIdentifier(req.params.userId, "User ID");
+      const sessionId = parseIdentifier(req.params.sessionId, "Session ID");
+      await actions.revokeSession(userId, sessionId);
       res.json({ success: true, message: "Session revoked" });
-    } catch {
-      res.status(500).json({ success: false, message: "Failed to revoke session" });
+    } catch (error) {
+      const validationError = error instanceof InputValidationError;
+      res.status(validationError ? 400 : 500).json({
+        success: false,
+        message: validationError ? error.message : "Failed to revoke session",
+      });
     }
   },
 
@@ -71,10 +80,15 @@ export const createBaseController = (auth: any) => ({
         return res.status(503).json({ success: false, message: "Session management unavailable" });
       }
 
-      await actions.revokeAllSessions(req.params.userId);
+      const userId = parseIdentifier(req.params.userId, "User ID");
+      await actions.revokeAllSessions(userId);
       res.json({ success: true, message: "All sessions revoked" });
-    } catch {
-      res.status(500).json({ success: false, message: "Failed to revoke sessions" });
+    } catch (error) {
+      const validationError = error instanceof InputValidationError;
+      res.status(validationError ? 400 : 500).json({
+        success: false,
+        message: validationError ? error.message : "Failed to revoke sessions",
+      });
     }
   },
 });

package/templates/express-base/docker-compose.yml

@@ -6,6 +6,11 @@ services:
     command: ["redis-server", "--appendonly", "yes"]
     volumes:
       - redis-data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
 
   postgres:
     image: postgres:16-alpine
@@ -17,6 +22,11 @@ services:
       POSTGRES_DB: authenik8
     volumes:
       - postgres-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d authenik8"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
 
 volumes:
   redis-data:

package/templates/express-base/gitignore.template

@@ -0,0 +1,6 @@
+node_modules/
+dist/
+.env
+*.log
+coverage/
+.DS_Store

package/templates/express-base/package.json

@@ -3,22 +3,28 @@
   "scripts": {
     "dev": "ts-node-dev --respawn --transpile-only ./src/server.ts",
     "build": "tsc",
-    "start": "node dist/server.js",
+    "start": "node dist/src/server.js",
     "prisma:migrate": "prisma migrate",
-    "docker:up": "docker compose up -d",
+    "docker:up": "docker compose up -d --wait",
     "docker:down": "docker compose down"
   },
   "dependencies": {
-    "authenik8-core": "^1.0.38",
+    "authenik8-core": "2.0.3",
     "dotenv": "^16.0.0",
     "express": "^4.18.2",
-    "@prisma/client": "5.22.0"
+    "@prisma/client": "7.8.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^22.10.2",
     "ts-node-dev": "^2.0.0",
     "typescript": "^5.0.0",
-     "prisma": "5.22.0"
+     "prisma": "7.8.0"
 
   },
+  "overrides": {
+    "@hono/node-server": "1.19.13"
+  },
   "type": "commonjs"
 }

package/templates/express-base/routes/base.routes.ts

@@ -7,7 +7,7 @@ export const createBaseRoutes = (auth: any) => {
 
   router.get("/public", controller.publicRoute);
   router.get("/guest", controller.guest);
-  router.get("/protected", controller.protected);
+  router.get("/protected", auth.requireAuth, controller.protected);
   router.post("/refresh", controller.refresh);
 
   router.get("/admin", auth.requireAdmin, controller.admin);

package/templates/express-base/src/.env.example

@@ -1,3 +1,8 @@
-JWT_SECRET=supersecret
-REFRESH_SECRET=refreshsecret
+AUTHENIK8_SIGNING_JWKS=
+AUTHENIK8_ACTIVE_KID=
+AUTHENIK8_ISSUER=http://localhost:3000
+AUTHENIK8_AUDIENCE=authenik8-app-api
+AUTHENIK8_AGENTS={}
+REFRESH_SECRET=replace-with-at-least-32-random-characters
+PORT=3000
 REDIS_URL=redis://localhost:6379

package/templates/express-base/src/server.ts

@@ -1,20 +1,22 @@
 import  dotenv  from "dotenv";
 import { createAuthenik8 } from "authenik8-core";
 import { createApp } from "../app";
-import { requiredSecret } from "../utils/security";
+import { agentIdentityConfig, authJwkConfig, requiredPort, requiredSecret } from "../utils/security";
 
 dotenv.config();
 
 async function start() {
   const auth = await createAuthenik8({
-    jwtSecret: requiredSecret("JWT_SECRET"),
+    jwt: authJwkConfig(),
     refreshSecret: requiredSecret("REFRESH_SECRET"),
+    agent: agentIdentityConfig(),
   });
 
   const app = createApp(auth);
 
