better-ts-stack 1.1.3 → 2.0.0

package/templates/frontend/tanstack/src/styles/app.css

@@ -1,85 +1,85 @@
-@import "tailwindcss" source("../");
-
-@theme inline {
-  --color-background: var(--background);
-  --color-foreground: var(--foreground);
-  --color-card: var(--card);
-  --color-card-foreground: var(--card-foreground);
-  --color-primary: var(--primary);
-  --color-primary-foreground: var(--primary-foreground);
-  --color-secondary: var(--secondary);
-  --color-secondary-foreground: var(--secondary-foreground);
-  --color-muted: var(--muted);
-  --color-muted-foreground: var(--muted-foreground);
-  --color-accent: var(--accent);
-  --color-accent-foreground: var(--accent-foreground);
-  --color-destructive: var(--destructive);
-  --color-border: var(--border);
-  --color-input: var(--input);
-  --color-ring: var(--ring);
-}
-
-:root {
-  --background: oklch(0.985 0 0);
-  --foreground: oklch(0.145 0 0);
-  --card: oklch(1 0 0);
-  --card-foreground: oklch(0.145 0 0);
-  --primary: oklch(0.205 0 0);
-  --primary-foreground: oklch(0.985 0 0);
-  --secondary: oklch(0.97 0 0);
-  --secondary-foreground: oklch(0.205 0 0);
-  --muted: oklch(0.97 0 0);
-  --muted-foreground: oklch(0.556 0 0);
-  --accent: oklch(0.97 0 0);
-  --accent-foreground: oklch(0.205 0 0);
-  --destructive: oklch(0.577 0.245 27.325);
-  --border: oklch(0.922 0 0);
-  --input: oklch(0.922 0 0);
-  --ring: oklch(0.708 0 0);
-}
-
-@media (prefers-color-scheme: dark) {
-  :root {
-    --background: oklch(0.145 0 0);
-    --foreground: oklch(0.985 0 0);
-    --card: oklch(0.205 0 0);
-    --card-foreground: oklch(0.985 0 0);
-    --primary: oklch(0.922 0 0);
-    --primary-foreground: oklch(0.205 0 0);
-    --secondary: oklch(0.269 0 0);
-    --secondary-foreground: oklch(0.985 0 0);
-    --muted: oklch(0.269 0 0);
-    --muted-foreground: oklch(0.708 0 0);
-    --accent: oklch(0.269 0 0);
-    --accent-foreground: oklch(0.985 0 0);
-    --destructive: oklch(0.704 0.191 22.216);
-    --border: oklch(1 0 0 / 10%);
-    --input: oklch(1 0 0 / 15%);
-    --ring: oklch(0.556 0 0);
-  }
-}
-
-@layer base {
-  *,
-  ::after,
-  ::before,
-  ::backdrop,
-  ::file-selector-button {
-    border-color: var(--color-gray-200, currentcolor);
-  }
-}
-
-@layer base {
-  html {
-    color-scheme: light dark;
-  }
-
-  * {
-    @apply border-gray-200 dark:border-gray-800;
-  }
-
-  html,
-  body {
-    @apply bg-gray-50 text-gray-900 dark:bg-gray-950 dark:text-gray-200;
-  }
-}
+@import "tailwindcss" source("../");
+
+@theme inline {
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --color-card: var(--card);
+  --color-card-foreground: var(--card-foreground);
+  --color-primary: var(--primary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-secondary: var(--secondary);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-muted: var(--muted);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-accent: var(--accent);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-destructive: var(--destructive);
+  --color-border: var(--border);
+  --color-input: var(--input);
+  --color-ring: var(--ring);
+}
+
+:root {
+  --background: oklch(0.985 0 0);
+  --foreground: oklch(0.145 0 0);
+  --card: oklch(1 0 0);
+  --card-foreground: oklch(0.145 0 0);
+  --primary: oklch(0.205 0 0);
+  --primary-foreground: oklch(0.985 0 0);
+  --secondary: oklch(0.97 0 0);
+  --secondary-foreground: oklch(0.205 0 0);
+  --muted: oklch(0.97 0 0);
+  --muted-foreground: oklch(0.556 0 0);
+  --accent: oklch(0.97 0 0);
+  --accent-foreground: oklch(0.205 0 0);
+  --destructive: oklch(0.577 0.245 27.325);
+  --border: oklch(0.922 0 0);
+  --input: oklch(0.922 0 0);
+  --ring: oklch(0.708 0 0);
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --background: oklch(0.145 0 0);
+    --foreground: oklch(0.985 0 0);
+    --card: oklch(0.205 0 0);
+    --card-foreground: oklch(0.985 0 0);
+    --primary: oklch(0.922 0 0);
+    --primary-foreground: oklch(0.205 0 0);
+    --secondary: oklch(0.269 0 0);
+    --secondary-foreground: oklch(0.985 0 0);
+    --muted: oklch(0.269 0 0);
+    --muted-foreground: oklch(0.708 0 0);
+    --accent: oklch(0.269 0 0);
+    --accent-foreground: oklch(0.985 0 0);
+    --destructive: oklch(0.704 0.191 22.216);
+    --border: oklch(1 0 0 / 10%);
+    --input: oklch(1 0 0 / 15%);
+    --ring: oklch(0.556 0 0);
+  }
+}
+
+@layer base {
+  *,
+  ::after,
+  ::before,
+  ::backdrop,
+  ::file-selector-button {
+    border-color: var(--color-gray-200, currentcolor);
+  }
+}
+
+@layer base {
+  html {
+    color-scheme: light dark;
+  }
+
+  * {
+    @apply border-gray-200 dark:border-gray-800;
+  }
+
+  html,
+  body {
+    @apply bg-gray-50 text-gray-900 dark:bg-gray-950 dark:text-gray-200;
+  }
+}

