@sundaysf/cli-v3 0.0.1

package/templates/api-auth/src/controllers/auth/auth.controller.ts

@@ -0,0 +1,109 @@
+import type { NextFunction, Request, Response } from 'express';
+import {
+  conflict,
+  notFound,
+  unauthorized,
+} from '../../common/errors/http.error';
+import { AuthDAO, KnexManager, UserDAO } from '../../db';
+import type { IUser } from '../../db';
+import { validateAuthLogin } from '../../dto/input/auth/auth.login.dto';
+import { validateAuthRegister } from '../../dto/input/auth/auth.register.dto';
+import { JwtService } from '../../services/jwt/jwt.service';
+import { PasswordService } from '../../services/password/password.service';
+
+export class AuthController {
+  private _userDAO = new UserDAO();
+  private _authDAO = new AuthDAO();
+  private _jwtService = new JwtService();
+  private _passwordService = new PasswordService();
+
+  private issueToken(user: IUser): string {
+    return this._jwtService.sign({
+      sub: user.uuid!,
+      userId: user.id!,
+      email: user.email,
+    });
+  }
+
+  /** POST /api/auth/register */
+  public async register(
+    req: Request,
+    res: Response,
+    next: NextFunction
+  ): Promise<void> {
+    try {
+      const input = validateAuthRegister(req.body);
+      if (await this._userDAO.getByEmail(input.email)) {
+        throw conflict('Email already registered');
+      }
+      const passwordHash = await this._passwordService.hash(input.password);
+      const user = await KnexManager.getConnection().transaction(
+        async (trx) => {
+          const created = await this._userDAO.create(
+            {
+              email: input.email,
+              firstName: input.firstName,
+              lastName: input.lastName,
+            },
+            trx
+          );
+          await this._authDAO.create(
+            { userId: created.id!, password: passwordHash },
+            trx
+          );
+          return created;
+        }
+      );
+      res.status(201).json({
+        success: true,
+        data: { token: this.issueToken(user), user: UserDAO.toPublic(user) },
+      });
+    } catch (err) {
+      next(err);
+    }
+  }
+
+  /** POST /api/auth/login */
+  public async login(
+    req: Request,
+    res: Response,
+    next: NextFunction
+  ): Promise<void> {
+    try {
+      const input = validateAuthLogin(req.body);
+      const user = await this._userDAO.getByEmail(input.email);
+      const auth = user?.id ? await this._authDAO.getByUserId(user.id) : null;
+      const valid = auth
+        ? await this._passwordService.compare(input.password, auth.password)
+        : false;
+      if (!user || !auth || !valid) {
+        throw unauthorized('Invalid credentials');
+      }
+      if (user.isActive === false) {
+        throw unauthorized('Account is disabled');
+      }
+      await this._authDAO.touchLastLogin(auth.id!);
+      res.status(200).json({
+        success: true,
+        data: { token: this.issueToken(user), user: UserDAO.toPublic(user) },
+      });
+    } catch (err) {
+      next(err);
+    }
+  }
+
+  /** GET /api/auth/me (authMiddleware) */
+  public async me(
+    req: Request,
+    res: Response,
+    next: NextFunction
+  ): Promise<void> {
+    try {
+      const user = await this._userDAO.getByUuid(req.auth!.sub);
+      if (!user) throw notFound('User not found');
+      res.status(200).json({ success: true, data: UserDAO.toPublic(user) });
+    } catch (err) {
+      next(err);
+    }
+  }
+}

package/templates/api-auth/src/db/dao/auth/auth.dao.ts

@@ -0,0 +1,21 @@
+import type { Knex } from 'knex';
+import { BaseDAO } from '../../BaseDAO';
+import type { IAuth } from '../../interfaces/auth/auth.interfaces';
+
+export class AuthDAO extends BaseDAO<IAuth> {
+  protected readonly table = 'auth';
+
+  async getByUserId(
+    userId: number,
+    trx?: Knex.Transaction
+  ): Promise<IAuth | null> {
+    const row = await this.q(trx).where({ userId }).first();
+    return (row as IAuth | undefined) ?? null;
+  }
+
+  async touchLastLogin(id: number, trx?: Knex.Transaction): Promise<void> {
+    await this.q(trx)
+      .where({ id })
+      .update({ lastLoginAt: this._knex.fn.now() });
+  }
+}

