better-ts-stack 2.1.2 → 2.2.0

package/templates/modules/auth/tanstack/src/routes/reset-password.tsx

@@ -0,0 +1,25 @@
+import { createFileRoute } from "@tanstack/react-router";
+
+import { ResetPasswordForm } from "~/components/auth/reset-password-form";
+
+// The link in the reset email lands here with ?token=..., or with ?error=...
+// when the token is invalid or has expired
+export const Route = createFileRoute("/reset-password")({
+  validateSearch: (search: Record<string, unknown>) => ({
+    token: typeof search.token === "string" ? search.token : undefined,
+    error: typeof search.error === "string" ? search.error : undefined,
+  }),
+  component: ResetPasswordPage,
+});
+
+function ResetPasswordPage() {
+  const { token, error } = Route.useSearch();
+
+  return (
+    <main className="flex min-h-svh items-center justify-center bg-muted p-6 md:p-10">
+      <div className="w-full max-w-md">
+        <ResetPasswordForm token={error ? null : (token ?? null)} />
+      </div>
+    </main>
+  );
+}

package/templates/modules/auth/tanstack/src/routes/sign-in.tsx

@@ -1,37 +1,44 @@
 import { createFileRoute, redirect } from "@tanstack/react-router";
 
 import { SignInForm } from "~/components/auth/sign-in-form";
-import { getSession } from "~/lib/auth-functions";
+import { Badge } from "~/components/ui/badge";
+import { getSession, getSocialProviders } from "~/lib/auth-functions";
 
 export const Route = createFileRoute("/sign-in")({
   beforeLoad: async () => {
-    const session = await getSession();
+    // Two independent server calls, made at the same time
+    const [session, providers] = await Promise.all([
+      getSession(),
+      getSocialProviders(),
+    ]);
 
     if (session) {
       throw redirect({ to: "/dashboard" });
     }
+
+    return { providers };
   },
   component: SignInPage,
 });
 
 function SignInPage() {
   return (
-    <main className="min-h-screen bg-[radial-gradient(circle_at_top,_rgba(14,165,233,0.16),_transparent_30%),linear-gradient(180deg,_#f8fafc_0%,_#eef2ff_100%)] px-6 py-16 sm:px-10">
-      <div className="mx-auto flex min-h-[calc(100vh-8rem)] max-w-5xl items-center gap-12 lg:grid lg:grid-cols-[0.9fr_1.1fr]">
-        <section className="hidden space-y-5 lg:block">
-          <span className="inline-flex rounded-full border border-sky-200 bg-white/80 px-3 py-1 text-xs font-medium uppercase tracking-[0.24em] text-sky-700">
-            Better Auth
-          </span>
-          <h1 className="text-4xl font-semibold tracking-tight text-slate-950">
+    <main className="flex min-h-svh items-center justify-center bg-muted p-6 md:p-10">
+      <div className="grid w-full max-w-5xl items-center gap-12 lg:grid-cols-[0.9fr_1.1fr]">
+        <section className="hidden flex-col gap-5 lg:flex">
+          <Badge variant="outline">Better Auth</Badge>
+          <h1 className="text-4xl font-semibold tracking-tight">
             Welcome back.
           </h1>
-          <p className="max-w-md text-base leading-7 text-slate-600">
+          <p className="max-w-md text-base leading-7 text-muted-foreground">
             This generated starter includes protected routes, session-aware page
             guards, and reusable auth form primitives you can extend from here.
           </p>
         </section>
-        <SignInForm />
+        <SignInForm
+          providers={Route.useRouteContext({ select: (ctx) => ctx.providers })}
+        />
       </div>
     </main>
   );
-}
+}

package/templates/modules/auth/tanstack/src/routes/sign-up.tsx

@@ -1,37 +1,44 @@
 import { createFileRoute, redirect } from "@tanstack/react-router";
 
 import { SignUpForm } from "~/components/auth/sign-up-form";
-import { getSession } from "~/lib/auth-functions";
+import { Badge } from "~/components/ui/badge";
+import { getSession, getSocialProviders } from "~/lib/auth-functions";
 
 export const Route = createFileRoute("/sign-up")({
   beforeLoad: async () => {
-    const session = await getSession();
+    // Two independent server calls, made at the same time
+    const [session, providers] = await Promise.all([
+      getSession(),
+      getSocialProviders(),
+    ]);
 
     if (session) {
       throw redirect({ to: "/dashboard" });
     }
+
+    return { providers };
   },
   component: SignUpPage,
 });
 
