create-authhero 0.18.0 → 0.20.0

package/dist/cloudflare-multitenant/copy-assets.js

@@ -59,6 +59,25 @@ try {
 
   copyDirectory(sourceDir, targetDir);
 
+  // Also copy widget files from @authhero/widget package
+  const widgetSourceDir = path.join(
+    __dirname,
+    "node_modules",
+    "@authhero",
+    "widget",
+    "dist",
+    "authhero-widget",
+  );
+  const widgetTargetDir = path.join(targetDir, "u", "widget");
+
+  if (fs.existsSync(widgetSourceDir)) {
+    console.log("📦 Copying widget assets...");
+    copyDirectory(widgetSourceDir, widgetTargetDir);
+  } else {
+    console.warn(`⚠️  Widget directory not found: ${widgetSourceDir}`);
+    console.warn("Widget features may not work. Install @authhero/widget to enable.");
+  }
+
   console.log(`✅ Assets copied to ${targetDir}`);
 } catch (error) {
   console.error("❌ Error copying assets:", error.message);

package/dist/cloudflare-multitenant/src/app.ts

@@ -1,29 +1,65 @@
 import { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { swaggerUI } from "@hono/swagger-ui";
+import { init, AuthHeroConfig, fetchAll } from "authhero";
 import {
-  init,
-  MultiTenantAuthHeroConfig,
-  DataAdapters,
+  createSyncHooks,
+  createTenantsOpenAPIRouter,
+  createProtectSyncedMiddleware,
 } from "@authhero/multi-tenancy";
+import { DataAdapters } from "@authhero/adapter-interfaces";
 
 // Control plane tenant ID - the tenant that manages all other tenants
 const CONTROL_PLANE_TENANT_ID = "control_plane";
 
-export default function createApp(
-  config: Omit<MultiTenantAuthHeroConfig, "controlPlaneTenantId"> & {
-    dataAdapter: DataAdapters;
-  },
-) {
+export default function createApp(config: AuthHeroConfig & { dataAdapter: DataAdapters }) {
+  // Create sync hooks for syncing entities from control plane to child tenants
+  const { entityHooks, tenantHooks } = createSyncHooks({
+    controlPlaneTenantId: CONTROL_PLANE_TENANT_ID,
+    getChildTenantIds: async () => {
+      const allTenants = await fetchAll<{ id: string }>(
+        (params) => config.dataAdapter.tenants.list(params),
+        "tenants",
+        { cursorField: "id", pageSize: 100 },
+      );
+      return allTenants
+        .filter((t) => t.id !== CONTROL_PLANE_TENANT_ID)
+        .map((t) => t.id);
+    },
+    getAdapters: async () => config.dataAdapter,
+    getControlPlaneAdapters: async () => config.dataAdapter,
+    sync: {
+      resourceServers: true,
+      roles: true,
+      connections: true,
+    },
+  });
+
+  // Create tenants router
+  const tenantsRouter = createTenantsOpenAPIRouter(
+    {
+      accessControl: {
+        controlPlaneTenantId: CONTROL_PLANE_TENANT_ID,
+        requireOrganizationMatch: false,
+        defaultPermissions: ["tenant:admin"],
+      },
+    },
+    { tenants: tenantHooks },
+  );
+
+  // Initialize AuthHero with sync hooks and tenant routes
   const { app } = init({
     ...config,
-    controlPlaneTenantId: CONTROL_PLANE_TENANT_ID,
-    // Sync resource servers from control plane tenant to all child tenants
-    syncResourceServers: true,
-    // Sync roles from control plane tenant to all child tenants
-    syncRoles: true,
+    entityHooks,
+    managementApiExtensions: [
+      ...(config.managementApiExtensions || []),
+      { path: "/tenants", router: tenantsRouter },
+    ],
   });
 
+  // Add middleware to protect synced entities from modification on child tenants
+  app.use("/api/v2/*", createProtectSyncedMiddleware());
+
   app
     .onError((err, ctx) => {
       if (err instanceof HTTPException) {

package/dist/cloudflare-multitenant/src/index.ts

@@ -3,7 +3,7 @@ import { Kysely } from "kysely";
 import createAdapters from "@authhero/kysely-adapter";
 import createApp from "./app";
 import { Env } from "./types";
-import { AuthHeroConfig } from "@authhero/multi-tenancy";
+import { AuthHeroConfig } from "authhero";
 
 // ──────────────────────────────────────────────────────────────────────────────
 // OPTIONAL: Uncomment to enable Cloudflare adapters (Analytics Engine, etc.)

