@usequark/quark-create-app 1.25.8 → 1.25.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.25.8",
+  "version": "1.25.10",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/templates/base-project/apps/web/src/app/api/auth/apple/route.js

@@ -1,6 +1,6 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { getAppleClientIds } from "@usequark/quark-config/oauth";
-import { validateBody } from "@usequark/quark-core";
+import { validateBody } from "@usequark/quark-core/core";
 import { user } from "@usequark/quark-db";
 import { importJWK, jwtVerify } from "jose";
 import { NextResponse } from "next/server";

package/templates/base-project/apps/web/src/app/api/auth/google/route.js

@@ -2,10 +2,11 @@ import {
 	getGoogleClientId,
 	isAudienceValid,
 } from "@usequark/quark-config/oauth";
-import { validateBody } from "@usequark/quark-core";
+import { validateBody } from "@usequark/quark-core/core";
 import { user } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import { isEmailVerified } from "../../../../lib/email-verified";
 import { issueTokenPair } from "../../../../lib/jwt";
 import { handleError } from "../../error-handler";
 
@@ -73,6 +74,24 @@ export async function POST(request) {
 			);
 		}
 
+		// An unverified address proves nothing about who controls the inbox, and
+		// this route creates the account on first sight — so without this check the
+		// confirmation that is supposed to establish ownership of the address is
+		// the attacker's to skip rather than the victim's to perform.
+		//
+		// It sits after the missing-email `400` on purpose. That one describes the
+		// shape of the token rather than reporting that the token was refused, and
+		// putting this check ahead of it would change a response operators already
+		// read for what it is. What matters for security is the position relative
+		// to the database: both checks land before `findByEmail`, so an unverified
+		// address can never become a registration or existence oracle.
+		if (!isEmailVerified(tokenInfo.email_verified)) {
+			return NextResponse.json(
+				{ message: "Invalid Google token" },
+				{ status: 401 },
+			);
+		}
+
 		// Find or create user
 		let existingUser = await user.findByEmail(googleEmail);
 		if (!existingUser) {

package/templates/base-project/apps/web/src/app/api/auth/refresh/route.js

@@ -1,4 +1,4 @@
-import { createLogger, validateBody } from "@usequark/quark-core";
+import { createLogger, validateBody } from "@usequark/quark-core/core";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { issueTokenPair, verifyMobileToken } from "../../../../lib/jwt";

package/templates/base-project/apps/web/src/app/api/auth/register/route.js

@@ -1,13 +1,9 @@
-import {
-	createQueue,
-	hashPassword,
-	validateBody,
-	withCsrfProtection,
-} from "@usequark/quark-core";
+import { hashPassword } from "@usequark/quark-core/auth";
+import { validateBody, withCsrfProtection } from "@usequark/quark-core/core";
 import { user, userRegisterSchema } from "@usequark/quark-db";
-import { JOB_NAMES, JOB_QUEUES } from "@usequark/quark-jobs";
 import { NextResponse } from "next/server";
 import { isSignupEnabled } from "@/lib/auth-signup";
+import { enqueueWelcomeEmail } from "@/lib/enqueue-welcome-email";
 import { handleError } from "../../error-handler";
 
 export const POST = withCsrfProtection(async (request) => {
@@ -46,12 +42,11 @@ export const POST = withCsrfProtection(async (request) => {
 		// Don't return the password
 		const { password: _, ...safeUser } = newUser;
 
-		// Enqueue welcome email (fire-and-forget - don't block the response)
+		// Enqueue welcome email (fire-and-forget - don't block the response).
+		// The queue module is reached through a lazily-loaded helper, so BullMQ
+		// stays out of this process until a registration actually happens.
 		try {
-			const emailQueue = createQueue(JOB_QUEUES.EMAIL);
-			await emailQueue.add(JOB_NAMES.SEND_WELCOME_EMAIL, {
-				userId: newUser.id,
-			});
+			await enqueueWelcomeEmail(newUser.id);
 		} catch {
 			// Non-critical - user is created even if email fails to enqueue
 		}

package/templates/base-project/apps/web/src/app/api/auth/token/route.js

@@ -1,4 +1,5 @@
-import { validateBody, verifyPassword } from "@usequark/quark-core";
+import { verifyPassword } from "@usequark/quark-core/auth";
+import { validateBody } from "@usequark/quark-core/core";
 import { user } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { z } from "zod";

package/templates/base-project/apps/web/src/app/api/csrf/route.js

@@ -4,7 +4,7 @@
  * and returns it to the client for inclusion in request headers.
  */
 
