obsidian docs

fix eslint vuln
WIP Kubernetes integration
2025-07-30 19:11:28 -05:00 · 2025-07-28 20:53:30 -05:00 · 2025-07-28 20:37:01 -05:00 · 2025-07-28 13:13:40 -05:00 · 2025-07-28 12:58:33 -05:00 · 2025-07-26 10:15:38 -05:00
53 changed files with 5761 additions and 2524 deletions
@@ -1,17 +0,0 @@
 # PostgreSQL
 POSTGRES_USER=kratos
 POSTGRES_PASSWORD=change_me_to_a_secure_password
 POSTGRES_DB=kratos
 # Kratos Secrets (generate with: openssl rand -base64 32)
 KRATOS_SECRETS_COOKIE=change_me_32_char_secret_key_here_1234
 KRATOS_SECRETS_CIPHER=change_me_32_char_cipher_key_here_123
 # Kratos Mode
 KRATOS_DEV_MODE=true
 # URLs
 KRATOS_PUBLIC_URL=http://localhost:4433
 KRATOS_ADMIN_URL=http://localhost:4434
 NEXT_PUBLIC_KRATOS_PUBLIC_URL=http://localhost:4433
 NEXT_PUBLIC_APP_URL=http://localhost:3000
@@ -1,19 +1,4 @@
 node_modules
 .turbo
 out
-
+.env.*
 # Environment files
 .env
 .env.local
 .env.*.local
 # Next.js
 .next
 *.tsbuildinfo
 # IDE
 .idea
 .vscode
 # OS
 .DS_Store
@@ -0,0 +1 @@
 auto-install-peers=true
@@ -1,661 +0,0 @@
                    GNU AFFERO GENERAL PUBLIC LICENSE
                       Version 3, 19 November 2007
 Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.
                            Preamble
  The GNU Affero General Public License is a free, copyleft license for
 software and other kinds of works, specifically designed to ensure
 cooperation with the community in the case of network server software.
  The licenses for most software and other practical works are designed
 to take away your freedom to share and change the works.  By contrast,
 our General Public Licenses are intended to guarantee your freedom to
 share and change all versions of a program--to make sure it remains free
 software for all its users.
  When we speak of free software, we are referring to freedom, not
 price.  Our General Public Licenses are designed to make sure that you
 have the freedom to distribute copies of free software (and charge for
 them if you wish), that you receive source code or can get it if you
 want it, that you can change the software or use pieces of it in new
 free programs, and that you know you can do these things.
  Developers that use our General Public Licenses protect your rights
 with two steps: (1) assert copyright on the software, and (2) offer
 you this License which gives you legal permission to copy, distribute
 and/or modify the software.
  A secondary benefit of defending all users' freedom is that
 improvements made in alternate versions of the program, if they
 receive widespread use, become available for other developers to
 incorporate.  Many developers of free software are heartened and
 encouraged by the resulting cooperation.  However, in the case of
 software used on network servers, this result may fail to come about.
 The GNU General Public License permits making a modified version and
 letting the public access it on a server without ever releasing its
 source code to the public.
  The GNU Affero General Public License is designed specifically to
 ensure that, in such cases, the modified source code becomes available
 to the community.  It requires the operator of a network server to
 provide the source code of the modified version running there to the
 users of that server.  Therefore, public use of a modified version, on
 a publicly accessible server, gives the public access to the source
 code of the modified version.
  An older license, called the Affero General Public License and
 published by Affero, was designed to accomplish similar goals.  This is
 a different license, not a version of the Affero GPL, but Affero has
 released a new version of the Affero GPL which permits relicensing under
 this license.
  The precise terms and conditions for copying, distribution and
 modification follow.
                       TERMS AND CONDITIONS
  0. Definitions.
  "This License" refers to version 3 of the GNU Affero General Public License.
  "Copyright" also means copyright-like laws that apply to other kinds of
 works, such as semiconductor masks.
  "The Program" refers to any copyrightable work licensed under this
 License.  Each licensee is addressed as "you".  "Licensees" and
 "recipients" may be individuals or organizations.
  To "modify" a work means to copy from or adapt all or part of the work
 in a fashion requiring copyright permission, other than the making of an
 exact copy.  The resulting work is called a "modified version" of the
 earlier work or a work "based on" the earlier work.
  A "covered work" means either the unmodified Program or a work based
 on the Program.
  To "propagate" a work means to do anything with it that, without
 permission, would make you directly or secondarily liable for
 infringement under applicable copyright law, except executing it on a
 computer or modifying a private copy.  Propagation includes copying,
 distribution (with or without modification), making available to the
 public, and in some countries other activities as well.
  To "convey" a work means any kind of propagation that enables other
 parties to make or receive copies.  Mere interaction with a user through
 a computer network, with no transfer of a copy, is not conveying.
  An interactive user interface displays "Appropriate Legal Notices"
 to the extent that it includes a convenient and prominently visible
 feature that (1) displays an appropriate copyright notice, and (2)
 tells the user that there is no warranty for the work (except to the
 extent that warranties are provided), that licensees may convey the
 work under this License, and how to view a copy of this License.  If
 the interface presents a list of user commands or options, such as a
 menu, a prominent item in the list meets this criterion.
  1. Source Code.
  The "source code" for a work means the preferred form of the work
 for making modifications to it.  "Object code" means any non-source
 form of a work.
  A "Standard Interface" means an interface that either is an official
 standard defined by a recognized standards body, or, in the case of
 interfaces specified for a particular programming language, one that
 is widely used among developers working in that language.
  The "System Libraries" of an executable work include anything, other
 than the work as a whole, that (a) is included in the normal form of
 packaging a Major Component, but which is not part of that Major
 Component, and (b) serves only to enable use of the work with that
 Major Component, or to implement a Standard Interface for which an
 implementation is available to the public in source code form.  A
 "Major Component", in this context, means a major essential component
 (kernel, window system, and so on) of the specific operating system
 (if any) on which the executable work runs, or a compiler used to
 produce the work, or an object code interpreter used to run it.
  The "Corresponding Source" for a work in object code form means all
 the source code needed to generate, install, and (for an executable
 work) run the object code and to modify the work, including scripts to
 control those activities.  However, it does not include the work's
 System Libraries, or general-purpose tools or generally available free
 programs which are used unmodified in performing those activities but
 which are not part of the work.  For example, Corresponding Source
 includes interface definition files associated with source files for
 the work, and the source code for shared libraries and dynamically
 linked subprograms that the work is specifically designed to require,
 such as by intimate data communication or control flow between those
 subprograms and other parts of the work.
  The Corresponding Source need not include anything that users
 can regenerate automatically from other parts of the Corresponding
 Source.
  The Corresponding Source for a work in source code form is that
 same work.
  2. Basic Permissions.
  All rights granted under this License are granted for the term of
 copyright on the Program, and are irrevocable provided the stated
 conditions are met.  This License explicitly affirms your unlimited
 permission to run the unmodified Program.  The output from running a
 covered work is covered by this License only if the output, given its
 content, constitutes a covered work.  This License acknowledges your
 rights of fair use or other equivalent, as provided by copyright law.
  You may make, run and propagate covered works that you do not
 convey, without conditions so long as your license otherwise remains
 in force.  You may convey covered works to others for the sole purpose
 of having them make modifications exclusively for you, or provide you
 with facilities for running those works, provided that you comply with
 the terms of this License in conveying all material for which you do
 not control copyright.  Those thus making or running the covered works
 for you must do so exclusively on your behalf, under your direction
 and control, on terms that prohibit them from making any copies of
 your copyrighted material outside their relationship with you.
  Conveying under any other circumstances is permitted solely under
 the conditions stated below.  Sublicensing is not allowed; section 10
 makes it unnecessary.
  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
  No covered work shall be deemed part of an effective technological
 measure under any applicable law fulfilling obligations under article
 11 of the WIPO copyright treaty adopted on 20 December 1996, or
 similar laws prohibiting or restricting circumvention of such
 measures.
  When you convey a covered work, you waive any legal power to forbid
 circumvention of technological measures to the extent such circumvention
 is effected by exercising rights under this License with respect to
 the covered work, and you disclaim any intention to limit operation or
 modification of the work as a means of enforcing, against the work's
 users, your or third parties' legal rights to forbid circumvention of
 technological measures.
  4. Conveying Verbatim Copies.
  You may convey verbatim copies of the Program's source code as you
 receive it, in any medium, provided that you conspicuously and
 appropriately publish on each copy an appropriate copyright notice;
 keep intact all notices stating that this License and any
 non-permissive terms added in accord with section 7 apply to the code;
 keep intact all notices of the absence of any warranty; and give all
 recipients a copy of this License along with the Program.
  You may charge any price or no price for each copy that you convey,
 and you may offer support or warranty protection for a fee.
  5. Conveying Modified Source Versions.
  You may convey a work based on the Program, or the modifications to
 produce it from the Program, in the form of source code under the
 terms of section 4, provided that you also meet all of these conditions:
    a) The work must carry prominent notices stating that you modified
    it, and giving a relevant date.
    b) The work must carry prominent notices stating that it is
    released under this License and any conditions added under section
    7.  This requirement modifies the requirement in section 4 to
    "keep intact all notices".
    c) You must license the entire work, as a whole, under this
    License to anyone who comes into possession of a copy.  This
    License will therefore apply, along with any applicable section 7
    additional terms, to the whole of the work, and all its parts,
    regardless of how they are packaged.  This License gives no
    permission to license the work in any other way, but it does not
    invalidate such permission if you have separately received it.
    d) If the work has interactive user interfaces, each must display
    Appropriate Legal Notices; however, if the Program has interactive
    interfaces that do not display Appropriate Legal Notices, your
    work need not make them do so.
  A compilation of a covered work with other separate and independent
 works, which are not by their nature extensions of the covered work,
 and which are not combined with it such as to form a larger program,
 in or on a volume of a storage or distribution medium, is called an
 "aggregate" if the compilation and its resulting copyright are not
 used to limit the access or legal rights of the compilation's users
 beyond what the individual works permit.  Inclusion of a covered work
 in an aggregate does not cause this License to apply to the other
 parts of the aggregate.
  6. Conveying Non-Source Forms.
  You may convey a covered work in object code form under the terms
 of sections 4 and 5, provided that you also convey the
 machine-readable Corresponding Source under the terms of this License,
 in one of these ways:
    a) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by the
    Corresponding Source fixed on a durable physical medium
    customarily used for software interchange.
    b) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by a
    written offer, valid for at least three years and valid for as
    long as you offer spare parts or customer support for that product
    model, to give anyone who possesses the object code either (1) a
    copy of the Corresponding Source for all the software in the
    product that is covered by this License, on a durable physical
    medium customarily used for software interchange, for a price no
    more than your reasonable cost of physically performing this
    conveying of source, or (2) access to copy the
    Corresponding Source from a network server at no charge.
    c) Convey individual copies of the object code with a copy of the
    written offer to provide the Corresponding Source.  This
    alternative is allowed only occasionally and noncommercially, and
    only if you received the object code with such an offer, in accord
    with subsection 6b.
    d) Convey the object code by offering access from a designated
    place (gratis or for a charge), and offer equivalent access to the
    Corresponding Source in the same way through the same place at no
    further charge.  You need not require recipients to copy the
    Corresponding Source along with the object code.  If the place to
    copy the object code is a network server, the Corresponding Source
    may be on a different server (operated by you or a third party)
    that supports equivalent copying facilities, provided you maintain
    clear directions next to the object code saying where to find the
    Corresponding Source.  Regardless of what server hosts the
    Corresponding Source, you remain obligated to ensure that it is
    available for as long as needed to satisfy these requirements.
    e) Convey the object code using peer-to-peer transmission, provided
    you inform other peers where the object code and Corresponding
    Source of the work are being offered to the general public at no
    charge under subsection 6d.
  A separable portion of the object code, whose source code is excluded
 from the Corresponding Source as a System Library, need not be
 included in conveying the object code work.
  A "User Product" is either (1) a "consumer product", which means any
 tangible personal property which is normally used for personal, family,
 or household purposes, or (2) anything designed or sold for incorporation
 into a dwelling.  In determining whether a product is a consumer product,
 doubtful cases shall be resolved in favor of coverage.  For a particular
 product received by a particular user, "normally used" refers to a
 typical or common use of that class of product, regardless of the status
 of the particular user or of the way in which the particular user
 actually uses, or expects or is expected to use, the product.  A product
 is a consumer product regardless of whether the product has substantial
 commercial, industrial or non-consumer uses, unless such uses represent
 the only significant mode of use of the product.
  "Installation Information" for a User Product means any methods,
 procedures, authorization keys, or other information required to install
 and execute modified versions of a covered work in that User Product from
 a modified version of its Corresponding Source.  The information must
 suffice to ensure that the continued functioning of the modified object
 code is in no case prevented or interfered with solely because
 modification has been made.
  If you convey an object code work under this section in, or with, or
 specifically for use in, a User Product, and the conveying occurs as
 part of a transaction in which the right of possession and use of the
 User Product is transferred to the recipient in perpetuity or for a
 fixed term (regardless of how the transaction is characterized), the
 Corresponding Source conveyed under this section must be accompanied
 by the Installation Information.  But this requirement does not apply
 if neither you nor any third party retains the ability to install
 modified object code on the User Product (for example, the work has
 been installed in ROM).
  The requirement to provide Installation Information does not include a
 requirement to continue to provide support service, warranty, or updates
 for a work that has been modified or installed by the recipient, or for
 the User Product in which it has been modified or installed.  Access to a
 network may be denied when the modification itself materially and
 adversely affects the operation of the network or violates the rules and
 protocols for communication across the network.
  Corresponding Source conveyed, and Installation Information provided,
 in accord with this section must be in a format that is publicly
 documented (and with an implementation available to the public in
 source code form), and must require no special password or key for
 unpacking, reading or copying.
  7. Additional Terms.
  "Additional permissions" are terms that supplement the terms of this
 License by making exceptions from one or more of its conditions.
 Additional permissions that are applicable to the entire Program shall
 be treated as though they were included in this License, to the extent
 that they are valid under applicable law.  If additional permissions
 apply only to part of the Program, that part may be used separately
 under those permissions, but the entire Program remains governed by
 this License without regard to the additional permissions.
  When you convey a copy of a covered work, you may at your option
 remove any additional permissions from that copy, or from any part of
 it.  (Additional permissions may be written to require their own
 removal in certain cases when you modify the work.)  You may place
 additional permissions on material, added by you to a covered work,
 for which you have or can give appropriate copyright permission.
  Notwithstanding any other provision of this License, for material you
 add to a covered work, you may (if authorized by the copyright holders of
 that material) supplement the terms of this License with terms:
    a) Disclaiming warranty or limiting liability differently from the
    terms of sections 15 and 16 of this License; or
    b) Requiring preservation of specified reasonable legal notices or
    author attributions in that material or in the Appropriate Legal
    Notices displayed by works containing it; or
    c) Prohibiting misrepresentation of the origin of that material, or
    requiring that modified versions of such material be marked in
    reasonable ways as different from the original version; or
    d) Limiting the use for publicity purposes of names of licensors or
    authors of the material; or
    e) Declining to grant rights under trademark law for use of some
    trade names, trademarks, or service marks; or
    f) Requiring indemnification of licensors and authors of that
    material by anyone who conveys the material (or modified versions of
    it) with contractual assumptions of liability to the recipient, for
    any liability that these contractual assumptions directly impose on
    those licensors and authors.
  All other non-permissive additional terms are considered "further
 restrictions" within the meaning of section 10.  If the Program as you
 received it, or any part of it, contains a notice stating that it is
 governed by this License along with a term that is a further
 restriction, you may remove that term.  If a license document contains
 a further restriction but permits relicensing or conveying under this
 License, you may add to a covered work material governed by the terms
 of that license document, provided that the further restriction does
 not survive such relicensing or conveying.
  If you add terms to a covered work in accord with this section, you
 must place, in the relevant source files, a statement of the
 additional terms that apply to those files, or a notice indicating
 where to find the applicable terms.
  Additional terms, permissive or non-permissive, may be stated in the
 form of a separately written license, or stated as exceptions;
 the above requirements apply either way.
  8. Termination.
  You may not propagate or modify a covered work except as expressly
 provided under this License.  Any attempt otherwise to propagate or
 modify it is void, and will automatically terminate your rights under
 this License (including any patent licenses granted under the third
 paragraph of section 11).
  However, if you cease all violation of this License, then your
 license from a particular copyright holder is reinstated (a)
 provisionally, unless and until the copyright holder explicitly and
 finally terminates your license, and (b) permanently, if the copyright
 holder fails to notify you of the violation by some reasonable means
 prior to 60 days after the cessation.
  Moreover, your license from a particular copyright holder is
 reinstated permanently if the copyright holder notifies you of the
 violation by some reasonable means, this is the first time you have
 received notice of violation of this License (for any work) from that
 copyright holder, and you cure the violation prior to 30 days after
 your receipt of the notice.
  Termination of your rights under this section does not terminate the
 licenses of parties who have received copies or rights from you under
 this License.  If your rights have been terminated and not permanently
 reinstated, you do not qualify to receive new licenses for the same
 material under section 10.
