create-kontrolia-auth 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 KontrolIA Auth Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,15 @@
+# create-kontrolia-auth
+
+Wizard de instalación. Dos preguntas independientes (ver la sección "Desacoplamiento clave" del plan de arquitectura):
+
+1. **¿De dónde sale tu Supabase?** Proyecto existente (pegas URL/keys, sin Docker) o uno nuevo self-hosted (genera `docker/.env` con secretos reales).
+2. **¿Dónde despliegas `auth-server`/`admin-panel`?** Docker, Vercel, Coolify, Railway u otro — genera los `.env.local` correspondientes.
+
+## Uso
+
+```bash
+git clone <tu-fork-de-kontrolia-auth>
+cd kontrolia-auth
+pnpm install
+pnpm --filter create-kontrolia-auth dev
+```

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import * as p from "@clack/prompts";
+import { migrate } from "@kontrolia/db";
+import { askApplicationStep } from "./steps/application.js";
+import { askDatabaseStep } from "./steps/database.js";
+import { askDeploymentStep } from "./steps/deployment.js";
+async function main() {
+    const repoRoot = process.cwd();
+    console.clear();
+    p.intro("KontrolIA Auth — instalador");
+    const db = await askDatabaseStep(repoRoot);
+    if (db.mode === "new-self-hosted") {
+        p.note("Corre `docker compose -f docker/docker-compose.yml up -d` y espera a que Postgres esté healthy antes de continuar con las migraciones.", "Antes de migrar");
+        const proceed = await p.confirm({ message: "¿Ya levantaste el docker-compose y Postgres está arriba?" });
+        if (p.isCancel(proceed) || !proceed) {
+            p.outro("Cuando esté listo, corre de nuevo: pnpm --filter create-kontrolia-auth dev");
+            return;
+        }
+    }
+    const s = p.spinner();
+    s.start("Aplicando migraciones del schema kontrolia");
+    try {
+        await migrate({ connectionString: db.databaseUrl });
+        s.stop("Migraciones aplicadas");
+    }
+    catch (error) {
+        s.stop("Fallaron las migraciones");
+        p.log.error(error.message);
+        process.exitCode = 1;
+        return;
+    }
+    await askApplicationStep(db);
+    await askDeploymentStep(repoRoot, db);
+    p.outro("Listo. Crea tu primer usuario/organización desde /register en auth-server, y usa @kontrolia/react en tus apps.");
+}
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});

package/dist/steps/application.d.ts

@@ -0,0 +1,10 @@
+import type { DatabaseAnswer } from "./database.js";
+/**
+ * Optional final step: registers a first application and its permission
+ * catalog. kontrolia.applications/permissions have no write policy for
+ * regular users (see migrations/0010_rls_policies.sql) and no admin API
+ * exists yet for it, so this writes directly against Postgres — the same
+ * platform-admin path migrate() already uses to apply schema changes.
+ */
+export declare function askApplicationStep(db: DatabaseAnswer): Promise<void>;
+//# sourceMappingURL=application.d.ts.map

package/dist/steps/application.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../src/steps/application.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAYpD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6E1E"}

