iec-cli 0.6.6

package/dist/templates/nextjs-oauth/src/lib/auth.ts

@@ -0,0 +1,285 @@
+import { cookies } from 'next/headers'
+import { SignJWT, jwtVerify } from 'jose'
+import crypto from 'crypto'
+
+// Configuration — read lazily so `next build` doesn't fail when env vars are
+// absent (they are injected at runtime via ConfigMap / Secret in K8s).
+function getBioIdUrl(): string {
+  return process.env.BIO_ID_URL || 'http://localhost:6100'
+}
+function getAppUrl(): string {
+  return process.env.APP_URL || 'http://localhost:3000'
+}
+function getClientId(): string {
+  const id = process.env.OAUTH_CLIENT_ID
+  if (!id) throw new Error('OAUTH_CLIENT_ID is not configured')
+  return id
+}
+function getClientSecret(): string {
+  const secret = process.env.OAUTH_CLIENT_SECRET
+  if (!secret) throw new Error('OAUTH_CLIENT_SECRET is not configured')
+  return secret
+}
+function getJwtSecret(): Uint8Array {
+  const secret = process.env.JWT_SECRET
+  if (!secret && process.env.NODE_ENV === 'production') {
+    throw new Error('JWT_SECRET environment variable is required in production')
+  }
+  return new TextEncoder().encode(secret || 'dev-only-secret-do-not-use-in-production')
+}
+
+const COOKIE_PREFIX = '{{name}}'
+const SESSION_MAX_AGE = 60 * 60           // 1 hour
+const REFRESH_TOKEN_MAX_AGE = 60 * 60 * 24 * 30 // 30 days
+const OAUTH_FLOW_MAX_AGE = 60 * 10        // 10 minutes
+
+export interface User {
+  id: string
+  email: string
+  name: string
+  roles: string[]
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+export function sanitizeReturnTo(returnTo: string | undefined, fallback = '/dashboard'): string {
+  if (!returnTo || !returnTo.startsWith('/') || returnTo.startsWith('//')) {
+    return fallback
+  }
+  return returnTo
+}
+
+export function generatePKCE(): { codeVerifier: string; codeChallenge: string } {
+  const codeVerifier = crypto.randomBytes(32).toString('base64url')
+  const codeChallenge = crypto
+    .createHash('sha256')
+    .update(codeVerifier)
+    .digest('base64url')
+  return { codeVerifier, codeChallenge }
+}
+
+export function getAuthorizationUrl(state: string, codeChallenge: string): string {
+  const params = new URLSearchParams({
+    client_id: getClientId(),
+    redirect_uri: `${getAppUrl()}/api/auth/callback`,
+    response_type: 'code',
+    scope: 'openid profile email',
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: 'S256',
+  })
+  return `${getBioIdUrl()}/oauth/authorize?${params.toString()}`
+}
+
+async function parseErrorResponse(response: Response, fallbackMessage: string): Promise<string> {
+  try {
+    const error = await response.json()
+    return error.error_description || error.error || fallbackMessage
+  } catch {
+    return fallbackMessage
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Bio-id API calls
+// ---------------------------------------------------------------------------
+
+export async function exchangeCodeForTokens(
+  code: string,
+  codeVerifier: string
+): Promise<{
+  access_token: string
+  token_type: string
+  expires_in: number
+  refresh_token: string
+  scope: string
+  id_token?: string
+}> {
+  const response = await fetch(`${getBioIdUrl()}/api/oauth/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: `${getAppUrl()}/api/auth/callback`,
+      client_id: getClientId(),
+      client_secret: getClientSecret(),
+      code_verifier: codeVerifier,
+    }).toString(),
+  })
+
+  if (!response.ok) {
+    throw new Error(await parseErrorResponse(response, 'Token exchange failed'))
+  }
+
+  return response.json()
+}
+
+export async function refreshAccessToken(refreshToken: string): Promise<{
+  access_token: string
+  token_type: string
+  expires_in: number
+  refresh_token: string
+  scope: string
+}> {
+  const response = await fetch(`${getBioIdUrl()}/api/oauth/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: getClientId(),
