diff --git a/.github/SECURITY.md b/.github/SECURITY.md index 7b930d4ad0..f295ec217c 100644 --- a/.github/SECURITY.md +++ b/.github/SECURITY.md @@ -2,14 +2,14 @@ ## Supported Versions -Only the latest versions of Stack Auth's server and client packages are supported. We do not provide security updates for older versions. +Only the latest versions of Hexclave's server and client packages are supported. We do not provide security updates for older versions. -If you would like to get security consulting regarding older versions of on-prem or self-hosted deployments of Stack Auth, please [contact us](mailto:team@stack-auth.com). +If you would like to get security consulting regarding older versions of on-prem or self-hosted deployments of Hexclave, please [contact us](mailto:team@hexclave.com). ## Reporting a Vulnerability -Stack Auth practices [responsible disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure). This helps us protect our users, but requires your cooperation. +Hexclave practices [responsible disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure). This helps us protect our users, but requires your cooperation. -Please disclose security vulnerabilities responsibly by emailing us at security@stack-auth.com. In this case, we will get back to you within 96 hours, and aim to get a fix released as soon as possible. We will disclose the issue publicly after at most 90 days. +Please disclose security vulnerabilities responsibly by emailing us at security@hexclave.com. In this case, we will get back to you within 96 hours, and aim to get a fix released as soon as possible. We will disclose the issue publicly after at most 90 days. Hence, we ask you not to publicize issues until the 90 days deadline is over. Also, please do not create GitHub issues with security vulnerabilities; instead, email us directly at the address above. diff --git a/.github/assets/app-shots/analytics.png b/.github/assets/app-shots/analytics.png new file mode 100644 index 0000000000..3a6e4d7a55 Binary files /dev/null and b/.github/assets/app-shots/analytics.png differ diff --git a/.github/assets/app-shots/api-keys.png b/.github/assets/app-shots/api-keys.png new file mode 100644 index 0000000000..e90526dbca Binary files /dev/null and b/.github/assets/app-shots/api-keys.png differ diff --git a/.github/assets/app-shots/authentication.png b/.github/assets/app-shots/authentication.png new file mode 100644 index 0000000000..cebf6a4d2e Binary files /dev/null and b/.github/assets/app-shots/authentication.png differ diff --git a/.github/assets/app-shots/data-vault.png b/.github/assets/app-shots/data-vault.png new file mode 100644 index 0000000000..4c6c50b8cb Binary files /dev/null and b/.github/assets/app-shots/data-vault.png differ diff --git a/.github/assets/app-shots/emails.png b/.github/assets/app-shots/emails.png new file mode 100644 index 0000000000..be621430d7 Binary files /dev/null and b/.github/assets/app-shots/emails.png differ diff --git a/.github/assets/app-shots/launch-checklist.png b/.github/assets/app-shots/launch-checklist.png new file mode 100644 index 0000000000..ebdbf58672 Binary files /dev/null and b/.github/assets/app-shots/launch-checklist.png differ diff --git a/.github/assets/app-shots/payments.png b/.github/assets/app-shots/payments.png new file mode 100644 index 0000000000..23d80c615e Binary files /dev/null and b/.github/assets/app-shots/payments.png differ diff --git a/.github/assets/app-shots/rbac.png b/.github/assets/app-shots/rbac.png new file mode 100644 index 0000000000..f802fc0d3f Binary files /dev/null and b/.github/assets/app-shots/rbac.png differ diff --git