-  app.listen(3000, () => {
-    console.log("🚀 Server running on http://localhost:3000");
+  const port = requiredPort();
+  app.listen(port, () => {
+    console.log(`🚀 Server running on http://localhost:${port}`);
   });
 }
 process.on("uncaughtException", (err) => {
@@ -26,12 +28,4 @@ process.on("unhandledRejection", (err) => {
   console.error(" Unhandled Rejection:", err);
   process.exit(1);
 });
-setInterval(() => {
-  const used = process.memoryUsage().heapUsed / 1024 / 1024;
-
-  if (used > 300) {
-    console.error(`Memory exceeded: ${used.toFixed(2)} MB`);
-    process.exit(1);
-  }
-}, 10000);
 start();

package/templates/express-base/tsconfig.json

@@ -1,47 +1,14 @@
 {
-  // Visit https://aka.ms/tsconfig to read more about this file
   "compilerOptions": {
-    // File Layout
-    "rootDir": "./src",
-     "outDir": "./dist",
-
-    // Environment Settings
-    // See also https://aka.ms/tsconfig/module
-    "module": "nodenext",
     "target": "ES2020",
-    "types": [],
-    // For nodejs:
-    // "lib": ["esnext"],
-    // "types": ["node"],
-    // and npm install -D @types/node
-
-    // Other Outputs
-    "sourceMap": true,
-    "declaration": true,
-    "declarationMap": true,
-
-    // Stricter Typechecking Options
-    "noUncheckedIndexedAccess": true,
-    "exactOptionalPropertyTypes": true,
-
-    // Style Options
-    // "noImplicitReturns": true,
-    // "noImplicitOverride": true,
-    // "noUnusedLocals": true,
-    // "noUnusedParameters": true,
-    // "noFallthroughCasesInSwitch": true,
-    // "noPropertyAccessFromIndexSignature": true,
-
-    // Recommended Options
+    "module": "commonjs",
+    "rootDir": ".",
+    "outDir": "./dist",
     "strict": true,
-    "jsx": "react-jsx",
-    "verbatimModuleSyntax": true,
-    "isolatedModules": true,
-    "noUncheckedSideEffectImports": true,
-    "moduleDetection": "force",
+    "esModuleInterop": true,
     "skipLibCheck": true,
-    "esModuleInterop":true,
-    //"moduleResolution":Nodenext,
+    "forceConsistentCasingInFileNames": true
   },
-  "exclude":["dist"]
+  "include": ["src", "app.ts", "controllers", "routes", "utils"],
+  "exclude": ["node_modules", "dist"]
 }

package/templates/express-base/utils/security.ts

@@ -1,32 +1,128 @@
+import { z } from "zod";
+import type { AgentIdentityConfig, Authenik8JwkConfig } from "authenik8-core";
+
 const sensitiveKeys = new Set(["token", "accessToken", "refreshToken"]);
 
-export function requiredSecret(name: string): string {
-  const value = process.env[name];
+const secretSchema = z.string().trim().min(32);
+const environmentValueSchema = z.string().trim().min(1);
+const portSchema = z.coerce.number().int().min(1).max(65535);
+const signingJwkSchema = z.object({
+  kty: z.literal("EC"),
+  crv: z.literal("P-256"),
+  x: z.string().min(1),
+  y: z.string().min(1),
+  d: z.string().min(1).optional(),
+  kid: z.string().min(1),
+  alg: z.literal("ES256").optional(),
+  use: z.literal("sig").optional(),
+});
+export const refreshTokenBodySchema = z.strictObject({
+  refreshToken: z.string().trim().min(16, "Refresh token is required").max(4096),
+});
+const identifierSchema = z.string()
+  .trim()
+  .min(1)
+  .max(128)
+  .regex(/^[A-Za-z0-9._:-]+$/);
+const agentIdSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+const agentScopeSchema = z.string().max(128).regex(/^[a-z][a-z0-9._/-]*(?::[a-z][a-z0-9._/-]*)+$/);
+const agentRegistrySchema = z.record(
+  agentIdSchema,
+  z.array(agentScopeSchema).min(1).max(64),
+);
+
+export class InputValidationError extends Error {}
+
+function validationMessage(error: z.ZodError, fallback: string): string {
+  return error.issues[0]?.message ?? fallback;
+}
 
-  if (typeof value !== "string" || value.trim().length < 32) {
-    throw new Error(`${name} must be set to at least 32 characters`);
+export function requiredSecret(name: string): string {
+  const result = secretSchema.safeParse(process.env[name]);
+  if (!result.success) {
+    throw new InputValidationError(`${name} must be set to at least 32 characters`);
   }
+  return result.data;
+}
 
-  return value;
+export function requiredEnv(name: string): string {
+  const result = environmentValueSchema.safeParse(process.env[name]);
+  if (!result.success) throw new InputValidationError(`${name} must be set`);
+  return result.data;
 }
 
