iec-cli 0.6.6

package/dist/templates/mga/{{name}}-web/.dockerignore

@@ -0,0 +1,6 @@
+node_modules
+.next
+.env
+.env.*
+*.log
+.git

package/dist/templates/mga/{{name}}-web/.env.example

@@ -0,0 +1,6 @@
+BIO_ID_URL=http://localhost:6100
+APP_URL=http://localhost:3000
+OAUTH_CLIENT_ID=
+OAUTH_CLIENT_SECRET=
+JWT_SECRET=dev-secret-change-in-production
+API_URL=http://localhost:3001

package/dist/templates/mga/{{name}}-web/Dockerfile

@@ -0,0 +1,51 @@
+FROM node:22-alpine AS base
+
+# Install dependencies only when needed
+FROM base AS deps
+RUN apk add --no-cache libc6-compat
+WORKDIR /app
+
+COPY package*.json ./
+RUN npm ci
+
+# Build the application
+FROM base AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+ENV NEXT_TELEMETRY_DISABLED 1
+
+RUN npm run build
+
+# Production image
+FROM base AS runner
+WORKDIR /app
+
+ENV NODE_ENV production
+ENV NEXT_TELEMETRY_DISABLED 1
+
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nextjs
+
+COPY --from=builder /app/public ./public
+
+# Set correct permissions for prerender cache
+RUN mkdir .next
+RUN chown nextjs:nodejs .next
+
+# Automatically leverage output traces to reduce image size
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+
+EXPOSE 3000
+
+ENV PORT 3000
+ENV HOSTNAME "0.0.0.0"
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/api/health || exit 1
+
+CMD ["node", "server.js"]

package/dist/templates/mga/{{name}}-web/catalog-info.yaml

@@ -0,0 +1,24 @@
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: {{name}}-web
+  description: {{description}} — Web portal
+  tags:
+    - tawa
+    - mga
+    - web
+    - nextjs
+    - cyber-insurance
+  annotations:
+    insureco.io/framework: nextjs
+    insureco.io/language: typescript
+    insureco.io/pod-tier: small
+spec:
+  type: service
+  lifecycle: production
+  owner: {{owner}}
+  auth:
+    mode: sso
+  internalDependencies:
+    - service: {{name}}-api
+      port: 3000

package/dist/templates/mga/{{name}}-web/dockerignore

@@ -0,0 +1,6 @@
+node_modules
+.next
+.env
+.env.*
+*.log
+.git

package/dist/templates/mga/{{name}}-web/gitignore

@@ -0,0 +1,36 @@
+# Dependencies
+/node_modules
+
+# Next.js
+/.next/
+/out/
+
+# Production
+/build
+
+# Environment files
+.env*.local
+.env
+
+# Debug
+npm-debug.log*
+
+# Vercel
+.vercel
+
+# TypeScript
+*.tsbuildinfo
+next-env.d.ts
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Testing
+/coverage

package/dist/templates/mga/{{name}}-web/helm/{{name}}-web/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: {{name}}-web
+description: Helm chart for {{name}}-web (Next.js MGA Cyber Insurance Portal)
+type: application
+version: 0.1.0
+appVersion: "0.1.0"
+maintainers:
+  - name: team-platform
+    email: platform@insureco.io

package/dist/templates/mga/{{name}}-web/helm/{{name}}-web/templates/_helpers.tpl

@@ -0,0 +1,49 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "app.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "app.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "app.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "app.labels" -}}
+helm.sh/chart: {{ include "app.chart" . }}
+{{ include "app.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "app.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "app.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

package/dist/templates/mga/{{name}}-web/helm/{{name}}-web/templates/configmap.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "app.fullname" . }}-config
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+data:
+  {{- range $key, $value := .Values.env }}
+  {{ $key }}: {{ $value | quote }}
+  {{- end }}

package/dist/templates/mga/{{name}}-web/helm/{{name}}-web/templates/deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "app.fullname" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "app.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "app.labels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: {{ include "app.fullname" . }}-config
+            {{- if .Values.secretRef }}
+            - secretRef:
+                name: {{ .Values.secretRef }}
+                optional: true
+            {{- end }}
+          livenessProbe:
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

package/dist/templates/mga/{{name}}-web/helm/{{name}}-web/templates/ingress.yaml

@@ -0,0 +1,41 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "app.fullname" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "app.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

package/dist/templates/mga/{{name}}-web/helm/{{name}}-web/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "app.fullname" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "app.selectorLabels" . | nindent 4 }}

