create-fullstack-scaffold 0.4.9 → 0.4.11

package/template/src/server/middleware/__tests__/realtime-env.test.ts

@@ -0,0 +1,56 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { Hono } from 'hono'
+
+vi.mock('@server/core', () => ({
+  setRealtimeEnv: vi.fn(),
+}))
+
+import { realtimeEnvMiddleware } from '../realtime-env'
+import { setRealtimeEnv } from '@server/core'
+
+describe('realtimeEnvMiddleware', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('should call setRealtimeEnv with env when REALTIME_DO exists', async () => {
+    const app = new Hono()
+    app.use('*', realtimeEnvMiddleware())
+    app.get('/test', c => c.json({ ok: true }))
+
+    const realtimeDo = { idFromName: vi.fn(), get: vi.fn() }
+    const res = await app.request('/test', {}, { REALTIME_DO: realtimeDo } as never)
+    expect(res.status).toBe(200)
+    expect(setRealtimeEnv).toHaveBeenCalledWith({ REALTIME_DO: realtimeDo })
+  })
+
+  it('should not call setRealtimeEnv when no env is present', async () => {
+    const app = new Hono()
+    app.use('*', realtimeEnvMiddleware())
+    app.get('/test', c => c.json({ ok: true }))
+
+    const res = await app.request('/test')
+    expect(res.status).toBe(200)
+    expect(setRealtimeEnv).not.toHaveBeenCalled()
+  })
+
+  it('should call setRealtimeEnv even when env has no REALTIME_DO', async () => {
+    const app = new Hono()
+    app.use('*', realtimeEnvMiddleware())
+    app.get('/test', c => c.json({ ok: true }))
+
+    const res = await app.request('/test', {}, {} as never)
+    expect(res.status).toBe(200)
+    expect(setRealtimeEnv).toHaveBeenCalledWith({})
+  })
+
+  it('should pass through to next handler', async () => {
+    const app = new Hono()
+    app.use('*', realtimeEnvMiddleware())
+    app.get('/test', c => c.json({ ok: true }))
+
+    const res = await app.request('/test')
+    const json = (await res.json()) as { ok: boolean }
+    expect(json.ok).toBe(true)
+  })
+})

