@dewtech/dare-cli 3.0.0 → 3.2.0

package/templates/stacks/rust-axum/src/errors.rs

@@ -0,0 +1,48 @@
+//! RFC 7807 Problem Details — uniform error shape across the API.
+use axum::{
+    http::StatusCode,
+    response::{IntoResponse, Response},
+    Json,
+};
+use serde_json::json;
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum AppError {
+    #[error("invalid credentials")]
+    Unauthorized,
+    #[error("forbidden")]
+    Forbidden,
+    #[error("not found")]
+    NotFound,
+    #[error("validation failed: {0}")]
+    Validation(String),
+    #[error("conflict: {0}")]
+    Conflict(String),
+    #[error("internal: {0}")]
+    Internal(#[from] anyhow::Error),
+    #[error("database: {0}")]
+    Db(#[from] sqlx::Error),
+}
+
+impl IntoResponse for AppError {
+    fn into_response(self) -> Response {
+        let (status, title) = match &self {
+            AppError::Unauthorized => (StatusCode::UNAUTHORIZED, "Unauthorized"),
+            AppError::Forbidden => (StatusCode::FORBIDDEN, "Forbidden"),
+            AppError::NotFound => (StatusCode::NOT_FOUND, "Not Found"),
+            AppError::Validation(_) => (StatusCode::BAD_REQUEST, "Bad Request"),
+            AppError::Conflict(_) => (StatusCode::CONFLICT, "Conflict"),
+            AppError::Internal(_) | AppError::Db(_) => {
+                (StatusCode::INTERNAL_SERVER_ERROR, "Internal Server Error")
+            }
+        };
+        let body = json!({
+            "type": format!("urn:problem:{}", status.as_u16()),
+            "title": title,
+            "status": status.as_u16(),
+            "detail": self.to_string(),
+        });
+        (status, Json(body)).into_response()
+    }
+}

package/templates/stacks/rust-axum/src/handlers/auth.rs

@@ -0,0 +1,48 @@
+//! Auth handlers — POST /auth/login, GET /auth/me.
+use axum::{extract::State, http::HeaderMap, Json};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    errors::AppError,
+    middleware::auth::extract_bearer,
+    services::auth_service,
+    services::user_service,
+    SharedState,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct LoginRequest {
+    pub email: String,
+    pub password: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct LoginResponse {
+    pub access_token: String,
+    pub token_type: &'static str,
+    pub expires_in: i64,
+}
+
+#[derive(Debug, Serialize)]
+pub struct MeResponse {
+    pub id: uuid::Uuid,
+    pub email: String,
+    pub role: String,
+}
+
+pub async fn login(
+    State(state): State<SharedState>,
+    Json(body): Json<LoginRequest>,
+) -> Result<Json<LoginResponse>, AppError> {
+    let (token, expires_in) = auth_service::login(&state, &body.email, &body.password).await?;
+    Ok(Json(LoginResponse { access_token: token, token_type: "Bearer", expires_in }))
+}
+
+pub async fn me(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+) -> Result<Json<MeResponse>, AppError> {
+    let claims = extract_bearer(&state.cfg, &headers)?;
+    let user = user_service::find_by_id(&state, claims.sub).await?;
+    Ok(Json(MeResponse { id: user.id, email: user.email, role: user.role }))
+}

package/templates/stacks/rust-axum/src/handlers/mod.rs

@@ -0,0 +1,3 @@
+pub mod auth;
+pub mod users;
+pub mod ws;

