create-ailk 0.1.0

package/templates/apps/api/src/routes/auth/__tests__/user.test.ts

@@ -0,0 +1,486 @@
+import { FastifyInstance } from 'fastify';
+import { userRoutes } from '../user';
+
+// Mock Prisma — lib/prisma.ts wraps the external DB boundary (PrismaClient
+// requires a live connection). This call auto-resolves to the manual mock at
+// src/lib/__mocks__/prisma.ts which covers user/userData/apiToken models.
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock('../../../lib/prisma.js');
+
+import { prisma } from '../../../lib/prisma.js';
+
+// Helper to create authenticated request
+function createAuthenticatedRequest(userId: string) {
+  return {
+    userId,
+  };
+}
+
+describe('User Routes', () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    const fastify = require('fastify')();
+    // Add userId decorator for testing
+    fastify.decorateRequest('userId', null);
+    await fastify.register(userRoutes);
+    app = fastify;
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  describe('GET /v1/user/profile', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      // ACT
+      const response = await app.inject({
+        method: 'GET',
+        url: '/v1/user/profile',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(401);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Authentication required');
+    });
+
+    it('should return user profile when authenticated', async () => {
+      // ARRANGE
+      const mockUser = {
+        id: 'user_123',
+        email: 'test@example.com',
+        name: 'Test User',
+        image: null,
+        role: 'USER',
+        createdAt: new Date(),
+      };
+
+      (prisma.user.findUnique as jest.Mock).mockResolvedValue(mockUser);
+
+      // Create a new app instance with userId set via hook
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      
+      // Add preHandler to set userId
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'GET',
+        url: '/v1/user/profile',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(true);
+      expect(body.data.id).toBe('user_123');
+
+      await fastify2.close();
+    });
+
+    it('should return 404 when user is not found', async () => {
+      // ARRANGE
+      (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'GET',
+        url: '/v1/user/profile',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(404);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('User not found');
+
+      await fastify2.close();
+    });
+
+    it('should return 500 on database error', async () => {
+      // ARRANGE
+      (prisma.user.findUnique as jest.Mock).mockRejectedValue(
+        new Error('Database error')
+      );
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'GET',
+        url: '/v1/user/profile',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(500);
+
+      await fastify2.close();
+    });
+  });
+
+  describe('PATCH /v1/user/profile', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      const response = await app.inject({
+        method: 'PATCH',
+        url: '/v1/user/profile',
+        payload: { name: 'New Name' },
+      });
+
+      expect(response.statusCode).toBe(401);
+    });
+
+    it('should update user profile with valid data', async () => {
+      // ARRANGE
+      const updatedUser = {
+        id: 'user_123',
+        email: 'test@example.com',
+        name: 'New Name',
+        image: 'https://example.com/avatar.jpg',
+        role: 'USER',
+        updatedAt: new Date(),
+      };
+
+      (prisma.user.update as jest.Mock).mockResolvedValue(updatedUser);
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'PATCH',
+        url: '/v1/user/profile',
+        payload: { name: 'New Name', image: 'https://example.com/avatar.jpg' },
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      expect(prisma.user.update).toHaveBeenCalledWith({
+        where: { id: 'user_123' },
+        data: { name: 'New Name', image: 'https://example.com/avatar.jpg' },
+        select: expect.any(Object),
+      });
+
+      await fastify2.close();
+    });
+
+    it('should return 400 on validation error', async () => {
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      const response = await fastify2.inject({
+        method: 'PATCH',
+        url: '/v1/user/profile',
+        payload: { image: 'not-a-url' }, // Invalid URL
+      });
+
+      expect(response.statusCode).toBe(400);
+
+      await fastify2.close();
+    });
+
+    it('should return 500 on non-ZodError database error', async () => {
+      // ARRANGE — throw a plain Error (not ZodError) to hit the 500 branch
+      (prisma.user.update as jest.Mock).mockRejectedValue(
+        new Error('DB connection lost')
+      );
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'PATCH',
+        url: '/v1/user/profile',
+        payload: { name: 'New Name' },
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(500);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Internal server error');
+
+      await fastify2.close();
+    });
+  });
+
+  describe('GET /v1/user/data/:key', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      const response = await app.inject({
