create-kontrolia-auth 2.2.2 → 2.3.0

package/README.md

@@ -16,6 +16,12 @@ Eso hace, en orden:
 2. **Descarga** el repositorio en `./mi-app` e instala dependencias.
 3. **Base de datos** — dos caminos independientes:
    - _Ya tengo Supabase_ (Cloud o self-hosted): pegas URL + keys, sin Docker.
+     Si es un proyecto Supabase Cloud, además ofrece **configurar
+     automáticamente** los dos ajustes que solo viven en su Dashboard —
+     exponer el schema `kontrolia_auth` en la API y activar el Custom Access
+     Token Hook — vía la Management API de Supabase (pide un Personal Access
+     Token de tu cuenta, distinto a las keys del proyecto; no se guarda). Si
+     lo saltas, muestra las instrucciones manuales exactas.
    - _Crear uno nuevo self-hosted_: genera `docker/.env`, **levanta los
      contenedores por ti** (`docker compose up -d`) y aplica las migraciones
      en cuanto Postgres está listo.

package/dist/steps/database.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/steps/database.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmE/E"}
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/steps/database.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAmDD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAiF/E"}

package/dist/steps/database.js

@@ -3,6 +3,49 @@ import { generateJwtSecret } from "../utils/secrets.js";
 import { generateSupabaseKeys } from "../utils/supabase-keys.js";
 import { writeEnvFile } from "../utils/files.js";
 import { textOrExit } from "../utils/prompts.js";
+import { addExposedSchema, enableCustomAccessTokenHook, extractProjectRef } from "../utils/supabase-management-api.js";
+/**
+ * Offers to configure the two Supabase Cloud dashboard-only settings
+ * (exposed schemas + Custom Access Token Hook) via the Management API
+ * instead of leaving them as manual steps — mirrors the Vercel deploy
+ * automation: a separate, more powerful "Personal Access Token" (account
+ * level, not the project's anon/service keys), captured with masked input
+ * and never persisted. Only offered for Supabase Cloud URLs (self-hosted
+ * projects and custom domains have no Management API to call). Returns
+ * which parts actually succeeded so the caller can fall back to a manual
+ * note for whichever one didn't.
+ */
+async function tryAutoConfigureSupabaseCloud(supabaseUrl) {
+    const projectRef = extractProjectRef(supabaseUrl);
+    if (!projectRef)
+        return { schemaDone: false, hookDone: false };
+    const auto = await p.confirm({
+        message: "¿Quieres que configure automáticamente el schema expuesto y el Custom Access Token Hook en tu proyecto Supabase? " +
+            "Necesito un Personal Access Token de tu cuenta Supabase (distinto a las keys del proyecto que ya diste).",
+        initialValue: true,
+    });
+    if (p.isCancel(auto) || !auto)
+        return { schemaDone: false, hookDone: false };
+    p.note("1. Entra a supabase.com/dashboard/account/tokens\n" +
+        '2. Dale click a "Generate new token"\n' +
+        "3. Ponle un nombre, confirma y cópialo (solo se ve una vez)\n" +
+        "4. Pégalo aquí abajo", "Cómo conseguir el Personal Access Token de Supabase");
+    const managementToken = await p.password({
+        message: "Personal Access Token de Supabase (no se guarda, solo se usa ahora)",
+        validate: (value) => (value.trim() ? undefined : "Requerido"),
+    });
+    if (p.isCancel(managementToken))
+        return { schemaDone: false, hookDone: false };
+    const schemaSpinner = p.spinner();
+    schemaSpinner.start("Exponiendo el schema kontrolia_auth en la API de datos");
+    const schemaResult = await addExposedSchema(managementToken, projectRef, "kontrolia_auth");
+    schemaSpinner.stop(schemaResult.ok ? "Schema kontrolia_auth expuesto" : `Falló: ${schemaResult.error}`);
+    const hookSpinner = p.spinner();
+    hookSpinner.start("Activando el Custom Access Token Hook");
+    const hookResult = await enableCustomAccessTokenHook(managementToken, projectRef);
+    hookSpinner.stop(hookResult.ok ? "Hook activado" : `Falló: ${hookResult.error}`);
+    return { schemaDone: schemaResult.ok, hookDone: hookResult.ok };
+}
 /**
  * Question A from the architecture plan: where does Postgres + GoTrue come
  * from? Two fully independent paths — neither assumes Docker.
@@ -32,7 +75,19 @@ export async function askDatabaseStep(repoRoot) {
         const anonKey = await textOrExit("Anon/public key");
         const serviceRoleKey = await textOrExit("Service role key (server-only, nunca la expongas al navegador)");
         const databaseUrl = await textOrExit("Connection string de Postgres", "postgres://postgres:...@db.tu-proyecto.supabase.co:5432/postgres");
-        p.note("Si tu proyecto es Supabase Cloud, activa el Custom Access Token Hook manualmente en Dashboard → Authentication → Hooks → selecciona kontrolia_auth.custom_access_token_hook. No se puede automatizar por API.", "Paso manual pendiente");
+        const { schemaDone, hookDone } = await tryAutoConfigureSupabaseCloud(supabaseUrl);
+        if (!schemaDone || !hookDone) {
+            const pending = [];
+            if (!hookDone)
+                pending.push("Authentication → Hooks → activa kontrolia_auth.custom_access_token_hook.");
+            if (!schemaDone) {
+                pending.push("Project Settings → Data API → en \"Exposed schemas\" agrega kontrolia_auth (queda como: public, graphql_public, kontrolia_auth). " +
+                    "Sin esto, crear una organización u otras operaciones fallan con \"Invalid schema: kontrolia_auth\".");
+            }
+            p.note("Si tu proyecto es Supabase Cloud (o self-hosted fuera de nuestro docker-compose), estos ajustes solo se pueden hacer " +
+                "desde el Dashboard — la API de Supabase no los expone del todo:\n\n" +
+                pending.map((line, i) => `${i + 1}. ${line}`).join("\n"), pending.length > 1 ? "Pasos manuales pendientes" : "Paso manual pendiente");
+        }
         return { mode, databaseUrl, supabaseUrl, anonKey, serviceRoleKey };
     }
     const jwtSecret = generateJwtSecret();

