create-arktos 1.2.0 → 1.4.0

package/src-js/middleware/index.js

@@ -0,0 +1,284 @@
+import helmet from 'helmet';
+import cors from 'cors';
+import rateLimit from 'express-rate-limit';
+import jwt from 'jsonwebtoken';
+import { createErrorResponse } from '../utils/response.js';
+import { ERROR_CODES } from '../constants/errorCodes.js';
+import DatabaseService from '../services/database.service.js';
+import logger from '../config/logger.js';
+
+const dbService = DatabaseService.getInstance();
+const prisma = dbService.getClient();
+
+// Security middleware
+export const securityMiddleware = [
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        styleSrc: ["'self'", "'unsafe-inline'"],
+        scriptSrc: ["'self'"],
+        imgSrc: ["'self'", 'data:', 'https:'],
+      },
+    },
+    crossOriginEmbedderPolicy: false,
+  }),
+  cors({
+    origin: process.env.FRONTEND_URL || 'http://localhost:3000',
+    credentials: true,
+    optionsSuccessStatus: 200,
+  }),
+];
+
+// Rate limiters
+export const rateLimiter = {
+  general: rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100, // limit each IP to 100 requests per windowMs
+    message: createErrorResponse(
+      'Too many requests, please try again later',
+      ERROR_CODES.RATE_LIMIT_EXCEEDED
+    ),
+    standardHeaders: true,
+    legacyHeaders: false,
+  }),
+  
+  auth: rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 10, // limit each IP to 10 auth requests per windowMs
+    message: createErrorResponse(
+      'Too many authentication attempts, please try again later',
+      ERROR_CODES.RATE_LIMIT_EXCEEDED
+    ),
+    standardHeaders: true,
+    legacyHeaders: false,
+  }),
+  
+  upload: rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 20, // limit each IP to 20 upload requests per windowMs
+    message: createErrorResponse(
+      'Too many upload requests, please try again later',
+      ERROR_CODES.RATE_LIMIT_EXCEEDED
+    ),
+    standardHeaders: true,
+    legacyHeaders: false,
+  }),
+  
+  api: rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 200, // limit each IP to 200 API requests per windowMs
+    message: createErrorResponse(
+      'Too many API requests, please try again later',
+      ERROR_CODES.RATE_LIMIT_EXCEEDED
+    ),
+    standardHeaders: true,
+    legacyHeaders: false,
+  }),
+};
+
+// Authentication middleware
+export const authMiddleware = async (req, res, next) => {
+  try {
+    const authHeader = req.headers.authorization;
+    
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return res.status(401).json(createErrorResponse(
+        'Authentication token required',
+        ERROR_CODES.AUTH_TOKEN_REQUIRED
+      ));
+    }
+
+    const token = authHeader.substring(7);
+    
+    let decoded;
+    try {
+      decoded = jwt.verify(token, process.env.JWT_SECRET);
+    } catch (error) {
+      return res.status(401).json(createErrorResponse(
+        'Invalid or expired token',
+        ERROR_CODES.AUTH_TOKEN_EXPIRED
+      ));
+    }
+
+    // Get user from database
+    const user = await prisma.user.findUnique({
+      where: { id: decoded.userId },
+      select: {
+        id: true,
+        email: true,
+        firstName: true,
+        lastName: true,
+        username: true,
+        avatar: true,
+        role: true,
+        isEmailVerified: true,
+        isActive: true,
+        lastLoginAt: true,
+      }
+    });
+
+    if (!user) {
+      return res.status(401).json(createErrorResponse(
+        'User not found',
+        ERROR_CODES.AUTH_USER_NOT_FOUND
+      ));
+    }
+
+    if (!user.isActive) {
+      return res.status(403).json(createErrorResponse(
+        'Account is deactivated',
+        ERROR_CODES.AUTH_ACCOUNT_DEACTIVATED
+      ));
+    }
+
+    req.user = user;
+    next();
+  } catch (error) {
+    logger.error('Authentication middleware error:', error);
+    return res.status(500).json(createErrorResponse(
+      'Internal server error',
+      ERROR_CODES.INTERNAL_ERROR
+    ));
+  }
+};
+
+// Optional auth middleware (doesn't fail if no token)
+export const optionalAuth = async (req, res, next) => {
+  try {
+    const authHeader = req.headers.authorization;
+    
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return next();
+    }
+
+    const token = authHeader.substring(7);
+    
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      
+      const user = await prisma.user.findUnique({
+        where: { id: decoded.userId },
+        select: {
+          id: true,
+          email: true,
+          firstName: true,
+          lastName: true,
+          username: true,
+          avatar: true,
+          role: true,
+          isEmailVerified: true,
+          isActive: true,
+          lastLoginAt: true,
+        }
+      });
+
+      if (user && user.isActive) {
+        req.user = user;
+      }
+    } catch (error) {
+      // Ignore token errors in optional auth
+    }
+
+    next();
+  } catch (error) {
+    logger.error('Optional auth middleware error:', error);
+    next();
+  }
+};
+
+// Role-based access control  
+export const requireRole = (roles) => {
+  return (req, res, next) => {
+    if (!req.user) {
+      return res.status(401).json(createErrorResponse(
+        'Authentication required',
+        ERROR_CODES.AUTH_TOKEN_REQUIRED
+      ));
+    }
+
+    const userRoles = Array.isArray(req.user.role) ? req.user.role : [req.user.role];
+    const requiredRoles = Array.isArray(roles) ? roles : [roles];
+    
+    const hasRole = requiredRoles.some(role => userRoles.includes(role));
+    
+    if (!hasRole) {
+      return res.status(403).json(createErrorResponse(
+        'Insufficient permissions',
+        ERROR_CODES.AUTH_INSUFFICIENT_PERMISSIONS
+      ));
+    }
+
+    next();
+  };
+};
+
+// Admin only middleware
+export const adminOnly = requireRole(['ADMIN']);
+
+// Moderator or admin middleware
+export const moderatorOrAdmin = requireRole(['MODERATOR', 'ADMIN']);
+
+// Validation middleware
+export const validation = {
+  request: (schema, data) => {
+    try {
+      return schema.parse(data);
+    } catch (error) {
+      const errorMessage = error.errors
+        ? error.errors.map(err => `${err.path.join('.')}: ${err.message}`).join(', ')
+        : 'Validation failed';
+      
+      throw new Error(errorMessage);
+    }
+  }
+};
+
+// Error handling middleware
+export const errorHandling = (error, _req, res, _next) => {
+  logger.error('Unhandled error:', error);
+
+  // Prisma errors
+  if (error.code === 'P2002') {
+    return res.status(409).json(createErrorResponse(
+      'Duplicate entry',
+      ERROR_CODES.DATABASE_CONFLICT
+    ));
+  }
+  
+  if (error.code === 'P2025') {
+    return res.status(404).json(createErrorResponse(
+      'Record not found',
+      ERROR_CODES.DATABASE_NOT_FOUND
+    ));
+  }
+
+  // Validation errors
+  if (error.name === 'ValidationError' || error.name === 'ZodError') {
+    return res.status(400).json(createErrorResponse(
+      error.message || 'Validation failed',
+      ERROR_CODES.VALIDATION_ERROR
+    ));
+  }
+
+  // JWT errors
+  if (error.name === 'JsonWebTokenError') {
+    return res.status(401).json(createErrorResponse(
+      'Invalid token',
+      ERROR_CODES.AUTH_TOKEN_INVALID
+    ));
+  }
+
+  if (error.name === 'TokenExpiredError') {
+    return res.status(401).json(createErrorResponse(
+      'Token expired',
+      ERROR_CODES.AUTH_TOKEN_EXPIRED
+    ));
+  }
+
+  // Default error response
+  return res.status(500).json(createErrorResponse(
+    'Internal server error',
+    ERROR_CODES.INTERNAL_ERROR
+  ));
+};

