@starci/hfs 4.2.12 → 4.2.14

package/templates/fe/transport/graphql/clients/clients/no-auth.ts

@@ -0,0 +1,33 @@
+import { ApolloClient, ApolloLink, InMemoryCache } from "@apollo/client"
+import {
+    createAttachLocaleLink,
+    createErrorLink,
+    createHttpLink,
+    createRetryLink,
+    createTimeoutLink,
+    defaultOptions,
+} from "../links"
+import type { ErrorReporter } from "../links/error"
+
+/** What the anonymous client takes: the abort signal of its operations and where the error link reports (none: it stays silent). */
+export interface CreateNoAuthApolloClientOptions {
+    readonly signal?: AbortSignal
+    readonly report?: ErrorReporter
+}
+
+/**
+ * The anonymous Apollo client for public operations: retry -> error -> timeout -> locale -> http. It never attaches a
+ * token, so a public operation stays public even for a signed-in reader.
+ */
+export const createNoAuthApolloClient = ({ signal, report }: CreateNoAuthApolloClientOptions = {}) =>
+    new ApolloClient({
+        link: ApolloLink.from([
+            createRetryLink(),
+            createErrorLink(report),
+            createTimeoutLink(),
+            createAttachLocaleLink(),
+            createHttpLink({ signal }),
+        ]),
+        cache: new InMemoryCache(),
+        defaultOptions,
+    })

package/templates/fe/transport/graphql/clients/index.ts

@@ -0,0 +1,2 @@
+export { createAuthApolloClient, createNoAuthApolloClient } from "./clients"
+export { graphqlResponseOf } from "./response"

package/templates/fe/transport/graphql/clients/links/attach-access-token.ts

@@ -0,0 +1,9 @@
+import { SetContextLink } from "@apollo/client/link/context"
+
+/** Attaches `Authorization: Bearer <access token>` from modules/auth when a session exists; an anonymous call goes out without it. */
+export const createAttachAccessTokenLink = (accessToken: () => Promise<string | undefined>) =>
+    new SetContextLink(async (context) => {
+        const token = await accessToken()
+        if (token === undefined) return {}
+        return { headers: { ...context.headers, authorization: `Bearer ${token}` } }
+    })

package/templates/fe/transport/graphql/clients/links/error.ts

@@ -0,0 +1,30 @@
+import { CombinedGraphQLErrors, CombinedProtocolErrors } from "@apollo/client"
+import { ErrorLink } from "@apollo/client/link/error"
+
+/** Where the error link reports one failed operation, as one line (the app's observability, when it wires one). */
+export type ErrorReporter = (line: string) => void
+
+/** One GraphQL error as the combined error carries it: its message and its extensions. */
+type GraphQLErrorEntry = { readonly message: string; readonly extensions?: Readonly<Record<string, unknown>> }
+
+/** The code of one GraphQL error (`extensions.code`), else its message. */
+const codeOf = (error: GraphQLErrorEntry): string =>
+    typeof error.extensions?.code === "string" ? error.extensions.code : error.message
+
+/**
+ * Reports what came back from downstream to `report` when the app passes one. The operation maps every error to its
+ * GraphQLResponse, so this link never swallows or rewrites one.
+ */
+export const createErrorLink = (report?: ErrorReporter) =>
+    new ErrorLink(({ error, operation }) => {
+        if (report === undefined) return
+        if (CombinedGraphQLErrors.is(error)) {
+            report(`[graphql] ${operation.operationName}: ${error.errors.map(codeOf).join(", ")}`)
+            return
+        }
+        if (CombinedProtocolErrors.is(error)) {
+            report(`[graphql protocol] ${operation.operationName}: ${error.message}`)
+            return
+        }
+        report(`[graphql network] ${operation.operationName}: ${error.message}`)
+    })