 function SignUpPage() {
   return (
-    <main className="min-h-screen bg-[radial-gradient(circle_at_top,_rgba(56,189,248,0.18),_transparent_28%),linear-gradient(180deg,_#f8fafc_0%,_#ecfeff_100%)] px-6 py-16 sm:px-10">
-      <div className="mx-auto flex min-h-[calc(100vh-8rem)] max-w-5xl items-center gap-12 lg:grid lg:grid-cols-[0.9fr_1.1fr]">
-        <section className="hidden space-y-5 lg:block">
-          <span className="inline-flex rounded-full border border-sky-200 bg-white/80 px-3 py-1 text-xs font-medium uppercase tracking-[0.24em] text-sky-700">
-            Better Auth
-          </span>
-          <h1 className="text-4xl font-semibold tracking-tight text-slate-950">
+    <main className="flex min-h-svh items-center justify-center bg-muted p-6 md:p-10">
+      <div className="grid w-full max-w-5xl items-center gap-12 lg:grid-cols-[0.9fr_1.1fr]">
+        <section className="hidden flex-col gap-5 lg:flex">
+          <Badge variant="outline">Better Auth</Badge>
+          <h1 className="text-4xl font-semibold tracking-tight">
             Create your account.
           </h1>
-          <p className="max-w-md text-base leading-7 text-slate-600">
-            Start with email and password today, then layer in profile data,
-            onboarding, and provider-based auth when your product needs it.
+          <p className="max-w-md text-base leading-7 text-muted-foreground">
+            Sign up with email and password, or with GitHub or Google once
+            their keys are set. A verification link goes to your inbox.
           </p>
         </section>
-        <SignUpForm />
+        <SignUpForm
+          providers={Route.useRouteContext({ select: (ctx) => ctx.providers })}
+        />
       </div>
     </main>
   );
-}
+}

package/templates/modules/drizzle/express/src/lib/schema.ts.hbs

@@ -0,0 +1,90 @@
+{{#if useAuth}}
+import { boolean, pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
+
+export const user = pgTable("user", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  emailVerified: boolean("email_verified").notNull().default(false),
+  image: text("image"),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+});
+
+export const session = pgTable("session", {
+  id: text("id").primaryKey(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  token: text("token").notNull().unique(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+  ipAddress: text("ip_address"),
+  userAgent: text("user_agent"),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+});
+
+export const account = pgTable("account", {
+  id: text("id").primaryKey(),
+  accountId: text("account_id").notNull(),
+  providerId: text("provider_id").notNull(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  accessToken: text("access_token"),
+  refreshToken: text("refresh_token"),
+  idToken: text("id_token"),
+  accessTokenExpiresAt: timestamp("access_token_expires_at", {
+    withTimezone: true,
+  }),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
+    withTimezone: true,
+  }),
+  scope: text("scope"),
+  password: text("password"),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+}, (table) => [uniqueIndex("account_provider_account_id_unique").on(table.providerId, table.accountId)]);
+
+export const verification = pgTable("verification", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+});
+{{else}}
+import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+
+export const users = pgTable("users", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  email: text("email").notNull().unique(),
+  name: text("name"),
+  password: text("password").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+});
+{{/if}}

package/templates/modules/drizzle/nestjs/src/database/schema.ts.hbs

@@ -0,0 +1,90 @@
+{{#if useAuth}}
+import { boolean, pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core";
+
+export const user = pgTable("user", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  emailVerified: boolean("email_verified").notNull().default(false),
+  image: text("image"),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+});
+
+export const session = pgTable("session", {
+  id: text("id").primaryKey(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  token: text("token").notNull().unique(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+  ipAddress: text("ip_address"),
+  userAgent: text("user_agent"),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+});
+
+export const account = pgTable("account", {
+  id: text("id").primaryKey(),
+  accountId: text("account_id").notNull(),
+  providerId: text("provider_id").notNull(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  accessToken: text("access_token"),
+  refreshToken: text("refresh_token"),
+  idToken: text("id_token"),
+  accessTokenExpiresAt: timestamp("access_token_expires_at", {
+    withTimezone: true,
+  }),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at", {
+    withTimezone: true,
+  }),
+  scope: text("scope"),
+  password: text("password"),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+}, (table) => [uniqueIndex("account_provider_account_id_unique").on(table.providerId, table.accountId)]);
+
+export const verification = pgTable("verification", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .notNull()
+    .defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+});
+{{else}}
+import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+
+export const users = pgTable("users", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  email: text("email").notNull().unique(),
+  name: text("name"),
+  password: text("password").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+});
+{{/if}}

package/templates/modules/mongoose/nestjs/config.json

@@ -5,7 +5,8 @@
   "type": "database",
   "dependencies": {
     "@nestjs/mongoose": "^12.0.0",
-    "mongoose": "^9.11.4"
+    "mongoose": "^9.11.4",
+    "mongodb": "^7.8.0"
   },
   "devDependencies": {},
   "scripts": {},