package/templates/stacks/rust-axum/src/handlers/users.rs

@@ -0,0 +1,81 @@
+//! Users handlers — GET /users, POST /users.
+use axum::{
+    extract::{Query, State},
+    http::HeaderMap,
+    Json,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    errors::AppError,
+    middleware::auth::extract_bearer,
+    services::user_service,
+    SharedState,
+};
+
+#[derive(Debug, Deserialize)]
+pub struct PageQuery {
+    #[serde(default = "default_page")]
+    pub page: i64,
+    #[serde(default = "default_limit")]
+    pub limit: i64,
+}
+
+fn default_page() -> i64 { 1 }
+fn default_limit() -> i64 { 20 }
+
+#[derive(Debug, Serialize)]
+pub struct UserOut {
+    pub id: uuid::Uuid,
+    pub email: String,
+    pub role: String,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct UserPage {
+    pub items: Vec<UserOut>,
+    pub total: i64,
+    pub page: i64,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct CreateUserRequest {
+    pub email: String,
+    pub password: String,
+    #[serde(default = "default_role")]
+    pub role: String,
+}
+
+fn default_role() -> String { "USER".to_string() }
+
+pub async fn list(
+    State(state): State<SharedState>,
+    Query(q): Query<PageQuery>,
+    headers: HeaderMap,
+) -> Result<Json<UserPage>, AppError> {
+    let _ = extract_bearer(&state.cfg, &headers)?;
+    let page = q.page.max(1);
+    let limit = q.limit.clamp(1, 100);
+    let (items, total) = user_service::page(&state, page, limit).await?;
+    Ok(Json(UserPage {
+        items: items.into_iter().map(|u| UserOut {
+            id: u.id, email: u.email, role: u.role, created_at: u.created_at,
+        }).collect(),
+        total,
+        page,
+    }))
+}
+
+pub async fn create(
+    State(state): State<SharedState>,
+    headers: HeaderMap,
+    Json(body): Json<CreateUserRequest>,
+) -> Result<Json<UserOut>, AppError> {
+    let claims = extract_bearer(&state.cfg, &headers)?;
+    if claims.role != "ADMIN" {
+        return Err(AppError::Forbidden);
+    }
+    let user = user_service::create(&state, &body.email, &body.password, &body.role).await?;
+    Ok(Json(UserOut { id: user.id, email: user.email, role: user.role, created_at: user.created_at }))
+}

package/templates/stacks/rust-axum/src/handlers/ws.rs

@@ -0,0 +1,24 @@
+//! WebSocket echo handler using axum::extract::ws.
+use axum::{
+    extract::ws::{Message, WebSocket, WebSocketUpgrade},
+    response::IntoResponse,
+};
+
+pub async fn handler(ws: WebSocketUpgrade) -> impl IntoResponse {
+    ws.on_upgrade(echo)
+}
+
+async fn echo(mut socket: WebSocket) {
+    while let Some(Ok(msg)) = socket.recv().await {
+        match msg {
+            Message::Text(t) => {
+                let _ = socket.send(Message::Text(t)).await;
+            }
+            Message::Binary(b) => {
+                let _ = socket.send(Message::Binary(b)).await;
+            }
+            Message::Close(_) => break,
+            _ => {}
+        }
+    }
+}

package/templates/stacks/rust-axum/src/lib.rs

@@ -0,0 +1,19 @@
+//! Public crate surface — re-exported for tests and bins.
+pub mod config;
+pub mod errors;
+pub mod handlers;
+pub mod llm;
+pub mod middleware;
+pub mod models;
+pub mod repositories;
+pub mod services;
+
+use std::sync::Arc;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub pool: sqlx::PgPool,
+    pub cfg: config::Config,
+}
+
+pub type SharedState = Arc<AppState>;

package/templates/stacks/rust-axum/src/llm/mod.rs

@@ -0,0 +1 @@
+pub mod provider;

package/templates/stacks/rust-axum/src/llm/provider.rs

@@ -0,0 +1,48 @@
+//! LLM provider abstraction. Two implementations: Dummy and OpenAi.
+//!
+//! `async-trait` is used for dyn-compatible async traits — see Cargo.toml.
+use async_trait::async_trait;
+
+#[async_trait]
+pub trait LlmProvider: Send + Sync {
+    async fn complete(&self, prompt: &str, max_tokens: usize) -> anyhow::Result<String>;
+}
+
+pub struct DummyProvider;
+
+#[async_trait]
+impl LlmProvider for DummyProvider {
+    async fn complete(&self, prompt: &str, max_tokens: usize) -> anyhow::Result<String> {
+        let n = prompt.len().min(max_tokens);
+        Ok(format!("[dummy] {}", &prompt[..n]))
+    }
+}
+
+pub struct OpenAiProvider {
+    pub api_key: String,
+    pub model: String,
+    pub base_uri: String,
+}
+
+#[async_trait]
+impl LlmProvider for OpenAiProvider {
+    async fn complete(&self, prompt: &str, max_tokens: usize) -> anyhow::Result<String> {
+        let client = reqwest::Client::new();
+        let body = serde_json::json!({
+            "model": self.model,
+            "messages": [{"role": "user", "content": prompt}],
+            "max_tokens": max_tokens
+        });
+        let res = client
+            .post(format!("{}/chat/completions", self.base_uri))
+            .bearer_auth(&self.api_key)
+            .json(&body)
+            .send()
+            .await?;
+        let v: serde_json::Value = res.json().await?;
+        Ok(v["choices"][0]["message"]["content"]
+            .as_str()
+            .unwrap_or_default()
+            .to_string())
+    }
+}

