create-skweb 3.4.0 → 3.5.0

package/.turbo/turbo-build.log

@@ -1,16 +1,17 @@
-
-> create-skweb@3.3.9 prebuild
-> tsc --outDir dist --rootDir src
-
-
-> create-skweb@3.3.9 build
-> rollup -c rollup.config.mjs && node scripts/inject-shebang.mjs && chmod +x dist/cli.js
-
-
-src/index.ts → dist/index.js...
-(!) [plugin typescript] @rollup/plugin-typescript: outputToFilesystem option is defaulting to true.
-created dist/index.js in 391ms
-
-src/cli.ts → dist/cli.js...
-created dist/cli.js in 214ms
-[inject-shebang] Shebang added to /Users/stayknight/projects/skweb-mono/tools/create-skweb/dist/cli.js
+
+> create-skweb@3.5.0 prebuild
+> tsc --outDir dist --rootDir src
+
+⠙
+> create-skweb@3.5.0 build
+> rollup -c rollup.config.mjs && node scripts/inject-shebang.mjs && chmod +x dist/cli.js
+
+⠙
+src/index.ts → dist/index.js...
+(!) [plugin typescript] @rollup/plugin-typescript: outputToFilesystem option is defaulting to true.
+created dist/index.js in 376ms
+
+src/cli.ts → dist/cli.js...
+created dist/cli.js in 239ms
+[inject-shebang] Shebang added to /Users/stayknight/projects/skweb-mono/tools/create-skweb/dist/cli.js
+⠙

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # create-skweb
 
+## 3.5.0
+
+### Minor Changes
+
+- a43c261: feat: 简化模板 auth/swagger 配置，添加 get-token 脚本
+
+  - Swagger 统一使用 bearerAuth (http + bearer + JWT)，不再使用 oauth2 流程
+  - 移除 clientSecret 相关配置
+  - 添加 scripts/get-token.{js,ts}：从 Keycloak (ROPC grant) 获取 access token
+  - package.json 添加 get-token 脚本和 axios 依赖
+  - .env.example 添加 OIDC_CLIENT_ID/OIDC_USERNAME/OIDC_PASSWORD (供 get-token 使用)
+  - 所有三个模板（ts/mjs/cjs）已同步
+
 ## 3.3.9
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-skweb",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Create a new SKWeb project with TypeScript, CJS, or MJS support",
   "type": "module",
   "main": "dist/index.js",

package/templates/cjs/.env.example

@@ -44,7 +44,7 @@ SWAGGER_ENABLED=true
 JWT_SECRET=please-change-this-in-production
 JWT_EXPIRES_IN=7d
 {{else}}
-# ---------- Auth: jwks (OIDC compatible) ----------
+# ---------- Auth: jwks (OIDC compatible, public-key signature) ----------
 # Works with any OIDC-compliant IdP. Common issuer formats:
 #   Keycloak:  https://kc.example.com/realms/myrealm
 #   Auth0:     https://your-tenant.auth0.com/
@@ -53,9 +53,15 @@ JWT_EXPIRES_IN=7d
 # `audience` is the client id of this API in the IdP (recommended).
 # JWKS URI is auto-derived as ${OIDC_ISSUER}/.well-known/jwks.json
 # unless OIDC_JWKS_URI is set explicitly.
+# This API only verifies the JWT signature; it does not handle the OAuth flow.
+# Use `npm run get-token` to obtain a token for local testing.
 OIDC_ISSUER=
 OIDC_AUDIENCE=
 OIDC_JWKS_URI=
+# The following are read by scripts/get-token.js to fetch a test token:
+OIDC_CLIENT_ID=
+OIDC_USERNAME=
+OIDC_PASSWORD=
 {{/if_eq}}
 
 # ---------- Logging ----------

package/templates/cjs/package.json

@@ -13,6 +13,7 @@
     "cron:dev": "npx dotenvx run -- node --watch src/cron-app.js",
     "seed": "npx dotenvx run -- node src/commands/seed.js",
     "migrate": "npx dotenvx run -- node src/commands/migrate.js",
+    "get-token": "node scripts/get-token.js",
     "build": "cp -r src dist",
     "lint": "eslint --fix --ext .js src",
     "test": "npx dotenvx run -- mocha test/**/*.js",
@@ -21,6 +22,7 @@
   },
   "dependencies": {
     "@dotenvx/dotenvx": "^1.75.1",
+    "axios": "^1.7.7",
     "http-errors": "^2.0.1",
     "skweb-express": "^2.1.0",
     "skweb-express-jwt": "^3.0.0",