package/dist/steps/application.js

@@ -0,0 +1,92 @@
+import * as p from "@clack/prompts";
+import { registerApplication } from "@kontrolia/db";
+function slugify(name) {
+    return name
+        .trim()
+        .toLowerCase()
+        .normalize("NFD")
+        .replace(/[̀-ͯ]/g, "")
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/(^-+|-+$)/g, "");
+}
+/**
+ * Optional final step: registers a first application and its permission
+ * catalog. kontrolia.applications/permissions have no write policy for
+ * regular users (see migrations/0010_rls_policies.sql) and no admin API
+ * exists yet for it, so this writes directly against Postgres — the same
+ * platform-admin path migrate() already uses to apply schema changes.
+ */
+export async function askApplicationStep(db) {
+    const wantsApp = await p.confirm({
+        message: "¿Quieres registrar tu primera aplicación (con su catálogo de permisos) ahora?",
+        initialValue: true,
+    });
+    if (p.isCancel(wantsApp)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    if (!wantsApp) {
+        p.note("Puedes registrar aplicaciones más tarde corriendo este wizard de nuevo, o insertando directamente en kontrolia.applications / kontrolia.permissions.", "Omitido");
+        return;
+    }
+    const name = await textOrExit("Nombre de la aplicación", "Facturación");
+    const slug = slugify(name);
+    const environment = await p.select({
+        message: "Entorno",
+        options: [
+            { value: "development", label: "development" },
+            { value: "staging", label: "staging" },
+            { value: "production", label: "production" },
+        ],
+        initialValue: "development",
+    });
+    if (p.isCancel(environment)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    p.note(`Cada permiso queda como ${slug}.<recurso>.<acción> — p. ej. facturas / crear.`, "Catálogo de permisos");
+    const permissions = [];
+    let addAnother = true;
+    while (addAnother) {
+        const resource = await textOrExit("Recurso", "facturas");
+        const action = await textOrExit("Acción", "crear");
+        const description = await p.text({ message: "Descripción (opcional)", placeholder: "Crear facturas" });
+        if (p.isCancel(description)) {
+            p.cancel("Instalación cancelada.");
+            process.exit(0);
+        }
+        permissions.push({ resource, action, description: description || undefined });
+        const more = await p.confirm({ message: "¿Agregar otro permiso?", initialValue: false });
+        if (p.isCancel(more)) {
+            p.cancel("Instalación cancelada.");
+            process.exit(0);
+        }
+        addAnother = more;
+    }
+    const s = p.spinner();
+    s.start(`Registrando ${name} (${slug}) y ${permissions.length} permiso(s)`);
+    try {
+        const { permissionKeys } = await registerApplication({
+            connectionString: db.databaseUrl,
+            name,
+            slug,
+            environment,
+            permissions,
+        });
+        s.stop(`Aplicación ${slug} registrada: ${permissionKeys.join(", ")}`);
+    }
+    catch (error) {
+        s.stop("No se pudo registrar la aplicación");
+        p.log.error(error.message);
+        return;
+    }
+    p.note("Para habilitarla en una organización (kontrolia.application_organizations) y asignarla a un rol, hazlo por ahora directo en la base de datos — el admin panel todavía solo permite verla, no darla de alta.", "Siguiente paso");
+}
+async function textOrExit(message, placeholder) {
+    const value = await p.text({ message, placeholder });
+    if (p.isCancel(value)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    return value;
+}

package/dist/steps/database.d.ts

@@ -0,0 +1,13 @@
+export interface DatabaseAnswer {
+    mode: "existing" | "new-self-hosted";
+    databaseUrl: string;
+    supabaseUrl: string;
+    anonKey: string;
+    serviceRoleKey: string;
+}
+/**
+ * Question A from the architecture plan: where does Postgres + GoTrue come
+ * from? Two fully independent paths — neither assumes Docker.
+ */
+export declare function askDatabaseStep(repoRoot: string): Promise<DatabaseAnswer>;
+//# sourceMappingURL=database.d.ts.map

package/dist/steps/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/steps/database.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmE/E"}

