better-ts-stack 1.1.2 → 1.1.4

package/templates/modules/auth/express/src/controllers/authController.ts.hbs

@@ -2,32 +2,67 @@ import { Request, Response } from "express";
 import bcrypt from "bcrypt";
 import { signToken } from "../lib/jwt";
 import { AuthenticatedRequest } from "../middleware/requireAuth";
-import { createUser, findUserByEmail, toPublicUser } from "../services/userStore";
+import {
+  createUser,
+  findUserByEmail,
+  isDuplicateEmailError,
+  toPublicUser,
+} from "../services/userStore";
 
 const SALT_ROUNDS = 10;
+const MIN_PASSWORD_LENGTH = 8;
+// bcrypt ignores bytes beyond 72, so longer passwords would be silently truncated
+const MAX_PASSWORD_BYTES = 72;
 
+// Request bodies are untrusted JSON, so fields may have any type
 interface RegisterBody {
-  email?: string;
-  password?: string;
-  name?: string | null;
+  email?: unknown;
+  password?: unknown;
+  name?: unknown;
 }
 
 interface LoginBody {
-  email?: string;
-  password?: string;
+  email?: unknown;
+  password?: unknown;
+}
+
+// Returns a trimmed, lowercased email, or null when the value is not a usable string
+function normalizeEmail(email: unknown): string | null {
+  if (typeof email !== "string") return null;
+  const normalized = email.trim().toLowerCase();
+  return normalized || null;
 }
 
 export async function register(
-  req: Request<object, unknown, RegisterBody>,
+  req: Request<object, unknown, RegisterBody | undefined>,
   res: Response,
 ): Promise<void> {
-  const { email, password, name } = req.body;
+  // Express 5 leaves req.body undefined when the request has no body
+  const body = req.body ?? {};
+  const email = normalizeEmail(body.email);
+  const password = body.password;
+  const name = body.name ?? null;
 
-  if (!email || !password) {
+  if (!email || typeof password !== "string" || !password) {
     res.status(400).json({ error: "Email and password are required" });
     return;
   }
 
+  if (
+    password.length < MIN_PASSWORD_LENGTH ||
+    Buffer.byteLength(password, "utf8") > MAX_PASSWORD_BYTES
+  ) {
+    res.status(400).json({
+      error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters and at most ${MAX_PASSWORD_BYTES} bytes`,
+    });
+    return;
+  }
+
+  if (name !== null && typeof name !== "string") {
+    res.status(400).json({ error: "Name must be a string" });
+    return;
+  }
+
   const existingUser = await findUserByEmail(email);
   if (existingUser) {
     res.status(409).json({ error: "User already exists" });
@@ -35,19 +70,33 @@ export async function register(
   }
 
   const hashedPassword = await bcrypt.hash(password, SALT_ROUNDS);
-  const user = await createUser({ email, name, password: hashedPassword });
+
+  let user;
+  try {
+    user = await createUser({ email, name, password: hashedPassword });
+  } catch (error) {
+    // A concurrent request registered the same email after the check above
+    if (isDuplicateEmailError(error)) {
+      res.status(409).json({ error: "User already exists" });
+      return;
+    }
+    throw error;
+  }
+
   const token = signToken({ sub: user.id, email: user.email, name: user.name });
 
   res.status(201).json({ user: toPublicUser(user), token });
 }
 
 export async function login(
-  req: Request<object, unknown, LoginBody>,
+  req: Request<object, unknown, LoginBody | undefined>,
   res: Response,
 ): Promise<void> {
-  const { email, password } = req.body;
+  const body = req.body ?? {};
+  const email = normalizeEmail(body.email);
+  const password = body.password;
 
