kasy-cli 1.19.3 → 1.20.0

package/bin/kasy.js

@@ -357,6 +357,7 @@ function buildProgram(language) {
       .option('--web', 'Run on web — prints localhost URL in lime so you open it in your own browser (your extensions, your accounts)')
       .option('--open', 'With --web: auto-launch a clean Chrome window (Flutter profile, no extensions) instead of just printing the URL')
       .option('--web-port <port>', 'Fixed port for web (default 5555) — keeps the origin stable so Firebase Auth sessions persist between runs')
+      .option('--web-hostname <host>', 'Host for web (default localhost) — localhost is a Firebase-authorized domain by default, so Google sign-in works without console changes')
       .option('-d, --device <id>', 'Run on specific device ID')
       .option('--prod', 'Use production dart-defines (from launch.json)')
       .option('--no-defines', 'Skip dart-defines from launch.json')

package/lib/commands/new.js

@@ -772,6 +772,9 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
         } else if (key === 'auth-providers-warn') {
           ps1.stop();
           ui.log.warn(`${tr('new.firebase.interactive.authWarn')}\n${kleur.cyan(data?.url || '')}`);
+        } else if (key === 'auth-localhost-warn') {
+          ps1.stop();
+          ui.log.warn(`${tr('new.firebase.localhostWarn')}\n${kleur.cyan(data?.url || '')}`);
         }
       };
       let setupResult = await setupFromScratch(core.appName.trim(), core.bundleId.trim(), {
@@ -1179,6 +1182,9 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
         } else if (key === 'auth-google-warn') {
           ps4.stop();
           ui.log.warn(`${tr('new.firebase.existing.googleSignInManual')}\n${kleur.cyan(data?.url || '')}`);
+        } else if (key === 'auth-localhost-warn') {
+          ps4.stop();
+          ui.log.warn(`${tr('new.firebase.localhostWarn')}\n${kleur.cyan(data?.url || '')}`);
         }
       },
     });
@@ -1804,6 +1810,9 @@ async function runNew(directory, { language: langHint = null, backend: backendHi
     if (appleResult.appleEnabled) {
       printStepResult({ name: 'apple sign-in', ok: true }, language);
     }
+    if (appleResult.localhostAuthorized === false) {
+      ui.log.warn(`${tr('new.firebase.localhostWarn')}\n${kleur.cyan(`https://console.firebase.google.com/project/${answers.firebaseProjectId}/authentication/settings`)}`);
+    }
   }
 
   // APNs key (iOS push) is intentionally not mentioned here — it only becomes

package/lib/commands/run.js

@@ -292,6 +292,13 @@ async function runRun(directory, options = {}) {
   }
 
   if (isChromeTarget || isWebServerTarget) {
+    // Pin the host to `localhost` so the app's origin is always an authorized
+    // domain. Firebase Auth authorizes `localhost` by default but NOT
+    // `127.0.0.1`, and `flutter run -d chrome` would otherwise auto-launch
+    // Chrome at 127.0.0.1 — which breaks Google sign-in with
+    // [firebase_auth/unauthorized-domain]. Forcing localhost makes Google
+    // login work out of the box, no Firebase Console changes required.
+    deviceArgs.push('--web-hostname', options.webHostname || 'localhost');
     // Pin a fixed port so the Chrome origin stays the same between runs.
     // Firebase Auth persists sessions per-origin (IndexedDB) — a random port
     // each run means the user gets logged out every restart.

package/lib/scaffold/backends/firebase/setup-from-scratch.js

@@ -659,6 +659,54 @@ async function checkBillingEnabled(projectId) {
   return { ok: true, enabled: result.stdout.trim().toLowerCase() === 'true' };
 }
 
