gemstack-cli 0.2.5 → 0.3.0

data/templates/auth/app/serializers/api_token_serializer.rb

@@ -1,6 +0,0 @@
-# frozen_string_literal: true
-
-class ApiTokenSerializer < ApplicationSerializer
-  model AuthToken
-  attributes :id, :name, :last_used_at, :expires_at, :created_at
-end

data/templates/auth/app/serializers/new_api_token_serializer.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-# The response to creating an API token: the only time the token itself is shown.
-class NewApiTokenSerializer < ApplicationSerializer
-  Result = Data.define(:token, :api_token)
-
-  attribute :token, :string
-  attribute :api_token, ApiTokenSerializer
-end

data/templates/auth/app/serializers/user_serializer.rb

@@ -1,6 +0,0 @@
-# frozen_string_literal: true
-
-# What the API shows about the signed-in user. Never add password_digest.
-class UserSerializer < ApplicationSerializer
-  attributes :id, :email, :email_verified_at, :created_at
-end

data/templates/auth/db/migrations/%timestamp%_create_auth_tables.rb

@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-# Tables used by GemStack::Auth (docs/authentication.md).
-Sequel.migration do
-  change do
-    create_table(:users) do
-      primary_key :id, type: :Bignum
-      String :email, null: false, unique: true # stored lowercased
-      String :password_digest, null: false     # Argon2id
-      column :email_verified_at, :timestamptz
-      column :created_at, :timestamptz, null: false
-      column :updated_at, :timestamptz, null: false
-    end
-
-    # One row per signed-in browser; the cookie holds a random token, the
-    # table only its SHA-256 digest.
-    create_table(:sessions) do
-      primary_key :id, type: :Bignum
-      foreign_key :user_id, :users, type: :Bignum, null: false, on_delete: :cascade, index: true
-      String :token_digest, size: 64, null: false, unique: true
-      column :ip, :inet
-      String :user_agent
-      column :created_at, :timestamptz, null: false
-      column :last_seen_at, :timestamptz, null: false
-      column :expires_at, :timestamptz, null: false, index: true
-    end
-
-    # API tokens, password reset and email verification tokens (digests only).
-    create_table(:auth_tokens) do
-      primary_key :id, type: :Bignum
-      foreign_key :user_id, :users, type: :Bignum, null: false, on_delete: :cascade, index: true
-      String :purpose, size: 30, null: false
-      String :token_digest, size: 64, null: false, unique: true
-      String :name
-      String :email
-      column :created_at, :timestamptz, null: false
-      column :last_used_at, :timestamptz
-      column :expires_at, :timestamptz
-    end
-  end
-end

data/templates/auth/frontend/app/account/page.tsx

@@ -1,116 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useRouter } from "next/navigation";
-import { useState, type FormEvent } from "react";
-import {
-  errorMessage,
-  useApiTokens,
-  useCreateApiToken,
-  useCurrentUser,
-  useLogout,
-  useResendVerification,
-  useRevokeApiToken,
-} from "@/lib/auth";
-
-export default function AccountPage() {
-  const router = useRouter();
-  const { data: user, isPending } = useCurrentUser();
-  const logout = useLogout();
-  const resend = useResendVerification();
-
-  if (isPending) return <main className="page muted">Loading…</main>;
-  if (!user) {
-    return (
-      <main className="page">
-        <h1>Account</h1>
-        <p>
-          You are signed out. <Link href="/login">Log in</Link> or <Link href="/signup">sign up</Link>.
-        </p>
-      </main>
-    );
-  }
-
-  return (
-    <main className="page">
-      <div className="page-header">
-        <h1>Account</h1>
-        <button className="button" onClick={() => logout.mutate(undefined, { onSuccess: () => router.push("/login") })}>
-          Log out
-        </button>
-      </div>
-      <dl className="card">
-        <dt>Email</dt>
-        <dd>
-          {user.email}{" "}
-          {user.email_verified_at ? (
-            <span className="muted">(confirmed)</span>
-          ) : (
-            <button className="button" disabled={resend.isPending || resend.isSuccess} onClick={() => resend.mutate()}>
-              {resend.isSuccess ? "Email sent" : "Resend confirmation email"}
-            </button>
-          )}
-        </dd>
-        <dt>Member since</dt>
-        <dd>{new Date(user.created_at).toLocaleDateString()}</dd>
-      </dl>
-      <ApiTokens />
-    </main>
-  );
-}
-
-function ApiTokens() {
-  const tokens = useApiTokens();
-  const create = useCreateApiToken();
-  const revoke = useRevokeApiToken();
-  const [name, setName] = useState("");
-
-  function handleSubmit(event: FormEvent<HTMLFormElement>) {
-    event.preventDefault();
-    create.mutate(name, { onSuccess: () => setName("") });
-  }
-
-  return (
-    <section>
-      <h2>API tokens</h2>
-      <p className="muted">
-        For scripts and other services: send <code>Authorization: Bearer &lt;token&gt;</code>.
-      </p>
-      {create.data && (
-        <p className="status status-ok">
-          <span className="dot" />
-          Copy your new token now — it won&apos;t be shown again: <code>{create.data.token}</code>
-        </p>
-      )}
-      <form className="form" onSubmit={handleSubmit}>
-        <label className="field">
-          Name
-          <input required maxLength={100} value={name} onChange={(e) => setName(e.target.value)} placeholder="CI" />
-        </label>
-        {create.error && <p className="form-error">{errorMessage(create.error)}</p>}
-        <div className="actions">
-          <button className="button" type="submit" disabled={create.isPending}>
-            Create token
-          </button>
-        </div>
-      </form>
-      <table className="table">
-        <tbody>
-          {tokens.data?.map((token) => (
-            <tr key={token.id}>
-              <td>{token.name}</td>
-              <td className="muted">
-                {token.last_used_at ? `used ${new Date(token.last_used_at).toLocaleString()}` : "never used"}
-              </td>
-              <td>
-                <button className="button button-danger" onClick={() => revoke.mutate(token.id)}>
-                  Revoke
-                </button>
-              </td>
-            </tr>
-          ))}
-        </tbody>
-      </table>
-    </section>
-  );
-}

