create-skweb 3.4.0 → 3.7.0

package/.turbo/turbo-build.log

@@ -1,16 +1,16 @@
 
-> create-skweb@3.3.9 prebuild
+> create-skweb@3.7.0 prebuild
 > tsc --outDir dist --rootDir src
 
 
-> create-skweb@3.3.9 build
+> create-skweb@3.7.0 build
 > rollup -c rollup.config.mjs && node scripts/inject-shebang.mjs && chmod +x dist/cli.js
 
 
 src/index.ts → dist/index.js...
 (!) [plugin typescript] @rollup/plugin-typescript: outputToFilesystem option is defaulting to true.
-created dist/index.js in 391ms
+created dist/index.js in 387ms
 
 src/cli.ts → dist/cli.js...
-created dist/cli.js in 214ms
+created dist/cli.js in 193ms
 [inject-shebang] Shebang added to /Users/stayknight/projects/skweb-mono/tools/create-skweb/dist/cli.js

package/.turbo/turbo-test.log

@@ -1,14 +1,14 @@
 
-> create-skweb@3.2.0 test
+> create-skweb@3.5.0 test
 > mocha test/**/*.mjs
 
 
 
   create-skweb
     createProject()
-      ✔ should create TypeScript project from template
-      ✔ should create MJS project from template
-      ✔ should create CJS project from template
+      1) should create TypeScript project from template
+      2) should create MJS project from template
+      3) should create CJS project from template
       ✔ should reject non-empty destination directory
       ✔ should include winston in all templates
       ✔ should include @dotenvx/dotenvx in all templates
@@ -23,47 +23,64 @@
       ✔ should not throw
     printSuccess()
 
-╔════════════════════════════════════════════════════════════════════╗
-║                         项目创建成功！                               ║
-╚════════════════════════════════════════════════════════════════════╝
-
-项目名称: my-app
-项目路径: /tmp/my-app/my-app
+项目创建成功！
 
-接下来可以执行:
+名称: my-app
+路径: /tmp/my-app/my-app
 
+接下来执行:
   cd my-app
-
-  # 复制环境变量模板并按需修改
   cp .env.example .env
+  npm run web:dev
 
-  # 开发模式运行
-  npm run start:dev
+      ✔ should not throw
 
-  # 生产模式运行 (需要先构建)
-  npm run build
-  npm run start
 
-  # 查看日志
-  npm run logs
+  7 passing (131ms)
+  3 failing
 
-  # 停止服务
-  npm run stop
+  1) create-skweb
+       createProject()
+         should create TypeScript project from template:
 
-  # 重启服务
-  npm run restart
+      AssertionError: expected false to be true
+      + expected - actual
 
-项目特性:
-  ✅ TypeScript/MJS/CJS 支持
-  ✅ @dotenvx/dotenvx 环境变量管理
-  ✅ PM2 进程管理
-  ✅ SKWeb Express 集成
-  ✅ Keycloak/JWKS 鉴权 (可选)
-  ✅ ESLint 代码检查
-  ✅ Mocha 测试框架
+      -false
+      +true
+      
+      at Context.<anonymous> (file:///Users/stayknight/projects/skweb-mono/tools/create-skweb/test/index.mjs:38:68)
 
-      ✔ should not throw
+  2) create-skweb
+       createProject()
+         should create MJS project from template:
+
+      AssertionError: expected false to be true
+      + expected - actual
+
+      -false
+      +true
+      
+      at Context.<anonymous> (file:///Users/stayknight/projects/skweb-mono/tools/create-skweb/test/index.mjs:51:68)
+
+  3) create-skweb
+       createProject()
+         should create CJS project from template:
+
+      AssertionError: expected false to be true
+      + expected - actual
+
+      -false
+      +true
+      
+      at Context.<anonymous> (file:///Users/stayknight/projects/skweb-mono/tools/create-skweb/test/index.mjs:63:68)
 
 
-  10 passing (179ms)
 