a/.github/assets/app-shots/teams.png b/.github/assets/app-shots/teams.png new file mode 100644 index 0000000000..c65e09a2f0 Binary files /dev/null and b/.github/assets/app-shots/teams.png differ diff --git a/.github/assets/app-shots/webhooks.png b/.github/assets/app-shots/webhooks.png new file mode 100644 index 0000000000..1af228bbc4 Binary files /dev/null and b/.github/assets/app-shots/webhooks.png differ diff --git a/.github/assets/comparison.png b/.github/assets/comparison.png new file mode 100644 index 0000000000..65c75c1882 Binary files /dev/null and b/.github/assets/comparison.png differ diff --git a/.github/assets/hexclave-header.svg b/.github/assets/hexclave-header.svg new file mode 100644 index 0000000000..36ad27ac5b --- /dev/null +++ b/.github/assets/hexclave-header.svg @@ -0,0 +1 @@ +Hexclave diff --git a/.github/assets/logos/analytics.png b/.github/assets/logos/analytics.png new file mode 100644 index 0000000000..d594665ab0 Binary files /dev/null and b/.github/assets/logos/analytics.png differ diff --git a/.github/assets/logos/api-keys.png b/.github/assets/logos/api-keys.png new file mode 100644 index 0000000000..9b4429d1ab Binary files /dev/null and b/.github/assets/logos/api-keys.png differ diff --git a/.github/assets/logos/authentication.png b/.github/assets/logos/authentication.png new file mode 100644 index 0000000000..9452418f87 Binary files /dev/null and b/.github/assets/logos/authentication.png differ diff --git a/.github/assets/logos/data-vault.png b/.github/assets/logos/data-vault.png new file mode 100644 index 0000000000..d66fac3135 Binary files /dev/null and b/.github/assets/logos/data-vault.png differ diff --git a/.github/assets/logos/emails.png b/.github/assets/logos/emails.png new file mode 100644 index 0000000000..7abb2f9312 Binary files /dev/null and b/.github/assets/logos/emails.png differ diff --git a/.github/assets/logos/launch-checklist.png b/.github/assets/logos/launch-checklist.png new file mode 100644 index 0000000000..38183d1431 Binary files /dev/null and b/.github/assets/logos/launch-checklist.png differ diff --git a/.github/assets/logos/payments.png b/.github/assets/logos/payments.png new file mode 100644 index 0000000000..09cc02db4e Binary files /dev/null and b/.github/assets/logos/payments.png differ diff --git a/.github/assets/logos/rbac.png b/.github/assets/logos/rbac.png new file mode 100644 index 0000000000..9f3e068ac5 Binary files /dev/null and b/.github/assets/logos/rbac.png differ diff --git a/.github/assets/logos/teams.png b/.github/assets/logos/teams.png new file mode 100644 index 0000000000..09ecf7a1f3 Binary files /dev/null and b/.github/assets/logos/teams.png differ diff --git a/.github/assets/logos/webhooks.png b/.github/assets/logos/webhooks.png new file mode 100644 index 0000000000..490a03c224 Binary files /dev/null and b/.github/assets/logos/webhooks.png differ diff --git a/.github/workflows/table-of-contents.yaml b/.github/workflows/table-of-contents.yaml index b623220bac..73958c0550 100644 --- a/.github/workflows/table-of-contents.yaml +++ b/.github/workflows/table-of-contents.yaml @@ -22,4 +22,4 @@ jobs: - uses: technote-space/toc-generator@9e238e7974de5fcf7b17b7acc54c896160dda0a3 # v4 with: TOC_TITLE: "" - TARGET_PATHS: "README*.md,CONTRIBUTING.md" + TARGET_PATHS: "CONTRIBUTING.md" diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 13d47e61ed..65eedc4f98 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,8 +1,8 @@ -# Contributing to Stack Auth +# Contributing to Hexclave -Welcome to Stack Auth! +Welcome to Hexclave! -Due to the nature of authentication, this may not be the easiest project to contribute