iec-cli 0.6.6

package/dist/templates/mga/{{name}}-web/src/app/reports/page.tsx

@@ -0,0 +1,231 @@
+import { apiClient } from '@/lib/api'
+
+interface ReportData {
+  totalPremium: number
+  policyCount: number
+  avgPremium: number
+  applicationCount: number
+  premiumTrend: Array<{
+    month: string
+    amount: number
+  }>
+  pipeline: {
+    submitted: number
+    review: number
+    quoted: number
+    bound: number
+    declined: number
+  }
+  topAgents: Array<{
+    name: string
+    policies: number
+    premium: number
+  }>
+  geography: Array<{
+    state: string
+    premium: number
+    policies: number
+  }>
+}
+
+function formatCurrency(value: number): string {
+  return new Intl.NumberFormat('en-US', {
+    style: 'currency',
+    currency: 'USD',
+    minimumFractionDigits: 0,
+    maximumFractionDigits: 0,
+  }).format(value)
+}
+
+export default async function ReportsPage() {
+  const res = await apiClient.get<ReportData>('/api/reports/full')
+
+  if (!res.success || !res.data) {
+    return (
+      <div>
+        <div className="page-header">
+          <h1 className="page-title">Reports</h1>
+        </div>
+        <div className="alert alert-error">
+          Failed to load reports: {res.error?.message || 'Unknown error'}
+        </div>
+      </div>
+    )
+  }
+
+  const data = res.data
+  const maxTrendAmount = Math.max(...data.premiumTrend.map((m) => m.amount), 1)
+  const pipelineTotal =
+    data.pipeline.submitted +
+    data.pipeline.review +
+    data.pipeline.quoted +
+    data.pipeline.bound +
+    data.pipeline.declined || 1
+
+  return (
+    <div>
+      <div className="page-header">
+        <h1 className="page-title">Reports</h1>
+      </div>
+
+      {/* KPI cards */}
+      <div className="kpi-grid">
+        <div className="card">
+          <div className="card-title">Total Premium</div>
+          <div className="card-value">{formatCurrency(data.totalPremium)}</div>
+        </div>
+        <div className="card">
+          <div className="card-title">Policy Count</div>
+          <div className="card-value">{data.policyCount.toLocaleString()}</div>
+        </div>
+        <div className="card">
+          <div className="card-title">Avg Premium</div>
+          <div className="card-value">{formatCurrency(data.avgPremium)}</div>
+        </div>
+        <div className="card">
+          <div className="card-title">Applications</div>
+          <div className="card-value">{data.applicationCount.toLocaleString()}</div>
+        </div>
+      </div>
+
+      {/* Premium Trend */}
+      <div className="card" style={{ marginBottom: 'var(--space-xl)' }}>
+        <div className="card-title">Premium Trend</div>
+        <div className="bar-chart">
+          {data.premiumTrend.map((month) => (
+            <div key={month.month} className="bar-row">
+              <div className="bar-label">{month.month}</div>
+              <div className="bar-track">
+                <div
+                  className="bar-fill"
+                  style={{ width: `${(month.amount / maxTrendAmount) * 100}%` }}
+                />
+              </div>
+              <div className="bar-value">{formatCurrency(month.amount)}</div>
+            </div>
+          ))}
+        </div>
+      </div>
+
+      {/* Pipeline */}
+      <div className="card" style={{ marginBottom: 'var(--space-xl)' }}>
+        <div className="card-title">Pipeline Breakdown</div>
+        <div className="pipeline-bar">
+          <div
+            className="pipeline-segment"
+            style={{ flex: data.pipeline.submitted, background: 'var(--color-warning)' }}
+          >
+            {data.pipeline.submitted > 0
+              ? `${Math.round((data.pipeline.submitted / pipelineTotal) * 100)}%`
+              : ''}
+          </div>
+          <div
+            className="pipeline-segment"
+            style={{ flex: data.pipeline.review, background: 'var(--color-pending)' }}
+          >
+            {data.pipeline.review > 0
+              ? `${Math.round((data.pipeline.review / pipelineTotal) * 100)}%`
+              : ''}
+          </div>
+          <div
+            className="pipeline-segment"
+            style={{ flex: data.pipeline.quoted, background: 'var(--color-info)' }}
+          >
+            {data.pipeline.quoted > 0
+              ? `${Math.round((data.pipeline.quoted / pipelineTotal) * 100)}%`
+              : ''}
+          </div>
+          <div
+            className="pipeline-segment"
+            style={{ flex: data.pipeline.bound, background: 'var(--color-success)' }}
+          >
+            {data.pipeline.bound > 0
+              ? `${Math.round((data.pipeline.bound / pipelineTotal) * 100)}%`
+              : ''}
+          </div>
+          <div
+            className="pipeline-segment"
+            style={{ flex: data.pipeline.declined, background: 'var(--color-danger)' }}
+          >
+            {data.pipeline.declined > 0
+              ? `${Math.round((data.pipeline.declined / pipelineTotal) * 100)}%`
+              : ''}
+          </div>
+        </div>
+        <div style={{ display: 'flex', gap: 'var(--space-md)', flexWrap: 'wrap', fontSize: '0.75rem' }}>
+          <span><span style={{ color: 'var(--color-warning)' }}>&#9632;</span> Submitted ({data.pipeline.submitted})</span>
+          <span><span style={{ color: 'var(--color-pending)' }}>&#9632;</span> Review ({data.pipeline.review})</span>
+          <span><span style={{ color: 'var(--color-info)' }}>&#9632;</span> Quoted ({data.pipeline.quoted})</span>
+          <span><span style={{ color: 'var(--color-success)' }}>&#9632;</span> Bound ({data.pipeline.bound})</span>
+          <span><span style={{ color: 'var(--color-danger)' }}>&#9632;</span> Declined ({data.pipeline.declined})</span>
+        </div>
+      </div>
+
+      <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: 'var(--space-xl)' }}>
+        {/* Top Agents */}
+        <div className="table-wrapper">
+          <div style={{ padding: 'var(--space-md)' }}>
+            <div className="card-title">Top Agents</div>
+          </div>
+          <table>
+            <thead>
+              <tr>
+                <th>Agent</th>
+                <th>Policies</th>
+                <th>Premium</th>
+              </tr>
+            </thead>
+            <tbody>
+              {data.topAgents.map((agent) => (
+                <tr key={agent.name}>
+                  <td>{agent.name}</td>
+                  <td>{agent.policies}</td>
+                  <td>{formatCurrency(agent.premium)}</td>
+                </tr>
+              ))}
+              {data.topAgents.length === 0 && (
+                <tr>
+                  <td colSpan={3} style={{ color: 'var(--color-text-muted)', textAlign: 'center' }}>
+                    No agent data available
+                  </td>
+                </tr>
+              )}
+            </tbody>
+          </table>
+        </div>
+
+        {/* Geography */}
+        <div className="table-wrapper">
+          <div style={{ padding: 'var(--space-md)' }}>
+            <div className="card-title">By State</div>
+          </div>
+          <table>
+            <thead>
+              <tr>
+                <th>State</th>
+                <th>Premium</th>
+                <th>Policies</th>
+              </tr>
+            </thead>
+            <tbody>
+              {data.geography.map((geo) => (
+                <tr key={geo.state}>
+                  <td>{geo.state}</td>
+                  <td>{formatCurrency(geo.premium)}</td>
+                  <td>{geo.policies}</td>
+                </tr>
+              ))}
+              {data.geography.length === 0 && (
+                <tr>
+                  <td colSpan={3} style={{ color: 'var(--color-text-muted)', textAlign: 'center' }}>
+                    No geographic data available
+                  </td>
+                </tr>
+              )}
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+  )
+}

