create-fullstack-scaffold 0.1.1 → 0.2.0

package/template/src/server/module-admin/services/admin-service.ts

@@ -1,9 +1,8 @@
 import bcrypt from 'bcryptjs'
 import { getDb, getRawClient } from '@server/db'
-import { todos } from '@server/db/schema'
 import { desc } from 'drizzle-orm'
 import { toISOString } from '@server/utils/date'
-import { getMockUsers } from '@server/utils/auth'
+import { getMockUsers, getMockTokens, getUserPasswordHashes } from '@server/utils/auth'
 import { Role, getPermissionsByRole } from '@shared/modules/permission'
 import type {
   SystemStats,
@@ -15,6 +14,24 @@ import type {
   UpdateUserRequest,
   CreateUserRequest,
 } from '@shared/modules/admin'
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let todosTable: any = null
+let todosTableLoaded = false
+
+async function getTodosTable() {
+  if (todosTableLoaded) return todosTable
+  try {
+    const schema = (await import('@server/db/schema')) as Record<string, unknown>
+    todosTable = schema.todos ?? null
+    todosTableLoaded = true
+    return todosTable
+  } catch {
+    todosTableLoaded = true
+    return null
+  }
+}
+
 export async function getSystemStats(): Promise<SystemStats> {
   const rawClient = await getRawClient()
 
@@ -40,6 +57,16 @@ export async function getSystemStats(): Promise<SystemStats> {
     }
   }
 
+  const todos = await getTodosTable()
+  if (!todos) {
+    return {
+      totalTodos: 0,
+      pendingTodos: 0,
+      completedTodos: 0,
+      lastUpdated: new Date().toISOString(),
+    }
+  }
+
   const db = await getDb()
   const allTodos = await db.select().from(todos)
 
@@ -53,6 +80,13 @@ export async function getSystemStats(): Promise<SystemStats> {
 
 export async function checkDatabaseHealth(): Promise<HealthCheck> {
   try {
+    const todos = await getTodosTable()
+    if (!todos) {
+      return {
+        database: 'disconnected',
+        timestamp: new Date().toISOString(),
+      }
+    }
     const db = await getDb()
     await db.select().from(todos).limit(1)
     return {
@@ -68,8 +102,10 @@ export async function checkDatabaseHealth(): Promise<HealthCheck> {
 }
 
 export async function clearAllTodos(): Promise<{ deletedCount: number }> {
+  const todos = await getTodosTable()
+  if (!todos) return { deletedCount: 0 }
   const db = await getDb()
-  const result = await db.delete(todos).returning()
+  const result = (await db.delete(todos).returning()) as unknown[]
   return { deletedCount: result.length }
 }
 
@@ -81,6 +117,8 @@ export async function getRecentActivity(limit: number = 10): Promise<
     updatedAt: string
   }>
 > {
+  const todos = await getTodosTable()
+  if (!todos) return []
   const db = await getDb()
   const results = await db.select().from(todos).orderBy(desc(todos.updatedAt)).limit(limit)
 
@@ -98,17 +136,31 @@ export async function login(data: LoginRequest): Promise<LoginResponse> {
   const mockUsers = getMockUsers()
   const user = mockUsers.find(u => u.username === data.username)
 
-  if (!user || !(await bcrypt.compare(data.password, MOCK_PASSWORD_HASH))) {
+  if (!user) {
+    throw new Error('Invalid credentials')
+  }
+
+  const passwordHashes = getUserPasswordHashes()
+  const storedHash = passwordHashes.get(user.id)
+  const passwordMatch = storedHash
+    ? await bcrypt.compare(data.password, storedHash)
+    : await bcrypt.compare(data.password, MOCK_PASSWORD_HASH)
+
+  if (!passwordMatch) {
     throw new Error('Invalid credentials')
   }
 
-  let token: string
-  if (user.role === Role.SUPER_ADMIN) {
-    token = `test-super-admin-${user.id}`
-  } else if (user.role === Role.CUSTOMER_SERVICE) {
-    token = `test-customer-service-${user.id}`
-  } else {
-    token = `test-user-${user.id}`
+  const mockTokens = getMockTokens()
+  let token: string | undefined
+  for (const [t, userId] of mockTokens) {
+    if (userId === user.id) {
+      token = t
+      break
+    }
+  }
+  if (!token) {
+    token = `test-token-${user.id}-${Date.now()}`
+    mockTokens.set(token, user.id)
   }
 
   return {
@@ -132,6 +184,8 @@ export async function register(data: RegisterRequest): Promise<User> {
     throw new Error('User already exists')
   }
 
