create-efc-app 0.9.2 → 0.9.6

package/dist/index.js

@@ -153,7 +153,7 @@ async function scaffold(opts) {
 }
 async function writePackageJson(dest, opts) {
   const deps = {
-    "express-file-cluster": "^0.9.2"
+    "express-file-cluster": "^0.9.6"
   };
   if (opts.database === "mongodb") deps["mongoose"] = "^9.7.2";
   if (opts.database === "postgresql") {
@@ -592,9 +592,9 @@ ${hasUser ? `import { User } from '../../model/User.js';
     const match = await verifyPassword(password, admin.password);
     if (!match) return res.status(401).json({ error: 'Invalid credentials' });
     if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
-    await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
-    await issueRefreshToken(res, Admin, admin.id);
-    return res.json({ message: 'Logged in as admin' });
+    const token = await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
+    const refreshToken = await issueRefreshToken(res, Admin, admin.id);
+    return res.json({ message: 'Logged in as admin', ...(token ? { token, refreshToken } : {}) });
   }
 
   const user = await ${db.findOne("User", `{ email }`)};
@@ -602,23 +602,26 @@ ${hasUser ? `import { User } from '../../model/User.js';
   const match = await verifyPassword(password, user.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
-  await issueToken(res, { id: user.id, role: user.role, email: user.email });
-  await issueRefreshToken(res, User, user.id);
-  res.json({ message: 'Logged in' });` : hasAdmin ? `  const admin = await ${db.findOne("Admin", `{ email }`)};
+  const token = await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  const refreshToken = await issueRefreshToken(res, User, user.id);
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({ message: 'Logged in', ...(token ? { token, refreshToken } : {}) });` : hasAdmin ? `  const admin = await ${db.findOne("Admin", `{ email }`)};
   if (!admin) return res.status(401).json({ error: 'Invalid credentials' });
   const match = await verifyPassword(password, admin.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!admin.isActive) return res.status(403).json({ error: 'Account suspended' });
-  await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
-  await issueRefreshToken(res, Admin, admin.id);
-  res.json({ message: 'Logged in as admin' });` : `  const user = await ${db.findOne("User", `{ email }`)};
+  const token = await issueToken(res, { id: admin.id, role: admin.role, email: admin.email });
+  const refreshToken = await issueRefreshToken(res, Admin, admin.id);
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({ message: 'Logged in as admin', ...(token ? { token, refreshToken } : {}) });` : `  const user = await ${db.findOne("User", `{ email }`)};
   if (!user) return res.status(401).json({ error: 'Invalid credentials' });
   const match = await verifyPassword(password, user.password);
   if (!match) return res.status(401).json({ error: 'Invalid credentials' });
   if (!user.isActive) return res.status(403).json({ error: 'Account suspended' });
-  await issueToken(res, { id: user.id, role: user.role, email: user.email });
-  await issueRefreshToken(res, User, user.id);
-  res.json({ message: 'Logged in' });`;
+  const token = await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  const refreshToken = await issueRefreshToken(res, User, user.id);
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({ message: 'Logged in', ...(token ? { token, refreshToken } : {}) });`;
   const loginContent = hasModels ? ts ? `import { issueToken, verifyPassword } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 ${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
@@ -627,7 +630,7 @@ async function issueRefreshToken(
   res: Response,
   model: ${usesTables(opts) ? "{ update: (args: { where: { id: string }; data: Record<string, unknown> }) => Promise<unknown> }" : "{ update: (id: string, data: Record<string, unknown>) => Promise<unknown> }"},
   id: string,
-): Promise<void> {
+): Promise<string> {
   const refreshToken = crypto.randomBytes(40).toString('hex');
   await ${db.update("model", "id", "{ refreshToken, refreshTokenExpiry: new Date(Date.now() + REFRESH_TOKEN_TTL_MS) }")};
   res.cookie('efc_refresh_token', refreshToken, {
@@ -636,11 +639,15 @@ async function issueRefreshToken(
     sameSite: 'strict',
     maxAge: REFRESH_TOKEN_TTL_MS,
   });
+  return refreshToken;
 }
 
 export const POST = async (req: Request, res: Response) => {
   const { email, password } = req.body;
-  if (!email || !password) return res.status(400).json({ error: 'email and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || typeof password !== 'string' || !email || !password) {
+    return res.status(400).json({ error: 'email and password are required' });
+  }
 