to, so if you are looking for projects to help gain programming experience, we may not be a great match. If you're looking for projects for beginners, check out [Awesome First PR Opportunities](https://github.com/MunGell/awesome-for-beginners). +Due to the nature of user infrastructure, this may not be the easiest project to contribute to, so if you are looking for projects to help gain programming experience, we may not be a great match. If you're looking for projects for beginners, check out [Awesome First PR Opportunities](https://github.com/MunGell/awesome-for-beginners). ## Table of contents @@ -19,18 +19,18 @@ Due to the nature of authentication, this may not be the easiest project to cont ## How to contribute -If you think Stack Auth is a good fit for you, follow these steps: +If you think Hexclave is a good fit for you, follow these steps: -1. Join [our Discord](https://discord.stack-auth.com) -2. [Use Stack Auth](https://docs.stack-auth.com/). The best way to understand the project is to use it. Build an application on top of Stack Auth, and post it on GitHub or write a blog post about how you built it. This also lets us assess your skills and understand where you could best help the project. +1. Join [our Discord](https://discord.hexclave.com) +2. [Use Hexclave](https://docs.hexclave.com/). The best way to understand the project is to use it. Build an application on top of Hexclave, and post it on GitHub or write a blog post about how you built it. This also lets us assess your skills and understand where you could best help the project. 3. Give us feedback on Discord or GitHub; let us know where you got stuck, and which things you wish were easier. (We appreciate contributions most when they solve problems the authors encountered themselves in real usage.) -4. Contribute to the [documentation](https://docs.stack-auth.com) and create examples & guides. This way, you can share your knowledge and expertise with everyone else who's just getting started. -5. Only then, start [contributing to the codebase](README.md#-development--contribution). Coordinate with us on Discord beforehand to ensure we are not working on the same thing already, and to make sure a task is not more difficult than it seems. +4. Contribute to the [documentation](https://docs.hexclave.com) and create examples & guides. This way, you can share your knowledge and expertise with everyone else who's just getting started. +5. Only then, start [contributing to the codebase](README.md#contributing). Coordinate with us on Discord beforehand to ensure we are not working on the same thing already, and to make sure a task is not more difficult than it seems. ## Security & bug bounties -For any security-related concerns & bug bounties, please email us at [security@stack-auth.com](mailto:security@stack-auth.com). +For any security-related concerns & bug bounties, please email us at [security@hexclave.com](mailto:security@hexclave.com). ## Vibecoding setup @@ -47,7 +47,7 @@ For vibecoding, it can help to have multiple parallel copies of the codebase ope eval "$(/path/to/direnv hook )" eval "$(/path/to/direnv export )" ``` -3. Now, create a `.envrc` file in the root of Stack Auth's codebase with the following content: +3. Now, create a `.envrc` file in the root of Hexclave's codebase with the following content: ```sh # .envrc # make sure to install direnv and add it to your shell rc file (e.g. ~/.bashrc or ~/.zshrc) diff --git a/README.md b/README.md index 32f2d87400..b560db755c 100644 --- a/README.md +++ b/README.md @@ -1,196 +1,181 @@ -[![Stack Logo](/.github/assets/logo.png)](https://stack-auth.com) +
-