package/template/src/server/middleware/__tests__/tenant-isolation.test.ts

@@ -0,0 +1,150 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { Hono } from 'hono'
+import { AppError } from '@server/utils/app-error'
+
+vi.mock('@server/db', () => ({
+  getDb: vi.fn().mockResolvedValue({
+    select: vi.fn().mockReturnThis(),
+    from: vi.fn().mockReturnThis(),
+    where: vi.fn().mockResolvedValue([]),
+  }),
+}))
+
+vi.mock('@server/db/schema', () => ({
+  tenants: { slug: 'slug' },
+}))
+
+vi.mock('drizzle-orm', () => ({
+  eq: vi.fn((_col, val) => val),
+}))
+
+vi.mock('@server/utils/logger', () => ({
+  createModuleLoggerSync: () => ({
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  }),
+}))
+
+import { tenantIsolationMiddleware } from '../tenant-isolation'
+import { getDb } from '@server/db'
+
+describe('tenantIsolationMiddleware', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  function mockDbResult(rows: unknown[]) {
+    vi.mocked(getDb).mockResolvedValueOnce({
+      select: vi.fn().mockReturnThis(),
+      from: vi.fn().mockReturnThis(),
+      where: vi.fn().mockResolvedValue(rows),
+    } as never)
+  }
+
+  function createApp() {
+    const app = new Hono()
+    app.onError((err, c) => {
+      if (AppError.isAppError(err)) {
+        return c.json({ success: false, error: err.message }, err.statusCode as 400)
+      }
+      return c.json({ success: false, error: 'Internal error' }, 500)
+    })
+    app.use('*', tenantIsolationMiddleware())
+    app.get('/api/test', c => {
+      const tenant = c.get('tenant')
+      return c.json({ ok: true, tenantId: tenant.id, tenantSlug: tenant.slug })
+    })
+    return app
+  }
+
+  it('should return error when no tenant header or subdomain', async () => {
+    const app = createApp()
+    const res = await app.request('/api/test')
+    expect(res.status).toBe(404)
+  })
+
+  it('should return error when tenant header is empty string', async () => {
+    const app = createApp()
+    const res = await app.request('/api/test', {
+      headers: { 'X-Tenant-Slug': '' },
+    })
+    expect(res.status).toBe(404)
+  })
+
+  it('should pass with valid tenant from header', async () => {
+    mockDbResult([
+      { id: 1, slug: 'test-tenant', name: 'Test', status: 'active', plan: 'free', maxUsers: 10, settings: null },
+    ])
+    const app = createApp()
+    const res = await app.request('/api/test', {
+      headers: { 'X-Tenant-Slug': 'test-tenant' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { ok: boolean; tenantId: number; tenantSlug: string }
+    expect(json.ok).toBe(true)
+    expect(json.tenantId).toBe(1)
+    expect(json.tenantSlug).toBe('test-tenant')
+  })
+
+  it('should return 404 for non-existent tenant', async () => {
+    mockDbResult([])
+    const app = createApp()
+    const res = await app.request('/api/test', {
+      headers: { 'X-Tenant-Slug': 'nonexistent' },
+    })
+    expect(res.status).toBe(404)
+  })
+
+  it('should extract tenant from subdomain when no header', async () => {
+    mockDbResult([
+      { id: 2, slug: 'acme', name: 'Acme', status: 'active', plan: 'pro', maxUsers: 100, settings: null },
+    ])
+    const app = createApp()
+    const res = await app.request('/api/test', {
+      headers: { Host: 'acme.example.com' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { tenantSlug: string }
+    expect(json.tenantSlug).toBe('acme')
+  })
+
+  it('should prefer X-Tenant-Slug header over subdomain', async () => {
+    mockDbResult([
+      { id: 3, slug: 'header-tenant', name: 'Header', status: 'active', plan: 'free', maxUsers: 5, settings: null },
+    ])
+    const app = createApp()
+    const res = await app.request('/api/test', {
+      headers: { Host: 'subdomain.example.com', 'X-Tenant-Slug': 'header-tenant' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { tenantSlug: string }
+    expect(json.tenantSlug).toBe('header-tenant')
+  })
+
+  it('should parse tenant settings JSON', async () => {
+    mockDbResult([
+      { id: 4, slug: 'with-settings', name: 'Settings', status: 'active', plan: 'pro', maxUsers: 50, settings: '{"theme":"dark"}' },
+    ])
+    const app = createApp()
+    const res = await app.request('/api/test', {
+      headers: { 'X-Tenant-Slug': 'with-settings' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { tenantId: number }
+    expect(json.tenantId).toBe(4)
+  })
+
+  it('should handle null settings gracefully', async () => {
+    mockDbResult([
+      { id: 5, slug: 'no-settings', name: 'NoSettings', status: 'active', plan: 'free', maxUsers: 5, settings: null },
+    ])
+    const app = createApp()
+    const res = await app.request('/api/test', {
+      headers: { 'X-Tenant-Slug': 'no-settings' },
+    })
+    expect(res.status).toBe(200)
+    const json = (await res.json()) as { tenantId: number }
+    expect(json.tenantId).toBe(5)
+  })
+})

package/template/src/server/module-admin/__tests__/admin-routes.test.ts

@@ -3,7 +3,7 @@ import { createTestClient } from '@server/test-utils/test-client'
 import { setupTestDatabase, cleanupTestDatabase } from '@server/db/test-setup'
 import { getRawClient } from '@server/db'
 import { Role } from '@shared/modules/permission'
-import * as notificationService from '@server/module-notifications/services/notification-service'
+import * as notificationService from '@server/module-notifications'
 
 function authedClient(token = 'admin-token') {
   return createTestClient(undefined, {

package/template/src/server/module-admin/module.ts

@@ -17,6 +17,10 @@ const adminManifest: ModuleManifest = {
         importPath: './routes/admin-routes',
         exportName: 'adminRoutes',
       },
+      {
+        importPath: './routes/dashboard-routes',
+        exportName: 'dashboardRoutes',
+      },
     ],
   },
 

package/template/src/server/module-admin/routes/admin-notification-routes.ts

@@ -1,7 +1,7 @@
 import { createRoute, z } from '@hono/zod-openapi'
 import { OpenAPIHono } from '@hono/zod-openapi'
 import { authMiddleware, type AuthUser } from '@server/middleware/auth'
-import * as notificationService from '@server/module-notifications/services/notification-service'
+import * as notificationService from '@server/module-notifications'
 import { realtime } from '@server/core'
 import { successResponse, errorResponse, success } from '@server/utils/route-helpers'
 import { logger } from '@server/utils/logger'
@@ -15,7 +15,7 @@ import {
   TestNotificationRequestSchema,
   AppSSEProtocolSchema,
 } from '@shared/modules/notifications'
-import { SuccessSchema } from '@shared/modules/admin'
+import { AdminSuccessSchema } from '@shared/modules/admin'
 