package/dist/templates/mga/{{name}}-web/src/lib/api.ts

@@ -0,0 +1,79 @@
+import { cookies } from 'next/headers'
+
+const COOKIE_PREFIX = '{{name}}-web'
+
+function getApiUrl(): string {
+  return process.env.API_URL || 'http://localhost:3001'
+}
+
+export interface ApiResponse<T = unknown> {
+  success: boolean
+  data?: T
+  error?: {
+    code: string
+    message: string
+  }
+}
+
+async function getSessionToken(): Promise<string | undefined> {
+  const cookieStore = await cookies()
+  return cookieStore.get(`${COOKIE_PREFIX}_session`)?.value
+}
+
+async function request<T>(
+  method: string,
+  path: string,
+  body?: unknown
+): Promise<ApiResponse<T>> {
+  const token = await getSessionToken()
+  const url = `${getApiUrl()}${path}`
+
+  const headers: Record<string, string> = {
+    'Content-Type': 'application/json',
+  }
+
+  if (token) {
+    headers['Authorization'] = `Bearer ${token}`
+  }
+
+  try {
+    const response = await fetch(url, {
+      method,
+      headers,
+      body: body ? JSON.stringify(body) : undefined,
+      cache: 'no-store',
+    })
+
+    const json = await response.json()
+
+    if (!response.ok) {
+      return {
+        success: false,
+        error: {
+          code: json.error?.code || `HTTP_${response.status}`,
+          message: json.error?.message || response.statusText,
+        },
+      }
+    }
+
+    return {
+      success: true,
+      data: json.data !== undefined ? json.data : json,
+    }
+  } catch (err) {
+    return {
+      success: false,
+      error: {
+        code: 'NETWORK_ERROR',
+        message: err instanceof Error ? err.message : 'Failed to reach API',
+      },
+    }
+  }
+}
+
+export const apiClient = {
+  get: <T>(path: string) => request<T>('GET', path),
+  post: <T>(path: string, body: unknown) => request<T>('POST', path, body),
+  put: <T>(path: string, body: unknown) => request<T>('PUT', path, body),
+  delete: <T>(path: string) => request<T>('DELETE', path),
+}