package/templates/fe/transport/graphql/clients/links/http.ts

@@ -0,0 +1,16 @@
+import { HttpLink } from "@apollo/client"
+import { graphqlUrl } from "@/modules/config"
+
+/** What the terminal link takes: whether cookies travel and the abort signal of every operation of the client. */
+export interface CreateHttpLinkParams {
+    readonly withCredentials?: boolean
+    readonly signal?: AbortSignal
+}
+
+/** The terminal link: POSTs the operation to the back end's GraphQL endpoint (modules/config). */
+export const createHttpLink = ({ withCredentials = false, signal }: CreateHttpLinkParams = {}) =>
+    new HttpLink({
+        uri: graphqlUrl(),
+        credentials: withCredentials ? "include" : "same-origin",
+        fetchOptions: { signal },
+    })

package/templates/fe/transport/graphql/clients/links/index.ts

@@ -0,0 +1,8 @@
+export { createAttachAccessTokenLink } from "./attach-access-token"
+export { createErrorLink } from "./error"
+export { createHttpLink } from "./http"
+export { createAttachLocaleLink } from "./locale"
+export { defaultOptions } from "./options"
+export { createRefreshTokenLink } from "./refresh-token"
+export { createRetryLink } from "./retry"
+export { createTimeoutLink } from "./timeout"

package/templates/fe/transport/graphql/clients/links/locale.ts

@@ -0,0 +1,13 @@
+import { SetContextLink } from "@apollo/client/link/context"
+
+/** The language of the document the reader is on (`<html lang>`, set by the locale layout); undefined outside a browser. */
+const documentLocale = (): string | undefined =>
+    typeof document === "undefined" || document.documentElement.lang === "" ? undefined : document.documentElement.lang
+
+/** The one writer of `x-locale`: every operation declares the language the back end answers and localizes its errors in. */
+export const createAttachLocaleLink = (locale: () => string | undefined = documentLocale) =>
+    new SetContextLink((context) => {
+        const value = locale()
+        if (value === undefined) return {}
+        return { headers: { ...context.headers, "x-locale": value } }
+    })

package/templates/fe/transport/graphql/clients/links/options.ts

@@ -0,0 +1,17 @@
+import type { ApolloClient } from "@apollo/client"
+
+/** How long one operation may run before the timeout link fails it. */
+export const OPERATION_TIMEOUT_MS = 15_000
+
+/** The retry window of a transient network failure: the first delay, the longest delay and the attempts in all. */
+export const RETRY_POLICY = { initialDelayMs: 300, maxDelayMs: 3_000, maxAttempts: 3 } as const
+
+/**
+ * The client policies: SWR owns the cache, so Apollo never answers from its own, and a GraphQL error comes back as the
+ * result's `error` (the operation maps it to a GraphQLResponse) instead of a rejected promise.
+ */
+export const defaultOptions: ApolloClient.DefaultOptions = {
+    watchQuery: { fetchPolicy: "no-cache", errorPolicy: "all" },
+    query: { fetchPolicy: "no-cache", errorPolicy: "all" },
+    mutate: { errorPolicy: "all" },
+}

package/templates/fe/transport/graphql/clients/links/refresh-token.ts

@@ -0,0 +1,36 @@
+import { CombinedGraphQLErrors, Observable } from "@apollo/client"
+import { ErrorLink } from "@apollo/client/link/error"
+
+/** The context flag of an operation already replayed after a refresh: it is never refreshed twice. */
+const REFRESHED = "accessTokenRefreshed"
+
+/** True when the back end refused the operation because the caller is not signed in (kind `unauthenticated`). */
+const isUnauthenticated = (error: unknown): boolean =>
+    CombinedGraphQLErrors.is(error) &&
+    error.errors.some(
+        (each) => each.extensions?.kind === "unauthenticated" || each.extensions?.code === "UNAUTHENTICATED",
+    )
+
+/**
+ * On an UNAUTHENTICATED answer, asks modules/auth for a fresh access token once and replays the operation with it. When no
+ * token comes back (the session ended) the original error travels on.
+ */
+export const createRefreshTokenLink = (refreshAccessToken: () => Promise<string | undefined>) =>
+    new ErrorLink(({ error, operation, forward }) => {
+        if (!isUnauthenticated(error) || operation.getContext()[REFRESHED] === true) return
+        return new Observable((observer) => {
+            let subscription: { unsubscribe: () => void } | undefined
+            refreshAccessToken().then(
+                (token) => {
+                    if (token === undefined) {
+                        observer.error(error)
+                        return
+                    }
+                    operation.setContext({ [REFRESHED]: true })
+                    subscription = forward(operation).subscribe(observer)
+                },
+                (cause: unknown) => observer.error(cause),
+            )
+            return () => subscription?.unsubscribe()
+        })
+    })