package/templates/cjs/scripts/get-token.js

@@ -0,0 +1,58 @@
+/**
+ * get-token.js
+ * -----------------------------------------------------------------------------
+ * Fetch a Keycloak access token using Resource Owner Password Credentials grant.
+ * Reads configuration from the project .env (via dotenv) and prints the token
+ * to stdout so you can pipe it into curl / paste it into Swagger UI.
+ *
+ * Required env vars in .env:
+ *   OIDC_ISSUER     - e.g. https://kc.example.com/realms/myrealm
+ *   OIDC_CLIENT_ID  - the public client id (must enable "Direct access grants")
+ *   OIDC_USERNAME   - the test user
+ *   OIDC_PASSWORD   - the test user's password
+ *
+ * Usage:
+ *   node scripts/get-token.js
+ *   TOKEN=$(node scripts/get-token.js)
+ *   curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/users
+ */
+'use strict'
+
+require('@dotenvx/dotenvx').config()
+
+const axios = require('axios')
+
+async function getToken() {
+  const issuer = (process.env.OIDC_ISSUER || '').replace(/\/$/, '')
+  const clientId = process.env.OIDC_CLIENT_ID
+  const username = process.env.OIDC_USERNAME
+  const password = process.env.OIDC_PASSWORD
+
+  if (!issuer) throw new Error('OIDC_ISSUER is missing in .env')
+  if (!clientId) throw new Error('OIDC_CLIENT_ID is missing in .env')
+  if (!username) throw new Error('OIDC_USERNAME is missing in .env')
+  if (!password) throw new Error('OIDC_PASSWORD is missing in .env')
+
+  const params = new URLSearchParams({
+    grant_type: 'password',
+    client_id: clientId,
+    username,
+    password
+  })
+
+  const tokenUrl = `${issuer}/protocol/openid-connect/token`
+  const response = await axios.post(tokenUrl, params.toString(), {
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
+  })
+
+  return response.data.access_token
+}
+
+getToken()
+  .then((token) => {
+    process.stdout.write(token + '\n')
+  })
+  .catch((err) => {
+    console.error('❌ Failed to fetch token:', err.response?.data || err.message)
+    process.exit(1)
+  })

package/templates/cjs/src/controllers/user.js

@@ -7,13 +7,8 @@ const { SysUser } = require('../models/SysUser.js')
  *   get:
  *     summary: 获取用户列表
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: query
  *         name: page
@@ -50,13 +45,8 @@ const userList = {
  *   get:
  *     summary: 获取单个用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -93,13 +83,8 @@ const userGet = {
  *   post:
  *     summary: 创建用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     requestBody:
  *       required: true
  *       content:
@@ -141,13 +126,8 @@ const userCreate = {
  *   put:
  *     summary: 更新用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -205,13 +185,8 @@ const userUpdate = {
  *   delete:
  *     summary: 删除用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id

package/templates/cjs/src/swagger.js

@@ -19,44 +19,12 @@ function buildOpenApiSpec() {
       ],
       components: {
         securitySchemes: {
-          {{#if_eq auth "static"}}
           bearerAuth: {
             type: 'http',
             scheme: 'bearer',
-            bearerFormat: 'JWT'
+            bearerFormat: 'JWT',
+            description: 'Paste your JWT access token (use `npm run get-token` to fetch one).'
           }
-          {{else}}
-          oidcAuth: (() => {
-            // Resolve OIDC endpoints from OIDC_ISSUER or OIDC_JWKS_URI
-            // Supports Keycloak realms and generic OIDC providers
-            const issuer = process.env.OIDC_ISSUER && process.env.OIDC_ISSUER.replace(/\/$/, '')
-            const jwksUri = process.env.OIDC_JWKS_URI
-            let baseUrl
-            if (issuer) {
-              baseUrl = issuer
-            } else if (jwksUri) {
-              // Keycloak JWKS URI: https://host/realms/<name>/protocol/openid-connect/certs
-              const match = jwksUri.match(/^(https?:\/\/[^/]+\/realms\/[^/]+)/)
-              if (match) baseUrl = match[1]
-            }
-            return {
-              type: 'oauth2',
-              flows: {
-                authorizationCode: {
-                  authorizationUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/auth` : undefined,
-                  tokenUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  refreshUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  scopes: {
-                    openid: 'OpenID Connect scope',
-                    profile: 'User profile',
-                    email: 'Email address',
-                    offline_access: 'Offline token refresh'
-                  }
-                }
-              }
-            }
-          })()
-          {{/if_eq}}
         }
       }
     },

