@cometchat/skills-cli 2.0.0

package/dist/registry/v6/production/react-router/api.cometchat-token.ts.tpl

@@ -0,0 +1,73 @@
+/**
+ * /api/cometchat-token — server-side endpoint that mints CometChat auth tokens.
+ *
+ * React Router v7 framework mode loader. The Auth Key NEVER leaves the
+ * server. The client calls this endpoint to get a short-lived auth token,
+ * then passes it to CometChatUIKit.loginWithAuthToken().
+ *
+ * Generated by `cometchat production-auth`. Customize freely:
+ *   - Add real authentication: read the user's session cookie / JWT here
+ *   - Map your app's user IDs to CometChat UIDs
+ *   - Add rate limiting if exposed publicly
+ *
+ * Security note: this file MUST NOT use VITE_* env vars for the Auth Key.
+ * The whole point is to keep the Auth Key out of the browser.
+ */
+import type { LoaderFunctionArgs } from "react-router";
+
+const COMETCHAT_APP_ID = process.env.VITE_COMETCHAT_APP_ID!;
+const COMETCHAT_REGION = process.env.VITE_COMETCHAT_REGION!;
+// IMPORTANT: server-only — no VITE_ prefix
+const COMETCHAT_AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+
+export async function loader({ request }: LoaderFunctionArgs) {
+  const url = new URL(request.url);
+  // ⚠ Replace this with your real auth: read the session, extract the user ID,
+  // then map it to a CometChat UID. Do not trust the query param in production.
+  const uid = url.searchParams.get("uid") ?? "cometchat-uid-1";
+
+  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
+    return Response.json(
+      { error: "CometChat credentials not configured on the server" },
+      { status: 500 },
+    );
+  }
+
+  try {
+    const res = await fetch(
+      `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3/users/${encodeURIComponent(uid)}/auth_tokens`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          appid: COMETCHAT_APP_ID,
+          apikey: COMETCHAT_AUTH_KEY,
+        },
+      },
+    );
+
+    if (!res.ok) {
+      const text = await res.text();
+      return Response.json(
+        { error: `CometChat token mint failed (${res.status})`, detail: text },
+        { status: 502 },
+      );
+    }
+
+    const body = (await res.json()) as { data?: { authToken?: string } };
+    const authToken = body.data?.authToken;
+    if (!authToken) {
+      return Response.json(
+        { error: "CometChat returned no authToken in response" },
+        { status: 502 },
+      );
+    }
+
+    return Response.json({ authToken, uid });
+  } catch (err) {
+    return Response.json(
+      { error: "Token mint failed", detail: err instanceof Error ? err.message : String(err) },
+      { status: 500 },
+    );
+  }
+}

package/dist/registry/v6/production/react-router.template.json

@@ -0,0 +1,58 @@
+{
+  "$schema": "../../schemas/template.schema.json",
+  "version": "1.0.0",
+  "experience_id": 1,
+  "framework": "react-router",
+  "sdk_compatibility": ">=6.0.0 <7.0.0",
+  "default_placement": "dedicated-route",
+  "deps": [],
+  "env_vars": [
+    {
+      "name": "COMETCHAT_AUTH_KEY",
+      "required": true,
+      "secret": true,
+      "description": "Server-side only Auth Key (no VITE_ prefix). Used by the /api/cometchat-token loader to mint user-scoped auth tokens. Remove VITE_COMETCHAT_AUTH_KEY from .env — that variable is for development only and exposes the key to the browser."
+    },
+    {
+      "name": "VITE_COMETCHAT_APP_ID",
+      "required": true,
+      "description": "Same as before — App ID is safe to expose"
+    },
+    {
+      "name": "VITE_COMETCHAT_REGION",
+      "required": true,
+      "description": "Same as before — region is safe to expose"
+    }
+  ],
+  "files": [
+    {
+      "path": "app/routes/api.cometchat-token.ts",
+      "action": "create",
+      "template_ref": "api.cometchat-token.ts.tpl",
+      "owned": true
+    },
+    {
+      "path": "app/routes.ts",
+      "action": "patch",
+      "patch_mode": "insert-before",
+      "anchor": "] satisfies RouteConfig",
+      "patch_content": "  route(\"api/cometchat-token\", \"routes/api.cometchat-token.ts\"),\n",
+      "skip_if_exists": "routes/api.cometchat-token.ts"
+    }
+  ],
+  "verify_rules": [],
+  "next_steps": [
+    "1. Add COMETCHAT_AUTH_KEY (NO VITE_ prefix) to .env with your CometChat Auth Key.",
+    "2. REMOVE VITE_COMETCHAT_AUTH_KEY from .env (keep APP_ID and REGION).",
+    "3. In app/cometchat/CometChatNoSSR.tsx, replace the login flow:",
+    "   FROM: CometChatUIKit.login('cometchat-uid-1').then(setUser).catch(setError);",
+    "   TO:   fetch('/api/cometchat-token?uid=' + encodeURIComponent(userId))",
+    "           .then(r => r.json())",
+    "           .then(data => CometChatUIKit.loginWithAuthToken(data.authToken))",
+    "           .then(setUser)",
+    "           .catch(e => setError(String(e)));",
+    "4. Replace 'cometchat-uid-1' with your real authenticated user's ID.",
+    "5. Restart the dev server (`npm run dev`) so the new env var takes effect.",
+    "6. The Auth Key is now ONLY in server memory — never sent to the browser."
+  ]
+}

