@dewtech/dare-cli 2.17.0 → 3.1.0

package/templates/stacks/rust-axum/llms.txt.tera

@@ -0,0 +1,54 @@
+# {{ projectName }}
+
+DARE-shaped Rust API on Axum 0.7. Layered Design: Handler → Service → Repository → Model.
+
+## Setup
+
+```bash
+cp .env.example .env
+docker compose up -d postgres
+cargo install sqlx-cli --no-default-features --features postgres
+sqlx database create
+sqlx migrate run
+cargo run
+```
+
+## Commands
+
+- `cargo run` — dev server (port 8000)
+- `cargo test --workspace` — tests
+- `cargo clippy -- -D warnings` — lint (warnings are errors)
+- `cargo audit` — RustSec advisory audit
+- `sqlx migrate add <name>` — new migration
+- `sqlx migrate run` — apply migrations
+
+## Endpoints
+
+| Method | Path | Auth | Description |
+|---|---|---|---|
+| POST | `/auth/login` | none | Exchange email+password for JWT |
+| GET | `/auth/me` | Bearer | Current user info |
+| GET | `/users` | Bearer | List users (query: page, limit) |
+| POST | `/users` | Bearer (admin) | Create user |
+| GET | `/ws` | upgrade | WebSocket echo example |
+| GET | `/openapi.json` | none | OpenAPI 3.x document (utoipa-generated at runtime) |
+| GET | `/swagger-ui` | none | Swagger UI |
+
+## Layered Design
+
+- `src/handlers/` — Axum extractors and route handlers
+- `src/services/` — business logic
+- `src/repositories/` — sqlx queries
+- `src/models/` — domain structs (FromRow / Serialize)
+- `src/middleware/` — auth + rate limit
+- `src/llm/` — provider abstraction
+
+Handlers never call sqlx directly — they go through services → repositories.
+
+## Env vars
+
+See `.env.example`. Required: `DATABASE_URL`, `JWT_SECRET`.
+
+## DARE skills
+
+See `.dare/skills.yml`.

package/templates/stacks/rust-axum/migrations/0001_create_users.sql

@@ -0,0 +1,13 @@
+-- 0001 — users table
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+
+CREATE TABLE IF NOT EXISTS users (
+    id          UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    email       VARCHAR(254) NOT NULL UNIQUE,
+    password    VARCHAR(255) NOT NULL,
+    role        VARCHAR(16) NOT NULL DEFAULT 'USER',
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS ix_users_email ON users (email);

package/templates/stacks/rust-axum/openapi.json.tera

@@ -0,0 +1,46 @@
+{
+  "openapi": "3.1.0",
+  "info": {
+    "title": "{{ projectName }}",
+    "version": "0.1.0",
+    "description": "DARE-shaped Rust/Axum API. Runtime spec served at /openapi.json by utoipa."
+  },
+  "paths": {
+    "/auth/login": {
+      "post": {
+        "summary": "Exchange email+password for JWT",
+        "responses": { "200": { "description": "JWT issued" }, "401": { "description": "Invalid credentials" } }
+      }
+    },
+    "/auth/me": {
+      "get": {
+        "summary": "Current user",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "User" }, "401": { "description": "Unauthorized" } }
+      }
+    },
+    "/users": {
+      "get": {
+        "summary": "List users",
+        "security": [{ "bearer": [] }],
+        "responses": { "200": { "description": "Page of users" } }
+      },
+      "post": {
+        "summary": "Create user (admin)",
+        "security": [{ "bearer": [] }],
+        "responses": { "201": { "description": "Created" }, "403": { "description": "Forbidden" } }
+      }
+    },
+    "/ws": {
+      "get": {
+        "summary": "WebSocket echo upgrade",
+        "responses": { "101": { "description": "Switching Protocols" } }
+      }
+    }
+  },
+  "components": {
+    "securitySchemes": {
+      "bearer": { "type": "http", "scheme": "bearer", "bearerFormat": "JWT" }
+    }
+  }
+}