+npm error Lifecycle script `test` failed with error:
+npm error code 3
+npm error path /Users/stayknight/projects/skweb-mono/tools/create-skweb
+npm error workspace create-skweb@3.5.0
+npm error location /Users/stayknight/projects/skweb-mono/tools/create-skweb
+npm error command failed
+npm error command sh -c mocha test/**/*.mjs

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # create-skweb
 
+## 3.7.0
+
+### Minor Changes
+
+- 39b301f: feat(skweb-express-jwt): 重构 jwks 模式，删除 verifyAsync/getKey/createJwksClient
+
+  - 删除 `verifyAsync()`：jwks 模式下用不到，请用 `midware` 做请求级验证
+  - 删除 `getKey()` / `createJwksClient()` / `this.jwksClient`：不再缓存独立 jwks 客户端
+  - `createMidware()` 改用 `jwksRsa.expressJwtSecret` 标准实现（之前是手写 kid 提取逻辑）
+  - `verify()` 错误消息更新：提示用户改用 `midware` 而不是 `verifyAsync`
+  - 这是 breaking change：调用方如果用了 `verifyAsync()`，请迁移到 `midware`
+
+  依赖升级：
+
+  - `skweb-express@2.2.0` 引用 `skweb-express-jwt@^4.0.0`
+  - `create-skweb@3.6.0` 模板同步到 `skweb-express@^2.2.0` 和 `skweb-express-jwt@^4.0.0`
+
+## 3.5.0
+
+### Minor Changes
+
+- a43c261: feat: 简化模板 auth/swagger 配置，添加 get-token 脚本
+
+  - Swagger 统一使用 bearerAuth (http + bearer + JWT)，不再使用 oauth2 流程
+  - 移除 clientSecret 相关配置
+  - 添加 scripts/get-token.{js,ts}：从 Keycloak (ROPC grant) 获取 access token
+  - package.json 添加 get-token 脚本和 axios 依赖
+  - .env.example 添加 OIDC_CLIENT_ID/OIDC_USERNAME/OIDC_PASSWORD (供 get-token 使用)
+  - 所有三个模板（ts/mjs/cjs）已同步
+
 ## 3.3.9
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-skweb",
-  "version": "3.4.0",
+  "version": "3.7.0",
   "description": "Create a new SKWeb project with TypeScript, CJS, or MJS support",
   "type": "module",
   "main": "dist/index.js",

package/templates/cjs/.env.example

@@ -44,7 +44,7 @@ SWAGGER_ENABLED=true
 JWT_SECRET=please-change-this-in-production
 JWT_EXPIRES_IN=7d
 {{else}}
-# ---------- Auth: jwks (OIDC compatible) ----------
+# ---------- Auth: jwks (OIDC compatible, public-key signature) ----------
 # Works with any OIDC-compliant IdP. Common issuer formats:
 #   Keycloak:  https://kc.example.com/realms/myrealm
 #   Auth0:     https://your-tenant.auth0.com/
@@ -53,9 +53,15 @@ JWT_EXPIRES_IN=7d
 # `audience` is the client id of this API in the IdP (recommended).
 # JWKS URI is auto-derived as ${OIDC_ISSUER}/.well-known/jwks.json
 # unless OIDC_JWKS_URI is set explicitly.
+# This API only verifies the JWT signature; it does not handle the OAuth flow.
+# Use `npm run get-token` to obtain a token for local testing.
 OIDC_ISSUER=
 OIDC_AUDIENCE=
 OIDC_JWKS_URI=
+# The following are read by scripts/get-token.js to fetch a test token:
+OIDC_CLIENT_ID=
+OIDC_USERNAME=
+OIDC_PASSWORD=
 {{/if_eq}}
 