package/templates/api-auth/src/db/dao/user/user.dao.ts

@@ -0,0 +1,24 @@
+import type { Knex } from 'knex';
+import { BaseDAO } from '../../BaseDAO';
+import type { IPublicUser, IUser } from '../../interfaces/user/user.interfaces';
+
+export class UserDAO extends BaseDAO<IUser> {
+  protected readonly table = 'user';
+
+  async getByEmail(
+    email: string,
+    trx?: Knex.Transaction
+  ): Promise<IUser | null> {
+    const row = await this.q(trx)
+      .whereRaw('lower(email) = lower(?)', [email])
+      .first();
+    return (row as IUser | undefined) ?? null;
+  }
+
+  /** Strips the internal id (and anything else that must not leave the API). */
+  static toPublic(user: IUser): IPublicUser {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    const { id, ...rest } = user;
+    return rest;
+  }
+}

package/templates/api-auth/src/db/interfaces/auth/auth.interfaces.ts

@@ -0,0 +1,8 @@
+import type { IEntity } from '../../d.types';
+
+export interface IAuth extends IEntity {
+  userId: number;
+  /** bcrypt hash, never the plain password. */
+  password: string;
+  lastLoginAt?: Date | string | null;
+}

package/templates/api-auth/src/db/interfaces/user/user.interfaces.ts

@@ -0,0 +1,11 @@
+import type { IEntity } from '../../d.types';
+
+export interface IUser extends IEntity {
+  email: string;
+  firstName: string;
+  lastName: string;
+  isActive?: boolean;
+}
+
+/** Shape exposed by the API: no internal id. */
+export type IPublicUser = Omit<IUser, 'id'>;

package/templates/api-auth/src/dto/input/auth/auth.login.dto.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+import { parseDto } from '../../../common/validation/parse-dto';
+
+export const AuthLoginSchema = z
+  .object({
+    email: z.email().trim().toLowerCase().max(255),
+    password: z.string().min(1).max(128),
+  })
+  .strict();
+
+export type AuthLoginInput = z.infer<typeof AuthLoginSchema>;
+
+export const validateAuthLogin = (input: unknown): AuthLoginInput =>
+  parseDto(AuthLoginSchema, input);

package/templates/api-auth/src/dto/input/auth/auth.register.dto.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+import { parseDto } from '../../../common/validation/parse-dto';
+
+export const AuthRegisterSchema = z
+  .object({
+    email: z.email().trim().toLowerCase().max(255),
+    password: z
+      .string()
+      .min(8, 'Password must be at least 8 characters')
+      .max(128),
+    firstName: z.string().trim().min(1).max(100),
+    lastName: z.string().trim().min(1).max(100),
+  })
+  .strict();
+
+export type AuthRegisterInput = z.infer<typeof AuthRegisterSchema>;
+
+export const validateAuthRegister = (input: unknown): AuthRegisterInput =>
+  parseDto(AuthRegisterSchema, input);

package/templates/api-auth/src/middlewares/auth/__tests__/auth.middleware.test.ts