 ${loginBody}
 };
@@ -656,11 +663,15 @@ async function issueRefreshToken(res, model, id) {
     sameSite: 'strict',
     maxAge: REFRESH_TOKEN_TTL_MS,
   });
+  return refreshToken;
 }
 
 export const POST = async (req, res) => {
   const { email, password } = req.body;
-  if (!email || !password) return res.status(400).json({ error: 'email and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || typeof password !== 'string' || !email || !password) {
+    return res.status(400).json({ error: 'email and password are required' });
+  }
 
 ${loginBody}
 };
@@ -750,7 +761,8 @@ ${sendsMail(opts) ? "import { enqueue } from 'express-file-cluster/tasks';\n" :
   const registerContent = ts ? `import type { Request, Response } from 'express';
 ${registerDbImports}${registerMeta}export const POST = async (req: Request, res: Response) => {
   const { name, email, password } = req.body;
-  if (!name || !email || !password) {
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof name !== 'string' || typeof email !== 'string' || typeof password !== 'string' || !name || !email || !password) {
     return res.status(400).json({ error: 'name, email and password are required' });
   }
   const existing = await ${db.findOne("User", `{ email }`)};
@@ -759,12 +771,13 @@ ${registerDbImports}${registerMeta}export const POST = async (req: Request, res:
   const verifyToken = crypto.randomBytes(32).toString('hex');
   const user = await ${db.create("User", `{ name, email, password: hashed, verifyToken }`)};
 ${sendVerifyEmail}
-  const { password: _, verifyToken: __, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.status(201).json({ message: 'Account created successfully', user: safe });
 };
 ` : `${registerDbImports}${registerMeta}export const POST = async (req, res) => {
   const { name, email, password } = req.body;
-  if (!name || !email || !password) {
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof name !== 'string' || typeof email !== 'string' || typeof password !== 'string' || !name || !email || !password) {
     return res.status(400).json({ error: 'name, email and password are required' });
   }
   const existing = await ${db.findOne("User", `{ email }`)};
@@ -773,7 +786,7 @@ ${sendVerifyEmail}
   const verifyToken = crypto.randomBytes(32).toString('hex');
   const user = await ${db.create("User", `{ name, email, password: hashed, verifyToken }`)};
 ${sendVerifyEmail}
-  const { password: _, verifyToken: __, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.status(201).json({ message: 'Account created successfully', user: safe });
 };
 `;
@@ -925,18 +938,21 @@ export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
   const limit = Math.min(100, Number(req.query.limit) || 20);
   const [all, total] = await Promise.all([${db.find("User", `{}`)}, ${db.count("User", `{}`)}]);
-  const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, ...u }) => u);
+  const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...u }) => u);
   res.json({ users, total, page, limit });
 };
 
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { name, email, password, role } = req.body;
-  if (!name || !email || !password) return res.status(400).json({ error: 'name, email and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof name !== 'string' || typeof email !== 'string' || typeof password !== 'string' || !name || !email || !password) {
+    return res.status(400).json({ error: 'name, email and password are required' });
+  }
   const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await hashPassword(password);
   const user = await ${db.create("User", `{ name, email, password: hashed, role: role ?? 'user' }`)};
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.status(201).json({ message: 'User created', user: safe });
 };
 ` : `import { hashPassword, requireAuth } from 'express-file-cluster/auth';
@@ -945,18 +961,21 @@ export const GET = async (req, res) => {
 ${roleGuard}  const page = Math.max(1, Number(req.query.page) || 1);
   const limit = Math.min(100, Number(req.query.limit) || 20);
   const [all, total] = await Promise.all([${db.find("User", `{}`)}, ${db.count("User", `{}`)}]);
-  const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, ...u }) => u);
+  const users = all.slice((page - 1) * limit, page * limit).map(({ password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...u }) => u);
   res.json({ users, total, page, limit });
 };
 