package/templates/mjs/.env.example

@@ -44,18 +44,24 @@ SWAGGER_ENABLED=true
 JWT_SECRET=please-change-this-in-production
 JWT_EXPIRES_IN=7d
 {{else}}
-# ---------- Auth: jwks (OIDC compatible) ----------
+# ---------- Auth: jwks (OIDC compatible, public-key signature) ----------
 # Works with any OIDC-compliant IdP. Common issuer formats:
 #   Keycloak:  https://kc.example.com/realms/myrealm
 #   Auth0:     https://your-tenant.auth0.com/
-#   Okta:      https://your-domain.okta.com/oauth2/default
+#   Okta:       https://your-domain.okta.com/oauth2/default
 #   Authing:   https://your-app.authing.cn/oauth2/default
 # `audience` is the client id of this API in the IdP (recommended).
 # JWKS URI is auto-derived as ${OIDC_ISSUER}/.well-known/jwks.json
 # unless OIDC_JWKS_URI is set explicitly.
+# This API only verifies the JWT signature; it does not handle the OAuth flow.
+# Use `npm run get-token` to obtain a token for local testing.
 OIDC_ISSUER=
 OIDC_AUDIENCE=
 OIDC_JWKS_URI=
+# The following are read by scripts/get-token.js to fetch a test token:
+OIDC_CLIENT_ID=
+OIDC_USERNAME=
+OIDC_PASSWORD=
 {{/if_eq}}
 
 # ---------- Logging ----------

package/templates/mjs/package.json

@@ -13,6 +13,7 @@
     "cron:dev": "npx dotenvx run -- node --watch src/cron-app.js",
     "seed": "npx dotenvx run -- node src/commands/seed.js",
     "migrate": "npx dotenvx run -- node src/commands/migrate.js",
+    "get-token": "node scripts/get-token.js",
     "build": "cp -r src dist",
     "lint": "eslint --fix --ext .js src",
     "test": "npx dotenvx run -- mocha test/**/*.mjs",
@@ -21,6 +22,7 @@
   },
   "dependencies": {
     "@dotenvx/dotenvx": "^1.75.1",
+    "axios": "^1.7.7",
     "http-errors": "^2.0.1",
     "skweb-express": "^2.1.0",
     "skweb-express-jwt": "^3.0.0",

package/templates/mjs/scripts/get-token.js

@@ -0,0 +1,55 @@
+/**
+ * get-token.js
+ * -----------------------------------------------------------------------------
+ * Fetch a Keycloak access token using Resource Owner Password Credentials grant.
+ * Reads configuration from the project .env (via dotenv) and prints the token
+ * to stdout so you can pipe it into curl / paste it into Swagger UI.
+ *
+ * Required env vars in .env:
+ *   OIDC_ISSUER     - e.g. https://kc.example.com/realms/myrealm
+ *   OIDC_CLIENT_ID  - the public client id (must enable "Direct access grants")
+ *   OIDC_USERNAME   - the test user
+ *   OIDC_PASSWORD   - the test user's password
+ *
+ * Usage:
+ *   node scripts/get-token.js
+ *   TOKEN=$(node scripts/get-token.js)
+ *   curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/users
+ */
+import '@dotenvx/dotenvx/config.js'
+import axios from 'axios'
+
+async function getToken() {
+  const issuer = (process.env.OIDC_ISSUER || '').replace(/\/$/, '')
+  const clientId = process.env.OIDC_CLIENT_ID
+  const username = process.env.OIDC_USERNAME
+  const password = process.env.OIDC_PASSWORD
+
+  if (!issuer) throw new Error('OIDC_ISSUER is missing in .env')
+  if (!clientId) throw new Error('OIDC_CLIENT_ID is missing in .env')
+  if (!username) throw new Error('OIDC_USERNAME is missing in .env')
+  if (!password) throw new Error('OIDC_PASSWORD is missing in .env')
+
+  const params = new URLSearchParams({
+    grant_type: 'password',
+    client_id: clientId,
+    username,
+    password
+  })
+
+  const tokenUrl = `${issuer}/protocol/openid-connect/token`
+  const response = await axios.post(tokenUrl, params.toString(), {
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
+  })
+
+  return response.data.access_token
+}
+
+getToken()
+  .then((token) => {
+    process.stdout.write(token + '\n')
+  })
+  .catch((err) => {
+    console.error('❌ Failed to fetch token:', err.response?.data || err.message)
+    process.exit(1)
+  })