+  const passwordHash = await bcrypt.hash(data.password, 10)
+
   const newUser: User = {
     id: String(mockUsers.length + 1),
     username: data.username,
@@ -144,6 +198,7 @@ export async function register(data: RegisterRequest): Promise<User> {
   }
 
   mockUsers.push(newUser)
+  getUserPasswordHashes().set(newUser.id, passwordHash)
 
   return newUser
 }
@@ -221,6 +276,8 @@ export async function getAllTodos(): Promise<
     createdAt: string
   }>
 > {
+  const todos = await getTodosTable()
+  if (!todos) return []
   const db = await getDb()
   const results = await db.select().from(todos).orderBy(desc(todos.createdAt))
 

package/template/src/server/module-auth/__tests__/auth-service.test.ts

@@ -0,0 +1,239 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from 'vitest'
+import * as authService from '../services/auth-service'
+import { getRawClient, getDb } from '@server/db'
+import { setupTestDatabase, cleanupTestDatabase } from '@server/db/test-setup'
+import { hashSync } from 'bcryptjs'
+
+describe('Auth Service', () => {
+  beforeAll(async () => {
+    await setupTestDatabase()
+    const db = await getDb()
+    expect(db).toBeDefined()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  beforeEach(async () => {
+    const client = await getRawClient()
+    if (client && 'execute' in client) {
+      await client.execute('DELETE FROM developers')
+    }
+  })
+
+  afterEach(async () => {
+    const client = await getRawClient()
+    if (client && 'execute' in client) {
+      await client.execute('DELETE FROM developers')
+    }
+  })
+
+  async function insertTestDeveloper(overrides: Record<string, unknown> = {}) {
+    const client = await getRawClient()
+    if (!client || !('execute' in client)) throw new Error('No DB client')
+
+    const id = (overrides.id as string) || 'dev-test-id'
+    const username = (overrides.username as string) || 'testuser'
+    const email = (overrides.email as string) || 'test@example.com'
+    const passwordHash = (overrides.passwordHash as string) || hashSync('password123', 10)
+    const apiKey = (overrides.apiKey as string) || 'ak_test-api-key'
+    const now = Date.now()
+
+    await client.execute({
+      sql: `INSERT INTO developers (id, username, email, password_hash, role, api_key, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [id, username, email, passwordHash, 'developer', apiKey, now, now],
+    })
+
+    return { id, username, email, apiKey, passwordHash }
+  }
+
+  describe('registerDeveloper', () => {
+    it('should register a new developer successfully', async () => {
+      const result = await authService.registerDeveloper({
+        username: 'newdev',
+        email: 'newdev@example.com',
+        password: 'password123',
+      })
+
+      expect(result.profile).toBeDefined()
+      expect(result.profile.username).toBe('newdev')
+      expect(result.profile.email).toBe('newdev@example.com')
+      expect(result.profile.role).toBe('developer')
+      expect(result.profile.id).toBeDefined()
+      expect(result.profile.createdAt).toBeDefined()
+    })
+
+    it('should hash the password with bcrypt', async () => {
+      await authService.registerDeveloper({
+        username: 'hashtest',
+        email: 'hashtest@example.com',
+        password: 'mypassword',
+      })
+
+      const client = await getRawClient()
+      if (!client || !('execute' in client)) throw new Error('No DB')
+      const result = await client.execute(
+        'SELECT password_hash FROM developers WHERE username = ?',
+        ['hashtest']
+      )
+      const row = result.rows[0] as unknown as { password_hash: string }
+
+      expect(row.password_hash).not.toBe('mypassword')
+      expect(row.password_hash.startsWith('$2')).toBe(true)
+    })
+
+    it('should throw ConflictError on duplicate email', async () => {
+      await insertTestDeveloper({ email: 'duplicate@example.com' })
+
+      await expect(
+        authService.registerDeveloper({
+          username: 'another',
+          email: 'duplicate@example.com',
+          password: 'password123',
+        })
+      ).rejects.toThrow('Duplicate entry')
+    })
+
+    it('should throw ConflictError on duplicate username', async () => {
+      await insertTestDeveloper({ username: 'duplicateuser' })
+
+      await expect(
+        authService.registerDeveloper({
+          username: 'duplicateuser',
+          email: 'other@example.com',
+          password: 'password123',
