@imksh/create 1.0.0

package/templates/mern/server/src/middleware/auth.middleware.js

@@ -0,0 +1,43 @@
+import jwt from "jsonwebtoken";
+import User from "../models/user.model.js";
+import { verifyToken } from "../utils/jwt.js";
+import logger from "../utils/logger.js";
+
+export const protect = async (req, res, next) => {
+  let token;
+  if (req.cookies?.token) {
+    token = req.cookies.token;
+  } else if (
+    req.headers.authorization &&
+    req.headers.authorization.startsWith("Bearer")
+  ) {
+    token = req.headers.authorization.split(" ")[1];
+  }
+
+  if (!token) {
+    return res
+      .status(401)
+      .json({ message: "Not authorized, no token provided" });
+  }
+
+  try {
+    const decoded = verifyToken(token);
+    if (!decoded) {
+      return res.status(401).json({ message: "Not authorized, invalid token" });
+    }
+
+    req.user = await User.findById(decoded.id).select("-password");
+    if (!req.user) {
+      return res
+        .status(401)
+        .json({ message: "Not authorized, user not found" });
+    }
+
+    return next();
+  } catch (error) {
+    logger.error("Auth middleware error", error);
+    return res
+      .status(401)
+      .json({ message: "Not authorized, token verification failed" });
+  }
+};

package/templates/mern/server/src/middleware/errorHandler.js

@@ -0,0 +1,22 @@
+/**
+ * Not Found Middleware
+ * Catches all unmatched requests and forwards a 404 error
+ */
+export const notFound = (req, res, next) => {
+  const error = new Error(`Not Found - ${req.originalUrl}`);
+  res.status(404);
+  next(error);
+};
+
+/**
+ * Global Error Handler Middleware
+ * Formats error responses nicely in JSON
+ */
+export const errorHandler = (err, req, res, next) => {
+  const statusCode = err.status || err.statusCode || (res.statusCode === 200 ? 500 : res.statusCode);
+  res.status(statusCode).json({
+    success: false,
+    message: err.message || "An unexpected error occurred",
+    stack: process.env.NODE_ENV === "production" ? undefined : err.stack,
+  });
+};

package/templates/mern/server/src/middleware/multer.js

@@ -0,0 +1,21 @@
+import multer from "multer";
+
+// Configure memory storage to receive file buffers directly
+const storage = multer.memoryStorage();
+
+// Validate file types (only allow common image formats)
+const fileFilter = (req, file, cb) => {
+  if (file.mimetype.startsWith("image/")) {
+    cb(null, true);
+  } else {
+    cb(new Error("Only image files are allowed!"), false);
+  }
+};
+
+export const upload = multer({
+  storage,
+  fileFilter,
+  limits: {
+    fileSize: 5 * 1024 * 1024, // 5MB limit
+  },
+});

package/templates/mern/server/src/middleware/rateLimiter.js

@@ -0,0 +1,57 @@
+import rateLimit from "express-rate-limit";
+
+const createLimiter = ({
+  windowMs,
+  max,
+  message,
+  skipSuccessfulRequests = false,
+}) =>
+  rateLimit({
+    windowMs,
+    max,
+    standardHeaders: true,
+    legacyHeaders: false,
+    skipSuccessfulRequests,
+
+    keyGenerator: (req) => {
+      return req.user?.id || req.ip || req.headers["x-forwarded-for"] || req.socket.remoteAddress;
+    },
+
+    handler: (req, res) => {
+      res.status(429).json({
+        success: false,
+        message,
+      });
+    },
+  });
+
+/**
+ * General API Limiter
+ * 100 requests / 15 minutes
+ */
+export const apiLimiter = createLimiter({
+  windowMs: 15 * 60 * 1000,
+  max: 100,
+  message: "Too many requests. Please try again later.",
+});
+
+/**
+ * Authentication Limiter
+ * 10 failed attempts / 15 minutes
+ */
+export const authLimiter = createLimiter({
+  windowMs: 15 * 60 * 1000,
+  max: 10,
+  skipSuccessfulRequests: true,
+  message: "Too many login attempts. Please try again later.",
+});
+
+/**
+ * Upload Limiter
+ * 20 uploads / hour
+ */
+export const uploadLimiter = createLimiter({
+  windowMs: 60 * 60 * 1000,
+  max: 20,
+  message: "Upload limit reached. Please try again in an hour.",
+});