-import { generateCsrfToken } from "@usequark/quark-core";
+import { generateCsrfToken } from "@usequark/quark-core/core";
 import { NextResponse } from "next/server";
 import { getCsrfCookieOptions } from "@/lib/csrf-cookie";
 

package/templates/base-project/apps/web/src/app/api/device/register/route.js

@@ -1,4 +1,4 @@
-import { validateBody } from "@usequark/quark-core";
+import { validateBody } from "@usequark/quark-core/core";
 import { prisma } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { z } from "zod";

package/templates/base-project/apps/web/src/app/api/error-handler.js

@@ -1,4 +1,4 @@
-import { AppError, createLogger } from "@usequark/quark-core";
+import { AppError, createLogger } from "@usequark/quark-core/core";
 import { NextResponse } from "next/server";
 
 const logger = createLogger("api");

package/templates/base-project/apps/web/src/app/api/files/[id]/route.js

@@ -7,11 +7,11 @@
 import {
 	ConflictError,
 	createLogger,
-	createStorage,
 	ForbiddenError,
 	NotFoundError,
 	withCsrfProtection,
-} from "@usequark/quark-core";
+} from "@usequark/quark-core/core";
+import { createStorage } from "@usequark/quark-core/storage";
 import { file } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { requireAuth } from "@/lib/auth-middleware";

package/templates/base-project/apps/web/src/app/api/files/route.js

@@ -5,13 +5,15 @@
  */
 
 import {
-	createStorage,
-	generateStorageKey,
-	parseMultipart,
 	parsePaginationQuery,
 	validateFile,
 	withCsrfProtection,
-} from "@usequark/quark-core";
+} from "@usequark/quark-core/core";
+import { parseMultipart } from "@usequark/quark-core/multipart";
+import {
+	createStorage,
+	generateStorageKey,
+} from "@usequark/quark-core/storage";
 import { file } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { requireAuth } from "@/lib/auth-middleware";

package/templates/base-project/apps/web/src/app/api/health/route.js

@@ -17,14 +17,14 @@
  * what the core module replaces.
  */
 
+import { createLogger } from "@usequark/quark-core/core";
 import {
 	checkQueues,
 	checkStorage,
-	createLogger,
-	getRegisteredQueues,
-	pingRedis,
 	runHealthChecks,
-} from "@usequark/quark-core";
+} from "@usequark/quark-core/health";
+import { getRegisteredQueues } from "@usequark/quark-core/queue";
+import { pingRedis } from "@usequark/quark-core/redis";
 import { pingDatabase } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 

package/templates/base-project/apps/web/src/app/api/users/[id]/route.js

@@ -2,7 +2,7 @@ import {
 	ConflictError,
 	validateBody,
 	withCsrfProtection,
-} from "@usequark/quark-core";
+} from "@usequark/quark-core/core";
 import { user, userUpdateSchema } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { requireRole } from "@/lib/auth-middleware";

package/templates/base-project/apps/web/src/app/api/users/me/route.js

@@ -1,4 +1,4 @@
-import { validateBody, withCsrfProtection } from "@usequark/quark-core";
+import { validateBody, withCsrfProtection } from "@usequark/quark-core/core";
 import { user, userUpdateSchema } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { extractBearerPayload } from "../../../../lib/jwt";

package/templates/base-project/apps/web/src/app/api/users/route.js

@@ -2,7 +2,7 @@ import {
 	parsePaginationQuery,
 	validateBody,
 	withCsrfProtection,
-} from "@usequark/quark-core";
+} from "@usequark/quark-core/core";
 import { user, userCreateSchema } from "@usequark/quark-db";
 import { NextResponse } from "next/server";
 import { requireRole } from "@/lib/auth-middleware";

package/templates/base-project/apps/web/src/lib/auth-middleware.js

@@ -1,4 +1,4 @@
-import { ForbiddenError, UnauthorizedError } from "@usequark/quark-core";
+import { ForbiddenError, UnauthorizedError } from "@usequark/quark-core/errors";
 import { auth } from "./auth";
 
 const UNAUTHENTICATED = "You must be logged in to access this resource";

package/templates/base-project/apps/web/src/lib/auth.js

@@ -1,14 +1,13 @@
 import { PrismaAdapter } from "@auth/prisma-adapter";
-import {
-	createAuthConfig,
-	createLogger,
-	verifyPassword,
-} from "@usequark/quark-core";
+import { createAuthConfig, verifyPassword } from "@usequark/quark-core/auth";
+import { createLogger } from "@usequark/quark-core/core";
+import { AppError } from "@usequark/quark-core/errors";
 import { Prisma, prisma, user } from "@usequark/quark-db";
 import NextAuth from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 import GithubProvider from "next-auth/providers/github";
 import GoogleProvider from "next-auth/providers/google";
+import { isEmailVerified } from "./email-verified";
 
