create-kontrolia-auth 1.0.0 → 1.1.0

package/dist/steps/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAYpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC3F"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAYpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiI3F"}

package/dist/steps/deployment.js

@@ -1,5 +1,6 @@
 import * as p from "@clack/prompts";
-import { writeEnvFile } from "../utils/files.js";
+import { updateEnvValue, writeEnvFile } from "../utils/files.js";
+import { registerOAuthClient } from "../utils/oauth-client.js";
 const NEXT_STEPS = {
     docker: "Se despliegan como parte del mismo docker/docker-compose.yml (servicios auth-server y admin-panel).",
     vercel: "vercel deploy en apps/auth-server y apps/admin-panel por separado, configurando las mismas variables en el dashboard de Vercel.",
@@ -27,6 +28,63 @@ export async function askDeploymentStep(repoRoot, db) {
         p.cancel("Instalación cancelada.");
         process.exit(0);
     }
+    const authServerUrl = await p.text({
+        message: "¿En qué URL va a vivir auth-server? (admin-panel la usa para enviar ahí a quien no tenga sesión)",
+        placeholder: "http://localhost:3000",
+        defaultValue: "http://localhost:3000",
+    });
+    if (p.isCancel(authServerUrl)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    const adminPanelUrl = await p.text({
+        message: "¿Y en qué URL va a vivir admin-panel? (auth-server la usa para regresar ahí después de iniciar sesión, en vez de mandarte a su propia pantalla de inicio)",
+        placeholder: "http://localhost:3001",
+        defaultValue: "http://localhost:3001",
+    });
+    if (p.isCancel(adminPanelUrl)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    const cookieDomain = await p.text({
+        message: "¿auth-server y admin-panel van a vivir en subdominios del mismo dominio (ej. auth.tuempresa.com y admin.tuempresa.com)? " +
+            "Si es así, escribe el dominio compartido empezando con un punto (ej. .tuempresa.com). Si comparten el mismo host, o no lo sabes todavía, déjalo vacío.",
+        placeholder: "",
+        defaultValue: "",
+    });
+    if (p.isCancel(cookieDomain)) {
+        p.cancel("Instalación cancelada.");
+        process.exit(0);
+    }
+    // Registers admin-panel as a first-party OAuth 2.1 client of this
+    // Supabase project so the dashboard can redirect straight through the
+    // authorize/consent/token flow instead of relying on a shared cookie
+    // domain — the only way SSO works when auth-server and admin-panel end up
+    // on genuinely different domains, not just subdomains.
+    const oauthSpinner = p.spinner();
+    oauthSpinner.start("Registrando admin-panel como cliente OAuth 2.1");
+    let oauthClientId = null;
+    try {
+        oauthClientId = await registerOAuthClient({
+            supabaseUrl: db.supabaseUrl,
+            serviceRoleKey: db.serviceRoleKey,
+            clientName: "admin-panel",
+            redirectUris: [`${adminPanelUrl}/oauth/callback`],
+        });
+    }
+    catch {
+        oauthClientId = null;
+    }
+    if (oauthClientId) {
+        oauthSpinner.stop("admin-panel registrado como cliente OAuth 2.1");
+    }
+    else {
+        oauthSpinner.stop("No se pudo registrar el cliente OAuth 2.1 (se omite)");
+        p.note("Tu proyecto Supabase no tiene habilitado el servidor OAuth 2.1 de GoTrue (GOTRUE_OAUTH_SERVER_ENABLED). " +
+            "admin-panel seguirá funcionando con el enlace de login normal, pero eso solo mantiene la sesión si " +
+            "auth-server y admin-panel comparten dominio (o subdominios con NEXT_PUBLIC_COOKIE_DOMAIN). " +
+            "Si en el futuro necesitas dominios completamente distintos, habilita esa opción en tu proyecto y vuelve a correr el instalador.", "Paso manual pendiente");
+    }
     const s = p.spinner();
     s.start("Generando apps/auth-server/.env.local y apps/admin-panel/.env.local");
     await writeEnvFile(`${repoRoot}/apps/auth-server/.env.local`, {
@@ -34,11 +92,35 @@ export async function askDeploymentStep(repoRoot, db) {
         NEXT_PUBLIC_SUPABASE_ANON_KEY: db.anonKey,
         SUPABASE_URL: db.supabaseUrl,
         SUPABASE_SERVICE_ROLE_KEY: db.serviceRoleKey,
+        NEXT_PUBLIC_ADMIN_PANEL_URL: adminPanelUrl,
+        NEXT_PUBLIC_COOKIE_DOMAIN: cookieDomain,
     });
     await writeEnvFile(`${repoRoot}/apps/admin-panel/.env.local`, {
         NEXT_PUBLIC_SUPABASE_URL: db.supabaseUrl,
         NEXT_PUBLIC_SUPABASE_ANON_KEY: db.anonKey,
+        NEXT_PUBLIC_AUTH_SERVER_URL: authServerUrl,
+        NEXT_PUBLIC_COOKIE_DOMAIN: cookieDomain,
+        NEXT_PUBLIC_OAUTH_CLIENT_ID: oauthClientId ?? "",
     });
+    if (db.mode === "new-self-hosted") {
+        // database.ts wrote SITE_URL="http://localhost:3000" as a fixed default
+        // *before* this step ever asked where auth-server actually lives —
+        // if authServerUrl isn't that default, GoTrue would otherwise keep
+        // building its own /oauth/consent redirects (and email links) against
+        // the wrong host forever.
+        await updateEnvValue(`${repoRoot}/docker/.env`, "SITE_URL", authServerUrl);
+        await updateEnvValue(`${repoRoot}/docker/.env`, "ADMIN_PANEL_URL", adminPanelUrl);
+        if (cookieDomain) {
+            await updateEnvValue(`${repoRoot}/docker/.env`, "COOKIE_DOMAIN", cookieDomain);
+        }
+        if (oauthClientId) {
+            await updateEnvValue(`${repoRoot}/docker/.env`, "OAUTH_CLIENT_ID", oauthClientId);
+        }
+    }
     s.stop(".env.local generados en auth-server y admin-panel");
+    if (db.mode === "new-self-hosted") {
+        p.note("docker/.env se actualizó con las URLs reales — como el contenedor de auth (GoTrue) ya estaba arriba con los " +
+            "valores por defecto, corre `docker compose -f docker/docker-compose.yml up -d` una vez más para que los tome.", "Reinicia el docker-compose");
+    }
     p.note(NEXT_STEPS[target], `Despliegue: ${target}`);
 }