package/dist/templates/mga/{{name}}-web/src/lib/auth.ts

@@ -0,0 +1,285 @@
+import { cookies } from 'next/headers'
+import { SignJWT, jwtVerify } from 'jose'
+import crypto from 'crypto'
+
+// Configuration — read lazily so `next build` doesn't fail when env vars are
+// absent (they are injected at runtime via ConfigMap / Secret in K8s).
+function getBioIdUrl(): string {
+  return process.env.BIO_ID_URL || 'http://localhost:6100'
+}
+function getAppUrl(): string {
+  return process.env.APP_URL || 'http://localhost:3000'
+}
+function getClientId(): string {
+  const id = process.env.OAUTH_CLIENT_ID
+  if (!id) throw new Error('OAUTH_CLIENT_ID is not configured')
+  return id
+}
+function getClientSecret(): string {
+  const secret = process.env.OAUTH_CLIENT_SECRET
+  if (!secret) throw new Error('OAUTH_CLIENT_SECRET is not configured')
+  return secret
+}
+function getJwtSecret(): Uint8Array {
+  const secret = process.env.JWT_SECRET
+  if (!secret && process.env.NODE_ENV === 'production') {
+    throw new Error('JWT_SECRET environment variable is required in production')
+  }
+  return new TextEncoder().encode(secret || 'dev-only-secret-do-not-use-in-production')
+}
+
+const COOKIE_PREFIX = '{{name}}-web'
+const SESSION_MAX_AGE = 60 * 60           // 1 hour
+const REFRESH_TOKEN_MAX_AGE = 60 * 60 * 24 * 30 // 30 days
+const OAUTH_FLOW_MAX_AGE = 60 * 10        // 10 minutes
+
+export interface User {
+  id: string
+  email: string
+  name: string
+  roles: string[]
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+export function sanitizeReturnTo(returnTo: string | undefined, fallback = '/dashboard'): string {
+  if (!returnTo || !returnTo.startsWith('/') || returnTo.startsWith('//')) {
+    return fallback
+  }
+  return returnTo
+}
+
+export function generatePKCE(): { codeVerifier: string; codeChallenge: string } {
+  const codeVerifier = crypto.randomBytes(32).toString('base64url')
+  const codeChallenge = crypto
+    .createHash('sha256')
+    .update(codeVerifier)
+    .digest('base64url')
+  return { codeVerifier, codeChallenge }
+}
+
+export function getAuthorizationUrl(state: string, codeChallenge: string): string {
+  const params = new URLSearchParams({
+    client_id: getClientId(),
+    redirect_uri: `${getAppUrl()}/api/auth/callback`,
+    response_type: 'code',
+    scope: 'openid profile email',
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256',
+  })
+  return `${getBioIdUrl()}/oauth/authorize?${params.toString()}`
+}
+
+async function parseErrorResponse(response: Response, fallbackMessage: string): Promise<string> {
+  try {
+    const error = await response.json()
+    return error.error_description || error.error || fallbackMessage
+  } catch {
+    return fallbackMessage
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Bio-id API calls
+// ---------------------------------------------------------------------------
+
+export async function exchangeCodeForTokens(
+  code: string,
+  codeVerifier: string
+): Promise<{
+  access_token: string
+  token_type: string
+  expires_in: number
+  refresh_token: string
+  scope: string
+  id_token?: string
+}> {
+  const response = await fetch(`${getBioIdUrl()}/api/oauth/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: `${getAppUrl()}/api/auth/callback`,
+      client_id: getClientId(),
+      client_secret: getClientSecret(),
+      code_verifier: codeVerifier,
+    }).toString(),
+  })
+
+  if (!response.ok) {
+    throw new Error(await parseErrorResponse(response, 'Token exchange failed'))
+  }
+
+  return response.json()
+}
+
+export async function refreshAccessToken(refreshToken: string): Promise<{
+  access_token: string
+  token_type: string
+  expires_in: number
+  refresh_token: string
+  scope: string
+}> {
+  const response = await fetch(`${getBioIdUrl()}/api/oauth/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: getClientId(),
