@starci/hfs 5.2.0 → 5.4.0

package/templates/fe/skeleton-lite/apps/web/src/features/pages/AppResetPage/index.tsx

@@ -0,0 +1,25 @@
+import type { ReactElement } from "react"
+import type { Metadata } from "next"
+import { Page } from "@starci/grammar/common"
+import { getTranslations } from "next-intl/server"
+import { EmailDoorForm } from "@/components/blocks/EmailDoorForm"
+
+/** The document title of the reset page. */
+export const appResetMetadata = async (): Promise<Metadata> => {
+    const t = await getTranslations("app.emailAuth.reset")
+    return { title: t("title") }
+}
+
+/** The query of the page: the link of the mail carries its token there. */
+type AppResetPageProps = { readonly searchParams: Promise<{ readonly token?: string | readonly string[] }> }
+
+/** The reset door of the lite sign-in, drawn as one Grammar Page (R325). */
+export const AppResetPage = async (props: AppResetPageProps): Promise<ReactElement> => {
+    const { token } = await props.searchParams
+    const t = await getTranslations("app.emailAuth.reset")
+    return (
+        <Page header={{ title: t("title") }} measure="reading">
+            <EmailDoorForm door="reset" token={typeof token === "string" ? token : token?.[0]} />
+        </Page>
+    )
+}

package/templates/fe/skeleton-lite/apps/web/src/features/pages/AppSignupPage/index.tsx

@@ -0,0 +1,21 @@
+import type { ReactElement } from "react"
+import type { Metadata } from "next"
+import { Page } from "@starci/grammar/common"
+import { getTranslations } from "next-intl/server"
+import { EmailDoorForm } from "@/components/blocks/EmailDoorForm"
+
+/** The document title of the signup page. */
+export const appSignupMetadata = async (): Promise<Metadata> => {
+    const t = await getTranslations("app.emailAuth.signup")
+    return { title: t("title") }
+}
+
+/** The signup door of the lite sign-in, drawn as one Grammar Page (R325). */
+export const AppSignupPage = async (_props: Record<string, never>): Promise<ReactElement> => {
+    const t = await getTranslations("app.emailAuth.signup")
+    return (
+        <Page header={{ title: t("title") }} measure="reading">
+            <EmailDoorForm door="signup" />
+        </Page>
+    )
+}

package/templates/fe/skeleton-lite/apps/web/src/hooks/emailAuth/emailAuth.shared.ts

@@ -0,0 +1,12 @@
+import type { AuthFailure } from "@/modules/auth"
+
+/** Why an email door refused: input the back end rejected, a weak password, a dead link, too many tries or the back end unreachable. */
+export type EmailDoorFailure = "invalid" | "password" | "link" | "tooMany" | "unavailable"
+
+/** The failure a door's wire code and kind stand for. */
+export const failureOf = (failure: AuthFailure): EmailDoorFailure => {
+    if (failure.code === "IDENTITY_PASSWORD_INVALID") return "password"
+    if (failure.code === "IDENTITY_RESET_TOKEN_INVALID") return "link"
+    if (failure.code === "IDENTITY_TOO_MANY_ATTEMPTS" || failure.code === "429") return "tooMany"
+    return failure.kind === "invalid" ? "invalid" : "unavailable"
+}

package/templates/fe/skeleton-lite/apps/web/src/hooks/emailAuth/index.ts

@@ -0,0 +1,2 @@
+export { useEmailDoor } from "./useEmailDoor"
+export type { EmailDoorFailure } from "./useEmailDoor"