 export const POST = async (req, res) => {
 ${roleGuard}  const { name, email, password, role } = req.body;
-  if (!name || !email || !password) return res.status(400).json({ error: 'name, email and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof name !== 'string' || typeof email !== 'string' || typeof password !== 'string' || !name || !email || !password) {
+    return res.status(400).json({ error: 'name, email and password are required' });
+  }
   const existing = await ${db.findOne("User", `{ email }`)};
   if (existing) return res.status(409).json({ error: 'Email already in use' });
   const hashed = await hashPassword(password);
   const user = await ${db.create("User", `{ name, email, password: hashed, role: role ?? 'user' }`)};
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.status(201).json({ message: 'User created', user: safe });
 };
 `;
@@ -1005,14 +1024,14 @@ export const meta: RouteMeta = {
 ` : "";
   const adminUserByIdDbImport = `import { User } from '../../../model/User.js';
 `;
-  const userByIdContent = ts ? `import { requireAuth } from 'express-file-cluster/auth';
+  const userByIdContent = ts ? `import { requireAuth, revokeAllSessions } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
 ${adminUserByIdDbImport}${userByIdMeta}${middlewares}
 export const GET = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.json({ user: safe });
 };
 
@@ -1021,7 +1040,10 @@ ${roleGuard}  const { id } = req.params;
   const { name, email, role, isActive } = req.body;
   const updated = await ${db.update("User", `id`, `{ name, email, role, isActive }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = updated;
+  // The role lives in the user's JWTs: end them, or a demoted/suspended user keeps access
+  // until they expire. (/auth/refresh also refuses inactive accounts.)
+  if (role !== undefined || isActive === false) await revokeAllSessions(id);
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = updated;
   res.json({ message: 'User updated', user: safe });
 };
 
@@ -1030,15 +1052,16 @@ ${roleGuard}  const { id } = req.params;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
   await ${db.delete("User", `id`)};
+  await revokeAllSessions(id);
   res.json({ message: \`User \${id} deleted\` });
 };
-` : `import { requireAuth } from 'express-file-cluster/auth';
+` : `import { requireAuth, revokeAllSessions } from 'express-file-cluster/auth';
 ${adminUserByIdDbImport}${userByIdMeta}${middlewares}
 export const GET = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.json({ user: safe });
 };
 
@@ -1047,7 +1070,10 @@ ${roleGuard}  const { id } = req.params;
   const { name, email, role, isActive } = req.body;
   const updated = await ${db.update("User", `id`, `{ name, email, role, isActive }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = updated;
+  // The role lives in the user's JWTs: end them, or a demoted/suspended user keeps access
+  // until they expire. (/auth/refresh also refuses inactive accounts.)
+  if (role !== undefined || isActive === false) await revokeAllSessions(id);
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = updated;
   res.json({ message: 'User updated', user: safe });
 };
 
@@ -1056,6 +1082,7 @@ ${roleGuard}  const { id } = req.params;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
   await ${db.delete("User", `id`)};
+  await revokeAllSessions(id);
   res.json({ message: \`User \${id} deleted\` });
 };
 `;
@@ -1107,7 +1134,7 @@ export const GET = async (req: Request, res: Response) => {
   const { id } = (req as any).user;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.json({ user: safe });
 };
 
@@ -1116,7 +1143,7 @@ export const PUT = async (req: Request, res: Response) => {
   const { name, email } = req.body;
   const updated = await ${db.update("User", `id`, `{ name, email }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = updated;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = updated;
   res.json({ message: 'Profile updated', user: safe });
 };
 ` : `import { requireAuth } from 'express-file-cluster/auth';
@@ -1125,7 +1152,7 @@ export const GET = async (req, res) => {
   const { id } = req.user;
   const user = await ${db.findById("User", `id`)};
   if (!user) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = user;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = user;
   res.json({ user: safe });
 };
 
@@ -1134,7 +1161,7 @@ export const PUT = async (req, res) => {
   const { name, email } = req.body;
   const updated = await ${db.update("User", `id`, `{ name, email }`)};
   if (!updated) return res.status(404).json({ error: 'User not found' });
-  const { password: _, ...safe } = updated;
+  const { password: _, verifyToken: _vt, resetToken: _rt, resetTokenExpiry: _re, refreshToken: _ft, refreshTokenExpiry: _fe, ...safe } = updated;
   res.json({ message: 'Profile updated', user: safe });
 };
 `;
@@ -1432,12 +1459,15 @@ ${refreshModelImports}${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60
 export const POST = async (req: Request, res: Response) => {
   const token = req.cookies?.['efc_refresh_token'] || req.body?.refreshToken;
   if (!token) return res.status(401).json({ error: 'Refresh token required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof token !== 'string') return res.status(400).json({ error: 'Invalid refresh token' });
 
