notifkit 0.1.4 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "notifkit",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Self-hosted notification infrastructure. One call delivers to email, SMS, push, and webhook — routed by preference, quiet hours, and consent.",
   "license": "MIT",
   "author": "devkitshq",
@@ -48,12 +48,17 @@
     "dist",
     "src",
     "drizzle",
+    "scripts/create-project.mjs",
     "README.md",
     "LICENSE"
   ],
+  "bin": {
+    "notifkit-create-project": "./scripts/create-project.mjs"
+  },
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch",
+    "create-project": "node scripts/create-project.mjs",
     "test": "vitest run --coverage",
     "test:watch": "vitest",
     "lint": "eslint . --fix",

package/scripts/create-project.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+/**
+ * Create a project and print its API key.
+ *
+ * Every `/v1/*` route needs a project API key, and a project API key can only
+ * be minted with the admin credential, so this is the one bootstrap step
+ * between a running server and the first notification.
+ *
+ *   ADMIN_API_KEY=supersecretkey npm run create-project
+ *   ADMIN_API_KEY=supersecretkey npx notifkit-create-project "my-app"
+ *
+ * ADMIN_API_KEY is the same variable the server reads, so pass the value the
+ * server was started with.
+ */
+
+const adminKey = process.env.ADMIN_API_KEY;
+const baseUrl = (process.env.NOTIFKIT_URL || "http://localhost:3000").replace(/\/$/, "");
+const name = process.argv[2] || process.env.PROJECT_NAME || "my-app";
+
+function fail(message) {
+  console.error(`create-project: ${message}`);
+  process.exit(1);
+}
+
+if (!adminKey) {
+  fail(
+    "no admin credential. Set ADMIN_API_KEY to the same value the server was started with:\n" +
+      "  ADMIN_API_KEY=supersecretkey npm run create-project",
+  );
+}
+
+let res;
+try {
+  res = await fetch(`${baseUrl}/v1/projects`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${adminKey}` },
+    body: JSON.stringify({ name }),
+  });
+} catch (err) {
+  fail(`could not reach the server at ${baseUrl} — is it running? (${err.message})`);
+}
+
+if (res.status === 401) {
+  fail("admin credential rejected. It must match the server's ADMIN_API_KEY exactly.");
+}
+
+if (res.status === 403) {
+  fail("project management is disabled. Start the server with ADMIN_API_KEY set.");
+}
+
+if (!res.ok) {
+  fail(`server returned ${res.status}: ${await res.text()}`);
+}
+
+const { id, apiKey } = await res.json();
+
+// The server keeps only a hash of the key, so this is the only time the value
+// itself exists anywhere. Print it in .env form to make that the obvious move.
+console.log(`\nProject "${name}" created. Save the API key now — it is not recoverable.\n`);
+console.log(`NOTIFKIT_PROJECT_ID=${id}`);
+console.log(`NOTIFKIT_API_KEY=${apiKey}\n`);

package/src/config/index.ts

@@ -38,7 +38,11 @@ export const baseConfigSchema = z.object({
   HOST: z.string().default("127.0.0.1"),
   REDIS_URL: z.string().url().default("redis://localhost:6379"),
   DATABASE_URL: z.string().url().default("postgres://platform:platform@localhost:5432/notifkit"),
-  ADMIN_API_KEY: z.string().optional(),
+  // Trimmed because the incoming bearer token is trimmed before comparison, so
+  // an untrimmed value here could never match it. `set KEY=value && cmd` on
+  // Windows puts a trailing space in the variable, which otherwise turns every
+  // admin request into a 401 that reads like a wrong key.
+  ADMIN_API_KEY: z.string().trim().optional(),
   WORKER_CONCURRENCY: z.coerce.number().int().min(1).default(10),
   QUEUE_MAX_LEN: z.coerce.number().int().min(1).default(10000000),
   DB_MAX_CONNECTIONS: z.coerce.number().int().min(1).default(2),