package/templates/stacks/rust-axum/src/config.rs

@@ -0,0 +1,45 @@
+//! Runtime configuration read from environment.
+use std::env;
+
+use tower_http::cors::AllowOrigin;
+
+#[derive(Clone, Debug)]
+pub struct Config {
+    pub app_port: u16,
+    pub database_url: String,
+    pub jwt_secret: String,
+    pub jwt_expires_secs: i64,
+    pub rate_limit_per_sec: u64,
+    pub rate_limit_burst: u32,
+    pub cors_origins: Vec<String>,
+    pub llm_provider: String,
+}
+
+impl Config {
+    pub fn from_env() -> anyhow::Result<Self> {
+        Ok(Self {
+            app_port: env::var("APP_PORT").ok().and_then(|s| s.parse().ok()).unwrap_or(8000),
+            database_url: env::var("DATABASE_URL")?,
+            jwt_secret: env::var("JWT_SECRET").unwrap_or_else(|_| "replace-me-in-prod".into()),
+            jwt_expires_secs: env::var("JWT_EXPIRES_SECS").ok().and_then(|s| s.parse().ok()).unwrap_or(900),
+            rate_limit_per_sec: env::var("RATE_LIMIT_PER_SEC").ok().and_then(|s| s.parse().ok()).unwrap_or(10),
+            rate_limit_burst: env::var("RATE_LIMIT_BURST").ok().and_then(|s| s.parse().ok()).unwrap_or(20),
+            cors_origins: env::var("CORS_ORIGINS")
+                .unwrap_or_else(|_| "http://localhost:3000".into())
+                .split(',')
+                .map(|s| s.trim().to_string())
+                .filter(|s| !s.is_empty())
+                .collect(),
+            llm_provider: env::var("LLM_PROVIDER").unwrap_or_else(|_| "dummy".into()),
+        })
+    }
+
+    pub fn cors_layer_origins(&self) -> AllowOrigin {
+        let parsed: Vec<axum::http::HeaderValue> = self
+            .cors_origins
+            .iter()
+            .filter_map(|o| o.parse().ok())
+            .collect();
+        AllowOrigin::list(parsed)
+    }
+}

package/templates/stacks/rust-axum/src/errors.rs

@@ -0,0 +1,48 @@
+//! RFC 7807 Problem Details — uniform error shape across the API.
+use axum::{
+    http::StatusCode,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum AppError {
+    #[error("invalid credentials")]
+    Unauthorized,
+    #[error("forbidden")]
+    Forbidden,
+    #[error("not found")]
+    NotFound,
+    #[error("validation failed: {0}")]
+    Validation(String),
+    #[error("conflict: {0}")]
+    Conflict(String),
+    #[error("internal: {0}")]
+    Internal(#[from] anyhow::Error),
+    #[error("database: {0}")]
+    Db(#[from] sqlx::Error),
+}
+
+impl IntoResponse for AppError {
+    fn into_response(self) -> Response {
+        let (status, title) = match &self {
+            AppError::Unauthorized => (StatusCode::UNAUTHORIZED, "Unauthorized"),
+            AppError::Forbidden => (StatusCode::FORBIDDEN, "Forbidden"),
+            AppError::NotFound => (StatusCode::NOT_FOUND, "Not Found"),
+            AppError::Validation(_) => (StatusCode::BAD_REQUEST, "Bad Request"),
+            AppError::Conflict(_) => (StatusCode::CONFLICT, "Conflict"),
+            AppError::Internal(_) | AppError::Db(_) => {
+                (StatusCode::INTERNAL_SERVER_ERROR, "Internal Server Error")
+            }
+        };
+        let body = json!({
+            "type": format!("urn:problem:{}", status.as_u16()),
+            "title": title,
+            "status": status.as_u16(),
+            "detail": self.to_string(),
+        });
+        (status, Json(body)).into_response()
+    }
+}

package/templates/stacks/rust-axum/src/handlers/auth.rs

@@ -0,0 +1,48 @@
+//! Auth handlers — POST /auth/login, GET /auth/me.
+use axum::{extract::State, http::HeaderMap, Json};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    errors::AppError,
+    middleware::auth::extract_bearer,
+    services::auth_service,
+    services::user_service,
+    SharedState,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct LoginRequest {
+    pub email: String,
+    pub password: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct LoginResponse {
+    pub access_token: String,
+    pub token_type: &'static str,
+    pub expires_in: i64,
+}
+
+#[derive(Debug, Serialize)]
+pub struct MeResponse {
+    pub id: uuid::Uuid,
+    pub email: String,
+    pub role: String,
+}
+
+pub async fn login(
+    State(state): State<SharedState>,
+    Json(body): Json<LoginRequest>,
+) -> Result<Json<LoginResponse>, AppError> {
+    let (token, expires_in) = auth_service::login(&state, &body.email, &body.password).await?;
+    Ok(Json(LoginResponse { access_token: token, token_type: "Bearer", expires_in }))
+}
+
+pub async fn me(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+) -> Result<Json<MeResponse>, AppError> {
+    let claims = extract_bearer(&state.cfg, &headers)?;
+    let user = user_service::find_by_id(&state, claims.sub).await?;
+    Ok(Json(MeResponse { id: user.id, email: user.email, role: user.role }))
+}

