@assistkick/create 1.0.0

package/templates/product-system/packages/backend/src/services/password_reset_service.ts

@@ -0,0 +1,135 @@
+/**
+ * Password reset service — handles token generation, validation, and password update.
+ * Uses crypto.randomBytes for secure token generation, bcryptjs for hashing.
+ */
+
+import { randomBytes, randomUUID } from 'node:crypto';
+import { hash, compare } from 'bcryptjs';
+import { eq, and } from 'drizzle-orm';
+import { users, passwordResetTokens } from '@interview-system/shared/db/schema.js';
+import type { EmailService } from './email_service.js';
+import type { AuthService } from './auth_service.js';
+
+const TOKEN_EXPIRY_MS = 60 * 60 * 1000; // 1 hour
+const SALT_ROUNDS = 12;
+
+interface PasswordResetServiceDeps {
+  getDb: () => any;
+  emailService: EmailService;
+  authService: AuthService;
+  appBaseUrl: string;
+  log: (tag: string, ...args: any[]) => void;
+}
+
+export class PasswordResetService {
+  private readonly getDb: () => any;
+  private readonly emailService: EmailService;
+  private readonly authService: AuthService;
+  private readonly appBaseUrl: string;
+  private readonly log: (tag: string, ...args: any[]) => void;
+
+  constructor({ getDb, emailService, authService, appBaseUrl, log }: PasswordResetServiceDeps) {
+    this.getDb = getDb;
+    this.emailService = emailService;
+    this.authService = authService;
+    this.appBaseUrl = appBaseUrl;
+    this.log = log;
+  }
+
+  /**
+   * Request a password reset. Always returns success to prevent user enumeration.
+   * If the email exists, generates a token and sends a reset email.
+   */
+  requestReset = async (email: string): Promise<void> => {
+    const db = this.getDb();
+
+    const [user] = await db
+      .select({ id: users.id, email: users.email })
+      .from(users)
+      .where(eq(users.email, email.toLowerCase()));
+
+    if (!user) {
+      this.log('RESET', `Reset requested for unknown email: ${email}`);
+      return; // Silent — no user enumeration
+    }
+
+    // Generate a secure random token
+    const rawToken = randomBytes(32).toString('hex');
+    const tokenHash = await hash(rawToken, SALT_ROUNDS);
+    const now = new Date().toISOString();
+    const expiresAt = new Date(Date.now() + TOKEN_EXPIRY_MS).toISOString();
+
+    await db.insert(passwordResetTokens).values({
+      id: randomUUID(),
+      userId: user.id,
+      tokenHash,
+      expiresAt,
+      createdAt: now,
+    });
+
+    const resetUrl = `${this.appBaseUrl}/reset-password?token=${rawToken}`;
+
+    try {
+      await this.emailService.sendPasswordResetEmail(user.email, resetUrl);
+      this.log('RESET', `Reset email sent to ${user.email}`);
+    } catch (err: any) {
+      this.log('RESET', `Failed to send reset email: ${err.message}`);
+      throw new Error('Failed to send reset email');
+    }
+  };
+
+  /**
+   * Confirm a password reset — validate token and update password.