package/templates/modules/prisma/express/prisma/schema.prisma.hbs

@@ -0,0 +1,92 @@
+// Prisma schema file
+// Learn more: https://pris.ly/d/prisma-schema
+
+generator client {
+  provider = "prisma-client"
+  moduleFormat = "cjs"
+  output   = "../src/generated/prisma"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+{{#if useAuth}}
+// Better Auth tables
+model User {
+  id            String    @id
+  name          String
+  email         String
+  emailVerified Boolean   @default(false)
+  image         String?
+  createdAt     DateTime  @default(now())
+  updatedAt     DateTime  @updatedAt
+  sessions      Session[]
+  accounts      Account[]
+
+  @@unique([email])
+  @@map("user")
+}
+
+model Session {
+  id        String   @id
+  expiresAt DateTime
+  token     String
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  ipAddress String?
+  userAgent String?
+  userId    String
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([token])
+  @@index([userId])
+  @@map("session")
+}
+
+model Account {
+  id                    String    @id
+  accountId             String
+  providerId            String
+  userId                String
+  user                  User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  accessToken           String?
+  refreshToken          String?
+  idToken               String?
+  accessTokenExpiresAt  DateTime?
+  refreshTokenExpiresAt DateTime?
+  scope                 String?
+  password              String?
+  createdAt             DateTime  @default(now())
+  updatedAt             DateTime  @updatedAt
+
+  @@index([userId])
+  @@unique([providerId, accountId])
+  @@map("account")
+}
+
+model Verification {
+  id         String   @id
+  identifier String
+  value      String
+  expiresAt  DateTime
+  createdAt  DateTime @default(now())
+  updatedAt  DateTime @updatedAt
+
+  @@index([identifier])
+  @@map("verification")
+}
+
+{{else}}
+// Sample User model
+model User {
+  id        String   @id @default(uuid())
+  email     String   @unique
+  name      String?
+  password  String
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@map("users")
+}
+{{/if}}

package/templates/modules/prisma/nestjs/prisma/schema.prisma.hbs

@@ -0,0 +1,91 @@
+// Prisma schema file
+// Learn more: https://pris.ly/d/prisma-schema
+
+generator client {
+  provider = "prisma-client"
+  output   = "../src/generated/prisma"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+{{#if useAuth}}
+// Better Auth tables
+model User {
+  id            String    @id
+  name          String
+  email         String
+  emailVerified Boolean   @default(false)
+  image         String?
+  createdAt     DateTime  @default(now())
+  updatedAt     DateTime  @updatedAt
+  sessions      Session[]
+  accounts      Account[]
+
+  @@unique([email])
+  @@map("user")
+}
+
+model Session {
+  id        String   @id
+  expiresAt DateTime
+  token     String
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  ipAddress String?
+  userAgent String?
+  userId    String
+  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+
+  @@unique([token])
+  @@index([userId])
+  @@map("session")
+}
+
+model Account {
+  id                    String    @id
+  accountId             String
+  providerId            String
+  userId                String
+  user                  User      @relation(fields: [userId], references: [id], onDelete: Cascade)
+  accessToken           String?
+  refreshToken          String?
+  idToken               String?
+  accessTokenExpiresAt  DateTime?
+  refreshTokenExpiresAt DateTime?
+  scope                 String?
+  password              String?
+  createdAt             DateTime  @default(now())
+  updatedAt             DateTime  @updatedAt
+
+  @@index([userId])
+  @@unique([providerId, accountId])
+  @@map("account")
+}
+
+model Verification {
+  id         String   @id
+  identifier String
+  value      String
+  expiresAt  DateTime
+  createdAt  DateTime @default(now())
+  updatedAt  DateTime @updatedAt
+
+  @@index([identifier])
+  @@map("verification")
+}
+
+{{else}}
+// Sample User model
+model User {
+  id        String   @id @default(uuid())
+  email     String   @unique
+  name      String?
+  password  String
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@map("users")
+}
+{{/if}}

package/templates/modules/rate-limit/express/src/middleware/rateLimit.ts

@@ -13,11 +13,3 @@ export const apiLimiter = rateLimit({
   legacyHeaders: false,
   skip: (req) => req.path === "/health",
 });
-
-// Sign-up and login: 10 attempts per IP in 15 minutes, against password guessing
-export const authLimiter = rateLimit({
-  windowMs: FIFTEEN_MINUTES,
-  limit: 10,
-  standardHeaders: "draft-8",
-  legacyHeaders: false,
-});

