kasy-cli 1.31.13 → 1.31.14

package/lib/scaffold/backends/supabase/deploy.js

@@ -363,6 +363,11 @@ async function enableGoogleSignIn(projectRef, webClientId, clientSecret) {
     external_google_client_id: webClientId,
     external_google_secret: clientSecret,
     external_google_skip_nonce_check: true,
+    // Allow the web app's dev origin as a redirect target so the web OAuth flow
+    // (signInWithOAuth redirectTo) and email links (recovery/confirm) land back on
+    // the app. http://localhost:5555 is the port `kasy run --web` uses. Add your
+    // production web origin here when you deploy to the web.
+    uri_allow_list: 'http://localhost:5555,http://localhost:5555/**',
   });
   if (!result.ok) return { ok: false, error: result.error };
   if (result.data.external_google_enabled === true) return { ok: true };

package/lib/scaffold/backends/supabase/patch/lib/features/authentication/api/authentication_api.dart

@@ -1,5 +1,6 @@
 import 'dart:convert';
 import 'package:crypto/crypto.dart';
+import 'package:firebase_auth/firebase_auth.dart' as fb_auth;
 import 'package:flutter/foundation.dart' show kIsWeb;
 import 'package:flutter/services.dart' show PlatformException;
 import 'package:flutter_facebook_auth/flutter_facebook_auth.dart';
@@ -212,16 +213,16 @@ Note: wait a minute after enabling anonymous sign-in before trying again. It tak
   @override
   Future<Credentials> signinWithGoogle() async {
     if (kIsWeb) {
-      // google_sign_in's imperative authenticate() is UNSUPPORTED on web (the v7
-      // web plugin throws UnimplementedError). Use Supabase's OAuth redirect flow:
-      // it sends the user to Google and back; the session arrives on return and is
-      // picked up by the auth state listener. Requires your web origin in Supabase
-      // Auth -> URL Configuration (Site URL / Redirect URLs).
-      await client.auth.signInWithOAuth(
-        OAuthProvider.google,
-        redirectTo: Uri.base.origin,
+      // google_sign_in v7 can't do imperative auth on web. Get the Google ID token
+      // via Firebase's popup (zero manual config — reuses the Firebase web OAuth
+      // client + authorized domains, which the kit already sets up) and sign into
+      // Supabase with it. Supabase remains the auth backend.
+      final idToken = await _googleIdTokenFromWebPopup();
+      final res = await client.auth.signInWithIdToken(
+        provider: OAuthProvider.google,
+        idToken: idToken,
       );
-      return Credentials(id: '', token: '');
+      return Credentials(id: res.user!.id, token: res.session?.accessToken ?? '');
     }
     final googleSignIn = GoogleSignIn.instance;
     // Web: clientId = Web Client ID (no serverClientId needed)
@@ -264,6 +265,33 @@ Note: wait a minute after enabling anonymous sign-in before trying again. It tak
     
   }
 
+  /// Web only: obtains a Google ID token via Firebase's popup. google_sign_in v7
+  /// can't do imperative auth on the web, but the kit already initializes Firebase
+  /// (for FCM), so we reuse Firebase's working web OAuth client to get the token,
+  /// then sign into Supabase with it — no Supabase callback / Google console step
+  /// needed. The token's audience is the Firebase web client ID, which is the same
+  /// one configured as Supabase's Google provider, so signInWithIdToken accepts it.
+  Future<String> _googleIdTokenFromWebPopup() async {
+    try {
+      final cred = await fb_auth.FirebaseAuth.instance.signInWithPopup(
+        fb_auth.GoogleAuthProvider(),
+      );
+      final idToken = (cred.credential as fb_auth.OAuthCredential?)?.idToken;
+      if (idToken == null) {
+        throw ApiError(code: 401, message: 'No Google ID token from Firebase popup.');
+      }
+      return idToken;
+    } on fb_auth.FirebaseAuthException catch (e) {
+      if (e.code == 'popup-closed-by-user' ||
+          e.code == 'cancelled-popup-request' ||
+          e.code == 'web-context-cancelled' ||
+          e.code == 'user-cancelled') {
+        throw const UserCancelledSignInException();
+      }
+      rethrow;
+    }
+  }
+
   @override
   Future<Credentials> signinWithGooglePlay() {
     // Google Play Games sign-in is not supported for Supabase backend.
@@ -323,14 +351,26 @@ Note: wait a minute after enabling anonymous sign-in before trying again. It tak
   @override
   Future<Credentials> signupFromAnonymousWithGoogle() async {
     if (kIsWeb) {
-      // Imperative GoogleSignIn.authenticate() is UNSUPPORTED on web. Use Supabase's
-      // OAuth redirect; the session arrives on return via the auth listener. (On web
-      // this signs in with Google instead of linking the anonymous user.)
-      await client.auth.signInWithOAuth(
-        OAuthProvider.google,
-        redirectTo: Uri.base.origin,
-      );
-      return Credentials(id: '', token: '');
+      // Web: get the Google ID token via Firebase's popup (see signinWithGoogle) and
+      // link it to the current anonymous Supabase user.
+      final idToken = await _googleIdTokenFromWebPopup();
+      try {
+        final response = await client.auth.linkIdentityWithIdToken(
+          provider: OAuthProvider.google,
+          idToken: idToken,
+        );
+        return Credentials(id: response.user!.id, token: response.session?.accessToken ?? '');
+      } on AuthException catch (e) {
+        if (e.code == 'identity_already_exists') {
+          await _deleteCurrentAnonymousUser();
+          final res = await client.auth.signInWithIdToken(
+            provider: OAuthProvider.google,
+            idToken: idToken,
+          );
+          return Credentials(id: res.user!.id, token: res.session?.accessToken ?? '');
+        }
+        rethrow;
+      }
     }
     final scopes = ['email'];
     final googleSignIn = GoogleSignIn.instance;