 function createFallbackSSEResponse(): Response {
   const stream = new ReadableStream({
@@ -83,7 +83,7 @@ const markNotificationReadRoute = createRoute({
     }),
   },
   responses: {
-    200: successResponse(SuccessSchema, 'Notification marked as read'),
+    200: successResponse(AdminSuccessSchema, 'Notification marked as read'),
     401: errorResponse('Unauthorized'),
     404: errorResponse('Notification not found'),
   },

package/template/src/server/module-admin/routes/user-management-routes.ts

@@ -9,7 +9,7 @@ import {
   UserListSchema,
   UpdateUserRequestSchema,
   CreateUserRequestSchema,
-  SuccessSchema,
+  AdminSuccessSchema,
 } from '@shared/modules/admin'
 
 const getUsersRoute = createRoute({
@@ -82,7 +82,7 @@ const deleteUserRoute = createRoute({
     }),
   },
   responses: {
-    200: successResponse(SuccessSchema, 'User deleted'),
+    200: successResponse(AdminSuccessSchema, 'User deleted'),
     401: errorResponse('Unauthorized'),
     403: errorResponse('Forbidden'),
     404: errorResponse('User not found'),

package/template/src/server/module-auth/__tests__/auth-routes.test.ts

@@ -0,0 +1,315 @@
+// @vitest-environment node
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from 'vitest'
+import { getRawClient, getDb } from '@server/db'
+import { setupTestDatabase, cleanupTestDatabase } from '@server/db/test-setup'
+import { hashSync } from 'bcryptjs'
+import jwt from 'jsonwebtoken'
+import { authRoutes } from '../routes/auth-routes'
+
+const secretKey = process.env.AUTH_SECRET_KEY || 'dev-secret-key-change-in-production'
+
+describe('Auth Routes', () => {
+  beforeAll(async () => {
+    await setupTestDatabase()
+    const db = await getDb()
+    expect(db).toBeDefined()
+  })
+
+  afterAll(async () => {
+    await cleanupTestDatabase()
+  })
+
+  beforeEach(async () => {
+    const client = await getRawClient()
+    if (client && 'execute' in client) {
+      await client.execute('DELETE FROM developers')
+    }
+  })
+
+  afterEach(async () => {
+    const client = await getRawClient()
+    if (client && 'execute' in client) {
+      await client.execute('DELETE FROM developers')
+    }
+  })
+
+  async function insertTestDeveloper(overrides: Record<string, unknown> = {}) {
+    const client = await getRawClient()
+    if (!client || !('execute' in client)) throw new Error('No DB client')
+
+    const id = (overrides.id as string) || 'dev-test-id'
+    const username = (overrides.username as string) || 'testuser'
+    const email = (overrides.email as string) || 'test@example.com'
+    const passwordHash = (overrides.passwordHash as string) || hashSync('password123', 10)
+    const apiKey = (overrides.apiKey as string) || 'ak_test-api-key'
+    const now = Date.now()
+
+    await client.execute({
+      sql: `INSERT INTO developers (id, username, email, password_hash, role, api_key, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [id, username, email, passwordHash, 'developer', apiKey, now, now],
+    })
+
+    return { id, username, email, apiKey, passwordHash }
+  }
+
+  async function registerUser(username: string, email: string, password: string) {
+    return authRoutes.fetch(
+      new Request('http://localhost/auth/register', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username, email, password }),
+      })
+    )
+  }
+
+  async function loginUser(payload: Record<string, string>) {
+    return authRoutes.fetch(
+      new Request('http://localhost/auth/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
+      })
+    )
+  }
+
+  describe('POST /auth/register', () => {
+    it('should register a new developer and return 201', async () => {
+      const res = await registerUser('newdev', 'newdev@example.com', 'password123')
+
+      expect(res.status).toBe(201)
+      const data = (await res.json()) as { success: boolean; data: { token: string; profile: { username: string; email: string; role: string; id: string } } }
+      expect(data.success).toBe(true)
+      expect(data.data.token).toBeDefined()
+      expect(typeof data.data.token).toBe('string')
+      expect(data.data.profile.username).toBe('newdev')
+      expect(data.data.profile.email).toBe('newdev@example.com')