package/dist/templates/mga/{{name}}-web/helm/{{name}}-web/values.yaml

@@ -0,0 +1,70 @@
+replicaCount: 1
+
+image:
+  repository: registry.digitalocean.com/insureco/{{name}}-web
+  pullPolicy: IfNotPresent
+  tag: "latest"
+
+imagePullSecrets:
+  - name: insureco
+
+nameOverride: ""
+fullnameOverride: ""
+
+service:
+  type: ClusterIP
+  port: 3000
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
+  hosts:
+    - host: {{name}}-web.sandbox.tawa.insureco.io
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 256Mi
+
+autoscaling:
+  enabled: false
+
+env:
+  NODE_ENV: production
+  PORT: "3000"
+  HOSTNAME: "0.0.0.0"
+  BIO_ID_URL: "https://bio.tawa.insureco.io"
+  API_URL: "http://{{name}}-api:3000"
+
+# K8s Secret containing OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, JWT_SECRET
+# Create with: kubectl create secret generic {{name}}-web-secrets --from-env-file=.env -n <namespace>
+secretRef: {{name}}-web-secrets
+
+livenessProbe:
+  httpGet:
+    path: /api/health
+    port: http
+  initialDelaySeconds: 15
+  periodSeconds: 10
+  failureThreshold: 3
+
+readinessProbe:
+  httpGet:
+    path: /api/health
+    port: http
+  initialDelaySeconds: 5
+  periodSeconds: 5
+
+nodeSelector: {}
+tolerations: []
+affinity: {}

package/dist/templates/mga/{{name}}-web/next.config.js

@@ -0,0 +1,8 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  output: 'standalone',
+  reactStrictMode: true,
+  poweredByHeader: false,
+}
+
+module.exports = nextConfig

package/dist/templates/mga/{{name}}-web/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "{{name}}-web",
+  "version": "0.1.0",
+  "description": "{{description}} — Web portal",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "next lint",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "next": "^14.2.0",
+    "react": "^18.3.0",
+    "react-dom": "^18.3.0",
+    "jose": "^5.9.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.0",
+    "@types/react-dom": "^18.3.0",
+    "eslint": "^8.0.0",
+    "eslint-config-next": "^14.2.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/dist/templates/mga/{{name}}-web/src/app/api/auth/callback/route.ts

@@ -0,0 +1,77 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { cookies } from 'next/headers'
+import {
+  exchangeCodeForTokens,
+  fetchUserInfo,
+  createSessionToken,
+  setSessionCookies,
+  sanitizeReturnTo,
+  getAppUrl,
+} from '@/lib/auth'
+
+export async function GET(request: NextRequest) {
+  const searchParams = request.nextUrl.searchParams
+  const code = searchParams.get('code')
+  const state = searchParams.get('state')
+  const error = searchParams.get('error')
+  const errorDescription = searchParams.get('error_description')
+
+  const cookieStore = await cookies()
+  const storedState = cookieStore.get('oauth_state')?.value
+  const codeVerifier = cookieStore.get('oauth_code_verifier')?.value
+  const returnTo = cookieStore.get('oauth_return_to')?.value || '/dashboard'
+
+  // Clear OAuth flow cookies
+  cookieStore.delete('oauth_state')
+  cookieStore.delete('oauth_code_verifier')
+  cookieStore.delete('oauth_return_to')
+
+  // Handle error from authorization server
+  if (error) {
+    const errorUrl = new URL('/', getAppUrl())
+    errorUrl.searchParams.set('error', error)
+    if (errorDescription) {
+      errorUrl.searchParams.set('error_description', errorDescription)
+    }
+    return NextResponse.redirect(errorUrl)
+  }
+
+  // Validate state to prevent CSRF
+  if (!state || state !== storedState) {
+    const errorUrl = new URL('/', getAppUrl())
+    errorUrl.searchParams.set('error', 'invalid_state')
+    errorUrl.searchParams.set('error_description', 'State parameter mismatch')
+    return NextResponse.redirect(errorUrl)
+  }
+
+  // Validate required params
+  if (!code || !codeVerifier) {
+    const errorUrl = new URL('/', getAppUrl())
+    errorUrl.searchParams.set('error', 'invalid_request')
+    errorUrl.searchParams.set('error_description', 'Missing authorization code')
+    return NextResponse.redirect(errorUrl)
+  }
+
+  try {
+    // Exchange code for bio-id tokens
+    const tokens = await exchangeCodeForTokens(code, codeVerifier)
+
+    // Fetch user info from bio-id using the access token
+    const user = await fetchUserInfo(tokens.access_token)
+
+    // Create our own session JWT and store it (not bio-id's access token)
+    const sessionToken = await createSessionToken(user)
+    await setSessionCookies(sessionToken, tokens.refresh_token)
+
+    const safeReturnTo = sanitizeReturnTo(returnTo)
+    return NextResponse.redirect(new URL(safeReturnTo, getAppUrl()))
+  } catch (err) {
+    const errorUrl = new URL('/', getAppUrl())
+    errorUrl.searchParams.set('error', 'token_exchange_failed')
+    errorUrl.searchParams.set(
+      'error_description',
+      err instanceof Error ? err.message : 'Failed to exchange authorization code'
+    )
+    return NextResponse.redirect(errorUrl)
+  }
+}