data/templates/auth/frontend/app/forgot-password/page.tsx

@@ -1,48 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useState, type FormEvent } from "react";
-import { errorMessage, useForgotPassword } from "@/lib/auth";
-
-export default function ForgotPasswordPage() {
-  const [email, setEmail] = useState("");
-  const forgot = useForgotPassword();
-
-  function handleSubmit(event: FormEvent<HTMLFormElement>) {
-    event.preventDefault();
-    forgot.mutate(email);
-  }
-
-  if (forgot.isSuccess) {
-    return (
-      <main className="page">
-        <h1>Check your email</h1>
-        <p>If an account exists for {email}, we sent it a link to choose a new password.</p>
-        <Link href="/login">Back to log in</Link>
-      </main>
-    );
-  }
-
-  const message = errorMessage(forgot.error);
-  return (
-    <main className="page">
-      <h1>Reset your password</h1>
-      <form className="form" onSubmit={handleSubmit}>
-        <label className="field">
-          Email
-          <input type="email" autoComplete="email" required value={email} onChange={(e) => setEmail(e.target.value)} />
-        </label>
-        {message && (
-          <p className="form-error" role="alert">
-            {message}
-          </p>
-        )}
-        <div className="actions">
-          <button className="button" type="submit" disabled={forgot.isPending}>
-            Send reset link
-          </button>
-        </div>
-      </form>
-    </main>
-  );
-}

data/templates/auth/frontend/app/login/page.tsx

@@ -1,26 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useRouter } from "next/navigation";
-import { CredentialsForm } from "@/components/auth/CredentialsForm";
-import { useLogin } from "@/lib/auth";
-
-export default function LoginPage() {
-  const router = useRouter();
-  const login = useLogin();
-
-  return (
-    <main className="page">
-      <h1>Log in</h1>
-      <CredentialsForm
-        submitLabel="Log in"
-        error={login.error}
-        pending={login.isPending}
-        onSubmit={(credentials) => login.mutate(credentials, { onSuccess: () => router.push("/account") })}
-      />
-      <p className="muted">
-        <Link href="/forgot-password">Forgot your password?</Link> · No account? <Link href="/signup">Sign up</Link>
-      </p>
-    </main>
-  );
-}

data/templates/auth/frontend/app/reset-password/page.tsx

@@ -1,11 +0,0 @@
-import { ResetPasswordForm } from "@/components/auth/ResetPasswordForm";
-
-export default async function ResetPasswordPage({ searchParams }: { searchParams: Promise<{ token?: string }> }) {
-  const { token } = await searchParams;
-  return (
-    <main className="page">
-      <h1>Choose a new password</h1>
-      {token ? <ResetPasswordForm token={token} /> : <p className="form-error">This link is missing its token.</p>}
-    </main>
-  );
-}