+        method: 'GET',
+        url: '/v1/user/data/preferences',
+      });
+
+      expect(response.statusCode).toBe(401);
+    });
+
+    it('should return user data when found', async () => {
+      // ARRANGE
+      const mockUserData = {
+        userId: 'user_123',
+        key: 'preferences',
+        value: { theme: 'dark' },
+      };
+
+      (prisma.userData.findUnique as jest.Mock).mockResolvedValue(mockUserData);
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'GET',
+        url: '/v1/user/data/preferences',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(true);
+
+      await fastify2.close();
+    });
+
+    it('should return 404 when data is not found', async () => {
+      (prisma.userData.findUnique as jest.Mock).mockResolvedValue(null);
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      const response = await fastify2.inject({
+        method: 'GET',
+        url: '/v1/user/data/nonexistent',
+      });
+
+      expect(response.statusCode).toBe(404);
+
+      await fastify2.close();
+    });
+  });
+
+  describe('PUT /v1/user/data/:key', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      const response = await app.inject({
+        method: 'PUT',
+        url: '/v1/user/data/preferences',
+        payload: { theme: 'light' },
+      });
+
+      expect(response.statusCode).toBe(401);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Authentication required');
+    });
+
+    it('should create or update user data', async () => {
+      // ARRANGE
+      const mockUserData = {
+        userId: 'user_123',
+        key: 'preferences',
+        value: { theme: 'light' },
+      };
+
+      (prisma.userData.upsert as jest.Mock).mockResolvedValue(mockUserData);
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'PUT',
+        url: '/v1/user/data/preferences',
+        payload: { theme: 'light' },
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      expect(prisma.userData.upsert).toHaveBeenCalled();
+
+      await fastify2.close();
+    });
+
+    it('should return 500 on database error', async () => {
+      // ARRANGE
+      (prisma.userData.upsert as jest.Mock).mockRejectedValue(
+        new Error('DB write failed')
+      );
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'PUT',
+        url: '/v1/user/data/preferences',
+        payload: { theme: 'light' },
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(500);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Internal server error');
+
+      await fastify2.close();
+    });
+  });
+
+  describe('DELETE /v1/user/data/:key', () => {
+    it('should return 401 when user is not authenticated', async () => {
+      const response = await app.inject({
+        method: 'DELETE',
+        url: '/v1/user/data/preferences',
+      });
+
+      expect(response.statusCode).toBe(401);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Authentication required');
+    });
+
+    it('should delete user data', async () => {
+      // ARRANGE
+      (prisma.userData.deleteMany as jest.Mock).mockResolvedValue({ count: 1 });
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'DELETE',
+        url: '/v1/user/data/preferences',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      expect(prisma.userData.deleteMany).toHaveBeenCalledWith({
+        where: { userId: 'user_123', key: 'preferences' },
+      });
+
+      await fastify2.close();
+    });
+
+    it('should return 500 on database error', async () => {
+      // ARRANGE
+      (prisma.userData.deleteMany as jest.Mock).mockRejectedValue(
+        new Error('DB delete failed')
+      );
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'DELETE',
+        url: '/v1/user/data/preferences',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(500);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Internal server error');
+
+      await fastify2.close();
+    });
+  });
+
+  describe('GET /v1/user/data/:key — error path', () => {
+    it('should return 500 on database error', async () => {
+      // ARRANGE
+      (prisma.userData.findUnique as jest.Mock).mockRejectedValue(
+        new Error('DB read failed')
+      );
+
+      const fastify2 = require('fastify')();
+      fastify2.decorateRequest('userId', null);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- #506/#507: pre-existing test-hygiene violation
+      fastify2.addHook('preHandler', async (request: any) => {
+        request.userId = 'user_123';
+      });
+      await fastify2.register(userRoutes);
+
+      // ACT
+      const response = await fastify2.inject({
+        method: 'GET',
+        url: '/v1/user/data/preferences',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(500);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(body.error).toBe('Internal server error');
+
+      await fastify2.close();
+    });
+  });
+});

package/templates/apps/api/src/routes/auth/tokens.ts

@@ -0,0 +1,199 @@
+/**
+ * API Token Management
+ * 
+ * Handles creation and management of API tokens for mobile/external clients.
+ * These tokens are stored locally in the customer's database.