-  if (!email || !password) {
+  if (!email || typeof password !== "string" || !password) {
     res.status(400).json({ error: "Email and password are required" });
     return;
   }

package/templates/modules/auth/express/src/middleware/requireAuth.ts.hbs

@@ -1,26 +1,26 @@
-import { NextFunction, Request, Response } from 'express';
-import { AuthTokenPayload, verifyToken } from '../lib/jwt';
-
-export interface AuthenticatedRequest extends Request {
-  user?: AuthTokenPayload;
-}
-
-export function requireAuth(req: AuthenticatedRequest, res: Response, next: NextFunction): void {
-  const authHeader = req.headers.authorization;
-
-  if (!authHeader || !authHeader.startsWith('Bearer')) {
-    res.status(401).json({ error: 'Authorization header missing or invalid' });
-    return;
-  }
-
-  const token = authHeader.substring('Bearer '.length);
-
-  try {
-    const payload = verifyToken(token);
-    req.user = payload;
-    next();
-  } catch (error) {
-    console.error('JWT verification failed:', error);
-    res.status(401).json({ error: 'Invalid or expired token' });
-  }
-}
+import { NextFunction, Request, Response } from 'express';
+import { AuthTokenPayload, verifyToken } from '../lib/jwt';
+
+export interface AuthenticatedRequest extends Request {
+  user?: AuthTokenPayload;
+}
+
+export function requireAuth(req: AuthenticatedRequest, res: Response, next: NextFunction): void {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    res.status(401).json({ error: 'Authorization header missing or invalid' });
+    return;
+  }
+
+  const token = authHeader.substring('Bearer '.length);
+
+  try {
+    const payload = verifyToken(token);
+    req.user = payload;
+    next();
+  } catch (error) {
+    console.error('JWT verification failed:', error);
+    res.status(401).json({ error: 'Invalid or expired token' });
+  }
+}

package/templates/modules/auth/express/src/services/userStore.ts.hbs

@@ -77,6 +77,14 @@ export {{#unless (eq database 'none')}}async {{/unless}}function createUser(data
   {{/if}}
 
   {{#if (eq database 'none')}}
+  // Enforce unique emails like a database constraint would, so a sign-up that
+  // raced past the findUserByEmail check is rejected instead of duplicated
+  if (users.some((candidate) => candidate.email === data.email)) {
+    return Promise.reject(
+      Object.assign(new Error('User already exists'), { code: 'DUPLICATE_EMAIL' }),
+    );
+  }
+
   const newUser: AuthUser = {
     id: crypto.randomUUID(),
     email: data.email,
@@ -89,6 +97,20 @@ export {{#unless (eq database 'none')}}async {{/unless}}function createUser(data
   {{/if}}
 }
 
+// Unique-constraint error codes: Prisma, PostgreSQL (Drizzle wraps it in `cause`),
+// MongoDB, and the in-memory store
+const DUPLICATE_KEY_CODES = new Set<unknown>(['P2002', '23505', 11000, 'DUPLICATE_EMAIL']);
+
+// True when an insert failed because the email is already taken (e.g. concurrent sign-ups)
+export function isDuplicateEmailError(error: unknown): boolean {
+  let current = error;
+  for (let depth = 0; depth < 5 && current && typeof current === 'object'; depth++) {
+    if (DUPLICATE_KEY_CODES.has((current as { code?: unknown }).code)) return true;
+    current = (current as { cause?: unknown }).cause;
+  }
+  return false;
+}
+
 export function toPublicUser(user: AuthUser): Omit<AuthUser, 'password'> {
   const { id, email, name } = user;
   return { id, email, name };