  9. Acceptance Not Required for Having Copies.
  You are not required to accept this License in order to receive or
 run a copy of the Program.  Ancillary propagation of a covered work
 occurring solely as a consequence of using peer-to-peer transmission
 to receive a copy likewise does not require acceptance.  However,
 nothing other than this License grants you permission to propagate or
 modify any covered work.  These actions infringe copyright if you do
 not accept this License.  Therefore, by modifying or propagating a
 covered work, you indicate your acceptance of this License to do so.
  10. Automatic Licensing of Downstream Recipients.
  Each time you convey a covered work, the recipient automatically
 receives a license from the original licensors, to run, modify and
 propagate that work, subject to this License.  You are not responsible
 for enforcing compliance by third parties with this License.
  An "entity transaction" is a transaction transferring control of an
 organization, or substantially all assets of one, or subdividing an
 organization, or merging organizations.  If propagation of a covered
 work results from an entity transaction, each party to that
 transaction who receives a copy of the work also receives whatever
 licenses to the work the party's predecessor in interest had or could
 give under the previous paragraph, plus a right to possession of the
 Corresponding Source of the work from the predecessor in interest, if
 the predecessor has it or can get it with reasonable efforts.
  You may not impose any further restrictions on the exercise of the
 rights granted or affirmed under this License.  For example, you may
 not impose a license fee, royalty, or other charge for exercise of
 rights granted under this License, and you may not initiate litigation
 (including a cross-claim or counterclaim in a lawsuit) alleging that
 any patent claim is infringed by making, using, selling, offering for
 sale, or importing the Program or any portion of it.
  11. Patents.
  A "contributor" is a copyright holder who authorizes use under this
 License of the Program or a work on which the Program is based.  The
 work thus licensed is called the contributor's "contributor version".
  A contributor's "essential patent claims" are all patent claims
 owned or controlled by the contributor, whether already acquired or
 hereafter acquired, that would be infringed by some manner, permitted
 by this License, of making, using, or selling its contributor version,
 but do not include claims that would be infringed only as a
 consequence of further modification of the contributor version.  For
 purposes of this definition, "control" includes the right to grant
 patent sublicenses in a manner consistent with the requirements of
 this License.
  Each contributor grants you a non-exclusive, worldwide, royalty-free
 patent license under the contributor's essential patent claims, to
 make, use, sell, offer for sale, import and otherwise run, modify and
 propagate the contents of its contributor version.
  In the following three paragraphs, a "patent license" is any express
 agreement or commitment, however denominated, not to enforce a patent
 (such as an express permission to practice a patent or covenant not to
 sue for patent infringement).  To "grant" such a patent license to a
 party means to make such an agreement or commitment not to enforce a
 patent against the party.
  If you convey a covered work, knowingly relying on a patent license,
 and the Corresponding Source of the work is not available for anyone
 to copy, free of charge and under the terms of this License, through a
 publicly available network server or other readily accessible means,
 then you must either (1) cause the Corresponding Source to be so
 available, or (2) arrange to deprive yourself of the benefit of the
 patent license for this particular work, or (3) arrange, in a manner
 consistent with the requirements of this License, to extend the patent
 license to downstream recipients.  "Knowingly relying" means you have
 actual knowledge that, but for the patent license, your conveying the
 covered work in a country, or your recipient's use of the covered work
 in a country, would infringe one or more identifiable patents in that
 country that you have reason to believe are valid.
  If, pursuant to or in connection with a single transaction or
 arrangement, you convey, or propagate by procuring conveyance of, a
 covered work, and grant a patent license to some of the parties
 receiving the covered work authorizing them to use, propagate, modify
 or convey a specific copy of the covered work, then the patent license
 you grant is automatically extended to all recipients of the covered
 work and works based on it.
  A patent license is "discriminatory" if it does not include within
 the scope of its coverage, prohibits the exercise of, or is
 conditioned on the non-exercise of one or more of the rights that are
 specifically granted under this License.  You may not convey a covered
 work if you are a party to an arrangement with a third party that is
 in the business of distributing software, under which you make payment
 to the third party based on the extent of your activity of conveying
 the work, and under which the third party grants, to any of the
 parties who would receive the covered work from you, a discriminatory
 patent license (a) in connection with copies of the covered work
 conveyed by you (or copies made from those copies), or (b) primarily
 for and in connection with specific products or compilations that
 contain the covered work, unless you entered into that arrangement,
 or that patent license was granted, prior to 28 March 2007.
  Nothing in this License shall be construed as excluding or limiting
 any implied license or other defenses to infringement that may
 otherwise be available to you under applicable patent law.
  12. No Surrender of Others' Freedom.
  If conditions are imposed on you (whether by court order, agreement or
 otherwise) that contradict the conditions of this License, they do not
 excuse you from the conditions of this License.  If you cannot convey a
 covered work so as to satisfy simultaneously your obligations under this
 License and any other pertinent obligations, then as a consequence you may
 not convey it at all.  For example, if you agree to terms that obligate you
 to collect a royalty for further conveying from those to whom you convey
 the Program, the only way you could satisfy both those terms and this
 License would be to refrain entirely from conveying the Program.
  13. Remote Network Interaction; Use with the GNU General Public License.
  Notwithstanding any other provision of this License, if you modify the
 Program, your modified version must prominently offer all users
 interacting with it remotely through a computer network (if your version
 supports such interaction) an opportunity to receive the Corresponding
 Source of your version by providing access to the Corresponding Source
 from a network server at no charge, through some standard or customary
 means of facilitating copying of software.  This Corresponding Source
 shall include the Corresponding Source for any work covered by version 3
 of the GNU General Public License that is incorporated pursuant to the
 following paragraph.
  Notwithstanding any other provision of this License, you have
 permission to link or combine any covered work with a work licensed
 under version 3 of the GNU General Public License into a single
 combined work, and to convey the resulting work.  The terms of this
 License will continue to apply to the part which is the covered work,
 but the work with which it is combined will remain governed by version
 3 of the GNU General Public License.
  14. Revised Versions of this License.
  The Free Software Foundation may publish revised and/or new versions of
 the GNU Affero General Public License from time to time.  Such new versions
 will be similar in spirit to the present version, but may differ in detail to
 address new problems or concerns.
  Each version is given a distinguishing version number.  If the
 Program specifies that a certain numbered version of the GNU Affero General
 Public License "or any later version" applies to it, you have the
 option of following the terms and conditions either of that numbered
 version or of any later version published by the Free Software
 Foundation.  If the Program does not specify a version number of the
 GNU Affero General Public License, you may choose any version ever published
 by the Free Software Foundation.
  If the Program specifies that a proxy can decide which future
 versions of the GNU Affero General Public License can be used, that proxy's
 public statement of acceptance of a version permanently authorizes you
 to choose that version for the Program.
  Later license versions may give you additional or different
 permissions.  However, no additional obligations are imposed on any
 author or copyright holder as a result of your choosing to follow a
 later version.
  15. Disclaimer of Warranty.
  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
 APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
 HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
 OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
 THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
 IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
 ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
  16. Limitation of Liability.
  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
 WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
 THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
 GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
 USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
 DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
 PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
 EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
 SUCH DAMAGES.
  17. Interpretation of Sections 15 and 16.
  If the disclaimer of warranty and limitation of liability provided
 above cannot be given local legal effect according to their terms,
 reviewing courts shall apply local law that most closely approximates
 an absolute waiver of all civil liability in connection with the
 Program, unless a warranty or assumption of liability accompanies a
 copy of the Program in return for a fee.
                     END OF TERMS AND CONDITIONS
            How to Apply These Terms to Your New Programs
  If you develop a new program, and you want it to be of the greatest
 possible use to the public, the best way to achieve this is to make it
 free software which everyone can redistribute and change under these terms.
  To do so, attach the following notices to the program.  It is safest
 to attach them to the start of each source file to most effectively
 state the exclusion of warranty; and each file should have at least
 the "copyright" line and a pointer to where the full notice is found.
    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Affero General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Affero General Public License for more details.
    You should have received a copy of the GNU Affero General Public License
    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 Also add information on how to contact you by electronic and paper mail.
  If your software can interact with users remotely through a computer
 network, you should also make sure that it provides a way for users to
 get its source.  For example, if your program is a web application, its
 interface could display a "Source" link that leads users to an archive
 of the code.  There are many ways you could offer source, and different
 solutions will be better for different programs; see section 13 for
 the specific requirements.
  You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU AGPL, see
 <https://www.gnu.org/licenses/>.
@@ -2,116 +2,24 @@
 ## Technologies Used
- **Next.js 15**: React 19-based framework for building server-side rendered web applications
+- **Next.js**: React-based framework for building server-side rendered and statically generated web applications.
- **GraphQL**: API query language for flexible and efficient data fetching
+- **GraphQL**: API query language for flexible and efficient data fetching.
- **Express.js**: Fast, unopinionated web framework for Node.js, powering the backend API
+- **Express.js**: Fast, unopinionated web framework for Node.js, powering the backend API.
- **Ory Kratos**: Open-source identity and user management system for authentication
+- **PostgreSQL**: Relational database for persistent storage.
- **PostgreSQL 18**: Relational database for persistent storage
+- **Docker**: Containerization for consistent deployment.
- **Podman Compose**: Container orchestration for local development and deployment
+- **Terraform CDKTF**: Infrastructure as Code (IaC) using the Cloud Development Kit for Terraform.
- **Turborepo**: Monorepo build system for managing multiple packages
+- **RabbitMQ**: Message broker for asynchronous communication and background processing.
 - **OpenTofu**: FOSS fork of Terraform
 - **RabbitMQ**: Message broker for asynchronous communication and background processing
-## Project Structure
+## Docker Commands
-```text
+To build the Docker image:
 lightsaver/
 ├── apps/
 │   └── lightsaver_user_client/    # Next.js frontend
 ├── services/                       # GraphQL API backend
 ├── infrastructure/
 │   └── kratos/                    # Ory Kratos configuration
 ├── podman-compose.yaml            # Container orchestration
 └── .env.example                   # Environment variables template
 ```
 ## Getting Started
 ### Prerequisites
 - Node.js 22+
 - pnpm
 - Podman and Podman Compose
 ### Setup
 1. Clone the repository and install dependencies:
   ```sh
   pnpm install
   ```
 1. Copy the environment file and configure it:
   ```sh
   cp .env.example .env
   # Edit .env and set secure values for:
   # - POSTGRES_PASSWORD
   # - KRATOS_SECRETS_COOKIE
   # - KRATOS_SECRETS_CIPHER
   ```
 1. Start all services with Podman Compose:
 ```sh
-podman-compose up
+docker build -t lightsaver-app .
 ```
-### Services
+To run the container:
 | Service | URL | Description |
 |---------|-----|-------------|
 | Frontend | http://localhost:3000 | Next.js user interface |
 | GraphQL API | http://localhost:4000/graphql | Express + Apollo Server |
 | Kratos Public | http://localhost:4433 | Authentication API |
 | Kratos Admin | http://localhost:4434 | Kratos admin API |
 | Mailhog | http://localhost:8025 | Dev email testing UI |
 ### Authentication
 The app uses Ory Kratos for authentication with the following flows:
 - **Registration**: `/auth/registration` - Create a new account
 - **Login**: `/auth/login` - Sign in to your account
 - **Recovery**: `/auth/recovery` - Reset forgotten password
 - **Verification**: `/auth/verification` - Verify email address
 - **Settings**: `/auth/settings` - Update account settings
 - **Dashboard**: `/dashboard` - Protected user dashboard
 ### Development
 Run individual services locally:
 ```sh
-# Frontend (Next.js)
+docker run -p 3000:3000 lightsaver-app
 pnpm --filter lightsaver_user_client dev
 # Backend (GraphQL API)
 pnpm --filter api dev
 ```
 ## Docker/Podman Commands
 Build and run all services:
 ```sh
 podman-compose up --build
 ```
 Run in detached mode:
 ```sh
 podman-compose up -d
 ```
 Stop all services:
 ```sh
 podman-compose down
 ```
 View logs:
 ```sh
 podman-compose logs -f
 ```
@@ -1,18 +1,7 @@
 import type { NextConfig } from "next";
 const nextConfig: NextConfig = {
-  output: "standalone",
+  /* config options here */
  async rewrites() {
    const kratosUrl =
      process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
    return [
      {
        source: "/api/kratos/:path*",
        destination: `${kratosUrl}/:path*`,
      },
    ];
  },
 };
 export default nextConfig;
@@ -10,7 +10,6 @@
  },
  "dependencies": {
    "@apollo/client": "^3.13.8",
    "@ory/client": "^1.15.0",
    "graphql": "^16.11.0",
    "next": "15.3.5",
    "react": "^19.0.0",
@@ -18,6 +17,7 @@
  },
  "devDependencies": {
    "@eslint/eslintrc": "^3",
    "@eslint/plugin-kit": "^0.3.4",
    "@tailwindcss/postcss": "^4",
    "@types/node": "^20",
    "@types/react": "^19",
@@ -1,89 +0,0 @@
 "use client";
 import { useEffect, useState } from "react";
 import { useSearchParams } from "next/navigation";
 import { FlowError } from "@ory/client";
 import { kratosClient } from "@/lib/kratos/client";
 import Link from "next/link";
 export default function ErrorPage() {
  const [error, setError] = useState<FlowError | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  const searchParams = useSearchParams();
  const errorId = searchParams.get("id");
  useEffect(() => {
    if (!errorId) {
      setIsLoading(false);
      return;
    }
    kratosClient
      .getFlowError({ id: errorId })
      .then(({ data }) => {
        setError(data);
      })
      .catch((err) => {
        console.error("Failed to fetch error:", err);
      })
      .finally(() => {
        setIsLoading(false);
      });
  }, [errorId]);
  if (isLoading) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Loading...
      </div>
    );
  }
  return (
    <div className="min-h-screen flex items-center justify-center bg-gray-50">
      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
        <h1 className="text-2xl font-bold text-center text-red-600">
          An Error Occurred
        </h1>
        {error ? (
          <div className="space-y-4">
            <div className="p-4 bg-red-50 border border-red-200 rounded-md">
              <p className="text-sm text-red-700">
                {typeof error.error === "object" && error.error !== null
                  ? JSON.stringify(error.error, null, 2)
                  : String(error.error)}
              </p>
            </div>
            {errorId && (
              <p className="text-xs text-gray-500 text-center">
                Error ID: {errorId}
              </p>
            )}
          </div>
        ) : (
          <p className="text-center text-gray-600">
            An unknown error occurred. Please try again.
          </p>
        )}
        <div className="flex flex-col gap-2">
          <Link
            href="/auth/login"
            className="w-full py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700 text-center"
          >
            Go to Login
          </Link>
          <Link
            href="/"
            className="w-full py-2 px-4 border border-gray-300 text-gray-700 rounded-md hover:bg-gray-50 text-center"
          >
            Go to Home
          </Link>
        </div>
      </div>
    </div>
  );
 }
@@ -1,112 +0,0 @@
 "use client";
 import { useEffect, useState, useCallback } from "react";
 import { useRouter, useSearchParams } from "next/navigation";
 import { LoginFlow, UpdateLoginFlowBody } from "@ory/client";
 import { kratosClient } from "@/lib/kratos/client";
 import { AuthForm } from "@/components/auth/AuthForm";
 import Link from "next/link";
 export default function LoginPage() {
  const [flow, setFlow] = useState<LoginFlow | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  const router = useRouter();
  const searchParams = useSearchParams();
  const flowId = searchParams.get("flow");
  const returnTo = searchParams.get("return_to");
  const initializeFlow = useCallback(async () => {
    try {
      if (flowId) {
        const { data } = await kratosClient.getLoginFlow({ id: flowId });
        setFlow(data);
      } else {
        const { data } = await kratosClient.createBrowserLoginFlow({
          returnTo: returnTo || undefined,
        });
        window.history.replaceState(null, "", `?flow=${data.id}`);
        setFlow(data);
      }
    } catch (error: unknown) {
      const err = error as { response?: { status?: number } };
      if (err.response?.status === 410) {
        window.location.href = "/auth/login";
        return;
      }
      console.error("Failed to initialize login flow:", error);
    } finally {
      setIsLoading(false);
    }
  }, [flowId, returnTo]);
  useEffect(() => {
    initializeFlow();
  }, [initializeFlow]);
  const handleSubmit = async (values: Record<string, unknown>) => {
    if (!flow) return;
    try {
      await kratosClient.updateLoginFlow({
        flow: flow.id,
        updateLoginFlowBody: values as UpdateLoginFlowBody,
      });
      router.push(returnTo || "/dashboard");
    } catch (error: unknown) {
      const err = error as { response?: { status?: number; data?: LoginFlow } };
      if (err.response?.status === 400 && err.response.data) {
        setFlow(err.response.data);
      } else if (err.response?.status === 410) {
        window.location.href = "/auth/login";
      } else {
        console.error("Login error:", error);
      }
    }
  };
  if (isLoading) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Loading...
