create-kontrolia-auth 2.4.0 → 2.4.1

package/dist/steps/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA8JpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAoJ3F"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAiLpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAsJ3F"}

package/dist/steps/deployment.js

@@ -2,6 +2,26 @@ import * as p from "@clack/prompts";
 import { readEnvFile, updateEnvValue, writeEnvFile } from "../utils/files.js";
 import { registerOAuthClient } from "../utils/oauth-client.js";
 import { createVercelProject, detectCurrentBranch, detectGitHubRepo, triggerVercelDeployment } from "../utils/vercel-api.js";
+/**
+ * Catches a `http://` URL for a real domain before it gets baked into env
+ * vars — this exact typo shipped once already and broke CORS silently: the
+ * browser sends `Origin: https://panel.example.com`, the server only
+ * allow-lists the `http://` variant from this value, and every fetch()
+ * from admin-panel to auth-server fails with an unhelpful "Failed to
+ * fetch" that gives no hint the mismatch is just one character. `http://`
+ * is still fine for localhost/127.0.0.1 since nothing serves plain HTTP
+ * during local dev.
+ */
+function validateDeployUrl(value) {
+    if (!value.trim())
+        return "Requerido";
+    if (/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/i.test(value.trim()))
+        return undefined;
+    if (!/^https:\/\//i.test(value.trim())) {
+        return 'Usa https:// para un dominio real (http:// solo vale para localhost) — si no, el navegador bloquea las llamadas entre auth-server y admin-panel por CORS.';
+    }
+    return undefined;
+}
 const NEXT_STEPS = {
     docker: "Ya está: los servicios auth-server y admin-panel viven en el mismo docker/docker-compose.yml. Corre `docker compose -f docker/docker-compose.yml up -d` para tenerlos arriba.",
     vercel: "Lo más confiable con un monorepo pnpm es conectar el repo desde el dashboard (no desplegar carpetas sueltas por CLI):\n" +
@@ -156,6 +176,7 @@ export async function askDeploymentStep(repoRoot, db) {
         placeholder: "http://localhost:3000",
         defaultValue: "http://localhost:3000",
         initialValue: prevAuthServerUrl,
+        validate: validateDeployUrl,
     });
     if (p.isCancel(authServerUrl)) {
         p.cancel("Instalación cancelada.");
@@ -166,6 +187,7 @@ export async function askDeploymentStep(repoRoot, db) {
         placeholder: "http://localhost:3001",
         defaultValue: "http://localhost:3001",
         initialValue: prevAdminPanelUrl,
+        validate: validateDeployUrl,
     });
     if (p.isCancel(adminPanelUrl)) {
         p.cancel("Instalación cancelada.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kontrolia-auth",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "license": "MIT",
   "description": "Turnkey installer for KontrolIA Auth. `npx create-kontrolia-auth mi-app` checks requirements, downloads the repo, installs deps, and runs a wizard: (1) connect to an existing Supabase project or create a new self-hosted one via Docker; (2) where to deploy auth-server/admin-panel (Docker, Vercel, Railway, Render, Coolify). Also exposes `update`, `migrate` and `doctor` subcommands.",
   "keywords": [