package/templates/fe/skeleton-lite/apps/web/src/hooks/emailAuth/useEmailDoor.ts

@@ -0,0 +1,32 @@
+"use client"
+
+import { useState, useTransition } from "react"
+import { sendEmailDoor } from "@/modules/auth"
+import type { EmailDoorName } from "@/modules/auth"
+import { failureOf } from "./emailAuth.shared"
+import type { EmailDoorFailure } from "./emailAuth.shared"
+
+export type { EmailDoorFailure } from "./emailAuth.shared"
+
+/** What an email door hook answers: whether a request runs, whether the back end accepted it, why it refused, the call itself and `reject`. */
+export interface EmailDoor {
+    readonly failure: EmailDoorFailure | undefined
+    readonly done: boolean
+    readonly pending: boolean
+    readonly submit: (body: Readonly<Record<string, string | undefined>>) => void
+    readonly reject: () => void
+}
+
+/** Calls one email door of the back end through modules/auth; a success sets `done`, a refusal its failure. */
+export const useEmailDoor = (door: EmailDoorName): EmailDoor => {
+    const [failure, setFailure] = useState<EmailDoorFailure>()
+    const [done, setDone] = useState(false)
+    const [pending, startTransition] = useTransition()
+    const submit = (body: Readonly<Record<string, string | undefined>>): void =>
+        startTransition(async () => {
+            const failed = await sendEmailDoor(door, body)
+            setFailure(failed === undefined ? undefined : failureOf(failed))
+            setDone(failed === undefined)
+        })
+    return { failure, done, pending, submit, reject: (): void => setFailure("invalid") }
+}

package/templates/fe/skeleton-lite/apps/web/src/modules/i18n/index.ts

@@ -1,2 +1,2 @@
-/** The locale served at the unprefixed path and used by the global error boundary. */
-export { DEFAULT_LOCALE, PRODUCT_TIME_ZONE, routing } from "./routing"
+/** The web app's description of its languages and the locale served at the unprefixed path (the global error boundary). */
+export { DEFAULT_LOCALE, i18n } from "./routing"

package/templates/fe/skeleton-lite/apps/web/src/modules/i18n/messages/en.json

@@ -5,7 +5,9 @@
       "brand": "{{project}}"
     },
     "home": {
-      "title": "Home"
+      "title": "Home",
+      "signup": "Create an account",
+      "forgot": "Forgot your password?"
     },
     "signIn": {
       "title": "Sign in",
@@ -52,6 +54,53 @@
       "title": "Getting started",
       "description": "Sign in to use the application. You can close this guide and open it again at any time.",
       "close": "Close"
+    },
+    "emailAuth": {
+      "email": "Email",
+      "password": "Password",
+      "newPassword": "New password",
+      "toSignIn": "Back to sign in",
+      "toResend": "Send the confirmation again",
+      "toForgot": "Request a new reset link",
+      "toSignup": "Create an account",
+      "toForgotPassword": "Forgot your password?",
+      "signup": {
+        "title": "Create an account",
+        "description": "Choose a password of at least 8 characters. We email a link to confirm your address.",
+        "submit": "Create account",
+        "done": "Check your inbox: we sent a link to confirm your email."
+      },
+      "resend": {
+        "title": "Confirm your email again",
+        "description": "Enter your address and we email a new confirmation link if the account is waiting for one.",
+        "submit": "Send the link",
+        "done": "If that address is waiting for confirmation, a new link is on its way."
+      },
+      "forgot": {
+        "title": "Forgot your password",
+        "description": "Enter your address and we email a link to choose a new password.",
+        "submit": "Send the link",
+        "done": "If that address has an account, a reset link is on its way."
+      },
+      "reset": {
+        "title": "Choose a new password",
+        "description": "The link works once. Every device is signed out when the password changes.",
+        "submit": "Save password",
+        "done": "Your password is changed. Sign in with the new one."
+      },
+      "confirm": {
+        "title": "Confirm your email",
+        "description": "Press the button to confirm your email address.",
+        "submit": "Confirm email",
+        "done": "Your email is confirmed. You can sign in."
+      },
+      "errors": {
+        "invalid": "Enter a valid value in every field.",
+        "password": "The password needs at least 8 characters and at most 72 bytes.",
+        "link": "The link is invalid or has expired. Request a new one.",
+        "tooMany": "Too many attempts. Try again later.",
+        "unavailable": "This is unavailable. Try again shortly."
+      }
     }
   }
 }