      </div>
    );
  }
  if (!flow) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Error loading login flow
      </div>
    );
  }
  return (
    <div className="min-h-screen flex items-center justify-center bg-gray-50">
      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
        <h1 className="text-2xl font-bold text-center">Sign In</h1>
        <AuthForm flow={flow} onSubmit={handleSubmit} submitLabel="Sign In" />
        <div className="text-center text-sm text-gray-600 space-y-2">
          <p>
            Don&apos;t have an account?{" "}
            <Link
              href="/auth/registration"
              className="text-blue-600 hover:underline"
            >
              Sign up
            </Link>
          </p>
          <p>
            <Link
              href="/auth/recovery"
              className="text-blue-600 hover:underline"
            >
              Forgot your password?
            </Link>
          </p>
        </div>
      </div>
    </div>
  );
 }
@@ -1,21 +0,0 @@
 import { NextRequest, NextResponse } from "next/server";
 import { kratosClient } from "@/lib/kratos/client";
 export async function GET(request: NextRequest) {
  const cookie = request.headers.get("cookie") || "";
  try {
    const { data } = await kratosClient.createBrowserLogoutFlow({
      cookie,
    });
    return NextResponse.redirect(data.logout_url);
  } catch (error) {
    console.error("Logout error:", error);
    return NextResponse.redirect(new URL("/", request.url));
  }
 }
 export async function POST(request: NextRequest) {
  return GET(request);
 }
@@ -1,128 +0,0 @@
 "use client";
 import { useEffect, useState, useCallback } from "react";
 import { useSearchParams } from "next/navigation";
 import { RecoveryFlow, UpdateRecoveryFlowBody } from "@ory/client";
 import { kratosClient } from "@/lib/kratos/client";
 import { AuthForm } from "@/components/auth/AuthForm";
 import Link from "next/link";
 export default function RecoveryPage() {
  const [flow, setFlow] = useState<RecoveryFlow | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  const [success, setSuccess] = useState(false);
  const searchParams = useSearchParams();
  const flowId = searchParams.get("flow");
  const initializeFlow = useCallback(async () => {
    try {
      if (flowId) {
        const { data } = await kratosClient.getRecoveryFlow({ id: flowId });
        setFlow(data);
      } else {
        const { data } = await kratosClient.createBrowserRecoveryFlow();
        window.history.replaceState(null, "", `?flow=${data.id}`);
        setFlow(data);
      }
    } catch (error: unknown) {
      const err = error as { response?: { status?: number } };
      if (err.response?.status === 410) {
        window.location.href = "/auth/recovery";
        return;
      }
      console.error("Failed to initialize recovery flow:", error);
    } finally {
      setIsLoading(false);
    }
  }, [flowId]);
  useEffect(() => {
    initializeFlow();
  }, [initializeFlow]);
  const handleSubmit = async (values: Record<string, unknown>) => {
    if (!flow) return;
    try {
      const { data } = await kratosClient.updateRecoveryFlow({
        flow: flow.id,
        updateRecoveryFlowBody: values as UpdateRecoveryFlowBody,
      });
      setFlow(data);
      if (data.state === "passed_challenge") {
        setSuccess(true);
      }
    } catch (error: unknown) {
      const err = error as {
        response?: { status?: number; data?: RecoveryFlow };
      };
      if (err.response?.status === 400 && err.response.data) {
        setFlow(err.response.data);
      } else if (err.response?.status === 410) {
        window.location.href = "/auth/recovery";
      } else {
        console.error("Recovery error:", error);
      }
    }
  };
  if (isLoading) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Loading...
      </div>
    );
  }
  if (!flow) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Error loading recovery flow
      </div>
    );
  }
  if (success) {
    return (
      <div className="min-h-screen flex items-center justify-center bg-gray-50">
        <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md text-center">
          <h1 className="text-2xl font-bold">Recovery Successful</h1>
          <p className="text-gray-600">
            You can now set a new password in your account settings.
          </p>
          <Link
            href="/auth/settings"
            className="inline-block py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700"
          >
            Go to Settings
          </Link>
        </div>
      </div>
    );
  }
  return (
    <div className="min-h-screen flex items-center justify-center bg-gray-50">
      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
        <h1 className="text-2xl font-bold text-center">Recover Your Account</h1>
        <p className="text-center text-gray-600">
          Enter your email address and we&apos;ll send you a recovery code.
        </p>
        <AuthForm
          flow={flow}
          onSubmit={handleSubmit}
          submitLabel="Send Recovery Code"
        />
        <p className="text-center text-sm text-gray-600">
          Remember your password?{" "}
          <Link href="/auth/login" className="text-blue-600 hover:underline">
            Sign in
          </Link>
        </p>
      </div>
    </div>
  );
 }
@@ -1,105 +0,0 @@
 "use client";
 import { useEffect, useState, useCallback } from "react";
 import { useRouter, useSearchParams } from "next/navigation";
 import { RegistrationFlow, UpdateRegistrationFlowBody } from "@ory/client";
 import { kratosClient } from "@/lib/kratos/client";
 import { AuthForm } from "@/components/auth/AuthForm";
 import Link from "next/link";
 export default function RegistrationPage() {
  const [flow, setFlow] = useState<RegistrationFlow | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  const router = useRouter();
  const searchParams = useSearchParams();
  const flowId = searchParams.get("flow");
  const returnTo = searchParams.get("return_to");
  const initializeFlow = useCallback(async () => {
    try {
      if (flowId) {
        const { data } = await kratosClient.getRegistrationFlow({ id: flowId });
        setFlow(data);
      } else {
        const { data } = await kratosClient.createBrowserRegistrationFlow({
          returnTo: returnTo || undefined,
        });
        window.history.replaceState(null, "", `?flow=${data.id}`);
        setFlow(data);
      }
    } catch (error: unknown) {
      const err = error as { response?: { status?: number } };
      if (err.response?.status === 410) {
        window.location.href = "/auth/registration";
        return;
      }
      console.error("Failed to initialize registration flow:", error);
    } finally {
      setIsLoading(false);
    }
  }, [flowId, returnTo]);
  useEffect(() => {
    initializeFlow();
  }, [initializeFlow]);
  const handleSubmit = async (values: Record<string, unknown>) => {
    if (!flow) return;
    try {
      await kratosClient.updateRegistrationFlow({
        flow: flow.id,
        updateRegistrationFlowBody: values as UpdateRegistrationFlowBody,
      });
      router.push(returnTo || "/dashboard");
    } catch (error: unknown) {
      const err = error as {
        response?: { status?: number; data?: RegistrationFlow };
      };
      if (err.response?.status === 400 && err.response.data) {
        setFlow(err.response.data);
      } else if (err.response?.status === 410) {
        window.location.href = "/auth/registration";
      } else {
        console.error("Registration error:", error);
      }
    }
  };
  if (isLoading) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Loading...
      </div>
    );
  }
  if (!flow) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Error loading registration flow
      </div>
    );
  }
  return (
    <div className="min-h-screen flex items-center justify-center bg-gray-50">
      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
        <h1 className="text-2xl font-bold text-center">Create Account</h1>
        <AuthForm
          flow={flow}
          onSubmit={handleSubmit}
          submitLabel="Create Account"
        />
        <p className="text-center text-sm text-gray-600">
          Already have an account?{" "}
          <Link href="/auth/login" className="text-blue-600 hover:underline">
            Sign in
          </Link>
        </p>
      </div>
    </div>
  );
 }
@@ -1,118 +0,0 @@
 "use client";
 import { useEffect, useState, useCallback } from "react";
 import { useSearchParams } from "next/navigation";
 import { SettingsFlow, UpdateSettingsFlowBody } from "@ory/client";
 import { kratosClient } from "@/lib/kratos/client";
 import { AuthForm } from "@/components/auth/AuthForm";
 import Link from "next/link";
 export default function SettingsPage() {
  const [flow, setFlow] = useState<SettingsFlow | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  const [success, setSuccess] = useState(false);
  const searchParams = useSearchParams();
  const flowId = searchParams.get("flow");
  const initializeFlow = useCallback(async () => {
    try {
      if (flowId) {
        const { data } = await kratosClient.getSettingsFlow({ id: flowId });
        setFlow(data);
      } else {
        const { data } = await kratosClient.createBrowserSettingsFlow();
        window.history.replaceState(null, "", `?flow=${data.id}`);
        setFlow(data);
      }
    } catch (error: unknown) {
      const err = error as { response?: { status?: number } };
      if (err.response?.status === 410) {
        window.location.href = "/auth/settings";
        return;
      }
      if (err.response?.status === 401) {
        window.location.href = "/auth/login?return_to=/auth/settings";
        return;
      }
      console.error("Failed to initialize settings flow:", error);
    } finally {
      setIsLoading(false);
    }
  }, [flowId]);
  useEffect(() => {
    initializeFlow();
  }, [initializeFlow]);
  const handleSubmit = async (values: Record<string, unknown>) => {
    if (!flow) return;
    try {
      const { data } = await kratosClient.updateSettingsFlow({
        flow: flow.id,
        updateSettingsFlowBody: values as UpdateSettingsFlowBody,
      });
      setFlow(data);
      setSuccess(true);
      setTimeout(() => setSuccess(false), 3000);
    } catch (error: unknown) {
      const err = error as {
        response?: { status?: number; data?: SettingsFlow };
      };
      if (err.response?.status === 400 && err.response.data) {
        setFlow(err.response.data);
      } else if (err.response?.status === 410) {
        window.location.href = "/auth/settings";
      } else if (err.response?.status === 401) {
        window.location.href = "/auth/login?return_to=/auth/settings";
      } else {
        console.error("Settings error:", error);
      }
    }
  };
  if (isLoading) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Loading...
      </div>
    );
  }
  if (!flow) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Error loading settings flow
      </div>
    );
  }
  return (
    <div className="min-h-screen flex items-center justify-center bg-gray-50">
      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
        <h1 className="text-2xl font-bold text-center">Account Settings</h1>
        {success && (
          <div className="p-3 bg-green-50 text-green-700 border border-green-200 rounded-md text-sm">
            Settings updated successfully!
          </div>
        )}
        <AuthForm
          flow={flow}
          onSubmit={handleSubmit}
          submitLabel="Update Settings"
        />
        <p className="text-center text-sm text-gray-600">
          <Link href="/dashboard" className="text-blue-600 hover:underline">
            Back to Dashboard
          </Link>
        </p>
      </div>
    </div>
  );
 }
@@ -1,130 +0,0 @@
 "use client";
 import { useEffect, useState, useCallback } from "react";
 import { useSearchParams } from "next/navigation";
 import { VerificationFlow, UpdateVerificationFlowBody } from "@ory/client";
 import { kratosClient } from "@/lib/kratos/client";
 import { AuthForm } from "@/components/auth/AuthForm";
 import Link from "next/link";
 export default function VerificationPage() {
  const [flow, setFlow] = useState<VerificationFlow | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  const [success, setSuccess] = useState(false);
  const searchParams = useSearchParams();
  const flowId = searchParams.get("flow");
  const initializeFlow = useCallback(async () => {
    try {
      if (flowId) {
        const { data } = await kratosClient.getVerificationFlow({ id: flowId });
        setFlow(data);
        if (data.state === "passed_challenge") {
          setSuccess(true);
        }
      } else {
        const { data } = await kratosClient.createBrowserVerificationFlow();
        window.history.replaceState(null, "", `?flow=${data.id}`);
        setFlow(data);
      }
    } catch (error: unknown) {
      const err = error as { response?: { status?: number } };
      if (err.response?.status === 410) {
        window.location.href = "/auth/verification";
        return;
      }
      console.error("Failed to initialize verification flow:", error);
    } finally {
      setIsLoading(false);
    }
  }, [flowId]);
  useEffect(() => {
    initializeFlow();
  }, [initializeFlow]);
  const handleSubmit = async (values: Record<string, unknown>) => {
    if (!flow) return;
    try {
      const { data } = await kratosClient.updateVerificationFlow({
        flow: flow.id,
        updateVerificationFlowBody: values as UpdateVerificationFlowBody,
      });
      setFlow(data);
      if (data.state === "passed_challenge") {
        setSuccess(true);
      }
    } catch (error: unknown) {
      const err = error as {
        response?: { status?: number; data?: VerificationFlow };
      };
      if (err.response?.status === 400 && err.response.data) {
        setFlow(err.response.data);
      } else if (err.response?.status === 410) {
        window.location.href = "/auth/verification";
      } else {
        console.error("Verification error:", error);
      }
    }
  };
  if (isLoading) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Loading...
      </div>
    );
  }
  if (!flow) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Error loading verification flow
      </div>
    );
  }
  if (success) {
    return (
      <div className="min-h-screen flex items-center justify-center bg-gray-50">
        <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md text-center">
          <h1 className="text-2xl font-bold text-green-600">Email Verified!</h1>
          <p className="text-gray-600">
            Your email address has been successfully verified.
          </p>
          <Link
            href="/dashboard"
            className="inline-block py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700"
          >
            Go to Dashboard
          </Link>
        </div>
      </div>
    );
  }
  return (
    <div className="min-h-screen flex items-center justify-center bg-gray-50">
      <div className="w-full max-w-md p-8 space-y-6 bg-white rounded-lg shadow-md">
        <h1 className="text-2xl font-bold text-center">Verify Your Email</h1>
        <p className="text-center text-gray-600">
          Enter the verification code sent to your email address.
        </p>
        <AuthForm flow={flow} onSubmit={handleSubmit} submitLabel="Verify" />
        <p className="text-center text-sm text-gray-600">
          <Link
            href="/dashboard"
            className="text-blue-600 hover:underline"
          >
            Skip for now
          </Link>
        </p>
      </div>
    </div>
  );
 }
@@ -1,113 +0,0 @@
 "use client";
 import { useSession } from "@/lib/hooks/useSession";
 import Link from "next/link";
 export default function DashboardPage() {
  const { session, identity, isLoading, isAuthenticated } = useSession();
  if (isLoading) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        Loading...
      </div>
    );
  }
  if (!isAuthenticated || !identity) {
    return (
      <div className="flex justify-center items-center min-h-screen">
        <div className="text-center">
          <p className="mb-4">You need to be logged in to view this page.</p>
          <Link
            href="/auth/login"
            className="text-blue-600 hover:underline"
          >
            Go to Login
          </Link>
        </div>
      </div>
    );
  }
  const traits = identity.traits as {
    email?: string;
    name?: { first?: string; last?: string };
  };
  return (
    <div className="min-h-screen bg-gray-50">
      <header className="bg-white shadow">
        <div className="max-w-7xl mx-auto px-4 py-6 sm:px-6 lg:px-8 flex justify-between items-center">
          <h1 className="text-3xl font-bold text-gray-900">Dashboard</h1>
          <div className="flex items-center gap-4">
            <Link
              href="/auth/settings"
              className="text-gray-600 hover:text-gray-900"
            >
              Settings
            </Link>
            <Link
              href="/auth/logout"
              className="py-2 px-4 bg-gray-200 text-gray-700 rounded-md hover:bg-gray-300"
            >
              Logout
            </Link>
          </div>
        </div>
      </header>
      <main className="max-w-7xl mx-auto px-4 py-6 sm:px-6 lg:px-8">
        <div className="bg-white rounded-lg shadow p-6">
          <h2 className="text-xl font-semibold mb-4">
            Welcome, {traits.name?.first || "User"}!