package/lib/scaffold/backends/supabase/pubspec.yaml.tpl

@@ -26,6 +26,11 @@ dependencies:
   facebook_app_events: ^0.24.0
   firebase_app_installations: ^0.4.0+7
   firebase_core: ^4.5.0
+  # Web-only Google sign-in: on web, google_sign_in v7 can't do imperative auth, so we
+  # get the Google ID token via Firebase's popup (zero manual config — reuses the
+  # Firebase web client + authorized domains) and hand it to Supabase signInWithIdToken.
+  # Supabase stays the auth backend; mobile keeps the native google_sign_in flow.
+  firebase_auth: ^6.1.4
   firebase_messaging: ^16.1.2
   firebase_remote_config: ^6.2.0
   flutter:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kasy-cli",
-  "version": "1.31.13",
+  "version": "1.31.14",
   "description": "CLI for scaffolding production-ready Flutter SaaS apps with Firebase, Supabase, or API REST backends.",
   "bin": {
     "kasy": "./bin/kasy.js"

package/templates/firebase/lib/components/kasy_sidebar.dart

@@ -213,8 +213,14 @@ class KasySidebar extends StatefulWidget {
     this.profileAvatar,
     this.profileGradient = KasyAvatarGradients.indigo,
     this.onProfileTap,
+    this.notificationsUnread = 0,
   });
 
+  /// Unread notification count. When greater than zero, the Notifications nav
+  /// item shows an unread dot (mirrors the bottom-bar badge). Purely an unread
+  /// indicator — not tied to push (which is native-only).
+  final int notificationsUnread;
+
   final VoidCallback? onSettingsTap;
 
   /// Whether the profile block is shown at the bottom of the rail. Set false to
@@ -496,6 +502,9 @@ class _KasySidebarState extends State<KasySidebar> {
                             : (widget.routes![i].label ?? ''),
                         isActive: _activeItemId.isEmpty && currentIndex == i,
                         onTap: () => _navigateTo(i),
+                        showBadge: i < meta.length &&
+                            meta[i].icon == KasyIcons.notification &&
+                            widget.notificationsUnread > 0,
                       ),
                     // Static showcase extras (incl. the Income submenu).
                     for (final item in _kMainItems.skip(1))
@@ -842,6 +851,37 @@ class _KasySidebarState extends State<KasySidebar> {
 
