create-fullstack-scaffold 0.4.9 → 0.4.10

package/template/src/server/db/test-setup.ts

@@ -272,6 +272,47 @@ export async function setupTestDatabase(): Promise<void> {
       FOREIGN KEY (category_id) REFERENCES plugin_categories(id) ON DELETE CASCADE,
       UNIQUE(plugin_id, category_id)
     );
+
+    CREATE TABLE IF NOT EXISTS tenants (
+      id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+      name TEXT NOT NULL,
+      slug TEXT NOT NULL UNIQUE,
+      status TEXT NOT NULL DEFAULT 'trial',
+      plan TEXT NOT NULL DEFAULT 'free',
+      max_users INTEGER NOT NULL DEFAULT 5,
+      settings TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS products (
+      id TEXT PRIMARY KEY NOT NULL,
+      name TEXT NOT NULL,
+      description TEXT,
+      price INTEGER NOT NULL,
+      status TEXT NOT NULL DEFAULT 'active',
+      stock INTEGER NOT NULL DEFAULT 0,
+      image_url TEXT,
+      merchant_id INTEGER NOT NULL,
+      created_at INTEGER DEFAULT (unixepoch() * 1000) NOT NULL,
+      updated_at INTEGER DEFAULT (unixepoch() * 1000) NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS merchants (
+      id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+      user_id TEXT NOT NULL,
+      tenant_id INTEGER NOT NULL,
+      business_name TEXT NOT NULL,
+      business_type TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'active',
+      description TEXT,
+      phone TEXT,
+      email TEXT,
+      address TEXT,
+      password TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
   `
 