@@ -0,0 +1,52 @@
+import type { NextFunction, Request, Response } from 'express';
+import { HttpError } from '../../../common/errors/http.error';
+import { JwtService } from '../../../services/jwt/jwt.service';
+import { authMiddleware, optionalAuthMiddleware } from '../auth.middleware';
+
+const build = (authorization?: string) => {
+  const req = { header: jest.fn(() => authorization) } as unknown as Request;
+  const res = {} as Response;
+  const next = jest.fn() as jest.MockedFunction<NextFunction>;
+  return { req, res, next };
+};
+const payload = { sub: 'uuid-1', userId: 1, email: 'a@b.co' };
+const token = new JwtService().sign(payload);
+
+describe('authMiddleware', () => {
+  it('sets req.auth for a valid bearer token', () => {
+    const { req, res, next } = build(`Bearer ${token}`);
+    authMiddleware(req, res, next);
+    expect(req.auth).toEqual(payload);
+    expect(next).toHaveBeenCalledWith();
+  });
+
+  it.each([undefined, 'Basic abc', 'Bearer ', 'Bearer not-a-token'])(
+    'rejects header %p with 401',
+    (header) => {
+      const { req, res, next } = build(header);
+      authMiddleware(req, res, next);
+      const err = next.mock.calls[0][0] as unknown as HttpError;
+      expect(err).toBeInstanceOf(HttpError);
+      expect(err.statusCode).toBe(401);
+      expect(req.auth).toBeUndefined();
+    }
+  );
+});
+
+describe('optionalAuthMiddleware', () => {
+  it('sets req.auth when the token is valid', () => {
+    const { req, res, next } = build(`Bearer ${token}`);
+    optionalAuthMiddleware(req, res, next);
+    expect(req.auth).toEqual(payload);
+    expect(next).toHaveBeenCalledWith();
+  });
+
+  it('continues anonymously without or with an invalid token', () => {
+    for (const header of [undefined, 'Bearer garbage']) {
+      const { req, res, next } = build(header);
+      optionalAuthMiddleware(req, res, next);
+      expect(req.auth).toBeUndefined();
+      expect(next).toHaveBeenCalledWith();
+    }
+  });
+});

package/templates/api-auth/src/middlewares/auth/auth.middleware.ts

@@ -0,0 +1,56 @@
+import type { NextFunction, Request, Response } from 'express';
+import { unauthorized } from '../../common/errors/http.error';
+import { JwtService, type IJwtPayload } from '../../services/jwt/jwt.service';
+
+declare global {
+  // eslint-disable-next-line @typescript-eslint/no-namespace
+  namespace Express {
+    interface Request {
+      /** Set by authMiddleware / optionalAuthMiddleware. */
+      auth?: IJwtPayload;
+    }
+  }
+}
+
+const readBearer = (req: Request): string | null => {
+  const header = req.header('authorization');
+  if (!header || !header.startsWith('Bearer ')) return null;
+  const token = header.slice('Bearer '.length).trim();
+  return token.length ? token : null;
+};
+
+/** Requires a valid `Authorization: Bearer <token>`; puts the payload in `req.auth`. */
+export const authMiddleware = (
+  req: Request,
+  _res: Response,
+  next: NextFunction
+): void => {
+  const token = readBearer(req);
+  if (!token) {
+    next(unauthorized('Missing or invalid Authorization header'));
+    return;
+  }
+  try {
+    req.auth = new JwtService().verify(token);
+    next();
+  } catch {
+    next(unauthorized('Invalid or expired token'));
+  }
+};
+
+/** Like authMiddleware but never rejects: anonymous requests continue with `req.auth` unset. */
+export const optionalAuthMiddleware = (
+  req: Request,
+  _res: Response,
+  next: NextFunction
+): void => {
+  const token = readBearer(req);
+  if (token) {
+    try {
+      req.auth = new JwtService().verify(token);
+    } catch {
+      // invalid token -> treated as anonymous
+    }
+  }
+  next();
+};

package/templates/api-auth/src/migrations/20240101000001_create_user.ts

@@ -0,0 +1,18 @@
+import type { Knex } from 'knex';
+
+export async function up(knex: Knex): Promise<void> {
+  await knex.schema.createTable('user', (table) => {
+    table.increments('id').primary();
+    table.uuid('uuid').notNullable().unique();
+    table.string('email', 255).notNullable().unique();
+    table.string('firstName', 100).notNullable();
+    table.string('lastName', 100).notNullable();
+    table.boolean('isActive').notNullable().defaultTo(true);
+    table.timestamp('createdAt').notNullable().defaultTo(knex.fn.now());
+    table.timestamp('updatedAt').notNullable().defaultTo(knex.fn.now());
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists('user');
+}

