@stratum-hq/create 0.3.0 → 0.4.0

package/src/generators/init-sql.ts

@@ -1,5 +1,46 @@
 import type { StackPreset } from "../matrix.js";
 
+/** Name of the non-superuser role a generated app connects as. */
+export function postgresAppRole(dbName: string): string {
+  return `${dbName}_app`;
+}
+
+/** Local development password for the generated application role. */
+export const POSTGRES_APP_PASSWORD = "dev_app_password";
+
+/**
+ * SQL that creates the role the application connects as. POSTGRES_USER is a
+ * superuser, and a superuser (or any BYPASSRLS role) ignores every row-level
+ * security policy, FORCE included. So the app gets its own role, and the
+ * superuser is kept for bootstrap and migrations.
+ */
+export function postgresAppRoleSql(dbName: string, strategy?: string): string {
+  const role = postgresAppRole(dbName);
+  let strategyGrant = "";
+  if (strategy === "schema") {
+    strategyGrant = `
+-- schema-per-tenant: the app creates one schema per tenant
+GRANT CREATE ON DATABASE ${dbName} TO ${role};
+`;
+  } else if (strategy === "database") {
+    strategyGrant = `
+-- database-per-tenant: the app creates one database per tenant
+ALTER ROLE ${role} CREATEDB;
+`;
+  }
+  return `
+-- Application role. The app connects as ${role} (DATABASE_URL), never as the
+-- bootstrap superuser (DATABASE_ADMIN_URL): a superuser or BYPASSRLS role
+-- ignores every row-level security policy, FORCE included. Use the superuser
+-- only for bootstrap and migrations.
+CREATE ROLE ${role} WITH LOGIN PASSWORD '${POSTGRES_APP_PASSWORD}' NOSUPERUSER NOBYPASSRLS NOCREATEROLE;
+GRANT CONNECT ON DATABASE ${dbName} TO ${role};
+GRANT USAGE, CREATE ON SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${role};
+${strategyGrant}`;
+}
+
 export function generatePresetInitSql(projectName: string, preset: StackPreset): string | null {
   const dbName = projectName.replace(/[^a-z0-9]/gi, "_").toLowerCase();
 
@@ -22,10 +63,13 @@ function generatePostgresInit(projectName: string, dbName: string, strategy: str
 -- Add RLS policies to each tenant-scoped table:
 --
 --   ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
+--   ALTER TABLE your_table FORCE ROW LEVEL SECURITY;
 --   CREATE POLICY tenant_isolation ON your_table
---     USING (tenant_id = current_setting('app.current_tenant')::uuid);
+--     USING (tenant_id = current_setting('app.current_tenant_id')::uuid);
 --
--- The Stratum db-adapters package sets app.current_tenant automatically.
+-- FORCE makes the policy apply to the table owner too; without it, a table
+-- created by the application role is not isolated for that role.
+-- The Stratum db-adapters package sets app.current_tenant_id automatically.
 `;
   }
 
@@ -37,7 +81,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-${rlsBlock}`;
+${postgresAppRoleSql(dbName, strategy)}${rlsBlock}`;
 }
 
 function generateMysqlInit(projectName: string, dbName: string): string {

package/src/generators/middleware.ts

@@ -33,11 +33,13 @@ const port = Number(process.env.PORT) || 3000;
 
 app.use(express.json());
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use((req, _res, next) => {
-  const tenantId =
-    req.headers["x-tenant-id"] as string ||
-    req.hostname.split(".")[0];
+  const tenantId = req.hostname.split(".")[0];
   (req as any).tenantId = tenantId;
   next();
 });
@@ -68,12 +70,14 @@ function generateFastifyMiddleware(projectName: string): MiddlewareFile[] {
 const fastify = Fastify({ logger: true });
 const port = Number(process.env.PORT) || 3000;
 