package/templates/stacks/rust-axum/src/handlers/mod.rs

@@ -0,0 +1,3 @@
+pub mod auth;
+pub mod users;
+pub mod ws;

package/templates/stacks/rust-axum/src/handlers/users.rs

@@ -0,0 +1,81 @@
+//! Users handlers — GET /users, POST /users.
+use axum::{
+    extract::{Query, State},
+    http::HeaderMap,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    errors::AppError,
+    middleware::auth::extract_bearer,
+    services::user_service,
+    SharedState,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct PageQuery {
+    #[serde(default = "default_page")]
+    pub page: i64,
+    #[serde(default = "default_limit")]
+    pub limit: i64,
+}
+
+fn default_page() -> i64 { 1 }
+fn default_limit() -> i64 { 20 }
+
+#[derive(Debug, Serialize)]
+pub struct UserOut {
+    pub id: uuid::Uuid,
+    pub email: String,
+    pub role: String,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct UserPage {
+    pub items: Vec<UserOut>,
+    pub total: i64,
+    pub page: i64,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateUserRequest {
+    pub email: String,
+    pub password: String,
+    #[serde(default = "default_role")]
+    pub role: String,
+}
+
+fn default_role() -> String { "USER".to_string() }
+
+pub async fn list(
+    State(state): State<SharedState>,
+    Query(q): Query<PageQuery>,
+    headers: HeaderMap,
+) -> Result<Json<UserPage>, AppError> {
+    let _ = extract_bearer(&state.cfg, &headers)?;
+    let page = q.page.max(1);
+    let limit = q.limit.clamp(1, 100);
+    let (items, total) = user_service::page(&state, page, limit).await?;
+    Ok(Json(UserPage {
+        items: items.into_iter().map(|u| UserOut {
+            id: u.id, email: u.email, role: u.role, created_at: u.created_at,
+        }).collect(),
+        total,
+        page,
+    }))
+}
+
+pub async fn create(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Json(body): Json<CreateUserRequest>,
+) -> Result<Json<UserOut>, AppError> {
+    let claims = extract_bearer(&state.cfg, &headers)?;
+    if claims.role != "ADMIN" {
+        return Err(AppError::Forbidden);
+    }
+    let user = user_service::create(&state, &body.email, &body.password, &body.role).await?;
+    Ok(Json(UserOut { id: user.id, email: user.email, role: user.role, created_at: user.created_at }))
+}

package/templates/stacks/rust-axum/src/handlers/ws.rs

@@ -0,0 +1,24 @@
+//! WebSocket echo handler using axum::extract::ws.
+use axum::{
+    extract::ws::{Message, WebSocket, WebSocketUpgrade},
+    response::IntoResponse,
+};
+
+pub async fn handler(ws: WebSocketUpgrade) -> impl IntoResponse {
+    ws.on_upgrade(echo)
+}
+
+async fn echo(mut socket: WebSocket) {
+    while let Some(Ok(msg)) = socket.recv().await {
+        match msg {
+            Message::Text(t) => {
+                let _ = socket.send(Message::Text(t)).await;
+            }
+            Message::Binary(b) => {
+                let _ = socket.send(Message::Binary(b)).await;
+            }
+            Message::Close(_) => break,
+            _ => {}
+        }
+    }
+}

package/templates/stacks/rust-axum/src/lib.rs

@@ -0,0 +1,19 @@
+//! Public crate surface — re-exported for tests and bins.
+pub mod config;
+pub mod errors;
+pub mod handlers;
+pub mod llm;
+pub mod middleware;
+pub mod models;
+pub mod repositories;
+pub mod services;
+
+use std::sync::Arc;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub pool: sqlx::PgPool,
+    pub cfg: config::Config,
+}
+
+pub type SharedState = Arc<AppState>;

package/templates/stacks/rust-axum/src/llm/mod.rs

@@ -0,0 +1 @@
+pub mod provider;