- ๐Ÿ“˜ Docs - | โ˜๏ธ Hosted Version - | โœจ Demo - | ๐ŸŽฎ Discord -

+Hexclave -# Stack Auth: The open-source auth platform +
-Stack Auth is a managed user authentication solution. It is developer-friendly and fully open-source (licensed under MIT and AGPL). +**The user infrastructure platform.** -Stack Auth gets you started in just five minutes, after which you'll be ready to use all of its features as you grow your project. Our managed service is completely optional and you can export your user data and self-host, for free, at any time. +Hexclave handles everything around your users: authentication, teams, +payments, emails, analytics, and much more. Start in minutes on the hosted +cloud. Your data is always yours to export and self-host. -We support Next.js, React, and JavaScript frontends, along with any backend that can use our [REST API](https://docs.stack-auth.com/api/overview). Check out our [setup guide](https://docs.stack-auth.com/docs/next/getting-started/setup) to get started. +[Website](https://hexclave.com) ยท [Docs](https://docs.hexclave.com) ยท [Dashboard](https://app.hexclave.com) ยท [Discord](https://discord.hexclave.com) + +![License](https://img.shields.io/badge/license-MIT%20%2F%20AGPLv3-blue) +![SDKs](https://img.shields.io/badge/SDKs-Next.js%20%C2%B7%20React%20%C2%B7%20JS-black) +![Deploy](https://img.shields.io/badge/deploy-Cloud%20or%20self--hosted-success) -
-Stack Auth Setup
-## Table of contents +--- - - +
+ Where Hexclave fits in the infrastructure stack +
-- [How is this different from X?](#how-is-this-different-from-x) -- [โœจ Features](#-features) -- [๐Ÿ“ฆ Installation & Setup](#-installation--setup) -- [๐ŸŒฑ Some community projects built with Stack Auth](#-some-community-projects-built-with-stack-auth) - - [Templates](#templates) - - [Examples](#examples) -- [๐Ÿ— Development & Contribution](#-development--contribution) - - [Requirements](#requirements) - - [Setup](#setup) - - [Useful commands](#useful-commands) -- [โค Contributors](#-contributors) +## Get started - +Setting up Hexclave is one prompt. Paste this into your coding agent of choice: -## How is this different from X? +```text +Read skill.hexclave.com and help me setup hexclave in this project +``` -Ask yourself about `X`: +## What's included -- Is `X` open-source? -- Is `X` developer-friendly, well-documented, and lets you get started in minutes? -- Besides authentication, does `X` also do authorization and user management (see feature list below)? +Hexclave ships as a catalog of apps you switch on as your product needs them. +Each one is built on the same user model, and new apps land regularly. -If you answered "no" to any of these questions, then that's how Stack Auth is different from `X`. + + + +
-## โœจ Features +###   Authentication -To get notified first when we add new features, please subscribe to [our newsletter](https://stack-auth.beehiiv.com/subscribe). +Authentication that just works with passkeys, OAuth, and CLI auth. Drop in one component and ship the whole flow; auth methods toggle from the dashboard with no code changes needed. -| | | -|-|:-:| -|

`` and ``

Authentication components that support OAuth, password credentials, and magic links, with shared development keys to make setup faster. All components support dark/light modes. | Sign-in component | -|

Idiomatic Next.js APIs

We build on server components, React hooks, and route handlers. | ![Dark/light mode](.github/assets/components.png) | -|

User dashboard

Dashboard to filter, analyze, and edit users. Replaces the first internal tool you would have to build. | ![User dashboard](.github/assets/dashboard.png) | -|

Account settings

Lets users update their profile, verify their e-mail, or change their password. No setup required. | Account settings component | -|

Multi-tenancy & teams

Manage B2B customers with an organization structure that makes sense and scales to millions. | Selected team switcher component | -|

Role-based access control

Define an arbitrary permission graph and assign it to users. Organizations can create org-specific roles. | RBAC | -|

OAuth Connections

Beyond login, Stack Auth can also manage access tokens for third-party APIs, such as Outlook and Google Calendar. It handles refreshing tokens and controlling scope, making access tokens accessible via a single function call. | OAuth tokens | -|

Passkeys

Support for passwordless authentication using passkeys, allowing users to sign in securely with biometrics or security keys across all their devices. | OAuth tokens | -|

Impersonation

Impersonate users for debugging and support, logging into their account as if you were them. | Webhooks | -|

Webhooks

Get notified when users use your product, built on Svix. | Webhooks | -|

Automatic emails

Send customizable emails on triggers such as sign-up, password reset, and email verification, editable with a WYSIWYG editor. | Email templates | -|

User session & JWT handling

Stack Auth manages refresh and access tokens, JWTs, and cookies, resulting in the best performance at no implementation cost. | User button | -|