package/src-js/routes/auth.routes.js

@@ -0,0 +1,28 @@
+import express from 'express';
+import { 
+  register,
+  login,
+  refreshToken,
+  logout,
+  verifyEmail,
+  getProfile,
+  updateProfile,
+  changePassword
+} from '../controllers/auth.controller.js';
+import { authMiddleware, optionalAuth, rateLimiter } from '../middleware/index.js';
+
+const router = express.Router();
+
+// Public routes with rate limiting
+router.post('/register', rateLimiter.auth, register);
+router.post('/login', rateLimiter.auth, login);
+router.post('/refresh-token', rateLimiter.auth, refreshToken);
+router.get('/verify-email/:token', verifyEmail);
+
+// Protected routes
+router.post('/logout', authMiddleware, logout);
+router.get('/profile', authMiddleware, getProfile);
+router.put('/profile', authMiddleware, updateProfile);
+router.put('/change-password', authMiddleware, changePassword);
+
+export default router;

package/src-js/routes/index.js

@@ -0,0 +1,18 @@
+import express from 'express';
+import authRoutes from './auth.routes.js';
+
+const router = express.Router();
+
+// Mount auth routes
+router.use('/auth', authRoutes);
+
+// Health check for API
+router.get('/health', (req, res) => {
+  res.json({
+    status: 'ok',
+    timestamp: new Date().toISOString(),
+    message: 'API is running'
+  });
+});
+
+export default router;