package/templates/fe/transport/graphql/clients/links/retry.ts

@@ -0,0 +1,16 @@
+import { CombinedGraphQLErrors } from "@apollo/client"
+import { RetryLink } from "@apollo/client/link/retry"
+import { RETRY_POLICY } from "./options"
+
+/**
+ * Retries a transient network failure with jittered exponential backoff. A GraphQL error is an answer of the back end and
+ * is never retried. First in the chain, so every other link sees the operation once per attempt.
+ */
+export const createRetryLink = () =>
+    new RetryLink({
+        delay: { initial: RETRY_POLICY.initialDelayMs, max: RETRY_POLICY.maxDelayMs, jitter: true },
+        attempts: {
+            max: RETRY_POLICY.maxAttempts,
+            retryIf: (error) => error !== undefined && !CombinedGraphQLErrors.is(error),
+        },
+    })

package/templates/fe/transport/graphql/clients/links/timeout.ts

@@ -0,0 +1,28 @@
+import { ApolloLink, Observable } from "@apollo/client"
+import { OPERATION_TIMEOUT_MS } from "./options"
+
+/** Fails the operation when no answer arrived within the timeout; the upstream links see the timeout as an error. */
+export const createTimeoutLink = (timeoutMs = OPERATION_TIMEOUT_MS) =>
+    new ApolloLink(
+        (operation, forward) =>
+            new Observable((observer) => {
+                const timer = setTimeout(() => {
+                    observer.error(new Error(`${operation.operationName} timed out after ${timeoutMs}ms`))
+                }, timeoutMs)
+                const subscription = forward(operation).subscribe({
+                    next: (value) => observer.next(value),
+                    error: (cause: unknown) => {
+                        clearTimeout(timer)
+                        observer.error(cause)
+                    },
+                    complete: () => {
+                        clearTimeout(timer)
+                        observer.complete()
+                    },
+                })
+                return () => {
+                    clearTimeout(timer)
+                    subscription.unsubscribe()
+                }
+            }),
+    )

package/templates/fe/transport/graphql/clients/response.ts

@@ -0,0 +1,43 @@
+import { CombinedGraphQLErrors } from "@apollo/client"
+import type { GraphQLFailure, GraphQLResponse } from "../types"
+
+/** The code of a failure the back end never answered: network, timeout or abort. */
+const TRANSPORT_FAILED = "TRANSPORT_FAILED"
+
+/** What an Apollo query or mutation resolves to under the `all` error policy: the data it got and the error it met. */
+export interface ApolloOutcome<TData> {
+    readonly data?: TData | null
+    readonly error?: unknown
+}
+
+const transportFailure = (message: string): GraphQLFailure => ({
+    success: false,
+    error: TRANSPORT_FAILED,
+    kind: "unavailable",
+    message,
+})
+
+/** The failure of an Apollo error: the first GraphQL error's code, kind and (localized) message, else a transport failure. */
+const failureOf = (error: unknown): GraphQLFailure => {
+    if (!CombinedGraphQLErrors.is(error))
+        return transportFailure(error instanceof Error ? error.message : TRANSPORT_FAILED)
+    const first = error.errors[0]
+    const code = first?.extensions?.code
+    const kind = first?.extensions?.kind
+    return {
+        success: false,
+        error: typeof code === "string" ? code : TRANSPORT_FAILED,
+        kind: typeof kind === "string" ? kind : "internal",
+        message: first?.message ?? TRANSPORT_FAILED,
+    }
+}
+
+/** Maps one Apollo outcome to the GraphQLResponse of the operation, `pick` selecting the operation's field from the data. */
+export const graphqlResponseOf = <TData, TValue>(
+    outcome: ApolloOutcome<TData>,
+    pick: (data: TData) => TValue,
+): GraphQLResponse<TValue> => {
+    if (outcome.error !== undefined) return failureOf(outcome.error)
+    if (outcome.data === undefined || outcome.data === null) return transportFailure(TRANSPORT_FAILED)
+    return { success: true, data: pick(outcome.data) }
+}

