create-efc-app 0.9.6 → 0.10.0

package/dist/index.js

@@ -46,18 +46,22 @@ function sendsMail(opts) {
 function usesTables(opts) {
   return opts.database === "postgresql" && opts.modelApi !== "defineModel";
 }
+function usesCollections(opts) {
+  return opts.database === "mongodb" && opts.modelApi !== "defineModel";
+}
 function orm(opts) {
   const t = usesTables(opts);
+  const c = usesCollections(opts);
   const where = (filter) => filter.replace(/\s/g, "") === "{}" ? "" : `{ where: ${filter} }`;
   const byId = (id) => id === "id" ? "{ id }" : `{ id: ${id} }`;
   return {
     findOne: (m, filter) => t ? `${m}.findFirst({ where: ${filter} })` : `${m}.findOne(${filter})`,
     findById: (m, id) => t ? `${m}.findUnique({ where: ${byId(id)} })` : `${m}.findById(${id})`,
     find: (m, filter) => t ? `${m}.findMany(${where(filter)})` : `${m}.find(${filter})`,
-    count: (m, filter) => t ? `${m}.count(${where(filter)})` : `${m}.count(${filter})`,
+    count: (m, filter) => t ? `${m}.count(${where(filter)})` : c ? `${m}.countDocuments(${filter})` : `${m}.count(${filter})`,
     create: (m, data) => t ? `${m}.create({ data: ${data} })` : `${m}.create(${data})`,
-    update: (m, id, data) => t ? `${m}.update({ where: ${byId(id)}, data: ${data} })` : `${m}.update(${id}, ${data})`,
-    delete: (m, id) => t ? `${m}.delete({ where: ${byId(id)} })` : `${m}.delete(${id})`
+    update: (m, id, data) => t ? `${m}.update({ where: ${byId(id)}, data: ${data} })` : c ? `${m}.findByIdAndUpdate(${id}, ${data}, { returnDocument: 'after' })` : `${m}.update(${id}, ${data})`,
+    delete: (m, id) => t ? `${m}.delete({ where: ${byId(id)} })` : c ? `${m}.findByIdAndDelete(${id})` : `${m}.delete(${id})`
   };
 }
 function generatedModels(opts) {
@@ -83,7 +87,7 @@ function generatedModels(opts) {
   return m;
 }
 function modelApi(opts) {
-  const name = usesTables(opts) ? "defineTable" : "defineModel";
+  const name = usesTables(opts) ? "defineTable" : usesCollections(opts) ? "defineCollection" : "defineModel";
   return { name, import: `import { ${name} } from 'express-file-cluster';` };
 }
 function refField(opts, r) {
@@ -153,7 +157,7 @@ async function scaffold(opts) {
 }
 async function writePackageJson(dest, opts) {
   const deps = {
-    "express-file-cluster": "^0.9.6"
+    "express-file-cluster": "^0.10.0"
   };
   if (opts.database === "mongodb") deps["mongoose"] = "^9.7.2";
   if (opts.database === "postgresql") {
@@ -238,6 +242,9 @@ ${declaration}
   jwtExpiresIn: process.env.JWT_EXPIRES_IN,
   cookieDomain: process.env.COOKIE_DOMAIN,
   cors: corsOrigins ? { origin: corsOrigins } : true,
+  // Behind a proxy / load balancer (Render, Fly, Heroku, nginx): the number of hops, e.g. 1,
+  // so req.ip is the client and rate limits count per client.
+  trustProxy: process.env.TRUST_PROXY ? Number(process.env.TRUST_PROXY) : undefined,
   authStrategy: '${opts.authStrategy}',
   tasks: ${tasks},
   // Cache + session-revocation store (logout really invalidates tokens). Redis when
@@ -311,7 +318,8 @@ Optional \u2014 the same docs over MCP, with search and scaffolding tools:
 ${usesTables(opts) ? `- \`src/model/*.${ext}\` \u2014 \`defineTable\` models (PostgreSQL-native, Prisma-style queries:
   \`findMany({ where, include })\`, \`create({ data })\`, \`update({ where, data })\`). A \`ref\` is a
   foreign key; ${opts.registry ? "add back-relations to a model's `relations` when you need `include`" : "back-relations are in each model's `relations`"}. \`src/model/index.${ext}\` imports
-  them all${opts.language === "typescript" ? " and declares `Tables` (typed `include`)" : ""} \u2014 add new models there.` : `- \`src/model/*.${ext}\` \u2014 \`defineModel\` models.`}