package/templates/api-auth/src/migrations/20240101000002_create_auth.ts

@@ -0,0 +1,24 @@
+import type { Knex } from 'knex';
+
+/** Credentials live apart from the profile so `user` rows can be exposed safely. */
+export async function up(knex: Knex): Promise<void> {
+  await knex.schema.createTable('auth', (table) => {
+    table.increments('id').primary();
+    table.uuid('uuid').notNullable().unique();
+    table
+      .integer('userId')
+      .notNullable()
+      .unique()
+      .references('id')
+      .inTable('user')
+      .onDelete('CASCADE');
+    table.string('password', 255).notNullable();
+    table.timestamp('lastLoginAt').nullable();
+    table.timestamp('createdAt').notNullable().defaultTo(knex.fn.now());
+    table.timestamp('updatedAt').notNullable().defaultTo(knex.fn.now());
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists('auth');
+}

package/templates/api-auth/src/routes/auth/__tests__/auth.routes.test.ts

@@ -0,0 +1,83 @@
+import { randomUUID } from 'crypto';
+import request from 'supertest';
+import app from '../../../app';
+import { KnexManager } from '../../../db';
+
+// Integration: real Postgres (docker compose up -d) with migrations applied.
+describe('/api/auth', () => {
+  const email = `auth-${randomUUID().slice(0, 8)}@example.com`;
+  const password = 'secret123';
+  let token = '';
+
+  beforeAll(async () => {
+    await KnexManager.connect();
+  });
+
+  afterAll(async () => {
+    await KnexManager.getConnection()('user').where({ email }).delete();
+    await KnexManager.disconnect();
+  });
+
+  it('registers a user', async () => {
+    const res = await request(app)
+      .post('/api/auth/register')
+      .send({ email, password, firstName: 'Ada', lastName: 'Lovelace' });
+    expect(res.status).toBe(201);
+    expect(res.body.success).toBe(true);
+    expect(res.body.data.user).toMatchObject({ email, firstName: 'Ada' });
+    expect(res.body.data.user.id).toBeUndefined();
+    expect(res.body.data.user.uuid).toEqual(expect.any(String));
+    expect(res.body.data.token).toEqual(expect.any(String));
+  });
+
+  it('rejects the same email twice', async () => {
+    const res = await request(app)
+      .post('/api/auth/register')
+      .send({ email, password, firstName: 'Ada', lastName: 'Lovelace' });
+    expect(res.status).toBe(409);
+    expect(res.body).toEqual({
+      success: false,
+      message: 'Email already registered',
+    });
+  });
+
+  it('validates the body', async () => {
+    const res = await request(app)
+      .post('/api/auth/register')
+      .send({ email: 'nope', password: '1' });
+    expect(res.status).toBe(400);
+    expect(res.body.message).toBe('Validation failed');
+    expect(res.body.errors).toHaveProperty('email');
+    expect(res.body.errors).toHaveProperty('password');
+  });
+
+  it('logs in', async () => {
+    const res = await request(app)
+      .post('/api/auth/login')
+      .send({ email: email.toUpperCase(), password });
+    expect(res.status).toBe(200);
+    token = res.body.data.token;
+    expect(token).toEqual(expect.any(String));
+  });
+
+  it('rejects bad credentials', async () => {
+    const res = await request(app)
+      .post('/api/auth/login')
+      .send({ email, password: 'wrong' });
+    expect(res.status).toBe(401);
+  });
+
+  it('returns the profile with a bearer token', async () => {
+    const res = await request(app)
+      .get('/api/auth/me')
+      .set('Authorization', `Bearer ${token}`);
+    expect(res.status).toBe(200);
+    expect(res.body.data.email).toBe(email);
+  });
+
+  it('rejects /me without a token', async () => {
+    const res = await request(app).get('/api/auth/me');
+    expect(res.status).toBe(401);
+    expect(res.body.success).toBe(false);
+  });
+});

package/templates/api-auth/src/routes/auth/auth.router.ts

@@ -0,0 +1,28 @@
+import { Router } from 'express';
+import { AuthController } from '../../controllers/auth/auth.controller';
+import { authMiddleware } from '../../middlewares/auth/auth.middleware';
+
+export class AuthRouter {
+  public router: Router = Router();
+  private readonly _authController = new AuthController();
+
+  constructor() {
+    this.initRoutes();
+  }
+
+  private initRoutes(): void {
+    this.router.post(
+      '/register',
+      this._authController.register.bind(this._authController)
+    );
+    this.router.post(
+      '/login',
+      this._authController.login.bind(this._authController)
+    );
+    this.router.get(
+      '/me',
+      authMiddleware,
+      this._authController.me.bind(this._authController)
+    );
+  }
+}

