@stacksjs/defaults 0.70.58 → 0.70.60

package/app/Models/commerce/WaitlistRestaurant.ts

@@ -0,0 +1,187 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation'
+
+export default defineModel({
+  name: 'WaitlistRestaurant',
+  table: 'waitlist_restaurants',
+  primaryKey: 'id',
+  autoIncrement: true,
+  belongsTo: ['Customer'],
+  traits: {
+    useUuid: true,
+    useTimestamps: true,
+    useSearch: {
+      displayable: ['id', 'name', 'email', 'phone', 'partySize', 'checkInTime', 'tablePreference', 'status', 'quotedWaitTime', 'actualWaitTime', 'queuePosition'],
+      searchable: ['name', 'email', 'phone'],
+      sortable: ['name', 'partySize', 'checkInTime', 'createdAt', 'updatedAt', 'status', 'queuePosition'],
+      filterable: ['tablePreference', 'status'],
+    },
+
+    useSeeder: {
+      count: 10,
+    },
+
+    useApi: {
+      uri: 'waitlist-restaurants',
+    },
+
+    observe: true,
+  },
+
+  attributes: {
+    name: {
+      order: 1,
+      fillable: true,
+      validation: {
+        rule: schema.string().required().max(255),
+        message: {
+          max: 'Name must have a maximum of 255 characters',
+        },
+      },
+      factory: faker => faker.person.fullName(),
+    },
+
+    email: {
+      order: 2,
+      fillable: true,
+      validation: {
+        rule: schema.string().required().email().max(255),
+        message: {
+          max: 'Email must have a maximum of 255 characters',
+        },
+      },
+      factory: faker => faker.internet.email(),
+    },
+
+    phone: {
+      order: 3,
+      fillable: true,
+      validation: {
+        rule: schema.string().max(100),
+        message: {
+          max: 'Phone number must have a maximum of 100 characters',
+        },
+      },
+      factory: faker => faker.phone.number(),
+    },
+
+    partySize: {
+      order: 4,
+      fillable: true,
+      validation: {
+        rule: schema.number().required().min(1),
+        message: {
+          min: 'Party size must be at least 1',
+        },
+      },
+      factory: faker => faker.number.int({ min: 1, max: 20 }),
+    },
+
+    checkInTime: {
+      order: 5,
+      fillable: true,
+      validation: {
+        rule: schema.timestamp().required(),
+      },
+      factory: (faker) => {
+        const date = faker.date.future()
+        return date.toISOString().slice(0, 19).replace('T', ' ')
+      },
+    },
+
+    tablePreference: {
+      order: 6,
+      fillable: true,
+      validation: {
+        rule: schema.enum(['indoor', 'bar', 'booth', 'no_preference']).required(),
+      },
+      factory: faker => faker.helpers.arrayElement(['indoor', 'bar', 'booth', 'no_preference']),
+    },
+
+    status: {
+      default: 'waiting',
+      order: 7,
+      fillable: true,
+      validation: {
+        rule: schema.enum(['waiting', 'seated', 'cancelled', 'no_show']).required(),
+      },
+      factory: faker => faker.helpers.arrayElement(['waiting', 'seated', 'cancelled', 'no_show']),
+    },
+
+    quoted_wait_time: {
+      order: 8,
+      fillable: true,
+      validation: {
+        rule: schema.number().required().min(0),
+        message: {
+          min: 'Quoted wait time must be at least 0 minutes',
+        },
+      },
+      factory: faker => faker.number.int({ min: 0, max: 120 }),
+    },
+
+    actual_wait_time: {
+      order: 9,
+      fillable: true,
+      validation: {
+        rule: schema.number().min(0),
+        message: {
+          min: 'Actual wait time must be at least 0 minutes',
+        },
+      },
+      factory: faker => faker.helpers.maybe(() => faker.number.int({ min: 0, max: 180 }), { probability: 0.7 }),
+    },
+
+    queue_position: {
+      order: 10,
+      fillable: true,
+      validation: {
+        rule: schema.number().min(1),
+        message: {
+          min: 'Queue position must be at least 1',
+        },
+      },
+      factory: faker => faker.helpers.maybe(() => faker.number.int({ min: 1, max: 50 }), { probability: 0.7 }),
+    },
+
+    seatedAt: {
+      order: 11,
+      fillable: true,
+      validation: {
+        rule: schema.timestamp(),
+      },
+      factory: (faker) => {
+        const date = faker.date.future()
+        return date.toISOString().slice(0, 19).replace('T', ' ')
+      },
+    },
+
+    noShowAt: {
+      order: 12,
+      fillable: true,
+      validation: {
+        rule: schema.timestamp(),
+      },
+      factory: (faker) => {
+        const date = faker.date.future()
+        return date.toISOString().slice(0, 19).replace('T', ' ')
+      },
+    },
+
+    cancelledAt: {
+      order: 13,
+      fillable: true,
+      validation: {
+        rule: schema.timestamp(),
+      },
+      factory: (faker) => {
+        const date = faker.date.future()
+        return date.toISOString().slice(0, 19).replace('T', ' ')
+      },
+    },
+  },
+
+  dashboard: {
+    highlight: true,
+  },
+} as const)