+  them all${opts.language === "typescript" ? " and declares `Tables` (typed `include`)" : ""} \u2014 add new models there.` : usesCollections(opts) ? `- \`src/model/*.${ext}\` \u2014 \`defineCollection\` models (MongoDB-native, mongoose-style queries:
+  \`find(filter, { projection, sort })\`, \`findByIdAndUpdate\`, typed \`pipeline()\`, \`lookup()\`).` : `- \`src/model/*.${ext}\` \u2014 \`defineModel\` models.`}
 - \`src/index.${ext}\` is the entry point; it imports \`efc.config.${ext}\` and passes it to \`ignite()\`.
 - Only three import paths exist: \`express-file-cluster\`, \`express-file-cluster/auth\`,
   \`express-file-cluster/tasks\`.
@@ -397,7 +405,9 @@ CORS_ORIGINS=http://localhost:3000${smtpVars}${oauthEnv}`;
 NODE_ENV=development
 DATABASE_URL=${dbExampleUrl}
 JWT_SECRET=<generate with: openssl rand -hex 64>${redis}
-CORS_ORIGINS=http://localhost:3000,https://yourapp.com${smtpExample}${oauthExample}`;
+CORS_ORIGINS=http://localhost:3000,https://yourapp.com
+# Behind a proxy / load balancer: how many hops to trust, so rate limits see client IPs
+# TRUST_PROXY=1${smtpExample}${oauthExample}`;
   await fs.outputFile(path.join(dest, ".env"), dotenv);
   await fs.outputFile(path.join(dest, ".env.example"), example);
 }
@@ -624,11 +634,23 @@ ${hasUser ? `import { User } from '../../model/User.js';
   res.json({ message: 'Logged in', ...(token ? { token, refreshToken } : {}) });`;
   const loginContent = hasModels ? ts ? `import { issueToken, verifyPassword } from 'express-file-cluster/auth';
 import type { Request, Response } from 'express';
-${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+import { rateLimit } from 'express-file-cluster';
+${loginDbImports}${loginMeta}// 10 attempts per 15 minutes per address and account. Keyed on the email too, so behind a
+// proxy without TRUST_PROXY (every client then has the proxy's IP) it still limits one
+// account at a time, never everyone.
+export const middlewares = [
+  rateLimit({
+    window: '15m',
+    max: 10,
+    key: (req) => \`\${req.ip}:\${String(req.body?.email ?? '').toLowerCase()}\`,
+  }),
+];
+
+const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
 async function issueRefreshToken(
   res: Response,
-  model: ${usesTables(opts) ? "{ update: (args: { where: { id: string }; data: Record<string, unknown> }) => Promise<unknown> }" : "{ update: (id: string, data: Record<string, unknown>) => Promise<unknown> }"},
+  model: ${usesTables(opts) ? "{ update: (args: { where: { id: string }; data: Record<string, unknown> }) => Promise<unknown> }" : usesCollections(opts) ? "{ findByIdAndUpdate: (id: string, data: Record<string, unknown>, options: { returnDocument: 'after' }) => Promise<unknown> }" : "{ update: (id: string, data: Record<string, unknown>) => Promise<unknown> }"},
   id: string,
 ): Promise<string> {
   const refreshToken = crypto.randomBytes(40).toString('hex');
@@ -652,7 +674,19 @@ export const POST = async (req: Request, res: Response) => {
 ${loginBody}
 };
 ` : `import { issueToken, verifyPassword } from 'express-file-cluster/auth';
-${loginDbImports}${loginMeta}const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
+import { rateLimit } from 'express-file-cluster';
+${loginDbImports}${loginMeta}// 10 attempts per 15 minutes per address and account. Keyed on the email too, so behind a
+// proxy without TRUST_PROXY (every client then has the proxy's IP) it still limits one
+// account at a time, never everyone.
+export const middlewares = [
+  rateLimit({
+    window: '15m',
+    max: 10,
+    key: (req) => \`\${req.ip}:\${String(req.body?.email ?? '').toLowerCase()}\`,
+  }),
+];
+
+const REFRESH_TOKEN_TTL_MS = 1000 * 60 * 60 * 24 * 30; // 30 days
 