          </h2>
          <div className="space-y-4">
            <div>
              <h3 className="text-sm font-medium text-gray-500">Email</h3>
              <p className="text-gray-900">{traits.email}</p>
            </div>
            <div>
              <h3 className="text-sm font-medium text-gray-500">Full Name</h3>
              <p className="text-gray-900">
                {traits.name?.first} {traits.name?.last}
              </p>
            </div>
            <div>
              <h3 className="text-sm font-medium text-gray-500">User ID</h3>
              <p className="text-gray-900 font-mono text-sm">{identity.id}</p>
            </div>
            <div>
              <h3 className="text-sm font-medium text-gray-500">
                Session Expires
              </h3>
              <p className="text-gray-900">
                {session?.expires_at
                  ? new Date(session.expires_at).toLocaleString()
                  : "N/A"}
              </p>
            </div>
            {!identity.verifiable_addresses?.[0]?.verified && (
              <div className="p-4 bg-yellow-50 border border-yellow-200 rounded-md">
                <p className="text-yellow-700 text-sm">
                  Your email is not verified.{" "}
                  <Link
                    href="/auth/verification"
                    className="font-medium underline"
                  >
                    Verify now
                  </Link>
                </p>
              </div>
            )}
          </div>
        </div>
      </main>
    </div>
  );
 }
@@ -0,0 +1,22 @@
 .heading {
  font-size: 24px;
  color: white;
  margin-bottom: 20px;
 }
 .loginInput {
  margin-bottom: 12px;
  border: white 1px solid;
 }
 .submitButton {
  background-color: #4CAF50; /* Green */
  border: none;
  color: white;
  padding: 10px 20px;
  text-align: center;
  text-decoration: none;
  display: inline-block;
  font-size: 16px;
  margin: 4px 2px;
  cursor: pointer;
 }
@@ -0,0 +1,38 @@
 "use client";
 import styles from "./login.module.css";
 import { useState } from "react";
 export default function LoginPage() {
  const [username, setUsername] = useState("");
  const [password, setPassword] = useState("");
  function handleSubmit(e: React.MouseEvent<HTMLButtonElement>) {
      e.preventDefault();
  };
  return (
    <div>
      <h1 className={styles.heading}>Login</h1>
      <form>
        <label>
          Username:
          <input className={styles.loginInput} type="text" name="username" value={username} onChange={(e) => setUsername(e.target.value)} />
        </label>
        <br />
        <label>
          Password:
          <input
            className={styles.loginInput}
            type="password"
                      name="password"
            value={password}
            onChange={(e) => setPassword(e.target.value)}
          />
        </label>
        <br />
        <button className={styles.submitButton} type="submit" onClick={handleSubmit}>Submit</button>
      </form>
    </div>
  );
 }
@@ -1,146 +0,0 @@
 "use client";
 import { UiNode, UiNodeInputAttributes, UiText } from "@ory/client";
 import { useState } from "react";
 interface FlowUI {
  nodes: UiNode[];
  action: string;
  method: string;
  messages?: UiText[];
 }
 interface AuthFormProps {
  flow: { ui: FlowUI };
  onSubmit: (values: Record<string, unknown>) => Promise<void>;
  submitLabel: string;
 }
 function getInputType(attrs: UiNodeInputAttributes): string {
  if (attrs.type === "hidden") return "hidden";
  if (attrs.type === "submit") return "submit";
  if (attrs.type === "email") return "email";
  if (attrs.type === "password") return "password";
  return attrs.type || "text";
 }
 export function AuthForm({ flow, onSubmit, submitLabel }: AuthFormProps) {
  const [isSubmitting, setIsSubmitting] = useState(false);
  const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
    e.preventDefault();
    setIsSubmitting(true);
    const formData = new FormData(e.currentTarget);
    const values: Record<string, unknown> = {};
    formData.forEach((value, key) => {
      values[key] = value;
    });
    try {
      await onSubmit(values);
    } finally {
      setIsSubmitting(false);
    }
  };
  const renderNode = (node: UiNode, index: number) => {
    if (node.type !== "input") return null;
    const attrs = node.attributes as UiNodeInputAttributes;
    const inputType = getInputType(attrs);
    if (inputType === "hidden") {
      return (
        <input
          key={index}
          type="hidden"
          name={attrs.name}
          value={(attrs.value as string) ?? ""}
        />
      );
    }
    if (inputType === "submit") {
      return (
        <button
          key={index}
          type="submit"
          name={attrs.name}
          value={(attrs.value as string) ?? ""}
          disabled={isSubmitting || attrs.disabled}
          className="w-full py-2 px-4 bg-blue-600 text-white rounded-md hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
        >
          {isSubmitting ? "Loading..." : submitLabel}
        </button>
      );
    }
    const hasError = node.messages?.some((m) => m.type === "error");
    return (
      <div key={index} className="space-y-1">
        <label htmlFor={attrs.name} className="block text-sm font-medium">
          {node.meta.label?.text || attrs.name}
        </label>
        <input
          id={attrs.name}
          type={inputType}
          name={attrs.name}
          defaultValue={(attrs.value as string) ?? ""}
          required={attrs.required}
          disabled={attrs.disabled || isSubmitting}
          autoComplete={attrs.autocomplete}
          className={`w-full px-3 py-2 border rounded-md focus:outline-none focus:ring-2 disabled:opacity-50 ${
            hasError
              ? "border-red-500 focus:ring-red-500"
              : "border-gray-300 focus:ring-blue-500"
          }`}
        />
        {node.messages?.map((message, msgIndex) => (
          <p
            key={msgIndex}
            className={`text-sm ${
              message.type === "error" ? "text-red-600" : "text-gray-600"
            }`}
          >
            {message.text}
          </p>
        ))}
      </div>
    );
  };
  const inputNodes = flow.ui.nodes.filter(
    (node) =>
      node.type === "input" &&
      (node.group === "default" || node.group === "password")
  );
  const submitNodes = flow.ui.nodes.filter(
    (node) =>
      node.type === "input" &&
      (node.attributes as UiNodeInputAttributes).type === "submit"
  );
  return (
    <form onSubmit={handleSubmit} className="space-y-4">
      {flow.ui.messages?.map((message, index) => (
        <div
          key={index}
          className={`p-3 rounded-md text-sm ${
            message.type === "error"
              ? "bg-red-50 text-red-700 border border-red-200"
              : "bg-blue-50 text-blue-700 border border-blue-200"
          }`}
        >
          {message.text}
        </div>
      ))}
      {inputNodes.map(renderNode)}
      {submitNodes.map(renderNode)}
    </form>
  );
 }
@@ -1,49 +0,0 @@
 "use client";
 import { useEffect, useState, useCallback } from "react";
 import { Session, Identity } from "@ory/client";
 import { kratosClient } from "@/lib/kratos/client";
 interface UseSessionResult {
  session: Session | null;
  identity: Identity | null;
  isLoading: boolean;
  error: Error | null;
  isAuthenticated: boolean;
  refetch: () => Promise<void>;
 }
 export function useSession(): UseSessionResult {
  const [session, setSession] = useState<Session | null>(null);
  const [isLoading, setIsLoading] = useState(true);
  const [error, setError] = useState<Error | null>(null);
  const fetchSession = useCallback(async () => {
    try {
      setIsLoading(true);
      const { data } = await kratosClient.toSession();
      setSession(data);
      setError(null);
    } catch (err) {
      setSession(null);
      if (err instanceof Error) {
        setError(err);
      }
    } finally {
      setIsLoading(false);
    }
  }, []);
  useEffect(() => {
    fetchSession();
  }, [fetchSession]);
  return {
    session,
    identity: session?.identity ?? null,
    isLoading,
    error,
    isAuthenticated: !!session,
    refetch: fetchSession,
  };
 }
@@ -1,22 +0,0 @@
 import { Configuration, FrontendApi } from "@ory/client";
 const kratosPublicUrl =
  process.env.NEXT_PUBLIC_KRATOS_PUBLIC_URL || "http://localhost:4433";
 export const kratosClient = new FrontendApi(
  new Configuration({
    basePath: kratosPublicUrl,
    baseOptions: {
      withCredentials: true,
    },
  })
 );
 export function createServerKratosClient(baseUrl?: string) {
  const url = baseUrl || process.env.KRATOS_ADMIN_URL || "http://localhost:4434";
  return new FrontendApi(
    new Configuration({
      basePath: url,
    })
  );
 }
@@ -1,70 +0,0 @@
 import { NextResponse } from "next/server";
 import type { NextRequest } from "next/server";
 const protectedRoutes = ["/dashboard", "/auth/settings"];
 const authRoutes = ["/auth/login", "/auth/registration"];
 export async function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl;
  const sessionCookie = request.cookies.get("lightsaver_session");
  if (protectedRoutes.some((route) => pathname.startsWith(route))) {
    if (!sessionCookie) {
      const loginUrl = new URL("/auth/login", request.url);
      loginUrl.searchParams.set("return_to", pathname);
      return NextResponse.redirect(loginUrl);
    }
    try {
      const kratosUrl =
        process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
      const response = await fetch(`${kratosUrl}/sessions/whoami`, {
        headers: {
          Cookie: `lightsaver_session=${sessionCookie.value}`,
        },
      });
      if (!response.ok) {
        const loginUrl = new URL("/auth/login", request.url);
        loginUrl.searchParams.set("return_to", pathname);
        return NextResponse.redirect(loginUrl);
      }
    } catch (error) {
      console.error("Session verification failed:", error);
      const loginUrl = new URL("/auth/login", request.url);
      return NextResponse.redirect(loginUrl);
    }
  }
  if (authRoutes.some((route) => pathname.startsWith(route))) {
    if (sessionCookie) {
      try {
        const kratosUrl =
          process.env.KRATOS_PUBLIC_URL || "http://localhost:4433";
        const response = await fetch(`${kratosUrl}/sessions/whoami`, {
          headers: {
            Cookie: `lightsaver_session=${sessionCookie.value}`,
          },
        });
        if (response.ok) {
          return NextResponse.redirect(new URL("/dashboard", request.url));
        }
      } catch {
        // Session invalid, allow access to auth pages
      }
    }
  }
  return NextResponse.next();
 }
 export const config = {
  matcher: [
    "/dashboard/:path*",
    "/auth/settings/:path*",
    "/auth/login",
    "/auth/registration",
  ],
 };
@@ -0,0 +1,110 @@
 FROM debian:bookworm-slim
 # explicitly set user/group IDs
 RUN set -eux; \
 	groupadd -r postgres --gid=999; \
 	useradd -r -g postgres --uid=999 --home-dir=/var/lib/postgresql --shell=/bin/bash postgres; \
 	install --verbose --directory --owner postgres --group postgres --mode 1777 /var/lib/postgresql
 RUN set -ex; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
 		gnupg \
 		less \
 	; \
 	rm -rf /var/lib/apt/lists/*
 # grab gosu for easy step-down from root
 ENV GOSU_VERSION=1.17
 RUN set -eux; \
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends ca-certificates wget; \
 	rm -rf /var/lib/apt/lists/*; \
 	dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
 	wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
 	wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
 	export GNUPGHOME="$(mktemp -d)"; \
 	gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
 	gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
 	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
 	apt-mark auto '.*' > /dev/null; \
 	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
 	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
 	chmod +x /usr/local/bin/gosu; \
 	gosu --version; \
 	gosu nobody true
 # make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default
 RUN set -eux; \
 	if [ -f /etc/dpkg/dpkg.cfg.d/docker ]; then \
 		grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
 		sed -ri '/\/usr\/share\/locale/d' /etc/dpkg/dpkg.cfg.d/docker; \
 		! grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
 	fi; \
 	apt-get update; apt-get install -y --no-install-recommends locales; rm -rf /var/lib/apt/lists/*; \
 	echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen; \
 	locale-gen; \
 	locale -a | grep 'en_US.utf8'
 ENV LANG=en_US.utf8
 RUN set -eux; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
 		libnss-wrapper \
 		xz-utils \
 		zstd \
 	; \
 	rm -rf /var/lib/apt/lists/*
 RUN mkdir /docker-entrypoint-initdb.d
 RUN set -ex; \
 	key='B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8'; \
 	export GNUPGHOME="$(mktemp -d)"; \
 	mkdir -p /usr/local/share/keyrings/; \
 	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
 	gpg --batch --export --armor "$key" > /usr/local/share/keyrings/postgres.gpg.asc; \
 	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"
 ENV PG_MAJOR=17
 ENV PATH=$PATH:/usr/lib/postgresql/17/bin
 ENV PG_VERSION=17.5
 RUN set -ex; \
 	dpkgArch="$(dpkg --print-architecture)"; \
 	echo "deb [ signed-by=/usr/local/share/keyrings/postgres.gpg.asc ] http://apt.postgresql.org/pub/repos/apt/ bookworm-pgdg main 17" > /etc/apt/sources.list.d/pgdg.list; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends postgresql-common; \
 	sed -ri 's/#(create_main_cluster) .*$/\1 = false/' /etc/postgresql-common/createcluster.conf; \
 	apt-get install -y --no-install-recommends \
 		"postgresql-17" \
 	; \
 	rm -rf /var/lib/apt/lists/*; \
 	find /usr -name '*.pyc' -type f -exec bash -c 'for pyc; do dpkg -S "$pyc" &> /dev/null || rm -vf "$pyc"; done' -- '{}' +; \
 	postgres --version
 # make the sample config easier to munge (and "correct by default")
 RUN set -eux; \
 	dpkg-divert --add --rename --divert "/usr/share/postgresql/postgresql.conf.sample.dpkg" "/usr/share/postgresql/17/postgresql.conf.sample"; \
 	cp -v /usr/share/postgresql/postgresql.conf.sample.dpkg /usr/share/postgresql/postgresql.conf.sample; \
 	ln -sv ../postgresql.conf.sample "/usr/share/postgresql/17/"; \
 	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" /usr/share/postgresql/postgresql.conf.sample; \
 	grep -F "listen_addresses = '*'" /usr/share/postgresql/postgresql.conf.sample
 RUN install --verbose --directory --owner postgres --group postgres --mode 3777 /var/run/postgresql
 ENV PGDATA=/var/lib/postgresql/data
 RUN install --verbose --directory --owner postgres --group postgres --mode 1777 "$PGDATA"
 VOLUME /var/lib/postgresql/data
 COPY docker-entrypoint.sh docker-ensure-initdb.sh /usr/local/bin/
 RUN ln -sT docker-ensure-initdb.sh /usr/local/bin/docker-enforce-initdb.sh
 ENTRYPOINT ["docker-entrypoint.sh"]
 STOPSIGNAL SIGINT
 EXPOSE 5432
 CMD ["postgres"]
@@ -0,0 +1,72 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 #
 # This script is intended for three main use cases:
 #
 #  1. (most importantly) as an example of how to use "docker-entrypoint.sh" to extend/reuse the initialization behavior
 #
 #  2. ("docker-ensure-initdb.sh") as a Kubernetes "init container" to ensure the provided database directory is initialized; see also "startup probes" for an alternative solution
 #       (no-op if database is already initialized)
 #
 #  3. ("docker-enforce-initdb.sh") as part of CI to ensure the database is fully initialized before use
 #       (error if database is already initialized)
 #
 source /usr/local/bin/docker-entrypoint.sh
 # arguments to this script are assumed to be arguments to the "postgres" server (same as "docker-entrypoint.sh"), and most "docker-entrypoint.sh" functions assume "postgres" is the first argument (see "_main" over there)
 if [ "$#" -eq 0 ] || [ "$1" != 'postgres' ]; then
 	set -- postgres "$@"
 fi
 # see also "_main" in "docker-entrypoint.sh"
 docker_setup_env
 # setup data directories and permissions (when run as root)
 docker_create_db_directories
 if [ "$(id -u)" = '0' ]; then
 	# then restart script as postgres user
 	exec gosu postgres "$BASH_SOURCE" "$@"
 fi
 # only run initialization on an empty data directory
 if [ -z "$DATABASE_ALREADY_EXISTS" ]; then
 	docker_verify_minimum_env
 	docker_error_old_databases
 	# check dir permissions to reduce likelihood of half-initialized database
 	ls /docker-entrypoint-initdb.d/ > /dev/null
 	docker_init_database_dir
 	pg_setup_hba_conf "$@"
 	# PGPASSWORD is required for psql when authentication is required for 'local' connections via pg_hba.conf and is otherwise harmless
 	# e.g. when '--auth=md5' or '--auth-local=md5' is used in POSTGRES_INITDB_ARGS
 	export PGPASSWORD="${PGPASSWORD:-$POSTGRES_PASSWORD}"
 	docker_temp_server_start "$@"
 	docker_setup_db
 	docker_process_init_files /docker-entrypoint-initdb.d/*
 	docker_temp_server_stop
 	unset PGPASSWORD
 else
 	self="$(basename "$0")"
 	case "$self" in
 		docker-ensure-initdb.sh)
 			echo >&2 "$self: note: database already initialized in '$PGDATA'!"
 			exit 0
 			;;
 		docker-enforce-initdb.sh)
 			echo >&2 "$self: error: (unexpected) database found in '$PGDATA'!"