package/src-js/schemas/index.js

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+
+// Environment validation schema
+export const envSchema = z.object({
+  NODE_ENV: z.string().default('development'),
+  PORT: z.string().transform(Number).default(3001),
+  DATABASE_URL: z.string().min(1, 'Database URL is required'),
+  DIRECT_URL: z.string().optional(),
+  JWT_SECRET: z.string().min(32, 'JWT secret must be at least 32 characters'),
+  JWT_REFRESH_SECRET: z.string().min(32, 'JWT refresh secret must be at least 32 characters'),
+  RESEND_API_KEY: z.string().optional(),
+  FRONTEND_URL: z.string().default('http://localhost:3000'),
+  BACKEND_URL: z.string().default('http://localhost:3001'),
+  BCRYPT_SALT_ROUNDS: z.string().transform(Number).default(12),
+  LOG_LEVEL: z.string().default('info'),
+  LOG_FILE: z.string().default('logs/app.log'),
+});
+
+// Auth schemas
+export const registerSchema = z.object({
+  email: z.string().email('Invalid email format'),
+  password: z.string().min(8, 'Password must be at least 8 characters'),
+  firstName: z.string().min(1, 'First name is required'),
+  lastName: z.string().min(1, 'Last name is required'),
+  username: z.string().min(3, 'Username must be at least 3 characters').optional(),
+});
+
+export const loginSchema = z.object({
+  email: z.string().email('Invalid email format'),
+  password: z.string().min(1, 'Password is required'),
+});
+
+export const refreshTokenSchema = z.object({
+  refreshToken: z.string().min(1, 'Refresh token is required'),
+});
+
+export const resendVerificationSchema = z.object({
+  email: z.string().email('Invalid email format'),
+});
+
+export const forgotPasswordSchema = z.object({
+  email: z.string().email('Invalid email format'),
+});
+
+export const resetPasswordSchema = z.object({
+  token: z.string().min(1, 'Reset token is required'),
+  password: z.string().min(8, 'Password must be at least 8 characters'),
+});
+
+export const updateProfileSchema = z.object({
+  firstName: z.string().min(1, 'First name is required').optional(),
+  lastName: z.string().min(1, 'Last name is required').optional(),
+  username: z.string().min(3, 'Username must be at least 3 characters').optional(),
+  avatar: z.string().url('Invalid avatar URL').optional(),
+});
+
+export const changePasswordSchema = z.object({
+  currentPassword: z.string().min(1, 'Current password is required'),
+  newPassword: z.string().min(8, 'New password must be at least 8 characters'),
+});

package/src-js/services/database.service.js

@@ -0,0 +1,89 @@
+import { PrismaClient } from '@prisma/client';
+import logger from '../config/logger.js';
+
+export class DatabaseService {
+  static instance;
+  prisma;
+  isConnected = false;
+
+  constructor() {
+    this.prisma = new PrismaClient({
+      log: ['query', 'error', 'info', 'warn'],
+    });
+
+    // Set up event listeners
+    this.setupEventListeners();
+  }
+
+  static getInstance() {
+    if (!DatabaseService.instance) {
+      DatabaseService.instance = new DatabaseService();
+    }
+    return DatabaseService.instance;
+  }
+
+  setupEventListeners() {
+    // Event listeners can be added here if needed
+    // For now, we're using simple logging configuration
+  }
+
+  async connect() {
+    try {
+      await this.prisma.$connect();
+      this.isConnected = true;
+      logger.info('Database connected successfully');
+    } catch (error) {
+      this.isConnected = false;
+      logger.error('Failed to connect to database:', error);
+      throw error;
+    }
+  }
+
+  async disconnect() {
+    try {
+      await this.prisma.$disconnect();
+      this.isConnected = false;
+      logger.info('Database disconnected successfully');
+    } catch (error) {
+      logger.error('Failed to disconnect from database:', error);
+      throw error;
+    }
+  }
+
+  getClient() {
+    if (!this.isConnected) {
+      logger.warn('Database client requested but not connected');
+    }
+    return this.prisma;
+  }
+
+  async healthCheck() {
+    try {
+      await this.prisma.$queryRaw`SELECT 1`;
+      return {
+        connected: true,
+        status: 'healthy',
+        timestamp: new Date().toISOString(),
+      };
+    } catch (error) {
+      logger.error('Database health check failed:', error);
+      return {
+        connected: false,
+        status: 'unhealthy',
+        error: error.message,
+        timestamp: new Date().toISOString(),
+      };
+    }
+  }
+
+  async executeTransaction(callback) {
+    try {
+      return await this.prisma.$transaction(callback);
+    } catch (error) {
+      logger.error('Database transaction failed:', error);
+      throw error;
+    }
+  }
+}
+
+export default DatabaseService;