package/app/Models/realtime/Websocket.ts

@@ -0,0 +1,77 @@
+import { defineModel } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation'
+
+export default defineModel({
+  name: 'Websocket',
+  table: 'websockets',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  traits: {
+    useTimestamps: true,
+    useSeeder: {
+      count: 20,
+    },
+    useApi: {
+      uri: 'websockets',
+      routes: ['index', 'store', 'show'],
+    },
+    observe: true,
+  },
+
+  attributes: {
+    type: {
+      required: true,
+      order: 1,
+      fillable: true,
+      validation: {
+        rule: schema.enum(['disconnection', 'error', 'success']),
+        message: {
+          in: 'Type must be one of: disconnection, error, success',
+        },
+      },
+      factory: faker => faker.helpers.arrayElement(['success', 'success', 'success', 'disconnection', 'error']),
+    },
+
+    socket: {
+      required: true,
+      order: 2,
+      fillable: true,
+      validation: {
+        rule: schema.string().min(1).max(255),
+        message: {
+          min: 'Socket identifier must be provided',
+          max: 'Socket identifier must not exceed 255 characters',
+        },
+      },
+      factory: faker => faker.string.alphanumeric(20),
+    },
+
+    details: {
+      required: true,
+      order: 3,
+      fillable: true,
+      validation: {
+        rule: schema.string().min(1).max(1000),
+        message: {
+          min: 'Details must be provided',
+          max: 'Details must not exceed 1000 characters',
+        },
+      },
+      factory: faker => faker.lorem.sentence(),
+    },
+
+    time: {
+      required: true,
+      order: 4,
+      fillable: true,
+      validation: {
+        rule: schema.number(),
+        message: {
+          date: 'Time must be a valid timestamp',
+        },
+      },
+      factory: faker => faker.date.recent().getTime(),
+    },
+  },
+} as const)

package/app/Notifications/README.md

@@ -0,0 +1,31 @@
+# What are Notifications
+
+Notifications are a way to define a message that should be sent somewhere. It is a unified API to send a message across multiple channels, such as email, SMS, Push Notifications, and social channels.
+
+## Get Started
+
+The following command will bootstrap a new notification in the `app/Notifications` directory.
+
+```sh
+buddy make:notification Welcome
+```
+
+## 🚜 Contributing
+
+Please review the [Contributing Guide](https://github.com/stacksjs/contributing) for details.
+
+## 🏝 Community
+
+For help, discussion about best practices, or any other conversation that would benefit from being searchable:
+
+[Discussions on GitHub](https://github.com/stacksjs/stacks/discussions)
+
+For casual chit-chat with others using this package:
+
+[Join the Stacks Discord Server](https://discord.gg/stacksjs)
+
+## 📄 License
+
+The MIT License (MIT). Please see [LICENSE](../../LICENSE.md) for more information.
+
+Made with 💙

package/app/Notifications/Welcome.ts

@@ -0,0 +1,32 @@
+import { config } from '@stacksjs/config'
+import { Email } from '@stacksjs/email'
+import { log } from '@stacksjs/logging'
+
+export default new Email({
+  // or Sms or Push or Webhook or Chat
+  name: 'welcome', // optional, defaults to the file name
+  subject: 'Welcome to Stacks', // optional, but recommended
+  to: 'some@email.com', // optional, has to be defined here or set when sending
+  from: config.email.from, // optional, defaults to the config value
+  template: 'Welcome', // resources/emails/Welcome.stx
+
+  handle: async () => {
+    // if needed, trigger some custom logic here
+    // or simply return a custom HTTP message
+    return {
+      message: 'Email sent',
+    }
+  },
+
+  onError: async (error: Error) => {
+    log.error(error)
+    // if needed, trigger some custom logic here
+    return {
+      message: 'Email failed to send',
+    }
+  },
+
+  onSuccess: () => {
+    log.info('Some additional logging here...')
+  },
+})