+/**
+ * Ensure `localhost` and `127.0.0.1` are in the project's authorized domains so
+ * Google/social sign-in works on Flutter web during local development.
+ *
+ * Projects created programmatically (via the Firebase Management API) do NOT get
+ * `localhost` seeded automatically — only `<project>.firebaseapp.com` and
+ * `<project>.web.app`. Without `localhost`, `signInWithPopup` fails with
+ * [firebase_auth/unauthorized-domain] when running `flutter run -d chrome` or
+ * `-d web-server`. The Firebase Console adds localhost by default; the API does
+ * not, so we add it here.
+ *
+ * Read-modify-write so the existing default domains are preserved — a blind PATCH
+ * with only [localhost] would wipe firebaseapp.com / web.app. Idempotent: it's a
+ * no-op when both entries are already present.
+ *
+ * @returns {{ ok: boolean, added?: string[], error?: string }}
+ */
+async function ensureLocalhostAuthorizedDomains(projectId, token) {
+  const base = `https://identitytoolkit.googleapis.com/admin/v2/projects/${projectId}/config`;
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    'Content-Type': 'application/json',
+    'X-Goog-User-Project': projectId,
+  };
+  // 1. Read the current authorized domains.
+  const getRes = await fetch(base, { headers });
+  if (!getRes.ok) {
+    const text = await getRes.text();
+    return { ok: false, error: `${getRes.status}: ${text}` };
+  }
+  const config = await getRes.json();
+  const current = Array.isArray(config.authorizedDomains) ? config.authorizedDomains : [];
+  const required = ['localhost', '127.0.0.1'];
+  const missing = required.filter((d) => !current.includes(d));
+  if (missing.length === 0) return { ok: true, added: [] };
+  // 2. Merge and write back, keeping every domain that was already there.
+  const patchRes = await fetch(`${base}?updateMask=authorizedDomains`, {
+    method: 'PATCH',
+    headers,
+    body: JSON.stringify({ authorizedDomains: [...current, ...missing] }),
+  });
+  if (!patchRes.ok) {
+    const text = await patchRes.text();
+    return { ok: false, error: `${patchRes.status}: ${text}` };
+  }
+  return { ok: true, added: missing };
+}
+
 /**
  * Enable Firebase Auth sign-in providers: Email/Password, Anonymous and Google.
  * Uses the Identity Toolkit Admin v2 REST API with gcloud credentials.
@@ -807,7 +855,18 @@ async function enableAuthProviders(projectId, { maxRetries = 3, retryDelayMs = 1
         // Network error — skip silently.
       }
 
-      return { ok: true, googleSignInSkipped, googleEnabled, appleEnabled };
+      // Step 5: Authorize localhost / 127.0.0.1 so web sign-in works in dev.
+      // Best effort — failure here doesn't block the providers we just enabled.
+      const domainsResult = await ensureLocalhostAuthorizedDomains(projectId, token);
+
+      return {
+        ok: true,
+        googleSignInSkipped,
+        googleEnabled,
+        appleEnabled,
+        localhostAuthorized: domainsResult.ok,
+        authorizedDomainsAdded: domainsResult.added || [],
+      };
     }
     const text = await res.text();
     lastError = `${res.status}: ${text}`;
@@ -818,7 +877,24 @@ async function enableAuthProviders(projectId, { maxRetries = 3, retryDelayMs = 1
     }
     break;
   }
-  return { ok: false, error: lastError };
+  // The provider PATCH failed after retries. Still try to authorize localhost as a
+  // best-effort: the auth config may already exist (a transient failure here, or
+  // auth initialized elsewhere), and web sign-in depends on localhost being on the
+  // list. This keeps the function self-sufficient instead of relying on a later
+  // re-invocation to backfill localhost.
+  let fallbackDomains = { ok: false, added: [] };
+  try {
+    const freshToken = await getAccessToken();
+    fallbackDomains = await ensureLocalhostAuthorizedDomains(projectId, freshToken);
+  } catch (_) {
+    // Best effort — ignore.
+  }
+  return {
+    ok: false,
+    error: lastError,
+    localhostAuthorized: fallbackDomains.ok,
+    authorizedDomainsAdded: fallbackDomains.added || [],
+  };
 }
 