+        })
+      ).rejects.toThrow('Duplicate entry')
+    })
+
+    it('should generate unique id and api_key', async () => {
+      const r1 = await authService.registerDeveloper({
+        username: 'user1',
+        email: 'user1@example.com',
+        password: 'password123',
+      })
+      const r2 = await authService.registerDeveloper({
+        username: 'user2',
+        email: 'user2@example.com',
+        password: 'password123',
+      })
+
+      expect(r1.profile.id).not.toBe(r2.profile.id)
+    })
+  })
+
+  describe('loginDeveloper', () => {
+    it('should login with email', async () => {
+      await insertTestDeveloper({
+        email: 'login@example.com',
+        username: 'loginuser',
+      })
+
+      const result = await authService.loginDeveloper({
+        email: 'login@example.com',
+        password: 'password123',
+      })
+
+      expect(result.profile).toBeDefined()
+      expect(result.profile.email).toBe('login@example.com')
+      expect(result.profile.username).toBe('loginuser')
+    })
+
+    it('should login with username via account field', async () => {
+      await insertTestDeveloper({
+        email: 'account@example.com',
+        username: 'accountuser',
+      })
+
+      const result = await authService.loginDeveloper({
+        account: 'accountuser',
+        password: 'password123',
+      })
+
+      expect(result.profile).toBeDefined()
+      expect(result.profile.username).toBe('accountuser')
+    })
+
+    it('should login with email via account field', async () => {
+      await insertTestDeveloper({
+        email: 'accountemail@example.com',
+        username: 'accountemailuser',
+      })
+
+      const result = await authService.loginDeveloper({
+        account: 'accountemail@example.com',
+        password: 'password123',
+      })
+
+      expect(result.profile).toBeDefined()
+      expect(result.profile.email).toBe('accountemail@example.com')
+    })
+
+    it('should throw AuthenticationError on wrong password', async () => {
+      await insertTestDeveloper({ email: 'wrongpw@example.com' })
+
+      await expect(
+        authService.loginDeveloper({
+          email: 'wrongpw@example.com',
+          password: 'wrongpassword',
+        })
+      ).rejects.toThrow('Invalid credentials')
+    })
+
+    it('should throw AuthenticationError when user not found', async () => {
+      await expect(
+        authService.loginDeveloper({
+          email: 'nonexistent@example.com',
+          password: 'password123',
+        })
+      ).rejects.toThrow('Invalid credentials')
+    })
+
+    it('should not return passwordHash in profile', async () => {
+      await insertTestDeveloper({ email: 'safe@example.com', username: 'safeuser' })
+
+      const result = await authService.loginDeveloper({
+        email: 'safe@example.com',
+        password: 'password123',
+      })
+
+      const profile = result.profile as Record<string, unknown>
+      expect(profile).not.toHaveProperty('passwordHash')
+      expect(profile).not.toHaveProperty('password_hash')
+    })
+  })
+
+  describe('verifyApiKey', () => {
+    it('should return profile for valid API key', async () => {
+      await insertTestDeveloper({ apiKey: 'ak_valid-key' })
+
+      const profile = await authService.verifyApiKey('ak_valid-key')
+
+      expect(profile).toBeDefined()
+      expect(profile.username).toBe('testuser')
+    })
+
+    it('should throw AuthenticationError for invalid API key', async () => {
+      await expect(authService.verifyApiKey('ak_invalid-key')).rejects.toThrow('Invalid API key')
+    })
+  })
+
+  describe('getDeveloperById', () => {
+    it('should return profile when developer exists', async () => {
+      await insertTestDeveloper({ id: 'dev-find-me' })
+
+      const profile = await authService.getDeveloperById('dev-find-me')
+
+      expect(profile).not.toBeNull()
+      expect(profile!.id).toBe('dev-find-me')
+      expect(profile!.username).toBe('testuser')
+    })
+
+    it('should return null when developer does not exist', async () => {
+      const profile = await authService.getDeveloperById('nonexistent-id')
+
+      expect(profile).toBeNull()
+    })
+  })
+})

package/template/src/server/module-auth/index.ts

@@ -0,0 +1,7 @@
+export { authRoutes } from './routes/auth-routes'
+export type {
+  DeveloperProfile,
+  LoginInput,
+  RegisterInput,
+  TokenResponse,
+} from '@shared/modules/auth'