package/app/Policies/PostPolicy.ts

@@ -0,0 +1,131 @@
+import type { UserModel } from '@stacksjs/orm'
+import { BasePolicy } from '@stacksjs/auth'
+
+/**
+ * Post Policy
+ *
+ * This policy controls authorization for Post model actions.
+ * Each method returns true to allow, false to deny, or an
+ * AuthorizationResponse for custom messages.
+ *
+ * Usage:
+ * 1. Register in app/Gates.ts:
+ *    policies: { 'Post': 'PostPolicy' }
+ *
+ * 2. Use in your code:
+ *    import { Gate } from '@stacksjs/auth'
+ *    await Gate.authorize('view', user, post)
+ *
+ * 3. Or use the middleware:
+ *    route.put('/posts/:post', 'UpdatePost').middleware('can:update,post')
+ */
+
+// Define your Post type (or import from your models)
+interface Post {
+  id: number
+  user_id: number
+  published: boolean
+  title?: string
+}
+
+export default class PostPolicy extends BasePolicy<Post> {
+  /**
+   * Run before any other checks.
+   * Return true to allow, false to deny, null to continue.
+   */
+  before(user: UserModel | null, ability: string): boolean | null {
+    // Example: Admins can do anything with posts
+    // if (user?.role === 'admin') {
+    //   return true
+    // }
+    return null // Continue to specific checks
+  }
+
+  /**
+   * Determine if the user can view any posts.
+   */
+  viewAny(user: UserModel | null): boolean {
+    // Anyone can view the posts list
+    return true
+  }
+
+  /**
+   * Determine if the user can view a specific post.
+   */
+  view(user: UserModel | null, post: Post): boolean {
+    // Published posts are visible to everyone
+    if (post.published) {
+      return true
+    }
+
+    // Unpublished posts only visible to the author
+    return user?.id === post.user_id
+  }
+
+  /**
+   * Determine if the user can create posts.
+   */
+  create(user: UserModel | null): boolean {
+    // Must be logged in to create posts
+    return user !== null
+  }
+
+  /**
+   * Determine if the user can update the post.
+   */
+  update(user: UserModel | null, post: Post): boolean {
+    // Only the author can update their post
+    return user?.id === post.user_id
+  }
+
+  /**
+   * Determine if the user can delete the post.
+   */
+  delete(user: UserModel | null, post: Post): boolean {
+    // Only the author can delete their post
+    return user?.id === post.user_id
+  }
+
+  /**
+   * Determine if the user can restore a soft-deleted post.
+   */
+  restore(user: UserModel | null, post: Post): boolean {
+    return user?.id === post.user_id
+  }
+
+  /**
+   * Determine if the user can permanently delete the post.
+   */
+  forceDelete(user: UserModel | null, post: Post): boolean {
+    // Only allow force delete if you're the author
+    return user?.id === post.user_id
+  }
+
+  /**
+   * Custom ability: Can the user publish the post?
+   */
+  publish(user: UserModel | null, post: Post): boolean {
+    return user?.id === post.user_id
+  }
+
+  /**
+   * Custom ability: Can the user feature the post?
+   * Returns a detailed response.
+   */
+  feature(user: UserModel | null, post: Post) {
+    if (!user) {
+      return this.deny('You must be logged in to feature posts.')
+    }
+
+    if (!post.published) {
+      return this.deny('Only published posts can be featured.')
+    }
+
+    // Only admins can feature posts (example)
+    // if (user.role !== 'admin') {
+    //   return this.deny('Only administrators can feature posts.')
+    // }
+
+    return this.allow()
+  }
+}