 /**
@@ -907,6 +983,13 @@ async function setupFromScratch(appName, bundleId, options = {}) {
       url: `https://console.firebase.google.com/project/${projectId}/authentication/providers`,
     });
   }
+  // Providers were enabled but localhost couldn't be authorized — warn so the user
+  // isn't surprised by [firebase_auth/unauthorized-domain] on web sign-in.
+  if (authResult.ok && authResult.localhostAuthorized === false) {
+    onProgress('auth-localhost-warn', {
+      url: `https://console.firebase.google.com/project/${projectId}/authentication/settings`,
+    });
+  }
 
   onProgress('firestore');
   const firestoreResult = await createFirestoreDatabase(projectId, region);
@@ -1022,6 +1105,11 @@ async function setupExistingProject(projectId, options = {}) {
       url: `https://console.firebase.google.com/project/${projectId}/authentication/providers`,
     });
   }
+  if (authResult.ok && authResult.localhostAuthorized === false) {
+    onProgress('auth-localhost-warn', {
+      url: `https://console.firebase.google.com/project/${projectId}/authentication/settings`,
+    });
+  }
 
   onProgress('firestore');
   const firestoreResult = await createFirestoreDatabase(projectId);
@@ -1114,6 +1202,7 @@ module.exports = {
   applyStorageCors,
   checkBillingEnabled,
   enableAuthProviders,
+  ensureLocalhostAuthorizedDomains,
   listBillingAccounts,
   listGcpOrganizations,
   checkGcloudAuth,

package/lib/scaffold/engine.js

@@ -41,6 +41,11 @@ const ALWAYS_EXCLUDE_BASENAMES = new Set([
   'google-services.json',   // Firebase Android config — client must generate their own
   'GoogleService-Info.plist', // Firebase iOS config — client must generate their own
   'firebase_options_dev.dart', // Dev Firebase options — internal only
+  'firebase_options.dart',  // Kit's own Firebase options — dead code in generated
+                            // projects (main.dart imports firebase_options_dev.dart,
+                            // which flutterfire regenerates per-user). Shipping it
+                            // would leak the kit's project id (fir-kit-8e56b) into
+                            // every generated app. Never copy it.
 ]);
 
 // File extensions that may contain generated Dart code — skip these

package/lib/scaffold/generate.js

@@ -48,6 +48,7 @@ const {
   writeEnvExample,
   writeEnvFileIfMissing,
   writeFirebaserc,
+  cleanFirebaseJsonKitRefs,
   writeFeaturesConfig,
   writeKitSetup,
   writeMakefile,
@@ -362,6 +363,9 @@ async function generateProject(targetDir, backend, options, hooks = {}) {
   }
 
   await writeFirebaserc(targetDir, firebaseProjectId);
+  // Drop the stale firebase.json entry that still points at the kit project
+  // (the dead lib/firebase_options.dart we no longer ship).
+  await cleanFirebaseJsonKitRefs(targetDir);
 
   // ── 3. Post-build específico do backend ────────────────────────────────────
   if (postBuild) {

package/lib/scaffold/shared/generator-utils.js

@@ -229,6 +229,39 @@ async function writeFirebaserc(projectDir, firebaseProjectId) {
   );
 }
 