package/templates/modules/auth/express/src/controllers/authController.ts.hbs

@@ -1,116 +0,0 @@
-import { Request, Response } from "express";
-import bcrypt from "bcrypt";
-import { z } from "zod";
-import { signToken } from "../lib/jwt";
-import { AuthenticatedRequest } from "../middleware/requireAuth";
-import {
-  createUser,
-  findUserByEmail,
-  isDuplicateEmailError,
-  toPublicUser,
-} from "../services/userStore";
-
-const SALT_ROUNDS = 10;
-const MIN_PASSWORD_LENGTH = 8;
-// bcrypt ignores bytes beyond 72, so longer passwords would be silently truncated
-const MAX_PASSWORD_BYTES = 72;
-
-// Emails are trimmed and lowercased so sign-in is case-insensitive
-const emailSchema = z
-  .string("Email and password are required")
-  .trim()
-  .toLowerCase()
-  .pipe(z.email("Email must be a valid email address"));
-
-const registerSchema = z.object({
-  email: emailSchema,
-  password: z
-    .string("Email and password are required")
-    .min(
-      MIN_PASSWORD_LENGTH,
-      `Password must be at least ${MIN_PASSWORD_LENGTH} characters`,
-    )
-    .refine(
-      (password) => Buffer.byteLength(password, "utf8") <= MAX_PASSWORD_BYTES,
-      `Password must be at most ${MAX_PASSWORD_BYTES} bytes`,
-    ),
-  name: z.string("Name must be a string").nullish(),
-});
-
-const loginSchema = z.object({
-  email: emailSchema,
-  password: z.string("Email and password are required").min(1),
-});
-
-// Sends a 400 with the first validation message and returns null when the body is invalid
-function parseBody<T>(schema: z.ZodType<T>, req: Request, res: Response): T | null {
-  // Express 5 leaves req.body undefined when the request has no body
-  const result = schema.safeParse(req.body ?? {});
-  if (result.success) return result.data;
-
-  res.status(400).json({ error: result.error.issues[0].message });
-  return null;
-}
-
-export async function register(req: Request, res: Response): Promise<void> {
-  const body = parseBody(registerSchema, req, res);
-  if (!body) return;
-  const { email, password, name = null } = body;
-
-  const existingUser = await findUserByEmail(email);
-  if (existingUser) {
-    res.status(409).json({ error: "User already exists" });
-    return;
-  }
-
-  const hashedPassword = await bcrypt.hash(password, SALT_ROUNDS);
-
-  let user;
-  try {
-    user = await createUser({ email, name, password: hashedPassword });
-  } catch (error) {
-    // A concurrent request registered the same email after the check above
-    if (isDuplicateEmailError(error)) {
-      res.status(409).json({ error: "User already exists" });
-      return;
-    }
-    throw error;
-  }
-
-  const token = signToken({ sub: user.id, email: user.email, name: user.name });
-
-  res.status(201).json({ user: toPublicUser(user), token });
-}
-
-export async function login(req: Request, res: Response): Promise<void> {
-  const body = parseBody(loginSchema, req, res);
-  if (!body) return;
-  const { email, password } = body;
-
-  const user = await findUserByEmail(email);
-
-  if (!user) {
-    res.status(401).json({ error: "Invalid credentials" });
-    return;
-  }
-
-  const isValidPassword = await bcrypt.compare(password, user.password);
-
-  if (!isValidPassword) {
-    res.status(401).json({ error: "Invalid credentials" });
-    return;
-  }
-
-  const token = signToken({ sub: user.id, email: user.email, name: user.name });
-
-  res.json({ user: toPublicUser(user), token });
-}
-
-export function me(req: AuthenticatedRequest, res: Response): void {
-  if (!req.user) {
-    res.status(401).json({ error: "Unauthorized" });
-    return;
-  }
-
-  res.json({ user: req.user });
-}

package/templates/modules/auth/express/src/lib/jwt.ts.hbs

@@ -1,27 +0,0 @@
-import jwt, { type SignOptions } from "jsonwebtoken";
-
-export interface AuthTokenPayload {
-  sub: string;
-  email: string;
-  name?: string | null;
-}
-
-const { JWT_SECRET, JWT_EXPIRES_IN } = process.env;
-
-function ensureSecret(): string {
-  if (!JWT_SECRET) {
-    throw new Error("JWT_SECRET is not set");
-  }
-  return JWT_SECRET;
-}
-
-export function signToken(payload: AuthTokenPayload): string {
-  const secret = ensureSecret();
-  const expiresIn = JWT_EXPIRES_IN || "1h";
-  return jwt.sign(payload, secret, { expiresIn } as SignOptions);
-}
-
-export function verifyToken(token: string): AuthTokenPayload {
-  const secret = ensureSecret();
-  return jwt.verify(token, secret) as AuthTokenPayload;
-}