package/app/README.md

@@ -0,0 +1,23 @@
+# The App Folder
+
+The Stacks App directory is where you would store
+
+## 🚜 Contributing
+
+Please review the [Contributing Guide](https://github.com/stacksjs/contributing) for details.
+
+## 🏝 Community
+
+For help, discussion about best practices, or any other conversation that would benefit from being searchable:
+
+[Discussions on GitHub](https://github.com/stacksjs/stacks/discussions)
+
+For casual chit-chat with others using this package:
+
+[Join the Stacks Discord Server](https://discord.gg/stacksjs)
+
+## 📄 License
+
+The MIT License (MIT). Please see [LICENSE](../../LICENSE.md) for more information.
+
+Made with 💙

package/app/Routes.ts

@@ -0,0 +1,47 @@
+// Route registry types live in `@stacksjs/router` (the consumer) — see
+// stacksjs/stacks#1863. Re-exported here for backwards compatibility
+// with any project code that imports them via `app/Routes`.
+import type { RouteDefinition, RouteRegistry } from '@stacksjs/router'
+
+export type { RouteDefinition, RouteRegistry }
+
+/**
+ * Application route registry.
+ *
+ * Define your route files here. The key becomes the URL prefix
+ * automatically. The `'web'` key is the only one that loads at root
+ * (`/`) with no prefix — see the route-loader's `NO_PREFIX_KEYS` for
+ * the canonical list.
+ *
+ * `'api'` auto-prefixes with `/api` so user routes line up with the
+ * rpx proxy forward path (stacksjs/stacks#1835). Writing
+ * `route.get('/cart/add', ...)` in `routes/api.ts` registers as
+ * `/api/cart/add` — exactly what `https://<domain>/api/cart/add`
+ * resolves to via the dev proxy.
+ *
+ * @example
+ * // Default API routes - routes/api.ts loaded at /api/*
+ * 'api': 'api',
+ *
+ * // Auto prefix from key - routes/v1.ts loaded at /v1/*
+ * 'v1': 'v1',
+ *
+ * // Explicit prefix - routes/api/v1.ts loaded at /api/v1/*
+ * 'legacy': { path: 'api/v1', prefix: '/api/v1' },
+ *
+ * // No prefix override - routes/internal.ts loaded at /* (no prefix)
+ * 'internal': { path: 'internal', prefix: '' },
+ *
+ * // With middleware - routes/admin.ts loaded at /admin/* with auth
+ * 'admin': { path: 'admin', middleware: ['auth'] },
+ */
+export default {
+  // Default API routes — auto-prefixed with /api by the route-loader
+  // so `routes/api.ts` aligns with the proxy forward path.
+  'api': 'api',
+
+  // Add versioned or prefixed routes here:
+  'v1': { path: 'v1', prefix: 'v1' }
+  // 'v2': 'api/v2',
+  // 'admin': { path: 'admin', middleware: ['auth'] },
+} satisfies RouteRegistry

package/app/Scheduler.ts

@@ -0,0 +1,28 @@
+import process from 'node:process'
+import { schedule } from '@stacksjs/scheduler'
+
+/**
+ * **Scheduler**
+ *
+ * Define your scheduled tasks here. Jobs, actions, and shell commands
+ * can all be scheduled with a fluent, expressive API.
+ *
+ * @see https://docs.stacksjs.com/scheduling
+ */
+export default function () {
+  // Run the Inspire job every hour
+  schedule
+    .job('Inspire')
+    .hourly()
+    .setTimeZone('America/Los_Angeles')
+
+  // Run a custom action every five minutes
+  // schedule.action('CleanupTempFiles').everyFiveMinutes()
+
+  // Run a shell command daily at midnight
+  // schedule.command('echo "Daily maintenance complete"').daily()
+}
+
+process.on('SIGINT', () => {
+  schedule.gracefulShutdown().then(() => process.exit(0))
+})

