create-navette 1.0.0-beta.3 → 1.0.0-beta.5

package/lib/index.js

@@ -7,6 +7,7 @@ import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from
 import { dirname, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
+import { readSecret } from "./secret.js";
 import { projectFiles } from "./templates.js";
 const own = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'));
 const args = process.argv.slice(2);
@@ -34,6 +35,27 @@ async function text(question, fallback, given) {
         return fallback;
     return (await prompt().question(`  ${bold(question)} ${dim(`(${fallback})`)} `)).trim() || fallback;
 }
+async function secret(question) {
+    // Readline would echo the characters: it is closed while the password is typed (`prompt()` opens a new one after).
+    rl?.close();
+    rl = null;
+    return readSecret(`  ${bold(question)} `);
+}
+/** The admin's password, typed twice; empty: `null`, one is generated. */
+async function choosePassword() {
+    for (;;) {
+        const password = await secret(`Admin password ${dim('(at least 8 characters; leave empty to generate one)')}`);
+        if (!password)
+            return null;
+        if (password.length < 8) {
+            say(`  ${dim('✖')} At least 8 characters: try again.`);
+            continue;
+        }
+        if ((await secret('Confirm the password')) === password)
+            return password;
+        say(`  ${dim('✖')} The passwords do not match: try again.`);
+    }
+}
 async function choose(question, choices, fallback, given) {
     if (given !== undefined) {
         const match = choices.find(([value]) => value === given);
@@ -70,6 +92,11 @@ const database = await choose('Database', [['sqlite', 'SQLite — a file, nothin
 const locale = await choose('Language of the interface', [['en', 'English'], ['fr', 'Français']], 'en', flag('locale'));
 const install = await confirm('Install the dependencies now?', true, flags['no-install'] ? 'no' : flags.install);
 const adminEmail = install && database === 'sqlite' ? await text('Admin email address', 'admin@example.com', flag('admin-email')) : null;
+// The admin's password: `--admin-password`, typed twice, or generated (and then shown at the end).
+const givenPassword = flag('admin-password');
+if (givenPassword !== undefined && givenPassword.length < 8)
+    fail('--admin-password must be at least 8 characters.');
+const chosenPassword = adminEmail ? (givenPassword ?? (interactive ? await choosePassword() : null)) : null;
 rl?.close();
 const options = {
     name: name.toLowerCase(), appName: name.replace(/[-_.]+/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase()),
@@ -97,13 +124,16 @@ for (const [file, content] of Object.entries(files)) {
 say(`\n  ✔ Created ${name} (${Object.keys(files).length} files)`);
 const run = (command, commandArgs) => spawnSync(command, commandArgs, { cwd: target, stdio: 'inherit', shell: process.platform === 'win32' }).status === 0;
 let adminPassword = null;
+const passwordGenerated = adminEmail !== null && chosenPassword === null;
 if (install) {
     say('  … Installing dependencies\n');
     if (!run('npm', ['install', '--no-fund', '--no-audit']))
         fail('npm install failed: fix the error above, then run `npm install` in the project.');
     if (adminEmail) {
-        adminPassword = flag('admin-password') ?? randomBytes(12).toString('base64url');
-        if (!run('npx', ['navette', 'make:user', '--admin', '--name=Admin', `--email=${adminEmail}`, `--password=${adminPassword}`]))
+        adminPassword = chosenPassword ?? randomBytes(12).toString('base64url');
+        // Passed through the environment, not the command line, where other users of the machine could read it.
+        const created = spawnSync('npx', ['navette', 'make:user', '--admin', '--name=Admin', `--email=${adminEmail}`], { cwd: target, stdio: 'inherit', shell: process.platform === 'win32', env: { ...process.env, NAVETTE_PASSWORD: adminPassword } }).status === 0;
+        if (!created)
             fail('Creating the admin user failed: run `npx navette make:user --admin` in the project.');
     }
 }
@@ -116,7 +146,14 @@ if (database !== 'sqlite')
 if (!adminPassword)
     say('    npx navette make:user --admin');
 say('    npm run dev\n');
-say(`  Admin panel  http://127.0.0.1:${options.port}/admin${adminPassword ? `   ${dim('sign in:')} ${adminEmail} / ${adminPassword}` : ''}`);
+say(`  Admin panel  http://127.0.0.1:${options.port}/admin`);
 if (userPanel)
     say(`  User panel   http://127.0.0.1:${options.port}/app`);
+if (adminPassword) {
+    say(`\n  ${bold('Admin account')}\n`);
+    say(`    Email     ${adminEmail}`);
+    say(passwordGenerated
+        ? `    Password  ${bold(adminPassword)}   ${dim('generated: copy it now, it is not shown again')}`
+        : `    Password  ${dim('the one you chose')}`);
+}
 say(`\n  Generate code with ${bold('npx navette make:resource Post --generate')} — see README.md.\n`);

package/lib/secret.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Reads a hidden answer in raw mode: each typed character shows as a dot, so the password never appears on screen.
+ * Backspace erases, Enter validates, Ctrl+C quits; escape sequences (arrow keys) are ignored.
+ */
+export declare function readSecret(label: string, input?: NodeJS.ReadStream, output?: NodeJS.WriteStream): Promise<string>;