package/templates/modules/docker/Dockerfile.hbs

@@ -1,126 +1,134 @@
-{{#if (eq framework 'nextjs')}}
-# Base stage
-FROM node:24-alpine AS base
-WORKDIR /app
-RUN apk add --no-cache libc6-compat
-
-# Dependencies stage
-FROM base AS deps
-COPY package*.json ./
-RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
-
-# Build stage
-FROM base AS builder
-COPY --from=deps /app/node_modules ./node_modules
-COPY . .
-{{#if (eq database 'prisma')}}
-RUN DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres" npm run build
-{{else if (eq database 'mongoose')}}
-RUN MONGODB_URI="mongodb://localhost:27017/build" npm run build
-{{else}}
-RUN npm run build
-{{/if}}
-
-# Production stage
-FROM node:24-alpine AS runner
-WORKDIR /app
-ENV NODE_ENV=production
-
-RUN addgroup --system --gid 1001 nodejs && \
-    adduser --system --uid 1001 nextjs
-
-COPY --from=builder /app/public ./public
-COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-
-USER nextjs
-EXPOSE {{port}}
-ENV PORT={{port}} HOSTNAME=0.0.0.0
-
-CMD ["node", "server.js"]
-
-{{else if (eq framework 'tanstack')}}
-# Build stage
-FROM node:24-alpine AS builder
-WORKDIR /app
-
-COPY package*.json ./
-RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
-
-COPY . .
-
-# Only build if package.json has a build script
-{{#if (eq database 'prisma')}}
-RUN DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres" npm run build
-{{else if (eq database 'mongoose')}}
-RUN MONGODB_URI="mongodb://localhost:27017/build" npm run build
-{{else}}
-RUN npm run build
-{{/if}}
-
-# Production stage
-FROM node:24-alpine
-WORKDIR /app
-ENV NODE_ENV=production
-
-# Create non-root user for security
-RUN addgroup --system --gid 1001 nodejs && \
-    adduser --system --uid 1001 tanstackuser
-
-COPY package*.json ./
-RUN if [ -f package-lock.json ]; then npm ci --omit=dev; else npm install --omit=dev; fi
-
-# Copy built output (dist/server/server.js + dist/client)
-COPY --from=builder --chown=tanstackuser:nodejs /app/dist ./dist
-
-# Include the Prisma client generated during the build stage
-{{#if (eq database 'prisma')}}
-COPY --from=builder --chown=tanstackuser:nodejs /app/generated ./generated
-{{/if}}
-
-USER tanstackuser
-EXPOSE {{port}}
-ENV PORT={{port}}
-
-CMD ["node_modules/.bin/srvx", "--prod", "-s", "../client", "dist/server/server.js"]
-
-{{else}}
-# Build stage
-FROM node:24-alpine AS builder
-WORKDIR /app
-
-COPY package*.json ./
-RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
-
-COPY . .
-
-# Only build if package.json has a build script
-{{#if (eq database 'prisma')}}
-RUN DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres" npm run build
-{{else if (eq database 'mongoose')}}
-RUN MONGODB_URI="mongodb://localhost:27017/build" npm run build
-{{else}}
-RUN npm run build
-{{/if}}
-
-# Production stage
-FROM node:24-alpine
-WORKDIR /app
-ENV NODE_ENV=production
-
-# Create non-root user for security
-RUN addgroup --system --gid 1001 nodejs && \
-    adduser --system --uid 1001 expressuser
-
-COPY package*.json ./
-RUN if [ -f package-lock.json ]; then npm ci --omit=dev; else npm install --omit=dev; fi
-
-# Copy built files (if TypeScript) or source files (if JavaScript)
-COPY --from=builder --chown=expressuser:nodejs /app/dist ./dist
-
-USER expressuser
-EXPOSE {{port}}
-ENV PORT={{port}}
-
-CMD ["node", "dist/index.js"]
+{{#if (eq framework 'nextjs')}}
+# Base stage
+FROM node:24-alpine AS base
+WORKDIR /app
+RUN apk add --no-cache libc6-compat
+
+# Dependencies stage
+FROM base AS deps
+COPY package*.json ./
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