package/template/src/server/module-auth/module.ts

@@ -0,0 +1,40 @@
+import type { ModuleManifest } from '@shared/core/module-manifest'
+
+const authManifest: ModuleManifest = {
+  name: 'auth',
+  description: 'Developer authentication with registration, login, and API key management',
+  category: 'system',
+  dependsOn: [],
+
+  routes: {
+    client: [
+      {
+        importPath: './routes/auth-routes',
+        exportName: 'authRoutes',
+      },
+      {
+        importPath: './routes/profile-routes',
+        exportName: 'profileRoutes',
+      },
+    ],
+  },
+
+  sharedSchemas: {
+    path: 'auth',
+  },
+
+  clientStores: ['authStore'],
+
+  clientPages: [
+    { name: 'LoginPage', route: '/login' },
+    { name: 'RegisterPage', route: '/register' },
+    { name: 'ProfilePage', route: '/profile' },
+  ],
+
+  dbSchemas: {
+    files: ['developers'],
+    hasSeed: false,
+  },
+}
+
+export default authManifest

package/template/src/server/module-auth/routes/auth-routes.ts

@@ -0,0 +1,94 @@
+import { createRoute } from '@hono/zod-openapi'
+import { OpenAPIHono } from '@hono/zod-openapi'
+import * as authService from '../services/auth-service'
+import {
+  DeveloperProfileSchema,
+  RegisterSchema,
+  LoginSchema,
+  TokenResponseSchema,
+} from '@shared/modules/auth'
+import { successResponse, errorResponse } from '@server/utils/route-helpers'
+import { success, created } from '@server/utils/route-helpers'
+import { ValidationError } from '@server/utils/app-error'
+
+import jwt from 'jsonwebtoken'
+import type { DeveloperProfile } from '@shared/modules/auth'
+
+const secretKey = process.env.AUTH_SECRET_KEY || 'dev-secret-key-change-in-production'
+
+function signToken(profile: DeveloperProfile): string {
+  return jwt.sign(
+    {
+      userId: profile.id,
+      username: profile.username,
+      email: profile.email,
+      role: profile.role,
+    },
+    secretKey,
+    { expiresIn: '7d' }
+  )
+}
+
+const registerRoute = createRoute({
+  method: 'post',
+  path: '/auth/register',
+  tags: ['auth'],
+  request: {
+    body: {
+      content: { 'application/json': { schema: RegisterSchema } },
+    },
+  },
+  responses: {
+    201: successResponse(TokenResponseSchema, 'Register a new developer'),
+    409: errorResponse('Email or username already exists'),
+    400: errorResponse('Invalid input'),
+  },
+})
+
+const loginRoute = createRoute({
+  method: 'post',
+  path: '/auth/login',
+  tags: ['auth'],
+  request: {
+    body: {
+      content: { 'application/json': { schema: LoginSchema } },
+    },
+  },
+  responses: {
+    200: successResponse(TokenResponseSchema, 'Login and get token'),
+    401: errorResponse('Invalid credentials'),
+    400: errorResponse('Invalid input'),
+  },
+})
+
+const verifyRoute = createRoute({
+  method: 'get',
+  path: '/auth/verify',
+  tags: ['auth'],
+  responses: {
+    200: successResponse(DeveloperProfileSchema, 'Verify token and get profile'),
+    401: errorResponse('Unauthorized'),
+  },
+})
+
+export const authRoutes = new OpenAPIHono()
+  .openapi(registerRoute, async c => {
+    const data = c.req.valid('json')
+    const { profile } = await authService.registerDeveloper(data)
+    const token = signToken(profile)
+    return c.json(created({ token, profile }), 201)
+  })
+  .openapi(loginRoute, async c => {
+    const data = c.req.valid('json')
+    const { profile } = await authService.loginDeveloper(data)
+    const token = signToken(profile)
+    return c.json(success({ token, profile }), 200)
+  })
+  .openapi(verifyRoute, async c => {
+    const user = c.get('authUser')
+    const profile = await authService.getDeveloperById(user.id)
+    if (!profile) {
+      throw new ValidationError('Developer profile not found')
+    }
+    return c.json(success(profile), 200)
+  })

package/template/src/server/module-auth/routes/profile-routes.ts

@@ -0,0 +1,31 @@
+import { createRoute } from '@hono/zod-openapi'
+import { OpenAPIHono } from '@hono/zod-openapi'
+import { successResponse } from '@server/utils/route-helpers'
+import { ProfileSchema } from '@shared/schemas'
+
+const getProfileRoute = createRoute({
+  method: 'get',
+  path: '/profile',
+  responses: {
+    200: successResponse(ProfileSchema, 'Get user profile'),
+  },
+})
+
+export const profileRoutes = new OpenAPIHono().openapi(getProfileRoute, async c => {
+  return c.json({
+    success: true as const,
+    data: {
+      id: 'user-1',
+      username: 'Demo User',
+      email: 'demo@example.com',
+      bio: 'A demo user profile',
+      joinDate: new Date().toISOString(),
+      stats: {
+        posts: 12,
+        followers: 48,
+        following: 25,
+      },
+    },
+    timestamp: new Date().toISOString(),
+  })
+})