+      client_secret: getClientSecret(),
+    }).toString(),
+  })
+
+  if (!response.ok) {
+    throw new Error(await parseErrorResponse(response, 'Token refresh failed'))
+  }
+
+  return response.json()
+}
+
+export async function fetchUserInfo(accessToken: string): Promise<User> {
+  const response = await fetch(`${getBioIdUrl()}/api/oauth/userinfo`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+  })
+
+  if (!response.ok) {
+    throw new Error('Failed to fetch user info')
+  }
+
+  const data = await response.json()
+
+  return {
+    id: data.bio_id || data.sub,
+    email: data.email,
+    name: data.name,
+    roles: data.roles || [],
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Session management
+//
+// After the OAuth callback, we create OUR OWN session JWT signed with
+// JWT_SECRET. This avoids needing to verify bio-id's access token locally
+// (bio-id uses HS256 signed with its own server secret).
+// ---------------------------------------------------------------------------
+
+export async function createSessionToken(user: User): Promise<string> {
+  return new SignJWT({
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    roles: user.roles,
+  })
+    .setProtectedHeader({ alg: 'HS256' })
+    .setIssuedAt()
+    .setExpirationTime(`${SESSION_MAX_AGE}s`)
+    .setIssuer(getAppUrl())
+    .sign(getJwtSecret())
+}
+
+export async function setSessionCookies(
+  sessionToken: string,
+  bioRefreshToken: string
+): Promise<void> {
+  const cookieStore = await cookies()
+  const secure = getAppUrl().startsWith('https://')
+
+  cookieStore.set(`${COOKIE_PREFIX}_session`, sessionToken, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: SESSION_MAX_AGE,
+    path: '/',
+  })
+
+  cookieStore.set(`${COOKIE_PREFIX}_refresh_token`, bioRefreshToken, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: REFRESH_TOKEN_MAX_AGE,
+    path: '/',
+  })
+}
+
+export async function clearAuthCookies(): Promise<void> {
+  const cookieStore = await cookies()
+  cookieStore.delete(`${COOKIE_PREFIX}_session`)
+  cookieStore.delete(`${COOKIE_PREFIX}_refresh_token`)
+  cookieStore.delete('oauth_state')
+  cookieStore.delete('oauth_code_verifier')
+  cookieStore.delete('oauth_return_to')
+}
+
+/**
+ * Get the current user from the session cookie (no network call).
+ * Verifies OUR session JWT — not bio-id's access token.
+ */
+export async function getCurrentUser(): Promise<User | null> {
+  const cookieStore = await cookies()
+  const sessionToken = cookieStore.get(`${COOKIE_PREFIX}_session`)?.value
+
+  if (!sessionToken) {
+    return null
+  }
+
+  try {
+    const { payload } = await jwtVerify(sessionToken, getJwtSecret(), {
+      issuer: getAppUrl(),
+    })
+
+    return {
+      id: payload.sub || '',
+      email: payload.email as string,
+      name: payload.name as string,
+      roles: (payload.roles as string[]) || [],
+    }
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Generate a login URL with PKCE and state stored in cookies
+ */
+export async function getLoginUrl(returnTo?: string): Promise<string> {
+  const cookieStore = await cookies()
+  const secure = getAppUrl().startsWith('https://')
+
+  const state = crypto.randomBytes(16).toString('hex')
+  const { codeVerifier, codeChallenge } = generatePKCE()
+
+  cookieStore.set('oauth_state', state, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: OAUTH_FLOW_MAX_AGE,
+    path: '/',
+  })
+
+  cookieStore.set('oauth_code_verifier', codeVerifier, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: OAUTH_FLOW_MAX_AGE,
+    path: '/',
+  })
+
+  const safeReturnTo = sanitizeReturnTo(returnTo)
+  cookieStore.set('oauth_return_to', safeReturnTo, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: OAUTH_FLOW_MAX_AGE,
+    path: '/',
+  })
+
+  return getAuthorizationUrl(state, codeChallenge)
+}
+
+export { COOKIE_PREFIX, getBioIdUrl, getAppUrl }