package/dist/registry/v6/user-mgmt/astro/cometchat-user.ts.tpl

@@ -0,0 +1,164 @@
+/**
+ * /api/cometchat-user — server-side CometChat user management.
+ *
+ * Astro API route. Handles POST (create), PUT (update), DELETE.
+ * The Auth Key NEVER leaves the server.
+ *
+ * Requires astro.config.mjs to have `output: 'server'` or `'hybrid'`.
+ *
+ * Generated by `cometchat add-user-mgmt`.
+ *
+ * SECURITY: this template is unauthenticated by design — add your own
+ * session check before exposing it publicly.
+ */
+import type { APIRoute } from "astro";
+
+const COMETCHAT_APP_ID = import.meta.env.PUBLIC_COMETCHAT_APP_ID!;
+const COMETCHAT_REGION = import.meta.env.PUBLIC_COMETCHAT_REGION!;
+const COMETCHAT_AUTH_KEY = import.meta.env.COMETCHAT_AUTH_KEY!;
+
+const COMETCHAT_API_BASE = `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3`;
+
+const baseHeaders = {
+  "Content-Type": "application/json",
+  appid: COMETCHAT_APP_ID,
+  apikey: COMETCHAT_AUTH_KEY,
+};
+
+function json(data: unknown, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+function validateUid(uid: unknown): string | null {
+  if (typeof uid !== "string" || uid.length === 0) return "uid is required";
+  if (uid.length > 100) return "uid must be ≤100 characters";
+  if (!/^[a-zA-Z0-9_-]+$/.test(uid)) {
+    return "uid must contain only alphanumeric characters, hyphens, and underscores";
+  }
+  return null;
+}
+
+function configError() {
+  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
+    return json({ error: "CometChat credentials not configured on the server" }, 500);
+  }
+  return null;
+}
+
+export const POST: APIRoute = async ({ request }) => {
+  const cfgErr = configError();
+  if (cfgErr) return cfgErr;
+
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return json({ error: "Invalid JSON body" }, 400);
+  }
+  const uidError = validateUid(body.uid);
+  if (uidError) return json({ error: uidError }, 400);
+  if (!body.name) return json({ error: "name is required" }, 400);
+
+  try {
+    const res = await fetch(`${COMETCHAT_API_BASE}/users`, {
+      method: "POST",
+      headers: baseHeaders,
+      body: JSON.stringify({
+        uid: body.uid,
+        name: body.name,
+        ...(body.avatar && { avatar: body.avatar }),
+        ...(body.metadata && { metadata: body.metadata }),
+        ...(body.tags && { tags: body.tags }),
+      }),
+    });
+    if (!res.ok) {
+      const detail = await res.text();
+      return json(
+        { error: `CometChat user create failed (${res.status})`, detail },
+        res.status === 409 ? 409 : 502,
+      );
+    }
+    const data = await res.json();
+    return json({ user: data.data }, 201);
+  } catch (err) {
+    return json(
+      { error: "Create failed", detail: err instanceof Error ? err.message : String(err) },
+      500,
+    );
+  }
+};
+
+export const PUT: APIRoute = async ({ request }) => {
+  const cfgErr = configError();
+  if (cfgErr) return cfgErr;
+
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return json({ error: "Invalid JSON body" }, 400);
+  }
+  const uidError = validateUid(body.uid);
+  if (uidError) return json({ error: uidError }, 400);
+
+  const updates: Record<string, unknown> = {};
+  if (body.name !== undefined) updates.name = body.name;
+  if (body.avatar !== undefined) updates.avatar = body.avatar;
+  if (body.metadata !== undefined) updates.metadata = body.metadata;
+  if (body.tags !== undefined) updates.tags = body.tags;
+  if (Object.keys(updates).length === 0) {
+    return json({ error: "No fields to update" }, 400);
+  }
+
+  try {
+    const res = await fetch(`${COMETCHAT_API_BASE}/users/${encodeURIComponent(body.uid)}`, {
+      method: "PUT",
+      headers: baseHeaders,
+      body: JSON.stringify(updates),
+    });
+    if (!res.ok) {
+      const detail = await res.text();
+      return json({ error: `CometChat user update failed (${res.status})`, detail }, 502);
+    }
+    const data = await res.json();
+    return json({ user: data.data });
+  } catch (err) {
+    return json(
+      { error: "Update failed", detail: err instanceof Error ? err.message : String(err) },
+      500,
+    );
+  }
+};
+
+export const DELETE: APIRoute = async ({ request }) => {
+  const cfgErr = configError();
+  if (cfgErr) return cfgErr;
+
+  const url = new URL(request.url);
+  const uid = url.searchParams.get("uid");
+  const uidError = validateUid(uid);
+  if (uidError) return json({ error: uidError }, 400);
+
+  try {
+    const res = await fetch(`${COMETCHAT_API_BASE}/users/${encodeURIComponent(uid as string)}`, {
+      method: "DELETE",
+      headers: baseHeaders,
+      body: JSON.stringify({ permanent: true }),
+    });
+    if (!res.ok) {
+      const detail = await res.text();
+      return json({ error: `CometChat user delete failed (${res.status})`, detail }, 502);
+    }
+    return json({ deleted: uid });
+  } catch (err) {
+    return json(
+      { error: "Delete failed", detail: err instanceof Error ? err.message : String(err) },
+      500,
+    );
+  }
+};
+
+export const prerender = false;