package/template/src/server/module-auth/services/auth-service.ts

@@ -0,0 +1,100 @@
+import { eq, or } from 'drizzle-orm'
+import { hashSync, compareSync } from 'bcryptjs'
+import type { DeveloperProfile, LoginInput, RegisterInput } from '@shared/modules/auth'
+import { getDb } from '@server/db'
+import { developers, type DeveloperTable } from '@server/db/schema'
+import { ConflictError, AuthenticationError } from '@server/utils/app-error'
+import { generateUUID } from '@server/utils/uuid'
+import { toISOString } from '@server/utils/date'
+
+// eslint-disable-next-line local-rules/no-util-functions-in-service -- module-specific row-to-profile mapping
+function toProfile(row: DeveloperTable): DeveloperProfile {
+  return {
+    id: row.id,
+    username: row.username,
+    email: row.email,
+    role: row.role,
+    createdAt: toISOString(row.createdAt),
+  }
+}
+
+export async function registerDeveloper(
+  input: RegisterInput
+): Promise<{ profile: DeveloperProfile }> {
+  const db = await getDb()
+
+  const existing = await db
+    .select()
+    .from(developers)
+    .where(or(eq(developers.email, input.email), eq(developers.username, input.username)))
+
+  if (existing.length > 0) {
+    const field = existing[0].email === input.email ? 'email' : 'username'
+    throw ConflictError.duplicateEntry(field, input[field as 'email' | 'username'] ?? '')
+  }
+
+  const id = generateUUID()
+  const apiKey = `ak_${generateUUID()}`
+  const passwordHash = hashSync(input.password, 10)
+  const now = new Date()
+
+  await db.insert(developers).values({
+    id,
+    username: input.username,
+    email: input.email,
+    passwordHash,
+    apiKey,
+    createdAt: now,
+    updatedAt: now,
+  })
+
+  const rows = await db.select().from(developers).where(eq(developers.id, id))
+  return { profile: toProfile(rows[0]) }
+}
+
+export async function loginDeveloper(input: LoginInput): Promise<{ profile: DeveloperProfile }> {
+  const db = await getDb()
+
+  const identifier = input.account || input.email
+  if (!identifier) {
+    throw new AuthenticationError('Account or email is required')
+  }
+
+  const rows = await db
+    .select()
+    .from(developers)
+    .where(or(eq(developers.email, identifier), eq(developers.username, identifier)))
+
+  if (rows.length === 0) {
+    throw new AuthenticationError('Invalid credentials')
+  }
+
+  const developer = rows[0]
+  if (!compareSync(input.password, developer.passwordHash)) {
+    throw new AuthenticationError('Invalid credentials')
+  }
+
+  return { profile: toProfile(developer) }
+}
+
+export async function verifyApiKey(apiKey: string): Promise<DeveloperProfile> {
+  const db = await getDb()
+
+  const rows = await db.select().from(developers).where(eq(developers.apiKey, apiKey))
+
+  if (rows.length === 0) {
+    throw new AuthenticationError('Invalid API key')
+  }
+
+  return toProfile(rows[0])
+}
+
+export async function getDeveloperById(id: string): Promise<DeveloperProfile | null> {
+  const db = await getDb()
+
+  const rows = await db.select().from(developers).where(eq(developers.id, id))
+
+  if (rows.length === 0) return null
+
+  return toProfile(rows[0])
+}

package/template/src/server/module-content/module.ts

@@ -7,10 +7,16 @@ const contentManifest: ModuleManifest = {
   dependsOn: ['permission'],
 
   routes: {
-    client: {
-      importPath: './routes/public-content-routes',
-      exportName: 'publicContentRoutes',
-    },
+    client: [
+      {
+        importPath: './routes/public-content-routes',
+        exportName: 'publicContentRoutes',
+      },
+      {
+        importPath: './routes/topics-routes',
+        exportName: 'topicsRoutes',
+      },
+    ],
     admin: [
       {
         importPath: './routes/content-routes',