better-ts-stack 2.1.2 → 2.2.0

package/templates/modules/auth/express/src/middleware/requireAuth.ts.hbs

@@ -1,25 +0,0 @@
-import { NextFunction, Request, Response } from 'express';
-import { AuthTokenPayload, verifyToken } from '../lib/jwt';
-
-export interface AuthenticatedRequest extends Request {
-  user?: AuthTokenPayload;
-}
-
-export function requireAuth(req: AuthenticatedRequest, res: Response, next: NextFunction): void {
-  const authHeader = req.headers.authorization;
-
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    res.status(401).json({ error: 'Authorization header missing or invalid' });
-    return;
-  }
-
-  const token = authHeader.substring('Bearer '.length);
-
-  try {
-    const payload = verifyToken(token);
-    req.user = payload;
-    next();
-  } catch {
-    res.status(401).json({ error: 'Invalid or expired token' });
-  }
-}

package/templates/modules/auth/express/src/routes/auth.ts.hbs

@@ -1,27 +0,0 @@
-import { Request, Response, NextFunction, Router } from 'express';
-import { login, me, register } from '../controllers/authController';
-{{#if useRateLimit}}
-import { authLimiter } from '../middleware/rateLimit';
-{{/if}}
-import { requireAuth } from '../middleware/requireAuth';
-
-const router: Router = Router();
-
-function asyncHandler(
-  fn: (req: Request, res: Response, next: NextFunction) => Promise<void>
-): (req: Request, res: Response, next: NextFunction) => void {
-  return (req, res, next) => {
-    void fn(req, res, next).catch(next);
-  };
-}
-
-{{#if useRateLimit}}
-router.post('/register', authLimiter, asyncHandler(register));
-router.post('/login', authLimiter, asyncHandler(login));
-{{else}}
-router.post('/register', asyncHandler(register));
-router.post('/login', asyncHandler(login));
-{{/if}}
-router.get('/me', requireAuth, me);
-
-export default router;

package/templates/modules/auth/express/src/services/userStore.ts.hbs

@@ -1,117 +0,0 @@
-{{#if (eq database 'drizzle')}}
-import { eq } from "drizzle-orm";
-import { db } from "../lib/db";
-import { users } from "../lib/schema";
-{{/if}}
-{{#if (eq database 'none')}}
-import crypto from 'crypto';
-{{/if}}
-{{#if (eq database 'prisma')}}
-import { prisma } from '../lib/prisma';
-{{/if}}
-{{#if (eq database 'mongoose')}}
-import UserModel from '../models/User';
-{{/if}}
-
-export interface AuthUser {
-  id: string;
-  email: string;
-  name?: string | null;
-  password: string;
-}
-
-export interface CreateUserInput {
-  email: string;
-  name?: string | null;
-  password: string;
-}
-
-{{#if (eq database 'none')}}
-const users: AuthUser[] = [];
-{{/if}}
-
-export {{#unless (eq database 'none')}}async {{/unless}}function findUserByEmail(email: string): Promise<AuthUser | null> {
-  {{#if (eq database 'drizzle')}}
-  const [user] = await db.select().from(users).where(eq(users.email, email)).limit(1);
-  return user ?? null;
-  {{/if}}
-  {{#if (eq database 'prisma')}}
-  return await prisma.user.findUnique({ where: { email } });
-  {{/if}}
-
-  {{#if (eq database 'mongoose')}}
-  const user = await UserModel.findOne({ email }).exec();
-  if (!user) return null;
-  return {
-    id: String(user._id),
-    email: user.email,
-    name: user.name,
-    password: user.password,
-  };
-  {{/if}}
-
-  {{#if (eq database 'none')}}
-  const user = users.find((candidate) => candidate.email === email);
-  return Promise.resolve(user ?? null);
-  {{/if}}
-}
-
-export {{#unless (eq database 'none')}}async {{/unless}}function createUser(data: CreateUserInput): Promise<AuthUser> {
-  {{#if (eq database 'drizzle')}}
-  const [user] = await db.insert(users).values(data).returning();
-  return user;
-  {{/if}}
-  {{#if (eq database 'prisma')}}
-  return await prisma.user.create({ data });
-  {{/if}}
-
-  {{#if (eq database 'mongoose')}}
-  const user = await UserModel.create(data);
-
-  return {
-    id: String(user._id),
-    email: user.email,
-    name: user.name,
-    password: user.password,
-  };
-  {{/if}}
-
-  {{#if (eq database 'none')}}
-  // Enforce unique emails like a database constraint would, so a sign-up that
-  // raced past the findUserByEmail check is rejected instead of duplicated
-  if (users.some((candidate) => candidate.email === data.email)) {
-    return Promise.reject(
-      Object.assign(new Error('User already exists'), { code: 'DUPLICATE_EMAIL' }),
-    );
-  }
-
-  const newUser: AuthUser = {
-    id: crypto.randomUUID(),
-    email: data.email,
-    name: data.name,
-    password: data.password,
-  };
-
-  users.push(newUser);
-  return Promise.resolve(newUser);
-  {{/if}}
-}
-
-// Unique-constraint error codes: Prisma, PostgreSQL (Drizzle wraps it in `cause`),
-// MongoDB, and the in-memory store
-const DUPLICATE_KEY_CODES = new Set<unknown>(['P2002', '23505', 11000, 'DUPLICATE_EMAIL']);
-
-// True when an insert failed because the email is already taken (e.g. concurrent sign-ups)
-export function isDuplicateEmailError(error: unknown): boolean {
-  let current = error;
-  for (let depth = 0; depth < 5 && current && typeof current === 'object'; depth++) {
-    if (DUPLICATE_KEY_CODES.has((current as { code?: unknown }).code)) return true;
-    current = (current as { cause?: unknown }).cause;
-  }
-  return false;
-}
-
-export function toPublicUser(user: AuthUser): Omit<AuthUser, 'password'> {
-  const { id, email, name } = user;
-  return { id, email, name };
-}