package/dist/registry/v6/user-mgmt/astro.template.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "../../schemas/template.schema.json",
+  "version": "1.0.0",
+  "experience_id": 1,
+  "framework": "astro",
+  "sdk_compatibility": ">=6.0.0 <7.0.0",
+  "default_placement": "dedicated-route",
+  "deps": [],
+  "env_vars": [
+    {
+      "name": "COMETCHAT_AUTH_KEY",
+      "required": true,
+      "secret": true,
+      "description": "Server-side only Auth Key (no PUBLIC_ prefix)."
+    }
+  ],
+  "files": [
+    {
+      "path": "src/pages/api/cometchat-user.ts",
+      "action": "create",
+      "template_ref": "cometchat-user.ts.tpl",
+      "owned": true
+    }
+  ],
+  "verify_rules": [],
+  "next_steps": [
+    "1. Make sure your astro.config.mjs has output: 'server' or 'hybrid'.",
+    "2. Endpoint at /api/cometchat-user supports POST (create), PUT (update), DELETE.",
+    "3. Add COMETCHAT_AUTH_KEY (no PUBLIC_ prefix) to .env.",
+    "4. Wire it into your sign-up flow when an app user is created.",
+    "5. SECURITY: this template is unauthenticated. Add session checks before deploying."
+  ]
+}