package/templates/mern/server/src/models/otp.model.js

@@ -0,0 +1,21 @@
+import mongoose from "mongoose";
+
+const otpSchema = new mongoose.Schema({
+  email: {
+    type: String,
+    required: true,
+  },
+  otp: {
+    type: String,
+    required: true,
+  },
+  createdAt: {
+    type: Date,
+    default: Date.now(),
+    expires: 300,
+  },
+});
+
+const Otp = mongoose.model("Otp", otpSchema);
+
+export default Otp;

package/templates/mern/server/src/models/pushSubscription.model.js

@@ -0,0 +1,32 @@
+import mongoose from "mongoose";
+
+const pushSubscriptionSchema = new mongoose.Schema(
+  {
+    endpoint: {
+      type: String,
+      required: true,
+      unique: true,
+    },
+    keys: {
+      p256dh: { type: String, required: true },
+      auth: { type: String, required: true },
+    },
+    user: {
+      type: mongoose.Schema.Types.ObjectId,
+      ref: "User",
+    },
+    role: {
+      type: String,
+      enum: ["admin", "user"],
+      default: "user",
+    },
+    expiresAt: {
+      type: Date,
+      default: () => new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+      index: { expires: 0 },
+    },
+  },
+  { timestamps: true },
+);
+
+export default mongoose.model("PushSubscription", pushSubscriptionSchema);

package/templates/mern/server/src/models/user.model.js

@@ -0,0 +1,43 @@
+import mongoose from "mongoose";
+
+const userSchema = new mongoose.Schema(
+  {
+    name: {
+      type: String,
+      required: [true, "Name is required"],
+      trim: true,
+    },
+
+    email: {
+      type: String,
+      required: [true, "Email is required"],
+      unique: true,
+      lowercase: true,
+      trim: true,
+    },
+    phone: {
+      type: String,
+    },
+    avatar: {
+      publicId: {
+        type: String,
+      },
+      url: {
+        type: String,
+      },
+    },
+    password: {
+      type: String,
+      required: [true, "Password is required"],
+    },
+    role: {
+      type: String,
+      enum: ["user", "admin", "other"],
+      default: "user",
+    },
+  },
+  { timestamps: true },
+);
+
+const User = mongoose.model("User", userSchema);
+export default User;

package/templates/mern/server/src/routes/auth.route.js

@@ -0,0 +1,22 @@
+import express from "express";
+import {
+  signup,
+  login,
+  getMe,
+  logout,
+  updateMe,
+} from "../controllers/auth.controller.js";
+import { protect } from "../middleware/auth.middleware.js";
+import { apiLimiter } from "../middleware/rateLimiter.js";
+
+const router = express.Router();
+
+router.use(apiLimiter);
+
+router.post("/signup", signup);
+router.post("/login", login);
+router.post("/logout", logout);
+router.get("/me", protect, getMe);
+router.put("/me", protect, updateMe);
+
+export default router;

package/templates/mern/server/src/routes/index.js

@@ -0,0 +1,10 @@
+import express from "express";
+import authRoutes from "./auth.route.js";
+import uploadRoutes from "./upload.route.js";
+
+const router = express.Router();
+
+router.use("/auth", authRoutes);
+router.use("/upload", uploadRoutes);
+
+export default router;

package/templates/mern/server/src/routes/upload.route.js

@@ -0,0 +1,12 @@
+import express from "express";
+import { upload } from "../middleware/multer.js";
+import { uploadFile } from "../controllers/upload.controller.js";
+import { protect } from "../middleware/auth.middleware.js";
+import { uploadLimiter } from "../middleware/rateLimiter.js";
+
+const router = express.Router();
+
+// Mount file upload route (protected by auth and rate-limited)
+router.post("/", protect, uploadLimiter, upload.single("file"), uploadFile);
+
+export default router;