 ${refreshLookup}
 
   if (!account || !account.refreshTokenExpiry || new Date(account.refreshTokenExpiry) < new Date()) {
     return res.status(401).json({ error: 'Invalid or expired refresh token' });
   }
+  if (account.isActive === false) return res.status(403).json({ error: 'Account suspended' });
 
   const newRefreshToken = crypto.randomBytes(40).toString('hex');
   const refreshTokenExpiry = new Date(Date.now() + REFRESH_TOKEN_TTL_MS);
@@ -1450,8 +1480,12 @@ ${refreshPersist}
     maxAge: REFRESH_TOKEN_TTL_MS,
   });
 
-  await issueToken(res, { id: account.id, role: account.role, email: account.email });
-  res.json({ message: 'Token refreshed' });
+  const accessToken = await issueToken(res, { id: account.id, role: account.role, email: account.email });
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({
+    message: 'Token refreshed',
+    ...(accessToken ? { token: accessToken, refreshToken: newRefreshToken } : {}),
+  });
 };
 ` : `import { issueToken } from 'express-file-cluster/auth';
 import crypto from 'node:crypto';
@@ -1460,12 +1494,15 @@ ${refreshModelImports}${refreshMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60
 export const POST = async (req, res) => {
   const token = req.cookies?.efc_refresh_token || req.body?.refreshToken;
   if (!token) return res.status(401).json({ error: 'Refresh token required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof token !== 'string') return res.status(400).json({ error: 'Invalid refresh token' });
 
 ${refreshLookup}
 
   if (!account || !account.refreshTokenExpiry || new Date(account.refreshTokenExpiry) < new Date()) {
     return res.status(401).json({ error: 'Invalid or expired refresh token' });
   }
+  if (account.isActive === false) return res.status(403).json({ error: 'Account suspended' });
 
   const newRefreshToken = crypto.randomBytes(40).toString('hex');
   const refreshTokenExpiry = new Date(Date.now() + REFRESH_TOKEN_TTL_MS);
@@ -1478,8 +1515,12 @@ ${refreshPersist}
     maxAge: REFRESH_TOKEN_TTL_MS,
   });
 
-  await issueToken(res, { id: account.id, role: account.role, email: account.email });
-  res.json({ message: 'Token refreshed' });
+  const accessToken = await issueToken(res, { id: account.id, role: account.role, email: account.email });
+  // bearer: the client stores both tokens itself; http-only: they travel as cookies.
+  res.json({
+    message: 'Token refreshed',
+    ...(accessToken ? { token: accessToken, refreshToken: newRefreshToken } : {}),
+  });
 };
 `;
     await fs.outputFile(path.join(dest, "src", "api", "auth", `refresh.${ext}`), refreshContent);
@@ -1513,7 +1554,8 @@ ${veMeta}export const GET = async (req: Request, res: Response) => {
 
 export const POST = async (req: Request, res: Response) => {
   const { email } = req.body;
-  if (!email) return res.status(400).json({ error: 'email is required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || !email) return res.status(400).json({ error: 'email is required' });
 
   const user = await ${db.findOne("User", `{ email }`)};
   if (user && !user.isVerified) {
@@ -1538,7 +1580,8 @@ ${veMeta}export const GET = async (req, res) => {
 
 export const POST = async (req, res) => {
   const { email } = req.body;
-  if (!email) return res.status(400).json({ error: 'email is required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || !email) return res.status(400).json({ error: 'email is required' });
 
   const user = await ${db.findOne("User", `{ email }`)};
   if (user && !user.isVerified) {
@@ -1573,7 +1616,8 @@ ${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 6
 
 export const POST = async (req: Request, res: Response) => {
   const { email } = req.body;
-  if (!email) return res.status(400).json({ error: 'email is required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || !email) return res.status(400).json({ error: 'email is required' });
 