package/templates/fe/skeleton-lite/apps/web/src/modules/i18n/messages/vi.json

@@ -5,7 +5,9 @@
       "brand": "{{project}}"
     },
     "home": {
-      "title": "Trang chủ"
+      "title": "Trang chủ",
+      "signup": "Tạo tài khoản",
+      "forgot": "Quên mật khẩu?"
     },
     "signIn": {
       "title": "Đăng nhập",
@@ -52,6 +54,53 @@
       "title": "Bắt đầu",
       "description": "Đăng nhập để sử dụng ứng dụng. Bạn có thể đóng hướng dẫn này và mở lại bất cứ lúc nào.",
       "close": "Đóng"
+    },
+    "emailAuth": {
+      "email": "Email",
+      "password": "Mật khẩu",
+      "newPassword": "Mật khẩu mới",
+      "toSignIn": "Quay lại đăng nhập",
+      "toResend": "Gửi lại thư xác nhận",
+      "toForgot": "Yêu cầu liên kết đặt lại mới",
+      "toSignup": "Tạo tài khoản",
+      "toForgotPassword": "Quên mật khẩu?",
+      "signup": {
+        "title": "Tạo tài khoản",
+        "description": "Chọn mật khẩu ít nhất 8 ký tự. Chúng tôi gửi email một liên kết để xác nhận địa chỉ của bạn.",
+        "submit": "Tạo tài khoản",
+        "done": "Hãy kiểm tra hộp thư: chúng tôi đã gửi liên kết xác nhận email."
+      },
+      "resend": {
+        "title": "Xác nhận email lại",
+        "description": "Nhập địa chỉ của bạn, chúng tôi gửi liên kết xác nhận mới nếu tài khoản đang chờ xác nhận.",
+        "submit": "Gửi liên kết",
+        "done": "Nếu địa chỉ đó đang chờ xác nhận, một liên kết mới đang được gửi."
+      },
+      "forgot": {
+        "title": "Quên mật khẩu",
+        "description": "Nhập địa chỉ của bạn, chúng tôi gửi email một liên kết để chọn mật khẩu mới.",
+        "submit": "Gửi liên kết",
+        "done": "Nếu địa chỉ đó có tài khoản, một liên kết đặt lại đang được gửi."
+      },
+      "reset": {
+        "title": "Chọn mật khẩu mới",
+        "description": "Liên kết chỉ dùng được một lần. Mọi thiết bị sẽ bị đăng xuất khi đổi mật khẩu.",
+        "submit": "Lưu mật khẩu",
+        "done": "Mật khẩu đã được đổi. Hãy đăng nhập bằng mật khẩu mới."
+      },
+      "confirm": {
+        "title": "Xác nhận email",
+        "description": "Nhấn nút để xác nhận địa chỉ email của bạn.",
+        "submit": "Xác nhận email",
+        "done": "Email đã được xác nhận. Bạn có thể đăng nhập."
+      },
+      "errors": {
+        "invalid": "Hãy nhập giá trị hợp lệ ở mọi ô.",
+        "password": "Mật khẩu cần ít nhất 8 ký tự và tối đa 72 byte.",
+        "link": "Liên kết không hợp lệ hoặc đã hết hạn. Hãy yêu cầu liên kết mới.",
+        "tooMany": "Quá nhiều lần thử. Hãy thử lại sau.",
+        "unavailable": "Chưa thể thực hiện. Hãy thử lại sau."
+      }
     }
   }
 }

package/templates/fe/skeleton-lite/apps/web/src/modules/i18n/request.ts

@@ -1,35 +1,12 @@
-import "server-only"
-import { hasLocale } from "next-intl"
-import type { AbstractIntlMessages } from "next-intl"
-import { getRequestConfig } from "next-intl/server"
-import { headers } from "next/headers"
-import { PRODUCT_TIME_ZONE, routing } from "./routing"
-
-/** The message tree a catalog module exports as its default: the module is read as `unknown` and checked, never trusted as `any`. */
-const isMessages = (value: unknown): value is AbstractIntlMessages => typeof value === "object" && value !== null
-
-const messagesOf = (loaded: unknown): AbstractIntlMessages => {
-    const messages = typeof loaded === "object" && loaded !== null && "default" in loaded ? loaded.default : undefined
-    if (!isMessages(messages)) throw new TypeError("A message catalog module must export its messages as default")
-    return messages
-}
-
-/** The header the next-intl middleware sets on the request with the locale it negotiated. */
-const LOCALE_HEADER = "x-next-intl-locale"
+import { createRequestConfig } from "@starci/next-i18n/request"
+import type { I18nRequestConfig } from "@starci/next-i18n/request"
+import { i18n } from "./routing"
 