-// Tenant extraction plugin
+// Tenant extraction hook. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 fastify.decorateRequest("tenantId", "");
 fastify.addHook("onRequest", async (request) => {
-  const tenantId =
-    (request.headers["x-tenant-id"] as string) ||
-    (request.hostname?.split(".")[0] ?? "");
+  const tenantId = request.hostname?.split(".")[0] ?? "";
   (request as any).tenantId = tenantId;
 });
 
@@ -105,14 +109,15 @@ function generateNextjsMiddleware(projectName: string): MiddlewareFile[] {
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -135,7 +140,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -155,11 +160,13 @@ import { serve } from "@hono/node-server";
 
 const app = new Hono();
 
-// Tenant extraction middleware
+// Tenant extraction middleware. The tenant comes from the subdomain the
+// request was routed to. Do not take it from a client-supplied header such as
+// x-tenant-id: any caller can set one and pick another tenant. Once you add
+// authentication, check that the signed-in user belongs to this tenant, or
+// derive the tenant from the verified session or JWT instead.
 app.use("*", async (c, next) => {
-  const tenantId =
-    c.req.header("x-tenant-id") ||
-    new URL(c.req.url).hostname.split(".")[0];
+  const tenantId = new URL(c.req.url).hostname.split(".")[0];
   c.set("tenantId", tenantId);
   await next();
 });
@@ -239,9 +246,11 @@ export class AppController {
 export class TenantGuard implements CanActivate {
   canActivate(context: ExecutionContext): boolean {
     const request = context.switchToHttp().getRequest();
-    const tenantId =
-      request.headers["x-tenant-id"] ||
-      request.hostname?.split(".")[0];
+    // The tenant comes from the subdomain the request was routed to. Do not
+    // take it from a client-supplied header such as x-tenant-id: any caller
+    // can set one and pick another tenant. Once you add authentication, check
+    // that the signed-in user belongs to this tenant here.
+    const tenantId = request.hostname?.split(".")[0];
     request.tenantId = tenantId || null;
     return true;
   }

package/src/index.ts

@@ -5,8 +5,9 @@ import * as path from "path";
 import crypto from "node:crypto";
 import { execSync } from "child_process";
 import { fileURLToPath } from "url";
-import { parsePresetString, isValidPreset, formatPresetString } from "./matrix.js";
+import { parsePresetString, isValidPreset } from "./matrix.js";
 import { createPresetProject } from "./preset-project.js";
+import { postgresAppRole, postgresAppRoleSql, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -194,7 +195,7 @@ CREATE EXTENSION IF NOT EXISTS "ltree";
 -- The ltree extension enables hierarchical tenant trees
 -- uuid-ossp provides uuid_generate_v4() for tenant IDs
 COMMENT ON DATABASE ${dbName} IS 'Multi-tenant database for ${projectName}';
-`;
+${postgresAppRoleSql(dbName)}`;
 }
 
 function generateEnv(projectName: string): string {
@@ -203,8 +204,12 @@ function generateEnv(projectName: string): string {
   return `# Environment variables for ${projectName}
 # Copy to .env and fill in values
 
-# Database
-DATABASE_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
+# Database. The app connects as the non-superuser role created in init.sql,
+# so row-level security applies to it.
+DATABASE_URL=postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}
+
+# Superuser: bootstrap and migrations only. It bypasses row-level security.
+DATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}
 