 ${fpLookup}
 
@@ -1592,7 +1636,8 @@ ${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 6
 
 export const POST = async (req, res) => {
   const { email } = req.body;
-  if (!email) return res.status(400).json({ error: 'email is required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof email !== 'string' || !email) return res.status(400).json({ error: 'email is required' });
 
 ${fpLookup}
 
@@ -1628,7 +1673,10 @@ ${hasAdmin ? `import { Admin } from '../../model/Admin.js';
 import { hashPassword, revokeAllSessions } from 'express-file-cluster/auth';
 ${rpModelImports}${rpMeta}export const POST = async (req: Request, res: Response) => {
   const { token, password } = req.body;
-  if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof token !== 'string' || typeof password !== 'string' || !token || !password) {
+    return res.status(400).json({ error: 'token and password are required' });
+  }
 
 ${rpLookup}
 
@@ -1646,7 +1694,10 @@ ${rpPersist}
 ` : `import { hashPassword, revokeAllSessions } from 'express-file-cluster/auth';
 ${rpModelImports}${rpMeta}export const POST = async (req, res) => {
   const { token, password } = req.body;
-  if (!token || !password) return res.status(400).json({ error: 'token and password are required' });
+  // Strings only: an object such as {"$ne": null} would be read as a filter operator and match any account.
+  if (typeof token !== 'string' || typeof password !== 'string' || !token || !password) {
+    return res.status(400).json({ error: 'token and password are required' });
+  }
 
 ${rpLookup}
 
@@ -2821,14 +2872,14 @@ ${suspendMeta}${mwAdmin4}
 export const POST = async (req: Request, res: Response) => {
 ${roleGuard}  const { id } = req.params;
   const { reason } = req.body;
-  // TODO: set user.isActive = false, log audit event
+  // TODO: set user.isActive = false (then revokeAllSessions(id) so open sessions end), log audit event
   res.json({ message: \`User \${id} suspended\`, reason });
 };
 ` : `${RA}${suspendMeta}${mwAdmin4}
 export const POST = async (req, res) => {
 ${roleGuard}  const { id } = req.params;
   const { reason } = req.body;
-  // TODO: set user.isActive = false, log audit event
+  // TODO: set user.isActive = false (then revokeAllSessions(id) so open sessions end), log audit event
   res.json({ message: \`User \${id} suspended\`, reason });
 };
 `;
@@ -3664,7 +3715,7 @@ async function writeOAuth(dest, opts) {
   const T = (s) => ts ? s : "";
   const userField = usesTables(opts) && generatedModels(opts).has("User") ? "user" : "userId";
   const lib = `import crypto from 'node:crypto';
-import { HttpError } from 'express-file-cluster';
+import { HttpError, cache } from 'express-file-cluster';
 import { hashPassword, issueToken } from 'express-file-cluster/auth';
 ${T("import type { Request, Response } from 'express';\n")}import { User } from '../model/User.js';
 import { OAuthAccount } from '../model/OAuthAccount.js';
@@ -3672,11 +3723,14 @@ import { OAuthAccount } from '../model/OAuthAccount.js';
 // Shared by the OAuth sign-in routes (src/api/auth/<provider>/).
 
 const STATE_TTL_MS = 10 * 60 * 1000; // a sign-in attempt has 10 minutes to come back
+const CODE_TTL_S = 60; // a bearer app has a minute to exchange its sign-in code
 ${T(`
 export interface OAuthState {
   state: string;
   nonce: string;
   verifier?: string;
+  /** Bearer apps: the S256 challenge of a verifier only the app knows (app \u2194 this server). */
+  appChallenge?: string;
 }
 