+/**
+ * Strip the kit's own Firebase project from the generated firebase.json.
+ *
+ * flutterfire configure rewrites the android/ios/web platform entries for the
+ * user's project, but it keys the dart entry by its --out path
+ * (lib/firebase_options_dev.dart) and leaves the template's stale
+ * `flutter.platforms.dart["lib/firebase_options.dart"]` entry untouched — which
+ * still points at the kit project (fir-kit-8e56b). We no longer ship that file
+ * (see ALWAYS_EXCLUDE_BASENAMES), so this drops the dead entry to guarantee the
+ * user's firebase.json never references the kit project.
+ *
+ * Best effort: no-ops when firebase.json is missing, unparseable, or already clean.
+ *
+ * @param {string} projectDir
+ * @returns {Promise<{ ok: boolean, changed: boolean }>}
+ */
+async function cleanFirebaseJsonKitRefs(projectDir) {
+  const firebaseJsonPath = path.join(projectDir, 'firebase.json');
+  if (!(await fs.pathExists(firebaseJsonPath))) return { ok: true, changed: false };
+  let config;
+  try {
+    config = await fs.readJson(firebaseJsonPath);
+  } catch {
+    return { ok: false, changed: false };
+  }
+  const dartMap = config && config.flutter && config.flutter.platforms && config.flutter.platforms.dart;
+  if (!dartMap || typeof dartMap !== 'object') return { ok: true, changed: false };
+  if (!('lib/firebase_options.dart' in dartMap)) return { ok: true, changed: false };
+  delete dartMap['lib/firebase_options.dart'];
+  await fs.writeJson(firebaseJsonPath, config, { spaces: 2 });
+  return { ok: true, changed: true };
+}
+
 /**
  * Write environnements.dart overrides for backend-specific config.
  *
@@ -812,7 +845,10 @@ async function writeMainDart(projectDir, backend, modules, packageName, options
     lines.push(`      options: firebase_dev.DefaultFirebaseOptions.currentPlatform,`);
     lines.push(`    ),`);
     lines.push(`    ProdEnvironment() => Firebase.initializeApp(`);
-    lines.push(`      // TODO replace with your own firebase options for production environment (if needed)`);
+    lines.push(`      // SETUP REQUIRED: For production, create a separate Firebase project and run:`);
+    lines.push(`      //   flutterfire configure --project=<your-prod-project> --out=lib/firebase_options_prod.dart`);
+    lines.push(`      // Then import firebase_options_prod.dart and use it here instead.`);
+    lines.push(`      // Reusing the dev project in production is only safe for early-stage development.`);
     lines.push(`      options: firebase_dev.DefaultFirebaseOptions.currentPlatform,`);
     lines.push(`    ),`);
     lines.push(`  };`);
@@ -1687,6 +1723,7 @@ module.exports = {
   writeEnvExample,
   writeEnvFileIfMissing,
   writeFirebaserc,
+  cleanFirebaseJsonKitRefs,
   writeEnvironnementsOverrides,
   writeFeaturesConfig,
   writeKitSetup,

package/lib/utils/i18n/messages-en.js

@@ -633,6 +633,7 @@ module.exports = {
     'new.firebase.interactive.billingWaiting': 'Checking Blaze status...',
     'new.firebase.interactive.billingTimeout': 'Blaze plan not confirmed after timeout. Deploy skipped — run manually when ready.',
     'new.firebase.interactive.authWarn': 'Could not enable Email/Password and Anonymous auth automatically. Enable manually:',
+    'new.firebase.localhostWarn': 'Could not authorize localhost for web sign-in. To test login in the browser, add "localhost" under Authorized domains:',
     'new.firebase.existing.apisFailed': 'Could not activate APIs:',
     'new.firebase.existing.googleSignInManual': 'Google Sign-In: enable manually in Authentication → Sign-in method → Google',
 

package/lib/utils/i18n/messages-es.js

@@ -633,6 +633,7 @@ module.exports = {
     'new.firebase.interactive.billingWaiting': 'Verificando estado del Blaze...',
     'new.firebase.interactive.billingTimeout': 'Plan Blaze no confirmado tras el tiempo límite. Despliegue omitido — ejecuta manualmente cuando estés listo.',
     'new.firebase.interactive.authWarn': 'No se pudo activar Email/Contraseña y Anónimo automáticamente. Actívalos manualmente:',
+    'new.firebase.localhostWarn': 'No se pudo autorizar localhost para el inicio de sesión web. Para probar el login en el navegador, agrega "localhost" en Authorized domains:',
     'new.firebase.existing.apisFailed': 'No se pudieron activar las APIs:',
     'new.firebase.existing.googleSignInManual': 'Google Sign-In: activa manualmente en Authentication → Sign-in method → Google',
 