package/templates/stacks/rust-axum/src/llm/provider.rs

@@ -0,0 +1,48 @@
+//! LLM provider abstraction. Two implementations: Dummy and OpenAi.
+//!
+//! `async-trait` is used for dyn-compatible async traits — see Cargo.toml.
+use async_trait::async_trait;
+
+#[async_trait]
+pub trait LlmProvider: Send + Sync {
+    async fn complete(&self, prompt: &str, max_tokens: usize) -> anyhow::Result<String>;
+}
+
+pub struct DummyProvider;
+
+#[async_trait]
+impl LlmProvider for DummyProvider {
+    async fn complete(&self, prompt: &str, max_tokens: usize) -> anyhow::Result<String> {
+        let n = prompt.len().min(max_tokens);
+        Ok(format!("[dummy] {}", &prompt[..n]))
+    }
+}
+
+pub struct OpenAiProvider {
+    pub api_key: String,
+    pub model: String,
+    pub base_uri: String,
+}
+
+#[async_trait]
+impl LlmProvider for OpenAiProvider {
+    async fn complete(&self, prompt: &str, max_tokens: usize) -> anyhow::Result<String> {
+        let client = reqwest::Client::new();
+        let body = serde_json::json!({
+            "model": self.model,
+            "messages": [{"role": "user", "content": prompt}],
+            "max_tokens": max_tokens
+        });
+        let res = client
+            .post(format!("{}/chat/completions", self.base_uri))
+            .bearer_auth(&self.api_key)
+            .json(&body)
+            .send()
+            .await?;
+        let v: serde_json::Value = res.json().await?;
+        Ok(v["choices"][0]["message"]["content"]
+            .as_str()
+            .unwrap_or_default()
+            .to_string())
+    }
+}

package/templates/stacks/rust-axum/src/main.rs.tera

@@ -0,0 +1,64 @@
+//! {{ projectName }} — Axum API entrypoint.
+use std::{net::SocketAddr, sync::Arc};
+
+use axum::{routing::{get, post}, Router};
+use sqlx::postgres::PgPoolOptions;
+use tower_http::{cors::CorsLayer, trace::TraceLayer};
+use tracing_subscriber::EnvFilter;
+
+use {{ crateName }}::{
+    config::Config,
+    handlers::{auth, users, ws},
+    middleware::rate_limit::with_rate_limit,
+    AppState,
+};
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    dotenvy::dotenv().ok();
+    tracing_subscriber::fmt()
+        .with_env_filter(EnvFilter::from_default_env())
+        .init();
+
+    let cfg = Config::from_env()?;
+
+    let pool = PgPoolOptions::new()
+        .max_connections(10)
+        .connect(&cfg.database_url)
+        .await?;
+
+    sqlx::migrate!("./migrations").run(&pool).await?;
+
+    let state = Arc::new(AppState { pool, cfg: cfg.clone() });
+
+    let cors = CorsLayer::new()
+        .allow_origin(cfg.cors_layer_origins())
+        .allow_methods(tower_http::cors::Any)
+        .allow_headers(tower_http::cors::Any);
+
+    let app = Router::new()
+        .route("/healthz", get(|| async { "ok" }))
+        .route("/auth/login", post(auth::login))
+        .route("/auth/me", get(auth::me))
+        .route("/users", get(users::list).post(users::create))
+        .route("/ws", get(ws::handler))
+        .route("/openapi.json", get(serve_openapi))
+        .layer(cors)
+        .layer(TraceLayer::new_for_http())
+        .with_state(state);
+
+    // Rate limit applied via helper (avoids naming GovernorLayer generics).
+    let app = with_rate_limit(app, &cfg);
+
+    let addr: SocketAddr = ([0, 0, 0, 0], cfg.app_port).into();
+    tracing::info!("listening on {}", addr);
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    axum::serve(listener, app).await?;
+    Ok(())
+}
+
+async fn serve_openapi() -> axum::response::Json<serde_json::Value> {
+    let raw = include_str!("../openapi.json");
+    let v: serde_json::Value = serde_json::from_str(raw).unwrap_or_default();
+    axum::response::Json(v)
+}