   const statements = migrationSQL.split(';').filter(s => s.trim())
@@ -699,6 +740,199 @@ async function seedTestData(client: Client): Promise<void> {
       // Ignore duplicate errors
     }
   }
+
+  // Seed tenants for testing
+  const tenants = [
+    {
+      id: 1,
+      name: 'Demo Corp',
+      slug: 'demo',
+      status: 'active',
+      plan: 'pro',
+      max_users: 50,
+      settings: JSON.stringify({ theme: 'dark', language: 'en' }),
+      created_at: new Date(Date.now() - 86400000).toISOString(),
+      updated_at: new Date(Date.now() - 86400000).toISOString(),
+    },
+    {
+      id: 2,
+      name: 'Test Inc',
+      slug: 'test',
+      status: 'trial',
+      plan: 'free',
+      max_users: 5,
+      settings: null,
+      created_at: new Date(Date.now() - 172800000).toISOString(),
+      updated_at: new Date(Date.now() - 172800000).toISOString(),
+    },
+    {
+      id: 3,
+      name: 'Suspended Corp',
+      slug: 'suspended',
+      status: 'suspended',
+      plan: 'starter',
+      max_users: 10,
+      settings: JSON.stringify({ theme: 'light', language: 'zh' }),
+      created_at: new Date(Date.now() - 259200000).toISOString(),
+      updated_at: new Date(Date.now() - 259200000).toISOString(),
+    },
+  ]
+
+  for (const tenant of tenants) {
+    try {
+      await client.execute({
+        sql: `INSERT OR IGNORE INTO tenants (id, name, slug, status, plan, max_users, settings, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          tenant.id,
+          tenant.name,
+          tenant.slug,
+          tenant.status,
+          tenant.plan,
+          tenant.max_users,
+          tenant.settings,
+          tenant.created_at,
+          tenant.updated_at,
+        ],
+      })
+    } catch {
+      // Ignore duplicate errors
+    }
+  }
+
+  // Seed products for testing
+  const products = [
+    {
+      id: 'prod-1',
+      name: '高级无线耳机',
+      description: '降噪蓝牙耳机，支持30小时续航',
+      price: 29900, // 299.00元
+      status: 'active',
+      stock: 100,
+      image_url: 'https://example.com/headphones.jpg',
+      merchant_id: 1, // merchant-1.id
+    },
+    {
+      id: 'prod-2',
+      name: '智能手表 Pro',
+      description: '健康监测、运动追踪，IP68防水',
+      price: 19900, // 199.00元
+      status: 'active',
+      stock: 50,
+      image_url: 'https://example.com/smartwatch.jpg',
+      merchant_id: 1, // merchant-1.id
+    },
+    {
+      id: 'prod-3',
+      name: '机械键盘',
+      description: 'RGB背光，Cherry轴体，87键布局',
+      price: 89900, // 899.00元
+      status: 'active',
+      stock: 30,
+      image_url: 'https://example.com/keyboard.jpg',
+      merchant_id: 2, // merchant-2.id
+    },
+    {
+      id: 'prod-4',
+      name: '4K显示器',
+      description: 'IPS面板，144Hz刷新率，HDR支持',
+      price: 249900, // 2499.00元
+      status: 'inactive',
+      stock: 0,
+      image_url: 'https://example.com/monitor.jpg',
+      merchant_id: 2, // merchant-2.id
+    },
+    {
+      id: 'prod-5',
+      name: '无线鼠标',
+      description: '人体工学设计，可编程按键',
+      price: 19900, // 199.00元
+      status: 'active',
+      stock: 200,
+      image_url: 'https://example.com/mouse.jpg',
+      merchant_id: 1, // merchant-1.id
+    },
+  ]
+
+  for (const product of products) {
+    try {
+      await client.execute({
+        sql: `INSERT OR IGNORE INTO products (id, name, description, price, status, stock, image_url, merchant_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          product.id,
+          product.name,
+          product.description,
+          product.price,
+          product.status,
+          product.stock,
+          product.image_url,
+          product.merchant_id,
+          Date.now(),
+          Date.now(),
+        ],
+      })
+    } catch {
+      // Ignore duplicate errors
+    }
+  }
+
+  // Seed merchants for testing
+  const merchants = [
+    {
+      id: 1,
+      userId: 'merchant-1',
+      tenantId: 1,
+      businessName: '示例商店',
+      businessType: 'retail',
+      status: 'active',
+      description: '一个示例零售商店',
+      phone: '13800138000',
+      email: 'merchant@example.com',
+      address: '北京市朝阳区',
+      password: 'password123',
+      createdAt: '2024-01-01T00:00:00.000Z',
+      updatedAt: '2024-01-01T00:00:00.000Z',
+    },
+    {
+      id: 2,
+      userId: 'merchant-2',
+      tenantId: 1,
+      businessName: '科技商店',
+      businessType: 'retail',
+      status: 'active',
+      description: null,
+      phone: null,
+      email: null,
+      address: null,
+      password: 'password123',
+      createdAt: '2024-01-02T00:00:00.000Z',
+      updatedAt: '2024-01-02T00:00:00.000Z',
+    },
+  ]
+
+  for (const merchant of merchants) {
+    try {
+      await client.execute({
+        sql: `INSERT OR IGNORE INTO merchants (id, user_id, tenant_id, business_name, business_type, status, description, phone, email, address, password, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          merchant.id,
+          merchant.userId,
+          merchant.tenantId,
+          merchant.businessName,
+          merchant.businessType,
+          merchant.status,
+          merchant.description,
+          merchant.phone,
+          merchant.email,
+          merchant.address,
+          merchant.password,
+          merchant.createdAt,
+          merchant.updatedAt,
+        ],
+      })
+    } catch {
+      // Ignore duplicate errors
+    }
+  }
 }
 
 export async function cleanupTestDatabase(): Promise<void> {
@@ -734,5 +968,8 @@ export async function cleanupTestDatabase(): Promise<void> {
     } catch {
       // Plugin tables may not exist in all test environments
     }
+    await client.execute('DELETE FROM tenants')
+    await client.execute('DELETE FROM merchants')
+    await client.execute('DELETE FROM products')
   }
 }