 # Authentication
 JWT_SECRET=${jwtSecret}
@@ -295,7 +300,7 @@ export default function Home() {
       <p>Multi-tenant app powered by Stratum.</p>
       <ul>
         <li>Configure tenants via the Stratum control plane</li>
-        <li>Access tenant context via <code>x-tenant-id</code> header</li>
+        <li>Tenant is resolved from the subdomain in <code>middleware.ts</code></li>
         <li>Use <code>@stratum-hq/lib</code> for tenant resolution</li>
       </ul>
     </main>
@@ -305,18 +310,19 @@ export default function Home() {
 }
 
 function generateNextjsMiddleware(): string {
-  return `// middleware.ts — tenant resolution via subdomain or header
+  return `// middleware.ts — tenant resolution via subdomain
 import { NextRequest, NextResponse } from "next/server";
 
 export function middleware(request: NextRequest) {
+  // The tenant comes from the subdomain the request was routed to. Any
+  // x-tenant-id the client sent is removed first, so server code that reads
+  // x-tenant-id only ever sees the value set here. Once you add
+  // authentication, check that the signed-in user belongs to this tenant.
   const hostname = request.headers.get("host") || "";
-  const subdomain = hostname.split(".")[0];
-  const headerTenantId = request.headers.get("x-tenant-id");
-  const pathTenantId = request.nextUrl.pathname.match(/^\\/tenant\\/([^/]+)/)?.[1];
-
-  const tenantId = headerTenantId || pathTenantId || subdomain;
+  const tenantId = hostname.split(".")[0];
 
   const requestHeaders = new Headers(request.headers);
+  requestHeaders.delete("x-tenant-id");
   if (tenantId && tenantId !== "localhost" && tenantId !== "www") {
     requestHeaders.set("x-tenant-id", tenantId);
   }
@@ -380,7 +386,7 @@ ${projectName}/
 
 This project uses Stratum for hierarchical multi-tenancy:
 
-- **Tenant resolution** — via JWT claim, subdomain, or \`x-tenant-id\` header
+- **Tenant resolution** — via subdomain (see \`middleware.ts\`); bind it to the signed-in user once you add authentication
 - **Config inheritance** — settings flow down the tenant tree with override support
 - **Permission ABAC** — role-based permissions with tenant-scoped enforcement
 

package/src/preset-project.ts

@@ -4,7 +4,7 @@ import crypto from "node:crypto";
 import { execSync } from "child_process";
 import type { StackPreset } from "./matrix.js";
 import { generatePresetDockerCompose } from "./generators/docker-compose.js";
-import { generatePresetInitSql } from "./generators/init-sql.js";
+import { generatePresetInitSql, postgresAppRole, POSTGRES_APP_PASSWORD } from "./generators/init-sql.js";
 import { generateDbSetup } from "./generators/db-setup.js";
 import { generateMiddleware } from "./generators/middleware.js";
 import { generatePresetPackageJson } from "./generators/package-json.js";
@@ -24,9 +24,14 @@ function generatePresetEnv(projectName: string, preset: StackPreset): string {
   const jwtSecret = crypto.randomBytes(32).toString("base64url");
 
   let dbUrl: string;
+  let adminUrlLine = "";
   switch (preset.database) {
     case "postgres":
-      dbUrl = `postgres://${dbName}:dev_password@localhost:5432/${dbName}`;
+      // The app connects as the non-superuser role created in init.sql, so
+      // row-level security applies to it. The superuser URL is for bootstrap
+      // and migrations only.
+      dbUrl = `postgres://${postgresAppRole(dbName)}:${POSTGRES_APP_PASSWORD}@localhost:5432/${dbName}`;
+      adminUrlLine = `\n# Superuser: bootstrap and migrations only. It bypasses row-level security.\nDATABASE_ADMIN_URL=postgres://${dbName}:dev_password@localhost:5432/${dbName}\n`;
       break;
     case "mongodb":
       dbUrl = `mongodb://${dbName}:dev_password@localhost:27017/${dbName}?authSource=admin`;
@@ -43,7 +48,7 @@ function generatePresetEnv(projectName: string, preset: StackPreset): string {
 