package/templates/modules/auth/nestjs/src/auth/auth.controller.ts.hbs

@@ -1,61 +0,0 @@
-import {
-  Body,
-  Controller,
-  Get,
-  HttpCode,
-  Post,
-  Req,
-  UseGuards,
-} from "@nestjs/common";
-{{#if useRateLimit}}
-import { Throttle } from "@nestjs/throttler";
-{{/if}}
-
-import { type AuthenticatedRequest, AuthGuard } from "./auth.guard.js";
-import {
-  type LoginInput,
-  loginSchema,
-  type RegisterInput,
-  registerSchema,
-} from "./auth.schemas.js";
-import { type AuthResponse, AuthService } from "./auth.service.js";
-import type { AuthTokenPayload } from "./jwt.js";
-import { ZodValidationPipe } from "./zod-validation.pipe.js";
-
-{{#if useRateLimit}}
-// Sign-up and login: 10 attempts per client IP in 15 minutes, against
-// password guessing
-const AUTH_LIMIT = { default: { ttl: 15 * 60 * 1000, limit: 10 } };
-
-{{/if}}
-@Controller("auth")
-export class AuthController {
-  constructor(private readonly authService: AuthService) {}
-
-  @Post("register")
-  {{#if useRateLimit}}
-  @Throttle(AUTH_LIMIT)
-  {{/if}}
-  register(
-    @Body(new ZodValidationPipe(registerSchema)) body: RegisterInput
-  ): Promise<AuthResponse> {
-    return this.authService.register(body);
-  }
-
-  @Post("login")
-  @HttpCode(200)
-  {{#if useRateLimit}}
-  @Throttle(AUTH_LIMIT)
-  {{/if}}
-  login(
-    @Body(new ZodValidationPipe(loginSchema)) body: LoginInput
-  ): Promise<AuthResponse> {
-    return this.authService.login(body);
-  }
-
-  @Get("me")
-  @UseGuards(AuthGuard)
-  me(@Req() request: AuthenticatedRequest): { user?: AuthTokenPayload } {
-    return { user: request.user };
-  }
-}

