diff --git a/.changeset/ecosystem-bump-july.md b/.changeset/ecosystem-bump-july.md new file mode 100644 index 0000000..da04b8e --- /dev/null +++ b/.changeset/ecosystem-bump-july.md @@ -0,0 +1,53 @@ +--- +"seamless-cli": minor +--- + +Move the scaffold onto the current Seamless ecosystem: auth API `v0.7.1`, admin dashboard `v0.4.0`, +and seamless-templates `v0.8.1` (which carries `@seamless-auth/react` `^0.8.0` in both React +starters, `@seamless-auth/express` `^0.12.0` in the Express starter, and `@seamless-auth/fastify` +`^0.3.1` in the Fastify starter). + +A scaffolded project can now finish registration without a passkey. Registration used to end on a +screen with a single control, leaving anyone who did not want a passkey, or whose device could not +make one, with no way forward. The starters offer a skip when the instance has another login method +enabled, and say so plainly when it does not. That reads from `GET /system-config/public`, a new +unauthenticated route on the auth server that returns the configured login methods, so the sign-in +screens can offer what an instance actually has enabled instead of a hardcoded guess. The API, the +adapters, and the web templates all had to move together for it to work, which is why this bumps +them as a set. + +Registration against a scaffolded Fastify API used to fail with a 500 and +`TypeError: option maxAge is invalid: 300`. The auth server sent the registration response's `ttl` +as the string `"300"`, and the Fastify adapter handed it to a cookie library that requires an +integer. The Express starter never showed this, because its adapter multiplies the value into +milliseconds and so coerced the string on the way past. It is fixed from both ends: +`@seamless-auth/core` `0.12.1` parses the lifetime before it reaches an adapter and rejects anything +that is not a positive whole number of seconds, and auth API `v0.7.1` sends the value as a number. + +`seamless init` now offers Fastify as a backend, listed as "Fastify (beta)" beside Express. It +serves the same surface as the Express starter on the same environment contract, including the +admin console at `/console` behind `SERVE_ADMIN_CONSOLE`. Two boot-time fixes land with it: an empty +`PORT=` in `.env` now falls back to 3000 rather than binding a random free port, and `pino-pretty` +moves to a runtime dependency so an install without dev dependencies boots. Both Express and Fastify +starters ship `.env.example` secret placeholders long enough to clear the adapter's 32 character +minimum, so the documented `cp .env.example .env && npm run dev` path boots. A project from +`seamless init` was already unaffected, because the CLI fills `COOKIE_SIGNING_KEY` itself. + +Both React starters gain a protected `/session` route that shows the issued claims, roles, +organization context, step-up freshness, and registered passkeys, so the first authenticated screen +reads as an app rather than a `JSON.stringify` dump. Missing configuration now stops a scaffolded +project with a message naming the variable instead of surfacing later as a 500, and the Express +starter reports every configuration problem at once. + +The auth API drops the admin bootstrap invite flow in favor of the `OWNER_EMAIL` grant the CLI +already writes, so the generated `.env` no longer carries `SEAMLESS_BOOTSTRAP_ENABLED`, +`SEAMLESS_BOOTSTRAP_SECRET`, or `SEAMLESS_AUTH_DEBUG_SECRETS`. `AVAILABLE_ROLES` now offers +`admin:read` and `admin:write` alongside bare `admin`, and assigning a role the instance does not +list is rejected rather than silently doing nothing. Postgres TLS is configurable through `DB_SSL`, +`DB_SSL_CA`, and `DB_SSL_REJECT_UNAUTHORIZED`, and `DB_URI` is accepted as a `DATABASE_URL` alias. + +The conformance harness adapter moves to `@seamless-auth/express` `^0.12.0`, which is also what +proxies the new public system-config route. The breaking change in `0.11.0` splits `error` into +`errorCode` and `errorBody` on the handler result types, which only affects code importing handlers +from `@seamless-auth/core` directly; the adapter uses `createSeamlessAuthServer`, so it needed no +source change. diff --git a/README.md b/README.md index a030e5e..ab4746d 100644 --- a/README.md +++ b/README.md @@ -134,6 +134,7 @@ ID KIND FRAMEWORK FLAGS STATUS react-vite web react --basic, --react-vite stable react-oauth web react --oauth, --react-oauth stable express api express --express stable +fastify api fastify --fastify beta ``` Every template answers to `--`; some also declare a shorter `--`, and the two are @@ -201,7 +202,7 @@ Depending on your selections, the CLI generates a project like this: my-app/ ├─ auth/ # Seamless Auth server (optional) ├─ web/ # React web application (optional) -├─ api/ # Express API server (optional) +├─ api/ # Express or Fastify API server (optional) ├─ docker-compose.yml (optional) └─ README.md ``` diff --git a/src/core/images.ts b/src/core/images.ts index c1abf6b..eac49e3 100644 --- a/src/core/images.ts +++ b/src/core/images.ts @@ -1,10 +1,10 @@ export const POSTGRES_IMAGE = "postgres:17"; -export const SEAMLESS_AUTH_API_VERSION = "v0.5.0"; +export const SEAMLESS_AUTH_API_VERSION = "v0.7.1"; export const SEAMLESS_AUTH_API_IMAGE = `ghcr.io/fells-code/seamless-auth-api:${SEAMLESS_AUTH_API_VERSION}`; -export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.3.0"; +export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.4.0"; export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-auth-admin-dashboard:${SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION}`; @@ -13,4 +13,4 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless- // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR. export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates"; -export const SEAMLESS_TEMPLATES_REF = "v0.5.0"; +export const SEAMLESS_TEMPLATES_REF = "v0.8.1"; diff --git a/verify/adapter-app/package.json b/verify/adapter-app/package.json index 425909d..ca26159 100644 --- a/verify/adapter-app/package.json +++ b/verify/adapter-app/package.json @@ -5,7 +5,7 @@ "type": "module", "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/express with a capture transport.", "dependencies": { - "@seamless-auth/express": "^0.9.0", + "@seamless-auth/express": "^0.12.1", "cookie-parser": "^1.4.6", "cors": "^2.8.5", "express": "^5.1.0"