 			exit 1
 			;;
 		*)
 			echo >&2 "$self: error: unknown file name: $self"
 			exit 99
 			;;
 	esac
 fi
@@ -0,0 +1,391 @@
 #!/usr/bin/env bash
 set -Eeo pipefail
 # TODO swap to -Eeuo pipefail above (after handling all potentially-unset variables)
 # usage: file_env VAR [DEFAULT]
 #    ie: file_env 'XYZ_DB_PASSWORD' 'example'
 # (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
 #  "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
 file_env() {
 	local var="$1"
 	local fileVar="${var}_FILE"
 	local def="${2:-}"
 	if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
 		printf >&2 'error: both %s and %s are set (but are exclusive)\n' "$var" "$fileVar"
 		exit 1
 	fi
 	local val="$def"
 	if [ "${!var:-}" ]; then
 		val="${!var}"
 	elif [ "${!fileVar:-}" ]; then
 		val="$(< "${!fileVar}")"
 	fi
 	export "$var"="$val"
 	unset "$fileVar"
 }
 # check to see if this file is being run or sourced from another script
 _is_sourced() {
 	# https://unix.stackexchange.com/a/215279
 	[ "${#FUNCNAME[@]}" -ge 2 ] \
 		&& [ "${FUNCNAME[0]}" = '_is_sourced' ] \
 		&& [ "${FUNCNAME[1]}" = 'source' ]
 }
 # used to create initial postgres directories and if run as root, ensure ownership to the "postgres" user
 docker_create_db_directories() {
 	local user; user="$(id -u)"
 	mkdir -p "$PGDATA"
 	# ignore failure since there are cases where we can't chmod (and PostgreSQL might fail later anyhow - it's picky about permissions of this directory)
 	chmod 00700 "$PGDATA" || :
 	# ignore failure since it will be fine when using the image provided directory; see also https://github.com/docker-library/postgres/pull/289
 	mkdir -p /var/run/postgresql || :
 	chmod 03775 /var/run/postgresql || :
 	# Create the transaction log directory before initdb is run so the directory is owned by the correct user
 	if [ -n "${POSTGRES_INITDB_WALDIR:-}" ]; then
 		mkdir -p "$POSTGRES_INITDB_WALDIR"
 		if [ "$user" = '0' ]; then
 			find "$POSTGRES_INITDB_WALDIR" \! -user postgres -exec chown postgres '{}' +
 		fi
 		chmod 700 "$POSTGRES_INITDB_WALDIR"
 	fi
 	# allow the container to be started with `--user`
 	if [ "$user" = '0' ]; then
 		find "$PGDATA" \! -user postgres -exec chown postgres '{}' +
 		find /var/run/postgresql \! -user postgres -exec chown postgres '{}' +
 	fi
 }
 # initialize empty PGDATA directory with new database via 'initdb'
 # arguments to `initdb` can be passed via POSTGRES_INITDB_ARGS or as arguments to this function
 # `initdb` automatically creates the "postgres", "template0", and "template1" dbnames
 # this is also where the database user is created, specified by `POSTGRES_USER` env
 docker_init_database_dir() {
 	# "initdb" is particular about the current user existing in "/etc/passwd", so we use "nss_wrapper" to fake that if necessary
 	# see https://github.com/docker-library/postgres/pull/253, https://github.com/docker-library/postgres/issues/359, https://cwrap.org/nss_wrapper.html
 	local uid; uid="$(id -u)"
 	if ! getent passwd "$uid" &> /dev/null; then
 		# see if we can find a suitable "libnss_wrapper.so" (https://salsa.debian.org/sssd-team/nss-wrapper/-/commit/b9925a653a54e24d09d9b498a2d913729f7abb15)
 		local wrapper
 		for wrapper in {/usr,}/lib{/*,}/libnss_wrapper.so; do
 			if [ -s "$wrapper" ]; then
 				NSS_WRAPPER_PASSWD="$(mktemp)"
 				NSS_WRAPPER_GROUP="$(mktemp)"
 				export LD_PRELOAD="$wrapper" NSS_WRAPPER_PASSWD NSS_WRAPPER_GROUP
 				local gid; gid="$(id -g)"
 				printf 'postgres:x:%s:%s:PostgreSQL:%s:/bin/false\n' "$uid" "$gid" "$PGDATA" > "$NSS_WRAPPER_PASSWD"
 				printf 'postgres:x:%s:\n' "$gid" > "$NSS_WRAPPER_GROUP"
 				break
 			fi
 		done
 	fi
 	if [ -n "${POSTGRES_INITDB_WALDIR:-}" ]; then
 		set -- --waldir "$POSTGRES_INITDB_WALDIR" "$@"
 	fi
 	# --pwfile refuses to handle a properly-empty file (hence the "\n"): https://github.com/docker-library/postgres/issues/1025
 	eval 'initdb --username="$POSTGRES_USER" --pwfile=<(printf "%s\n" "$POSTGRES_PASSWORD") '"$POSTGRES_INITDB_ARGS"' "$@"'
 	# unset/cleanup "nss_wrapper" bits
 	if [[ "${LD_PRELOAD:-}" == */libnss_wrapper.so ]]; then
 		rm -f "$NSS_WRAPPER_PASSWD" "$NSS_WRAPPER_GROUP"
 		unset LD_PRELOAD NSS_WRAPPER_PASSWD NSS_WRAPPER_GROUP
 	fi
 }
 # print large warning if POSTGRES_PASSWORD is long
 # error if both POSTGRES_PASSWORD is empty and POSTGRES_HOST_AUTH_METHOD is not 'trust'
 # print large warning if POSTGRES_HOST_AUTH_METHOD is set to 'trust'
 # assumes database is not set up, ie: [ -z "$DATABASE_ALREADY_EXISTS" ]
 docker_verify_minimum_env() {
 	case "${PG_MAJOR:-}" in
 		13) # https://github.com/postgres/postgres/commit/67a472d71c98c3d2fa322a1b4013080b20720b98
 			# check password first so we can output the warning before postgres
 			# messes it up
 			if [ "${#POSTGRES_PASSWORD}" -ge 100 ]; then
 				cat >&2 <<-'EOWARN'
 					WARNING: The supplied POSTGRES_PASSWORD is 100+ characters.
 					  This will not work if used via PGPASSWORD with "psql".
 					  https://www.postgresql.org/message-id/flat/E1Rqxp2-0004Qt-PL%40wrigleys.postgresql.org (BUG #6412)
 					  https://github.com/docker-library/postgres/issues/507
 				EOWARN
 			fi
 			;;
 	esac
 	if [ -z "$POSTGRES_PASSWORD" ] && [ 'trust' != "$POSTGRES_HOST_AUTH_METHOD" ]; then
 		# The - option suppresses leading tabs but *not* spaces. :)
 		cat >&2 <<-'EOE'
 			Error: Database is uninitialized and superuser password is not specified.
 			       You must specify POSTGRES_PASSWORD to a non-empty value for the
 			       superuser. For example, "-e POSTGRES_PASSWORD=password" on "docker run".
 			       You may also use "POSTGRES_HOST_AUTH_METHOD=trust" to allow all
 			       connections without a password. This is *not* recommended.
 			       See PostgreSQL documentation about "trust":
 			       https://www.postgresql.org/docs/current/auth-trust.html
 		EOE
 		exit 1
 	fi
 	if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
 		cat >&2 <<-'EOWARN'
 			********************************************************************************
 			WARNING: POSTGRES_HOST_AUTH_METHOD has been set to "trust". This will allow
 			         anyone with access to the Postgres port to access your database without
 			         a password, even if POSTGRES_PASSWORD is set. See PostgreSQL
 			         documentation about "trust":
 			         https://www.postgresql.org/docs/current/auth-trust.html
 			         In Docker's default configuration, this is effectively any other
 			         container on the same system.
 			         It is not recommended to use POSTGRES_HOST_AUTH_METHOD=trust. Replace
 			         it with "-e POSTGRES_PASSWORD=password" instead to set a password in
 			         "docker run".
 			********************************************************************************
 		EOWARN
 	fi
 }
 # similar to the above, but errors if there are any "old" databases detected (usually due to upgrades without pg_upgrade)
 docker_error_old_databases() {
 	if [ -n "${OLD_DATABASES[0]:-}" ]; then
 		cat >&2 <<-EOE
 			Error: in 18+, these Docker images are configured to store database data in a
 			       format which is compatible with "pg_ctlcluster" (specifically, using
 			       major-version-specific directory names).  This better reflects how
 			       PostgreSQL itself works, and how upgrades are to be performed.
 			       See also https://github.com/docker-library/postgres/pull/1259
 			       Counter to that, there appears to be PostgreSQL data in:
 			         ${OLD_DATABASES[*]}
 			       This is usually the result of upgrading the Docker image without upgrading
 			       the underlying database using "pg_upgrade" (which requires both versions).
 			       See https://github.com/docker-library/postgres/issues/37 for a (long)
 			       discussion around this process, and suggestions for how to do so.
 		EOE
 		exit 1
 	fi
 }
 # usage: docker_process_init_files [file [file [...]]]
 #    ie: docker_process_init_files /always-initdb.d/*
 # process initializer files, based on file extensions and permissions
 docker_process_init_files() {
 	# psql here for backwards compatibility "${psql[@]}"
 	psql=( docker_process_sql )
 	printf '\n'
 	local f
 	for f; do
 		case "$f" in
 			*.sh)
 				# https://github.com/docker-library/postgres/issues/450#issuecomment-393167936
 				# https://github.com/docker-library/postgres/pull/452
 				if [ -x "$f" ]; then
 					printf '%s: running %s\n' "$0" "$f"
 					"$f"
 				else
 					printf '%s: sourcing %s\n' "$0" "$f"
 					. "$f"
 				fi
 				;;
 			*.sql)     printf '%s: running %s\n' "$0" "$f"; docker_process_sql -f "$f"; printf '\n' ;;
 			*.sql.gz)  printf '%s: running %s\n' "$0" "$f"; gunzip -c "$f" | docker_process_sql; printf '\n' ;;
 			*.sql.xz)  printf '%s: running %s\n' "$0" "$f"; xzcat "$f" | docker_process_sql; printf '\n' ;;
 			*.sql.zst) printf '%s: running %s\n' "$0" "$f"; zstd -dc "$f" | docker_process_sql; printf '\n' ;;
 			*)         printf '%s: ignoring %s\n' "$0" "$f" ;;
 		esac
 		printf '\n'
 	done
 }
 # Execute sql script, passed via stdin (or -f flag of pqsl)
 # usage: docker_process_sql [psql-cli-args]
 #    ie: docker_process_sql --dbname=mydb <<<'INSERT ...'
 #    ie: docker_process_sql -f my-file.sql
 #    ie: docker_process_sql <my-file.sql
 docker_process_sql() {
 	local query_runner=( psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --no-password --no-psqlrc )
 	if [ -n "$POSTGRES_DB" ]; then
 		query_runner+=( --dbname "$POSTGRES_DB" )
 	fi
 	PGHOST= PGHOSTADDR= "${query_runner[@]}" "$@"
 }
 # create initial database
 # uses environment variables for input: POSTGRES_DB
 docker_setup_db() {
 	local dbAlreadyExists
 	dbAlreadyExists="$(
 		POSTGRES_DB= docker_process_sql --dbname postgres --set db="$POSTGRES_DB" --tuples-only <<-'EOSQL'
 			SELECT 1 FROM pg_database WHERE datname = :'db' ;
 		EOSQL
 	)"
 	if [ -z "$dbAlreadyExists" ]; then
 		POSTGRES_DB= docker_process_sql --dbname postgres --set db="$POSTGRES_DB" <<-'EOSQL'
 			CREATE DATABASE :"db" ;
 		EOSQL
 		printf '\n'
 	fi
 }
 # Loads various settings that are used elsewhere in the script
 # This should be called before any other functions
 docker_setup_env() {
 	file_env 'POSTGRES_PASSWORD'
 	file_env 'POSTGRES_USER' 'postgres'
 	file_env 'POSTGRES_DB' "$POSTGRES_USER"
 	file_env 'POSTGRES_INITDB_ARGS'
 	: "${POSTGRES_HOST_AUTH_METHOD:=}"
 	declare -g DATABASE_ALREADY_EXISTS
 	: "${DATABASE_ALREADY_EXISTS:=}"
 	declare -ag OLD_DATABASES=()
 	# look specifically for PG_VERSION, as it is expected in the DB dir
 	if [ -s "$PGDATA/PG_VERSION" ]; then
 		DATABASE_ALREADY_EXISTS='true'
 	elif [ "$PGDATA" = "/var/lib/postgresql/$PG_MAJOR/docker" ]; then
 		# https://github.com/docker-library/postgres/pull/1259
 		for d in /var/lib/postgresql /var/lib/postgresql/data /var/lib/postgresql/*/docker; do
 			if [ -s "$d/PG_VERSION" ]; then
 				OLD_DATABASES+=( "$d" )
 			fi
 		done
 	fi
 }
 # append POSTGRES_HOST_AUTH_METHOD to pg_hba.conf for "host" connections
 # all arguments will be passed along as arguments to `postgres` for getting the value of 'password_encryption'
 pg_setup_hba_conf() {
 	# default authentication method is md5 on versions before 14
 	# https://www.postgresql.org/about/news/postgresql-14-released-2318/
 	if [ "$1" = 'postgres' ]; then
 		shift
 	fi
 	local auth
 	# check the default/configured encryption and use that as the auth method
 	auth="$(postgres -C password_encryption "$@")"
 	: "${POSTGRES_HOST_AUTH_METHOD:=$auth}"
 	{
 		printf '\n'
 		if [ 'trust' = "$POSTGRES_HOST_AUTH_METHOD" ]; then
 			printf '# warning trust is enabled for all connections\n'
 			printf '# see https://www.postgresql.org/docs/17/auth-trust.html\n'
 		fi
 		printf 'host all all all %s\n' "$POSTGRES_HOST_AUTH_METHOD"
 	} >> "$PGDATA/pg_hba.conf"
 }
 # start socket-only postgresql server for setting up or running scripts
 # all arguments will be passed along as arguments to `postgres` (via pg_ctl)
 docker_temp_server_start() {
 	if [ "$1" = 'postgres' ]; then
 		shift
 	fi
 	# internal start of server in order to allow setup using psql client
 	# does not listen on external TCP/IP and waits until start finishes
 	set -- "$@" -c listen_addresses='' -p "${PGPORT:-5432}"
 	# unset NOTIFY_SOCKET so the temporary server doesn't prematurely notify
 	# any process supervisor.
 	NOTIFY_SOCKET= \
 	PGUSER="${PGUSER:-$POSTGRES_USER}" \
 	pg_ctl -D "$PGDATA" \
 		-o "$(printf '%q ' "$@")" \
 		-w start
 }
 # stop postgresql server after done setting up user and running scripts
 docker_temp_server_stop() {
 	PGUSER="${PGUSER:-postgres}" \
 	pg_ctl -D "$PGDATA" -m fast -w stop
 }
 # check arguments for an option that would cause postgres to stop
 # return true if there is one
 _pg_want_help() {
 	local arg
 	for arg; do
 		case "$arg" in
 			# postgres --help | grep 'then exit'
 			# leaving out -C on purpose since it always fails and is unhelpful:
 			# postgres: could not access the server configuration file "/var/lib/postgresql/data/postgresql.conf": No such file or directory
 			-'?'|--help|--describe-config|-V|--version)
 				return 0
 				;;
 		esac
 	done
 	return 1
 }
 _main() {
 	# if first arg looks like a flag, assume we want to run postgres server
 	if [ "${1:0:1}" = '-' ]; then
 		set -- postgres "$@"
 	fi
 	if [ "$1" = 'postgres' ] && ! _pg_want_help "$@"; then
 		docker_setup_env
 		# setup data directories and permissions (when run as root)
 		docker_create_db_directories
 		if [ "$(id -u)" = '0' ]; then
 			# then restart script as postgres user
 			exec gosu postgres "$BASH_SOURCE" "$@"
 		fi
 		# only run initialization on an empty data directory
 		if [ -z "$DATABASE_ALREADY_EXISTS" ]; then
 			docker_verify_minimum_env
 			docker_error_old_databases
 			# check dir permissions to reduce likelihood of half-initialized database
 			ls /docker-entrypoint-initdb.d/ > /dev/null
 			docker_init_database_dir
 			pg_setup_hba_conf "$@"
 			# PGPASSWORD is required for psql when authentication is required for 'local' connections via pg_hba.conf and is otherwise harmless
 			# e.g. when '--auth=md5' or '--auth-local=md5' is used in POSTGRES_INITDB_ARGS
 			export PGPASSWORD="${PGPASSWORD:-$POSTGRES_PASSWORD}"
 			docker_temp_server_start "$@"
 			docker_setup_db
 			docker_process_init_files /docker-entrypoint-initdb.d/*
 			docker_temp_server_stop
 			unset PGPASSWORD
 			cat <<-'EOM'
 				PostgreSQL init process complete; ready for start up.