package/upgrade/check.mjs

@@ -88,7 +88,7 @@ export async function checkEdition({
 
   const full = fullEditionDeclaration(declaration, manifest);
   const tracked = trackedFiles(repoRoot);
-  // A lite app cannot have the full-only Jest preset installed yet. The upgrade model carries the preset's public sync inputs
+  // A lite app scaffolded before the 2026-10-12 ruling has no Jest preset installed. The upgrade model carries the preset's public sync inputs
   // specifically so both the dry full-edition view and the upgrade plan render the same targets before dependencies are added.
   const resolvedPresets = presets ?? UPGRADE_PRESETS;
   const managed = renderTargets(full, resolvedPresets, { manifest });

package/upgrade/index.mjs

@@ -42,7 +42,8 @@ const FULL_DEV_DEPENDENCIES = Object.freeze([
   "ts-jest",
 ]);
 const FULL_DEPENDENCIES = Object.freeze(["nest-commander"]);
-// Upgrade must render the full managed files before it can add/install the full-only Jest preset. These are the preset's two
+// Upgrade must render the full managed files before it can add/install the Jest preset a lite app scaffolded before the 2026-10-12
+// ruling lacks (a current lite app already has it, and the e2e world's @starci/test-world is what full adds). These are the preset's two
 // public sync inputs; once apply resolves the new dependency, normal full sync reads them from @starci/jest-preset again.
 export const UPGRADE_PRESETS = Object.freeze({
   sonarExclusions: "**/*.spec.ts,**/*.e2e-spec.ts,**/dist/**,**/coverage/**",
@@ -349,7 +350,7 @@ async function model({ root, to, presets, manifest }) {
     steps.push({
       op: "rewrite-managed",
       path: "package.json",
-      why: "Add the full test toolchain at canon pins and render the full root scripts.",
+      why: "Add the full test toolchain (the e2e world and any unit tooling a lite app lacks) at canon pins and render the full root scripts.",
       content: jsonText(nextPackage),
       kind: "file",
     });