package/template/src/server/middleware/__tests__/audit-log.test.ts

@@ -0,0 +1,144 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { Hono } from 'hono'
+
+vi.mock('@server/utils/auth', () => ({
+  getAuthUser: vi.fn(),
+}))
+
+vi.mock('@server/module-permission/services/audit-log-service', () => ({
+  auditLogService: { create: vi.fn().mockResolvedValue({}) },
+}))
+
+vi.mock('@server/utils/logger', () => ({
+  logger: {
+    api: () => ({
+      info: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+    }),
+  },
+}))
+
+vi.mock('@shared/constants', () => ({
+  PATH_TO_RESOURCE_TYPE: { users: 'user', orders: 'order', todos: 'todo' },
+  ACTION_TYPES: { CREATE: 'create', UPDATE: 'update', DELETE: 'delete' },
+}))
+
+import { auditLogMiddleware } from '../audit-log'
+import { getAuthUser } from '@server/utils/auth'
+import { auditLogService } from '@server/module-permission/services/audit-log-service'
+
+describe('auditLogMiddleware', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  function createApp() {
+    const app = new Hono()
+    app.use('*', auditLogMiddleware())
+    app.get('/api/users', c => c.json({ ok: true }))
+    app.post('/api/users', c => c.json({ ok: true }))
+    app.put('/api/users/:id', c => c.json({ ok: true }))
+    app.delete('/api/users/:id', c => c.json({ ok: true }))
+    app.patch('/api/users/:id', c => c.json({ ok: true }))
+    app.get('/health', c => c.json({ status: 'ok' }))
+    app.get('/api/permissions/check', c => c.json({ ok: true }))
+    return app
+  }
+
+  it('should skip non-API paths', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    await app.request('/health')
+    expect(auditLogService.create).not.toHaveBeenCalled()
+  })
+
+  it('should skip GET requests', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    await app.request('/api/users')
+    expect(auditLogService.create).not.toHaveBeenCalled()
+  })
+
+  it('should skip unauthenticated requests', async () => {
+    vi.mocked(getAuthUser).mockReturnValue(undefined as never)
+    const app = createApp()
+    await app.request('/api/users', { method: 'POST' })
+    expect(auditLogService.create).not.toHaveBeenCalled()
+  })
+
+  it('should skip /api/permissions/ paths', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    await app.request('/api/permissions/check')
+    expect(auditLogService.create).not.toHaveBeenCalled()
+  })
+
+  it('should create audit log for POST with auth', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    const res = await app.request('/api/users', { method: 'POST' })
+    expect(res.status).toBe(200)
+    expect(auditLogService.create).toHaveBeenCalledTimes(1)
+    const call = vi.mocked(auditLogService.create).mock.calls[0][0]
+    expect(call.userId).toBe('user-1')
+    expect(call.action).toBe('create')
+    expect(call.resourceType).toBe('user')
+  })
+
+  it('should create audit log for PUT with update action', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    await app.request('/api/users/123', { method: 'PUT' })
+    const call = vi.mocked(auditLogService.create).mock.calls[0][0]
+    expect(call.action).toBe('update')
+    expect(call.resourceId).toBe('123')
+  })
+
+  it('should create audit log for DELETE with delete action', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    await app.request('/api/users/456', { method: 'DELETE' })
+    const call = vi.mocked(auditLogService.create).mock.calls[0][0]
+    expect(call.action).toBe('delete')
+    expect(call.resourceId).toBe('456')
+  })
+
+  it('should create audit log for PATCH with update action', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    await app.request('/api/users/789', { method: 'PATCH' })
+    const call = vi.mocked(auditLogService.create).mock.calls[0][0]
+    expect(call.action).toBe('update')
+  })
+
+  it('should not throw when auditLogService.create fails', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    vi.mocked(auditLogService.create).mockRejectedValueOnce(new Error('DB error'))
+    const app = createApp()
+    const res = await app.request('/api/users', { method: 'POST' })
+    expect(res.status).toBe(200)
+  })
+
+  it('should capture IP address from headers', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    await app.request('/api/users', {
+      method: 'POST',
+      headers: { 'X-Forwarded-For': '1.2.3.4' },
+    })
+    const call = vi.mocked(auditLogService.create).mock.calls[0][0]
+    expect(call.ipAddress).toBe('1.2.3.4')
+  })
+
+  it('should capture user agent from headers', async () => {
+    vi.mocked(getAuthUser).mockReturnValue({ id: 'user-1' } as never)
+    const app = createApp()
+    await app.request('/api/users', {
+      method: 'POST',
+      headers: { 'User-Agent': 'TestAgent/1.0' },
+    })
+    const call = vi.mocked(auditLogService.create).mock.calls[0][0]
+    expect(call.userAgent).toBe('TestAgent/1.0')
+  })
+})