 export interface OAuthProfile {
@@ -3743,7 +3797,7 @@ export function takeState(
  * user with the same (provider-verified) email, else a new user. New users get a random
  * password \u2014 they can set a real one with the forgot-password flow.
  */
-export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuthProfile")})${T(": Promise<void>")} {
+export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuthProfile")})${T(": Promise<string | undefined>")} {
   const key = \`\${profile.provider}:\${profile.providerId}\`;
   const account = await ${db.findOne("OAuthAccount", "{ key }")};
   let user = account ? await ${db.findById("User", `account.${userField}`)} : null;
@@ -3778,12 +3832,66 @@ export async function signInWithOAuth(res${T(": Response")}, profile${T(": OAuth
     }
   }
   if (!user.isActive) throw new HttpError(403, 'Account suspended');
-  await issueToken(res, { id: user.id, role: user.role, email: user.email });
+  // http-only: sets the cookie, returns undefined. bearer: returns the token.
+  return issueToken(res, { id: user.id, role: user.role, email: user.email });
+}
+
+/**
+ * Bearer apps start sign-in with \`?code_challenge=<base64url SHA-256 of a random verifier>\`
+ * (PKCE, RFC 7636, between the app and this server). Only the app holding the verifier can
+ * redeem the sign-in code \u2014 another app catching the myapp:// redirect can't.
+ */
+export function appChallengeFrom(query${T(": Request['query']")})${T(": string | undefined")} {
+  const challenge = query.code_challenge;
+  if (challenge === undefined) return undefined;
+  if (typeof challenge !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(challenge)) {
+    throw new HttpError(400, 'code_challenge must be the base64url SHA-256 of your code_verifier');
+  }
+  return challenge;
 }
 
-/** Where the browser goes once signed in. */
-export function successRedirect()${T(": string")} {
-  return process.env.OAUTH_SUCCESS_REDIRECT || '/';
+/**
+ * Where the browser goes once signed in. With authStrategy 'bearer' the JWT never goes in the
+ * URL (history, screenshots, logs): it gets a one-time code, valid for a minute, which the app
+ * that started the sign-in trades for the token at POST /auth/oauth/exchange.
+ */
+export async function successRedirect(
+  token${T("?: string")},
+  appChallenge${T("?: string")},
+)${T(": Promise<string>")} {
+  const to = process.env.OAUTH_SUCCESS_REDIRECT || '/';
+  if (!token) return to;
+  if (!appChallenge) {
+    throw new HttpError(
+      400,
+      'Bearer sign-in needs a code_challenge \u2014 start at /auth/<provider>?code_challenge=\u2026',
+    );
+  }
+  const code = randomToken();
+  await cache.set(\`oauth:code:\${code}\`, { token, appChallenge }, { ttl: CODE_TTL_S });
+  return \`\${to}#code=\${code}\`;
+}
+
+/**
+ * The token for a one-time sign-in code, given the verifier behind the challenge the sign-in
+ * started with. Once: a second use (or after a minute) gets 400.
+ */
+export async function exchangeCode(code${T(": unknown")}, verifier${T(": unknown")})${T(": Promise<string>")} {
+  if (typeof code !== 'string' || !code) throw new HttpError(400, 'code is required');
+  if (typeof verifier !== 'string' || !/^[A-Za-z0-9._~-]{43,128}$/.test(verifier)) {
+    throw new HttpError(400, 'code_verifier is required (43-128 characters)');
+  }
+  const key = \`oauth:code:\${code}\`;
+  const saved = await cache.get${T("<{ token: string; appChallenge: string }>")}(key);
+  const expected = Buffer.from(saved?.appChallenge ?? '');
+  const actual = Buffer.from(pkceChallenge(verifier));
+  // A wrong verifier leaves the code alone, so it can't be used to burn someone's sign-in.
+  if (!saved || expected.length !== actual.length || !crypto.timingSafeEqual(expected, actual)) {
+    throw new HttpError(400, 'Invalid or expired sign-in code');
+  }
+  // del is atomic: of two requests racing with the same code, only one removes it.
+  if ((await cache.del(key)) !== 1) throw new HttpError(400, 'Invalid or expired sign-in code');
+  return saved.token;
 }
 `;
   const reqRes = (r) => ts ? `(${r}: Request, res: Response)` : `(${r}, res)`;
@@ -3793,14 +3901,16 @@ export function successRedirect()${T(": string")} {
 };
 