package/templates/stacks/rust-axum/src/main.rs.tera

@@ -0,0 +1,64 @@
+//! {{ projectName }} — Axum API entrypoint.
+use std::{net::SocketAddr, sync::Arc};
+
+use axum::{routing::{get, post}, Router};
+use sqlx::postgres::PgPoolOptions;
+use tower_http::{cors::CorsLayer, trace::TraceLayer};
+use tracing_subscriber::EnvFilter;
+
+use {{ crateName }}::{
+    config::Config,
+    handlers::{auth, users, ws},
+    middleware::rate_limit::with_rate_limit,
+    AppState,
+};
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    dotenvy::dotenv().ok();
+    tracing_subscriber::fmt()
+        .with_env_filter(EnvFilter::from_default_env())
+        .init();
+
+    let cfg = Config::from_env()?;
+
+    let pool = PgPoolOptions::new()
+        .max_connections(10)
+        .connect(&cfg.database_url)
+        .await?;
+
+    sqlx::migrate!("./migrations").run(&pool).await?;
+
+    let state = Arc::new(AppState { pool, cfg: cfg.clone() });
+
+    let cors = CorsLayer::new()
+        .allow_origin(cfg.cors_layer_origins())
+        .allow_methods(tower_http::cors::Any)
+        .allow_headers(tower_http::cors::Any);
+
+    let app = Router::new()
+        .route("/healthz", get(|| async { "ok" }))
+        .route("/auth/login", post(auth::login))
+        .route("/auth/me", get(auth::me))
+        .route("/users", get(users::list).post(users::create))
+        .route("/ws", get(ws::handler))
+        .route("/openapi.json", get(serve_openapi))
+        .layer(cors)
+        .layer(TraceLayer::new_for_http())
+        .with_state(state);
+
+    // Rate limit applied via helper (avoids naming GovernorLayer generics).
+    let app = with_rate_limit(app, &cfg);
+
+    let addr: SocketAddr = ([0, 0, 0, 0], cfg.app_port).into();
+    tracing::info!("listening on {}", addr);
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    axum::serve(listener, app).await?;
+    Ok(())
+}
+
+async fn serve_openapi() -> axum::response::Json<serde_json::Value> {
+    let raw = include_str!("../openapi.json");
+    let v: serde_json::Value = serde_json::from_str(raw).unwrap_or_default();
+    axum::response::Json(v)
+}

package/templates/stacks/rust-axum/src/middleware/auth.rs

@@ -0,0 +1,20 @@
+//! Bearer JWT extractor — reads Authorization header and validates the token.
+use axum::http::{header::AUTHORIZATION, HeaderMap};
+use jsonwebtoken::{decode, DecodingKey, Validation};
+
+use crate::{config::Config, errors::AppError, services::auth_service::Claims};
+
+pub fn extract_bearer(cfg: &Config, headers: &HeaderMap) -> Result<Claims, AppError> {
+    let raw = headers
+        .get(AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .ok_or(AppError::Unauthorized)?;
+    let token = raw.strip_prefix("Bearer ").ok_or(AppError::Unauthorized)?;
+    let data = decode::<Claims>(
+        token,
+        &DecodingKey::from_secret(cfg.jwt_secret.as_bytes()),
+        &Validation::default(),
+    )
+    .map_err(|_| AppError::Unauthorized)?;
+    Ok(data.claims)
+}

package/templates/stacks/rust-axum/src/middleware/mod.rs

@@ -0,0 +1,2 @@
+pub mod auth;
+pub mod rate_limit;