M2M authentication

Use short-lived access tokens to authenticate your machines to other machines. | M2M authentication | +
+Authentication +
+ + + +
-## ๐Ÿ“ฆ Installation & Setup +###   Teams -To install Stack Auth in your Next.js project (for React, JavaScript, or other frameworks, see our [complete documentation](https://docs.stack-auth.com)): +Build for teams, not just users, with workspaces, email invites, and roles that actually gate the work. The workspace switcher remembers selection, invites auto sign up new users, and permissions hold up under audit. -1. Run Stack Auth's installation wizard with the following command: - ```bash - npx @stackframe/stack-cli@latest init - ``` + +Teams +
-2. Then, create an account on the [Stack Auth dashboard](https://app.stack-auth.com/projects), create a new project with an API key, and copy its environment variables into the .env.local file of your Next.js project: - ``` - NEXT_PUBLIC_STACK_PROJECT_ID= - NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY= - STACK_SECRET_SERVER_KEY= - ``` -3. That's it! You can run your app with `npm run dev` and go to [http://localhost:3000/handler/signup](http://localhost:3000/handler/signup) to see the sign-up page. You can also check out the account settings page at [http://localhost:3000/handler/account-settings](http://localhost:3000/handler/account-settings). + + + +
-Check out the [documentation](https://docs.stack-auth.com/getting-started/setup) for a more detailed guide. +###   RBAC -## ๐ŸŒฑ Some community projects built with Stack Auth +Permissions, sorted: roles that nest and one permission check that works the same on server or client. Define them in the dashboard, check them anywhere in your code. -Have your own? Happy to feature it if you create a PR or message us on [Discord](https://discord.stack-auth.com). + +RBAC +
-### Templates -- [Stack Auth Template by Stack Auth Team](https://github.com/hexclave/stack-auth-template) -- [Next SaaSkit by wolfgunblood](https://github.com/wolfgunblood/nextjs-saaskit) -- [SaaS Boilerplate by Robin Faraj](https://github.com/robinfaraj/saas-boilerplate) + + + +
-### Examples -- [Stack Auth Example by career-tokens](https://github.com/career-tokens/StackYCAuth) -- [Stack Auth Demo by the Stack Auth team](https://github.com/hexclave/stack-auth/tree/dev/examples/demo) -- [Stack Auth E-Commerce Example by the Stack Auth team](https://github.com/hexclave/stack-auth/tree/dev/examples/e-commerce) +###   API Keys -## ๐Ÿ— Development & Contribution +API keys without the footguns: leaked keys get auto-revoked, work for users and teams, and show the full secret only once. We never keep the plaintext after creation. -This is for you if you want to contribute to the Stack Auth project or run the Stack Auth dashboard locally. + +API Keys +
-**Important**: Please read the [contribution guidelines](CONTRIBUTING.md) carefully and join [our Discord](https://discord.stack-auth.com) if you'd like to help. + + + +
-### Requirements +###   Payments -- Node v20 -- pnpm v9 -- Docker +Payments without the plumbing for subscriptions, one-time charges, and usage metering with credits. Bill a person or a whole team with one model, no separate codepath. -### Setup + +Payments +
-Note: 24GB+ of RAM is recommended for a smooth development experience. + + + +
-In a new terminal: +###   Emails -```sh -pnpm install +Email that delivers and tells you so, handling transactional and marketing sends from one API. Edit templates with an AI editor, theme once, and track every open and click. -# Build the packages and generate code. We only need to do this once, as `pnpm dev` will do this from now on -pnpm build:packages -pnpm codegen + +Emails +
-# Start the dependencies (DB, Inbucket, etc.) as Docker containers, seeding the DB with the Prisma schema -# Make sure you have Docker (or OrbStack) installed and running -pnpm restart-deps + + + +
-# Start the dev server -pnpm dev +###   Analytics -# In a different terminal, run tests in watch mode -pnpm test # useful: --no-watch (disables watch mode) and --bail 1 (stops after the first failure) -``` +Know your users with no data stack required, with live active user counts and session replays out of the box. Ask in plain English to build dashboards or write SQL to save queries, all with one flag enabled. -You can now open the dev launchpad at [http://localhost:8100](http://localhost:8100). From there, you can navigate to the dashboard at [http://localhost:8101](http://localhost:8101), API on port 8102, demo on port 8103, docs on port 8104, Inbucket (e-mails) on port 8105, and Prisma Studio on port 8106. See the dev launchpad for a list of all running services. + +Analytics +