 const logger = createLogger({ name: "auth" });
 const STALE_SESSION_PATTERN = /jwtsessionerror|no matching decryption secret/i;
@@ -128,6 +127,31 @@ if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
 		GoogleProvider({
 			clientId: process.env.GOOGLE_CLIENT_ID,
 			clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+			// The web sign-in creates its account on first sight through the
+			// Prisma adapter, so an unconfirmed address here means the same thing it
+			// does on the mobile route: the confirmation that is supposed to
+			// establish ownership of the address never happened. Google does issue
+			// tokens for unconfirmed addresses.
+			//
+			// The refusal is thrown rather than returned, and that is deliberate.
+			// Auth.js has no "null means refuse" contract: `getUserAndAccount` reads
+			// `profile.email` straight off whatever the mapper hands back, so a null
+			// denial works only because it trips a TypeError that is caught and
+			// logged as `OAuthProfileParseError` — indistinguishable, in the log, from
+			// a malformed provider response or a user who cancelled. Throwing says
+			// why in the one place an operator can read it, and lands in the same
+			// catch: no session, no user row, redirect back to the sign-in page.
+			profile: (profile) => {
+				if (!isEmailVerified(profile.email_verified)) {
+					throw new AppError(
+						"Google sign-in refused: the account's email address is not verified",
+						401,
+						"OAUTH_EMAIL_NOT_VERIFIED",
+					);
+				}
+
+				return profile;
+			},
 		}),
 	);
 }

package/templates/base-project/apps/web/src/lib/email-verified.js

@@ -0,0 +1,28 @@
+/**
+ * Whether a provider's `email_verified` claim says the address is confirmed.
+ *
+ * Providers disagree on the wire format. Google's `tokeninfo` endpoint reports
+ * the claim as the *string* `"true"` or `"false"`; the OIDC userinfo that
+ * reaches a NextAuth profile mapper carries the same string. The id token's own
+ * claim is a boolean. A plain truthiness check would therefore do the exact
+ * opposite of the obvious thing: accept `"false"` while refusing every real
+ * sign-in. Both spellings mean the same thing and both are accepted; nothing
+ * else is.
+ *
+ * Everything else — a missing claim, a null, a number, `"yes"` — reads as
+ * unverified, because the failure modes are asymmetric. A wrong refusal costs
+ * one unlucky sign-in. A wrong acceptance hands an unconfirmed address a
+ * session on a route or a provider that creates the account on first sight.
+ *
+ * Shared by both Google sign-in paths — the hand-written `POST /api/auth/google`
+ * the mobile app posts to, and the NextAuth provider the web button uses — so
+ * there is one definition of "confirmed" rather than two that can drift.
+ *
+ * @param {unknown} value
+ * @returns {boolean}
+ */
+export function isEmailVerified(value) {
+	if (typeof value === "boolean") return value;
+	if (typeof value !== "string") return false;
+	return value.trim().toLowerCase() === "true";
+}

package/templates/base-project/apps/web/src/lib/enqueue-welcome-email.js

@@ -0,0 +1,51 @@
+import { JOB_NAMES, JOB_QUEUES } from "@usequark/quark-jobs";
+
+/**
+ * Loads the queue module on demand.
+ *
+ * Kept as a named binding rather than an inline `import()` so it can be
+ * substituted — see `loadQueue` on {@link enqueueWelcomeEmail}.
+ *
+ * @returns {Promise<typeof import("@usequark/quark-core/queue")>}
+ */
+function loadQueueModule() {
+	return import("@usequark/quark-core/queue");
+}
+
+/**
+ * Enqueues the post-signup welcome email for a newly created user.
+ *
+ * This lives in its own module for two reasons.
+ *
+ * The queue module is imported dynamically from inside this file, so callers
+ * that import *this* statically never pull BullMQ into their module graph. That
+ * matters most for `/api/auth/register`, which is reachable on the web service:
+ * a module-scope `createQueue` import both loaded BullMQ at startup and pinned a
+ * Redis connection to the web process for as long as the process lived.
+ *
+ * It also gives the route a static boundary to substitute in tests. `mock.module`
+ * intercepts a dynamic import only when the importing module registered the mock,
+ * so a dynamic import made by the route itself cannot be mocked from the route's
+ * test. A static import of this module can.
+ *
+ * @param {string} userId - The user to welcome. The worker rejects a job with
+ *   no userId, so this is required rather than defaulted.
+ * @param {() => Promise<{ createQueue: (name: string, options?: object) => object }>} [loadQueue]
+ *   How to obtain the queue module. Defaults to the dynamic import above;
+ *   overridden in tests.
+ * @returns {Promise<void>}
+ * @throws Whatever `createQueue` or `add` throws. The queue is closed either
+ *   way, so a caller that swallows the error still leaves no connection behind.
+ */
+export async function enqueueWelcomeEmail(userId, loadQueue = loadQueueModule) {
+	const { createQueue } = await loadQueue();
+	const queue = createQueue(JOB_QUEUES.EMAIL);
+
+	try {
+		await queue.add(JOB_NAMES.SEND_WELCOME_EMAIL, { userId });
+	} finally {
+		// Never let a failing close mask the enqueue outcome — the caller only
+		// needs to know whether the job reached the queue.
+		await queue.close().catch(() => {});
+	}
+}