data/templates/auth/frontend/app/signup/page.tsx

@@ -1,27 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useRouter } from "next/navigation";
-import { CredentialsForm } from "@/components/auth/CredentialsForm";
-import { useSignup } from "@/lib/auth";
-
-export default function SignupPage() {
-  const router = useRouter();
-  const signup = useSignup();
-
-  return (
-    <main className="page">
-      <h1>Create an account</h1>
-      <CredentialsForm
-        submitLabel="Sign up"
-        newPassword
-        error={signup.error}
-        pending={signup.isPending}
-        onSubmit={(credentials) => signup.mutate(credentials, { onSuccess: () => router.push("/account") })}
-      />
-      <p className="muted">
-        Already have an account? <Link href="/login">Log in</Link>
-      </p>
-    </main>
-  );
-}

data/templates/auth/frontend/app/verify-email/page.tsx

@@ -1,11 +0,0 @@
-import { VerifyEmail } from "@/components/auth/VerifyEmail";
-
-export default async function VerifyEmailPage({ searchParams }: { searchParams: Promise<{ token?: string }> }) {
-  const { token } = await searchParams;
-  return (
-    <main className="page">
-      <h1>Confirm your email</h1>
-      {token ? <VerifyEmail token={token} /> : <p className="form-error">This link is missing its token.</p>}
-    </main>
-  );
-}

data/templates/auth/frontend/components/auth/CredentialsForm.tsx

@@ -1,58 +0,0 @@
-"use client";
-
-import { useState, type FormEvent } from "react";
-import { errorMessage, type Credentials } from "@/lib/auth";
-
-export function CredentialsForm({
-  submitLabel,
-  newPassword = false,
-  error,
-  pending,
-  onSubmit,
-}: {
-  submitLabel: string;
-  newPassword?: boolean;
-  error: unknown;
-  pending: boolean;
-  onSubmit: (credentials: Credentials) => void;
-}) {
-  const [email, setEmail] = useState("");
-  const [password, setPassword] = useState("");
-
-  function handleSubmit(event: FormEvent<HTMLFormElement>) {
-    event.preventDefault();
-    onSubmit({ email, password });
-  }
-
-  const message = errorMessage(error);
-  return (
-    <form className="form" onSubmit={handleSubmit}>
-      <label className="field">
-        Email
-        <input type="email" autoComplete="email" required value={email} onChange={(e) => setEmail(e.target.value)} />
-      </label>
-      <label className="field">
-        Password
-        <input
-          type="password"
-          autoComplete={newPassword ? "new-password" : "current-password"}
-          minLength={newPassword ? 12 : undefined}
-          required
-          value={password}
-          onChange={(e) => setPassword(e.target.value)}
-        />
-        {newPassword && <small className="muted">At least 12 characters. A few random words work well.</small>}
-      </label>
-      {message && (
-        <p className="form-error" role="alert">
-          {message}
-        </p>
-      )}
-      <div className="actions">
-        <button className="button" type="submit" disabled={pending}>
-          {pending ? "Please wait…" : submitLabel}
-        </button>
-      </div>
-    </form>
-  );
-}

data/templates/auth/frontend/components/auth/ResetPasswordForm.tsx

@@ -1,43 +0,0 @@
-"use client";
-
-import { useRouter } from "next/navigation";
-import { useState, type FormEvent } from "react";
-import { errorMessage, useResetPassword } from "@/lib/auth";
-
-export function ResetPasswordForm({ token }: { token: string }) {
-  const router = useRouter();
-  const [password, setPassword] = useState("");
-  const reset = useResetPassword();
-
-  function handleSubmit(event: FormEvent<HTMLFormElement>) {
-    event.preventDefault();
-    reset.mutate({ token, password }, { onSuccess: () => router.push("/account") });
-  }
-
-  const message = errorMessage(reset.error);
-  return (
-    <form className="form" onSubmit={handleSubmit}>
-      <label className="field">
-        New password
-        <input
-          type="password"
-          autoComplete="new-password"
-          minLength={12}
-          required
-          value={password}
-          onChange={(e) => setPassword(e.target.value)}
-        />
-      </label>
-      {message && (
-        <p className="form-error" role="alert">
-          {message}
-        </p>
-      )}
-      <div className="actions">
-        <button className="button" type="submit" disabled={reset.isPending}>
-          Save password
-        </button>
-      </div>
-    </form>
-  );
-}

