create-efc-app 0.9.1 → 0.9.2

package/dist/index.js

@@ -153,7 +153,7 @@ async function scaffold(opts) {
 }
 async function writePackageJson(dest, opts) {
   const deps = {
-    "express-file-cluster": "^0.9.1"
+    "express-file-cluster": "^0.9.2"
   };
   if (opts.database === "mongodb") deps["mongoose"] = "^9.7.2";
   if (opts.database === "postgresql") {
@@ -162,10 +162,8 @@ async function writePackageJson(dest, opts) {
   }
   if (opts.tasks && opts.taskBackend === "bullmq") deps["bullmq"] = "^5.0.0";
   if (opts.tasks && opts.taskBackend === "pg-boss") deps["pg-boss"] = "^12.0.0";
-  if (opts.mailer) deps["nodemailer"] = "^6.9.0";
+  if (opts.mailer) deps["nodemailer"] = "^10.2.1";
   if (usesOAuth(opts)) deps["jose"] = "^6.2.3";
-  const auth = !opts.registry || opts.userPortal || opts.adminPortal;
-  if (auth) deps["bcrypt"] = "^5.1.0";
   const devDeps = {
     vitest: "^5.0.3"
   };
@@ -175,8 +173,7 @@ async function writePackageJson(dest, opts) {
     devDeps["@types/node"] = "^22.0.0";
     devDeps["@types/express"] = "^4.17.21";
     devDeps["tsx"] = "^4.0.0";
-    if (opts.mailer) devDeps["@types/nodemailer"] = "^6.4.0";
-    if (auth) devDeps["@types/bcrypt"] = "^5.0.0";
+    if (opts.mailer) devDeps["@types/nodemailer"] = "^8.0.2";
     if (opts.database === "postgresql") devDeps["@types/pg"] = "^8.11.0";
   }
   const pkg = {
@@ -194,7 +191,9 @@ async function writePackageJson(dest, opts) {
       "db:studio": "efc db studio"
     },
     dependencies: deps,
-    devDependencies: devDeps
+    devDependencies: devDeps,
+    // tsup 8 still asks for esbuild 0.27, which has an open advisory; 0.28 builds the same.
+    ...opts.language === "typescript" ? { overrides: { esbuild: "^0.28.1" } } : {}
   };
   await fs.writeJson(path.join(dest, "package.json"), pkg, { spaces: 2 });
 }
@@ -584,14 +583,13 @@ export const meta: RouteMeta = {
 ` : "";
   const { user: hasUser, admin: hasAdmin } = principals(opts);
   const hasModels = hasUser || hasAdmin;
-  const loginDbImports = hasModels ? `import bcrypt from 'bcrypt';
-import crypto from 'node:crypto';
+  const loginDbImports = hasModels ? `import crypto from 'node:crypto';
 ${hasUser ? `import { User } from '../../model/User.js';
 ` : ""}${hasAdmin ? `import { Admin } from '../../model/Admin.js';
 ` : ""}` : "";
   const loginBody = hasAdmin && hasUser ? `  const admin = await ${db.findOne("Admin", `{ email }`)};
   if (admin) {
-    const match = await bcrypt.compare(password, admin.password);
+    const match = await verifyPassword(password, admin.password);
     if (!match) return res.status(401).json({ error: 'Invalid credentials' });
     if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
     await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
@@ -601,27 +599,27 @@ ${hasUser ? `import { User } from '../../model/User.js';
 
   const user = await ${db.findOne("User", `{ email }`)};
   if (!user) return res.status(401).json({ error: 'Invalid credentials' });
-  const match = await bcrypt.compare(password, user.password);
+  const match = await verifyPassword(password, user.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
   await issueToken(res, { id: user.id, role: user.role, email: user.email });
   await issueRefreshToken(res, User, user.id);
   res.json({ message: 'Logged in' });` : hasAdmin ? `  const admin = await ${db.findOne("Admin", `{ email }`)};
   if (!admin) return res.status(401).json({ error: 'Invalid credentials' });
-  const match = await bcrypt.compare(password, admin.password);
+  const match = await verifyPassword(password, admin.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
   await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
   await issueRefreshToken(res, Admin, admin.id);
   res.json({ message: 'Logged in as admin' });` : `  const user = await ${db.findOne("User", `{ email }`)};
   if (!user) return res.status(401).json({ error: 'Invalid credentials' });
-  const match = await bcrypt.compare(password, user.password);
+  const match = await verifyPassword(password, user.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
   await issueToken(res, { id: user.id, role: user.role, email: user.email });
   await issueRefreshToken(res, User, user.id);
   res.json({ message: 'Logged in' });`;
-  const loginContent = hasModels ? ts ? `import { issueToken } from 'express-file-cluster/auth';
+  const loginContent = hasModels ? ts ? `import { issueToken, verifyPassword } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 ${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
@@ -646,7 +644,7 @@ export const POST = async (req: Request, res: Response) => {
 