 			EOM
 		else
 			cat <<-'EOM'
 				PostgreSQL Database directory appears to contain a database; Skipping initialization
 			EOM
 		fi
 	fi
 	exec "$@"
 }
 if ! _is_sourced; then
 	_main "$@"
 fi
@@ -0,0 +1,14 @@
 import type { CodegenConfig } from "@graphql-codegen/cli";
 const config: CodegenConfig = {
  schema: ["services/auth/schema/schema.graphql"],
  generates: {
    "./resolvers-types.ts": {
      config: {
        useIndexSignature: true,
      },
      plugins: ["typescript", "typescript-resolvers"],
    },
  },
 };
 export default config;
@@ -0,0 +1 @@
 {}
@@ -0,0 +1 @@
 {}
@@ -0,0 +1,31 @@
 {
  "file-explorer": true,
  "global-search": true,
  "switcher": true,
  "graph": true,
  "backlink": true,
  "canvas": true,
  "outgoing-link": true,
  "tag-pane": true,
  "properties": false,
  "page-preview": true,
  "daily-notes": true,
  "templates": true,
  "note-composer": true,
  "command-palette": true,
  "slash-command": false,
  "editor-status": true,
  "bookmarks": true,
  "markdown-importer": false,
  "zk-prefixer": false,
  "random-note": false,
  "outline": true,
  "word-count": true,
  "slides": false,
  "audio-recorder": false,
  "workspaces": false,
  "file-recovery": true,
  "publish": false,
  "sync": true,
  "webviewer": false
 }
@@ -0,0 +1 @@
 {}
@@ -0,0 +1,3 @@
 {
  "theme": "obsidian"
 }
@@ -0,0 +1,31 @@
 {
  "file-explorer": true,
  "global-search": true,
  "switcher": true,
  "graph": true,
  "backlink": true,
  "canvas": true,
  "outgoing-link": true,
  "tag-pane": true,
  "properties": false,
  "page-preview": true,
  "daily-notes": true,
  "templates": true,
  "note-composer": true,
  "command-palette": true,
  "slash-command": false,
  "editor-status": true,
  "bookmarks": true,
  "markdown-importer": false,
  "zk-prefixer": false,
  "random-note": false,
  "outline": true,
  "word-count": true,
  "slides": false,
  "audio-recorder": false,
  "workspaces": false,
  "file-recovery": true,
  "publish": false,
  "sync": true,
  "webviewer": false
 }
@@ -0,0 +1,166 @@
 {
  "main": {
    "id": "a50b81cf00688a7f",
    "type": "split",
    "children": [
      {
        "id": "2e75bb4ed5a090b4",
        "type": "tabs",
        "children": [
          {
            "id": "de13abfe2ed99649",
            "type": "leaf",
            "state": {
              "type": "empty",
              "state": {},
              "icon": "lucide-file",
              "title": "New tab"
            }
          }
        ]
      }
    ],
    "direction": "vertical"
  },
  "left": {
    "id": "e7df76c86166bd4f",
    "type": "split",
    "children": [
      {
        "id": "681e3db73e836177",
        "type": "tabs",
        "children": [
          {
            "id": "820827387827beba",
            "type": "leaf",
            "state": {
              "type": "file-explorer",
              "state": {
                "sortOrder": "alphabetical",
                "autoReveal": false
              },
              "icon": "lucide-folder-closed",
              "title": "Files"
            }
          },
          {
            "id": "6f22506e4ef49d80",
            "type": "leaf",
            "state": {
              "type": "search",
              "state": {
                "query": "",
                "matchingCase": false,
                "explainSearch": false,
                "collapseAll": false,
                "extraContext": false,
                "sortOrder": "alphabetical"
              },
              "icon": "lucide-search",
              "title": "Search"
            }
          },
          {
            "id": "5fcbd10dd558c03a",
            "type": "leaf",
            "state": {
              "type": "bookmarks",
              "state": {},
              "icon": "lucide-bookmark",
              "title": "Bookmarks"
            }
          }
        ]
      }
    ],
    "direction": "horizontal",
    "width": 300
  },
  "right": {
    "id": "47d5adcd7f9dbd07",
    "type": "split",
    "children": [
      {
        "id": "58e6eaa0e1b63f6a",
        "type": "tabs",
        "children": [
          {
            "id": "6beab8742fcc1585",
            "type": "leaf",
            "state": {
              "type": "backlink",
              "state": {
                "collapseAll": false,
                "extraContext": false,
                "sortOrder": "alphabetical",
                "showSearch": false,
                "searchQuery": "",
                "backlinkCollapsed": false,
                "unlinkedCollapsed": true
              },
              "icon": "links-coming-in",
              "title": "Backlinks"
            }
          },
          {
            "id": "47b716fd376cf8da",
            "type": "leaf",
            "state": {
              "type": "outgoing-link",
              "state": {
                "linksCollapsed": false,
                "unlinkedCollapsed": true
              },
              "icon": "links-going-out",
              "title": "Outgoing links"
            }
          },
          {
            "id": "f794baa612157193",
            "type": "leaf",
            "state": {
              "type": "tag",
              "state": {
                "sortOrder": "frequency",
                "useHierarchy": true,
                "showSearch": false,
                "searchQuery": ""
              },
              "icon": "lucide-tags",
              "title": "Tags"
            }
          },
          {
            "id": "5790163a24c843d3",
            "type": "leaf",
            "state": {
              "type": "outline",
              "state": {
                "followCursor": false,
                "showSearch": false,
                "searchQuery": ""
              },
              "icon": "lucide-list",
              "title": "Outline"
            }
          }
        ]
      }
    ],
    "direction": "horizontal",
    "width": 300,
    "collapsed": true
  },
  "left-ribbon": {
    "hiddenItems": {
      "switcher:Open quick switcher": false,
      "graph:Open graph view": false,
      "canvas:Create new canvas": false,
      "daily-notes:Open today's daily note": false,
      "templates:Insert template": false,
      "command-palette:Open command palette": false
    }
  },
  "active": "de13abfe2ed99649",
  "lastOpenFiles": []
 }
@@ -1,52 +0,0 @@
 {
  "$id": "https://lightsaver.app/schemas/identity.schema.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "LightsaverUser",
  "type": "object",
  "properties": {
    "traits": {
      "type": "object",
      "properties": {
        "email": {
          "type": "string",
          "format": "email",
          "title": "Email",
          "ory.sh/kratos": {
            "credentials": {
              "password": {
                "identifier": true
              }
            },
            "recovery": {
              "via": "email"
            },
            "verification": {
              "via": "email"
            }
          }
        },
        "name": {
          "type": "object",
          "properties": {
            "first": {
              "type": "string",
              "title": "First Name",
              "minLength": 1,
              "maxLength": 100
            },
            "last": {
              "type": "string",
              "title": "Last Name",
              "minLength": 1,
              "maxLength": 100
            }
          },
          "required": ["first", "last"],
          "additionalProperties": false
        }
      },
      "required": ["email", "name"],
      "additionalProperties": false
    }
  }
 }
@@ -1,120 +0,0 @@
 version: v1.2.0
 dsn: memory
 serve:
  public:
    base_url: http://localhost:4433/
    cors:
      enabled: true
      allowed_origins:
        - http://localhost:3000
        - http://127.0.0.1:3000
      allowed_methods:
        - POST
        - GET
        - PUT
        - PATCH
        - DELETE
      allowed_headers:
        - Authorization
        - Content-Type
        - Cookie
        - X-Session-Token
      exposed_headers:
        - Content-Type
        - Set-Cookie
      allow_credentials: true
  admin:
    base_url: http://localhost:4434/
 selfservice:
  default_browser_return_url: http://localhost:3000/
  allowed_return_urls:
    - http://localhost:3000/
    - http://localhost:3000/dashboard
  methods:
    password:
      enabled: true
    link:
      enabled: true
    code:
      enabled: true
      mfa_enabled: false
  flows:
    error:
      ui_url: http://localhost:3000/auth/error
    settings:
      ui_url: http://localhost:3000/auth/settings
      privileged_session_max_age: 15m
    recovery:
      enabled: true
      ui_url: http://localhost:3000/auth/recovery
      use: code
    verification:
      enabled: true
      ui_url: http://localhost:3000/auth/verification
      use: code
      after:
        default_browser_return_url: http://localhost:3000/dashboard
    logout:
      after:
        default_browser_return_url: http://localhost:3000/
    login:
      ui_url: http://localhost:3000/auth/login
      lifespan: 10m
      after:
        password:
          hooks:
            - hook: revoke_active_sessions
    registration:
      ui_url: http://localhost:3000/auth/registration
      lifespan: 10m
      after:
        password:
          hooks:
            - hook: session
 log:
  level: debug
  format: text
  leak_sensitive_values: false
 secrets:
  cookie:
    - ${SECRETS_COOKIE}
  cipher:
    - ${SECRETS_CIPHER}
 ciphers:
  algorithm: xchacha20-poly1305
 hashers:
  algorithm: bcrypt
  bcrypt:
    cost: 12
 identity:
  default_schema_id: default
  schemas:
    - id: default
      url: file:///etc/config/kratos/identity.schema.json
 courier:
  smtp:
    connection_uri: smtp://mailhog:1025/?disable_starttls=true
 session:
  lifespan: 24h
  cookie:
    name: lightsaver_session
    same_site: Lax
    domain: localhost
@@ -0,0 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 bases:
 - ../../base
 patchesStrategicMerge:
 - dev-config.yaml
@@ -0,0 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - deployment.yaml
 - service.yaml
 - configmap.yaml
@@ -5,22 +5,47 @@
  "main": "index.js",
  "scripts": {
    "build": "turbo run build",
-    "check-types": "tsc --noEmit",
+    "check-types": "pnpm -r --filter \"!./apps/**\" exec tsc --noEmit --pretty && pnpm -r --filter \"./apps/**\" exec tsc --noEmit --pretty",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "codegen": "graphql-codegen --config ./codegen.ts",
    "start": "pnpm check-types && pnpm codegen && turbo run build",
    "test:unit": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "Jason Ross",
  "license": "ISC",
-  "packageManager": "pnpm@10.26.2+sha512.0e308ff2005fc7410366f154f625f6631ab2b16b1d2e70238444dd6ae9d630a8482d92a451144debc492416896ed16f7b114a86ec68b8404b2443869e68ffda6",
+  "module": "esnext",
  "packageManager": "pnpm@10.13.1",
  "engines": {
-    "node": ">=22.17.0"
+    "node": "^22.17.0"
  },
  "dependencies": {
-    "lightsaver": "workspace:*"
+    "@apollo/client": "^3.13.8",
    "@cloudamqp/amqp-client": "^3.2.1",
    "dotenv": "^17.2.1",
    "graphql": "^16.11.0",
    "lightsaver": "workspace:*",
    "next-auth": "^4.24.11"
  },
  "devDependencies": {
    "@graphql-codegen/cli": "^5.0.7",
    "@graphql-codegen/typescript": "^4.1.6",
    "@graphql-codegen/typescript-resolvers": "^4.5.1",
    "@parcel/watcher": "^2.5.1",
    "@types/node": "^24.1.0",
    "pnpm": "^10.13.1",
-    "turbo": "^2.5.4",
+    "turbo": "^2.5.5",
    "typescript": "^5.8.3"
  },
  "pnpm": {
    "overrides": {
      "fetch-blob": "npm:fetch-blob-fixed@^1.0.1"
    },
    "onlyBuiltDependencies": [
      "@apollo/protobufjs",
      "@parcel/watcher",
      "@tailwindcss/oxide",
      "sharp",
      "unrs-resolver"
    ]
  }
 }
@@ -4,6 +4,7 @@ packages:
  - packages/*
 onlyBuiltDependencies:
  - '@parcel/watcher'
  - '@tailwindcss/oxide'
  - sharp
  - unrs-resolver
@@ -1,115 +0,0 @@
 version: "3.9"
 services:
  postgres:
    image: postgres:18-alpine
    container_name: lightsaver_postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-kratos}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-kratos}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - lightsaver_network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-kratos} -d ${POSTGRES_DB:-kratos}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
  mailhog:
    image: mailhog/mailhog:latest
    container_name: lightsaver_mailhog
    ports:
      - "8025:8025"
    networks:
      - lightsaver_network
    restart: unless-stopped
  kratos-migrate:
    image: oryd/kratos:v1.2.0
    container_name: lightsaver_kratos_migrate
    environment:
      DSN: postgres://${POSTGRES_USER:-kratos}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-kratos}?sslmode=disable
    volumes:
      - ./infrastructure/kratos:/etc/config/kratos:ro
    command: migrate sql -e --yes
    networks:
      - lightsaver_network
    depends_on:
      postgres:
        condition: service_healthy
    restart: on-failure
  kratos:
    image: oryd/kratos:v1.2.0
    container_name: lightsaver_kratos
    environment:
      DSN: postgres://${POSTGRES_USER:-kratos}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-kratos}?sslmode=disable
      SECRETS_COOKIE: ${KRATOS_SECRETS_COOKIE}
      SECRETS_CIPHER: ${KRATOS_SECRETS_CIPHER}
      SERVE_PUBLIC_BASE_URL: ${KRATOS_PUBLIC_URL:-http://localhost:4433}
      SERVE_ADMIN_BASE_URL: ${KRATOS_ADMIN_URL:-http://localhost:4434}
      COURIER_SMTP_CONNECTION_URI: smtp://mailhog:1025/?disable_starttls=true
    volumes:
      - ./infrastructure/kratos:/etc/config/kratos:ro
    command: >
      sh -c "if [ '${KRATOS_DEV_MODE:-true}' = 'true' ]; then
        kratos serve --config /etc/config/kratos/kratos.yaml --dev --watch-courier;
      else
        kratos serve --config /etc/config/kratos/kratos.yaml --watch-courier;
      fi"
    ports:
      - "4433:4433"
      - "4434:4434"
    networks:
      - lightsaver_network
    depends_on:
      kratos-migrate:
        condition: service_completed_successfully
    restart: unless-stopped
  frontend:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_KRATOS_PUBLIC_URL: ${NEXT_PUBLIC_KRATOS_PUBLIC_URL:-http://localhost:4433}
    container_name: lightsaver_frontend
    environment:
      NODE_ENV: production
      NEXT_PUBLIC_KRATOS_PUBLIC_URL: ${NEXT_PUBLIC_KRATOS_PUBLIC_URL:-http://localhost:4433}
      KRATOS_ADMIN_URL: http://kratos:4434
    ports:
      - "3000:3000"
    networks:
      - lightsaver_network
    depends_on:
      - kratos
    restart: unless-stopped
  services:
    build:
      context: .