package/dist/templates/nextjs-oauth/src/middleware.ts

@@ -0,0 +1,71 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { jwtVerify } from 'jose'
+
+const COOKIE_PREFIX = '{{name}}'
+
+// Routes that require authentication
+const PROTECTED_PATHS = ['/dashboard']
+
+// Routes that should never be blocked
+const PUBLIC_PATHS = [
+  '/',
+  '/api/auth',
+  '/api/health',
+]
+
+function isPublicPath(pathname: string): boolean {
+  return PUBLIC_PATHS.some(
+    (path) => pathname === path || pathname.startsWith(`${path}/`)
+  )
+}
+
+function isProtectedPath(pathname: string): boolean {
+  return PROTECTED_PATHS.some(
+    (path) => pathname === path || pathname.startsWith(`${path}/`)
+  )
+}
+
+export async function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl
+
+  if (isPublicPath(pathname)) {
+    return NextResponse.next()
+  }
+
+  if (!isProtectedPath(pathname)) {
+    return NextResponse.next()
+  }
+
+  // Check for our session cookie (not bio-id's access token)
+  const sessionToken = request.cookies.get(`${COOKIE_PREFIX}_session`)?.value
+
+  if (!sessionToken) {
+    const loginUrl = new URL('/api/auth/login', request.url)
+    loginUrl.searchParams.set('returnTo', pathname)
+    return NextResponse.redirect(loginUrl)
+  }
+
+  // Verify our own session JWT (signed with JWT_SECRET, issued by APP_URL)
+  try {
+    const secret = new TextEncoder().encode(
+      process.env.JWT_SECRET || 'dev-only-secret-do-not-use-in-production'
+    )
+    await jwtVerify(sessionToken, secret, {
+      issuer: process.env.APP_URL || 'http://localhost:3000',
+    })
+  } catch {
+    // Session expired or invalid — redirect to login
+    const loginUrl = new URL('/api/auth/login', request.url)
+    loginUrl.searchParams.set('returnTo', pathname)
+    return NextResponse.redirect(loginUrl)
+  }
+
+  return NextResponse.next()
+}
+
+export const config = {
+  matcher: [
+    // Match all paths except static files and Next.js internals
+    '/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
+  ],
+}

package/dist/templates/nextjs-oauth/tsconfig.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "preserve",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "exclude": ["node_modules"]
+}

package/dist/templates/static/catalog-info.yaml

@@ -0,0 +1,14 @@
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: {{name}}
+  description: {{description}}
+  tags:
+    - tawa
+    - static
+  annotations:
+    insureco.io/framework: static
+spec:
+  type: service
+  lifecycle: production
+  owner: {{owner}}

package/dist/templates/static/index.html

@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>{{name}}</title>
+  <link rel="stylesheet" href="styles.css">
+</head>
+<body>
+  <main>
+    <h1>{{name}}</h1>
+    <p>{{description}}</p>
+    <p>Deployed on <a href="https://tawa.insureco.io">Tawa</a></p>
+  </main>
+</body>
+</html>

package/dist/templates/static/styles.css

@@ -0,0 +1,39 @@
+* {
+  margin: 0;
+  padding: 0;
+  box-sizing: border-box;
+}
+
+body {
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+  min-height: 100vh;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: #0a0a0a;
+  color: #fafafa;
+}
+
+main {
+  text-align: center;
+  padding: 2rem;
+}
+
+h1 {
+  font-size: 2.5rem;
+  margin-bottom: 1rem;
+}
+
+p {
+  color: #888;
+  margin-bottom: 0.5rem;
+}
+
+a {
+  color: #3b82f6;
+  text-decoration: none;
+}
+
+a:hover {
+  text-decoration: underline;
+}

package/dist/templates/worker/.env.example

@@ -0,0 +1,13 @@
+# Redis Configuration
+REDIS_HOST=localhost
+REDIS_PORT=6379
+REDIS_PASSWORD=
+
+# Queue Configuration
+QUEUE_NAME={{name}}-jobs
+
+# Worker Configuration
+WORKER_CONCURRENCY=5
+
+# Environment
+NODE_ENV=development