package/templates/mern/server/src/services/auth.service.js

@@ -0,0 +1,162 @@
+import User from "../models/user.model.js";
+import Otp from "../models/otp.model.js";
+import bcrypt from "bcrypt";
+import { generateToken } from "../utils/jwt.js";
+import { sendOtpEmail } from "../utils/emailOtp.js";
+import { uploadSingleToCloudinary, deleteFromCloudinary } from "../utils/cloudinaryUpload.js";
+import logger from "../utils/logger.js";
+
+export const authService = {
+  /**
+   * User Signup
+   */
+  signup: async ({ name, email, phone, password }) => {
+    const existingUser = await User.findOne({ email });
+    if (existingUser) {
+      const err = new Error("User already exists");
+      err.status = 409;
+      throw err;
+    }
+
+    const salt = await bcrypt.genSalt(10);
+    const hashedPassword = await bcrypt.hash(password, salt);
+
+    const photoURL = `https://placehold.co/600x400?text=${name.charAt(0).toUpperCase()}`;
+
+    const newUser = await User.create({
+      name,
+      email: email.toLowerCase(),
+      phone,
+      role: "user",
+      password: hashedPassword,
+      avatar: {
+        url: photoURL,
+        publicId: "",
+      },
+    });
+
+    return newUser;
+  },
+
+  /**
+   * User Login
+   */
+  login: async ({ email, password }) => {
+    const user = await User.findOne({ email });
+    if (!user) {
+      const err = new Error("User not found");
+      err.status = 404;
+      throw err;
+    }
+
+    const isValid = await bcrypt.compare(password, user.password);
+    if (!isValid) {
+      const err = new Error("Invalid Credentials");
+      err.status = 401;
+      throw err;
+    }
+
+    return user;
+  },
+
+  /**
+   * Generate and Send OTP
+   */
+  generateOtp: async (email) => {
+    const user = await User.findOne({ email });
+    if (!user) {
+      const err = new Error("User not found");
+      err.status = 404;
+      throw err;
+    }
+
+    const existingOtp = await Otp.findOne({ email });
+    if (existingOtp) {
+      await existingOtp.deleteOne();
+    }
+
+    const otp = Math.floor(100000 + Math.random() * 900000).toString();
+    const hashedOtp = await bcrypt.hash(otp, 10);
+
+    await Otp.create({
+      email,
+      otp: hashedOtp,
+    });
+
+    await sendOtpEmail(email, otp);
+    return true;
+  },
+
+  /**
+   * Verify OTP
+   */
+  verifyOtp: async ({ email, otp }) => {
+    const user = await User.findOne({ email });
+    if (!user) {
+      const err = new Error("User not found");
+      err.status = 404;
+      throw err;
+    }
+
+    const existingOtp = await Otp.findOne({ email });
+    if (!existingOtp) {
+      const err = new Error("OTP match failed");
+      err.status = 400;
+      throw err;
+    }
+
+    const isMatched = await bcrypt.compare(otp, existingOtp.otp);
+    if (!isMatched) {
+      const err = new Error("OTP match failed");
+      err.status = 400;
+      throw err;
+    }
+
+    return user;
+  },
+
+  /**
+   * Reset Password
+   */
+  resetPassword: async (user, newPassword) => {
+    const hashedPassword = await bcrypt.hash(newPassword, 10);
+    user.password = hashedPassword;
+    await user.save();
+    return true;
+  },
+
+  /**
+   * Update Profile
+   */
+  updateProfile: async (userId, { name, phone, file }) => {
+    const user = await User.findById(userId);
+    if (!user) {
+      const err = new Error("User not found");
+      err.status = 404;
+      throw err;
+    }
+
+    if (name) user.name = name;
+    if (phone) user.phone = phone;
+
+    if (file) {
+      const uploadResult = await uploadSingleToCloudinary(file, {
+        folder: "codelab/avatars",
+      });
+
+      if (user.avatar && user.avatar.publicId) {
+        await deleteFromCloudinary(user.avatar.publicId).catch((err) =>
+          logger.error("Old avatar delete error", err)
+        );
+      }
+
+      user.avatar = {
+        url: uploadResult.url,
+        publicId: uploadResult.publicId,
+      };
+    }
+
+    await user.save();
+    return user;
+  },
+};