package/templates/mjs/src/controllers/user.js

@@ -7,13 +7,8 @@ import { SysUser } from '../models/SysUser.js'
  *   get:
  *     summary: 获取用户列表
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: query
  *         name: page
@@ -50,13 +45,8 @@ const userList = {
  *   get:
  *     summary: 获取单个用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -93,13 +83,8 @@ const userGet = {
  *   post:
  *     summary: 创建用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     requestBody:
  *       required: true
  *       content:
@@ -141,13 +126,8 @@ const userCreate = {
  *   put:
  *     summary: 更新用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -205,13 +185,8 @@ const userUpdate = {
  *   delete:
  *     summary: 删除用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id

package/templates/mjs/src/swagger.js

@@ -21,44 +21,12 @@ export function buildOpenApiSpec() {
       ],
       components: {
         securitySchemes: {
-          {{#if_eq auth "static"}}
           bearerAuth: {
             type: 'http',
             scheme: 'bearer',
-            bearerFormat: 'JWT'
+            bearerFormat: 'JWT',
+            description: 'Paste your JWT access token (use `npm run get-token` to fetch one).'
           }
-          {{else}}
-          oidcAuth: (() => {
-            // Resolve OIDC endpoints from OIDC_ISSUER or OIDC_JWKS_URI
-            // Supports Keycloak realms and generic OIDC providers
-            const issuer = process.env.OIDC_ISSUER?.replace(/\/$/, '')
-            const jwksUri = process.env.OIDC_JWKS_URI
-            let baseUrl
-            if (issuer) {
-              baseUrl = issuer
-            } else if (jwksUri) {
-              // Keycloak JWKS URI: https://host/realms/<name>/protocol/openid-connect/certs
-              const match = jwksUri.match(/^(https?:\/\/[^/]+\/realms\/[^/]+)/)
-              if (match) baseUrl = match[1]
-            }
-            return {
-              type: 'oauth2',
-              flows: {
-                authorizationCode: {
-                  authorizationUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/auth` : undefined,
-                  tokenUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  refreshUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  scopes: {
-                    openid: 'OpenID Connect scope',
-                    profile: 'User profile',
-                    email: 'Email address',
-                    offline_access: 'Offline token refresh'
-                  }
-                }
-              }
-            }
-          })()
-          {{/if_eq}}
         }
       }
     },

package/templates/ts/.env.example

@@ -44,7 +44,7 @@ SWAGGER_ENABLED=true
 JWT_SECRET=please-change-this-in-production
 JWT_EXPIRES_IN=7d
 {{else}}
-# ---------- Auth: jwks (OIDC compatible) ----------
+# ---------- Auth: jwks (OIDC compatible, public-key signature) ----------
 # Works with any OIDC-compliant IdP. Common issuer formats:
 #   Keycloak:  https://kc.example.com/realms/myrealm
 #   Auth0:     https://your-tenant.auth0.com/
@@ -53,9 +53,15 @@ JWT_EXPIRES_IN=7d
 # `audience` is the client id of this API in the IdP (recommended).
 # JWKS URI is auto-derived as ${OIDC_ISSUER}/.well-known/jwks.json
 # unless OIDC_JWKS_URI is set explicitly.
+# This API only verifies the JWT signature; it does not handle the OAuth flow.
+# Use `npm run get-token` to obtain a token for local testing.
 OIDC_ISSUER=
 OIDC_AUDIENCE=
 OIDC_JWKS_URI=
+# The following are read by scripts/get-token.ts to fetch a test token:
+OIDC_CLIENT_ID=
+OIDC_USERNAME=
+OIDC_PASSWORD=
 {{/if_eq}}
 
 # ---------- Logging ----------

package/templates/ts/package.json

@@ -13,6 +13,7 @@
     "cron:dev": "npx dotenvx run -- tsx watch src/cron-app.ts",
     "seed": "npx dotenvx run -- tsx src/commands/seed.ts",
     "migrate": "npx dotenvx run -- tsx src/commands/migrate.ts",
+    "get-token": "tsx scripts/get-token.ts",
     "build": "tsc && rollup -c rollup.config.mjs",
     "build:dev": "rollup -c rollup.config.mjs --environment NODE_ENV:development",
     "lint": "eslint --fix --ext .ts src",
@@ -23,6 +24,7 @@
   },
   "dependencies": {
     "@dotenvx/dotenvx": "^1.75.1",
+    "axios": "^1.7.7",
     "http-errors": "^2.0.1",
     "skweb-express": "^2.1.0",
     "skweb-express-jwt": "^3.0.0",