      dockerfile: services/Dockerfile
    container_name: lightsaver_services
    environment:
      NODE_ENV: production
      KRATOS_ADMIN_URL: http://kratos:4434
      PORT: 4000
    ports:
      - "4000:4000"
    networks:
      - lightsaver_network
    depends_on:
      - kratos
    restart: unless-stopped
 networks:
  lightsaver_network:
    driver: bridge
 volumes:
  postgres_data:
@@ -0,0 +1,220 @@
 import { GraphQLResolveInfo } from 'graphql';
 export type Maybe<T> = T | null;
 export type InputMaybe<T> = Maybe<T>;
 export type Exact<T extends { [key: string]: unknown }> = { [K in keyof T]: T[K] };
 export type MakeOptional<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]?: Maybe<T[SubKey]> };
 export type MakeMaybe<T, K extends keyof T> = Omit<T, K> & { [SubKey in K]: Maybe<T[SubKey]> };
 export type MakeEmpty<T extends { [key: string]: unknown }, K extends keyof T> = { [_ in K]?: never };
 export type Incremental<T> = T | { [P in keyof T]?: P extends ' $fragmentName' | '__typename' ? T[P] : never };
 export type RequireFields<T, K extends keyof T> = Omit<T, K> & { [P in K]-?: NonNullable<T[P]> };
 /** All built-in and custom scalars, mapped to their actual values */
 export type Scalars = {
  ID: { input: string; output: string; }
  String: { input: string; output: string; }
  Boolean: { input: boolean; output: boolean; }
  Int: { input: number; output: number; }
  Float: { input: number; output: number; }
 };
 export type CreateUserInput = {
  dateOfBirth: Scalars['String']['input'];
  email: Scalars['String']['input'];
  firstName: Scalars['String']['input'];
  lastName: Scalars['String']['input'];
  password: Scalars['String']['input'];
 };
 export type CreateUserResponse = {
  __typename?: 'CreateUserResponse';
  error?: Maybe<Scalars['String']['output']>;
  success: Scalars['Boolean']['output'];
  token?: Maybe<Scalars['String']['output']>;
  user?: Maybe<User>;
 };
 export type Mutation = {
  __typename?: 'Mutation';
  createUser: CreateUserResponse;
  login: UserLoginResponse;
  logout: UserLogoutResponse;
 };
 export type MutationCreateUserArgs = {
  input: CreateUserInput;
 };
 export type MutationLoginArgs = {
  input: UserLoginInput;
 };
 export type User = {
  __typename?: 'User';
  dateOfBirth: Scalars['String']['output'];
  email: Scalars['String']['output'];
  firstName: Scalars['String']['output'];
  id: Scalars['ID']['output'];
  lastName: Scalars['String']['output'];
 };
 export type UserLoginInput = {
  email: Scalars['String']['input'];
  password: Scalars['String']['input'];
 };
 export type UserLoginResponse = {
  __typename?: 'UserLoginResponse';
  error?: Maybe<Scalars['String']['output']>;
  success: Scalars['Boolean']['output'];
  token?: Maybe<Scalars['String']['output']>;
  user?: Maybe<User>;
 };
 export type UserLogoutResponse = {
  __typename?: 'UserLogoutResponse';
  success: Scalars['Boolean']['output'];
 };
 export type WithIndex<TObject> = TObject & Record<string, any>;
 export type ResolversObject<TObject> = WithIndex<TObject>;
 export type ResolverTypeWrapper<T> = Promise<T> | T;
 export type ResolverWithResolve<TResult, TParent, TContext, TArgs> = {
  resolve: ResolverFn<TResult, TParent, TContext, TArgs>;
 };
 export type Resolver<TResult, TParent = {}, TContext = {}, TArgs = {}> = ResolverFn<TResult, TParent, TContext, TArgs> | ResolverWithResolve<TResult, TParent, TContext, TArgs>;
 export type ResolverFn<TResult, TParent, TContext, TArgs> = (
  parent: TParent,
  args: TArgs,
  context: TContext,
  info: GraphQLResolveInfo
 ) => Promise<TResult> | TResult;
 export type SubscriptionSubscribeFn<TResult, TParent, TContext, TArgs> = (
  parent: TParent,
  args: TArgs,
  context: TContext,
  info: GraphQLResolveInfo
 ) => AsyncIterable<TResult> | Promise<AsyncIterable<TResult>>;
 export type SubscriptionResolveFn<TResult, TParent, TContext, TArgs> = (
  parent: TParent,
  args: TArgs,
  context: TContext,
  info: GraphQLResolveInfo
 ) => TResult | Promise<TResult>;
 export interface SubscriptionSubscriberObject<TResult, TKey extends string, TParent, TContext, TArgs> {
  subscribe: SubscriptionSubscribeFn<{ [key in TKey]: TResult }, TParent, TContext, TArgs>;
  resolve?: SubscriptionResolveFn<TResult, { [key in TKey]: TResult }, TContext, TArgs>;
 }
 export interface SubscriptionResolverObject<TResult, TParent, TContext, TArgs> {
  subscribe: SubscriptionSubscribeFn<any, TParent, TContext, TArgs>;
  resolve: SubscriptionResolveFn<TResult, any, TContext, TArgs>;
 }
 export type SubscriptionObject<TResult, TKey extends string, TParent, TContext, TArgs> =
  | SubscriptionSubscriberObject<TResult, TKey, TParent, TContext, TArgs>
  | SubscriptionResolverObject<TResult, TParent, TContext, TArgs>;
 export type SubscriptionResolver<TResult, TKey extends string, TParent = {}, TContext = {}, TArgs = {}> =
  | ((...args: any[]) => SubscriptionObject<TResult, TKey, TParent, TContext, TArgs>)
  | SubscriptionObject<TResult, TKey, TParent, TContext, TArgs>;
 export type TypeResolveFn<TTypes, TParent = {}, TContext = {}> = (
  parent: TParent,
  context: TContext,
  info: GraphQLResolveInfo
 ) => Maybe<TTypes> | Promise<Maybe<TTypes>>;
 export type IsTypeOfResolverFn<T = {}, TContext = {}> = (obj: T, context: TContext, info: GraphQLResolveInfo) => boolean | Promise<boolean>;
 export type NextResolverFn<T> = () => Promise<T>;
 export type DirectiveResolverFn<TResult = {}, TParent = {}, TContext = {}, TArgs = {}> = (
  next: NextResolverFn<TResult>,
  parent: TParent,
  args: TArgs,
  context: TContext,
  info: GraphQLResolveInfo
 ) => TResult | Promise<TResult>;
 /** Mapping between all available schema types and the resolvers types */
 export type ResolversTypes = ResolversObject<{
  Boolean: ResolverTypeWrapper<Scalars['Boolean']['output']>;
  CreateUserInput: CreateUserInput;
  CreateUserResponse: ResolverTypeWrapper<CreateUserResponse>;
  ID: ResolverTypeWrapper<Scalars['ID']['output']>;
  Mutation: ResolverTypeWrapper<{}>;
  String: ResolverTypeWrapper<Scalars['String']['output']>;
  User: ResolverTypeWrapper<User>;
  UserLoginInput: UserLoginInput;
  UserLoginResponse: ResolverTypeWrapper<UserLoginResponse>;
  UserLogoutResponse: ResolverTypeWrapper<UserLogoutResponse>;
 }>;
 /** Mapping between all available schema types and the resolvers parents */
 export type ResolversParentTypes = ResolversObject<{
  Boolean: Scalars['Boolean']['output'];
  CreateUserInput: CreateUserInput;
  CreateUserResponse: CreateUserResponse;
  ID: Scalars['ID']['output'];
  Mutation: {};
  String: Scalars['String']['output'];
  User: User;
  UserLoginInput: UserLoginInput;
  UserLoginResponse: UserLoginResponse;
  UserLogoutResponse: UserLogoutResponse;
 }>;
 export type CreateUserResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['CreateUserResponse'] = ResolversParentTypes['CreateUserResponse']> = ResolversObject<{
  error?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
  success?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
  token?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
  user?: Resolver<Maybe<ResolversTypes['User']>, ParentType, ContextType>;
  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 export type MutationResolvers<ContextType = any, ParentType extends ResolversParentTypes['Mutation'] = ResolversParentTypes['Mutation']> = ResolversObject<{
  createUser?: Resolver<ResolversTypes['CreateUserResponse'], ParentType, ContextType, RequireFields<MutationCreateUserArgs, 'input'>>;
  login?: Resolver<ResolversTypes['UserLoginResponse'], ParentType, ContextType, RequireFields<MutationLoginArgs, 'input'>>;
  logout?: Resolver<ResolversTypes['UserLogoutResponse'], ParentType, ContextType>;
 }>;
 export type UserResolvers<ContextType = any, ParentType extends ResolversParentTypes['User'] = ResolversParentTypes['User']> = ResolversObject<{
  dateOfBirth?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
  email?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
  firstName?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
  id?: Resolver<ResolversTypes['ID'], ParentType, ContextType>;
  lastName?: Resolver<ResolversTypes['String'], ParentType, ContextType>;
  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 export type UserLoginResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['UserLoginResponse'] = ResolversParentTypes['UserLoginResponse']> = ResolversObject<{
  error?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
  success?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
  token?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>;
  user?: Resolver<Maybe<ResolversTypes['User']>, ParentType, ContextType>;
  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 export type UserLogoutResponseResolvers<ContextType = any, ParentType extends ResolversParentTypes['UserLogoutResponse'] = ResolversParentTypes['UserLogoutResponse']> = ResolversObject<{
  success?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>;
  __isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>;
 }>;
 export type Resolvers<ContextType = any> = ResolversObject<{
  CreateUserResponse?: CreateUserResponseResolvers<ContextType>;
  Mutation?: MutationResolvers<ContextType>;
  User?: UserResolvers<ContextType>;
  UserLoginResponse?: UserLoginResponseResolvers<ContextType>;
  UserLogoutResponse?: UserLogoutResponseResolvers<ContextType>;
 }>;
@@ -1,26 +0,0 @@
 FROM node:22-slim AS builder
 RUN apt-get update && apt-get dist-upgrade -y && apt-get install -y ca-certificates build-essential
 RUN corepack enable && corepack prepare pnpm@latest --activate
 WORKDIR /app
 COPY . .
 RUN pnpm install --filter=api...
 RUN pnpm --filter=api run build || true
 FROM node:22-slim
 WORKDIR /app
 COPY --from=builder /app/services ./services
 COPY --from=builder /app/node_modules ./node_modules
 WORKDIR /app/services
 EXPOSE 4000
 CMD ["node", "--import", "tsx", "src/index.ts"]
@@ -0,0 +1,10 @@
 # Auth Service
 This service handles user authentication and authorization using Ory Kratos and integrates with a REST API.
 ## Technologies Used
 - **Ory Kratos (self-hosted)**: Identity and user management system.
 - **Express.js**: Web framework for building the REST API.
 - **PostgreSQL**: Database for storing user data.
 - **Docker**: Kratos, PostgreSQL, and this service are containerized for easy deployment.
 Kratos was chosen for its robust identity management capabilities, including support for multiple authentication methods and self-service flows. It also provides first class support for PostgreSQL, which was my preferred database choice for this project.
@@ -0,0 +1,232 @@
 FROM debian:{{ env.variant }}-slim
 # explicitly set user/group IDs
 RUN set -eux; \
 	groupadd -r postgres --gid=999; \
 # https://salsa.debian.org/postgresql/postgresql-common/blob/997d842ee744687d99a2b2d95c1083a2615c79e8/debian/postgresql-common.postinst#L32-35
 	useradd -r -g postgres --uid=999 --home-dir=/var/lib/postgresql --shell=/bin/bash postgres; \
 # also create the postgres user's home directory with appropriate permissions
 # see https://github.com/docker-library/postgres/issues/274
 	install --verbose --directory --owner postgres --group postgres --mode 1777 /var/lib/postgresql
 RUN set -ex; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
 		gnupg \
 # https://www.postgresql.org/docs/16/app-psql.html#APP-PSQL-META-COMMAND-PSET-PAGER
 # https://github.com/postgres/postgres/blob/REL_16_1/src/include/fe_utils/print.h#L25
 # (if "less" is available, it gets used as the default pager for psql, and it only adds ~1.5MiB to our image size)
 		less \
 	; \
 	rm -rf /var/lib/apt/lists/*
 # grab gosu for easy step-down from root
 # https://github.com/tianon/gosu/releases
 ENV GOSU_VERSION 1.17
 RUN set -eux; \
 	savedAptMark="$(apt-mark showmanual)"; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends ca-certificates wget; \
 	rm -rf /var/lib/apt/lists/*; \
 	dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
 	wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \
 	wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch.asc"; \
 	export GNUPGHOME="$(mktemp -d)"; \
 	gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4; \
 	gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu; \
 	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc; \
 	apt-mark auto '.*' > /dev/null; \
 	[ -z "$savedAptMark" ] || apt-mark manual $savedAptMark > /dev/null; \
 	apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; \
 	chmod +x /usr/local/bin/gosu; \
 	gosu --version; \
 	gosu nobody true
 # make the "en_US.UTF-8" locale so postgres will be utf-8 enabled by default
 RUN set -eux; \
 	if [ -f /etc/dpkg/dpkg.cfg.d/docker ]; then \
 # if this file exists, we're likely in "debian:xxx-slim", and locales are thus being excluded so we need to remove that exclusion (since we need locales)
 		grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
 		sed -ri '/\/usr\/share\/locale/d' /etc/dpkg/dpkg.cfg.d/docker; \
 		! grep -q '/usr/share/locale' /etc/dpkg/dpkg.cfg.d/docker; \
 	fi; \
 	apt-get update; apt-get install -y --no-install-recommends locales; rm -rf /var/lib/apt/lists/*; \
 	echo 'en_US.UTF-8 UTF-8' >> /etc/locale.gen; \
 	locale-gen; \
 	locale -a | grep 'en_US.utf8'
 ENV LANG en_US.utf8
 RUN set -eux; \
 	apt-get update; \
 	apt-get install -y --no-install-recommends \
 		libnss-wrapper \
 		xz-utils \
 		zstd \
 	; \
 	rm -rf /var/lib/apt/lists/*
 RUN mkdir /docker-entrypoint-initdb.d
 RUN set -ex; \
 # pub   4096R/ACCC4CF8 2011-10-13 [expires: 2019-07-02]
 #       Key fingerprint = B97B 0AFC AA1A 47F0 44F2  44A0 7FCC 7D46 ACCC 4CF8
 # uid                  PostgreSQL Debian Repository
 	key='B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8'; \
 	export GNUPGHOME="$(mktemp -d)"; \
 	mkdir -p /usr/local/share/keyrings/; \
 	gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"; \
 	gpg --batch --export --armor "$key" > /usr/local/share/keyrings/postgres.gpg.asc; \
 	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"
 ENV PG_MAJOR {{ env.version }}
 ENV PATH $PATH:/usr/lib/postgresql/$PG_MAJOR/bin
 ENV PG_VERSION {{ .[env.variant].version }}
 RUN set -ex; \
 	\
 # see note below about "*.pyc" files
 	export PYTHONDONTWRITEBYTECODE=1; \
 	\
 	dpkgArch="$(dpkg --print-architecture)"; \
 	aptRepo="[ signed-by=/usr/local/share/keyrings/postgres.gpg.asc ] http://apt.postgresql.org/pub/repos/apt/ {{ env.variant }}-pgdg main $PG_MAJOR"; \
 	case "$dpkgArch" in \
 		{{ .[env.variant].arches | join(" | ") }}) \
 # arches officialy built by upstream
 			echo "deb $aptRepo" > /etc/apt/sources.list.d/pgdg.list; \
 			apt-get update; \
 			;; \
 		*) \
 # we're on an architecture upstream doesn't officially build for
 # let's build binaries from their published source packages
 			echo "deb-src $aptRepo" > /etc/apt/sources.list.d/pgdg.list; \
 			\
 			savedAptMark="$(apt-mark showmanual)"; \
 			\
 			tempDir="$(mktemp -d)"; \
 			cd "$tempDir"; \
 			\
 # create a temporary local APT repo to install from (so that dependency resolution can be handled by APT, as it should be)
 			apt-get update; \
 			apt-get install -y --no-install-recommends dpkg-dev; \
 			echo "deb [ trusted=yes ] file://$tempDir ./" > /etc/apt/sources.list.d/temp.list; \
 			_update_repo() { \
 				dpkg-scanpackages . > Packages; \
 # work around the following APT issue by using "Acquire::GzipIndexes=false" (overriding "/etc/apt/apt.conf.d/docker-gzip-indexes")
 #   Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
 #   ...
 #   E: Failed to fetch store:/var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages  Could not open file /var/lib/apt/lists/partial/_tmp_tmp.ODWljpQfkE_._Packages - open (13: Permission denied)
 				apt-get -o Acquire::GzipIndexes=false update; \
 			}; \
 			_update_repo; \
 			\
 # build .deb files from upstream's source packages (which are verified by apt-get)
 			nproc="$(nproc)"; \
 			export DEB_BUILD_OPTIONS="nocheck parallel=$nproc"; \
 # we have to build postgresql-common-dev first because postgresql-$PG_MAJOR shares "debian/rules" logic with it: https://salsa.debian.org/postgresql/postgresql/-/commit/f4338a0d28cf4541956bddb0f4e444ba9dba81b9
 			apt-get build-dep -y postgresql-common-dev; \
 			apt-get source --compile postgresql-common-dev; \
 			_update_repo; \
 {{ if .major == 13 then ( -}}
 # we need DEBIAN_FRONTEND on postgresql-13 for slapd ("Please enter the password for the admin entry in your LDAP directory."); see https://bugs.debian.org/929417
 			DEBIAN_FRONTEND=noninteractive \
 {{ ) else "" end -}}
 			apt-get build-dep -y "postgresql-$PG_MAJOR=$PG_VERSION"; \
 			apt-get source --compile "postgresql-$PG_MAJOR=$PG_VERSION"; \
 			\
 # we don't remove APT lists here because they get re-downloaded and removed later
 			\
 # reset apt-mark's "manual" list so that "purge --auto-remove" will remove all build dependencies
 # (which is done after we install the built packages so we don't have to redownload any overlapping dependencies)
 			apt-mark showmanual | xargs apt-mark auto > /dev/null; \
 			apt-mark manual $savedAptMark; \
 			\
 			ls -lAFh; \
 			_update_repo; \
 			grep '^Package: ' Packages; \
 			cd /; \
 			;; \
 	esac; \
 	\
 	apt-get install -y --no-install-recommends postgresql-common; \
 	sed -ri 's/#(create_main_cluster) .*$/\1 = false/' /etc/postgresql-common/createcluster.conf; \
 	apt-get install -y --no-install-recommends \
 		"postgresql-$PG_MAJOR=$PG_VERSION" \
 	; \
 {{ if .major >= 18 then ( -}}
 # https://github.com/docker-library/postgres/pull/1344#issuecomment-2936578203 (JIT is a separate package in 18+, but only supported for a subset of architectures)
 	if apt-get install -s "postgresql-$PG_MAJOR-jit" > /dev/null 2>&1; then \
 		apt-get install -y --no-install-recommends "postgresql-$PG_MAJOR-jit=$PG_VERSION"; \
 	fi; \
 {{ ) else "" end -}}
 	\
 	rm -rf /var/lib/apt/lists/*; \
 	\
 	if [ -n "$tempDir" ]; then \
 # if we have leftovers from building, let's purge them (including extra, unnecessary build deps)
 		apt-get purge -y --auto-remove; \
 		rm -rf "$tempDir" /etc/apt/sources.list.d/temp.list; \
 	fi; \
 	\
 # some of the steps above generate a lot of "*.pyc" files (and setting "PYTHONDONTWRITEBYTECODE" beforehand doesn't propagate properly for some reason), so we clean them up manually (as long as they aren't owned by a package)
 	find /usr -name '*.pyc' -type f -exec bash -c 'for pyc; do dpkg -S "$pyc" &> /dev/null || rm -vf "$pyc"; done' -- '{}' +; \
 	\
 	postgres --version
 # make the sample config easier to munge (and "correct by default")
 RUN set -eux; \
 	dpkg-divert --add --rename --divert "/usr/share/postgresql/postgresql.conf.sample.dpkg" "/usr/share/postgresql/$PG_MAJOR/postgresql.conf.sample"; \
 	cp -v /usr/share/postgresql/postgresql.conf.sample.dpkg /usr/share/postgresql/postgresql.conf.sample; \
 	ln -sv ../postgresql.conf.sample "/usr/share/postgresql/$PG_MAJOR/"; \
 	sed -ri "s!^#?(listen_addresses)\s*=\s*\S+.*!\1 = '*'!" /usr/share/postgresql/postgresql.conf.sample; \
 	grep -F "listen_addresses = '*'" /usr/share/postgresql/postgresql.conf.sample
 RUN install --verbose --directory --owner postgres --group postgres --mode 3777 /var/run/postgresql
 {{ if .major >= 18 then ( -}}
 #
 # NOTE: in 18+, PGDATA has changed to match the pg_ctlcluster standard directory structure, and the VOLUME has moved from /var/lib/postgresql/data to /var/lib/postgresql
 #
 ENV PGDATA /var/lib/postgresql/{{ .major | tostring }}/docker
 RUN ln -svT . /var/lib/postgresql/data # https://github.com/docker-library/postgres/pull/1259#issuecomment-2215477494
 VOLUME /var/lib/postgresql
 # ("/var/lib/postgresql" is already pre-created with suitably usable permissions above)
 {{ ) else ( -}}
 ENV PGDATA /var/lib/postgresql/data
 # this 1777 will be replaced by 0700 at runtime (allows semi-arbitrary "--user" values)
 RUN install --verbose --directory --owner postgres --group postgres --mode 1777 "$PGDATA"
 VOLUME /var/lib/postgresql/data
 {{ ) end -}}
 COPY docker-entrypoint.sh docker-ensure-initdb.sh /usr/local/bin/
 RUN ln -sT docker-ensure-initdb.sh /usr/local/bin/docker-enforce-initdb.sh
 ENTRYPOINT ["docker-entrypoint.sh"]