 `;
-  const googleStart = `${typeImport}import { pkceChallenge, randomToken, rememberState } from '../../../lib/oauth.js';
+  const googleStart = `${typeImport}import { appChallengeFrom, pkceChallenge, randomToken, rememberState } from '../../../lib/oauth.js';
 ${meta("GET", 'Start "Sign in with Google": redirects to Google.')}// Redirects to Google's consent screen; Google sends the browser back to the callback route
 // (GOOGLE_REDIRECT_URI \u2014 register that exact URL in the Google Cloud console).
-export const GET = async ${reqRes("_req")} => {
+// Bearer apps add ?code_challenge=\u2026 (see appChallengeFrom in src/lib/oauth).
+export const GET = async ${reqRes("req")} => {
+  const appChallenge = appChallengeFrom(req.query);
   const state = randomToken();
   const nonce = randomToken();
   const verifier = randomToken();
-  rememberState(res, 'google', { state, nonce, verifier });
+  rememberState(res, 'google', { state, nonce, verifier, ...(appChallenge ? { appChallenge } : {}) });
   const params = new URLSearchParams({
     client_id: process.env.GOOGLE_CLIENT_ID ?? '',
     redirect_uri: process.env.GOOGLE_REDIRECT_URI ?? '',
@@ -3849,23 +3959,25 @@ export const GET = async ${reqRes("req")} => {
   });
   if (payload.nonce !== saved.nonce) throw new HttpError(400, 'Invalid sign-in response');
 
-  await signInWithOAuth(res, {
+  const token = await signInWithOAuth(res, {
     provider: 'google',
     providerId: String(payload.sub),
     email: ${ts ? "payload.email as string | undefined" : "payload.email"},
     emailVerified: payload.email_verified === true,
     name: ${ts ? "payload.name as string | undefined" : "payload.name"},
   });
-  res.redirect(successRedirect());
+  res.redirect(await successRedirect(token, saved.appChallenge));
 };
 `;
-  const appleStart = `${typeImport}import { randomToken, rememberState } from '../../../lib/oauth.js';
+  const appleStart = `${typeImport}import { appChallengeFrom, randomToken, rememberState } from '../../../lib/oauth.js';
 ${meta("GET", 'Start "Sign in with Apple": redirects to Apple.')}// Redirects to Apple; Apple POSTs the result to the callback route (APPLE_REDIRECT_URI \u2014
 // register it on the Services ID; Apple only accepts https URLs on a verified domain).
-export const GET = async ${reqRes("_req")} => {
+// Bearer apps add ?code_challenge=\u2026 (see appChallengeFrom in src/lib/oauth).
+export const GET = async ${reqRes("req")} => {
+  const appChallenge = appChallengeFrom(req.query);
   const state = randomToken();
   const nonce = randomToken();
-  rememberState(res, 'apple', { state, nonce }, true);
+  rememberState(res, 'apple', { state, nonce, ...(appChallenge ? { appChallenge } : {}) }, true);
   const params = new URLSearchParams({
     client_id: process.env.APPLE_CLIENT_ID ?? '',
     redirect_uri: process.env.APPLE_REDIRECT_URI ?? '',
@@ -3934,18 +4046,24 @@ export const POST = async ${reqRes("req")} => {
     name = undefined;
   }
 