package/templates/stacks/rust-axum/src/middleware/rate_limit.rs

@@ -0,0 +1,27 @@
+//! Rate limit via tower_governor — per-IP token bucket.
+//!
+//! We apply the layer through a generic helper instead of naming the
+//! `GovernorLayer<K, M>` generics explicitly — the concrete extractor /
+//! middleware types vary across tower_governor versions, so we let type
+//! inference fill them in.
+use std::sync::Arc;
+
+use axum::Router;
+use tower_governor::{governor::GovernorConfigBuilder, GovernorLayer};
+
+use crate::config::Config;
+
+/// Apply the per-IP rate limit layer to a router.
+pub fn with_rate_limit<S>(router: Router<S>, cfg: &Config) -> Router<S>
+where
+    S: Clone + Send + Sync + 'static,
+{
+    let conf = Arc::new(
+        GovernorConfigBuilder::default()
+            .per_second(cfg.rate_limit_per_sec)
+            .burst_size(cfg.rate_limit_burst)
+            .finish()
+            .expect("valid governor config"),
+    );
+    router.layer(GovernorLayer { config: conf })
+}

package/templates/stacks/rust-axum/src/models/mod.rs

@@ -0,0 +1 @@
+pub mod user;

package/templates/stacks/rust-axum/src/models/user.rs

@@ -0,0 +1,13 @@
+//! User domain model. sqlx FromRow + serde Serialize.
+use serde::{Deserialize, Serialize};
+use sqlx::FromRow;
+
+#[derive(Debug, Clone, FromRow, Serialize, Deserialize)]
+pub struct User {
+    pub id: uuid::Uuid,
+    pub email: String,
+    pub password: String,
+    pub role: String,
+    pub created_at: chrono::DateTime<chrono::Utc>,
+    pub updated_at: chrono::DateTime<chrono::Utc>,
+}

package/templates/stacks/rust-axum/src/repositories/mod.rs

@@ -0,0 +1 @@
+pub mod user_repository;

package/templates/stacks/rust-axum/src/repositories/user_repository.rs

@@ -0,0 +1,62 @@
+//! User repository — the only place sqlx is called for the User aggregate.
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::models::user::User;
+
+pub async fn find_by_email(pool: &PgPool, email: &str) -> Result<Option<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        "SELECT id, email, password, role, created_at, updated_at \
+         FROM users WHERE email = $1",
+    )
+    .bind(email)
+    .fetch_optional(pool)
+    .await
+}
+
+pub async fn find_by_id(pool: &PgPool, id: Uuid) -> Result<Option<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        "SELECT id, email, password, role, created_at, updated_at \
+         FROM users WHERE id = $1",
+    )
+    .bind(id)
+    .fetch_optional(pool)
+    .await
+}
+
+pub async fn page(pool: &PgPool, offset: i64, limit: i64) -> Result<Vec<User>, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        "SELECT id, email, password, role, created_at, updated_at \
+         FROM users ORDER BY created_at DESC LIMIT $1 OFFSET $2",
+    )
+    .bind(limit)
+    .bind(offset)
+    .fetch_all(pool)
+    .await
+}
+
+pub async fn count(pool: &PgPool) -> Result<i64, sqlx::Error> {
+    let row: (i64,) = sqlx::query_as("SELECT COUNT(*) FROM users")
+        .fetch_one(pool)
+        .await?;
+    Ok(row.0)
+}
+
+pub async fn create(
+    pool: &PgPool,
+    email: &str,
+    password_hash: &str,
+    role: &str,
+) -> Result<User, sqlx::Error> {
+    sqlx::query_as::<_, User>(
+        "INSERT INTO users (id, email, password, role) \
+         VALUES ($1, $2, $3, $4) \
+         RETURNING id, email, password, role, created_at, updated_at",
+    )
+    .bind(Uuid::new_v4())
+    .bind(email)
+    .bind(password_hash)
+    .bind(role)
+    .fetch_one(pool)
+    .await
+}