package/lib/utils/i18n/messages-pt.js

@@ -633,6 +633,7 @@ module.exports = {
     'new.firebase.interactive.billingWaiting': 'Verificando status do Blaze...',
     'new.firebase.interactive.billingTimeout': 'Plano Blaze não confirmado apos o tempo limite. Deploy ignorado — rode manualmente quando estiver pronto.',
     'new.firebase.interactive.authWarn': 'Não foi possível ativar Email/Senha e Anônimo automaticamente. Ative manualmente:',
+    'new.firebase.localhostWarn': 'Não foi possível autorizar localhost para login web. Se for testar login no navegador, adicione "localhost" em Authorized domains:',
     'new.firebase.existing.apisFailed': 'Não foi possível ativar APIs:',
     'new.firebase.existing.googleSignInManual': 'Google Sign-In: ative manualmente em Authentication → Sign-in method → Google',
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kasy-cli",
-  "version": "1.19.3",
+  "version": "1.20.0",
   "description": "CLI for scaffolding production-ready Flutter SaaS apps with Firebase, Supabase, or API REST backends.",
   "bin": {
     "kasy": "./bin/kasy.js"

package/templates/firebase/android/app/src/main/res/values-night-v31/styles.xml

@@ -6,7 +6,7 @@
         <item name="android:windowFullscreen">true</item>
         <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
-        <item name="android:windowSplashScreenBackground">#000000</item>
+        <item name="android:windowSplashScreenBackground">#060608</item>
         <item name="android:windowSplashScreenAnimatedIcon">@drawable/android12splash</item>
     </style>
     <!-- Theme applied to the Android Window as soon as the process has started.

package/templates/firebase/android/app/src/main/res/values-v31/styles.xml

@@ -6,7 +6,7 @@
         <item name="android:windowFullscreen">true</item>
         <item name="android:windowDrawsSystemBarBackgrounds">true</item>
         <item name="android:windowLayoutInDisplayCutoutMode">shortEdges</item>
-        <item name="android:windowSplashScreenBackground">#FFFFFF</item>
+        <item name="android:windowSplashScreenBackground">#F7F7F7</item>
         <item name="android:windowSplashScreenAnimatedIcon">@drawable/android12splash</item>
     </style>
     <!-- Theme applied to the Android Window as soon as the process has started.

package/templates/firebase/lib/components/kasy_date_picker.dart

@@ -987,6 +987,14 @@ class _KasyDatePickerState extends State<KasyDatePicker>
         hasErrorText ? widget.errorText : widget.description;
     final Color labelColor = hasInvalidState ? c.error : c.fieldLabel;
 
+    // Kit-wide rule: disabled colors are softened by blending toward the
+    // surface (opaque), never by raw opacity. See KasyButton / KasyTextField.
+    final Color blendSurface = c.surface;
+    Color dimDisabled(Color base, {double alpha = 0.55}) {
+      if (!isDisabled) return base;
+      return Color.alphaBlend(base.withValues(alpha: alpha), blendSurface);
+    }
+
     return Column(
       crossAxisAlignment: CrossAxisAlignment.start,
       mainAxisSize: MainAxisSize.min,
@@ -1000,9 +1008,7 @@ class _KasyDatePickerState extends State<KasyDatePicker>
                 Text(
                   widget.label!,
                   style: context.textTheme.bodyMedium?.copyWith(
-                    color: isDisabled
-                        ? labelColor.withValues(alpha: 0.46)
-                        : labelColor,
+                    color: dimDisabled(labelColor),
                     fontWeight: FontWeight.w500,
                   ),
                 ),
@@ -1066,11 +1072,11 @@ class _KasyDatePickerState extends State<KasyDatePicker>
             child: Text(
               footerText,
               style: context.textTheme.bodySmall?.copyWith(
-                color: (hasErrorText ? c.error : c.muted).withValues(
-                  // Match KasyTextField's disabled description fade (0.34)
-                  // so the helper text dims along with the field.
-                  alpha: isDisabled ? 0.34 : 1,
-                ),
+                // Soften the helper text via the kit's blend-toward-surface
+                // rule so the field as a whole reads as disabled without any
+                // transparency.
+                color:
+                    dimDisabled(hasErrorText ? c.error : c.muted, alpha: 0.45),
               ),
             ),
           ),