 # Database
 ${urlKey}=${dbUrl}
-
+${adminUrlLine}
 # Authentication
 JWT_SECRET=${jwtSecret}
 

package/src/__tests__/create.test.ts

@@ -1,217 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
-import { parseArgs, createProject, validateProjectName } from "../index.js";
-
-// ─── parseArgs tests ──────────────────────────────────────────────────────────
-
-describe("parseArgs", () => {
-  it("extracts project name from positional arg", () => {
-    const result = parseArgs(["my-app"]);
-    expect(result.projectName).toBe("my-app");
-  });
-
-  it("defaults template to express", () => {
-    const result = parseArgs(["my-app"]);
-    expect(result.template).toBe("express");
-  });
-
-  it("parses --template flag", () => {
-    const result = parseArgs(["my-app", "--template", "fastify"]);
-    expect(result.template).toBe("fastify");
-  });
-
-  it("parses --template=value syntax", () => {
-    const result = parseArgs(["my-app", "--template=nextjs"]);
-    expect(result.template).toBe("nextjs");
-  });
-
-  it("parses --skip-install flag", () => {
-    const result = parseArgs(["my-app", "--skip-install"]);
-    expect(result.skipInstall).toBe(true);
-  });
-
-  it("parses --force flag", () => {
-    const result = parseArgs(["my-app", "--force"]);
-    expect(result.force).toBe(true);
-  });
-
-  it("returns null projectName when no positional arg given", () => {
-    const result = parseArgs(["--template", "express"]);
-    expect(result.projectName).toBeNull();
-  });
-
-  it("skipInstall defaults to false", () => {
-    const result = parseArgs(["my-app"]);
-    expect(result.skipInstall).toBe(false);
-  });
-
-  it("force defaults to false", () => {
-    const result = parseArgs(["my-app"]);
-    expect(result.force).toBe(false);
-  });
-});
-
-// ─── Error cases ──────────────────────────────────────────────────────────────
-
-describe("main arg validation", () => {
-  it("errors when no project name given", () => {
-    // parseArgs returns null projectName, which main() would exit on
-    const result = parseArgs([]);
-    expect(result.projectName).toBeNull();
-  });
-});
-
-// ─── File generation tests ────────────────────────────────────────────────────
-
-describe("createProject", () => {
-  let tmpDir: string;
-  let projectDir: string;
-
-  beforeEach(() => {
-    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "stratum-create-test-"));
-    projectDir = path.join(tmpDir, "test-project");
-    fs.mkdirSync(projectDir, { recursive: true });
-  });
-
-  afterEach(() => {
-    fs.rmSync(tmpDir, { recursive: true, force: true });
-  });
-
-  it("generates correct files for express template", () => {
-    createProject("test-project", "express", projectDir, true);
-
-    expect(fs.existsSync(path.join(projectDir, "package.json"))).toBe(true);
-    expect(fs.existsSync(path.join(projectDir, "docker-compose.yml"))).toBe(true);
-    expect(fs.existsSync(path.join(projectDir, ".env.example"))).toBe(true);
-    expect(fs.existsSync(path.join(projectDir, "src", "index.ts"))).toBe(true);
-    expect(fs.existsSync(path.join(projectDir, "README.md"))).toBe(true);
-    expect(fs.existsSync(path.join(projectDir, "init.sql"))).toBe(true);
-  });
-
-  it("generates correct files for fastify template", () => {
-    createProject("test-project", "fastify", projectDir, true);
-
-    expect(fs.existsSync(path.join(projectDir, "src", "index.ts"))).toBe(true);
-    const serverContent = fs.readFileSync(
-      path.join(projectDir, "src", "index.ts"),
-      "utf8",
-    );
-    expect(serverContent).toContain("Fastify");
-  });
-
-  it("generates correct files for nextjs template", () => {
-    createProject("test-project", "nextjs", projectDir, true);
-
-    expect(fs.existsSync(path.join(projectDir, "src", "app", "page.tsx"))).toBe(true);