package/app/Storefront/CartCookie.ts

@@ -0,0 +1,109 @@
+/**
+ * Cart cookie helper — signs / verifies the `stacks_cart` token.
+ *
+ * Storefront cart actions used to set the cookie to a raw UUIDv7. The
+ * value is hard to *guess* (122 bits of randomness) but trivially
+ * *tamperable* — a hostile client can replace it with any other
+ * known token to read someone else's cart. Signing the cookie with
+ * an HMAC over APP_KEY closes that hole: on read, we reject any
+ * value whose signature doesn't match, falling back to "no cart" so
+ * the action mints a fresh one.
+ *
+ * Format: `<token>.<sig>` where `<sig>` is the first 22 base64url
+ * characters of `HMAC-SHA256(APP_KEY, token)` (16 bytes → 128 bits,
+ * plenty for tamper detection without bloating the cookie).
+ *
+ * Backwards compat: legacy unsigned tokens still parse (we treat
+ * "no `.`" as unsigned) so existing carts don't get orphaned by the
+ * upgrade. Once the cookie expires (30 days) every shopper has the
+ * signed form.
+ */
+
+import { createHmac } from 'node:crypto'
+
+const SIG_BYTES = 16
+const SIG_CHARS = 22 // 16 bytes → 22 base64url chars (no padding)
+
+/**
+ * Resolve the APP_KEY at call time so test envs that swap `process.env`
+ * pick up the new value. Strips the `base64:` prefix Stacks uses for
+ * keys generated by `buddy key:generate`. Falls back to a short
+ * sentinel so a missing key doesn't crash the request — but the
+ * resulting signature is predictable and easy to forge, so the
+ * sentinel doubles as a "fix your env" smell in dev.
+ */
+function getKey(): string {
+  const raw = process.env.APP_KEY || ''
+  if (raw.startsWith('base64:'))
+    return raw.slice('base64:'.length)
+  return raw || 'unsigned-fallback-set-APP_KEY'
+}
+
+function sign(token: string): string {
+  const sig = createHmac('sha256', getKey())
+    .update(token)
+    .digest('base64url')
+    .slice(0, SIG_CHARS)
+  return `${token}.${sig}`
+}
+
+/**
+ * Constant-time string compare so signature verification doesn't
+ * leak timing info. Both sides are the same length here (22 chars),
+ * so the early-exit length check is safe.
+ */
+function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false
+  let diff = 0
+  for (let i = 0; i < a.length; i++)
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i)
+  return diff === 0
+}
+
+/**
+ * Pull a verified cart token out of the request, or null if the
+ * cookie is missing/malformed/forged. Legacy unsigned tokens
+ * (no `.`) are accepted once and re-signed on the next write.
+ */
+export function readCartCookie(request: any, cookieName: string): string | null {
+  const raw = request.cookies?.get?.(cookieName)
+  if (!raw || typeof raw !== 'string') return null
+
+  // Legacy: unsigned UUID. Accept and let the caller re-sign on write.
+  // We can't tell apart "valid legacy" from "client-forged garbage",
+  // but the action's existing flow already does a DB lookup that
+  // returns no row for unknown tokens — same fallback path.
+  if (!raw.includes('.')) return raw
+
+  const dot = raw.lastIndexOf('.')
+  const token = raw.slice(0, dot)
+  const presented = raw.slice(dot + 1)
+  if (!token || presented.length !== SIG_CHARS) return null
+
+  const expected = createHmac('sha256', getKey())
+    .update(token)
+    .digest('base64url')
+    .slice(0, SIG_CHARS)
+
+  return timingSafeEqual(expected, presented) ? token : null
+}
+
+/**
+ * Write a signed cart token to the response cookies. `opts` mirrors
+ * the existing `request.cookies.set(name, value, opts)` shape.
+ */
+export function writeCartCookie(
+  request: any,
+  cookieName: string,
+  token: string,
+  opts: Record<string, unknown>,
+): void {
+  request.cookies?.set?.(cookieName, sign(token), opts)
+}
+
+export const cartCookie = { read: readCartCookie, write: writeCartCookie, sign }
+export default cartCookie
+
+// Re-export `SIG_BYTES` so tests can assert the byte budget without
+// recomputing it. Not used at runtime in the storefront flow.
+export const _internals = { SIG_BYTES, SIG_CHARS }

package/package.json

@@ -1,14 +1,15 @@
 {
   "name": "@stacksjs/defaults",
   "type": "module",
-  "version": "0.70.58",
+  "version": "0.70.60",
   "description": "Default Stacks scaffold resources (views, layouts, components, preloader) — shipped so apps consuming the framework from node_modules get the same fallback resources a vendored checkout provides. Source of truth: storage/framework/defaults.",
   "author": "Chris Breuer",
   "license": "MIT",
   "homepage": "https://github.com/stacksjs/stacks/tree/main/storage/framework/defaults",
   "files": [
     "README.md",
-    "resources"
+    "resources",
+    "app"
   ],
   "exports": {
     "./*": "./*",