package/dist/utils/supabase-management-api.d.ts

@@ -0,0 +1,28 @@
+export interface ManagementApiResult {
+    ok: boolean;
+    /** Only present when ok is false. */
+    error?: string;
+}
+/**
+ * Extracts the project ref (subdomain) from a Supabase Cloud URL, e.g.
+ * "https://abcxyz.supabase.co" -> "abcxyz". Returns null for anything else
+ * (self-hosted, a custom domain) — those aren't reachable through Supabase's
+ * account-level Management API, which only knows about Cloud projects.
+ */
+export declare function extractProjectRef(supabaseUrl: string): string | null;
+/**
+ * Adds a schema to the project's exposed-schemas list (PostgREST's
+ * `db_schema`) if it isn't there already — idempotent, and preserves
+ * whatever schemas were already exposed instead of overwriting them, since
+ * `db_schema` is a single string representing the *entire* list, not a
+ * per-schema toggle.
+ */
+export declare function addExposedSchema(token: string, projectRef: string, schema: string): Promise<ManagementApiResult>;
+/**
+ * Enables the Custom Access Token Hook against
+ * kontrolia_auth.custom_access_token_hook — the function that injects
+ * organization_id/roles/permissions into the JWT. Cloud projects' database
+ * is always named "postgres", so the pg-functions:// URI is fixed.
+ */
+export declare function enableCustomAccessTokenHook(token: string, projectRef: string): Promise<ManagementApiResult>;
+//# sourceMappingURL=supabase-management-api.d.ts.map

package/dist/utils/supabase-management-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase-management-api.d.ts","sourceRoot":"","sources":["../../src/utils/supabase-management-api.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGpE;AASD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+BtH;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBjH"}