package/runtime/scripts/hfs/architecture/supabase-results.mjs

@@ -1,182 +0,0 @@
-import { chainParts, isSupabaseCall, isSupabaseValue, reportAt, unwrap } from './supabase-ast.mjs';
-import { machineKit } from './machine-ast.mjs';
-
-/**
- * The front-end Supabase result checks (FE_DB_RESULT_TYPED, FE_DB_ERROR_HANDLED): a query result keeps its inferred row type, a list read is
- * bounded, and the awaited result is either passed whole to `toOutcome` or has its error read.
- */
-const FE_RESULT_TYPED = 'FE_DB_RESULT_TYPED';
-const FE_ERROR_HANDLED = 'FE_DB_ERROR_HANDLED';
-export const FE_DB_SLOTS = new Set(['fe.modules.db', 'fe.package.db', 'fe.modules.db.outcome']);
-const QUERY_TERMINALS = new Set(['single', 'maybeSingle', 'returns']);
-const QUERY_WRITES = new Set(['insert', 'update', 'upsert', 'delete']);
-const LIST_BOUNDS = new Set(['gt', 'gte', 'lt', 'lte', 'range']);
-
-export const symbolOf = (kit, checker, node) => kit.aliased(checker, kit.symbolAt(checker, node)) ?? kit.symbolAt(checker, node);
-
-export const sameSymbol = (kit, checker, node, symbol) => Boolean(symbol && symbolOf(kit, checker, node) === symbol);
-
-const fromAwaitedSupabase = (kit, checker, node, seen = new Set()) => {
-  const current = unwrap(kit.ts, node);
-  if (!current || seen.has(current)) return false;
-  seen.add(current);
-  if (kit.ts.isCallExpression(current)) return isSupabaseCall(kit, checker, current);
-  if (!kit.ts.isIdentifier(current)) return false;
-  for (const declaration of kit.declarationsOf(checker, current)) {
-    if (kit.ts.isVariableDeclaration(declaration) && declaration.initializer && fromAwaitedSupabase(kit, checker, declaration.initializer, seen)) return true;
-  }
-  return false;
-};
-
-const callIsToOutcome = (kit, checker, graph, call) => {
-  if (!kit.ts.isCallExpression(call)) return false;
-  const expression = call.expression;
-  let name = null;
-  if (kit.ts.isIdentifier(expression)) name = expression.text;
-  else if (kit.ts.isPropertyAccessExpression(expression)) name = expression.name.text;
-  if (name !== 'toOutcome') return false;
-  return kit.declarationsOf(checker, kit.ts.isPropertyAccessExpression(expression) ? expression.name : expression)
-    .some(declaration => {
-      const rel = kit.graphPath(declaration);
-      return rel !== null && FE_DB_SLOTS.has(graph.files.get(rel)?.slot);
-    });
-};
-
-const parentCall = (ts, node) => {
-  let current = node;
-  while (current.parent && ts.isParenthesizedExpression(current.parent)) current = current.parent;
-  return ts.isCallExpression(current.parent) ? current.parent : null;
-};
-
-/** True when `node` reads `.error` / `['error']` of the result symbol, or passes the result whole to toOutcome. */
-const readsResultError = (kit, checker, graph, node, result) => {
-  const { ts } = kit;
-  if (ts.isPropertyAccessExpression(node) && node.name.text === 'error' && sameSymbol(kit, checker, node.expression, result)) return true;
-  if (ts.isElementAccessExpression(node) && ts.isStringLiteralLike(node.argumentExpression) && node.argumentExpression.text === 'error' && sameSymbol(kit, checker, node.expression, result)) return true;
-  return ts.isCallExpression(node) && callIsToOutcome(kit, checker, graph, node)
-    && node.arguments.some(argument => sameSymbol(kit, checker, unwrap(ts, argument), result));
-};
-
-/** A result bound to one identifier is handled when the file reads its error or hands it whole to toOutcome. */
-const identifierResultHandled = (kit, checker, graph, awaitNode, declaration) => {
-  const result = symbolOf(kit, checker, declaration.name);
-  let handled = false;
-  kit.walk(awaitNode.getSourceFile(), node => {
-    if (readsResultError(kit, checker, graph, node, result)) handled = true;
-    return !handled;
-  });
-  return handled;
-};
-
-/** A result destructured into `{ error }` is handled when the bound error is referenced beyond its binding. */
-const destructuredResultHandled = (kit, checker, awaitNode, declaration) => {
-  const errorBinding = declaration.name.elements.find(element => {
-    const property = element.propertyName ?? element.name;
-    return kit.ts.isIdentifier(property) && property.text === 'error';
-  });
-  if (!errorBinding || !kit.ts.isIdentifier(errorBinding.name)) return false;
-  const error = symbolOf(kit, checker, errorBinding.name);
-  let references = 0;
-  kit.walk(awaitNode.getSourceFile(), node => {
-    if (kit.ts.isIdentifier(node) && sameSymbol(kit, checker, node, error)) references += 1;
-    return true;
-  });
-  return references > 1;
-};
-
-const handledAwait = (kit, checker, graph, awaitNode) => {
-  const direct = parentCall(kit.ts, awaitNode);
-  if (direct && callIsToOutcome(kit, checker, graph, direct) && direct.arguments.some(argument => argument === awaitNode || argument === awaitNode.parent)) return true;
-  let cursor = awaitNode;