   // ── Generic row (expanded) / icon+tooltip (collapsed) ────────────────────────
 
+  /// Overlays a small unread dot on the top-right of [child] when [show] is true.
+  /// The dot carries a thin border in the sidebar background color so it reads
+  /// cleanly over the icon.
+  Widget _withBadgeDot({
+    required Widget child,
+    required bool show,
+    required Color dotColor,
+    required Color borderColor,
+  }) {
+    if (!show) return child;
+    return Stack(
+      clipBehavior: Clip.none,
+      children: [
+        child,
+        Positioned(
+          top: -2,
+          right: -2,
+          child: Container(
+            width: 8,
+            height: 8,
+            decoration: BoxDecoration(
+              color: dotColor,
+              shape: BoxShape.circle,
+              border: Border.all(color: borderColor, width: 1.5),
+            ),
+          ),
+        ),
+      ],
+    );
+  }
+
   Widget _buildItemRow(
     _SidebarColors c, {
     required IconData icon,
@@ -849,6 +889,7 @@ class _KasySidebarState extends State<KasySidebar> {
     required bool isActive,
     required VoidCallback onTap,
     bool isLogout = false,
+    bool showBadge = false,
     List<Widget> trailing = const [],
     double bottomGap = _kItemGap,
   }) {
@@ -861,14 +902,19 @@ class _KasySidebarState extends State<KasySidebar> {
     if (_collapsed) {
       return Padding(
         padding: EdgeInsets.only(bottom: bottomGap),
-        child: _ProTooltipIcon(
-          icon: icon,
-          label: label,
-          iconBg: fill,
-          iconColor: iconColor,
-          activeBg: c.activeBg,
-          colors: c,
-          onTap: onTap,
+        child: _withBadgeDot(
+          show: showBadge,
+          dotColor: c.logout,
+          borderColor: c.bg,
+          child: _ProTooltipIcon(
+            icon: icon,
+            label: label,
+            iconBg: fill,
+            iconColor: iconColor,
+            activeBg: c.activeBg,
+            colors: c,
+            onTap: onTap,
+          ),
         ),
       );
     }
@@ -894,7 +940,12 @@ class _KasySidebarState extends State<KasySidebar> {
           ),
           child: Row(
             children: [
-              Icon(icon, size: _kIconSize, color: iconColor),
+              _withBadgeDot(
+                show: showBadge,
+                dotColor: c.logout,
+                borderColor: c.bg,
+                child: Icon(icon, size: _kIconSize, color: iconColor),
+              ),
               const SizedBox(width: _kIconGap),
               Expanded(
                 child: Text(

package/templates/firebase/lib/core/bottom_menu/bottom_menu.dart

@@ -14,6 +14,7 @@ import 'package:kasy_kit/core/states/logout_action.dart';
 import 'package:kasy_kit/core/states/user_state_notifier.dart';
 import 'package:kasy_kit/core/theme/theme.dart';
 import 'package:kasy_kit/core/widgets/responsive_layout.dart';
+import 'package:kasy_kit/features/notifications/providers/unread_notifications_count_provider.dart';
 import 'package:kasy_kit/features/settings/ui/widgets/kasy_user_avatar.dart';
 import 'package:kasy_kit/i18n/translations.g.dart';
 
@@ -64,6 +65,10 @@ class BottomMenu extends StatelessWidget {
                 builder: (context, ref, _) {
                   final User user =
                       ref.watch(userStateNotifierProvider).user;
+                  final int unread = ref
+                      .watch(unreadNotificationsCountProvider)
+                      .value ??
+                      0;
                   final (String name, String email) = switch (user) {
                     final AuthenticatedUserData u => (
                       (u.name?.isNotEmpty ?? false)
@@ -81,6 +86,7 @@ class BottomMenu extends StatelessWidget {
                     profileName: name,
                     profileEmail: email,
                     profileAvatar: const KasyUserAvatar(),
+                    notificationsUnread: unread,
                   );
                 },
               ),

package/templates/firebase/lib/core/bottom_menu/notification_bottom_item.dart

@@ -1,48 +1,27 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:kasy_kit/core/states/user_state_notifier.dart';
 import 'package:kasy_kit/core/theme/theme.dart';
-import 'package:kasy_kit/features/notifications/repositories/notifications_repository.dart';
+import 'package:kasy_kit/features/notifications/providers/unread_notifications_count_provider.dart';
 
-class BottomItemNotification extends ConsumerStatefulWidget {
+/// Bottom-bar notifications icon with an unread-count badge.
+///
+/// The badge is purely an unread indicator (works on web too) — it is not tied
+/// to push notifications, which are native-only. The count comes from the shared
+/// [unreadNotificationsCountProvider], which re-subscribes per signed-in user.
+class BottomItemNotification extends ConsumerWidget {
   const BottomItemNotification({super.key});
 
   @override
-  ConsumerState<ConsumerStatefulWidget> createState() =>
-      _BottomItemNotificationState();
-}
-
-class _BottomItemNotificationState
-    extends ConsumerState<BottomItemNotification> {
-  Stream<int>? _count$;
-
-  @override
-  Widget build(BuildContext context) {
-    final String? userId =
-        ref.watch(userStateNotifierProvider).user.idOrNull;
+  Widget build(BuildContext context, WidgetRef ref) {
     const icon = Icon(KasyIcons.notification);
-
-    if (userId == null) {
-      return icon;
-    }
-
-    _count$ ??= ref
-        .read(notificationRepositoryProvider)
-        .listenToUnreadNotificationsCount(userId);
-
-    return StreamBuilder<int>(
-      key: const ValueKey('notification-count'),
-      stream: _count$,
-      builder: (context, snapshot) {
-        final count = snapshot.data ?? 0;
-        if (count == 0) return icon;
-        return Badge(
-          backgroundColor: context.colors.error,
-          textColor: context.colors.onPrimary,
-          label: Text(count > 99 ? '99+' : '$count'),
-          child: icon,
-        );
-      },
+    final int count =
+        ref.watch(unreadNotificationsCountProvider).value ?? 0;
+    if (count == 0) return icon;
+    return Badge(
+      backgroundColor: context.colors.error,
+      textColor: context.colors.onError,
+      label: Text(count > 99 ? '99+' : '$count'),
+      child: icon,
     );
   }
 }

package/templates/firebase/lib/features/notifications/providers/unread_notifications_count_provider.dart