package/dist/utils/files.d.ts

@@ -2,5 +2,11 @@ export interface EnvValues {
     [key: string]: string;
 }
 export declare function writeEnvFile(path: string, values: EnvValues): Promise<void>;
+/**
+ * Updates (or appends) a single key in an existing .env file without
+ * touching the rest — for docker/.env, which database.ts already wrote a
+ * full set of values into before deployment.ts runs.
+ */
+export declare function updateEnvValue(path: string, key: string, value: string): Promise<void>;
 export declare function fileExists(path: string): boolean;
 //# sourceMappingURL=files.d.ts.map

package/dist/utils/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/utils/files.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ5F;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD"}

package/dist/utils/files.js

@@ -1,11 +1,25 @@
 import { existsSync } from "node:fs";
-import { writeFile } from "node:fs/promises";
+import { readFile, writeFile } from "node:fs/promises";
 export async function writeEnvFile(path, values) {
     const contents = Object.entries(values)
         .map(([key, value]) => `${key}=${value}`)
         .join("\n");
     await writeFile(path, `${contents}\n`, "utf8");
 }
+/**
+ * Updates (or appends) a single key in an existing .env file without
+ * touching the rest — for docker/.env, which database.ts already wrote a
+ * full set of values into before deployment.ts runs.
+ */
+export async function updateEnvValue(path, key, value) {
+    const current = existsSync(path) ? await readFile(path, "utf8") : "";
+    const line = `${key}=${value}`;
+    const pattern = new RegExp(`^${key}=.*$`, "m");
+    const updated = pattern.test(current)
+        ? current.replace(pattern, line)
+        : `${current.replace(/\n+$/, "")}\n${line}\n`;
+    await writeFile(path, updated.replace(/^\n/, ""), "utf8");
+}
 export function fileExists(path) {
     return existsSync(path);
 }

package/dist/utils/oauth-client.d.ts

@@ -0,0 +1,21 @@
+export interface RegisterOAuthClientOptions {
+    supabaseUrl: string;
+    serviceRoleKey: string;
+    clientName: string;
+    redirectUris: string[];
+}
+/**
+ * Registers a first-party OAuth client (admin-panel) against this Supabase
+ * project's own OAuth 2.1 server, via the service-role admin API — the only
+ * way SSO between auth-server and admin-panel survives them living on
+ * genuinely different domains (not just subdomains), since a shared cookie
+ * simply can't cross that boundary.
+ *
+ * Returns null (rather than throwing) when the project doesn't have OAuth
+ * server mode enabled — an existing Supabase project the installer doesn't
+ * control the config of, same "last mile manual step" as the Custom Access
+ * Token Hook. The caller is expected to fall back gracefully and tell the
+ * user how to enable it themselves.
+ */
+export declare function registerOAuthClient(options: RegisterOAuthClientOptions): Promise<string | null>;
+//# sourceMappingURL=oauth-client.d.ts.map

package/dist/utils/oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../../src/utils/oauth-client.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBrG"}

package/dist/utils/oauth-client.js

@@ -0,0 +1,33 @@
+/**
+ * Registers a first-party OAuth client (admin-panel) against this Supabase
+ * project's own OAuth 2.1 server, via the service-role admin API — the only
+ * way SSO between auth-server and admin-panel survives them living on
+ * genuinely different domains (not just subdomains), since a shared cookie
+ * simply can't cross that boundary.
+ *
+ * Returns null (rather than throwing) when the project doesn't have OAuth
+ * server mode enabled — an existing Supabase project the installer doesn't
+ * control the config of, same "last mile manual step" as the Custom Access
+ * Token Hook. The caller is expected to fall back gracefully and tell the
+ * user how to enable it themselves.
+ */
+export async function registerOAuthClient(options) {
+    const response = await fetch(`${options.supabaseUrl.replace(/\/$/, "")}/auth/v1/admin/oauth/clients`, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${options.serviceRoleKey}`,
+            apikey: options.serviceRoleKey,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            client_name: options.clientName,
+            redirect_uris: options.redirectUris,
+            client_type: "public",
+            token_endpoint_auth_method: "none",
+        }),
+    });
+    if (!response.ok)
+        return null;
+    const data = (await response.json());
+    return data.client_id;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kontrolia-auth",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "license": "MIT",
   "description": "Installer wizard for KontrolIA Auth. Two independent questions: (1) connect to an existing Supabase project or create a new self-hosted one via Docker; (2) where to deploy auth-server/admin-panel (Docker, Vercel, Coolify, Railway).",
   "keywords": [
@@ -32,7 +32,7 @@
   "dependencies": {
     "@clack/prompts": "^0.9.1",
     "jose": "^5.9.6",
-    "@kontrolia/db": "1.0.0"
+    "@kontrolia/db": "1.0.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",