package/dist/steps/database.js

@@ -0,0 +1,70 @@
+import * as p from "@clack/prompts";
+import { generateJwtSecret } from "../utils/secrets.js";
+import { generateSupabaseKeys } from "../utils/supabase-keys.js";
+import { writeEnvFile } from "../utils/files.js";
+/**
+ * Question A from the architecture plan: where does Postgres + GoTrue come
+ * from? Two fully independent paths — neither assumes Docker.
+ */
+export async function askDatabaseStep(repoRoot) {
+    const mode = await p.select({
+        message: "¿De dónde sale tu Supabase (Postgres + Auth)?",
+        options: [
+            {
+                value: "existing",
+                label: "Ya tengo un proyecto Supabase (Cloud o self-hosted)",
+                hint: "pegas la URL y las keys, sin Docker",
+            },
+            {
+                value: "new-self-hosted",
+                label: "Crear uno nuevo self-hosted con Docker",
+                hint: "levanta Postgres + GoTrue + PostgREST + Kong localmente",
+            },
+        ],
+    });
+    if (p.isCancel(mode)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    if (mode === "existing") {
+        const supabaseUrl = await textOrExit("URL de tu proyecto Supabase", "https://tu-proyecto.supabase.co");
+        const anonKey = await textOrExit("Anon/public key");
+        const serviceRoleKey = await textOrExit("Service role key (server-only, nunca la expongas al navegador)");
+        const databaseUrl = await textOrExit("Connection string de Postgres", "postgres://postgres:...@db.tu-proyecto.supabase.co:5432/postgres");
+        p.note("Si tu proyecto es Supabase Cloud, activa el Custom Access Token Hook manualmente en Dashboard → Authentication → Hooks → selecciona kontrolia.custom_access_token_hook. No se puede automatizar por API.", "Paso manual pendiente");
+        return { mode, databaseUrl, supabaseUrl, anonKey, serviceRoleKey };
+    }
+    const jwtSecret = generateJwtSecret();
+    const { anonKey, serviceRoleKey } = await generateSupabaseKeys(jwtSecret);
+    const postgresPassword = generateJwtSecret().slice(0, 24);
+    const s = p.spinner();
+    s.start("Generando docker/.env");
+    await writeEnvFile(`${repoRoot}/docker/.env`, {
+        POSTGRES_PASSWORD: postgresPassword,
+        POSTGRES_PORT: "5432",
+        JWT_SECRET: jwtSecret,
+        ANON_KEY: anonKey,
+        SERVICE_ROLE_KEY: serviceRoleKey,
+        SUPABASE_PORT: "8000",
+        SUPABASE_PUBLIC_URL: "http://localhost:8000",
+        SITE_URL: "http://localhost:3000",
+        GOTRUE_MAILER_AUTOCONFIRM: "true",
+    });
+    s.stop("docker/.env generado");
+    p.note("docker compose -f docker/docker-compose.yml up -d\n(corre esto ahora, o después — el wizard no lo hace por ti para que puedas revisar docker/.env primero)", "Siguiente paso");
+    return {
+        mode,
+        databaseUrl: `postgres://postgres:${postgresPassword}@localhost:5432/postgres`,
+        supabaseUrl: "http://localhost:8000",
+        anonKey,
+        serviceRoleKey,
+    };
+}
+async function textOrExit(message, placeholder) {
+    const value = await p.text({ message, placeholder });
+    if (p.isCancel(value)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    return value;
+}

package/dist/steps/deployment.d.ts

@@ -0,0 +1,8 @@
+import type { DatabaseAnswer } from "./database.js";
+/**
+ * Question B from the architecture plan: where do auth-server/admin-panel
+ * run? Fully independent from the database question above — this only
+ * ever generates env files, it never touches the database connection.
+ */
+export declare function askDeploymentStep(repoRoot: string, db: DatabaseAnswer): Promise<void>;
+//# sourceMappingURL=deployment.d.ts.map

package/dist/steps/deployment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAYpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC3F"}

package/dist/steps/deployment.js

@@ -0,0 +1,44 @@
+import * as p from "@clack/prompts";
+import { writeEnvFile } from "../utils/files.js";
+const NEXT_STEPS = {
+    docker: "Se despliegan como parte del mismo docker/docker-compose.yml (servicios auth-server y admin-panel).",
+    vercel: "vercel deploy en apps/auth-server y apps/admin-panel por separado, configurando las mismas variables en el dashboard de Vercel.",
+    coolify: "Crea dos recursos 'Next.js App' en Coolify apuntando a apps/auth-server y apps/admin-panel, con las variables de .env.local generadas.",
+    railway: "railway up en apps/auth-server y apps/admin-panel, o conéctalos como servicios desde el repo en el dashboard de Railway.",
+    manual: "Corre `pnpm build && pnpm start` en apps/auth-server y apps/admin-panel en el servidor/K8s de tu elección, usando los .env.local generados.",
+};
+/**
+ * Question B from the architecture plan: where do auth-server/admin-panel
+ * run? Fully independent from the database question above — this only
+ * ever generates env files, it never touches the database connection.
+ */
+export async function askDeploymentStep(repoRoot, db) {
+    const target = await p.select({
+        message: "¿Dónde vas a desplegar auth-server / admin-panel?",
+        options: [
+            { value: "docker", label: "Docker (incluido en el mismo docker-compose)" },
+            { value: "vercel", label: "Vercel" },
+            { value: "coolify", label: "Coolify" },
+            { value: "railway", label: "Railway" },
+            { value: "manual", label: "Otro / Kubernetes / manual" },
+        ],
+    });
+    if (p.isCancel(target)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    const s = p.spinner();
+    s.start("Generando apps/auth-server/.env.local y apps/admin-panel/.env.local");
+    await writeEnvFile(`${repoRoot}/apps/auth-server/.env.local`, {
+        NEXT_PUBLIC_SUPABASE_URL: db.supabaseUrl,
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: db.anonKey,
+        SUPABASE_URL: db.supabaseUrl,
+        SUPABASE_SERVICE_ROLE_KEY: db.serviceRoleKey,
+    });
+    await writeEnvFile(`${repoRoot}/apps/admin-panel/.env.local`, {
+        NEXT_PUBLIC_SUPABASE_URL: db.supabaseUrl,
+        NEXT_PUBLIC_SUPABASE_ANON_KEY: db.anonKey,
+    });
+    s.stop(".env.local generados en auth-server y admin-panel");
+    p.note(NEXT_STEPS[target], `Despliegue: ${target}`);
+}