package/lib/secret.js

@@ -0,0 +1,40 @@
+// Hidden terminal input, for passwords.
+/**
+ * Reads a hidden answer in raw mode: each typed character shows as a dot, so the password never appears on screen.
+ * Backspace erases, Enter validates, Ctrl+C quits; escape sequences (arrow keys) are ignored.
+ */
+export function readSecret(label, input = process.stdin, output = process.stdout) {
+    output.write(label);
+    const wasRaw = input.isRaw === true;
+    input.setRawMode?.(true);
+    input.setEncoding('utf8');
+    input.resume();
+    return new Promise((resolve) => {
+        let value = '';
+        const onData = (chunk) => {
+            if (chunk.startsWith('\x1b'))
+                return;
+            for (const character of chunk) {
+                if (character === '\r' || character === '\n') {
+                    input.off('data', onData);
+                    input.setRawMode?.(wasRaw);
+                    input.pause();
+                    output.write('\n');
+                    resolve(value);
+                    return;
+                }
+                if (character === '\u0003') {
+                    input.setRawMode?.(wasRaw);
+                    output.write('\n');
+                    process.exit(130);
+                }
+                if (character === '\u007f' || character === '\b')
+                    value = value.slice(0, -1);
+                else if (character >= ' ')
+                    value += character;
+            }
+            output.write(`\r\x1b[K${label}${'•'.repeat(value.length)}`);
+        };
+        input.on('data', onData);
+    });
+}

package/lib/templates.js

@@ -101,6 +101,14 @@ export async function up(db: Knex): Promise<void> {
         table.timestamps();
     });
 }
+`;
+    files['src/migrations/0006_add_multi_factor_authentication.ts'] = `import type { Knex } from '@navette-js/database';
+import { multiFactorAuthenticationSchema } from '@navette-js/panels';
+
+// Two-factor authentication: authenticator app secret and recovery codes (users table), and a security_keys table.
+export async function up(db: Knex): Promise<void> {
+    await multiFactorAuthenticationSchema(db);
+}
 `;
     files['src/migrations/0002_create_notifications_table.ts'] = `import type { Knex } from '@navette-js/database';
 
@@ -214,12 +222,10 @@ ${timestamps}
 `;
     // ------------------------------------------------------------------ admin panel
     files['src/panels/admin.ts'] = `// The admin panel (/admin): only users with the \`admin\` role can sign in.
-import { AccountWidget, discoverPages, discoverResources, discoverWidgets, fileMailer, knexAuthProvider, ${sqlite ? 'knexNotificationStore, ' : ''}Panel } from '@navette-js/panels';
+import { AccountWidget, AppAuthentication, discoverPages, EditProfile, EmailAuthentication, discoverResources, discoverWidgets, fileMailer, ${sqlite ? 'knexNotificationStore, ' : ''}Panel, SecurityKeyAuthentication } from '@navette-js/panels';
 import { Color } from '@navette-js/support';
 import { db } from '../database.ts';
-
-const users = knexAuthProvider((table) => db(table));
-const isAdmin = async (id: string | number) => (await db('users').where('id', id).first())?.role === 'admin';
+import { users } from '../users.ts';
 
 export default Panel.make()
     .id('admin')
@@ -230,21 +236,26 @@ export default Panel.make()
     .setColors({ primary: Color.Amber })
     .login()
     .passwordReset()
-    .profile()
+    // Profile page in the full layout (sections, with the navigation).
+    .profile(EditProfile, false)
+    // Two-factor authentication, set up by each user on their profile: an authenticator app (with recovery codes), a code by email or a security key.
+    .multiFactorAuthentication([AppAuthentication.make().recoverable(), EmailAuthentication.make(), SecurityKeyAuthentication.make()])
     .mailer(fileMailer(process.env.MAIL_LOG ?? 'storage/mail.log'))
 ${sqlite ? '    .databaseNotifications(knexNotificationStore((table: string) => db(table)))\n' : ''}    .globalSearchKeyBindings(['command+k', 'ctrl+k'])
     // Resources, pages and widgets are discovered from these folders: \`npx navette make:resource\` adds files there.
     .resources(await discoverResources(new URL('../admin/resources/', import.meta.url)))
     .pages(await discoverPages(new URL('../admin/pages/', import.meta.url)))
     .widgets([AccountWidget, ...(await discoverWidgets(new URL('../admin/widgets/', import.meta.url)))])
-    .auth({
-        ...users,
-        attempt: async (email, password) => {
-            const user = await users.attempt(email, password);
-            return user && (await isAdmin(user.id)) ? user : null;
-        },
-        find: async (id) => ((await isAdmin(id)) ? users.find(id) : null),
-    });
+    .auth(users)
+    // Only users with the \`admin\` role may sign in here; others are refused at login and get a 403 page.
+    .canAccess(async (user) => (await db('users').where('id', user.id).first())?.role === 'admin');
+`;
+    files['src/users.ts'] = `// Users of every panel. Panels share one session (signing into one signs into the others), so they share this provider;
+// each panel's \`canAccess()\` decides who may enter it.
+import { knexAuthProvider } from '@navette-js/panels';
+import { db } from './database.ts';
+
+export const users = knexAuthProvider((table) => db(table));
 `;
     files['src/admin/pages/Dashboard.ts'] = `import { Dashboard as BaseDashboard } from '@navette-js/panels';
 