package/templates/base-project/apps/web/src/lib/jwt.js

@@ -1,4 +1,5 @@
-import { AppError, getAuthSecret } from "@usequark/quark-core";
+import { getAuthSecret } from "@usequark/quark-core/auth";
+import { AppError } from "@usequark/quark-core/core";
 import { jwtVerify, SignJWT } from "jose";
 
 const ISSUER = "quark-mobile";

package/templates/base-project/apps/web/src/preflight.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadConfig } from "@usequark/quark-config";
-import { createLogger } from "@usequark/quark-core";
+import { createLogger } from "@usequark/quark-core/core";
 import { pingDatabase } from "@usequark/quark-db";
 
 const logger = createLogger("web-preflight");

package/templates/base-project/biome.json

@@ -23,7 +23,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"preset": "recommended"
+			"recommended": true
 		}
 	},
 	"javascript": {

package/templates/base-project/packages/db/src/umami.js

@@ -4,7 +4,7 @@
  * No API key needed — we connect to the same DB Umami uses.
  */
 
-import { createLogger } from "@usequark/quark-core";
+import { createLogger } from "@usequark/quark-core/core";
 
 const log = createLogger("lib:umami-db");
 

package/templates/config/src/redis.js

@@ -1,4 +1,4 @@
-import { resolveRedisConnection } from "@usequark/quark-core";
+import { resolveRedisConnection } from "@usequark/quark-core/redis";
 
 let _redis = null;
 

package/templates/config/src/validate-env.js

@@ -1,4 +1,4 @@
-import { createLogger } from "@usequark/quark-core";
+import { createLogger } from "@usequark/quark-core/core";
 import { ValidationError } from "@usequark/quark-core/errors";
 import { z } from "zod";
 import { syncNextAuthUrl } from "./app-url.js";

package/templates/worker/src/handlers/email.js

@@ -3,11 +3,11 @@
  * Processes email-related background jobs
  */
 
+import { createEmailService } from "@usequark/quark-core/email";
 import {
-	createEmailService,
 	passwordResetEmail,
 	welcomeEmail,
-} from "@usequark/quark-core";
+} from "@usequark/quark-core/email-templates";
 import { prisma } from "@usequark/quark-db";
 import { JOB_NAMES } from "@usequark/quark-jobs";
 import {

package/templates/worker/src/handlers/files.js

@@ -3,7 +3,7 @@
  * Processes file-related background jobs (cleanup, etc.)
  */
 
-import { createStorage } from "@usequark/quark-core";
+import { createStorage } from "@usequark/quark-core/storage";
 import { file } from "@usequark/quark-db";
 import { JOB_NAMES } from "@usequark/quark-jobs";
 

package/templates/worker/src/index.js

@@ -4,15 +4,15 @@
  * Handles job execution, retries, and error tracking
  */
 
+import { createLogger } from "@usequark/quark-core/core";
+import { AppError } from "@usequark/quark-core/errors";
 import {
 	checkQueueHealth,
-	createLogger,
 	createQueue,
 	createWorker,
-	getRedisEndpoint,
 	updateQueueDepths,
-} from "@usequark/quark-core";
-import { AppError } from "@usequark/quark-core/errors";
+} from "@usequark/quark-core/queue";
+import { getRedisEndpoint, getRedisUrl } from "@usequark/quark-core/redis";
 import { job, prisma } from "@usequark/quark-db";
 import { JOB_NAMES, JOB_QUEUES } from "@usequark/quark-jobs";
 import { jobHandlers } from "./handlers/index.js";

package/templates/worker/src/lib/railway.js

@@ -3,7 +3,7 @@
  * Fetches estimated usage and deployment data from Railway's GraphQL API.
  */
 
-import { createLogger } from "@usequark/quark-core";
+import { createLogger } from "@usequark/quark-core/core";
 import { AppError } from "@usequark/quark-core/errors";
 
 const log = createLogger("lib:railway");

package/templates/worker/src/lib/tokens.js

@@ -1,4 +1,4 @@
-import { createLogger } from "@usequark/quark-core";
+import { createLogger } from "@usequark/quark-core/core";
 
 const _logger = createLogger("worker:tokens");