package/templates/stacks/rust-axum/src/services/auth_service.rs

@@ -0,0 +1,50 @@
+//! Auth business logic — login flow.
+use argon2::{
+    password_hash::{PasswordHash, PasswordVerifier},
+    Argon2,
+};
+use chrono::Utc;
+use jsonwebtoken::{encode, EncodingKey, Header};
+use serde::{Deserialize, Serialize};
+
+use crate::{errors::AppError, repositories::user_repository, SharedState};
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct Claims {
+    pub sub: uuid::Uuid,
+    pub email: String,
+    pub role: String,
+    pub exp: i64,
+}
+
+pub async fn login(
+    state: &SharedState,
+    email: &str,
+    password: &str,
+) -> Result<(String, i64), AppError> {
+    let email = email.trim().to_lowercase();
+    let user = user_repository::find_by_email(&state.pool, &email).await?
+        .ok_or(AppError::Unauthorized)?;
+
+    let parsed = PasswordHash::new(&user.password)
+        .map_err(|_| AppError::Unauthorized)?;
+    Argon2::default()
+        .verify_password(password.as_bytes(), &parsed)
+        .map_err(|_| AppError::Unauthorized)?;
+
+    let exp = Utc::now().timestamp() + state.cfg.jwt_expires_secs;
+    let claims = Claims {
+        sub: user.id,
+        email: user.email.clone(),
+        role: user.role.clone(),
+        exp,
+    };
+    let token = encode(
+        &Header::default(),
+        &claims,
+        &EncodingKey::from_secret(state.cfg.jwt_secret.as_bytes()),
+    )
+    .map_err(|e| AppError::Internal(anyhow::anyhow!(e)))?;
+
+    Ok((token, state.cfg.jwt_expires_secs))
+}

package/templates/stacks/rust-axum/src/services/mod.rs

@@ -0,0 +1,2 @@
+pub mod auth_service;
+pub mod user_service;

package/templates/stacks/rust-axum/src/services/user_service.rs

@@ -0,0 +1,53 @@
+//! User business logic — find / page / create.
+use argon2::{
+    password_hash::{rand_core::OsRng, PasswordHasher, SaltString},
+    Argon2,
+};
+use uuid::Uuid;
+
+use crate::{
+    errors::AppError,
+    models::user::User,
+    repositories::user_repository,
+    SharedState,
+};
+
+pub async fn find_by_id(state: &SharedState, id: Uuid) -> Result<User, AppError> {
+    user_repository::find_by_id(&state.pool, id).await?
+        .ok_or(AppError::NotFound)
+}
+
+pub async fn page(state: &SharedState, page: i64, limit: i64) -> Result<(Vec<User>, i64), AppError> {
+    let offset = (page - 1) * limit;
+    let items = user_repository::page(&state.pool, offset, limit).await?;
+    let total = user_repository::count(&state.pool).await?;
+    Ok((items, total))
+}
+
+pub async fn create(
+    state: &SharedState,
+    email: &str,
+    password: &str,
+    role: &str,
+) -> Result<User, AppError> {
+    if !["USER", "ADMIN"].contains(&role) {
+        return Err(AppError::Validation(format!("role '{}' is not allowed", role)));
+    }
+    if password.len() < 8 {
+        return Err(AppError::Validation("password must be at least 8 chars".into()));
+    }
+
+    let email = email.trim().to_lowercase();
+    if user_repository::find_by_email(&state.pool, &email).await?.is_some() {
+        return Err(AppError::Conflict("email already in use".into()));
+    }
+
+    let salt = SaltString::generate(&mut OsRng);
+    let hash = Argon2::default()
+        .hash_password(password.as_bytes(), &salt)
+        .map_err(|e| AppError::Internal(anyhow::anyhow!(e.to_string())))?
+        .to_string();
+
+    let user = user_repository::create(&state.pool, &email, &hash, role).await?;
+    Ok(user)
+}

package/templates/stacks/rust-axum/tests/integration_test.rs.tera

@@ -0,0 +1,13 @@
+//! Smoke integration test. Exercises pure functions that don't need a DB.
+//!
+//! Full HTTP tests require a Postgres instance and live binding — keep those
+//! gated behind `#[ignore]` so `cargo test` stays fast in CI without infra.
+
+#[test]
+fn config_defaults_are_sane() {
+    std::env::set_var("DATABASE_URL", "postgres://user:pass@localhost:5432/x");
+    let cfg = {{ crateName }}::config::Config::from_env().expect("config");
+    assert_eq!(cfg.app_port, 8000);
+    assert!(cfg.rate_limit_per_sec > 0);
+    assert!(cfg.rate_limit_burst >= cfg.rate_limit_per_sec as u32);
+}

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Dewtech Technologies
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.