package/templates/modules/auth/nestjs/src/auth/auth.guard.ts

@@ -1,36 +0,0 @@
-import {
-  type CanActivate,
-  type ExecutionContext,
-  Injectable,
-  UnauthorizedException,
-} from "@nestjs/common";
-import type { Request } from "express";
-
-import { type AuthTokenPayload, verifyToken } from "./jwt.js";
-
-export interface AuthenticatedRequest extends Request {
-  user?: AuthTokenPayload;
-}
-
-// Requires a valid "Authorization: Bearer <token>" header and sets request.user
-@Injectable()
-export class AuthGuard implements CanActivate {
-  canActivate(context: ExecutionContext): boolean {
-    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
-    const authHeader = request.headers.authorization;
-
-    if (!authHeader?.startsWith("Bearer ")) {
-      throw new UnauthorizedException(
-        "Authorization header missing or invalid"
-      );
-    }
-
-    try {
-      request.user = verifyToken(authHeader.substring("Bearer ".length));
-    } catch {
-      throw new UnauthorizedException("Invalid or expired token");
-    }
-
-    return true;
-  }
-}

package/templates/modules/auth/nestjs/src/auth/auth.schemas.ts

@@ -1,35 +0,0 @@
-import { z } from "zod";
-
-const MIN_PASSWORD_LENGTH = 8;
-// bcrypt ignores bytes beyond 72, so longer passwords would be silently truncated
-const MAX_PASSWORD_BYTES = 72;
-
-// Emails are trimmed and lowercased so sign-in is case-insensitive
-const emailSchema = z
-  .string("Email and password are required")
-  .trim()
-  .toLowerCase()
-  .pipe(z.email("Email must be a valid email address"));
-
-export const registerSchema = z.object({
-  email: emailSchema,
-  password: z
-    .string("Email and password are required")
-    .min(
-      MIN_PASSWORD_LENGTH,
-      `Password must be at least ${MIN_PASSWORD_LENGTH} characters`
-    )
-    .refine(
-      (password) => Buffer.byteLength(password, "utf8") <= MAX_PASSWORD_BYTES,
-      `Password must be at most ${MAX_PASSWORD_BYTES} bytes`
-    ),
-  name: z.string("Name must be a string").nullish(),
-});
-
-export const loginSchema = z.object({
-  email: emailSchema,
-  password: z.string("Email and password are required").min(1),
-});
-
-export type RegisterInput = z.infer<typeof registerSchema>;
-export type LoginInput = z.infer<typeof loginSchema>;

package/templates/modules/auth/nestjs/src/auth/auth.service.ts

@@ -1,70 +0,0 @@
-import {
-  ConflictException,
-  Injectable,
-  UnauthorizedException,
-} from "@nestjs/common";
-import bcrypt from "bcrypt";
-
-import type { LoginInput, RegisterInput } from "./auth.schemas.js";
-import { signToken } from "./jwt.js";
-import {
-  type AuthUser,
-  isDuplicateEmailError,
-  UsersService,
-} from "./users.service.js";
-
-const SALT_ROUNDS = 10;
-
-export interface AuthResponse {
-  user: Omit<AuthUser, "password">;
-  token: string;
-}
-
-@Injectable()
-export class AuthService {
-  constructor(private readonly usersService: UsersService) {}
-
-  async register({
-    email,
-    password,
-    name = null,
-  }: RegisterInput): Promise<AuthResponse> {
-    if (await this.usersService.findByEmail(email)) {
-      throw new ConflictException("User already exists");
-    }
-
-    const hashedPassword = await bcrypt.hash(password, SALT_ROUNDS);
-
-    try {
-      const user = await this.usersService.create({
-        email,
-        name,
-        password: hashedPassword,
-      });
-      return this.toAuthResponse(user);
-    } catch (error) {
-      // A concurrent request registered the same email after the check above
-      if (isDuplicateEmailError(error)) {
-        throw new ConflictException("User already exists");
-      }
-      throw error;
-    }
-  }
-
-  async login({ email, password }: LoginInput): Promise<AuthResponse> {
-    const user = await this.usersService.findByEmail(email);
-
-    if (!user || !(await bcrypt.compare(password, user.password))) {
-      throw new UnauthorizedException("Invalid credentials");
-    }
-
-    return this.toAuthResponse(user);
-  }
-
-  private toAuthResponse({ id, email, name }: AuthUser): AuthResponse {
-    return {
-      user: { id, email, name },
-      token: signToken({ sub: id, email, name }),
-    };
-  }
-}