+   */
+  confirmReset = async (token: string, newPassword: string): Promise<void> => {
+    const db = this.getDb();
+    const now = new Date().toISOString();
+
+    // Get all unused, non-expired tokens
+    const candidates = await db
+      .select({
+        id: passwordResetTokens.id,
+        userId: passwordResetTokens.userId,
+        tokenHash: passwordResetTokens.tokenHash,
+        expiresAt: passwordResetTokens.expiresAt,
+      })
+      .from(passwordResetTokens)
+      .where(
+        and(
+          eq(passwordResetTokens.usedAt, null as any),
+        ),
+      );
+
+    // Find the matching token by comparing hashes
+    let matchedToken: { id: string; userId: string; expiresAt: string } | null = null;
+    for (const candidate of candidates) {
+      const isExpired = new Date(candidate.expiresAt) < new Date();
+      if (isExpired) continue;
+
+      const matches = await compare(token, candidate.tokenHash);
+      if (matches) {
+        matchedToken = { id: candidate.id, userId: candidate.userId, expiresAt: candidate.expiresAt };
+        break;
+      }
+    }
+
+    if (!matchedToken) {
+      throw new Error('Invalid or expired reset token');
+    }
+
+    // Mark token as used
+    await db
+      .update(passwordResetTokens)
+      .set({ usedAt: now })
+      .where(eq(passwordResetTokens.id, matchedToken.id));
+
+    // Hash new password and update user
+    const passwordHash = await this.authService.hashPassword(newPassword);
+    await db
+      .update(users)
+      .set({ passwordHash, updatedAt: now })
+      .where(eq(users.id, matchedToken.userId));
+
+    this.log('RESET', `Password reset completed for user ${matchedToken.userId}`);
+  };
+}

package/templates/product-system/packages/backend/src/services/project_service.test.ts

@@ -0,0 +1,215 @@
+import { describe, it, mock, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { ProjectService } from './project_service.ts';
+
+const createMockDb = () => {
+  let selectResults: any[][] = [];
+  let selectCallIndex = 0;
+
+  const db = {
+    select: mock.fn(() => ({
+      from: mock.fn(() => ({
+        where: mock.fn(() => {
+          const result = selectResults[selectCallIndex] || [];
+          selectCallIndex++;
+          return Object.assign(result, {
+            orderBy: mock.fn(() => result),
+          });
+        }),
+        orderBy: mock.fn(() => {
+          const result = selectResults[selectCallIndex] || [];
+          selectCallIndex++;
+          return result;
+        }),
+      })),
+    })),
+    insert: mock.fn(() => ({
+      values: mock.fn(() => Promise.resolve()),
+    })),
+    update: mock.fn(() => ({
+      set: mock.fn(() => ({
+        where: mock.fn(() => Promise.resolve()),
+      })),
+    })),
+    _setSelectResults: (results: any[][]) => {
+      selectResults = results;
+      selectCallIndex = 0;
+    },
+  };
+
+  return db;
+};
+
+const createService = (db: any) => {
+  return new ProjectService({
+    getDb: () => db,
+    log: mock.fn(),
+  });
+};
+
+describe('ProjectService', () => {
+  let db: ReturnType<typeof createMockDb>;
+  let service: ProjectService;
+
+  beforeEach(() => {
+    db = createMockDb();
+    service = createService(db);
+  });
+
+  describe('generateId', () => {
+    it('returns an id with proj_ prefix', () => {
+      const id = service.generateId();
+      assert.ok(id.startsWith('proj_'));
+      assert.ok(id.length > 5);
+    });
+
+    it('generates unique ids', () => {
+      const id1 = service.generateId();
+      const id2 = service.generateId();
+      assert.notEqual(id1, id2);
+    });
+  });
+
+  describe('listActive', () => {
+    it('returns active projects', async () => {
+      const mockProjects = [
+        { id: 'proj_001', name: 'Project A', isDefault: 1, archivedAt: null, createdAt: '2024-01-01T00:00:00Z', updatedAt: '2024-01-01T00:00:00Z' },
+        { id: 'proj_002', name: 'Project B', isDefault: 0, archivedAt: null, createdAt: '2024-01-02T00:00:00Z', updatedAt: '2024-01-02T00:00:00Z' },
+      ];
+      db._setSelectResults([mockProjects]);
+
+      const result = await service.listActive();
+
+      assert.equal(result.length, 2);
+      assert.equal(result[0].name, 'Project A');
+    });
+
+    it('returns empty array when no projects exist', async () => {
+      db._setSelectResults([[]]);
+
+      const result = await service.listActive();
+
+      assert.equal(result.length, 0);