package/dist/utils/supabase-management-api.js

@@ -0,0 +1,84 @@
+const CUSTOM_ACCESS_TOKEN_HOOK_URI = "pg-functions://postgres/kontrolia_auth/custom_access_token_hook";
+/**
+ * Extracts the project ref (subdomain) from a Supabase Cloud URL, e.g.
+ * "https://abcxyz.supabase.co" -> "abcxyz". Returns null for anything else
+ * (self-hosted, a custom domain) — those aren't reachable through Supabase's
+ * account-level Management API, which only knows about Cloud projects.
+ */
+export function extractProjectRef(supabaseUrl) {
+    const match = supabaseUrl.match(/^https:\/\/([a-z0-9-]+)\.supabase\.co\/?$/);
+    return match ? match[1] : null;
+}
+async function managementApiFetch(path, token, init) {
+    return fetch(`https://api.supabase.com/v1${path}`, {
+        ...init,
+        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json", ...init?.headers },
+    });
+}
+/**
+ * Adds a schema to the project's exposed-schemas list (PostgREST's
+ * `db_schema`) if it isn't there already — idempotent, and preserves
+ * whatever schemas were already exposed instead of overwriting them, since
+ * `db_schema` is a single string representing the *entire* list, not a
+ * per-schema toggle.
+ */
+export async function addExposedSchema(token, projectRef, schema) {
+    let getRes;
+    try {
+        getRes = await managementApiFetch(`/projects/${projectRef}/postgrest`, token);
+    }
+    catch (error) {
+        return { ok: false, error: error.message };
+    }
+    if (!getRes.ok) {
+        const body = (await getRes.json().catch(() => null));
+        return { ok: false, error: body?.message ?? `HTTP ${getRes.status} leyendo la config actual` };
+    }
+    const current = (await getRes.json());
+    const schemas = (current.db_schema ?? "public")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    if (schemas.includes(schema))
+        return { ok: true };
+    schemas.push(schema);
+    let patchRes;
+    try {
+        patchRes = await managementApiFetch(`/projects/${projectRef}/postgrest`, token, {
+            method: "PATCH",
+            body: JSON.stringify({ db_schema: schemas.join(",") }),
+        });
+    }
+    catch (error) {
+        return { ok: false, error: error.message };
+    }
+    if (patchRes.ok)
+        return { ok: true };
+    const body = (await patchRes.json().catch(() => null));
+    return { ok: false, error: body?.message ?? `HTTP ${patchRes.status}` };
+}
+/**
+ * Enables the Custom Access Token Hook against
+ * kontrolia_auth.custom_access_token_hook — the function that injects
+ * organization_id/roles/permissions into the JWT. Cloud projects' database
+ * is always named "postgres", so the pg-functions:// URI is fixed.
+ */
+export async function enableCustomAccessTokenHook(token, projectRef) {
+    let res;
+    try {
+        res = await managementApiFetch(`/projects/${projectRef}/config/auth`, token, {
+            method: "PATCH",
+            body: JSON.stringify({
+                hook_custom_access_token_enabled: true,
+                hook_custom_access_token_uri: CUSTOM_ACCESS_TOKEN_HOOK_URI,
+            }),
+        });
+    }
+    catch (error) {
+        return { ok: false, error: error.message };
+    }
+    if (res.ok)
+        return { ok: true };
+    const body = (await res.json().catch(() => null));
+    return { ok: false, error: body?.message ?? `HTTP ${res.status}` };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kontrolia-auth",
-  "version": "2.2.2",
+  "version": "2.3.0",
   "license": "MIT",
   "description": "Turnkey installer for KontrolIA Auth. `npx create-kontrolia-auth mi-app` checks requirements, downloads the repo, installs deps, and runs a wizard: (1) connect to an existing Supabase project or create a new self-hosted one via Docker; (2) where to deploy auth-server/admin-panel (Docker, Vercel, Railway, Render, Coolify). Also exposes `update`, `migrate` and `doctor` subcommands.",
   "keywords": [