data/templates/auth/frontend/components/auth/VerifyEmail.tsx

@@ -1,28 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { useEffect, useRef } from "react";
-import { errorMessage, useVerifyEmail } from "@/lib/auth";
-
-// Confirms on load. Links in emails are opened with GET, so the page posts
-// the token — a mail scanner prefetching the link can't use it up.
-export function VerifyEmail({ token }: { token: string }) {
-  const verify = useVerifyEmail();
-  const started = useRef(false);
-
-  useEffect(() => {
-    if (started.current) return;
-    started.current = true;
-    verify.mutate(token);
-  }, [token, verify]);
-
-  if (verify.isSuccess) {
-    return (
-      <p>
-        Your email address is confirmed. <Link href="/account">Continue</Link>
-      </p>
-    );
-  }
-  if (verify.isError) return <p className="form-error">{errorMessage(verify.error)}</p>;
-  return <p className="muted">Confirming…</p>;
-}

data/templates/auth/frontend/lib/auth.ts

@@ -1,113 +0,0 @@
-"use client";
-
-// Authentication hooks (generated by `gemstack add auth`). The session lives
-// in an HttpOnly cookie the browser sends automatically — JavaScript never
-// sees it, so there is no token to store or leak.
-import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { ApiError } from "@/lib/gemstack/client";
-import { apiTokens, emailVerifications, passwordResets, registrations, sessions } from "@/lib/api/generated";
-import type { SessionCreateInput, User } from "@/lib/api/generated";
-
-export const authKeys = { me: ["auth", "me"] as const, tokens: ["auth", "tokens"] as const };
-
-export type Credentials = SessionCreateInput;
-
-/** The signed-in user, or null when signed out. */
-export function useCurrentUser() {
-  return useQuery({
-    queryKey: authKeys.me,
-    queryFn: async () => {
-      try {
-        return await sessions.get();
-      } catch (error) {
-        if (error instanceof ApiError && error.status === 401) return null;
-        throw error;
-      }
-    },
-    staleTime: 60_000,
-  });
-}
-
-function useSignedIn() {
-  const queryClient = useQueryClient();
-  return (user: User) => {
-    queryClient.setQueryData(authKeys.me, user);
-    // Anything cached belonged to the previous (or no) user.
-    return queryClient.invalidateQueries({ predicate: (query) => query.queryKey[0] !== "auth" });
-  };
-}
-
-export function useLogin() {
-  const signedIn = useSignedIn();
-  return useMutation({ mutationFn: (input: Credentials) => sessions.create(input), onSuccess: signedIn });
-}
-
-export function useSignup() {
-  const signedIn = useSignedIn();
-  return useMutation({ mutationFn: (input: Credentials) => registrations.create(input), onSuccess: signedIn });
-}
-
-export function useLogout() {
-  const queryClient = useQueryClient();
-  return useMutation({
-    mutationFn: () => sessions.delete(),
-    onSuccess: () => {
-      queryClient.clear();
-      queryClient.setQueryData(authKeys.me, null);
-    },
-  });
-}
-
-export function useForgotPassword() {
-  return useMutation({ mutationFn: (email: string) => passwordResets.create({ email }) });
-}
-
-export function useResetPassword() {
-  const signedIn = useSignedIn();
-  return useMutation({
-    mutationFn: (input: { token: string; password: string }) => passwordResets.update(input),
-    onSuccess: signedIn,
-  });
-}
-
-export function useVerifyEmail() {
-  const queryClient = useQueryClient();
-  return useMutation({
-    mutationFn: (token: string) => emailVerifications.update({ token }),
-    onSuccess: () => queryClient.invalidateQueries({ queryKey: authKeys.me }),
-  });
-}
-
-export function useResendVerification() {
-  return useMutation({ mutationFn: () => emailVerifications.create() });
-}
-
-export function useApiTokens() {
-  return useQuery({ queryKey: authKeys.tokens, queryFn: () => apiTokens.list() });
-}
-
-export function useCreateApiToken() {
-  const queryClient = useQueryClient();
-  return useMutation({
-    mutationFn: (name: string) => apiTokens.create({ name }),
-    onSuccess: () => queryClient.invalidateQueries({ queryKey: authKeys.tokens }),
-  });
-}
-
-export function useRevokeApiToken() {
-  const queryClient = useQueryClient();
-  return useMutation({
-    mutationFn: (id: number) => apiTokens.delete(id),
-    onSuccess: () => queryClient.invalidateQueries({ queryKey: authKeys.tokens }),
-  });
-}
-
-/** A readable message for a failed auth request. */
-export function errorMessage(error: unknown): string | null {
-  if (!error) return null;
-  if (error instanceof ApiError) {
-    const fields = Object.entries(error.errors).map(([field, messages]) => `${field} ${messages.join(", ")}`);
-    return fields.length ? fields.join(". ") : error.message;
-  }
-  return "Something went wrong. Please try again.";
-}