package/dist/cloudflare-simple/copy-assets.js

@@ -59,6 +59,25 @@ try {
 
   copyDirectory(sourceDir, targetDir);
 
+  // Also copy widget files from @authhero/widget package
+  const widgetSourceDir = path.join(
+    __dirname,
+    "node_modules",
+    "@authhero",
+    "widget",
+    "dist",
+    "authhero-widget",
+  );
+  const widgetTargetDir = path.join(targetDir, "u", "widget");
+
+  if (fs.existsSync(widgetSourceDir)) {
+    console.log("📦 Copying widget assets...");
+    copyDirectory(widgetSourceDir, widgetTargetDir);
+  } else {
+    console.warn(`⚠️  Widget directory not found: ${widgetSourceDir}`);
+    console.warn("Widget features may not work. Install @authhero/widget to enable.");
+  }
+
   console.log(`✅ Assets copied to ${targetDir}`);
 } catch (error) {
   console.error("❌ Error copying assets:", error.message);

package/dist/create-authhero.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command as A } from "commander";
 import m from "inquirer";
-import s from "fs";
+import o from "fs";
 import i from "path";
 import { spawn as b } from "child_process";
 const D = new A(), c = {
@@ -9,8 +9,8 @@ const D = new A(), c = {
     name: "Local (SQLite)",
     description: "Local development setup with SQLite database - great for getting started",
     templateDir: "local",
-    packageJson: (o) => ({
-      name: o,
+    packageJson: (n) => ({
+      name: n,
       version: "1.0.0",
       type: "module",
       scripts: {
@@ -42,15 +42,16 @@ const D = new A(), c = {
     name: "Cloudflare Simple (Single Tenant)",
     description: "Single-tenant Cloudflare Workers setup with D1 database",
     templateDir: "cloudflare-simple",
-    packageJson: (o) => ({
-      name: o,
+    packageJson: (n) => ({
+      name: n,
       version: "1.0.0",
       type: "module",
       scripts: {
+        postinstall: "node copy-assets.js",
         "copy-assets": "node copy-assets.js",
-        dev: "npm run copy-assets && wrangler dev --port 3000 --local-protocol https",
-        "dev:remote": "npm run copy-assets && wrangler dev --port 3000 --local-protocol https --remote --config wrangler.local.toml",
-        deploy: "npm run copy-assets && wrangler deploy --config wrangler.local.toml",
+        dev: "wrangler dev --port 3000 --local-protocol https",
+        "dev:remote": "wrangler dev --port 3000 --local-protocol https --remote --config wrangler.local.toml",
+        deploy: "wrangler deploy --config wrangler.local.toml",
         "db:migrate:local": "wrangler d1 migrations apply AUTH_DB --local",
         "db:migrate:remote": "wrangler d1 migrations apply AUTH_DB --remote --config wrangler.local.toml",
         migrate: "wrangler d1 migrations apply AUTH_DB --local",
@@ -62,6 +63,7 @@ const D = new A(), c = {
       dependencies: {
         "@authhero/drizzle": "latest",
         "@authhero/kysely-adapter": "latest",
+        "@authhero/widget": "latest",
         "@hono/swagger-ui": "^0.5.0",
         "@hono/zod-openapi": "^0.19.0",
         authhero: "latest",
@@ -83,15 +85,16 @@ const D = new A(), c = {
     name: "Cloudflare Multi-Tenant (Production)",
     description: "Production-grade multi-tenant setup with D1 database and tenant management",
     templateDir: "cloudflare-multitenant",
-    packageJson: (o) => ({
-      name: o,
+    packageJson: (n) => ({
+      name: n,
       version: "1.0.0",
       type: "module",
       scripts: {
+        postinstall: "node copy-assets.js",
         "copy-assets": "node copy-assets.js",
-        dev: "npm run copy-assets && wrangler dev --port 3000 --local-protocol https",
-        "dev:remote": "npm run copy-assets && wrangler dev --port 3000 --local-protocol https --remote --config wrangler.local.toml",
-        deploy: "npm run copy-assets && wrangler deploy --config wrangler.local.toml",
+        dev: "wrangler dev --port 3000 --local-protocol https",
+        "dev:remote": "wrangler dev --port 3000 --local-protocol https --remote --config wrangler.local.toml",
+        deploy: "wrangler deploy --config wrangler.local.toml",
         "db:migrate:local": "wrangler d1 migrations apply AUTH_DB --local",
         "db:migrate:remote": "wrangler d1 migrations apply AUTH_DB --remote --config wrangler.local.toml",
         migrate: "wrangler d1 migrations apply AUTH_DB --local",
@@ -104,8 +107,10 @@ const D = new A(), c = {
         "@authhero/drizzle": "latest",
         "@authhero/kysely-adapter": "latest",
         "@authhero/multi-tenancy": "latest",
+        "@authhero/widget": "latest",
         "@hono/swagger-ui": "^0.5.0",
         "@hono/zod-openapi": "^0.19.0",
+        authhero: "latest",
         hono: "^4.6.0",
         kysely: "latest",
         "kysely-d1": "latest"
@@ -121,10 +126,10 @@ const D = new A(), c = {
     seedFile: "seed.ts"
   }
 };
-function j(o, e) {
-  s.readdirSync(o).forEach((n) => {
-    const a = i.join(o, n), t = i.join(e, n);
-    s.lstatSync(a).isDirectory() ? (s.mkdirSync(t, { recursive: !0 }), j(a, t)) : s.copyFileSync(a, t);
+function j(n, e) {
+  o.readdirSync(n).forEach((s) => {
+    const a = i.join(n, s), t = i.join(e, s);
+    o.lstatSync(a).isDirectory() ? (o.mkdirSync(t, { recursive: !0 }), j(a, t)) : o.copyFileSync(a, t);
   });
 }
 function I() {
@@ -161,9 +166,9 @@ async function main() {
 main().catch(console.error);
 `;
 }
-function x(o) {
-  const e = i.join(o, ".github", "workflows");
-  s.mkdirSync(e, { recursive: !0 });
+function x(n) {
+  const e = i.join(n, ".github", "workflows");
+  o.mkdirSync(e, { recursive: !0 });
   const r = `name: Unit tests
 