-Your IDE may show an error on all `@stackframe/XYZ` imports. To fix this, simply restart the TypeScript language server; for example, in VSCode you can open the command palette (Ctrl+Shift+P) and run `Developer: Reload Window` or `TypeScript: Restart TS server`. + + + +
-Pre-populated .env files for the setup below are available and used by default in `.env.development` in each of the packages. However, if you're creating a production build (eg. with `pnpm run build`), you must supply the environment variables manually (see below). +###   Webhooks -### Useful commands +React to every user event in real time with signed, tamper-proof webhooks. Retries and backoff are handled for you; verify in five lines and manage endpoints from the dashboard. -```sh -# NOTE: -# Please see the dev launchpad (default: http://localhost:8100) for a list of all running services. + +Webhooks +
-# Installation commands -pnpm install: Installs dependencies + + + +
-# Types & linting commands -pnpm typecheck: Runs the TypeScript type checker. May require a build or dev server to run first. -pnpm lint: Runs the ESLint linter. Optionally, pass `--fix` to fix some of the linting errors. May require a build or dev server to run first. +###   Data Vault -# Build commands -pnpm build: Builds all projects, including apps, packages, examples, and docs. Also runs code-generation tasks. Before you can run this, you will have to copy all `.env.development` files in the folders to `.env.production.local` or set the environment variables manually. -pnpm build:packages: Builds all the npm packages. -pnpm codegen: Runs all the code-generation tasks, eg. Prisma client and OpenAPI docs generation. +A safe for the secrets your users hand you, locked with your secret so we never see the plaintext. Store and retrieve tokens in two lines each, server-only by design. -# Development commands -pnpm dev: Runs the development servers of the main projects, excluding most examples. On the first run, requires the packages to be built and codegen to be run. After that, it will watch for file changes (including those in code-generation files). If you have to restart the development server for anything, that is a bug that you can report. -pnpm dev:full: Runs the development servers for all projects, including examples. -pnpm dev:basic: Runs the development servers only for the necessary services (backend and dashboard). Not recommended for most users, upgrade your machine instead. + +Data Vault +
-# Environment commands -pnpm start-deps: Starts the Docker dependencies (DB, Inbucket, etc.) as Docker containers, and initializes them with the seed script & migrations. Note: The started dependencies will be visible on the dev launchpad (port 8100 by default). -pnpm stop-deps: Stops the Docker dependencies (DB, Inbucket, etc.) and deletes the data on them. -pnpm restart-deps: Stops and starts the dependencies. + + + +
-# Database commands -pnpm db:migration-gen: Currently not used. Please generate Prisma migrations manually (or with AI). -pnpm db:reset: Resets the database to the initial state. Run automatically by `pnpm start-deps`. -pnpm db:init: Initializes the database with the seed script & migrations. Run automatically by `pnpm db:reset`. -pnpm db:seed: Re-seeds the database with the seed script. Run automatically by `pnpm db:init`. -pnpm db:migrate: Runs the migrations. Run automatically by `pnpm db:init`. +###   Launch Checklist -# Testing commands -pnpm test : Runs the tests. Pass `--bail 1` to make the test only run until the first failure. Pass `--no-watch` to run the tests once instead of in watch mode. +Run through the must-do checks before flipping to production: domain setup, callbacks locked, secrets rotated. The progress tracker keeps your team aligned so nothing critical slips through on launch day. -# Various commands -pnpm explain-query: Paste a SQL query to get an explanation of the query plan, helping you debug performance issues. -pnpm verify-data-integrity: Verify the integrity of the data in the database by running a bunch of integrity checks. This should never fail at any point in time (unless you messed with the DB manually). -``` + +Launch Checklist +
+ +## Contributing -Note: When working with AI, you should keep a terminal tab with the dev server open so the AI can run queries against it. +Hexclave is open source, and contributions are welcome. Read +[`CONTRIBUTING.md`](./CONTRIBUTING.md) to get started, and say hello in +[Discord](https://discord.hexclave.com) before picking up anything large. +Found a security issue? Email security@hexclave.com. ## โค Contributors - + Contributors