package/templates/modules/auth/express/config.json

@@ -1,26 +1,27 @@
-{
-  "id": "auth",
-  "name": "JWT Auth",
-  "description": "JWT authentication with bcrypt password hashing",
-  "type": "feature",
-  "dependencies": {
-    "bcrypt": "^6.0.0",
-    "jsonwebtoken": "^9.0.3"
-  },
-  "devDependencies": {
-    "@types/bcrypt": "^6.0.0",
-    "@types/jsonwebtoken": "^9.0.10"
-  },
-  "scripts": {},
-  "envVars": {
-    "JWT_SECRET": "please-change-me",
-    "JWT_EXPIRES_IN": "1h"
-  },
-  "templateFiles": [
-    "src/lib/jwt.ts.hbs",
-    "src/middleware/requireAuth.ts.hbs",
-    "src/services/userStore.ts.hbs",
-    "src/routes/auth.ts.hbs",
-    "src/controllers/authController.ts.hbs"
-  ]
-}
+{
+  "id": "auth",
+  "name": "JWT Auth",
+  "description": "JWT authentication with bcrypt password hashing",
+  "type": "feature",
+  "dependencies": {
+    "bcrypt": "^6.0.0",
+    "jsonwebtoken": "^9.0.3",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@types/bcrypt": "^6.0.0",
+    "@types/jsonwebtoken": "^9.0.10"
+  },
+  "scripts": {},
+  "envVars": {
+    "JWT_SECRET": "please-change-me",
+    "JWT_EXPIRES_IN": "1h"
+  },
+  "templateFiles": [
+    "src/lib/jwt.ts.hbs",
+    "src/middleware/requireAuth.ts.hbs",
+    "src/services/userStore.ts.hbs",
+    "src/routes/auth.ts.hbs",
+    "src/controllers/authController.ts.hbs"
+  ]
+}