+
+# Build stage
+FROM base AS builder
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+{{#if useAuth}}
+# next build loads the auth route, which initializes Better Auth. The build gets
+# a placeholder secret for this command only; the real one is supplied at runtime.
+{{/if}}
+{{#if (eq database 'prisma')}}
+RUN {{#if useAuth}}BETTER_AUTH_SECRET="build-only-placeholder-secret-not-used-at-runtime" {{/if}}DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres" npm run build
+{{else if (eq database 'mongoose')}}
+RUN {{#if useAuth}}BETTER_AUTH_SECRET="build-only-placeholder-secret-not-used-at-runtime" {{/if}}MONGODB_URI="mongodb://localhost:27017/build" npm run build
+{{else}}
+RUN {{#if useAuth}}BETTER_AUTH_SECRET="build-only-placeholder-secret-not-used-at-runtime" {{/if}}npm run build
+{{/if}}
+
+# Production stage
+FROM node:24-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nextjs
+
+COPY --from=builder /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+EXPOSE {{port}}
+ENV PORT={{port}} HOSTNAME=0.0.0.0
+
+CMD ["node", "server.js"]
+
+{{else if (eq framework 'tanstack')}}
+# Build stage
+FROM node:24-alpine AS builder
+WORKDIR /app
+
+COPY package*.json ./
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
+
+COPY . .
+
+# Only build if package.json has a build script
+{{#if (eq database 'prisma')}}
+RUN DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres" npm run build
+{{else if (eq database 'mongoose')}}
+RUN MONGODB_URI="mongodb://localhost:27017/build" npm run build
+{{else}}
+RUN npm run build
+{{/if}}
+
+# Production stage
+FROM node:24-alpine
+WORKDIR /app
+ENV NODE_ENV=production
+
+# Create non-root user for security
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 tanstackuser
+
+COPY package*.json ./
+# Clear the npm cache in the same layer so it does not ship in the image
+RUN if [ -f package-lock.json ]; then npm ci --omit=dev; else npm install --omit=dev; fi \
+    && npm cache clean --force
+
+# Copy built output (dist/server/server.js + dist/client)
+COPY --from=builder --chown=tanstackuser:nodejs /app/dist ./dist
+
+# Include the Prisma client generated during the build stage
+{{#if (eq database 'prisma')}}
+COPY --from=builder --chown=tanstackuser:nodejs /app/generated ./generated
+{{/if}}
+
+USER tanstackuser
+EXPOSE {{port}}
+ENV PORT={{port}}
+
+CMD ["node_modules/.bin/srvx", "--prod", "-s", "../client", "dist/server/server.js"]
+
+{{else}}
+# Build stage
+FROM node:24-alpine AS builder
+WORKDIR /app
+
+COPY package*.json ./
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
+
+COPY . .
+
+# Only build if package.json has a build script
+{{#if (eq database 'prisma')}}
+RUN DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres" npm run build
+{{else if (eq database 'mongoose')}}
+RUN MONGODB_URI="mongodb://localhost:27017/build" npm run build
+{{else}}
+RUN npm run build
+{{/if}}
+
+# Production stage
+FROM node:24-alpine
+WORKDIR /app
+ENV NODE_ENV=production
+
+# Create non-root user for security
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 expressuser
+
+COPY package*.json ./
+# Clear the npm cache in the same layer so it does not ship in the image
+RUN if [ -f package-lock.json ]; then npm ci --omit=dev; else npm install --omit=dev; fi \
+    && npm cache clean --force
+
+# Copy built files (if TypeScript) or source files (if JavaScript)
+COPY --from=builder --chown=expressuser:nodejs /app/dist ./dist
+
+USER expressuser
+EXPOSE {{port}}
+ENV PORT={{port}}
+
+CMD ["node", "dist/index.js"]
 {{/if}}