package/dist/templates/worker/Dockerfile

@@ -0,0 +1,26 @@
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM node:22-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --production && npm cache clean --force
+COPY --from=builder /app/dist ./dist
+
+ENV NODE_ENV=production
+
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nodejs -u 1001 && \
+    chown -R nodejs:nodejs /app
+
+USER nodejs
+
+# Health check via file existence
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD test -f /tmp/healthy || exit 1
+
+CMD ["node", "dist/index.js"]

package/dist/templates/worker/README.md

@@ -0,0 +1,106 @@
+# {{name}}
+
+{{description}}
+
+A background job processor using BullMQ and Redis.
+
+## Getting Started
+
+### Prerequisites
+
+- Node.js 20+
+- Redis server
+
+### Installation
+
+```bash
+npm install
+```
+
+### Development
+
+Start Redis locally:
+
+```bash
+docker run -d -p 6379:6379 redis:alpine
+```
+
+Run the worker:
+
+```bash
+npm run dev
+```
+
+## Job Types
+
+The worker processes these job types:
+
+- `email` - Send email notifications
+- `report` - Generate reports
+- `sync` - Synchronize data
+- `cleanup` - Clean up resources
+
+## Adding Jobs to the Queue
+
+From another service:
+
+```typescript
+import { Queue } from 'bullmq'
+
+const queue = new Queue('{{name}}-jobs', {
+  connection: {
+    host: 'redis',
+    port: 6379,
+  },
+})
+
+// Add a job
+await queue.add('my-job', {
+  type: 'email',
+  payload: {
+    to: 'user@example.com',
+    subject: 'Hello',
+    body: 'World',
+  },
+  priority: 5,
+})
+```
+
+## Health Checks
+
+The worker uses file-based health checks:
+
+- Creates `/tmp/healthy` when ready
+- Removes the file on error or shutdown
+- Kubernetes checks file existence for liveness
+
+## Configuration
+
+Environment variables:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `REDIS_HOST` | localhost | Redis server host |
+| `REDIS_PORT` | 6379 | Redis server port |
+| `REDIS_PASSWORD` | - | Redis password |
+| `QUEUE_NAME` | {{name}}-jobs | Queue name |
+| `WORKER_CONCURRENCY` | 5 | Max concurrent jobs |
+
+## Deployment
+
+```bash
+iec link
+iec deploy
+```
+
+## Project Structure
+
+```
+{{name}}/
+├── src/
+│   └── index.ts      # Worker entry point
+├── helm/
+│   └── {{name}}/     # Kubernetes Helm chart
+├── Dockerfile
+└── catalog-info.yaml
+```

package/dist/templates/worker/catalog-info.yaml

@@ -0,0 +1,19 @@
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: {{name}}
+  description: {{description}}
+  tags:
+    - tawa
+    - worker
+    - background-job
+  annotations:
+    insureco.io/framework: bullmq
+    insureco.io/language: typescript
+    insureco.io/type: worker
+spec:
+  type: service
+  lifecycle: experimental
+  owner: {{owner}}
+  # Workers typically don't expose HTTP routes
+  # Health is monitored via TCP probe or file-based health check

package/dist/templates/worker/gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+.env
+.env.local
+*.log

package/dist/templates/worker/helm/{{name}}/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: {{name}}
+description: Helm chart for {{name}} background worker
+type: application
+version: 0.1.0
+appVersion: "0.1.0"
+maintainers:
+  - name: team-platform
+    email: platform@insureco.io

package/dist/templates/worker/helm/{{name}}/templates/deployment.yaml

@@ -0,0 +1,68 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ .Release.Name }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          envFrom:
+            - configMapRef:
+                name: {{ .Release.Name }}-config
+                optional: true
+            - secretRef:
+                name: {{ .Release.Name }}-secrets
+                optional: true
+            {{- if .Values.secretRef }}
+            - secretRef:
+                name: {{ .Values.secretRef }}
+            {{- end }}
+          {{- with .Values.env }}
+          env:
+            {{- range $key, $value := . }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}