-  await signInWithOAuth(res, {
+  const token = await signInWithOAuth(res, {
     provider: 'apple',
     providerId: String(payload.sub),
     email: ${ts ? "payload.email as string | undefined" : "payload.email"},
     emailVerified: payload.email_verified === true || payload.email_verified === 'true',
     name,
   });
-  res.redirect(303, successRedirect());
+  res.redirect(303, await successRedirect(token, saved.appChallenge));
+};
+`;
+  const exchange = `${typeImport}import { exchangeCode } from '../../../lib/oauth.js';
+${meta("POST", "Bearer apps: trade the one-time code from the sign-in redirect (plus the PKCE code_verifier) for a token.")}export const POST = async ${reqRes("req")} => {
+  res.json({ token: await exchangeCode(req.body?.code, req.body?.code_verifier) });
 };
 `;
   const oauth = opts.oauth ?? {};
   await fs.outputFile(path.join(dest, "src", "lib", `oauth.${ext}`), lib);
+  await fs.outputFile(path.join(dest, "src", "api", "auth", "oauth", `exchange.${ext}`), exchange);
   if (oauth.google) {
     await fs.outputFile(
       path.join(dest, "src", "api", "auth", "google", `index.${ext}`),
@@ -4001,6 +4119,18 @@ var admin = (flag) => (o) => {
   o.adminPortal = true;
   o.adminFeatures = { ...o.adminFeatures, [flag]: true };
 };
+var AUTH_STRATEGY_OPTIONS = [
+  {
+    value: "http-only",
+    label: "http-only cookie",
+    hint: "browsers \u2014 websites and SPAs (recommended)"
+  },
+  {
+    value: "bearer",
+    label: "Bearer token",
+    hint: "mobile/desktop apps, API clients \u2014 keep it in Keychain/Keystore, not localStorage"
+  }
+];
 var ITEMS = [
   {
     name: "auth",
@@ -4008,7 +4138,16 @@ var ITEMS = [
     description: "User & Admin models; register, login, logout and me routes",
     group: "auth",
     registryDependencies: [],
-    docs: "Tokens are issued per `authStrategy` in efc.config \u2014 'http-only' (cookie) or 'localStorage' (Bearer). Verification emails go through the SendEmail task; `efc add email-client` makes it send real mail.",
+    docs: "Tokens are issued per `authStrategy` in efc.config \u2014 'http-only' (cookie) or 'bearer' (login returns the token; send it as Authorization: Bearer). Verification emails go through the SendEmail task; `efc add email-client` makes it send real mail.",
+    prompts: [
+      {
+        name: "authStrategy",
+        config: "authStrategy",
+        type: "select",
+        message: "Authentication strategy:",
+        options: AUTH_STRATEGY_OPTIONS
+      }
+    ],
     enable: (o) => {
       o.userPortal = true;
     }
@@ -4555,29 +4694,26 @@ async function main() {
       hint: item.description
     });
   }
+  const auth = await p.select({
+    message: "Authentication:",
+    options: [
+      ...AUTH_STRATEGY_OPTIONS,
+      { value: "none", label: "None", hint: "add it later with `efc add auth`" }
+    ]
+  });
+  if (p.isCancel(auth)) cancel2();
   const picked = await p.groupMultiselect({
     message: `Add features now? ${pc.dim("(space to toggle, enter to confirm \u2014 or add any later with `efc add <item>`)")}`,
     options: groups,
+    initialValues: auth === "none" ? [] : ["auth"],
     required: false
   });
   if (p.isCancel(picked)) cancel2();
   const items = withDependencies(picked);
-  let authStrategy = "http-only";
-  if (items.includes("auth")) {
-    const strategy = await p.select({
-      message: "Authentication strategy:",
-      options: [
-        { value: "http-only", label: "http-only", hint: "secure cookie \u2014 recommended for SSR" },
-        { value: "localStorage", label: "localStorage", hint: "bearer token \u2014 for SPAs" }
-      ]
-    });
-    if (p.isCancel(strategy)) cancel2();
-    authStrategy = strategy;
-  }
-  const answers = {};
+  const answers = auth === "none" ? {} : { authStrategy: auth };
   const prompts = itemPrompts(items);
   for (const q of prompts) {
-    if (!promptApplies(q, answers)) continue;
+    if (q.name in answers || !promptApplies(q, answers)) continue;
     if (q.note) p.note(q.note);
     if (q.type === "select") {
       const choice = await p.select({
@@ -4617,7 +4753,7 @@ async function main() {
     items,
     {
       projectName,
-      authStrategy,
+      authStrategy: answers["authStrategy"] ?? "http-only",
       cluster,
       taskBackend,
       ...answers["provider"] === "custom" && { smtpProvider: "custom" }
@@ -4652,6 +4788,17 @@ Rotate any of them immediately if it is ever exposed.`,
       "Credentials"
     );
   }
+  if (opts.database === "postgresql") {
+    const db = path3.basename(opts.projectName);
+    p.note(
+      `.env points DATABASE_URL at postgresql://localhost:5432/${db}, with no user or password.
+EFC creates the tables on first use, but not the database or the login:
+  \u2022 Local server: createdb ${db}  (add user:password@ to the URL if it asks for one)
+  \u2022 Neon, Supabase, RDS: create the database in the dashboard and paste its full
+    connection string into .env as DATABASE_URL`,
+      "PostgreSQL"
+    );
+  }
   p.outro(
     pc.green(`
 Your project is ready!