create-kontrolia-auth 2.4.0 → 2.4.2

package/dist/steps/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA8JpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAoJ3F"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/steps/deployment.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAiLpD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAsJ3F"}

package/dist/steps/deployment.js

@@ -2,6 +2,26 @@ import * as p from "@clack/prompts";
 import { readEnvFile, updateEnvValue, writeEnvFile } from "../utils/files.js";
 import { registerOAuthClient } from "../utils/oauth-client.js";
 import { createVercelProject, detectCurrentBranch, detectGitHubRepo, triggerVercelDeployment } from "../utils/vercel-api.js";
+/**
+ * Catches a `http://` URL for a real domain before it gets baked into env
+ * vars — this exact typo shipped once already and broke CORS silently: the
+ * browser sends `Origin: https://panel.example.com`, the server only
+ * allow-lists the `http://` variant from this value, and every fetch()
+ * from admin-panel to auth-server fails with an unhelpful "Failed to
+ * fetch" that gives no hint the mismatch is just one character. `http://`
+ * is still fine for localhost/127.0.0.1 since nothing serves plain HTTP
+ * during local dev.
+ */
+function validateDeployUrl(value) {
+    if (!value.trim())
+        return "Requerido";
+    if (/^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?\/?$/i.test(value.trim()))
+        return undefined;
+    if (!/^https:\/\//i.test(value.trim())) {
+        return 'Usa https:// para un dominio real (http:// solo vale para localhost) — si no, el navegador bloquea las llamadas entre auth-server y admin-panel por CORS.';
+    }
+    return undefined;
+}
 const NEXT_STEPS = {
     docker: "Ya está: los servicios auth-server y admin-panel viven en el mismo docker/docker-compose.yml. Corre `docker compose -f docker/docker-compose.yml up -d` para tenerlos arriba.",
     vercel: "Lo más confiable con un monorepo pnpm es conectar el repo desde el dashboard (no desplegar carpetas sueltas por CLI):\n" +
@@ -156,6 +176,7 @@ export async function askDeploymentStep(repoRoot, db) {
         placeholder: "http://localhost:3000",
         defaultValue: "http://localhost:3000",
         initialValue: prevAuthServerUrl,
+        validate: validateDeployUrl,
     });
     if (p.isCancel(authServerUrl)) {
         p.cancel("Instalación cancelada.");
@@ -166,6 +187,7 @@ export async function askDeploymentStep(repoRoot, db) {
         placeholder: "http://localhost:3001",
         defaultValue: "http://localhost:3001",
         initialValue: prevAdminPanelUrl,
+        validate: validateDeployUrl,
     });
     if (p.isCancel(adminPanelUrl)) {
         p.cancel("Instalación cancelada.");

package/dist/utils/supabase-management-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supabase-management-api.d.ts","sourceRoot":"","sources":["../../src/utils/supabase-management-api.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGpE;AASD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+BtH;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBjH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBvG"}
+{"version":3,"file":"supabase-management-api.d.ts","sourceRoot":"","sources":["../../src/utils/supabase-management-api.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,OAAO,CAAC;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGpE;AASD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+BtH;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBjH;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBvG"}

package/dist/utils/supabase-management-api.js

@@ -1,6 +1,16 @@
 const CUSTOM_ACCESS_TOKEN_HOOK_URI = "pg-functions://postgres/kontrolia_auth/custom_access_token_hook";
-/** GoTrue's internal route for the OAuth 2.1 authorization endpoint — the API rejects oauth_server_enabled without it. */
-const OAUTH_SERVER_AUTHORIZATION_PATH = "/oauth/authorize";
+/**
+ * NOT GoTrue's own /auth/v1/oauth/authorize endpoint (that one is fixed,
+ * not configurable) — this is the path on OUR OWN app (auth-server) that
+ * GoTrue redirects the browser to, with an `authorization_id` query param,
+ * so the app can render its consent screen. Must match the route
+ * auth-server actually serves (apps/auth-server/app/oauth/consent/page.tsx)
+ * and the value docker-compose.yml already sets for self-hosted
+ * (GOTRUE_OAUTH_SERVER_AUTHORIZATION_PATH). Getting this wrong doesn't
+ * surface as an error on enable — it silently breaks every OAuth
+ * authorization attempt afterward, redirecting to a path nothing serves.
+ */
+const OAUTH_SERVER_AUTHORIZATION_PATH = "/oauth/consent";
 /**
  * Extracts the project ref (subdomain) from a Supabase Cloud URL, e.g.
  * "https://abcxyz.supabase.co" -> "abcxyz". Returns null for anything else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kontrolia-auth",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "license": "MIT",
   "description": "Turnkey installer for KontrolIA Auth. `npx create-kontrolia-auth mi-app` checks requirements, downloads the repo, installs deps, and runs a wizard: (1) connect to an existing Supabase project or create a new self-hosted one via Docker; (2) where to deploy auth-server/admin-panel (Docker, Vercel, Railway, Render, Coolify). Also exposes `update`, `migrate` and `doctor` subcommands.",
   "keywords": [