+    });
+  });
+
+  describe('getById', () => {
+    it('returns project when found', async () => {
+      db._setSelectResults([[{ id: 'proj_001', name: 'Test', isDefault: 0, archivedAt: null, createdAt: '2024-01-01T00:00:00Z', updatedAt: '2024-01-01T00:00:00Z' }]]);
+
+      const result = await service.getById('proj_001');
+
+      assert.ok(result);
+      assert.equal(result.name, 'Test');
+    });
+
+    it('returns null when not found', async () => {
+      db._setSelectResults([[]]);
+
+      const result = await service.getById('proj_999');
+
+      assert.equal(result, null);
+    });
+  });
+
+  describe('create', () => {
+    it('creates a project with correct fields', async () => {
+      const result = await service.create('New Project');
+
+      assert.ok(result.id.startsWith('proj_'));
+      assert.equal(result.name, 'New Project');
+      assert.equal(result.isDefault, 0);
+      assert.equal(result.archivedAt, null);
+      assert.ok(result.createdAt);
+      assert.ok(result.updatedAt);
+      assert.equal(db.insert.mock.calls.length, 1);
+    });
+  });
+
+  describe('rename', () => {
+    it('renames an existing project', async () => {
+      db._setSelectResults([[{ id: 'proj_001', name: 'Old Name', isDefault: 0, archivedAt: null, createdAt: '2024-01-01T00:00:00Z', updatedAt: '2024-01-01T00:00:00Z' }]]);
+
+      const result = await service.rename('proj_001', 'New Name');
+
+      assert.equal(result.name, 'New Name');
+      assert.equal(db.update.mock.calls.length, 1);
+    });
+
+    it('throws when project not found', async () => {
+      db._setSelectResults([[]]);
+
+      await assert.rejects(
+        () => service.rename('proj_999', 'New Name'),
+        { message: 'Project not found' },
+      );
+    });
+  });
+
+  describe('archive', () => {
+    it('archives a non-default project', async () => {
+      db._setSelectResults([[{ id: 'proj_001', name: 'Test', isDefault: 0, archivedAt: null, createdAt: '2024-01-01T00:00:00Z', updatedAt: '2024-01-01T00:00:00Z' }]]);
+
+      const result = await service.archive('proj_001');
+
+      assert.ok(result.archivedAt);
+      assert.equal(db.update.mock.calls.length, 1);
+    });
+
+    it('throws when project not found', async () => {
+      db._setSelectResults([[]]);
+
+      await assert.rejects(
+        () => service.archive('proj_999'),
+        { message: 'Project not found' },
+      );
+    });
+
+    it('throws when archiving the default project', async () => {
+      db._setSelectResults([[{ id: 'proj_001', name: 'Default', isDefault: 1, archivedAt: null, createdAt: '2024-01-01T00:00:00Z', updatedAt: '2024-01-01T00:00:00Z' }]]);
+
+      await assert.rejects(
+        () => service.archive('proj_001'),
+        { message: 'Cannot archive the default project' },
+      );
+    });
+
+    it('throws when project is already archived', async () => {
+      db._setSelectResults([[{ id: 'proj_001', name: 'Test', isDefault: 0, archivedAt: '2024-01-01T00:00:00Z', createdAt: '2024-01-01T00:00:00Z', updatedAt: '2024-01-01T00:00:00Z' }]]);
+
+      await assert.rejects(
+        () => service.archive('proj_001'),
+        { message: 'Project is already archived' },
+      );
+    });
+  });
+
+  describe('restore', () => {
+    it('restores an archived project', async () => {
+      db._setSelectResults([[{ id: 'proj_001', name: 'Test', isDefault: 0, archivedAt: '2024-01-01T00:00:00Z', createdAt: '2024-01-01T00:00:00Z', updatedAt: '2024-01-01T00:00:00Z' }]]);
+
+      const result = await service.restore('proj_001');
+
+      assert.equal(result.archivedAt, null);
+      assert.equal(db.update.mock.calls.length, 1);
+    });
+
+    it('throws when project not found', async () => {
+      db._setSelectResults([[]]);
+
+      await assert.rejects(
+        () => service.restore('proj_999'),
+        { message: 'Project not found' },
+      );
+    });
+
+    it('throws when project is not archived', async () => {
+      db._setSelectResults([[{ id: 'proj_001', name: 'Test', isDefault: 0, archivedAt: null, createdAt: '2024-01-01T00:00:00Z', updatedAt: '2024-01-01T00:00:00Z' }]]);
+
+      await assert.rejects(
+        () => service.restore('proj_001'),
+        { message: 'Project is not archived' },
+      );
+    });
+  });
+});

package/templates/product-system/packages/backend/src/services/project_service.ts

@@ -0,0 +1,171 @@
+/**
+ * Project service — CRUD operations for projects.