-export function getBearerToken(authorizationHeader: string | undefined): string | undefined {
-  const [scheme, token] = authorizationHeader?.split(" ") ?? [];
-  return scheme === "Bearer" && token ? token : undefined;
+export function requiredPort(): number {
+  const result = portSchema.safeParse(process.env.PORT ?? 3000);
+  if (!result.success) throw new InputValidationError("PORT must be between 1 and 65535");
+  return result.data;
 }
 
-export function parseRefreshToken(body: unknown) {
-  if (!body || typeof body !== "object") {
-    throw new Error("Refresh token is required");
+export function authJwkConfig(): Authenik8JwkConfig {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(requiredEnv("AUTHENIK8_SIGNING_JWKS"));
+  } catch {
+    throw new InputValidationError("AUTHENIK8_SIGNING_JWKS must be a valid JSON array");
   }
+  const result = z.array(signingJwkSchema).min(1).safeParse(parsed);
+  if (!result.success) {
+    throw new InputValidationError("AUTHENIK8_SIGNING_JWKS must contain ES256 P-256 JWKs");
+  }
+  const activeKid = requiredEnv("AUTHENIK8_ACTIVE_KID");
+  const activeKey = result.data.find((key) => key.kid === activeKid);
+  if (!activeKey?.d) throw new InputValidationError("AUTHENIK8_ACTIVE_KID must select a private signing JWK");
+  return {
+    keys: result.data,
+    activeKid,
+    issuer: requiredEnv("AUTHENIK8_ISSUER"),
+    audience: requiredEnv("AUTHENIK8_AUDIENCE"),
+  };
+}
 
-  const { refreshToken } = body as { refreshToken?: unknown };
+export function agentIdentityConfig(): AgentIdentityConfig | undefined {
+  const source = process.env.AUTHENIK8_AGENTS?.trim();
+  if (!source) return undefined;
 
-  if (typeof refreshToken !== "string" || refreshToken.trim().length < 16) {
-    throw new Error("Refresh token is required");
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(source);
+  } catch {
+    throw new InputValidationError("AUTHENIK8_AGENTS must be a JSON object of agent scope arrays");
   }
+  const result = agentRegistrySchema.safeParse(parsed);
+  if (!result.success) {
+    throw new InputValidationError("AUTHENIK8_AGENTS must map valid agent IDs to resource:action scopes");
+  }
+  if (!Object.keys(result.data).length) return undefined;
+
+  const registry = result.data;
+  return {
+    resolveAgent: async (agentId) => {
+      const scopes = Object.prototype.hasOwnProperty.call(registry, agentId)
+        ? registry[agentId]
+        : undefined;
+      return scopes ? { agentId, scopes, active: true } : null;
+    },
+  };
+}
+
+export function getBearerToken(authorizationHeader: string | undefined): string | undefined {
+  const result = z.string().regex(/^Bearer\s+\S+$/).safeParse(authorizationHeader);
+  return result.success ? result.data.replace(/^Bearer\s+/, "") : undefined;
+}
+
+export function parseRefreshToken(body: unknown): string {
+  const result = refreshTokenBodySchema.safeParse(body);
+  if (!result.success) {
+    throw new InputValidationError(validationMessage(result.error, "Refresh token is required"));
+  }
+  return result.data.refreshToken;
+}
 
-  return refreshToken;
+export function parseIdentifier(value: unknown, label: string): string {
+  const result = identifierSchema.safeParse(value);
+  if (!result.success) throw new InputValidationError(`${label} is invalid`);
+  return result.data;
 }
 
 export function sanitizeSessionResponse(value: unknown): unknown {

package/templates/fullstack/.env.example

@@ -0,0 +1,24 @@
+NODE_ENV=development
+PORT=3000
+WEB_ORIGIN=http://localhost:5173
+DATABASE_URL=postgresql://postgres:postgres@localhost:5432/authenik8?schema=public
+REDIS_URL=redis://localhost:6379
+AUTHENIK8_SIGNING_JWKS=
+AUTHENIK8_ACTIVE_KID=
+AUTHENIK8_ISSUER=http://localhost:3000
+AUTHENIK8_AUDIENCE=authenik8-fullstack-api
+AUTHENIK8_AGENTS={}
+REFRESH_SECRET=replace-with-another-32-random-characters
+COOKIE_SECURE=false
+TRUST_PROXY=false
+LOG_LEVEL=info
+EMAIL_FROM=Authenik8 <auth@example.com>
+RESEND_API_KEY=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_REDIRECT_URI=http://localhost:3000/api/auth/oauth/google/callback
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+GITHUB_REDIRECT_URI=http://localhost:3000/api/auth/oauth/github/callback
+SEED_ADMIN_EMAIL=admin@example.com
+SEED_ADMIN_PASSWORD=ChangeMe123!