 # ---------- Logging ----------

package/templates/cjs/package.json

@@ -13,6 +13,7 @@
     "cron:dev": "npx dotenvx run -- node --watch src/cron-app.js",
     "seed": "npx dotenvx run -- node src/commands/seed.js",
     "migrate": "npx dotenvx run -- node src/commands/migrate.js",
+    "get-token": "node scripts/get-token.js",
     "build": "cp -r src dist",
     "lint": "eslint --fix --ext .js src",
     "test": "npx dotenvx run -- mocha test/**/*.js",
@@ -21,9 +22,10 @@
   },
   "dependencies": {
     "@dotenvx/dotenvx": "^1.75.1",
+    "axios": "^1.7.7",
     "http-errors": "^2.0.1",
-    "skweb-express": "^2.1.0",
-    "skweb-express-jwt": "^3.0.0",
+    "skweb-express": "^2.2.0",
+    "skweb-express-jwt": "^4.0.0",
     "skweb-express-logger": "^2.0.0",
     "skweb-sequelize": "^2.0.1",
     "skweb-redis": "^2.0.0",

package/templates/cjs/scripts/get-token.js

@@ -0,0 +1,58 @@
+/**
+ * get-token.js
+ * -----------------------------------------------------------------------------
+ * Fetch a Keycloak access token using Resource Owner Password Credentials grant.
+ * Reads configuration from the project .env (via dotenv) and prints the token
+ * to stdout so you can pipe it into curl / paste it into Swagger UI.
+ *
+ * Required env vars in .env:
+ *   OIDC_ISSUER     - e.g. https://kc.example.com/realms/myrealm
+ *   OIDC_CLIENT_ID  - the public client id (must enable "Direct access grants")
+ *   OIDC_USERNAME   - the test user
+ *   OIDC_PASSWORD   - the test user's password
+ *
+ * Usage:
+ *   node scripts/get-token.js
+ *   TOKEN=$(node scripts/get-token.js)
+ *   curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/users
+ */
+'use strict'
+
+require('@dotenvx/dotenvx').config()
+
+const axios = require('axios')
+
+async function getToken() {
+  const issuer = (process.env.OIDC_ISSUER || '').replace(/\/$/, '')
+  const clientId = process.env.OIDC_CLIENT_ID
+  const username = process.env.OIDC_USERNAME
+  const password = process.env.OIDC_PASSWORD
+
+  if (!issuer) throw new Error('OIDC_ISSUER is missing in .env')
+  if (!clientId) throw new Error('OIDC_CLIENT_ID is missing in .env')
+  if (!username) throw new Error('OIDC_USERNAME is missing in .env')
+  if (!password) throw new Error('OIDC_PASSWORD is missing in .env')
+
+  const params = new URLSearchParams({
+    grant_type: 'password',
+    client_id: clientId,
+    username,
+    password
+  })
+
+  const tokenUrl = `${issuer}/protocol/openid-connect/token`
+  const response = await axios.post(tokenUrl, params.toString(), {
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
+  })
+
+  return response.data.access_token
+}
+
+getToken()
+  .then((token) => {
+    process.stdout.write(token + '\n')
+  })
+  .catch((err) => {
+    console.error('❌ Failed to fetch token:', err.response?.data || err.message)
+    process.exit(1)
+  })

package/templates/cjs/src/controllers/user.js

@@ -7,13 +7,8 @@ const { SysUser } = require('../models/SysUser.js')
  *   get:
  *     summary: 获取用户列表
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: query
  *         name: page
@@ -50,13 +45,8 @@ const userList = {
  *   get:
  *     summary: 获取单个用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -93,13 +83,8 @@ const userGet = {
  *   post:
  *     summary: 创建用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     requestBody:
  *       required: true
  *       content:
@@ -141,13 +126,8 @@ const userCreate = {
  *   put:
  *     summary: 更新用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -205,13 +185,8 @@ const userUpdate = {
  *   delete:
  *     summary: 删除用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id