+ * Projects support create, rename, archive (soft delete), and restore.
+ */
+
+import { eq, isNull } from 'drizzle-orm';
+import { projects, nodes, edges, kanban, sessions } from '@interview-system/shared/db/schema.js';
+import { randomBytes } from 'node:crypto';
+
+interface ProjectServiceDeps {
+  getDb: () => any;
+  log: (tag: string, ...args: any[]) => void;
+}
+
+export interface ProjectRecord {
+  id: string;
+  name: string;
+  isDefault: number;
+  archivedAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export class ProjectService {
+  private readonly getDb: () => any;
+  private readonly log: (tag: string, ...args: any[]) => void;
+
+  constructor({ getDb, log }: ProjectServiceDeps) {
+    this.getDb = getDb;
+    this.log = log;
+  }
+
+  generateId = (): string => {
+    const hex = randomBytes(4).toString('hex');
+    return `proj_${hex}`;
+  };
+
+  listActive = async (): Promise<ProjectRecord[]> => {
+    const db = this.getDb();
+    const rows = await db
+      .select()
+      .from(projects)
+      .where(isNull(projects.archivedAt))
+      .orderBy(projects.createdAt);
+    return rows;
+  };
+
+  getById = async (id: string): Promise<ProjectRecord | null> => {
+    const db = this.getDb();
+    const [row] = await db
+      .select()
+      .from(projects)
+      .where(eq(projects.id, id));
+    return row || null;
+  };
+
+  create = async (name: string): Promise<ProjectRecord> => {
+    const db = this.getDb();
+    const now = new Date().toISOString();
+    const id = this.generateId();
+
+    const record: ProjectRecord = {
+      id,
+      name,
+      isDefault: 0,
+      archivedAt: null,
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    await db.insert(projects).values(record);
+    this.log('PROJECTS', `Created project: ${name} (${id})`);
+    return record;
+  };
+
+  rename = async (id: string, name: string): Promise<ProjectRecord> => {
+    const db = this.getDb();
+    const existing = await this.getById(id);
+
+    if (!existing) {
+      throw new Error('Project not found');
+    }
+
+    const now = new Date().toISOString();
+    await db
+      .update(projects)
+      .set({ name, updatedAt: now })
+      .where(eq(projects.id, id));
+
+    this.log('PROJECTS', `Renamed project ${id}: "${existing.name}" → "${name}"`);
+    return { ...existing, name, updatedAt: now };
+  };
+
+  archive = async (id: string): Promise<ProjectRecord> => {
+    const db = this.getDb();
+    const existing = await this.getById(id);
+
+    if (!existing) {
+      throw new Error('Project not found');
+    }
+
+    if (existing.isDefault) {
+      throw new Error('Cannot archive the default project');
+    }
+
+    if (existing.archivedAt) {
+      throw new Error('Project is already archived');
+    }
+
+    const now = new Date().toISOString();
+    await db
+      .update(projects)
+      .set({ archivedAt: now, updatedAt: now })
+      .where(eq(projects.id, id));
+
+    this.log('PROJECTS', `Archived project: ${existing.name} (${id})`);
+    return { ...existing, archivedAt: now, updatedAt: now };
+  };
+
+  restore = async (id: string): Promise<ProjectRecord> => {
+    const db = this.getDb();
+    const existing = await this.getById(id);
+
+    if (!existing) {
+      throw new Error('Project not found');
+    }
+
+    if (!existing.archivedAt) {
+      throw new Error('Project is not archived');
+    }
+
+    const now = new Date().toISOString();
+    await db
+      .update(projects)
+      .set({ archivedAt: null, updatedAt: now })
+      .where(eq(projects.id, id));
+
+    this.log('PROJECTS', `Restored project: ${existing.name} (${id})`);
+    return { ...existing, archivedAt: null, updatedAt: now };
+  };
+
+  ensureDefaultAndAssignOrphans = async (): Promise<void> => {
+    const db = this.getDb();
+
+    // Find or create the default project
+    const [existing] = await db.select().from(projects).where(eq(projects.isDefault, 1));
+    let defaultId: string;
+
+    if (existing) {