package/templates/modules/auth/nestjs/src/auth/jwt.ts

@@ -1,27 +0,0 @@
-import jwt, { type SignOptions } from "jsonwebtoken";
-
-export interface AuthTokenPayload {
-  sub: string;
-  email: string;
-  name?: string | null;
-}
-
-const { JWT_SECRET, JWT_EXPIRES_IN } = process.env;
-
-function ensureSecret(): string {
-  if (!JWT_SECRET) {
-    throw new Error("JWT_SECRET is not set");
-  }
-  return JWT_SECRET;
-}
-
-export function signToken(payload: AuthTokenPayload): string {
-  const secret = ensureSecret();
-  const expiresIn = JWT_EXPIRES_IN || "1h";
-  return jwt.sign(payload, secret, { expiresIn } as SignOptions);
-}
-
-export function verifyToken(token: string): AuthTokenPayload {
-  const secret = ensureSecret();
-  return jwt.verify(token, secret) as AuthTokenPayload;
-}

package/templates/modules/auth/nestjs/src/auth/users.service.ts.hbs

@@ -1,144 +0,0 @@
-{{#if (eq database 'drizzle')}}
-import { Inject, Injectable } from "@nestjs/common";
-import { eq } from "drizzle-orm";
-
-import { type Database, DRIZZLE } from "../database/database.module.js";
-import { users } from "../database/schema.js";
-{{/if}}
-{{#if (eq database 'prisma')}}
-import { Injectable } from "@nestjs/common";
-
-import { PrismaService } from "../prisma/prisma.service.js";
-{{/if}}
-{{#if (eq database 'mongoose')}}
-import { Injectable } from "@nestjs/common";
-import { InjectModel } from "@nestjs/mongoose";
-import type { Model } from "mongoose";
-
-import { User } from "../users/user.schema.js";
-{{/if}}
-{{#if (eq database 'none')}}
-import { Injectable } from "@nestjs/common";
-import { randomUUID } from "node:crypto";
-{{/if}}
-
-export interface AuthUser {
-  id: string;
-  email: string;
-  name?: string | null;
-  password: string;
-}
-
-export interface CreateUserInput {
-  email: string;
-  name?: string | null;
-  password: string;
-}
-
-@Injectable()
-export class UsersService {
-  {{#if (eq database 'drizzle')}}
-  constructor(@Inject(DRIZZLE) private readonly db: Database) {}
-
-  async findByEmail(email: string): Promise<AuthUser | null> {
-    const [user] = await this.db
-      .select()
-      .from(users)
-      .where(eq(users.email, email))
-      .limit(1);
-    return user ?? null;
-  }
-
-  async create(data: CreateUserInput): Promise<AuthUser> {
-    const [user] = await this.db.insert(users).values(data).returning();
-    return user;
-  }
-  {{/if}}
-  {{#if (eq database 'prisma')}}
-  constructor(private readonly prisma: PrismaService) {}
-
-  findByEmail(email: string): Promise<AuthUser | null> {
-    return this.prisma.user.findUnique({ where: { email } });
-  }
-
-  create(data: CreateUserInput): Promise<AuthUser> {
-    return this.prisma.user.create({ data });
-  }
-  {{/if}}
-  {{#if (eq database 'mongoose')}}
-  constructor(
-    @InjectModel(User.name) private readonly userModel: Model<User>
-  ) {}
-
-  async findByEmail(email: string): Promise<AuthUser | null> {
-    const user = await this.userModel.findOne({ email }).exec();
-    if (!user) return null;
-    return {
-      id: user._id.toString(),
-      email: user.email,
-      name: user.name,
-      password: user.password,
-    };
-  }
-
-  async create(data: CreateUserInput): Promise<AuthUser> {
-    const user = await this.userModel.create(data);
-    return {
-      id: user._id.toString(),
-      email: user.email,
-      name: user.name,
-      password: user.password,
-    };
-  }
-  {{/if}}
-  {{#if (eq database 'none')}}
-  // In-memory store for trying the API out: users are lost on restart, so add
-  // a database before going to production
-  private readonly users: AuthUser[] = [];
-
-  findByEmail(email: string): Promise<AuthUser | null> {
-    const user = this.users.find((candidate) => candidate.email === email);
-    return Promise.resolve(user ?? null);
-  }
-
-  create(data: CreateUserInput): Promise<AuthUser> {
-    // Enforce unique emails like a database constraint would, so a sign-up that
-    // raced past the findByEmail check is rejected instead of duplicated
-    if (this.users.some((candidate) => candidate.email === data.email)) {
-      return Promise.reject(
-        Object.assign(new Error("User already exists"), {
-          code: "DUPLICATE_EMAIL",
-        })
-      );
-    }
-
-    const user: AuthUser = { id: randomUUID(), ...data };
-    this.users.push(user);
-    return Promise.resolve(user);
-  }
-  {{/if}}
-}
-
-// Unique-constraint error codes: Prisma, PostgreSQL (Drizzle wraps it in `cause`),
-// MongoDB, and the in-memory store
-const DUPLICATE_KEY_CODES = new Set<unknown>([
-  "P2002",
-  "23505",
-  11000,
-  "DUPLICATE_EMAIL",
-]);
-
-// True when an insert failed because the email is already taken (e.g. concurrent sign-ups)
-export function isDuplicateEmailError(error: unknown): boolean {
-  let current = error;
-  for (
-    let depth = 0;
-    depth < 5 && current && typeof current === "object";
-    depth++
-  ) {
-    if (DUPLICATE_KEY_CODES.has((current as { code?: unknown }).code))
-      return true;
-    current = (current as { cause?: unknown }).cause;
-  }
-  return false;
-}