-  while (cursor.parent && kit.ts.isParenthesizedExpression(cursor.parent)) cursor = cursor.parent;
-  const declaration = kit.ts.isVariableDeclaration(cursor.parent) ? cursor.parent : null;
-  if (!declaration) return false;
-  if (kit.ts.isIdentifier(declaration.name)) return identifierResultHandled(kit, checker, graph, awaitNode, declaration);
-  if (!kit.ts.isObjectBindingPattern(declaration.name)) return false;
-  return destructuredResultHandled(kit, checker, awaitNode, declaration);
-};
-
-const dataSymbolFromAwait = (kit, checker, identifier) => {
-  const symbol = symbolOf(kit, checker, identifier);
-  for (const declaration of symbol?.declarations ?? []) {
-    if (!kit.ts.isBindingElement(declaration) || !kit.ts.isObjectBindingPattern(declaration.parent)) continue;
-    const property = declaration.propertyName ?? declaration.name;
-    if (!kit.ts.isIdentifier(property) || property.text !== 'data') continue;
-    const variable = declaration.parent.parent;
-    if (kit.ts.isVariableDeclaration(variable) && variable.initializer && fromAwaitedSupabase(kit, checker, variable.initializer)) return symbol;
-  }
-  return null;
-};
-
-function inspectResultGeneric(scope, node) {
-  const { ts, kit, checker, report } = scope;
-  if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && QUERY_TERMINALS.has(node.expression.name.text)
-    && node.typeArguments?.length && isSupabaseValue(kit, checker, node.expression.expression)) {
-    report(FE_RESULT_TYPED, node, `${node.expression.name.text}<T>() supplies a result generic; derive the row type from Database and let the Supabase chain infer it.`);
-  }
-}
-
-function inspectResultCast(scope, node) {
-  const { ts, kit, checker, report } = scope;
-  if ((ts.isAsExpression(node) || ts.isTypeAssertionExpression(node) || ts.isNonNullExpression(node)) && fromAwaitedSupabase(kit, checker, node.expression)) {
-    report(FE_RESULT_TYPED, node, 'A Supabase query result is cast or non-null asserted; narrow its typed data/error outcome instead.');
-  }
-}
-
-/** Counts a multi-row read and reports it when no limit, range or keyset bound applies. */
-function inspectListRead(scope, node, methods) {
-  const isListRead = methods.includes('select') && !methods.some(method => QUERY_WRITES.has(method)) && !methods.includes('single') && !methods.includes('maybeSingle');
-  if (!isListRead) return;
-  scope.counters.listReads += 1;
-  if (!methods.includes('limit') && !methods.some(method => LIST_BOUNDS.has(method))) {
-    scope.report(FE_RESULT_TYPED, node, 'A Supabase list read has no .limit(), .range(), or keyset bound (.gt/.gte/.lt/.lte); bound every multi-row read.');
-  }
-}
-
-function inspectAwaitedResult(scope, node) {
-  const { ts, kit, checker, report, graph, counters } = scope;
-  if (!ts.isAwaitExpression(node) || !isSupabaseValue(kit, checker, node.expression)) return;
-  const expression = unwrap(ts, node.expression);
-  if (!ts.isCallExpression(expression)) return;
-  counters.awaited += 1;
-  inspectListRead(scope, node, chainParts(ts, expression));
-  if (!handledAwait(kit, checker, graph, node)) {
-    report(FE_ERROR_HANDLED, node, 'The awaited Supabase result does not read its error and is not passed whole to toOutcome(result).');
-  }
-}
-
-function inspectSwallowedData(scope, node) {
-  const { ts, kit, checker, report } = scope;
-  if (!(ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken && ts.isArrayLiteralExpression(node.right) && node.right.elements.length === 0)) return;
-  const left = unwrap(ts, node.left);
-  const swallowed = ts.isIdentifier(left) ? Boolean(dataSymbolFromAwait(kit, checker, left))
-    : ts.isPropertyAccessExpression(left) && left.name.text === 'data' && fromAwaitedSupabase(kit, checker, left.expression);
-  if (swallowed) report(FE_ERROR_HANDLED, node, 'Supabase data is collapsed with ?? []; refused or unavailable is not empty data. Pass the whole result to toOutcome.');
-}
-
-function inspectQueryResultNode(scope, node) {
-  inspectResultGeneric(scope, node);
-  inspectResultCast(scope, node);
-  inspectAwaitedResult(scope, node);
-  inspectSwallowedData(scope, node);
-  return true;
-}
-
-export function checkFrontendQueryResults(input) {
-  const kit = machineKit(input);
-  const violations = [];
-  const counters = { awaited: 0, listReads: 0 };
-  for (const file of input.graph.files.values()) {
-    const checker = kit.checkerOf(file.sourceFile);
-    const seen = new Set();
-    const report = (ruleId, node, message) => {
-      const key = `${ruleId}:${node.pos}:${message}`;
-      if (seen.has(key)) return;
-      seen.add(key);
-      reportAt(violations, kit, ruleId, file, node, message);
-    };
-    const scope = { ts: kit.ts, kit, checker, report, graph: input.graph, counters };
-    kit.walk(file.sourceFile, node => inspectQueryResultNode(scope, node));
-  }
-  return { violations, coverage: { status: 'checked', awaited: counters.awaited, listReads: counters.listReads } };
-}