package/template/src/server/middleware/__tests__/cors.test.ts

@@ -0,0 +1,84 @@
+import { describe, it, expect } from 'vitest'
+import { Hono } from 'hono'
+import { corsMiddleware, createCorsMiddleware } from '../cors'
+
+describe('corsMiddleware', () => {
+  function createApp(options?: Parameters<typeof corsMiddleware>[0]) {
+    const app = new Hono()
+    app.use('*', corsMiddleware(options))
+    app.get('/test', c => c.json({ ok: true }))
+    app.options('/test', c => c.json({ ok: true }))
+    return app
+  }
+
+  it('should set Access-Control-Allow-Origin header', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: { Origin: 'http://localhost:5173' },
+    })
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBeTruthy()
+  })
+
+  it('should set Access-Control-Allow-Credentials to true', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: { Origin: 'http://localhost:5173' },
+    })
+    expect(res.headers.get('Access-Control-Allow-Credentials')).toBe('true')
+  })
+
+  it('should handle OPTIONS preflight request', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      method: 'OPTIONS',
+      headers: { Origin: 'http://localhost:5173' },
+    })
+    expect(res.status).toBe(204)
+  })
+
+  it('should set allowed methods on preflight', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      method: 'OPTIONS',
+      headers: { Origin: 'http://localhost:5173' },
+    })
+    const allowMethods = res.headers.get('Access-Control-Allow-Methods')
+    expect(allowMethods).toBeTruthy()
+    expect(allowMethods).toContain('GET')
+    expect(allowMethods).toContain('POST')
+    expect(allowMethods).toContain('DELETE')
+  })
+
+  it('should set allowed headers on preflight', async () => {
+    const app = createApp()
+    const res = await app.request('/test', {
+      method: 'OPTIONS',
+      headers: { Origin: 'http://localhost:5173' },
+    })
+    const allowHeaders = res.headers.get('Access-Control-Allow-Headers')
+    expect(allowHeaders).toBeTruthy()
+    expect(allowHeaders).toContain('Content-Type')
+    expect(allowHeaders).toContain('Authorization')
+  })
+
+  it('should respect custom origin', async () => {
+    const app = createApp({ origin: 'https://custom.example.com' })
+    const res = await app.request('/test', {
+      headers: { Origin: 'https://custom.example.com' },
+    })
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBe('https://custom.example.com')
+  })
+
+  it('should pass through and return response', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { ok: boolean }
+    expect(json.ok).toBe(true)
+  })
+
+  it('createCorsMiddleware should return same middleware', () => {
+    const mw = createCorsMiddleware({ origin: '*' })
+    expect(typeof mw).toBe('function')
+  })
+})