-    expect(fs.existsSync(path.join(projectDir, "middleware.ts"))).toBe(true);
-  });
-
-  it("package.json contains @stratum-hq/lib dependency", () => {
-    createProject("test-project", "express", projectDir, true);
-
-    const pkgContent = fs.readFileSync(path.join(projectDir, "package.json"), "utf8");
-    const pkg = JSON.parse(pkgContent);
-    expect(pkg.dependencies["@stratum-hq/lib"]).toBeDefined();
-  });
-
-  it("package.json contains pg dependency", () => {
-    createProject("test-project", "express", projectDir, true);
-
-    const pkgContent = fs.readFileSync(path.join(projectDir, "package.json"), "utf8");
-    const pkg = JSON.parse(pkgContent);
-    expect(pkg.dependencies["pg"]).toBeDefined();
-  });
-
-  it("package.json contains express dependency for express template", () => {
-    createProject("test-project", "express", projectDir, true);
-
-    const pkgContent = fs.readFileSync(path.join(projectDir, "package.json"), "utf8");
-    const pkg = JSON.parse(pkgContent);
-    expect(pkg.dependencies["express"]).toBeDefined();
-  });
-
-  it("docker-compose.yml contains PostgreSQL 16", () => {
-    createProject("test-project", "express", projectDir, true);
-
-    const dockerContent = fs.readFileSync(
-      path.join(projectDir, "docker-compose.yml"),
-      "utf8",
-    );
-    expect(dockerContent).toContain("postgres:16-alpine");
-  });
-
-  it("init.sql enables uuid-ossp and ltree extensions", () => {
-    createProject("test-project", "express", projectDir, true);
-
-    const sqlContent = fs.readFileSync(path.join(projectDir, "init.sql"), "utf8");
-    expect(sqlContent).toContain("uuid-ossp");
-    expect(sqlContent).toContain("ltree");
-  });
-
-  it(".env.example contains DATABASE_URL", () => {
-    createProject("test-project", "express", projectDir, true);
-
-    const envContent = fs.readFileSync(path.join(projectDir, ".env.example"), "utf8");
-    expect(envContent).toContain("DATABASE_URL");
-  });
-
-  it("default template is express", () => {
-    const result = parseArgs(["my-app"]);
-    expect(result.template).toBe("express");
-  });
-});
-
-// ─── Project name validation ──────────────────────────────────────────────────
-
-describe("validateProjectName", () => {
-  it("accepts a valid name", () => {
-    expect(validateProjectName("valid-name")).toBeNull();
-  });
-
-  it("accepts names with dots and underscores", () => {
-    expect(validateProjectName("my.app_1")).toBeNull();
-  });
-
-  it("rejects empty string", () => {
-    expect(validateProjectName("")).not.toBeNull();
-  });
-
-  it("rejects name with spaces", () => {
-    expect(validateProjectName("name with spaces")).not.toBeNull();
-  });
-
-  it("rejects path traversal with ../", () => {
-    expect(validateProjectName("../escape")).not.toBeNull();
-  });
-
-  it("rejects absolute path", () => {
-    expect(validateProjectName("/absolute/path")).not.toBeNull();
-  });
-
-  it("rejects name starting with a dot", () => {
-    expect(validateProjectName(".hidden")).not.toBeNull();
-  });
-
-  it("rejects name with path separator embedded", () => {
-    expect(validateProjectName("foo/bar")).not.toBeNull();
-  });
-});
-
-// ─── Directory existence error ────────────────────────────────────────────────
-
-describe("directory existence check", () => {
-  it("errors when directory exists without --force", () => {
-    // parseArgs doesn't control this — main() does the fs.existsSync check.
-    // We verify that parseArgs returns force=false by default, which triggers the error.
-    const result = parseArgs(["existing-dir"]);
-    expect(result.force).toBe(false);
-    // When force is false and dir exists, main() calls process.exit(1)
-  });
-
-  it("--force flag allows overwriting existing directory", () => {
-    const result = parseArgs(["existing-dir", "--force"]);
-    expect(result.force).toBe(true);
-  });
-});