 /**
- * The request config next-intl's plugin loads. The locale is the one the middleware negotiated: this module is reachable from the proxy
- * through the navigation, and `next/root-params` can only be imported inside the app directory.
+ * The request config next-intl's plugin loads: the app's own catalogs over the shared stack. The locale is the one the proxy
+ * negotiated (a route the proxy does not negotiate reads the cookie, then the default); `next/root-params` can only be imported
+ * inside the app directory, so no route reader is passed.
  */
-const requestConfig: ReturnType<typeof getRequestConfig> = getRequestConfig(async () => {
-    const requested = (await headers()).get(LOCALE_HEADER)
-    const locale = hasLocale(routing.locales, requested) ? requested : routing.defaultLocale
-    return {
-        locale,
-        timeZone: PRODUCT_TIME_ZONE,
-        messages: messagesOf(await import(`./messages/${locale}.json`)),
-        getMessageFallback: ({ namespace, key }) => `web:${namespace ?? ""}.${key}`,
-    }
-})
+const requestConfig: I18nRequestConfig = createRequestConfig(i18n, { app: "web", loadMessages: (locale) => import(`./messages/${locale}.json`) })
 
 export default requestConfig

package/templates/fe/skeleton-lite/apps/web/src/modules/i18n/routing.ts

@@ -1,18 +1,17 @@
+import { defineI18n } from "@starci/next-i18n"
+import type { I18n } from "@starci/next-i18n"
+
 const LOCALES = ["vi", "en"] as const
 
-/** The locale served at the unprefixed path. */
-export const DEFAULT_LOCALE = "vi" as const
+/** The description of the web app's languages: the locales and the `as-needed` prefix mode that `defineI18n` types. */
+export type WebI18n = I18n<typeof LOCALES, "as-needed">
 
-/** The fixed product time zone used by the server and hydrated client. */
-export const PRODUCT_TIME_ZONE = "Asia/Ho_Chi_Minh"
+/** The locale served at the unprefixed path. */
+export const DEFAULT_LOCALE: WebI18n["defaultLocale"] = "vi"
 
-/** The one locale-routing table of the web app. */
-export const routing: {
-    readonly locales: typeof LOCALES
-    readonly defaultLocale: typeof DEFAULT_LOCALE
-    readonly localePrefix: "as-needed"
-} = {
-    locales: LOCALES,
-    defaultLocale: DEFAULT_LOCALE,
-    localePrefix: "as-needed" as const,
-}
+/**
+ * The one description of the web app's languages, read by the proxy, the request config and the locale layout: vi default, a prefix
+ * only when the locale is not the default, and a fixed time zone so the server and the hydrated client format the same instant the
+ * same way. The stack that reads it is `@starci/next-i18n`'s (FE-I18N-1).
+ */
+export const i18n: WebI18n = defineI18n({ locales: LOCALES, defaultLocale: DEFAULT_LOCALE, timeZone: "Asia/Ho_Chi_Minh" })

package/templates/fe/skeleton-lite/apps/web/src/modules/routes/index.ts

@@ -1,4 +1,9 @@
 /** Every internal destination the web app links to, named once. */
 export const APP_ROUTES = {
     home: "/",
+    signup: "/auth/signup",
+    resend: "/auth/resend",
+    forgot: "/auth/forgot",
+    confirm: "/auth/confirm",
+    reset: "/auth/reset",
 } as const

package/templates/fe/skeleton-lite/apps/web/src/proxy.ts

@@ -1,25 +1,12 @@
-import createMiddleware from "next-intl/middleware"
-import { NextResponse } from "next/server"
-import type { NextRequest } from "next/server"
-import { routing } from "@/modules/i18n"
-
-/** The paths outside locale routing: the liveness route and the framework's own assets. */
-const UNNEGOTIATED_ROOTS: ReadonlySet<string> = new Set(["health", "_next", "_vercel"])
-const negotiate = createMiddleware(routing)
-
-const firstSegment = (pathname: string): string => pathname.split("/")[1] ?? ""
-
-const isUnnegotiated = (pathname: string): boolean => {
-    const last = pathname.split("/").at(-1) ?? ""
-    return UNNEGOTIATED_ROOTS.has(firstSegment(pathname)) || (last.includes(".") && !last.endsWith("."))
-}
+import { createProxy } from "@starci/next-i18n/proxy"
+import type { LocaleProxy } from "@starci/next-i18n/proxy"
+import { i18n } from "@/modules/i18n"
 
 /**
  * Locale routing only. The session lives in the browser (modules/auth) and the back end verifies the access token of
  * every call, so the proxy neither reads nor refreshes it.
  */
-export const proxy = (request: NextRequest): NextResponse =>
-    isUnnegotiated(request.nextUrl.pathname) ? NextResponse.next() : negotiate(request)
+export const proxy: LocaleProxy = createProxy(i18n)
 