package/templates/stacks/rust-axum/src/middleware/auth.rs

@@ -0,0 +1,20 @@
+//! Bearer JWT extractor — reads Authorization header and validates the token.
+use axum::http::{header::AUTHORIZATION, HeaderMap};
+use jsonwebtoken::{decode, DecodingKey, Validation};
+
+use crate::{config::Config, errors::AppError, services::auth_service::Claims};
+
+pub fn extract_bearer(cfg: &Config, headers: &HeaderMap) -> Result<Claims, AppError> {
+    let raw = headers
+        .get(AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .ok_or(AppError::Unauthorized)?;
+    let token = raw.strip_prefix("Bearer ").ok_or(AppError::Unauthorized)?;
+    let data = decode::<Claims>(
+        token,
+        &DecodingKey::from_secret(cfg.jwt_secret.as_bytes()),
+        &Validation::default(),
+    )
+    .map_err(|_| AppError::Unauthorized)?;
+    Ok(data.claims)
+}

package/templates/stacks/rust-axum/src/middleware/mod.rs

@@ -0,0 +1,2 @@
+pub mod auth;
+pub mod rate_limit;

package/templates/stacks/rust-axum/src/middleware/rate_limit.rs

@@ -0,0 +1,27 @@
+//! Rate limit via tower_governor — per-IP token bucket.
+//!
+//! We apply the layer through a generic helper instead of naming the
+//! `GovernorLayer<K, M>` generics explicitly — the concrete extractor /
+//! middleware types vary across tower_governor versions, so we let type
+//! inference fill them in.
+use std::sync::Arc;
+
+use axum::Router;
+use tower_governor::{governor::GovernorConfigBuilder, GovernorLayer};
+
+use crate::config::Config;
+
+/// Apply the per-IP rate limit layer to a router.
+pub fn with_rate_limit<S>(router: Router<S>, cfg: &Config) -> Router<S>
+where
+    S: Clone + Send + Sync + 'static,
+{
+    let conf = Arc::new(
+        GovernorConfigBuilder::default()
+            .per_second(cfg.rate_limit_per_sec)
+            .burst_size(cfg.rate_limit_burst)
+            .finish()
+            .expect("valid governor config"),
+    );
+    router.layer(GovernorLayer { config: conf })
+}

package/templates/stacks/rust-axum/src/models/mod.rs

@@ -0,0 +1 @@
+pub mod user;

package/templates/stacks/rust-axum/src/models/user.rs

@@ -0,0 +1,13 @@
+//! User domain model. sqlx FromRow + serde Serialize.
+use serde::{Deserialize, Serialize};
+use sqlx::FromRow;
+
+#[derive(Debug, Clone, FromRow, Serialize, Deserialize)]
+pub struct User {
+    pub id: uuid::Uuid,
+    pub email: String,
+    pub password: String,
+    pub role: String,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+}

package/templates/stacks/rust-axum/src/repositories/mod.rs

@@ -0,0 +1 @@
+pub mod user_repository;

package/templates/stacks/rust-axum/src/repositories/user_repository.rs

@@ -0,0 +1,62 @@
+//! User repository — the only place sqlx is called for the User aggregate.
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::models::user::User;
+
+pub async fn find_by_email(pool: &PgPool, email: &str) -> Result<Option<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        "SELECT id, email, password, role, created_at, updated_at \
+         FROM users WHERE email = $1",
+    )
+    .bind(email)
+    .fetch_optional(pool)
+    .await
+}
+
+pub async fn find_by_id(pool: &PgPool, id: Uuid) -> Result<Option<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        "SELECT id, email, password, role, created_at, updated_at \
+         FROM users WHERE id = $1",
+    )
+    .bind(id)
+    .fetch_optional(pool)
+    .await
+}
+
+pub async fn page(pool: &PgPool, offset: i64, limit: i64) -> Result<Vec<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        "SELECT id, email, password, role, created_at, updated_at \
+         FROM users ORDER BY created_at DESC LIMIT $1 OFFSET $2",
+    )
+    .bind(limit)
+    .bind(offset)
+    .fetch_all(pool)
+    .await
+}
+
+pub async fn count(pool: &PgPool) -> Result<i64, sqlx::Error> {
+    let row: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM users")
+        .fetch_one(pool)
+        .await?;
+    Ok(row.0)
+}
+
+pub async fn create(
+    pool: &PgPool,
+    email: &str,
+    password_hash: &str,
+    role: &str,
+) -> Result<User, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        "INSERT INTO users (id, email, password, role) \
+         VALUES ($1, $2, $3, $4) \
+         RETURNING id, email, password, role, created_at, updated_at",
+    )
+    .bind(Uuid::new_v4())
+    .bind(email)
+    .bind(password_hash)
+    .bind(role)
+    .fetch_one(pool)
+    .await
+}