package/src-js/services/email.service.js

@@ -0,0 +1,161 @@
+import { Resend } from 'resend';
+import fs from 'fs';
+import path from 'path';
+import logger from '../config/logger.js';
+
+const resend = new Resend(process.env.RESEND_API_KEY);
+
+class EmailService {
+  constructor() {
+    this.fromEmail = process.env.FROM_EMAIL || 'noreply@arktos.dev';
+    this.templatesPath = path.join(process.cwd(), 'src', 'views', 'emails');
+  }
+
+  async loadTemplate(templateName) {
+    try {
+      const templatePath = path.join(this.templatesPath, `${templateName}.html`);
+      return fs.readFileSync(templatePath, 'utf8');
+    } catch (error) {
+      logger.error(`Failed to load email template: ${templateName}`, error);
+      throw new Error(`Email template ${templateName} not found`);
+    }
+  }
+
+  replaceVariables(template, variables) {
+    let processedTemplate = template;
+    
+    for (const [key, value] of Object.entries(variables)) {
+      const regex = new RegExp(`{{${key}}}`, 'g');
+      processedTemplate = processedTemplate.replace(regex, value || '');
+    }
+    
+    return processedTemplate;
+  }
+
+  async sendEmail({ to, subject, template, variables = {}, attachments = [] }) {
+    try {
+      if (!process.env.RESEND_API_KEY) {
+        logger.warn('RESEND_API_KEY not configured. Email would be sent in production.');
+        logger.info(`Email would be sent to: ${to}, Subject: ${subject}`);
+        return { success: true, messageId: 'dev-mode' };
+      }
+
+      const htmlTemplate = await this.loadTemplate(template);
+      const html = this.replaceVariables(htmlTemplate, {
+        ...variables,
+        frontendUrl: process.env.FRONTEND_URL || 'http://localhost:3000',
+        backendUrl: process.env.BACKEND_URL || 'http://localhost:3001',
+        year: new Date().getFullYear(),
+      });
+
+      const emailData = {
+        from: this.fromEmail,
+        to: Array.isArray(to) ? to : [to],
+        subject,
+        html,
+      };
+
+      if (attachments.length > 0) {
+        emailData.attachments = attachments;
+      }
+
+      const result = await resend.emails.send(emailData);
+      
+      logger.info(`Email sent successfully to ${to}: ${subject}`);
+      return { success: true, messageId: result.id };
+    } catch (error) {
+      logger.error('Failed to send email:', error);
+      throw error;
+    }
+  }
+
+  async sendVerificationEmail(to, token, firstName) {
+    const verificationUrl = `${process.env.FRONTEND_URL}/verify-email/${token}`;
+    
+    return this.sendEmail({
+      to,
+      subject: 'Verify your email address',
+      template: 'verification',
+      variables: {
+        firstName,
+        verificationUrl,
+      },
+    });
+  }
+
+  async sendWelcomeEmail(to, firstName) {
+    return this.sendEmail({
+      to,
+      subject: 'Welcome to Arktos!',
+      template: 'welcome',
+      variables: {
+        firstName,
+      },
+    });
+  }
+
+  async sendPasswordResetEmail(to, token, firstName) {
+    const resetUrl = `${process.env.FRONTEND_URL}/reset-password/${token}`;
+    
+    return this.sendEmail({
+      to,
+      subject: 'Reset your password',
+      template: 'resetPassword',
+      variables: {
+        firstName,
+        resetUrl,
+      },
+    });
+  }
+
+  async sendNotificationEmail(to, subject, message, firstName) {
+    return this.sendEmail({
+      to,
+      subject,
+      template: 'notification',
+      variables: {
+        firstName,
+        message,
+        subject,
+      },
+    });
+  }
+
+  // Utility method to validate email addresses
+  validateEmail(email) {
+    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    return emailRegex.test(email);
+  }
+
+  // Bulk email sending (for newsletters, announcements, etc.)
+  async sendBulkEmail({ recipients, subject, template, variables = {} }) {
+    const results = [];
+    
+    for (const recipient of recipients) {
+      try {
+        const result = await this.sendEmail({
+          to: recipient.email,
+          subject,
+          template,
+          variables: {
+            ...variables,
+            firstName: recipient.firstName || '',
+            lastName: recipient.lastName || '',
+          },
+        });
+        
+        results.push({ email: recipient.email, success: true, messageId: result.messageId });
+        
+        // Add small delay to avoid rate limiting
+        await new Promise(resolve => setTimeout(resolve, 100));
+      } catch (error) {
+        logger.error(`Failed to send bulk email to ${recipient.email}:`, error);
+        results.push({ email: recipient.email, success: false, error: error.message });
+      }
+    }
+    
+    return results;
+  }
+}
+
+export default new EmailService();