package/dist/registry/v6/user-mgmt/nextjs/route.ts.tpl

@@ -0,0 +1,212 @@
+/**
+ * /api/cometchat-user — server-side CometChat user management.
+ *
+ * Handles three operations:
+ *   POST   — create a new CometChat user (call when an app user signs up)
+ *   PATCH  — update an existing user (call when profile changes)
+ *   DELETE — delete a user (call when app user is deleted)
+ *
+ * All operations use the CometChat REST API with the server-only AUTH_KEY.
+ * The auth key NEVER leaves the server.
+ *
+ * Generated by `cometchat add-user-mgmt`.
+ *
+ * SECURITY: this template is unauthenticated by design — add your own
+ * session check (NextAuth, Clerk, custom JWT) before exposing it publicly.
+ * Otherwise anyone with the URL can create/delete users in your app.
+ */
+import { NextRequest, NextResponse } from "next/server";
+
+const COMETCHAT_APP_ID = process.env.NEXT_PUBLIC_COMETCHAT_APP_ID!;
+const COMETCHAT_REGION = process.env.NEXT_PUBLIC_COMETCHAT_REGION!;
+const COMETCHAT_AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
+
+interface CreateUserBody {
+  uid: string;
+  name: string;
+  avatar?: string;
+  link?: string;
+  role?: string;
+  metadata?: Record<string, unknown>;
+  tags?: string[];
+}
+
+interface UpdateUserBody {
+  uid: string;
+  name?: string;
+  avatar?: string;
+  link?: string;
+  role?: string;
+  metadata?: Record<string, unknown>;
+  tags?: string[];
+}
+
+const COMETCHAT_API_BASE = `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3`;
+
+const baseHeaders = {
+  "Content-Type": "application/json",
+  appid: COMETCHAT_APP_ID,
+  apikey: COMETCHAT_AUTH_KEY,
+};
+
+function validateConfig(): NextResponse | null {
+  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
+    return NextResponse.json(
+      { error: "CometChat credentials not configured on the server" },
+      { status: 500 },
+    );
+  }
+  return null;
+}
+
+// CometChat UIDs must be alphanumeric + hyphens + underscores. Validate before
+// passing to the API to give better error messages than the upstream 400.
+function validateUid(uid: unknown): string | null {
+  if (typeof uid !== "string" || uid.length === 0) return "uid is required";
+  if (uid.length > 100) return "uid must be ≤100 characters";
+  if (!/^[a-zA-Z0-9_-]+$/.test(uid)) {
+    return "uid must contain only alphanumeric characters, hyphens, and underscores";
+  }
+  return null;
+}
+
+/** POST — create a new user. Body: { uid, name, ...optional }. */
+export async function POST(request: NextRequest) {
+  const configError = validateConfig();
+  if (configError) return configError;
+
+  let body: CreateUserBody;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const uidError = validateUid(body.uid);
+  if (uidError) return NextResponse.json({ error: uidError }, { status: 400 });
+  if (!body.name || typeof body.name !== "string") {
+    return NextResponse.json({ error: "name is required" }, { status: 400 });
+  }
+
+  try {
+    const res = await fetch(`${COMETCHAT_API_BASE}/users`, {
+      method: "POST",
+      headers: baseHeaders,
+      body: JSON.stringify({
+        uid: body.uid,
+        name: body.name,
+        ...(body.avatar && { avatar: body.avatar }),
+        ...(body.link && { link: body.link }),
+        ...(body.role && { role: body.role }),
+        ...(body.metadata && { metadata: body.metadata }),
+        ...(body.tags && { tags: body.tags }),
+      }),
+    });
+
+    if (!res.ok) {
+      const detail = await res.text();
+      return NextResponse.json(
+        { error: `CometChat user create failed (${res.status})`, detail },
+        { status: res.status === 409 ? 409 : 502 },
+      );
+    }
+
+    const data = (await res.json()) as { data?: unknown };
+    return NextResponse.json({ user: data.data }, { status: 201 });
+  } catch (err) {
+    return NextResponse.json(
+      { error: "Create failed", detail: err instanceof Error ? err.message : String(err) },
+      { status: 500 },
+    );
+  }
+}
+
+/** PATCH — update an existing user. Body: { uid, ...fields-to-update }. */
+export async function PATCH(request: NextRequest) {
+  const configError = validateConfig();
+  if (configError) return configError;
+
+  let body: UpdateUserBody;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+  }
+
+  const uidError = validateUid(body.uid);
+  if (uidError) return NextResponse.json({ error: uidError }, { status: 400 });
+
+  const updates: Record<string, unknown> = {};
+  if (body.name !== undefined) updates.name = body.name;
+  if (body.avatar !== undefined) updates.avatar = body.avatar;
+  if (body.link !== undefined) updates.link = body.link;
+  if (body.role !== undefined) updates.role = body.role;
+  if (body.metadata !== undefined) updates.metadata = body.metadata;
+  if (body.tags !== undefined) updates.tags = body.tags;
+
+  if (Object.keys(updates).length === 0) {
+    return NextResponse.json({ error: "No fields to update" }, { status: 400 });
+  }
+
+  try {
+    const res = await fetch(`${COMETCHAT_API_BASE}/users/${encodeURIComponent(body.uid)}`, {
+      method: "PUT",
+      headers: baseHeaders,
+      body: JSON.stringify(updates),
+    });
+
+    if (!res.ok) {
+      const detail = await res.text();
+      return NextResponse.json(
+        { error: `CometChat user update failed (${res.status})`, detail },
+        { status: 502 },
+      );
+    }
+
+    const data = (await res.json()) as { data?: unknown };
+    return NextResponse.json({ user: data.data });
+  } catch (err) {
+    return NextResponse.json(
+      { error: "Update failed", detail: err instanceof Error ? err.message : String(err) },
+      { status: 500 },
+    );
+  }
+}
+
+/** DELETE — delete a user. Query: ?uid=<uid>. */
+export async function DELETE(request: NextRequest) {
+  const configError = validateConfig();
+  if (configError) return configError;
+
+  const uid = request.nextUrl.searchParams.get("uid");
+  const uidError = validateUid(uid);
+  if (uidError) return NextResponse.json({ error: uidError }, { status: 400 });
+
+  try {
+    const res = await fetch(
+      `${COMETCHAT_API_BASE}/users/${encodeURIComponent(uid as string)}`,
+      {
+        method: "DELETE",
+        headers: baseHeaders,
+        body: JSON.stringify({ permanent: true }),
+      },
+    );
+
+    if (!res.ok) {
+      const detail = await res.text();
+      return NextResponse.json(
+        { error: `CometChat user delete failed (${res.status})`, detail },
+        { status: 502 },
+      );
+    }
+
+    return NextResponse.json({ deleted: uid });
+  } catch (err) {
+    return NextResponse.json(
+      { error: "Delete failed", detail: err instanceof Error ? err.message : String(err) },
+      { status: 500 },
+    );
+  }
+}
+
+export const dynamic = "force-dynamic";