package/templates/modules/docker/config.json

@@ -7,7 +7,7 @@
   "devDependencies": {},
   "scripts": {
     "docker:build": "docker build -t {{projectName}} .",
-    "docker:up": "docker compose up -d",
+    "docker:up": "docker compose up -d --build",
     "docker:down": "docker compose down",
     "docker:logs": "docker compose logs -f"
   },

package/templates/modules/mongoose/{config.json → express/config.json}

@@ -1,7 +1,7 @@
 {
   "id": "mongoose",
   "name": "Mongoose (MongoDB)",
-  "description": "MongoDB database integration using Mongoose ODM",
+  "description": "MongoDB database integration for Express using Mongoose ODM",
   "type": "database",
   "dependencies": {
     "mongoose": "^9.9.5",
@@ -12,5 +12,5 @@
   "envVars": {
     "MONGODB_URI": "mongodb://localhost:27017/myapp"
   },
-  "templateFiles": ["src/lib/db.ts.hbs"]
+  "templateFiles": []
 }

package/templates/modules/mongoose/{src → express/src}/models/User.ts

@@ -1,48 +1,48 @@
-import mongoose, { type Model, Schema } from "mongoose";
-
-/**
- * User document interface
- */
-export interface IUser {
-  email: string;
-  name?: string | null;
-  password: string;
-  createdAt: Date;
-  updatedAt: Date;
-}
-
-/**
- * User schema definition
- */
-const userSchema = new Schema<IUser>(
-  {
-    email: {
-      type: String,
-      required: true,
-      unique: true,
-      lowercase: true,
-      trim: true,
-    },
-    name: {
-      type: String,
-      trim: true,
-    },
-    password: {
-      type: String,
-      required: true,
-      minlength: 6,
-    },
-  },
-  {
-    timestamps: true,
-  }
-);
-
-/**
- * User model
- */
-const User =
-  (mongoose.models.User as Model<IUser> | undefined) ??
-  mongoose.model<IUser>("User", userSchema);
-
-export default User;
+import mongoose, { type Model, Schema } from "mongoose";
+
+/**
+ * User document interface
+ */
+export interface IUser {
+  email: string;
+  name?: string | null;
+  password: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+/**
+ * User schema definition
+ */
+const userSchema = new Schema<IUser>(
+  {
+    email: {
+      type: String,
+      required: true,
+      unique: true,
+      lowercase: true,
+      trim: true,
+    },
+    name: {
+      type: String,
+      trim: true,
+    },
+    password: {
+      type: String,
+      required: true,
+      minlength: 6,
+    },
+  },
+  {
+    timestamps: true,
+  }
+);
+
+/**
+ * User model
+ */
+const User =
+  (mongoose.models.User as Model<IUser> | undefined) ??
+  mongoose.model<IUser>("User", userSchema);
+
+export default User;

package/templates/modules/mongoose/nextjs/config.json

@@ -0,0 +1,16 @@
+{
+  "id": "mongoose",
+  "name": "Mongoose (MongoDB)",
+  "description": "MongoDB database integration for Next.js using Mongoose ODM",
+  "type": "database",
+  "dependencies": {
+    "mongoose": "^9.9.5",
+    "mongodb": "^7.6.0"
+  },
+  "devDependencies": {},
+  "scripts": {},
+  "envVars": {
+    "MONGODB_URI": "mongodb://localhost:27017/myapp"
+  },
+  "templateFiles": []
+}

package/templates/modules/mongoose/nextjs/lib/db.ts

@@ -0,0 +1,36 @@
+import mongoose from "mongoose";
+
+// Reuse one connection across hot reloads and concurrent requests
+const globalForMongoose = globalThis as unknown as {
+  mongooseConnection?: Promise<typeof mongoose>;
+};
+
+/**
+ * Connects Mongoose once and returns the shared connection.
+ * Call this in server code before querying Mongoose models.
+ */
+export async function connectDB(): Promise<typeof mongoose> {
+  const mongoUri = process.env.MONGODB_URI;
+
+  if (!mongoUri) {
+    throw new Error("MONGODB_URI environment variable is not defined");
+  }
+
+  globalForMongoose.mongooseConnection ??= mongoose
+    .connect(mongoUri)
+    .catch((error: unknown) => {
+      // Let the next call retry instead of caching the failure
+      globalForMongoose.mongooseConnection = undefined;
+      throw error;
+    });
+
+  return globalForMongoose.mongooseConnection;
+}
+
+/**
+ * Gracefully close the MongoDB connection
+ */
+export async function disconnectDB(): Promise<void> {
+  await mongoose.connection.close();
+  globalForMongoose.mongooseConnection = undefined;
+}