+      defaultId = existing.id;
+    } else {
+      const now = new Date().toISOString();
+      defaultId = this.generateId();
+      await db.insert(projects).values({
+        id: defaultId,
+        name: 'Default',
+        isDefault: 1,
+        archivedAt: null,
+        createdAt: now,
+        updatedAt: now,
+      });
+      this.log('PROJECTS', `Created default project (${defaultId})`);
+    }
+
+    // Assign orphan rows (project_id IS NULL) to the default project
+    await db.update(nodes).set({ projectId: defaultId }).where(isNull(nodes.projectId));
+    await db.update(edges).set({ projectId: defaultId }).where(isNull(edges.projectId));
+    await db.update(kanban).set({ projectId: defaultId }).where(isNull(kanban.projectId));
+    await db.update(sessions).set({ projectId: defaultId }).where(isNull(sessions.projectId));
+  };
+}

package/templates/product-system/packages/backend/src/services/pty_session_manager.test.ts

@@ -0,0 +1,88 @@
+import { describe, it, mock, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { PtySessionManager } from './pty_session_manager.ts';
+
+const createMockPty = () => {
+  const listeners: Record<string, Function> = {};
+  return {
+    onData: mock.fn((cb: Function) => { listeners.data = cb; }),
+    onExit: mock.fn((cb: Function) => { listeners.exit = cb; }),
+    write: mock.fn(),
+    resize: mock.fn(),
+    kill: mock.fn(),
+    _emit: (event: string, data: unknown) => listeners[event]?.(data),
+  };
+};
+
+describe('PtySessionManager', () => {
+  let manager: PtySessionManager;
+  let spawnMock: ReturnType<typeof mock.fn>;
+  let logMock: ReturnType<typeof mock.fn>;
+  let mockPty: ReturnType<typeof createMockPty>;
+  const PROJECT_ROOT = '/test/project/root';
+
+  beforeEach(() => {
+    mockPty = createMockPty();
+    spawnMock = mock.fn(() => mockPty);
+    logMock = mock.fn();
+    manager = new PtySessionManager({ spawn: spawnMock as any, log: logMock, projectRoot: PROJECT_ROOT });
+  });
+
+  describe('spawnCommand uses projectRoot as cwd', () => {
+    it('passes projectRoot as cwd when spawning a command', () => {
+      manager.createSession('user1', 80, 24);
+
+      // Simulate typing "claude" + Enter
+      manager.writeToSession('user1', 'claude\r');
+
+      assert.equal(spawnMock.mock.calls.length, 1);
+      const spawnOptions = spawnMock.mock.calls[0].arguments[2] as Record<string, unknown>;
+      assert.equal(spawnOptions.cwd, PROJECT_ROOT);
+    });
+  });
+
+  describe('validateCommand', () => {
+    it('allows "claude" command', () => {
+      const result = manager.validateCommand('claude');
+      assert.equal(result.valid, true);
+    });
+
+    it('allows "claude" with arguments', () => {
+      const result = manager.validateCommand('claude --help');
+      assert.equal(result.valid, true);
+    });
+
+    it('rejects disallowed commands', () => {
+      const result = manager.validateCommand('rm -rf /');
+      assert.equal(result.valid, false);
+      assert.ok(result.error?.includes('not allowed'));
+    });
+
+    it('rejects empty command', () => {
+      const result = manager.validateCommand('');
+      assert.equal(result.valid, false);
+    });
+  });
+
+  describe('session lifecycle', () => {
+    it('creates a new session', () => {
+      const session = manager.createSession('user1', 80, 24);
+      assert.equal(session.userId, 'user1');
+      assert.equal(session.state, 'idle');
+    });
+
+    it('reuses existing session', () => {
+      const s1 = manager.createSession('user1', 80, 24);
+      const s2 = manager.createSession('user1', 80, 24);
+      assert.strictEqual(s1, s2);
+    });
+
+    it('destroys session and kills pty', () => {
+      manager.createSession('user1', 80, 24);
+      manager.writeToSession('user1', 'claude\r');
+      manager.destroySession('user1');
+      assert.equal(mockPty.kill.mock.calls.length, 1);
+      assert.equal(manager.getSession('user1'), undefined);
+    });
+  });
+});