package/templates/api-auth/src/services/jwt/__tests__/jwt.service.test.ts

@@ -0,0 +1,32 @@
+import jwt from 'jsonwebtoken';
+import { JwtService } from '../jwt.service';
+
+describe('JwtService', () => {
+  const service = new JwtService();
+  const payload = { sub: 'user-uuid', userId: 1, email: 'a@b.co' };
+
+  it('signs and verifies a payload', () => {
+    const token = service.sign(payload);
+    expect(service.verify(token)).toEqual(payload);
+  });
+
+  it('rejects a token signed with another secret', () => {
+    const forged = jwt.sign(
+      payload,
+      'another-secret-that-is-long-enough-123456'
+    );
+    expect(() => service.verify(forged)).toThrow();
+  });
+
+  it('rejects an expired token', () => {
+    const expired = jwt.sign(payload, process.env.JWT_SECRET!, {
+      expiresIn: -10,
+    });
+    expect(() => service.verify(expired)).toThrow(/expired/i);
+  });
+
+  it('rejects a payload without subject', () => {
+    const noSub = jwt.sign({ userId: 1 }, process.env.JWT_SECRET!);
+    expect(() => service.verify(noSub)).toThrow(/Invalid token payload/);
+  });
+});

package/templates/api-auth/src/services/jwt/jwt.service.ts

@@ -0,0 +1,36 @@
+import jwt, { type SignOptions } from 'jsonwebtoken';
+import { env } from '../../common/config/env';
+
+export interface IJwtPayload {
+  /** Subject: the user's public uuid. */
+  sub: string;
+  userId: number;
+  email: string;
+}
+
+/** Signs and verifies access tokens with JWT_SECRET / JWT_EXPIRES_IN. */
+export class JwtService {
+  private readonly _secret: string = env.JWT_SECRET;
+  private readonly _expiresIn: string = env.JWT_EXPIRES_IN;
+
+  public sign(payload: IJwtPayload): string {
+    const options: SignOptions = {
+      expiresIn: this._expiresIn as SignOptions['expiresIn'],
+    };
+    return jwt.sign(payload, this._secret, options);
+  }
+
+  /** Returns the payload or throws (invalid signature, malformed, expired). */
+  public verify(token: string): IJwtPayload {
+    const decoded = jwt.verify(token, this._secret);
+    if (
+      typeof decoded !== 'object' ||
+      decoded === null ||
+      typeof decoded.sub !== 'string'
+    ) {
+      throw new Error('Invalid token payload');
+    }
+    const { sub, userId, email } = decoded as IJwtPayload;
+    return { sub, userId, email };
+  }
+}

package/templates/api-auth/src/services/password/__tests__/password.service.test.ts

@@ -0,0 +1,13 @@
+import { PasswordService } from '../password.service';
+
+describe('PasswordService', () => {
+  const service = new PasswordService(4);
+
+  it('hashes and compares', async () => {
+    const hash = await service.hash('secret123');
+    expect(hash).not.toBe('secret123');
+    expect(hash).toMatch(/^\$2[aby]\$/);
+    expect(await service.compare('secret123', hash)).toBe(true);
+    expect(await service.compare('nope', hash)).toBe(false);
+  });
+});

package/templates/api-auth/src/services/password/password.service.ts

@@ -0,0 +1,14 @@
+import bcrypt from 'bcryptjs';
+
+/** bcrypt hashing (bcryptjs: pure JS, same format as native bcrypt, no build step). */
+export class PasswordService {
+  constructor(private readonly _saltRounds: number = 10) {}
+
+  public hash(plain: string): Promise<string> {
+    return bcrypt.hash(plain, this._saltRounds);
+  }
+
+  public compare(plain: string, hash: string): Promise<boolean> {
+    return bcrypt.compare(plain, hash);
+  }
+}