package/templates/cjs/src/swagger.js

@@ -19,44 +19,12 @@ function buildOpenApiSpec() {
       ],
       components: {
         securitySchemes: {
-          {{#if_eq auth "static"}}
           bearerAuth: {
             type: 'http',
             scheme: 'bearer',
-            bearerFormat: 'JWT'
+            bearerFormat: 'JWT',
+            description: 'Paste your JWT access token (use `npm run get-token` to fetch one).'
           }
-          {{else}}
-          oidcAuth: (() => {
-            // Resolve OIDC endpoints from OIDC_ISSUER or OIDC_JWKS_URI
-            // Supports Keycloak realms and generic OIDC providers
-            const issuer = process.env.OIDC_ISSUER && process.env.OIDC_ISSUER.replace(/\/$/, '')
-            const jwksUri = process.env.OIDC_JWKS_URI
-            let baseUrl
-            if (issuer) {
-              baseUrl = issuer
-            } else if (jwksUri) {
-              // Keycloak JWKS URI: https://host/realms/<name>/protocol/openid-connect/certs
-              const match = jwksUri.match(/^(https?:\/\/[^/]+\/realms\/[^/]+)/)
-              if (match) baseUrl = match[1]
-            }
-            return {
-              type: 'oauth2',
-              flows: {
-                authorizationCode: {
-                  authorizationUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/auth` : undefined,
-                  tokenUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  refreshUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  scopes: {
-                    openid: 'OpenID Connect scope',
-                    profile: 'User profile',
-                    email: 'Email address',
-                    offline_access: 'Offline token refresh'
-                  }
-                }
-              }
-            }
-          })()
-          {{/if_eq}}
         }
       }
     },

package/templates/mjs/.env.example

@@ -44,18 +44,24 @@ SWAGGER_ENABLED=true
 JWT_SECRET=please-change-this-in-production
 JWT_EXPIRES_IN=7d
 {{else}}
-# ---------- Auth: jwks (OIDC compatible) ----------
+# ---------- Auth: jwks (OIDC compatible, public-key signature) ----------
 # Works with any OIDC-compliant IdP. Common issuer formats:
 #   Keycloak:  https://kc.example.com/realms/myrealm
 #   Auth0:     https://your-tenant.auth0.com/
-#   Okta:      https://your-domain.okta.com/oauth2/default
+#   Okta:       https://your-domain.okta.com/oauth2/default
 #   Authing:   https://your-app.authing.cn/oauth2/default
 # `audience` is the client id of this API in the IdP (recommended).
 # JWKS URI is auto-derived as ${OIDC_ISSUER}/.well-known/jwks.json
 # unless OIDC_JWKS_URI is set explicitly.
+# This API only verifies the JWT signature; it does not handle the OAuth flow.
+# Use `npm run get-token` to obtain a token for local testing.
 OIDC_ISSUER=
 OIDC_AUDIENCE=
 OIDC_JWKS_URI=
+# The following are read by scripts/get-token.js to fetch a test token:
+OIDC_CLIENT_ID=
+OIDC_USERNAME=
+OIDC_PASSWORD=
 {{/if_eq}}
 
 # ---------- Logging ----------

package/templates/mjs/package.json

@@ -13,6 +13,7 @@
     "cron:dev": "npx dotenvx run -- node --watch src/cron-app.js",
     "seed": "npx dotenvx run -- node src/commands/seed.js",
     "migrate": "npx dotenvx run -- node src/commands/migrate.js",
+    "get-token": "node scripts/get-token.js",
     "build": "cp -r src dist",
     "lint": "eslint --fix --ext .js src",
     "test": "npx dotenvx run -- mocha test/**/*.mjs",
@@ -21,9 +22,10 @@
   },
   "dependencies": {
     "@dotenvx/dotenvx": "^1.75.1",
+    "axios": "^1.7.7",
     "http-errors": "^2.0.1",
-    "skweb-express": "^2.1.0",
-    "skweb-express-jwt": "^3.0.0",
+    "skweb-express": "^2.2.0",
+    "skweb-express-jwt": "^4.0.0",
     "skweb-express-logger": "^2.0.0",
     "skweb-sequelize": "^2.0.1",
     "skweb-redis": "^2.0.0",