data/templates/auth/test/controllers/auth_test.rb

@@ -1,108 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../test_helper"
-
-# The authentication flows generated by `gemstack add auth`.
-class AuthTest < GemStack::TestCase
-  PASSWORD = "correct horse battery staple"
-
-  def create_user(email = "ada@example.com") = User.create(email: email, password: PASSWORD)
-  def token_from(mail) = mail.text_part.decoded[/token=([\w-]+)/, 1]
-
-  def test_signup_signs_in_and_sends_a_verification_email
-    assert_emails(1) { post_json "/api/auth/signup", { email: "Ada@Example.com", password: PASSWORD } }
-
-    assert_status 201
-    assert_equal "ada@example.com", json_body["email"]
-    refute json_body.key?("password_digest")
-    assert_equal ["ada@example.com"], last_email.to
-    get_json "/api/auth/me"
-
-    assert_status 200
-  end
-
-  def test_signup_validation
-    create_user
-    post_json "/api/auth/signup", { email: "ada@example.com", password: "short" }
-
-    assert_error 422, "validation_failed"
-    assert_equal ["is already taken"], json_body["errors"]["email"]
-    assert_equal ["is too short (minimum 12 characters)"], json_body["errors"]["password"]
-  end
-
-  def test_login_me_logout
-    user = create_user
-    post_json "/api/auth/login", { email: "ADA@example.com", password: PASSWORD }
-
-    assert_status 200
-    get_json "/api/auth/me"
-
-    assert_equal user.id, json_body["id"]
-    delete_json "/api/auth/logout"
-
-    assert_status 204
-    get_json "/api/auth/me"
-
-    assert_error 401, "unauthenticated"
-  end
-
-  def test_login_failures_look_the_same
-    create_user
-    post_json "/api/auth/login", { email: "ada@example.com", password: "wrong password!" }
-    wrong_password = json_body
-    post_json "/api/auth/login", { email: "nobody@example.com", password: PASSWORD }
-
-    assert_error 401, "invalid_credentials"
-    assert_equal wrong_password["error"]["message"], json_body["error"]["message"]
-  end
-
-  def test_password_reset
-    user = create_user
-    other_device = GemStack::Auth::Sessions.create(user.id)
-    assert_emails(1) { post_json "/api/auth/password/forgot", { email: user.email } }
-
-    assert_status 202
-    post_json "/api/auth/password/reset", { token: token_from(last_email), password: "a brand new passphrase" }
-
-    assert_status 200
-    assert User.authenticate_by(email: user.email, password: "a brand new passphrase")
-    assert_nil GemStack::Auth::Sessions.find(other_device), "other sessions end"
-    post_json "/api/auth/password/reset", { token: token_from(last_email), password: "and another one!!" }
-
-    assert_error 400, "invalid_token"
-  end
-
-  def test_forgot_password_does_not_reveal_accounts
-    assert_emails(0) { post_json "/api/auth/password/forgot", { email: "nobody@example.com" } }
-
-    assert_status 202
-  end
-
-  def test_email_verification
-    user = create_user
-    sign_in_as(user)
-    assert_emails(1) { post_json "/api/auth/email/resend" }
-    post_json "/api/auth/email/verify", { token: token_from(last_email) }
-
-    assert_status 204
-    assert User[user.id].email_verified?
-  end
-
-  def test_api_tokens
-    user = create_user
-    sign_in_as(user)
-    post_json "/api/auth/tokens", { name: "CI" }
-
-    assert_status 201
-    token = json_body["token"]
-    get_json "/api/auth/me", {}, { "HTTP_AUTHORIZATION" => "Bearer #{token}" }
-
-    assert_equal user.id, json_body["id"]
-    get_json "/api/auth/tokens"
-
-    assert_equal ["CI"], json_body.map { |t| t["name"] }
-    delete_json "/api/auth/tokens/#{json_body.first["id"]}"
-
-    assert_status 204
-  end
-end

data/templates/controller/app/controllers/%file_name%_controller.rb.tt

@@ -1,10 +0,0 @@
-# frozen_string_literal: true
-
-class <%= class_name %> < ApplicationController
-<% actions.each_with_index do |action, index| -%>
-<%= "\n" if index.positive? %>  # <%= route_for(action)[0].upcase %> /api<%= route_for(action)[1] %>
-  def <%= action %>
-    render({ action: "<%= file_name %>#<%= action %>" })
-  end
-<% end -%>
-end