@@ -0,0 +1,17 @@
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:kasy_kit/core/states/user_state_notifier.dart';
+import 'package:kasy_kit/features/notifications/repositories/notifications_repository.dart';
+
+/// Live count of the signed-in user's unread notifications. Emits 0 when there
+/// is no user. Shared source for badging the notifications item everywhere it
+/// appears in the navigation (bottom bar, sidebar).
+///
+/// Watches the user id, so it automatically re-subscribes to the right stream
+/// when the account changes (avoids leaking the previous user's count).
+final unreadNotificationsCountProvider = StreamProvider.autoDispose<int>((ref) {
+  final String? userId = ref.watch(userStateNotifierProvider).user.idOrNull;
+  if (userId == null) return Stream<int>.value(0);
+  return ref
+      .read(notificationRepositoryProvider)
+      .listenToUnreadNotificationsCount(userId);
+});

package/templates/firebase/lib/features/settings/ui/components/delete_user_component.dart

@@ -14,12 +14,18 @@ class DeleteUserButton extends ConsumerWidget {
       label: t.settings.delete_account.button,
       variant: KasyButtonVariant.ghost,
       foregroundColor: context.colors.muted,
-      onPressed: () => showKasyConfirmDialog(
+      onPressed: () {
+        // Only warn about losing the subscription when the user actually has an
+        // active one — otherwise the generic permanent-deletion warning.
+        final bool isSubscriber =
+            ref.read(userStateNotifierProvider).subscription?.isActive ?? false;
+        final account = t.settings.delete_account;
+        showKasyConfirmDialog(
         context,
-        title: t.settings.delete_account.title,
-        message: t.settings.delete_account.content,
-        cancelLabel: t.settings.delete_account.cancel,
-        confirmLabel: t.settings.delete_account.confirm,
+        title: account.title,
+        message: isSubscriber ? account.content_subscriber : account.content,
+        cancelLabel: account.cancel,
+        confirmLabel: account.confirm,
         destructive: true,
         onConfirmAsync: () async {
           try {
@@ -34,7 +40,8 @@ class DeleteUserButton extends ConsumerWidget {
             }
           }
         },
-      ),
+        );
+      },
     );
   }
 }

package/templates/firebase/lib/i18n/en.i18n.json

@@ -502,7 +502,8 @@
         "delete_account": {
             "button": "I want to delete my account",
             "title": "Delete your account?",
-            "content": "Warning: this is permanent. You will lose any active subscription, and creating a new account later (even with the same email) will not restore it.",
+            "content": "Warning: this action is permanent and cannot be undone.",
+            "content_subscriber": "Warning: this is permanent. You will lose your active subscription, and creating a new account later (even with the same email) will not restore it.",
             "cancel": "Cancel",
             "confirm": "Yes, delete",
             "error": "Something went wrong. Please try again."

package/templates/firebase/lib/i18n/es.i18n.json

@@ -502,7 +502,8 @@
         "delete_account": {
             "button": "Quiero eliminar mi cuenta",
             "title": "¿Quieres eliminar tu cuenta?",
-            "content": "Advertencia: esta acción es permanente. Perderás cualquier suscripción activa, y crear una cuenta nueva más tarde (incluso con el mismo correo) no la recuperará.",
+            "content": "Advertencia: esta acción es permanente y no se puede deshacer.",
+            "content_subscriber": "Advertencia: esta acción es permanente. Perderás tu suscripción activa, y crear una cuenta nueva más tarde (incluso con el mismo correo) no la recuperará.",
             "cancel": "Cancelar",
             "confirm": "Sí, eliminar",
             "error": "Algo salió mal. Por favor, inténtalo de nuevo."

package/templates/firebase/lib/i18n/pt.i18n.json

@@ -502,7 +502,8 @@
         "delete_account": {
             "button": "Quero excluir minha conta",
             "title": "Quer excluir sua conta?",
-            "content": "Atenção: esta ação é permanente. Você perde qualquer assinatura ativa, e criar uma nova conta depois (mesmo com o mesmo e-mail) não recupera ela.",
+            "content": "Atenção: esta ação é permanente e não pode ser desfeita.",
+            "content_subscriber": "Atenção: esta ação é permanente. Você perde sua assinatura ativa, e criar uma nova conta depois (mesmo com o mesmo e-mail) não recupera ela.",
             "cancel": "Cancelar",
             "confirm": "Sim, excluir",
             "error": "Algo deu errado. Por favor, tente novamente."