package/templates/mjs/scripts/get-token.js

@@ -0,0 +1,55 @@
+/**
+ * get-token.js
+ * -----------------------------------------------------------------------------
+ * Fetch a Keycloak access token using Resource Owner Password Credentials grant.
+ * Reads configuration from the project .env (via dotenv) and prints the token
+ * to stdout so you can pipe it into curl / paste it into Swagger UI.
+ *
+ * Required env vars in .env:
+ *   OIDC_ISSUER     - e.g. https://kc.example.com/realms/myrealm
+ *   OIDC_CLIENT_ID  - the public client id (must enable "Direct access grants")
+ *   OIDC_USERNAME   - the test user
+ *   OIDC_PASSWORD   - the test user's password
+ *
+ * Usage:
+ *   node scripts/get-token.js
+ *   TOKEN=$(node scripts/get-token.js)
+ *   curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/users
+ */
+import '@dotenvx/dotenvx/config.js'
+import axios from 'axios'
+
+async function getToken() {
+  const issuer = (process.env.OIDC_ISSUER || '').replace(/\/$/, '')
+  const clientId = process.env.OIDC_CLIENT_ID
+  const username = process.env.OIDC_USERNAME
+  const password = process.env.OIDC_PASSWORD
+
+  if (!issuer) throw new Error('OIDC_ISSUER is missing in .env')
+  if (!clientId) throw new Error('OIDC_CLIENT_ID is missing in .env')
+  if (!username) throw new Error('OIDC_USERNAME is missing in .env')
+  if (!password) throw new Error('OIDC_PASSWORD is missing in .env')
+
+  const params = new URLSearchParams({
+    grant_type: 'password',
+    client_id: clientId,
+    username,
+    password
+  })
+
+  const tokenUrl = `${issuer}/protocol/openid-connect/token`
+  const response = await axios.post(tokenUrl, params.toString(), {
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
+  })
+
+  return response.data.access_token
+}
+
+getToken()
+  .then((token) => {
+    process.stdout.write(token + '\n')
+  })
+  .catch((err) => {
+    console.error('❌ Failed to fetch token:', err.response?.data || err.message)
+    process.exit(1)
+  })

package/templates/mjs/src/controllers/user.js

@@ -7,13 +7,8 @@ import { SysUser } from '../models/SysUser.js'
  *   get:
  *     summary: 获取用户列表
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: query
  *         name: page
@@ -50,13 +45,8 @@ const userList = {
  *   get:
  *     summary: 获取单个用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -93,13 +83,8 @@ const userGet = {
  *   post:
  *     summary: 创建用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     requestBody:
  *       required: true
  *       content:
@@ -141,13 +126,8 @@ const userCreate = {
  *   put:
  *     summary: 更新用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -205,13 +185,8 @@ const userUpdate = {
  *   delete:
  *     summary: 删除用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id

package/templates/mjs/src/swagger.js

@@ -21,44 +21,12 @@ export function buildOpenApiSpec() {
       ],
       components: {
         securitySchemes: {
-          {{#if_eq auth "static"}}
           bearerAuth: {
             type: 'http',
             scheme: 'bearer',
-            bearerFormat: 'JWT'
+            bearerFormat: 'JWT',
+            description: 'Paste your JWT access token (use `npm run get-token` to fetch one).'
           }
-          {{else}}
-          oidcAuth: (() => {
-            // Resolve OIDC endpoints from OIDC_ISSUER or OIDC_JWKS_URI
-            // Supports Keycloak realms and generic OIDC providers
-            const issuer = process.env.OIDC_ISSUER?.replace(/\/$/, '')
-            const jwksUri = process.env.OIDC_JWKS_URI
-            let baseUrl
-            if (issuer) {
-              baseUrl = issuer
-            } else if (jwksUri) {
-              // Keycloak JWKS URI: https://host/realms/<name>/protocol/openid-connect/certs
-              const match = jwksUri.match(/^(https?:\/\/[^/]+\/realms\/[^/]+)/)
-              if (match) baseUrl = match[1]
-            }
-            return {
-              type: 'oauth2',
-              flows: {
-                authorizationCode: {
-                  authorizationUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/auth` : undefined,
-                  tokenUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  refreshUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  scopes: {
-                    openid: 'OpenID Connect scope',
-                    profile: 'User profile',
-                    email: 'Email address',
-                    offline_access: 'Offline token refresh'
-                  }
-                }
-              }
-            }
-          })()
-          {{/if_eq}}
         }
       }
     },