 async function issueRefreshToken(res, model, id) {
   const refreshToken = crypto.randomBytes(40).toString('hex');
@@ -1612,7 +1646,13 @@ ${hasAdmin ? `import { Admin } from '../../model/Admin.js';
     else if (admin) await ${db.update("Admin", `admin.id`, `{ resetToken, resetTokenExpiry }`)};` : `    await ${db.update("User", `user.id`, `{ resetToken, resetTokenExpiry }`)};`;
     const fpContent = ts ? `import type { Request, Response } from 'express';
 import crypto from 'node:crypto';
-${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
+import { rateLimit } from 'express-file-cluster';
+${mailerTaskImport}${fpModelImports}${fpMeta}// 5 reset emails per hour per address \u2014 keeps the endpoint from mail-bombing someone.
+export const middlewares = [
+  rateLimit({ window: '1h', max: 5, key: (req) => String(req.body?.email ?? '').toLowerCase() }),
+];
+
+const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
 
 export const POST = async (req: Request, res: Response) => {
   const { email } = req.body;
@@ -1632,7 +1672,13 @@ ${sendResetEmail}  }
   res.json({ message: 'Reset email sent' });
 };
 ` : `import crypto from 'node:crypto';
-${mailerTaskImport}${fpModelImports}${fpMeta}const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
+import { rateLimit } from 'express-file-cluster';
+${mailerTaskImport}${fpModelImports}${fpMeta}// 5 reset emails per hour per address \u2014 keeps the endpoint from mail-bombing someone.
+export const middlewares = [
+  rateLimit({ window: '1h', max: 5, key: (req) => String(req.body?.email ?? '').toLowerCase() }),
+];
+
+const RESET_TOKEN_TTL_MS = 1000 * 60 * 60; // 1 hour
 
 export const POST = async (req, res) => {
   const { email } = req.body;
@@ -4097,6 +4143,12 @@ var VARIANTS = ["typescript", "javascript"].flatMap((language) => {
       database: "mongodb",
       modelApi: "defineModel"
     },
+    {
+      key: `${lang}-mongo-collection`,
+      language,
+      database: "mongodb",
+      modelApi: "defineCollection"
+    },
     {
       key: `${lang}-pg-model`,
       language,
@@ -4512,7 +4564,7 @@ function registryOptions(v, items = [], extra = {}) {
     projectName: "efc-app",
     language: v.language,
     database: v.database,
-    ...v.database === "postgresql" && { modelApi: v.modelApi },
+    modelApi: v.modelApi,
     authStrategy: "http-only",
     cluster: true,
     tasks: true,
@@ -4555,7 +4607,7 @@ async function writeManifest(dest, opts, items) {
     registry: (pkg.dependencies["express-file-cluster"] ?? "").replace(/^[^\d]*/, ""),
     language: opts.language,
     database: opts.database,
-    modelApi: opts.database === "postgresql" ? opts.modelApi ?? "defineTable" : "defineModel",
+    modelApi: opts.database === "postgresql" ? opts.modelApi ?? "defineTable" : opts.modelApi === "defineModel" ? "defineModel" : "defineCollection",
     tasks: opts.tasks ? opts.taskBackend ?? "bullmq" : null,
     items: [...withDependencies(items)].sort(),
     files: Object.fromEntries(Object.entries(files).sort(([a], [b]) => a.localeCompare(b)))
@@ -4651,22 +4703,30 @@ async function main() {
     ]
   });
   if (p.isCancel(database)) cancel2();
-  let modelApi2;
-  if (database === "postgresql") {
-    const api = await p.select({
-      message: "Models:",
-      options: [
-        {
-          value: "defineTable",
-          label: "defineTable",
-          hint: "PostgreSQL-native \u2014 foreign keys, relations, include, Prisma-style queries"
-        },
-        { value: "defineModel", label: "defineModel", hint: "portable \u2014 the same API on MongoDB" }
-      ]
-    });
-    if (p.isCancel(api)) cancel2();
-    modelApi2 = api;
-  }
+  const api = await p.select({
+    message: "Models:",
+    options: database === "postgresql" ? [
+      {
+        value: "defineTable",
+        label: "defineTable",
+        hint: "PostgreSQL-native \u2014 foreign keys, relations, include, Prisma-style queries"
+      },
+      { value: "defineModel", label: "defineModel", hint: "portable \u2014 the same API on MongoDB" }
+    ] : [
+      {
+        value: "defineCollection",
+        label: "defineCollection",
+        hint: "MongoDB-native \u2014 mongoose-style queries, typed pipelines, BSON types"
+      },
+      {
+        value: "defineModel",
+        label: "defineModel",
+        hint: "portable \u2014 the same API on PostgreSQL"
+      }
+    ]
+  });
+  if (p.isCancel(api)) cancel2();
+  const modelApi2 = api;
   const taskBackend = await p.select({
     message: "Task queue backend:",
     options: database === "postgresql" ? [