package/template/src/server/middleware/__tests__/logger.test.ts

@@ -0,0 +1,117 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { Hono } from 'hono'
+
+const mockLog = {
+  info: vi.fn(),
+  warn: vi.fn(),
+  error: vi.fn(),
+  debug: vi.fn(),
+  trace: vi.fn(),
+  fatal: vi.fn(),
+  child: () => mockLog,
+}
+
+vi.mock('@server/utils/logger', () => ({
+  createModuleLoggerSync: () => mockLog,
+  logger: {
+    api: () => mockLog,
+    app: () => mockLog,
+    db: () => mockLog,
+    ws: () => mockLog,
+    bootstrap: () => mockLog,
+    module: () => mockLog,
+  },
+}))
+
+import { loggerMiddleware } from '../logger'
+
+describe('loggerMiddleware', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  function createApp(options?: Parameters<typeof loggerMiddleware>[0]) {
+    const app = new Hono()
+    app.use('*', loggerMiddleware(options))
+    app.get('/test', c => c.json({ ok: true }))
+    app.get('/health', c => c.json({ status: 'ok' }))
+    return app
+  }
+
+  it('should pass through and return response', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { ok: boolean }
+    expect(json.ok).toBe(true)
+  })
+
+  it('should log request and response for non-excluded paths', async () => {
+    const app = createApp()
+    await app.request('/test')
+    expect(mockLog.info).toHaveBeenCalled()
+    const calls = mockLog.info.mock.calls.map(c => c[1])
+    expect(calls).toContain('Request started')
+    expect(calls).toContain('Request completed')
+  })
+
+  it('should skip logging for default excludePaths /health', async () => {
+    const app = createApp()
+    await app.request('/health')
+    expect(mockLog.info).not.toHaveBeenCalled()
+  })
+
+  it('should skip request logging when logRequests is false', async () => {
+    const app = createApp({ logRequests: false })
+    await app.request('/test')
+    const calls = mockLog.info.mock.calls.map(c => c[1])
+    expect(calls).not.toContain('Request started')
+    expect(calls).toContain('Request completed')
+  })
+
+  it('should skip response logging when logResponses is false', async () => {
+    const app = createApp({ logResponses: false })
+    await app.request('/test')
+    const calls = mockLog.info.mock.calls.map(c => c[1])
+    expect(calls).toContain('Request started')
+    expect(calls).not.toContain('Request completed')
+  })
+
+  it('should handle custom excludePaths', async () => {
+    const app = createApp({ excludePaths: ['/custom', '/health'] })
+    app.get('/custom', c => c.json({ ok: true }))
+    await app.request('/custom')
+    expect(mockLog.info).not.toHaveBeenCalled()
+  })
+
+  it('should re-throw errors after logging', async () => {
+    const app = new Hono()
+    app.use('*', loggerMiddleware())
+    app.get('/boom', () => {
+      throw new Error('boom')
+    })
+
+    const res = await app.request('/boom')
+    expect(res.status).toBe(500)
+  })
+
+  it('should skip error logging when logErrors is false', async () => {
+    const app = createApp({ logErrors: false })
+    app.get('/boom', () => {
+      throw new Error('boom')
+    })
+    app.onError((err, c) => c.json({ error: err.message }, 500))
+
+    await app.request('/boom')
+    expect(mockLog.error).not.toHaveBeenCalled()
+  })
+
+  it('should include duration in response log', async () => {
+    const app = createApp()
+    await app.request('/test')
+    const completedCall = mockLog.info.mock.calls.find(c => c[1] === 'Request completed')
+    expect(completedCall).toBeDefined()
+    const fields = completedCall![0] as Record<string, unknown>
+    expect(fields.duration).toBeDefined()
+  })
+})

package/template/src/server/middleware/__tests__/rate-limit.test.ts

@@ -0,0 +1,73 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { Hono } from 'hono'
+import {
+  rateLimitMiddleware,
+  strictRateLimitMiddleware,
+  mediumRateLimitMiddleware,
+  standardRateLimitMiddleware,
+} from '../rate-limit'
+
+describe('rateLimitMiddleware', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  function createApp(options?: Parameters<typeof rateLimitMiddleware>[0]) {
+    const app = new Hono()
+    app.use('*', rateLimitMiddleware(options))
+    app.get('/test', c => c.json({ ok: true }))
+    return app
+  }
+
+  it('should pass through in test environment', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { ok: boolean }
+    expect(json.ok).toBe(true)
+  })
+
+  it('should return response with custom options', async () => {
+    const app = createApp({ windowMs: 1000, max: 5, message: 'Too many' })
+    const res = await app.request('/test')
+    expect(res.status).toBe(200)
+  })
+
+  it('should export preset middlewares', () => {
+    expect(typeof strictRateLimitMiddleware).toBe('function')
+    expect(typeof mediumRateLimitMiddleware).toBe('function')
+    expect(typeof standardRateLimitMiddleware).toBe('function')
+  })
+
+  it('strictRateLimitMiddleware should pass through in test env', async () => {
+    const app = new Hono()
+    app.use('*', strictRateLimitMiddleware)
+    app.get('/test', c => c.json({ ok: true }))
+    const res = await app.request('/test')
+    expect(res.status).toBe(200)
+  })
+
+  it('mediumRateLimitMiddleware should pass through in test env', async () => {
+    const app = new Hono()
+    app.use('*', mediumRateLimitMiddleware)
+    app.get('/test', c => c.json({ ok: true }))
+    const res = await app.request('/test')
+    expect(res.status).toBe(200)
+  })
+
+  it('standardRateLimitMiddleware should pass through in test env', async () => {
+    const app = new Hono()
+    app.use('*', standardRateLimitMiddleware)
+    app.get('/test', c => c.json({ ok: true }))
+    const res = await app.request('/test')
+    expect(res.status).toBe(200)
+  })
+
+  it('should pass through multiple requests in test env', async () => {
+    const app = createApp({ windowMs: 1000, max: 1 })
+    for (let i = 0; i < 10; i++) {
+      const res = await app.request('/test')
+      expect(res.status).toBe(200)
+    }
+  })
+})