package/templates/ts/.env.example

@@ -44,7 +44,7 @@ SWAGGER_ENABLED=true
 JWT_SECRET=please-change-this-in-production
 JWT_EXPIRES_IN=7d
 {{else}}
-# ---------- Auth: jwks (OIDC compatible) ----------
+# ---------- Auth: jwks (OIDC compatible, public-key signature) ----------
 # Works with any OIDC-compliant IdP. Common issuer formats:
 #   Keycloak:  https://kc.example.com/realms/myrealm
 #   Auth0:     https://your-tenant.auth0.com/
@@ -53,9 +53,15 @@ JWT_EXPIRES_IN=7d
 # `audience` is the client id of this API in the IdP (recommended).
 # JWKS URI is auto-derived as ${OIDC_ISSUER}/.well-known/jwks.json
 # unless OIDC_JWKS_URI is set explicitly.
+# This API only verifies the JWT signature; it does not handle the OAuth flow.
+# Use `npm run get-token` to obtain a token for local testing.
 OIDC_ISSUER=
 OIDC_AUDIENCE=
 OIDC_JWKS_URI=
+# The following are read by scripts/get-token.ts to fetch a test token:
+OIDC_CLIENT_ID=
+OIDC_USERNAME=
+OIDC_PASSWORD=
 {{/if_eq}}
 
 # ---------- Logging ----------

package/templates/ts/package.json

@@ -13,6 +13,7 @@
     "cron:dev": "npx dotenvx run -- tsx watch src/cron-app.ts",
     "seed": "npx dotenvx run -- tsx src/commands/seed.ts",
     "migrate": "npx dotenvx run -- tsx src/commands/migrate.ts",
+    "get-token": "tsx scripts/get-token.ts",
     "build": "tsc && rollup -c rollup.config.mjs",
     "build:dev": "rollup -c rollup.config.mjs --environment NODE_ENV:development",
     "lint": "eslint --fix --ext .ts src",
@@ -23,9 +24,10 @@
   },
   "dependencies": {
     "@dotenvx/dotenvx": "^1.75.1",
+    "axios": "^1.7.7",
     "http-errors": "^2.0.1",
-    "skweb-express": "^2.1.0",
-    "skweb-express-jwt": "^3.0.0",
+    "skweb-express": "^2.2.0",
+    "skweb-express-jwt": "^4.0.0",
     "skweb-express-logger": "^2.0.0",
     "skweb-sequelize": "^2.0.1",
     "skweb-redis": "^2.0.0",