package/templates/ts/scripts/get-token.ts

@@ -0,0 +1,55 @@
+/**
+ * get-token.ts
+ * -----------------------------------------------------------------------------
+ * Fetch a Keycloak access token using Resource Owner Password Credentials grant.
+ * Reads configuration from the project .env (via dotenv) and prints the token
+ * to stdout so you can pipe it into curl / paste it into Swagger UI.
+ *
+ * Required env vars in .env:
+ *   OIDC_ISSUER     - e.g. https://kc.example.com/realms/myrealm
+ *   OIDC_CLIENT_ID  - the public client id (must enable "Direct access grants")
+ *   OIDC_USERNAME   - the test user
+ *   OIDC_PASSWORD   - the test user's password
+ *
+ * Usage:
+ *   tsx scripts/get-token.ts
+ *   TOKEN=$(tsx scripts/get-token.ts)
+ *   curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/users
+ */
+import '@dotenvx/dotenvx/config'
+import axios from 'axios'
+
+async function getToken(): Promise<string> {
+  const issuer = (process.env.OIDC_ISSUER || '').replace(/\/$/, '')
+  const clientId = process.env.OIDC_CLIENT_ID
+  const username = process.env.OIDC_USERNAME
+  const password = process.env.OIDC_PASSWORD
+
+  if (!issuer) throw new Error('OIDC_ISSUER is missing in .env')
+  if (!clientId) throw new Error('OIDC_CLIENT_ID is missing in .env')
+  if (!username) throw new Error('OIDC_USERNAME is missing in .env')
+  if (!password) throw new Error('OIDC_PASSWORD is missing in .env')
+
+  const params = new URLSearchParams({
+    grant_type: 'password',
+    client_id: clientId,
+    username,
+    password
+  })
+
+  const tokenUrl = `${issuer}/protocol/openid-connect/token`
+  const response = await axios.post(tokenUrl, params.toString(), {
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
+  })
+
+  return response.data.access_token
+}
+
+getToken()
+  .then((token) => {
+    process.stdout.write(token + '\n')
+  })
+  .catch((err) => {
+    console.error('❌ Failed to fetch token:', err.response?.data || err.message)
+    process.exit(1)
+  })

package/templates/ts/src/controllers/user.ts

@@ -7,13 +7,8 @@ import { SysUser } from '../models/SysUser.js'
  *   get:
  *     summary: 获取用户列表
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: query
  *         name: page
@@ -50,13 +45,8 @@ const userList = {
  *   get:
  *     summary: 获取单个用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -93,13 +83,8 @@ const userGet = {
  *   post:
  *     summary: 创建用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     requestBody:
  *       required: true
  *       content:
@@ -141,13 +126,8 @@ const userCreate = {
  *   put:
  *     summary: 更新用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -205,13 +185,8 @@ const userUpdate = {
  *   delete:
  *     summary: 删除用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id

package/templates/ts/src/swagger.ts

@@ -21,44 +21,12 @@ export function buildOpenApiSpec(): object {
       ],
       components: {
         securitySchemes: {
-          {{#if_eq auth "static"}}
           bearerAuth: {
             type: 'http',
             scheme: 'bearer',
-            bearerFormat: 'JWT'
+            bearerFormat: 'JWT',
+            description: 'Paste your JWT access token (use `npm run get-token` to fetch one).'
           }
-          {{else}}
-          oidcAuth: (() => {
-            // Resolve OIDC endpoints from OIDC_ISSUER or OIDC_JWKS_URI
-            // Supports Keycloak realms and generic OIDC providers
-            const issuer = process.env.OIDC_ISSUER?.replace(/\/$/, '')
-            const jwksUri = process.env.OIDC_JWKS_URI
-            let baseUrl: string | undefined
-            if (issuer) {
-              baseUrl = issuer
-            } else if (jwksUri) {
-              // Keycloak JWKS URI: https://host/realms/<name>/protocol/openid-connect/certs
-              const match = jwksUri.match(/^(https?:\/\/[^/]+\/realms\/[^/]+)/)
-              if (match) baseUrl = match[1]
-            }
-            return {
-              type: 'oauth2',
-              flows: {
-                authorizationCode: {
-                  authorizationUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/auth` : undefined,
-                  tokenUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  refreshUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  scopes: {
-                    openid: 'OpenID Connect scope',
-                    profile: 'User profile',
-                    email: 'Email address',
-                    offline_access: 'Offline token refresh'
-                  }
-                }
-              }
-            }
-          })()
-          {{/if_eq}}
         }
       }
     },