+ */
+import { randomBytes, createHash } from 'crypto';
+
+import { getClock } from '@working-theory/common';
+import { logger } from '@working-theory/observability';
+import type { FastifyPluginAsync } from 'fastify';
+import { z } from 'zod';
+
+import { prisma } from '../../lib/prisma.js';
+
+const createTokenSchema = z.object({
+  name: z.string().min(1, 'Name is required'),
+  clientType: z.enum(['mobile', 'api', 'cli']).default('api'),
+  deviceInfo: z.string().optional(),
+  scopes: z.array(z.string()).default([]),
+  expiresInDays: z.number().min(1).max(365).optional(),
+});
+
+/**
+ * Generate a secure API token
+ */
+function generateToken(): { token: string; hash: string; prefix: string } {
+  const token = `tok_${randomBytes(32).toString('hex')}`;
+  const hash = createHash('sha256').update(token).digest('hex');
+  const prefix = token.substring(0, 12);
+  return { token, hash, prefix };
+}
+
+export const tokenRoutes: FastifyPluginAsync = async (fastify) => {
+  /**
+   * POST /v1/auth/tokens
+   * Create a new API token
+   * Requires authenticated user (session or existing token)
+   */
+  fastify.post('/v1/auth/tokens', async (request, reply) => {
+    try {
+      // TODO: Get userId from session/auth middleware
+      const userId = (request as unknown as { userId?: string }).userId;
+      if (!userId) {
+        return reply.status(401).send({
+          success: false,
+          error: 'Authentication required',
+        });
+      }
+
+      const data = createTokenSchema.parse(request.body);
+      const { token, hash, prefix } = generateToken();
+
+      // Calculate expiration
+      const expiresAt = data.expiresInDays
+        ? new Date(getClock().now() + data.expiresInDays * 24 * 60 * 60 * 1000)
+        : null;
+
+      // Create token in database
+      const apiToken = await prisma.apiToken.create({
+        data: {
+          userId,
+          name: data.name,
+          token: hash, // Store hash, not the actual token
+          tokenPrefix: prefix,
+          clientType: data.clientType,
+          ...(data.deviceInfo !== undefined && { deviceInfo: data.deviceInfo }),
+          scopes: data.scopes,
+          expiresAt,
+        },
+        select: {
+          id: true,
+          name: true,
+          tokenPrefix: true,
+          clientType: true,
+          scopes: true,
+          expiresAt: true,
+          createdAt: true,
+        },
+      });
+
+      // Return the actual token ONCE (user must save it)
+      return reply.status(201).send({
+        success: true,
+        token, // Only time we return the actual token
+        data: apiToken,
+        warning: 'Save this token now. You will not be able to see it again.',
+      });
+    } catch (error) {
+      if (error instanceof z.ZodError) {
+        return reply.status(400).send({
+          success: false,
+          error: 'Validation failed',
+          details: error.issues,
+        });
+      }
+
+      logger.error({ err: error }, '[Tokens] Error creating token');
+      return reply.status(500).send({
+        success: false,
+        error: 'Internal server error',
+      });
+    }
+  });
+
+  /**
+   * GET /v1/auth/tokens
+   * List user's API tokens (without the actual token values)
+   */
+  fastify.get('/v1/auth/tokens', async (request, reply) => {
+    try {
+      const userId = (request as unknown as { userId?: string }).userId;
+      if (!userId) {
+        return reply.status(401).send({
+          success: false,
+          error: 'Authentication required',
+        });
+      }
+
+      const tokens = await prisma.apiToken.findMany({
+        where: {
+          userId,
+          revokedAt: null,
+        },
+        select: {
+          id: true,
+          name: true,
+          tokenPrefix: true,
+          clientType: true,
+          deviceInfo: true,
+          scopes: true,
+          expiresAt: true,
+          lastUsedAt: true,
+          createdAt: true,
+        },
+        orderBy: { createdAt: 'desc' },
+      });
+
+      return reply.send({
+        success: true,
+        data: tokens,
+      });
+    } catch (error) {
+      logger.error({ err: error }, '[Tokens] Error listing tokens');
+      return reply.status(500).send({
+        success: false,
+        error: 'Internal server error',
+      });
+    }
+  });
+
+  /**
+   * DELETE /v1/auth/tokens/:id
+   * Revoke an API token
+   */
+  fastify.delete<{ Params: { id: string } }>('/v1/auth/tokens/:id', async (request, reply) => {
+    try {
+      const userId = (request as unknown as { userId?: string }).userId;
+      if (!userId) {
+        return reply.status(401).send({
+          success: false,
+          error: 'Authentication required',
+        });
+      }
+
+      const { id } = request.params;
+
+      // Verify ownership and revoke
+      const token = await prisma.apiToken.updateMany({
+        where: {
+          id,
+          userId,
+          revokedAt: null,
+        },
+        data: {
+          revokedAt: new Date(),
+        },
+      });
+
+      if (token.count === 0) {
+        return reply.status(404).send({
+          success: false,
+          error: 'Token not found',
+        });
+      }
+
+      return reply.send({
+        success: true,
+        message: 'Token revoked',
+      });
+    } catch (error) {
+      logger.error({ err: error }, '[Tokens] Error revoking token');
+      return reply.status(500).send({
+        success: false,
+        error: 'Internal server error',
+      });
+    }
+  });
+};