package/templates/ts/scripts/get-token.ts

@@ -0,0 +1,55 @@
+/**
+ * get-token.ts
+ * -----------------------------------------------------------------------------
+ * Fetch a Keycloak access token using Resource Owner Password Credentials grant.
+ * Reads configuration from the project .env (via dotenv) and prints the token
+ * to stdout so you can pipe it into curl / paste it into Swagger UI.
+ *
+ * Required env vars in .env:
+ *   OIDC_ISSUER     - e.g. https://kc.example.com/realms/myrealm
+ *   OIDC_CLIENT_ID  - the public client id (must enable "Direct access grants")
+ *   OIDC_USERNAME   - the test user
+ *   OIDC_PASSWORD   - the test user's password
+ *
+ * Usage:
+ *   tsx scripts/get-token.ts
+ *   TOKEN=$(tsx scripts/get-token.ts)
+ *   curl -H "Authorization: Bearer $TOKEN" http://localhost:3000/api/users
+ */
+import '@dotenvx/dotenvx/config'
+import axios from 'axios'
+
+async function getToken(): Promise<string> {
+  const issuer = (process.env.OIDC_ISSUER || '').replace(/\/$/, '')
+  const clientId = process.env.OIDC_CLIENT_ID
+  const username = process.env.OIDC_USERNAME
+  const password = process.env.OIDC_PASSWORD
+
+  if (!issuer) throw new Error('OIDC_ISSUER is missing in .env')
+  if (!clientId) throw new Error('OIDC_CLIENT_ID is missing in .env')
+  if (!username) throw new Error('OIDC_USERNAME is missing in .env')
+  if (!password) throw new Error('OIDC_PASSWORD is missing in .env')
+
+  const params = new URLSearchParams({
+    grant_type: 'password',
+    client_id: clientId,
+    username,
+    password
+  })
+
+  const tokenUrl = `${issuer}/protocol/openid-connect/token`
+  const response = await axios.post(tokenUrl, params.toString(), {
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
+  })
+
+  return response.data.access_token
+}
+
+getToken()
+  .then((token) => {
+    process.stdout.write(token + '\n')
+  })
+  .catch((err) => {
+    console.error('❌ Failed to fetch token:', err.response?.data || err.message)
+    process.exit(1)
+  })

package/templates/ts/src/controllers/user.ts

@@ -7,13 +7,8 @@ import { SysUser } from '../models/SysUser.js'
  *   get:
  *     summary: 获取用户列表
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: query
  *         name: page
@@ -50,13 +45,8 @@ const userList = {
  *   get:
  *     summary: 获取单个用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -93,13 +83,8 @@ const userGet = {
  *   post:
  *     summary: 创建用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     requestBody:
  *       required: true
  *       content:
@@ -141,13 +126,8 @@ const userCreate = {
  *   put:
  *     summary: 更新用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id
@@ -205,13 +185,8 @@ const userUpdate = {
  *   delete:
  *     summary: 删除用户
  *     tags: [Users]
- *     {{#if_eq auth "static"}}
  *     security:
  *       - bearerAuth: []
- *     {{else}}
- *     security:
- *       - oidcAuth: []
- *     {{/if_eq}}
  *     parameters:
  *       - in: path
  *         name: id

package/templates/ts/src/swagger.ts

@@ -21,44 +21,12 @@ export function buildOpenApiSpec(): object {
       ],
       components: {
         securitySchemes: {
-          {{#if_eq auth "static"}}
           bearerAuth: {
             type: 'http',
             scheme: 'bearer',
-            bearerFormat: 'JWT'
+            bearerFormat: 'JWT',
+            description: 'Paste your JWT access token (use `npm run get-token` to fetch one).'
           }
-          {{else}}
-          oidcAuth: (() => {
-            // Resolve OIDC endpoints from OIDC_ISSUER or OIDC_JWKS_URI
-            // Supports Keycloak realms and generic OIDC providers
-            const issuer = process.env.OIDC_ISSUER?.replace(/\/$/, '')
-            const jwksUri = process.env.OIDC_JWKS_URI
-            let baseUrl: string | undefined
-            if (issuer) {
-              baseUrl = issuer
-            } else if (jwksUri) {
-              // Keycloak JWKS URI: https://host/realms/<name>/protocol/openid-connect/certs
-              const match = jwksUri.match(/^(https?:\/\/[^/]+\/realms\/[^/]+)/)
-              if (match) baseUrl = match[1]
-            }
-            return {
-              type: 'oauth2',
-              flows: {
-                authorizationCode: {
-                  authorizationUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/auth` : undefined,
-                  tokenUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  refreshUrl: baseUrl ? `${baseUrl}/protocol/openid-connect/token` : undefined,
-                  scopes: {
-                    openid: 'OpenID Connect scope',
-                    profile: 'User profile',
-                    email: 'Email address',
-                    offline_access: 'Offline token refresh'
-                  }
-                }
-              }
-            }
-          })()
-          {{/if_eq}}
         }
       }
     },