@@ -383,8 +394,9 @@ export class TaskStats extends StatsOverviewWidget {
     // ------------------------------------------------------------------ user panel
     if (o.userPanel) {
         files['src/panels/app.ts'] = `// The user panel (/app): anyone can sign up${teams ? ', then create or join teams' : ''}.
-import { AccountWidget, discoverPages, discoverResources, discoverWidgets, fileMailer, knexAuthProvider, ${teams ? 'knexTenantProvider, ' : ''}Panel } from '@navette-js/panels';
+import { AccountWidget, AppAuthentication, discoverPages, EditProfile, EmailAuthentication, discoverResources, discoverWidgets, fileMailer, ${teams ? 'knexTenantProvider, ' : ''}Panel, SecurityKeyAuthentication } from '@navette-js/panels';
 import { db } from '../database.ts';
+import { users } from '../users.ts';
 ${teams ? "import { EditTeamProfile, RegisterTeam } from '../app/tenancy.ts';\n" : ''}
 export default Panel.make()
     .id('app')
@@ -396,7 +408,10 @@ export default Panel.make()
     .registration()
     .passwordReset()
     .emailVerification()
-    .profile()
+    // Profile page in the full layout (sections, with the navigation).
+    .profile(EditProfile, false)
+    // Two-factor authentication, set up by each user on their profile: an authenticator app (with recovery codes), a code by email or a security key.
+    .multiFactorAuthentication([AppAuthentication.make().recoverable(), EmailAuthentication.make(), SecurityKeyAuthentication.make()])
     .mailer(fileMailer(process.env.MAIL_LOG ?? 'storage/mail.log'))
 ${teams ? `    // Every page lives under /app/<team>; records with a \`team_id\` column only show to that team's members.
     .tenant(knexTenantProvider((table) => db(table), { label: 'Current team' }), { ownershipColumn: 'team_id' })
@@ -405,7 +420,7 @@ ${teams ? `    // Every page lives under /app/<team>; records with a \`team_id\`
 ` : ''}    .resources(await discoverResources(new URL('../app/resources/', import.meta.url)))
     .pages(await discoverPages(new URL('../app/pages/', import.meta.url)))
     .widgets([AccountWidget, ...(await discoverWidgets(new URL('../app/widgets/', import.meta.url)))])
-    .auth(knexAuthProvider((table) => db(table)));
+    .auth(users);
 `;
         files['src/app/pages/Dashboard.ts'] = `import { Dashboard as BaseDashboard } from '@navette-js/panels';
 
@@ -474,7 +489,8 @@ export class NoteResource extends Resource {
     files['src/server.ts'] = `// Entry point: runs the migrations, then serves every panel of src/panels.
 import express from 'express';
 import { mkdirSync } from 'node:fs';
-import { discoverPanels, panelRouter } from '@navette-js/panels';
+import { discoverPanels, panelNotFound, panelRouter } from '@navette-js/panels';
+import { views } from '@navette-js/support';
 ${o.locale === 'fr' ? "import { setLocale } from '@navette-js/support/i18n';\n" : ''}import { UploadStore, WireRuntime } from '@navette-js/wire';
 import { migrate } from './database.ts';
 
@@ -483,15 +499,20 @@ if (!key) throw new Error('APP_KEY is missing: start the server with \`npm run d
 ${o.locale === 'fr' ? "setLocale('fr');\n" : ''}mkdirSync('storage/public', { recursive: true });
 
 for (const name of await migrate()) console.log(\`Migrated \${name}\`);
+// View components: <x-name> in any view renders src/components/name.ejs (\`npx navette make:component name\`).
+views.components(new URL('./components/', import.meta.url));
 
 const app = express();
 // Uploaded files that are public (FileUpload with the public disk).
 app.use('/storage', express.static('storage/public', { dotfiles: 'deny', index: false }));
 // Each panel has its own runtime (its own Livewire endpoint and components).
-for (const panel of await discoverPanels(new URL('./panels/', import.meta.url))) {
+const panels = await discoverPanels(new URL('./panels/', import.meta.url));
+for (const panel of panels) {
     app.use(panelRouter(panel, new WireRuntime({ key, uploads: new UploadStore('storage/tmp', key) })));
 }
 app.get('/', (_req, res) => res.redirect('/${o.userPanel ? 'app' : 'admin'}'));
+// Any other URL: the 404 page of the first panel.
+if (panels[0]) app.use(panelNotFound(panels[0]));
 
 const port = Number(process.env.PORT ?? ${o.port});
 app.listen(port, '127.0.0.1', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-navette",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0-beta.5",
   "description": "Create a Navette project: npm create navette@latest",
   "license": "MIT",
   "type": "module",