package/templates/modules/auth/express/src/controllers/authController.ts.hbs

@@ -1,130 +1,116 @@
-import { Request, Response } from "express";
-import bcrypt from "bcrypt";
-import { signToken } from "../lib/jwt";
-import { AuthenticatedRequest } from "../middleware/requireAuth";
-import {
-  createUser,
-  findUserByEmail,
-  isDuplicateEmailError,
-  toPublicUser,
-} from "../services/userStore";
-
-const SALT_ROUNDS = 10;
-const MIN_PASSWORD_LENGTH = 8;
-// bcrypt ignores bytes beyond 72, so longer passwords would be silently truncated
-const MAX_PASSWORD_BYTES = 72;
-
-// Request bodies are untrusted JSON, so fields may have any type
-interface RegisterBody {
-  email?: unknown;
-  password?: unknown;
-  name?: unknown;
-}
-
-interface LoginBody {
-  email?: unknown;
-  password?: unknown;
-}
-
-// Returns a trimmed, lowercased email, or null when the value is not a usable string
-function normalizeEmail(email: unknown): string | null {
-  if (typeof email !== "string") return null;
-  const normalized = email.trim().toLowerCase();
-  return normalized || null;
-}
-
-export async function register(
-  req: Request<object, unknown, RegisterBody | undefined>,
-  res: Response,
-): Promise<void> {
-  // Express 5 leaves req.body undefined when the request has no body
-  const body = req.body ?? {};
-  const email = normalizeEmail(body.email);
-  const password = body.password;
-  const name = body.name ?? null;
-
-  if (!email || typeof password !== "string" || !password) {
-    res.status(400).json({ error: "Email and password are required" });
-    return;
-  }
-
-  if (
-    password.length < MIN_PASSWORD_LENGTH ||
-    Buffer.byteLength(password, "utf8") > MAX_PASSWORD_BYTES
-  ) {
-    res.status(400).json({
-      error: `Password must be at least ${MIN_PASSWORD_LENGTH} characters and at most ${MAX_PASSWORD_BYTES} bytes`,
-    });
-    return;
-  }
-
-  if (name !== null && typeof name !== "string") {
-    res.status(400).json({ error: "Name must be a string" });
-    return;
-  }
-
-  const existingUser = await findUserByEmail(email);
-  if (existingUser) {
-    res.status(409).json({ error: "User already exists" });
-    return;
-  }
-
-  const hashedPassword = await bcrypt.hash(password, SALT_ROUNDS);
-
-  let user;
-  try {
-    user = await createUser({ email, name, password: hashedPassword });
-  } catch (error) {
-    // A concurrent request registered the same email after the check above
-    if (isDuplicateEmailError(error)) {
-      res.status(409).json({ error: "User already exists" });
-      return;
-    }
-    throw error;
-  }
-
-  const token = signToken({ sub: user.id, email: user.email, name: user.name });
-
-  res.status(201).json({ user: toPublicUser(user), token });
-}
-
-export async function login(
-  req: Request<object, unknown, LoginBody | undefined>,
-  res: Response,
-): Promise<void> {
-  const body = req.body ?? {};
-  const email = normalizeEmail(body.email);
-  const password = body.password;
-
-  if (!email || typeof password !== "string" || !password) {
-    res.status(400).json({ error: "Email and password are required" });
-    return;
-  }
-
-  const user = await findUserByEmail(email);
-
-  if (!user) {
-    res.status(401).json({ error: "Invalid credentials" });
-    return;
-  }
-
-  const isValidPassword = await bcrypt.compare(password, user.password);
-
-  if (!isValidPassword) {
-    res.status(401).json({ error: "Invalid credentials" });
-    return;
-  }
-
-  const token = signToken({ sub: user.id, email: user.email, name: user.name });
-
-  res.json({ user: toPublicUser(user), token });
-}
-
-export function me(req: AuthenticatedRequest, res: Response): void {
-  if (!req.user) {
-    res.status(401).json({ error: "Unauthorized" });
-    return;
-  }
-
-  res.json({ user: req.user });
-}
+import { Request, Response } from "express";
+import bcrypt from "bcrypt";
+import { z } from "zod";
+import { signToken } from "../lib/jwt";
+import { AuthenticatedRequest } from "../middleware/requireAuth";
+import {
+  createUser,
+  findUserByEmail,
+  isDuplicateEmailError,
+  toPublicUser,
+} from "../services/userStore";
+
+const SALT_ROUNDS = 10;
+const MIN_PASSWORD_LENGTH = 8;
+// bcrypt ignores bytes beyond 72, so longer passwords would be silently truncated
+const MAX_PASSWORD_BYTES = 72;
+
+// Emails are trimmed and lowercased so sign-in is case-insensitive
+const emailSchema = z
+  .string("Email and password are required")
+  .trim()
+  .toLowerCase()
+  .pipe(z.email("Email must be a valid email address"));
+
+const registerSchema = z.object({
+  email: emailSchema,
+  password: z
+    .string("Email and password are required")
+    .min(
+      MIN_PASSWORD_LENGTH,
+      `Password must be at least ${MIN_PASSWORD_LENGTH} characters`,
+    )
+    .refine(
+      (password) => Buffer.byteLength(password, "utf8") <= MAX_PASSWORD_BYTES,
+      `Password must be at most ${MAX_PASSWORD_BYTES} bytes`,
+    ),
+  name: z.string("Name must be a string").nullish(),
+});
+
+const loginSchema = z.object({
+  email: emailSchema,
+  password: z.string("Email and password are required").min(1),
+});
+
+// Sends a 400 with the first validation message and returns null when the body is invalid
+function parseBody<T>(schema: z.ZodType<T>, req: Request, res: Response): T | null {
+  // Express 5 leaves req.body undefined when the request has no body
+  const result = schema.safeParse(req.body ?? {});
+  if (result.success) return result.data;
+
+  res.status(400).json({ error: result.error.issues[0].message });
+  return null;
+}
+
+export async function register(req: Request, res: Response): Promise<void> {
+  const body = parseBody(registerSchema, req, res);
+  if (!body) return;
+  const { email, password, name = null } = body;
+
+  const existingUser = await findUserByEmail(email);
+  if (existingUser) {
+    res.status(409).json({ error: "User already exists" });
+    return;
+  }
+
+  const hashedPassword = await bcrypt.hash(password, SALT_ROUNDS);
+
+  let user;
+  try {
+    user = await createUser({ email, name, password: hashedPassword });
+  } catch (error) {
+    // A concurrent request registered the same email after the check above
+    if (isDuplicateEmailError(error)) {
+      res.status(409).json({ error: "User already exists" });
+      return;
+    }
+    throw error;
+  }
+
+  const token = signToken({ sub: user.id, email: user.email, name: user.name });
+
+  res.status(201).json({ user: toPublicUser(user), token });
+}
+
+export async function login(req: Request, res: Response): Promise<void> {
+  const body = parseBody(loginSchema, req, res);
+  if (!body) return;
+  const { email, password } = body;
+
+  const user = await findUserByEmail(email);
+
+  if (!user) {
+    res.status(401).json({ error: "Invalid credentials" });
+    return;
+  }
+
+  const isValidPassword = await bcrypt.compare(password, user.password);
+
+  if (!isValidPassword) {
+    res.status(401).json({ error: "Invalid credentials" });
+    return;
+  }
+
+  const token = signToken({ sub: user.id, email: user.email, name: user.name });
+
+  res.json({ user: toPublicUser(user), token });
+}
+
+export function me(req: AuthenticatedRequest, res: Response): void {
+  if (!req.user) {
+    res.status(401).json({ error: "Unauthorized" });
+    return;
+  }
+
+  res.json({ user: req.user });
+}