 # We set the default STOPSIGNAL to SIGINT, which corresponds to what PostgreSQL
 # calls "Fast Shutdown mode" wherein new connections are disallowed and any
 # in-progress transactions are aborted, allowing PostgreSQL to stop cleanly and
 # flush tables to disk.
 #
 # See https://www.postgresql.org/docs/current/server-shutdown.html for more details
 # about available PostgreSQL server shutdown signals.
 #
 # See also https://www.postgresql.org/docs/current/server-start.html for further
 # justification of this as the default value, namely that the example (and
 # shipped) systemd service files use the "Fast Shutdown mode" for service
 # termination.
 #
 STOPSIGNAL SIGINT
 #
 # An additional setting that is recommended for all users regardless of this
 # value is the runtime "--stop-timeout" (or your orchestrator/runtime's
 # equivalent) for controlling how long to wait between sending the defined
 # STOPSIGNAL and sending SIGKILL.
 #
 # The default in most runtimes (such as Docker) is 10 seconds, and the
 # documentation at https://www.postgresql.org/docs/current/server-start.html notes
 # that even 90 seconds may not be long enough in many instances.
 EXPOSE 5432
 CMD ["postgres"]
@@ -0,0 +1 @@
 console.log("Hello World!");
@@ -0,0 +1,23 @@
 version: v0.11.0
 identity:
  schemas:
    - id: default
      url: file:///etc/config/kratos/identity.schema.json
 dsn: postgres://postgres:secret@kratos-postgres:5432/kratos?sslmode=disable
 serve:
  public:
    base_url: http://localhost:4433/
    cors:
      enabled: true
  admin:
    base_url: http://localhost:4434/
 selfservice:
  default_browser_return_url: http://localhost:3000/
  flows:
    login: {}
    registration: {}
  methods:
    password:
      enabled: true
 log:
  level: debug
@@ -1,20 +1,18 @@
 {
-  "name": "api",
+  "name": "auth",
  "version": "1.0.0",
  "description": "",
  "main": "src/index.js",
  "scripts": {
-    "dev": "nodemon --exec tsx src/index.ts",
+    "test": "echo \"Error: no test specified\" && exit 1",
-    "start": "node --import tsx src/index.ts",
+    "build": "turbo run build"
    "build": "tsc",
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "packageManager": "pnpm@10.13.1",
  "dependencies": {
-    "@ory/client": "^1.15.0",
+    "@ory/client-fetch": "^1.21.0",
    "apollo-server-express": "^3.13.0",
    "express": "^5.1.0",
    "graphql": "^16.11.0"
@@ -24,7 +22,6 @@
    "@types/node": "^20.19.7",
    "nodemon": "^3.1.10",
    "ts-node": "^10.9.2",
    "tsx": "^4.19.0",
    "typescript": "^5.8.3"
  }
 }
@@ -1,5 +0,0 @@
 export {
  kratosSessionMiddleware,
  requireAuth,
  type AuthenticatedRequest,
 } from "../middleware/kratosSession";
@@ -1,74 +0,0 @@
 import express from "express";
 import { ApolloServer } from "apollo-server-express";
 import {
  kratosSessionMiddleware,
  AuthenticatedRequest,
 } from "./middleware/kratosSession";
 const typeDefs = `
  type User {
    id: ID!
    email: String
    firstName: String
    lastName: String
  }
  type Query {
    me: User
    hello: String!
  }
 `;
 interface Traits {
  email?: string;
  name?: {
    first?: string;
    last?: string;
  };
 }
 const resolvers = {
  Query: {
    hello: () => "Hello from Lightsaver API!",
    me: (_: unknown, __: unknown, context: { req: AuthenticatedRequest }) => {
      const { session } = context.req;
      if (!session || !session.identity) {
        return null;
      }
      const traits = session.identity.traits as Traits;
      return {
        id: session.identity.id,
        email: traits.email,
        firstName: traits.name?.first,
        lastName: traits.name?.last,
      };
    },
  },
 };
 async function startServer() {
  const app = express();
  app.use(kratosSessionMiddleware);
  const server = new ApolloServer({
    typeDefs,
    resolvers,
    context: ({ req }: { req: AuthenticatedRequest }) => ({ req }),
  });
  await server.start();
  server.applyMiddleware({ app, path: "/graphql" });
  const port = process.env.PORT || 4000;
  app.listen(port, () => {
    console.log(`Server running at http://localhost:${port}/graphql`);
  });
 }
 startServer().catch(console.error);
@@ -1,55 +0,0 @@
 import { Request, Response, NextFunction } from "express";
 import { Configuration, FrontendApi, Session } from "@ory/client";
 const kratosAdminUrl = process.env.KRATOS_ADMIN_URL || "http://localhost:4434";
 const kratosClient = new FrontendApi(
  new Configuration({
    basePath: kratosAdminUrl,
  })
 );
 export interface AuthenticatedRequest extends Request {
  session?: Session;
  userId?: string;
 }
 export async function kratosSessionMiddleware(
  req: AuthenticatedRequest,
  res: Response,
  next: NextFunction
 ): Promise<void> {
  const cookie = req.headers.cookie;
  if (!cookie) {
    next();
    return;
  }
  try {
    const { data: session } = await kratosClient.toSession({
      cookie,
    });
    req.session = session;
    req.userId = session.identity?.id;
  } catch (error) {
    // Session invalid or expired - continue without session
    console.debug("No valid session found:", error);
  }
  next();
 }
 export function requireAuth(
  req: AuthenticatedRequest,
  res: Response,
  next: NextFunction
 ): void {
  if (!req.session || !req.userId) {
    res.status(401).json({ error: "Unauthorized" });
    return;
  }
  next();
 }
@@ -0,0 +1,114 @@
 {
  "compilerOptions": {
    /* Visit https://aka.ms/tsconfig to read more about this file */
    /* Projects */
    // "incremental": true,                              /* Save .tsbuildinfo files to allow for incremental compilation of projects. */
    // "composite": true,                                /* Enable constraints that allow a TypeScript project to be used with project references. */
    // "tsBuildInfoFile": "./.tsbuildinfo",              /* Specify the path to .tsbuildinfo incremental compilation file. */
    // "disableSourceOfProjectReferenceRedirect": true,  /* Disable preferring source files instead of declaration files when referencing composite projects. */
    // "disableSolutionSearching": true,                 /* Opt a project out of multi-project reference checking when editing. */
    // "disableReferencedProjectLoad": true,             /* Reduce the number of projects loaded automatically by TypeScript. */
    /* Language and Environment */
    "target": "es2024",                                  /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
    // "lib": [],                                        /* Specify a set of bundled library declaration files that describe the target runtime environment. */
    // "jsx": "preserve",                                /* Specify what JSX code is generated. */
    // "libReplacement": true,                           /* Enable lib replacement. */
    // "experimentalDecorators": true,                   /* Enable experimental support for legacy experimental decorators. */
    // "emitDecoratorMetadata": true,                    /* Emit design-type metadata for decorated declarations in source files. */
    // "jsxFactory": "",                                 /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h'. */
    // "jsxFragmentFactory": "",                         /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
    // "jsxImportSource": "",                            /* Specify module specifier used to import the JSX factory functions when using 'jsx: react-jsx*'. */
    // "reactNamespace": "",                             /* Specify the object invoked for 'createElement'. This only applies when targeting 'react' JSX emit. */
    // "noLib": true,                                    /* Disable including any library files, including the default lib.d.ts. */
    // "useDefineForClassFields": true,                  /* Emit ECMAScript-standard-compliant class fields. */
    // "moduleDetection": "auto",                        /* Control what method is used to detect module-format JS files. */
    /* Modules */
    "module": "nodenext",                                /* Specify what module code is generated. */
    // "rootDir": "./",                                  /* Specify the root folder within your source files. */
    // "moduleResolution": "node10",                     /* Specify how TypeScript looks up a file from a given module specifier. */
    // "baseUrl": "./",                                  /* Specify the base directory to resolve non-relative module names. */
    // "paths": {},                                      /* Specify a set of entries that re-map imports to additional lookup locations. */
    // "rootDirs": [],                                   /* Allow multiple folders to be treated as one when resolving modules. */
    // "typeRoots": [],                                  /* Specify multiple folders that act like './node_modules/@types'. */
    // "types": [],                                      /* Specify type package names to be included without being referenced in a source file. */
    // "allowUmdGlobalAccess": true,                     /* Allow accessing UMD globals from modules. */
    // "moduleSuffixes": [],                             /* List of file name suffixes to search when resolving a module. */
    // "allowImportingTsExtensions": true,               /* Allow imports to include TypeScript file extensions. Requires '--moduleResolution bundler' and either '--noEmit' or '--emitDeclarationOnly' to be set. */
    // "rewriteRelativeImportExtensions": true,          /* Rewrite '.ts', '.tsx', '.mts', and '.cts' file extensions in relative import paths to their JavaScript equivalent in output files. */
    // "resolvePackageJsonExports": true,                /* Use the package.json 'exports' field when resolving package imports. */
    // "resolvePackageJsonImports": true,                /* Use the package.json 'imports' field when resolving imports. */
    // "customConditions": [],                           /* Conditions to set in addition to the resolver-specific defaults when resolving imports. */
    // "noUncheckedSideEffectImports": true,             /* Check side effect imports. */
    // "resolveJsonModule": true,                        /* Enable importing .json files. */
    // "allowArbitraryExtensions": true,                 /* Enable importing files with any extension, provided a declaration file is present. */
    // "noResolve": true,                                /* Disallow 'import's, 'require's or '<reference>'s from expanding the number of files TypeScript should add to a project. */
    /* JavaScript Support */
    // "allowJs": true,                                  /* Allow JavaScript files to be a part of your program. Use the 'checkJS' option to get errors from these files. */
    // "checkJs": true,                                  /* Enable error reporting in type-checked JavaScript files. */
    // "maxNodeModuleJsDepth": 1,                        /* Specify the maximum folder depth used for checking JavaScript files from 'node_modules'. Only applicable with 'allowJs'. */
    /* Emit */
    // "declaration": true,                              /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
    // "declarationMap": true,                           /* Create sourcemaps for d.ts files. */
    "moduleResolution": "nodenext",                     /* Specify how TypeScript looks up a file from a given module specifier. */
    // "emitDeclarationOnly": true,                      /* Only output d.ts files and not JavaScript files. */
    // "sourceMap": true,                                /* Create source map files for emitted JavaScript files. */
    // "inlineSourceMap": true,                          /* Include sourcemap files inside the emitted JavaScript. */
    // "noEmit": true,                                   /* Disable emitting files from a compilation. */
    // "outFile": "./",                                  /* Specify a file that bundles all outputs into one JavaScript file. If 'declaration' is true, also designates a file that bundles all .d.ts output. */
    // "outDir": "./",                                   /* Specify an output folder for all emitted files. */
    // "removeComments": true,                           /* Disable emitting comments. */
    // "importHelpers": true,                            /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
    // "downlevelIteration": true,                       /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
    // "sourceRoot": "",                                 /* Specify the root path for debuggers to find the reference source code. */
    // "mapRoot": "",                                    /* Specify the location where debugger should locate map files instead of generated locations. */
    // "inlineSources": true,                            /* Include source code in the sourcemaps inside the emitted JavaScript. */
    // "emitBOM": true,                                  /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
    // "newLine": "crlf",                                /* Set the newline character for emitting files. */
    // "stripInternal": true,                            /* Disable emitting declarations that have '@internal' in their JSDoc comments. */
    // "noEmitHelpers": true,                            /* Disable generating custom helper functions like '__extends' in compiled output. */
    // "noEmitOnError": true,                            /* Disable emitting files if any type checking errors are reported. */
    // "preserveConstEnums": true,                       /* Disable erasing 'const enum' declarations in generated code. */
    // "declarationDir": "./",                           /* Specify the output directory for generated declaration files. */
    /* Interop Constraints */
    // "isolatedModules": true,                          /* Ensure that each file can be safely transpiled without relying on other imports. */
    // "verbatimModuleSyntax": true,                     /* Do not transform or elide any imports or exports not marked as type-only, ensuring they are written in the output file's format based on the 'module' setting. */
    // "isolatedDeclarations": true,                     /* Require sufficient annotation on exports so other tools can trivially generate declaration files. */
    // "erasableSyntaxOnly": true,                       /* Do not allow runtime constructs that are not part of ECMAScript. */
    // "allowSyntheticDefaultImports": true,             /* Allow 'import x from y' when a module doesn't have a default export. */
    "esModuleInterop": true,                             /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables 'allowSyntheticDefaultImports' for type compatibility. */
    // "preserveSymlinks": true,                         /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
    "forceConsistentCasingInFileNames": true,            /* Ensure that casing is correct in imports. */
    /* Type Checking */
    "strict": true,                                      /* Enable all strict type-checking options. */
    // "noImplicitAny": true,                            /* Enable error reporting for expressions and declarations with an implied 'any' type. */
    // "strictNullChecks": true,                         /* When type checking, take into account 'null' and 'undefined'. */
    // "strictFunctionTypes": true,                      /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
    // "strictBindCallApply": true,                      /* Check that the arguments for 'bind', 'call', and 'apply' methods match the original function. */
    // "strictPropertyInitialization": true,             /* Check for class properties that are declared but not set in the constructor. */
    // "strictBuiltinIteratorReturn": true,              /* Built-in iterators are instantiated with a 'TReturn' type of 'undefined' instead of 'any'. */
    // "noImplicitThis": true,                           /* Enable error reporting when 'this' is given the type 'any'. */
    // "useUnknownInCatchVariables": true,               /* Default catch clause variables as 'unknown' instead of 'any'. */
    // "alwaysStrict": true,                             /* Ensure 'use strict' is always emitted. */
    // "noUnusedLocals": true,                           /* Enable error reporting when local variables aren't read. */
    // "noUnusedParameters": true,                       /* Raise an error when a function parameter isn't read. */
    // "exactOptionalPropertyTypes": true,               /* Interpret optional property types as written, rather than adding 'undefined'. */
    // "noImplicitReturns": true,                        /* Enable error reporting for codepaths that do not explicitly return in a function. */
    // "noFallthroughCasesInSwitch": true,               /* Enable error reporting for fallthrough cases in switch statements. */
    // "noUncheckedIndexedAccess": true,                 /* Add 'undefined' to a type when accessed using an index. */
    // "noImplicitOverride": true,                       /* Ensure overriding members in derived classes are marked with an override modifier. */
    // "noPropertyAccessFromIndexSignature": true,       /* Enforces using indexed accessors for keys declared using an indexed type. */
    // "allowUnusedLabels": true,                        /* Disable error reporting for unused labels. */
    // "allowUnreachableCode": true,                     /* Disable error reporting for unreachable code. */
    /* Completeness */
    // "skipDefaultLibCheck": true,                      /* Skip type checking .d.ts files that are included with TypeScript. */
    "skipLibCheck": true                                 /* Skip type checking all .d.ts files. */
  }
 }
Author	SHA1	Message	Date
JMR-dev	b70167289f	obsidian docs	2025-07-30 19:11:28 -05:00
JMR-dev	2f951b7ad2	fix eslint vuln	2025-07-28 20:53:30 -05:00
JMR-dev	93ac66e2f8	WIP Kubernetes integration	2025-07-28 20:37:01 -05:00
JMR-dev	77a6e9b1a4	Removed uncessary GraphQL files \| Added README to auth service	2025-07-28 13:13:40 -05:00
JMR-dev	01630fd821	WIP	2025-07-28 12:58:33 -05:00
JMR-dev	caf5b4b757	make sure module resolution is correct'	2025-07-26 10:15:38 -05:00
JMR-dev	25b90382bb	package updates	2025-07-25 16:02:49 -05:00
JMR-dev	e53d44bf6b	* Updated local package * Fixed GraphQL codegen	2025-07-24 17:24:00 -05:00
JMR-dev	c33b2e09e6	adding patched dependancy	2025-07-23 20:21:36 -05:00
JMR-dev	4c76420ad9	adding login GraphQL resolver	2025-07-22 17:17:26 -05:00
JMR-dev	91afdf42b5	package adds for RabbitMQ client	2025-07-21 21:13:49 -05:00
JMR-dev	5c58c59e48	WIP on resolvers/GraphQL schema	2025-07-21 20:18:16 -05:00
JMR-dev	2b0fa4aeb8	schema WIP	2025-07-21 16:56:35 -05:00
JMR-dev	f22ccabc0d	update Dockerfile script file paths	2025-07-21 15:35:47 -05:00
JMR-dev	c1425fb3a7	file structure change	2025-07-21 15:34:31 -05:00
JMR-dev	8271c5df28	ci-cd and db infra scripting	2025-07-21 15:32:48 -05:00
JMR-dev	d21c88698a	basic login ui	2025-07-19 09:26:04 -05:00