 /** Routes that pass through locale negotiation. */
 export const config = {

package/templates/be/auth-lite/src/modules/domain/identity/persistence/entities/auth-identity.entity.ts

@@ -1,38 +0,0 @@
-// Managed by starci app sync (slot be.identity.sign-in); do not edit: run "npx starci app sync --execute".
-import { Column, Entity, PrimaryColumn } from "typeorm"
-
-@Entity({ schema: "auth", name: "identities" })
-/** One external identity of an account (a Google subject), mapped from auth.identities of db/bootstrap.sql. */
-export class AuthIdentityEntity {
-    /** The row id. */
-    @PrimaryColumn({ name: "id", type: "uuid" })
-    id!: string
-
-    /** The provider's id of the person (the Google subject). */
-    @Column({ name: "provider_id", type: "text" })
-    providerId!: string
-
-    /** The account the identity belongs to. */
-    @Column({ name: "user_id", type: "uuid" })
-    userId!: string
-
-    /** What the provider told us, as JSON. */
-    @Column({ name: "identity_data", type: "jsonb" })
-    identityData!: Record<string, string | boolean | null>
-
-    /** The provider name. */
-    @Column({ name: "provider", type: "text" })
-    provider!: string
-
-    /** The last sign-in through this identity, or null. */
-    @Column({ name: "last_sign_in_at", type: "timestamptz", nullable: true })
-    lastSignInAt!: Date | null
-
-    /** When the identity was linked. */
-    @Column({ name: "created_at", type: "timestamptz", nullable: true })
-    createdAt!: Date | null
-
-    /** When the identity last changed. */
-    @Column({ name: "updated_at", type: "timestamptz", nullable: true })
-    updatedAt!: Date | null
-}

package/templates/be/auth-lite/src/modules/domain/identity/persistence/entities/auth-user.entity.ts

@@ -1,54 +0,0 @@
-// Managed by starci app sync (slot be.identity.sign-in); do not edit: run "npx starci app sync --execute".
-import { Column, Entity, PrimaryColumn } from "typeorm"
-
-@Entity({ schema: "auth", name: "users" })
-/** One person who can sign in, mapped from auth.users of db/bootstrap.sql (the GoTrue column set; only the columns sign-in reads or writes). */
-export class AuthUserEntity {
-    /** The account id. */
-    @PrimaryColumn({ name: "id", type: "uuid" })
-    id!: string
-
-    /** The audience the row carries. */
-    @Column({ name: "aud", type: "varchar", length: 255, nullable: true })
-    aud!: string | null
-
-    /** The database role the row carries. */
-    @Column({ name: "role", type: "varchar", length: 255, nullable: true })
-    role!: string | null
-
-    /** The sign-in address, lower-cased. */
-    @Column({ name: "email", type: "varchar", length: 255, nullable: true })
-    email!: string | null
-
-    /** The bcrypt hash of the password, or null for an account that signs in with Google only. */
-    @Column({ name: "encrypted_password", type: "varchar", length: 255, nullable: true })
-    encryptedPassword!: string | null
-
-    /** When the mailbox was confirmed, or null. */
-    @Column({ name: "email_confirmed_at", type: "timestamptz", nullable: true })
-    emailConfirmedAt!: Date | null
-
-    /** The last sign-in, or null. */
-    @Column({ name: "last_sign_in_at", type: "timestamptz", nullable: true })
-    lastSignInAt!: Date | null
-
-    /** Until when the account is banned, or null. */
-    @Column({ name: "banned_until", type: "timestamptz", nullable: true })
-    bannedUntil!: Date | null
-
-    /** When the account was deleted, or null. */
-    @Column({ name: "deleted_at", type: "timestamptz", nullable: true })
-    deletedAt!: Date | null
-
-    /** True for an anonymous account, which never signs in with an address. */
-    @Column({ name: "is_anonymous", type: "boolean" })
-    isAnonymous!: boolean
-
-    /** When the account was created. */
-    @Column({ name: "created_at", type: "timestamptz", nullable: true })
-    createdAt!: Date | null
-
-    /** When the account last changed. */
-    @Column({ name: "updated_at", type: "timestamptz", nullable: true })
-    updatedAt!: Date | null
-}