package/templates/modules/auth/express/src/middleware/requireAuth.ts.hbs

@@ -1,26 +1,26 @@
-import { NextFunction, Request, Response } from 'express';
-import { AuthTokenPayload, verifyToken } from '../lib/jwt';
-
-export interface AuthenticatedRequest extends Request {
-  user?: AuthTokenPayload;
-}
-
-export function requireAuth(req: AuthenticatedRequest, res: Response, next: NextFunction): void {
-  const authHeader = req.headers.authorization;
-
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    res.status(401).json({ error: 'Authorization header missing or invalid' });
-    return;
-  }
-
-  const token = authHeader.substring('Bearer '.length);
-
-  try {
-    const payload = verifyToken(token);
-    req.user = payload;
-    next();
-  } catch (error) {
-    console.error('JWT verification failed:', error);
-    res.status(401).json({ error: 'Invalid or expired token' });
-  }
-}
+import { NextFunction, Request, Response } from 'express';
+import { AuthTokenPayload, verifyToken } from '../lib/jwt';
+
+export interface AuthenticatedRequest extends Request {
+  user?: AuthTokenPayload;
+}
+
+export function requireAuth(req: AuthenticatedRequest, res: Response, next: NextFunction): void {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    res.status(401).json({ error: 'Authorization header missing or invalid' });
+    return;
+  }
+
+  const token = authHeader.substring('Bearer '.length);
+
+  try {
+    const payload = verifyToken(token);
+    req.user = payload;
+    next();
+  } catch (error) {
+    console.error('JWT verification failed:', error);
+    res.status(401).json({ error: 'Invalid or expired token' });
+  }
+}