package/templates/app/quality-config-lite/sonar-project.properties

@@ -1,5 +0,0 @@
-{{> app/quality-config/sonar-base.properties}}
-sonar.exclusions={{sonarExclusions}}
-sonar.typescript.tsconfigPaths={{tsconfigPaths}}
-sonar.externalIssuesReportPaths=reports/lint.sonar.json
-sonar.nodejs.maxspace=8192

package/templates/be/patterns/api/feature.index.http.ts.tpl

@@ -1 +0,0 @@
-export { @@Feature@@HttpModule } from "./transport/http/@@feature@@-http.module"

package/templates/be/patterns/api/http.controller.ts.tpl

@@ -1,27 +0,0 @@
-import { Body, Controller, Post } from "@nestjs/common"
-import type { CommandBus } from "@nestjs/cqrs"
-import { CurrentPrincipal } from "@modules/domain/identity"
-import { InjectCommandBus } from "@modules/platform/cqrs"
-import type { Principal } from "@modules/platform/cqrs"
-import { @@Action@@Command } from "../../application/@@action@@.command"
-import { to@@Action@@Request, to@@Action@@Response } from "./@@action@@.mapper"
-import { @@Action@@Request } from "./dto/@@action@@.request"
-import { @@Action@@Response } from "./dto/@@action@@.response"
-
-@Controller("@@feature@@")
-/** HTTP door of @@actionCamel@@. */
-export class @@Action@@Controller {
-    constructor(@InjectCommandBus() private readonly commandBus: CommandBus) {}
-
-    /** Runs @@action@@ for the authenticated caller. */
-    @Post()
-    async @@actionCamel@@(
-        @CurrentPrincipal() principal: Principal,
-        @Body() input: @@Action@@Request,
-    ): Promise<@@Action@@Response> {
-        const result = await this.commandBus.execute(
-            new @@Action@@Command({ request: to@@Action@@Request(input), principal }),
-        )
-        return to@@Action@@Response(result)
-    }
-}

package/templates/be/patterns/api/http.mapper.ts.tpl

@@ -1,9 +0,0 @@
-import type { @@Action@@Request, @@Action@@Result } from "../../application/@@action@@.contracts"
-import type { @@Action@@Request as @@Action@@HttpRequest } from "./dto/@@action@@.request"
-import type { @@Action@@Response } from "./dto/@@action@@.response"
-
-/** Maps the HTTP request to the command request. */
-export const to@@Action@@Request = (input: @@Action@@HttpRequest): @@Action@@Request => ({ id: input.id })
-
-/** Maps the command result to the HTTP response. */
-export const to@@Action@@Response = (result: @@Action@@Result): @@Action@@Response => ({ id: result.id })

package/templates/be/patterns/api/http.module.ts.tpl

@@ -1,7 +0,0 @@
-import { Module } from "@nestjs/common"
-import { @@Feature@@ApiModule } from "../../@@feature@@.module"
-import { @@Action@@Controller } from "./@@action@@.controller"
-
-@Module({ imports: [@@Feature@@ApiModule], controllers: [@@Action@@Controller] })
-/** The HTTP transport of the @@feature@@ feature. */
-export class @@Feature@@HttpModule {}

package/templates/be/patterns/api/http.request.ts.tpl

@@ -1,10 +0,0 @@
-import { IsNotEmpty, IsString, MaxLength } from "class-validator"
-
-/** The bounded HTTP request of @@actionCamel@@. */
-export class @@Action@@Request {
-    /** The id of the subject. */
-    @IsString()
-    @IsNotEmpty()
-    @MaxLength(64)
-    id!: string
-}