 on: push
@@ -185,7 +190,7 @@ jobs:
 
       - run: npm run type-check
       - run: npm test
-`, n = `name: Deploy to Dev
+`, s = `name: Deploy to Dev
 
 on:
   push:
@@ -250,9 +255,9 @@ jobs:
           apiToken: \${{ secrets.PROD_CLOUDFLARE_API_TOKEN }}
           command: deploy --env production
 `;
-  s.writeFileSync(i.join(e, "unit-tests.yml"), r), s.writeFileSync(i.join(e, "deploy-dev.yml"), n), s.writeFileSync(i.join(e, "release.yml"), a), console.log("\\n📦 GitHub CI workflows created!");
+  o.writeFileSync(i.join(e, "unit-tests.yml"), r), o.writeFileSync(i.join(e, "deploy-dev.yml"), s), o.writeFileSync(i.join(e, "release.yml"), a), console.log("\\n📦 GitHub CI workflows created!");
 }
-function C(o) {
+function C(n) {
   const e = {
     branches: ["main"],
     plugins: [
@@ -261,42 +266,42 @@ function C(o) {
       "@semantic-release/github"
     ]
   };
-  s.writeFileSync(
-    i.join(o, ".releaserc.json"),
+  o.writeFileSync(
+    i.join(n, ".releaserc.json"),
     JSON.stringify(e, null, 2)
   );
-  const r = i.join(o, "package.json"), n = JSON.parse(s.readFileSync(r, "utf-8"));
-  n.devDependencies = {
-    ...n.devDependencies,
+  const r = i.join(n, "package.json"), s = JSON.parse(o.readFileSync(r, "utf-8"));
+  s.devDependencies = {
+    ...s.devDependencies,
     "semantic-release": "^24.0.0"
-  }, n.scripts = {
-    ...n.scripts,
+  }, s.scripts = {
+    ...s.scripts,
     test: 'echo "No tests yet"',
     "type-check": "tsc --noEmit"
-  }, s.writeFileSync(r, JSON.stringify(n, null, 2));
+  }, o.writeFileSync(r, JSON.stringify(s, null, 2));
 }
-function v(o, e) {
-  return new Promise((r, n) => {
-    const a = b(o, [], {
+function v(n, e) {
+  return new Promise((r, s) => {
+    const a = b(n, [], {
       cwd: e,
       shell: !0,
       stdio: "inherit"
     });
     a.on("close", (t) => {
-      t === 0 ? r() : n(new Error(`Command failed with exit code ${t}`));
-    }), a.on("error", n);
+      t === 0 ? r() : s(new Error(`Command failed with exit code ${t}`));
+    }), a.on("error", s);
   });
 }
-function S(o, e, r) {
-  return new Promise((n, a) => {
-    const t = b(o, [], {
+function S(n, e, r) {
+  return new Promise((s, a) => {
+    const t = b(n, [], {
       cwd: e,
       shell: !0,
       stdio: "inherit",
       env: { ...process.env, ...r }
     });
     t.on("close", (f) => {
-      f === 0 ? n() : a(new Error(`Command failed with exit code ${f}`));
+      f === 0 ? s() : a(new Error(`Command failed with exit code ${f}`));
     }), t.on("error", a);
   });
 }
@@ -306,23 +311,23 @@ D.version("1.0.0").description("Create a new AuthHero project").argument("[proje
 ).option("-e, --email <email>", "admin email address").option("-p, --password <password>", "admin password (min 8 characters)").option(
   "--package-manager <pm>",
   "package manager to use: npm, yarn, pnpm, or bun"
-).option("--skip-install", "skip installing dependencies").option("--skip-migrate", "skip running database migrations").option("--skip-seed", "skip seeding the database").option("--skip-start", "skip starting the development server").option("--github-ci", "include GitHub CI workflows with semantic versioning").option("-y, --yes", "skip all prompts and use defaults/provided options").action(async (o, e) => {
+).option("--skip-install", "skip installing dependencies").option("--skip-migrate", "skip running database migrations").option("--skip-seed", "skip seeding the database").option("--skip-start", "skip starting the development server").option("--github-ci", "include GitHub CI workflows with semantic versioning").option("-y, --yes", "skip all prompts and use defaults/provided options").action(async (n, e) => {