+      client_secret: getClientSecret(),
+    }).toString(),
+  })
+
+  if (!response.ok) {
+    throw new Error(await parseErrorResponse(response, 'Token refresh failed'))
+  }
+
+  return response.json()
+}
+
+export async function fetchUserInfo(accessToken: string): Promise<User> {
+  const response = await fetch(`${getBioIdUrl()}/api/oauth/userinfo`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+  })
+
+  if (!response.ok) {
+    throw new Error('Failed to fetch user info')
+  }
+
+  const data = await response.json()
+
+  return {
+    id: data.bio_id || data.sub,
+    email: data.email,
+    name: data.name,
+    roles: data.roles || [],
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Session management
+//
+// After the OAuth callback, we create OUR OWN session JWT signed with
+// JWT_SECRET. This avoids needing to verify bio-id's access token locally
+// (bio-id uses HS256 signed with its own server secret).
+// ---------------------------------------------------------------------------
+
+export async function createSessionToken(user: User): Promise<string> {
+  return new SignJWT({
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    roles: user.roles,
+  })
+    .setProtectedHeader({ alg: 'HS256' })
+    .setIssuedAt()
+    .setExpirationTime(`${SESSION_MAX_AGE}s`)
+    .setIssuer(getAppUrl())
+    .sign(getJwtSecret())
+}
+
+export async function setSessionCookies(
+  sessionToken: string,
+  bioRefreshToken: string
+): Promise<void> {
+  const cookieStore = await cookies()
+  const secure = getAppUrl().startsWith('https://')
+
+  cookieStore.set(`${COOKIE_PREFIX}_session`, sessionToken, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: SESSION_MAX_AGE,
+    path: '/',
+  })
+
+  cookieStore.set(`${COOKIE_PREFIX}_refresh_token`, bioRefreshToken, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: REFRESH_TOKEN_MAX_AGE,
+    path: '/',
+  })
+}
+
+export async function clearAuthCookies(): Promise<void> {
+  const cookieStore = await cookies()
+  cookieStore.delete(`${COOKIE_PREFIX}_session`)
+  cookieStore.delete(`${COOKIE_PREFIX}_refresh_token`)
+  cookieStore.delete('oauth_state')
+  cookieStore.delete('oauth_code_verifier')
+  cookieStore.delete('oauth_return_to')
+}
+
+/**
+ * Get the current user from the session cookie (no network call).
+ * Verifies OUR session JWT — not bio-id's access token.
+ */
+export async function getCurrentUser(): Promise<User | null> {
+  const cookieStore = await cookies()
+  const sessionToken = cookieStore.get(`${COOKIE_PREFIX}_session`)?.value
+
+  if (!sessionToken) {
+    return null
+  }
+
+  try {
+    const { payload } = await jwtVerify(sessionToken, getJwtSecret(), {
+      issuer: getAppUrl(),
+    })
+
+    return {
+      id: payload.sub || '',
+      email: payload.email as string,
+      name: payload.name as string,
+      roles: (payload.roles as string[]) || [],
+    }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Generate a login URL with PKCE and state stored in cookies
+ */
+export async function getLoginUrl(returnTo?: string): Promise<string> {
+  const cookieStore = await cookies()
+  const secure = getAppUrl().startsWith('https://')
+
+  const state = crypto.randomBytes(16).toString('hex')
+  const { codeVerifier, codeChallenge } = generatePKCE()
+
+  cookieStore.set('oauth_state', state, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: OAUTH_FLOW_MAX_AGE,
+    path: '/',
+  })
+
+  cookieStore.set('oauth_code_verifier', codeVerifier, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: OAUTH_FLOW_MAX_AGE,
+    path: '/',
+  })
+
+  const safeReturnTo = sanitizeReturnTo(returnTo)
+  cookieStore.set('oauth_return_to', safeReturnTo, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: OAUTH_FLOW_MAX_AGE,
+    path: '/',
+  })
+
+  return getAuthorizationUrl(state, codeChallenge)
+}
+
+export { COOKIE_PREFIX, getBioIdUrl, getAppUrl }