package/templates/be/patterns/api/http.response.ts.tpl

@@ -1,5 +0,0 @@
-/** The HTTP response of @@actionCamel@@. */
-export class @@Action@@Response {
-    /** The id of the subject. */
-    id!: string
-}

package/templates/fe/skeleton-lite/apps/web/src/app/auth/callback/route.ts

@@ -1,24 +0,0 @@
-import "server-only"
-
-import type { NextRequest } from "next/server"
-import { NextResponse } from "next/server"
-import { exchangeAuthCode } from "@/modules/db"
-import { safeNextPath } from "@/modules/routes"
-
-const destinationOf = (request: NextRequest): URL => {
-    const path = safeNextPath(request.nextUrl.searchParams.get("next"), request.nextUrl.origin)
-    return new URL(path, request.nextUrl.origin)
-}
-
-/** Completes Supabase's PKCE exchange and returns only to a same-origin path. */
-export const GET = async (request: NextRequest): Promise<NextResponse> => {
-    const destination = destinationOf(request)
-    const code = request.nextUrl.searchParams.get("code")
-    if (code === null) {
-        destination.searchParams.set("auth", "invalid")
-        return NextResponse.redirect(destination)
-    }
-    const exchanged = await exchangeAuthCode(code)
-    if (exchanged.kind !== "ok") destination.searchParams.set("auth", exchanged.kind)
-    return NextResponse.redirect(destination)
-}

package/templates/fe/skeleton-lite/apps/web/src/components/blocks/SignOutButton/index.tsx

@@ -1,38 +0,0 @@
-"use client"
-
-import { useTranslations } from "next-intl"
-import { useState, useTransition } from "react"
-import { writeSignOut } from "@/modules/db/auth/write-sign-out"
-import { navigation } from "@/modules/i18n"
-import { SignOutButtonBase } from "./component"
-
-type SignOutFailure = "refused" | "not-found" | "invalid" | "unavailable"
-
-/** The connected control that ends the current browser session. */
-export const SignOutButton = () => {
-    const router = navigation.useRouter()
-    const t = useTranslations("app.signOut")
-    const [failure, setFailure] = useState<SignOutFailure>()
-    const [pending, startTransition] = useTransition()
-    const signOut = () => {
-        startTransition(async () => {
-            const outcome = await writeSignOut()
-            if (outcome.kind !== "ok") {
-                setFailure(outcome.kind)
-                return
-            }
-            setFailure(undefined)
-            router.refresh()
-        })
-    }
-    return (
-        <SignOutButtonBase
-            props={{
-                label: pending ? t("working") : t("submit"),
-                pending,
-                failure: failure === undefined ? undefined : t(failure),
-            }}
-            on={{ press: signOut }}
-        />
-    )
-}

package/templates/fe/skeleton-lite/apps/web/src/modules/db/auth/read-session.ts

@@ -1,25 +0,0 @@
-import "server-only"
-
-import type { NextRequest, NextResponse } from "next/server"
-import { getPrincipal, principalFromClaims } from "../principal"
-import type { Principal } from "../principal"
-import { createRequestDbClient, createServerDbClient } from "../server"
-import { toOutcome } from "../outcome"
-import type { DbOutcome } from "../outcome"
-
-/** Reads the verified principal of the current server request. */
-export const readSession = (): Promise<DbOutcome<Principal>> => getPrincipal()
-
-/** Exchanges the one-time PKCE code and lets the server client write the resulting cookies. */
-export const exchangeAuthCode = async (code: string) => {
-    const client = await createServerDbClient()
-    return toOutcome(await client.auth.exchangeCodeForSession(code))
-}
-
-/** Refreshes proxy cookies through `getClaims()` and returns the verified principal outcome. */
-export const refreshSession = async (request: NextRequest, response: NextResponse): Promise<DbOutcome<Principal>> => {
-    const client = createRequestDbClient(request, response)
-    const claims = toOutcome(await client.auth.getClaims())
-    if (claims.kind !== "ok") return claims
-    return principalFromClaims(claims.value.claims)
-}