   const r = e.yes === !0;
   console.log(`
 🔐 Welcome to AuthHero!
 `);
-  let n = o;
-  n || (r ? (n = "auth-server", console.log(`Using default project name: ${n}`)) : n = (await m.prompt([
+  let s = n;
+  s || (r ? (s = "auth-server", console.log(`Using default project name: ${s}`)) : s = (await m.prompt([
     {
       type: "input",
       name: "projectName",
       message: "Project name:",
       default: "auth-server",
-      validate: (p) => p !== "" || "Project name cannot be empty"
+      validate: (d) => d !== "" || "Project name cannot be empty"
     }
   ])).projectName);
-  const a = i.join(process.cwd(), n);
-  s.existsSync(a) && (console.error(`❌ Project "${n}" already exists.`), process.exit(1));
+  const a = i.join(process.cwd(), s);
+  o.existsSync(a) && (console.error(`❌ Project "${s}" already exists.`), process.exit(1));
   let t;
   e.template ? (["local", "cloudflare-simple", "cloudflare-multitenant"].includes(
     e.template
@@ -356,37 +361,37 @@ D.version("1.0.0").description("Create a new AuthHero project").argument("[proje
     }
   ])).setupType;
   const f = c[t];
-  s.mkdirSync(a, { recursive: !0 }), s.writeFileSync(
+  o.mkdirSync(a, { recursive: !0 }), o.writeFileSync(
     i.join(a, "package.json"),
-    JSON.stringify(f.packageJson(n), null, 2)
+    JSON.stringify(f.packageJson(s), null, 2)
   );
   const k = i.join(
     import.meta.url.replace("file://", "").replace("/create-authhero.js", ""),
     f.templateDir
   );
-  if (s.existsSync(k) ? j(k, a) : (console.error(`❌ Template directory not found: ${k}`), process.exit(1)), t === "cloudflare-simple" || t === "cloudflare-multitenant") {
-    const l = i.join(a, "wrangler.toml"), p = i.join(a, "wrangler.local.toml");
-    s.existsSync(l) && s.copyFileSync(l, p);
-    const d = i.join(a, ".dev.vars.example"), u = i.join(a, ".dev.vars");
-    s.existsSync(d) && s.copyFileSync(d, u), console.log(
+  if (o.existsSync(k) ? j(k, a) : (console.error(`❌ Template directory not found: ${k}`), process.exit(1)), t === "cloudflare-simple" || t === "cloudflare-multitenant") {
+    const l = i.join(a, "wrangler.toml"), d = i.join(a, "wrangler.local.toml");
+    o.existsSync(l) && o.copyFileSync(l, d);
+    const p = i.join(a, ".dev.vars.example"), u = i.join(a, ".dev.vars");
+    o.existsSync(p) && o.copyFileSync(p, u), console.log(
       "📁 Created wrangler.local.toml and .dev.vars for local development"
     );
   }
-  let y = !1;
-  if ((t === "cloudflare-simple" || t === "cloudflare-multitenant") && (e.githubCi !== void 0 ? (y = e.githubCi, y && console.log("Including GitHub CI workflows with semantic versioning")) : r || (y = (await m.prompt([
+  let w = !1;
+  if ((t === "cloudflare-simple" || t === "cloudflare-multitenant") && (e.githubCi !== void 0 ? (w = e.githubCi, w && console.log("Including GitHub CI workflows with semantic versioning")) : r || (w = (await m.prompt([
     {
       type: "confirm",
       name: "includeGithubCi",
       message: "Would you like to include GitHub CI with semantic versioning?",
       default: !1
     }
-  ])).includeGithubCi), y && (x(a), C(a))), t === "local") {
+  ])).includeGithubCi), w && (x(a), C(a))), t === "local") {
     const l = I();
-    s.writeFileSync(i.join(a, "src/seed.ts"), l);
+    o.writeFileSync(i.join(a, "src/seed.ts"), l);
   }
   console.log(
     `
-✅ Project "${n}" has been created with ${f.name} setup!
+✅ Project "${s}" has been created with ${f.name} setup!
 `
   );
   let h;