 ${loginBody}
 };
-` : `import { issueToken } from 'express-file-cluster/auth';
+` : `import { issueToken, verifyPassword } from 'express-file-cluster/auth';
 ${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
 async function issueRefreshToken(res, model, id) {
@@ -735,7 +733,7 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const registerDbImports = `import bcrypt from 'bcrypt';
+  const registerDbImports = `import { hashPassword } from 'express-file-cluster/auth';
 import crypto from 'node:crypto';
 ${sendsMail(opts) ? "import { enqueue } from 'express-file-cluster/tasks';\n" : ""}import { User } from '../../model/User.js';
 `;
@@ -757,7 +755,7 @@ ${registerDbImports}${registerMeta}export const POST = async (req: Request, res:
   }
   const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
-  const hashed = await bcrypt.hash(password, 10);
+  const hashed = await hashPassword(password);
   const verifyToken = crypto.randomBytes(32).toString('hex');
   const user = await ${db.create("User", `{ name, email, password: hashed, verifyToken }`)};
 ${sendVerifyEmail}
@@ -771,7 +769,7 @@ ${sendVerifyEmail}
   }
   const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
-  const hashed = await bcrypt.hash(password, 10);
+  const hashed = await hashPassword(password);
   const verifyToken = crypto.randomBytes(32).toString('hex');
   const user = await ${db.create("User", `{ name, email, password: hashed, verifyToken }`)};
 ${sendVerifyEmail}
@@ -918,12 +916,9 @@ export const meta: RouteMeta = {
 };
 
 ` : "";
-  const adminUsersDbImport = ts ? `import bcrypt from 'bcrypt';
-import { User } from '../../../model/User.js';
-` : `import bcrypt from 'bcrypt';
-import { User } from '../../../model/User.js';
+  const adminUsersDbImport = `import { User } from '../../../model/User.js';
 `;
-  const usersListContent = ts ? `import { requireAuth } from 'express-file-cluster/auth';
+  const usersListContent = ts ? `import { hashPassword, requireAuth } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 ${adminUsersDbImport}${usersListMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
@@ -939,12 +934,12 @@ ${roleGuard}  const { name, email, password, role } = req.body;
   if (!name || !email || !password) return res.status(400).json({ error: 'name, email and password are required' });
   const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
-  const hashed = await bcrypt.hash(password, 10);
+  const hashed = await hashPassword(password);
   const user = await ${db.create("User", `{ name, email, password: hashed, role: role ?? 'user' }`)};
   const { password: _, ...safe } = user;
   res.status(201).json({ message: 'User created', user: safe });
 };
-` : `import { requireAuth } from 'express-file-cluster/auth';
+` : `import { hashPassword, requireAuth } from 'express-file-cluster/auth';
 ${adminUsersDbImport}${usersListMeta}${middlewares}
 export const GET = async (req, res) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
@@ -959,7 +954,7 @@ ${roleGuard}  const { name, email, password, role } = req.body;
   if (!name || !email || !password) return res.status(400).json({ error: 'name, email and password are required' });
   const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
-  const hashed = await bcrypt.hash(password, 10);
+  const hashed = await hashPassword(password);
   const user = await ${db.create("User", `{ name, email, password: hashed, role: role ?? 'user' }`)};
   const { password: _, ...safe } = user;
   res.status(201).json({ message: 'User created', user: safe });
@@ -1630,8 +1625,7 @@ ${hasAdmin ? `import { Admin } from '../../model/Admin.js';
     const rpPersist = hasAdmin ? `  if (user) await ${db.update("User", `user.id`, `{ password: hashed, resetToken: '' }`)};
   else if (admin) await ${db.update("Admin", `admin.id`, `{ password: hashed, resetToken: '' }`)};` : `  await ${db.update("User", `user.id`, `{ password: hashed, resetToken: '' }`)};`;
     const rpContent = ts ? `import type { Request, Response } from 'express';
-import bcrypt from 'bcrypt';
-import { revokeAllSessions } from 'express-file-cluster/auth';
+import { hashPassword, revokeAllSessions } from 'express-file-cluster/auth';
 ${rpModelImports}${rpMeta}export const POST = async (req: Request, res: Response) => {
   const { token, password } = req.body;
   if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
@@ -1642,15 +1636,14 @@ ${rpLookup}
     return res.status(400).json({ error: 'Invalid or expired reset token' });
   }
 
-  const hashed = await bcrypt.hash(password, 10);
+  const hashed = await hashPassword(password);
 ${rpPersist}
   // Tokens issued with the old password stop working everywhere.
   await revokeAllSessions(account.id);
 
   res.json({ message: 'Password reset successfully' });
 };
-` : `import bcrypt from 'bcrypt';
-import { revokeAllSessions } from 'express-file-cluster/auth';
+` : `import { hashPassword, revokeAllSessions } from 'express-file-cluster/auth';
 ${rpModelImports}${rpMeta}export const POST = async (req, res) => {
   const { token, password } = req.body;
   if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
@@ -1661,7 +1654,7 @@ ${rpLookup}
     return res.status(400).json({ error: 'Invalid or expired reset token' });
   }
 
-  const hashed = await bcrypt.hash(password, 10);
+  const hashed = await hashPassword(password);
 ${rpPersist}
   // Tokens issued with the old password stop working everywhere.
   await revokeAllSessions(account.id);
@@ -3671,9 +3664,8 @@ async function writeOAuth(dest, opts) {
   const T = (s) => ts ? s : "";
   const userField = usesTables(opts) && generatedModels(opts).has("User") ? "user" : "userId";
   const lib = `import crypto from 'node:crypto';
-import bcrypt from 'bcrypt';
 import { HttpError } from 'express-file-cluster';
-import { issueToken } from 'express-file-cluster/auth';
+import { hashPassword, issueToken } from 'express-file-cluster/auth';
 ${T("import type { Request, Response } from 'express';\n")}import { User } from '../model/User.js';
 import { OAuthAccount } from '../model/OAuthAccount.js';
 
@@ -3767,7 +3759,7 @@ export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuth
     `{
         name: profile.name || email.split('@')[0],
         email,
-        password: await bcrypt.hash(randomToken(), 10),
+        password: await hashPassword(randomToken()),
         isVerified: true,
       }`
   )});