package/templates/mern/server/src/utils/authToken.js

@@ -0,0 +1,26 @@
+import jwt from "jsonwebtoken";
+
+export const genToken = async (user, res) => {
+  try {
+    const payload = {
+      id: user._id,
+      role: user.role || "admin",
+    };
+    const token = await jwt.sign(payload, process.env.JWT_SECRET, {
+      expiresIn: "1d",
+    });
+    //expires in day=1d,in hour=1h,in seconds=1
+
+    console.log(token);
+    res.cookie("token", token, {
+      maxAge: 1000 * 60 * 60 * 24,
+      httpOnly: process.env.NODE_ENV !== "production" ? false : true,
+      secure: process.env.NODE_ENV !== "production" ? false : true,
+      sameSite: process.env.NODE_ENV !== "production" ? "lax" : "none",
+    });
+    return token;
+  } catch (error) {
+    console.log(error);
+    throw error;
+  }
+};

package/templates/mern/server/src/utils/cloudinary.js

@@ -0,0 +1,27 @@
+import { v2 as cloudinary } from "cloudinary";
+import { CloudinaryStorage } from "multer-storage-cloudinary";
+import multer from "multer";
+
+cloudinary.config({
+  cloud_name: process.env.CLOUDINARY_CLOUD_NAME,
+  api_key: process.env.CLOUDINARY_API_KEY,
+  api_secret: process.env.CLOUDINARY_API_SECRET,
+});
+
+// Storage engine for profile images / file submissions
+const storage = new CloudinaryStorage({
+  cloudinary,
+  params: (req, file) => ({
+    folder: "lms-uploads",
+    allowed_formats: ["jpg", "jpeg", "png", "gif", "pdf", "webp"],
+    resource_type: file.mimetype.startsWith("image/") ? "image" : "raw",
+    public_id: `${Date.now()}-${file.originalname.replace(/\s+/g, "_")}`,
+  }),
+});
+
+export const upload = multer({
+  storage,
+  limits: { fileSize: 10 * 1024 * 1024 }, // 10 MB cap
+});
+
+export { cloudinary };

package/templates/mern/server/src/utils/cloudinaryUpload.js

@@ -0,0 +1,87 @@
+import cloudinary from "../config/cloudinary.js";
+import logger from "./logger.js";
+
+const uploadToCloudinary = async (
+  file,
+  {
+    folder = "uploads",
+    width,
+    height,
+    crop,
+    quality = "auto",
+    format = "auto",
+    ...options
+  } = {},
+) => {
+  if (!file?.buffer) {
+    throw new Error("Invalid file.");
+  }
+
+  const dataURI = `data:${file.mimetype};base64,${file.buffer.toString(
+    "base64",
+  )}`;
+
+  const result = await cloudinary.uploader.upload(dataURI, {
+    folder,
+    width,
+    height,
+    crop,
+    quality,
+    format,
+    ...options,
+  });
+
+  return {
+    url: result.secure_url,
+    publicId: result.public_id,
+    assetId: result.asset_id,
+    width: result.width,
+    height: result.height,
+    format: result.format,
+    bytes: result.bytes,
+  };
+};
+
+/**
+ * Upload Single Image
+ */
+export const uploadSingleToCloudinary = async (
+  file,
+  options = {},
+) => {
+  try {
+    return await uploadToCloudinary(file, options);
+  } catch (error) {
+    logger.error("Cloudinary Upload Error", error);
+    throw new Error("Failed to upload image.");
+  }
+};
+
+/**
+ * Upload Multiple Images
+ */
+export const uploadMultipleToCloudinary = async (
+  files = [],
+  options = {},
+) => {
+  try {
+    return await Promise.all(
+      files.map((file) => uploadToCloudinary(file, options)),
+    );
+  } catch (error) {
+    logger.error("Cloudinary Upload Error", error);
+    throw new Error("Failed to upload images.");
+  }
+};
+
+/**
+ * Delete Image
+ */
+export const deleteFromCloudinary = async (publicId) => {
+  try {
+    return await cloudinary.uploader.destroy(publicId);
+  } catch (error) {
+    logger.error("Cloudinary Delete Error", error);
+    throw new Error("Failed to delete image.");
+  }
+};