package/dist/utils/files.d.ts

@@ -0,0 +1,6 @@
+export interface EnvValues {
+    [key: string]: string;
+}
+export declare function writeEnvFile(path: string, values: EnvValues): Promise<void>;
+export declare function fileExists(path: string): boolean;
+//# sourceMappingURL=files.d.ts.map

package/dist/utils/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD"}

package/dist/utils/files.js

@@ -0,0 +1,11 @@
+import { existsSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
+export async function writeEnvFile(path, values) {
+    const contents = Object.entries(values)
+        .map(([key, value]) => `${key}=${value}`)
+        .join("\n");
+    await writeFile(path, `${contents}\n`, "utf8");
+}
+export function fileExists(path) {
+    return existsSync(path);
+}

package/dist/utils/secrets.d.ts

@@ -0,0 +1,3 @@
+/** Local-only secret generation for the self-hosted docker-compose path. */
+export declare function generateJwtSecret(): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/utils/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/utils/secrets.ts"],"names":[],"mappings":"AAEA,4EAA4E;AAC5E,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C"}

package/dist/utils/secrets.js

@@ -0,0 +1,5 @@
+import { randomBytes } from "node:crypto";
+/** Local-only secret generation for the self-hosted docker-compose path. */
+export function generateJwtSecret() {
+    return randomBytes(32).toString("hex");
+}

package/dist/utils/supabase-keys.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Mints local anon/service_role keys for the self-hosted docker-compose
+ * path — these are just HS256 JWTs signed with the project's JWT_SECRET,
+ * the same scheme Supabase's own key generator uses.
+ */
+export declare function generateSupabaseKeys(jwtSecret: string): Promise<{
+    anonKey: string;
+    serviceRoleKey: string;
+}>;
+//# sourceMappingURL=supabase-keys.d.ts.map

package/dist/utils/supabase-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-keys.d.ts","sourceRoot":"","sources":["../../src/utils/supabase-keys.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM;;;GAgB3D"}

package/dist/utils/supabase-keys.js

@@ -0,0 +1,20 @@
+import { SignJWT } from "jose";
+/**
+ * Mints local anon/service_role keys for the self-hosted docker-compose
+ * path — these are just HS256 JWTs signed with the project's JWT_SECRET,
+ * the same scheme Supabase's own key generator uses.
+ */
+export async function generateSupabaseKeys(jwtSecret) {
+    const secret = new TextEncoder().encode(jwtSecret);
+    const issuedAt = Math.floor(Date.now() / 1000);
+    const tenYears = 10 * 365 * 24 * 60 * 60;
+    const sign = (role) => new SignJWT({ role, iss: "kontrolia-auth" })
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuedAt(issuedAt)
+        .setExpirationTime(issuedAt + tenYears)
+        .sign(secret);
+    return {
+        anonKey: await sign("anon"),
+        serviceRoleKey: await sign("service_role"),
+    };
+}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "create-kontrolia-auth",
+  "version": "1.0.0",
+  "license": "MIT",
+  "description": "Installer wizard for KontrolIA Auth. Two independent questions: (1) connect to an existing Supabase project or create a new self-hosted one via Docker; (2) where to deploy auth-server/admin-panel (Docker, Vercel, Coolify, Railway).",
+  "keywords": [
+    "kontrolia",
+    "auth",
+    "cli",
+    "installer",
+    "iam",
+    "supabase"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rauldolores/auth.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/rauldolores/auth#readme",
+  "bugs": "https://github.com/rauldolores/auth/issues",
+  "author": "KontrolIA",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "create-kontrolia-auth": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@clack/prompts": "^0.9.1",
+    "jose": "^5.9.6",
+    "@kontrolia/db": "1.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "eslint": "^9.17.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "@kontrolia/config": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsx src/index.ts",
+    "lint": "eslint .",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rimraf dist"
+  }
+}