package/templates/modules/auth/nestjs/src/auth/zod-validation.pipe.ts

@@ -1,16 +0,0 @@
-import { BadRequestException, type PipeTransform } from "@nestjs/common";
-import type { ZodType } from "zod";
-
-// Validates a request body against a Zod schema and returns the parsed value
-export class ZodValidationPipe<T> implements PipeTransform<unknown, T> {
-  constructor(private readonly schema: ZodType<T>) {}
-
-  transform(value: unknown): T {
-    // The body is undefined when the request has none
-    const result = this.schema.safeParse(value ?? {});
-    if (!result.success) {
-      throw new BadRequestException(result.error.issues[0].message);
-    }
-    return result.data;
-  }
-}

package/templates/modules/drizzle/express/src/lib/schema.ts

@@ -1,12 +0,0 @@
-import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
-
-export const users = pgTable("users", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  email: text("email").notNull().unique(),
-  name: text("name"),
-  password: text("password").notNull(),
-  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
-  updatedAt: timestamp("updated_at", { withTimezone: true })
-    .defaultNow()
-    .$onUpdate(() => new Date()),
-});

package/templates/modules/drizzle/nestjs/src/database/schema.ts

@@ -1,12 +0,0 @@
-import { pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
-
-export const users = pgTable("users", {
-  id: uuid("id").primaryKey().defaultRandom(),
-  email: text("email").notNull().unique(),
-  name: text("name"),
-  password: text("password").notNull(),
-  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow(),
-  updatedAt: timestamp("updated_at", { withTimezone: true })
-    .defaultNow()
-    .$onUpdate(() => new Date()),
-});

package/templates/modules/prisma/express/prisma/schema.prisma

@@ -1,24 +0,0 @@
-// Prisma schema file
-// Learn more: https://pris.ly/d/prisma-schema
-
-generator client {
-  provider = "prisma-client"
-  moduleFormat = "cjs"
-  output   = "../src/generated/prisma"
-}
-
-datasource db {
-  provider = "postgresql"
-}
-
-// Sample User model
-model User {
-  id        String   @id @default(uuid())
-  email     String   @unique
-  name      String?
-  password  String
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-
-  @@map("users")
-}

package/templates/modules/prisma/nestjs/prisma/schema.prisma

@@ -1,23 +0,0 @@
-// Prisma schema file
-// Learn more: https://pris.ly/d/prisma-schema
-
-generator client {
-  provider = "prisma-client"
-  output   = "../src/generated/prisma"
-}
-
-datasource db {
-  provider = "postgresql"
-}
-
-// Sample User model
-model User {
-  id        String   @id @default(uuid())
-  email     String   @unique
-  name      String?
-  password  String
-  createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
-
-  @@map("users")
-}