package/dist/templates/mga/{{name}}-web/src/middleware.ts

@@ -0,0 +1,71 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { jwtVerify } from 'jose'
+
+const COOKIE_PREFIX = '{{name}}-web'
+
+// Routes that require authentication
+const PROTECTED_PATHS = ['/dashboard', '/applications', '/reports']
+
+// Routes that should never be blocked
+const PUBLIC_PATHS = [
+  '/',
+  '/api/auth',
+  '/api/health',
+]
+
+function isPublicPath(pathname: string): boolean {
+  return PUBLIC_PATHS.some(
+    (path) => pathname === path || pathname.startsWith(`${path}/`)
+  )
+}
+
+function isProtectedPath(pathname: string): boolean {
+  return PROTECTED_PATHS.some(
+    (path) => pathname === path || pathname.startsWith(`${path}/`)
+  )
+}
+
+export async function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl
+
+  if (isPublicPath(pathname)) {
+    return NextResponse.next()
+  }
+
+  if (!isProtectedPath(pathname)) {
+    return NextResponse.next()
+  }
+
+  // Check for our session cookie (not bio-id's access token)
+  const sessionToken = request.cookies.get(`${COOKIE_PREFIX}_session`)?.value
+
+  if (!sessionToken) {
+    const loginUrl = new URL('/api/auth/login', request.url)
+    loginUrl.searchParams.set('returnTo', pathname)
+    return NextResponse.redirect(loginUrl)
+  }
+
+  // Verify our own session JWT (signed with JWT_SECRET, issued by APP_URL)
+  try {
+    const secret = new TextEncoder().encode(
+      process.env.JWT_SECRET || 'dev-only-secret-do-not-use-in-production'
+    )
+    await jwtVerify(sessionToken, secret, {
+      issuer: process.env.APP_URL || 'http://localhost:3000',
+    })
+  } catch {
+    // Session expired or invalid — redirect to login
+    const loginUrl = new URL('/api/auth/login', request.url)
+    loginUrl.searchParams.set('returnTo', pathname)
+    return NextResponse.redirect(loginUrl)
+  }
+
+  return NextResponse.next()
+}
+
+export const config = {
+  matcher: [
+    // Match all paths except static files and Next.js internals
+    '/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
+  ],
+}

package/dist/templates/mga/{{name}}-web/tsconfig.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/dist/templates/nextjs/.env.example

@@ -0,0 +1,11 @@
+# Next.js Configuration
+NEXT_PUBLIC_APP_NAME={{name}}
+
+# API Configuration
+# NEXT_PUBLIC_API_URL=https://api.example.com
+
+# Analytics (if needed)
+# NEXT_PUBLIC_GA_ID=UA-XXXXXXXXX-X
+
+# Feature Flags
+# NEXT_PUBLIC_FEATURE_X_ENABLED=false