@@ -418,8 +423,8 @@ D.version("1.0.0").description("Create a new AuthHero project").argument("[proje
 📦 Installing dependencies with ${l}...
 `);
     try {
-      const p = l === "pnpm" ? "pnpm install --ignore-workspace" : `${l} install`;
-      if (await v(p, a), t === "local" && (console.log(`
+      const d = l === "pnpm" ? "pnpm install --ignore-workspace" : `${l} install`;
+      if (await v(d, a), t === "local" && (console.log(`
 🔧 Building native modules...
 `), await v("npm rebuild better-sqlite3", a)), console.log(`
 ✅ Dependencies installed successfully!
@@ -443,14 +448,14 @@ D.version("1.0.0").description("Create a new AuthHero project").argument("[proje
               name: "username",
               message: "Admin email:",
               default: "admin@example.com",
-              validate: (w) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(w) || "Please enter a valid email address"
+              validate: (y) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(y) || "Please enter a valid email address"
             },
             {
               type: "password",
               name: "password",
               message: "Admin password:",
               mask: "*",
-              validate: (w) => w.length < 8 ? "Password must be at least 8 characters" : !0
+              validate: (y) => y.length < 8 ? "Password must be at least 8 characters" : !0
             }
           ]), e.skipMigrate || (console.log(`
 🔄 Running migrations...
@@ -473,30 +478,30 @@ D.version("1.0.0").description("Create a new AuthHero project").argument("[proje
           ));
         }
       }
-      let d;
-      e.skipStart || r ? d = !1 : d = (await m.prompt([
+      let p;
+      e.skipStart || r ? p = !1 : p = (await m.prompt([
         {
           type: "confirm",
           name: "shouldStart",
           message: "Would you like to start the development server?",
           default: !0
         }
-      ])).shouldStart, d && (console.log(
+      ])).shouldStart, p && (console.log(
         `
 🚀 Starting development server on https://localhost:3000 ...
 `
-      ), await v(`${l} run dev`, a)), r && !d && (console.log(`
+      ), await v(`${l} run dev`, a)), r && !p && (console.log(`
 ✅ Setup complete!`), console.log(`
-To start the development server:`), console.log(`  cd ${n}`), console.log("  npm run dev"), (t === "cloudflare-simple" || t === "cloudflare-multitenant") && console.log(
+To start the development server:`), console.log(`  cd ${s}`), console.log("  npm run dev"), (t === "cloudflare-simple" || t === "cloudflare-multitenant") && console.log(
         `
 Server will be available at: https://localhost:3000`
       ));
-    } catch (p) {
+    } catch (d) {
       console.error(`
-❌ An error occurred:`, p), process.exit(1);
+❌ An error occurred:`, d), process.exit(1);
     }
   }
-  h || (console.log("Next steps:"), console.log(`  cd ${n}`), t === "local" ? (console.log("  npm install"), console.log("  npm run migrate"), console.log(
+  h || (console.log("Next steps:"), console.log(`  cd ${s}`), t === "local" ? (console.log("  npm install"), console.log("  npm run migrate"), console.log(
     "  ADMIN_EMAIL=admin@example.com ADMIN_PASSWORD=yourpassword npm run seed"
   ), console.log("  npm run dev")) : (t === "cloudflare-simple" || t === "cloudflare-multitenant") && (console.log("  npm install"), console.log(
     "  npm run migrate  # or npm run db:migrate:remote for production"

package/package.json

@@ -5,7 +5,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "0.18.0",
+  "version": "0.20.0",
   "type": "module",
   "main": "dist/create-authhero.js",
   "bin": {