package/dist/templates/mga/{{name}}-web/src/app/api/auth/login/route.ts

@@ -0,0 +1,16 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { getLoginUrl } from '@/lib/auth'
+
+export async function GET(request: NextRequest) {
+  const returnTo = request.nextUrl.searchParams.get('returnTo') || '/dashboard'
+
+  try {
+    const loginUrl = await getLoginUrl(returnTo)
+    return NextResponse.redirect(loginUrl)
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Login failed'
+    return NextResponse.redirect(
+      new URL(`/?error=${encodeURIComponent(message)}`, request.url)
+    )
+  }
+}

package/dist/templates/mga/{{name}}-web/src/app/api/auth/logout/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from 'next/server'
+import { clearAuthCookies, getAppUrl } from '@/lib/auth'
+
+export async function POST() {
+  await clearAuthCookies()
+  return NextResponse.redirect(new URL('/', getAppUrl()), { status: 303 })
+}

package/dist/templates/mga/{{name}}-web/src/app/api/auth/session/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from 'next/server'
+import { cookies } from 'next/headers'
+import {
+  getCurrentUser,
+  refreshAccessToken,
+  fetchUserInfo,
+  createSessionToken,
+  setSessionCookies,
+  COOKIE_PREFIX,
+} from '@/lib/auth'
+
+const NO_CACHE_HEADERS = { 'Cache-Control': 'no-store, no-cache, must-revalidate' }
+
+export async function GET() {
+  try {
+    const user = await getCurrentUser()
+
+    if (user) {
+      return NextResponse.json({ user }, { headers: NO_CACHE_HEADERS })
+    }
+
+    // Session expired — try refreshing via bio-id refresh token
+    const cookieStore = await cookies()
+    const refreshToken = cookieStore.get(`${COOKIE_PREFIX}_refresh_token`)?.value
+
+    if (refreshToken) {
+      try {
+        const tokens = await refreshAccessToken(refreshToken)
+        const refreshedUser = await fetchUserInfo(tokens.access_token)
+        const sessionToken = await createSessionToken(refreshedUser)
+        await setSessionCookies(sessionToken, tokens.refresh_token)
+        return NextResponse.json({ user: refreshedUser }, { headers: NO_CACHE_HEADERS })
+      } catch {
+        // Refresh token also invalid — user must re-login
+      }
+    }
+
+    return NextResponse.json({ user: null }, { headers: NO_CACHE_HEADERS })
+  } catch {
+    return NextResponse.json({ user: null }, { headers: NO_CACHE_HEADERS })
+  }
+}

package/dist/templates/mga/{{name}}-web/src/app/api/health/route.ts

@@ -0,0 +1,10 @@
+import { NextResponse } from 'next/server'
+
+export async function GET() {
+  return NextResponse.json({
+    status: 'healthy',
+    service: '{{name}}-web',
+    timestamp: new Date().toISOString(),
+    environment: process.env.NODE_ENV,
+  })
+}

package/dist/templates/mga/{{name}}-web/src/app/api/proxy/applications/route.ts

@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { cookies } from 'next/headers'
+
+const COOKIE_PREFIX = '{{name}}-web'
+
+function getApiUrl(): string {
+  return process.env.API_URL || 'http://localhost:3001'
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const cookieStore = await cookies()
+    const token = cookieStore.get(`${COOKIE_PREFIX}_session`)?.value
+
+    if (!token) {
+      return NextResponse.json(
+        { error: { code: 'UNAUTHORIZED', message: 'Not authenticated' } },
+        { status: 401 }
+      )
+    }
+
+    const body = await request.json()
+
+    const response = await fetch(`${getApiUrl()}/api/applications`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${token}`,
+      },
+      body: JSON.stringify(body),
+    })
+
+    const data = await response.json()
+
+    return NextResponse.json(data, { status: response.status })
+  } catch (err) {
+    return NextResponse.json(
+      {
+        error: {
+          code: 'PROXY_ERROR',
+          message: err instanceof Error ? err.message : 'Failed to proxy request',
+        },
+      },
+      { status: 500 }
+    )
+  }
+}

package/dist/templates/mga/{{name}}-web/src/app/applications/layout.tsx

@@ -0,0 +1,17 @@
+import { redirect } from 'next/navigation'
+import { getCurrentUser } from '@/lib/auth'
+import { DashboardShell } from '../dashboard/shell'
+
+export default async function ApplicationsLayout({
+  children,
+}: {
+  children: React.ReactNode
+}) {
+  const user = await getCurrentUser()
+
+  if (!user) {
+    redirect('/api/auth/login?returnTo=/applications')
+  }
+
+  return <DashboardShell user={user}>{children}</DashboardShell>
+}