package/dist/registry/v6/user-mgmt/nextjs.template.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "../../schemas/template.schema.json",
+  "version": "1.0.0",
+  "experience_id": 1,
+  "framework": "nextjs",
+  "sdk_compatibility": ">=6.0.0 <7.0.0",
+  "default_placement": "dedicated-route",
+  "deps": [],
+  "env_vars": [
+    {
+      "name": "COMETCHAT_AUTH_KEY",
+      "required": true,
+      "secret": true,
+      "description": "Server-side only Auth Key (no NEXT_PUBLIC_ prefix). Used by both /api/cometchat-token AND /api/cometchat-user."
+    },
+    {
+      "name": "NEXT_PUBLIC_COMETCHAT_APP_ID",
+      "required": true
+    },
+    {
+      "name": "NEXT_PUBLIC_COMETCHAT_REGION",
+      "required": true
+    }
+  ],
+  "files": [
+    {
+      "path": "src/app/api/cometchat-user/route.ts",
+      "action": "create",
+      "template_ref": "route.ts.tpl",
+      "owned": true
+    }
+  ],
+  "verify_rules": [],
+  "next_steps": [
+    "1. The endpoint at /api/cometchat-user supports POST (create), PATCH (update), and DELETE.",
+    "2. Wire it into your sign-up flow. When a new user signs up, call POST /api/cometchat-user with { uid, name, avatar?, metadata? } to create their CometChat counterpart.",
+    "",
+    "   Example with NextAuth (in your sign-up callback):",
+    "     const res = await fetch('/api/cometchat-user', {",
+    "       method: 'POST',",
+    "       headers: { 'Content-Type': 'application/json' },",
+    "       body: JSON.stringify({ uid: session.user.id, name: session.user.name }),",
+    "     });",
+    "",
+    "   Example with Clerk (in a Clerk webhook handler):",
+    "     export async function POST(req: Request) {",
+    "       const event = await req.json();",
+    "       if (event.type === 'user.created') {",
+    "         await fetch(`${process.env.NEXTAUTH_URL}/api/cometchat-user`, { ... });",
+    "       }",
+    "     }",
+    "",
+    "3. The endpoint validates uid is alphanumeric + hyphens only (CometChat constraint).",
+    "4. Errors are returned as { error, detail } with HTTP status codes.",
+    "5. SECURITY: in production, this endpoint should be authenticated. The template uses no auth — add session checks before deploying."
+  ]
+}