+      expect(data.data.profile.role).toBe('developer')
+      expect(data.data.profile.id).toBeDefined()
+    })
+
+    it('should return a valid JWT token', async () => {
+      const res = await registerUser('jwtuser', 'jwt@example.com', 'password123')
+      const data = (await res.json()) as { success: boolean; data: { token: string } }
+      expect(data.success).toBe(true)
+
+      const decoded = jwt.verify(data.data.token, secretKey) as jwt.JwtPayload
+      expect(decoded.username).toBe('jwtuser')
+      expect(decoded.email).toBe('jwt@example.com')
+      expect(decoded.role).toBe('developer')
+      expect(decoded.userId).toBeDefined()
+      expect(decoded.exp).toBeGreaterThan(Date.now() / 1000)
+    })
+
+    it('should set token expiry to 7 days', async () => {
+      const res = await registerUser('expiryuser', 'expiry@example.com', 'password123')
+      const data = (await res.json()) as { success: boolean; data: { token: string } }
+
+      const decoded = jwt.verify(data.data.token, secretKey) as jwt.JwtPayload
+      const expectedExp = decoded.iat! + 7 * 24 * 60 * 60
+      expect(decoded.exp).toBe(expectedExp)
+    })
+
+    it('should return error on duplicate email', async () => {
+      await insertTestDeveloper({ email: 'dup@example.com' })
+      const res = await registerUser('another', 'dup@example.com', 'password123')
+      expect(res.status).toBeGreaterThanOrEqual(400)
+    })
+
+    it('should return error on duplicate username', async () => {
+      await insertTestDeveloper({ username: 'dupuser' })
+      const res = await registerUser('dupuser', 'unique@example.com', 'password123')
+      expect(res.status).toBeGreaterThanOrEqual(400)
+    })
+
+    it('should return 400 with missing username', async () => {
+      const res = await authRoutes.fetch(
+        new Request('http://localhost/auth/register', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email: 'noUser@example.com', password: 'password123' }),
+        })
+      )
+      expect(res.status).toBe(400)
+    })
+
+    it('should return 400 with missing email', async () => {
+      const res = await authRoutes.fetch(
+        new Request('http://localhost/auth/register', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ username: 'noemail', password: 'password123' }),
+        })
+      )
+      expect(res.status).toBe(400)
+    })
+
+    it('should return 400 with invalid email format', async () => {
+      const res = await registerUser('bademail', 'not-an-email', 'password123')
+      expect(res.status).toBe(400)
+    })
+
+    it('should return 400 with password shorter than 6 chars', async () => {
+      const res = await registerUser('shortpw', 'short@example.com', '12345')
+      expect(res.status).toBe(400)
+    })
+
+    it('should return 400 with username shorter than 3 chars', async () => {
+      const res = await registerUser('ab', 'shortname@example.com', 'password123')
+      expect(res.status).toBe(400)
+    })
+
+    it('should return 400 with username longer than 50 chars', async () => {
+      const res = await registerUser('a'.repeat(51), 'long@example.com', 'password123')
+      expect(res.status).toBe(400)
+    })
+
+    it('should return profile with createdAt timestamp', async () => {
+      const res = await registerUser('tsuser', 'ts@example.com', 'password123')
+      const data = (await res.json()) as { success: boolean; data: { profile: { createdAt: string } } }
+      expect(data.success).toBe(true)
+      expect(data.data.profile.createdAt).toBeDefined()
+      expect(data.data.profile.createdAt).toMatch(/^\d{4}-\d{2}-\d{2}T/)
+    })
+  })
+
+  describe('POST /auth/login', () => {
+    it('should login with email and return 200', async () => {
+      await insertTestDeveloper({ email: 'login@example.com', username: 'loginuser' })
+
+      const res = await loginUser({ email: 'login@example.com', password: 'password123' })
+
+      expect(res.status).toBe(200)
+      const data = (await res.json()) as { success: boolean; data: { token: string; profile: { email: string; username: string } } }
+      expect(data.success).toBe(true)
+      expect(data.data.token).toBeDefined()
+      expect(data.data.profile.email).toBe('login@example.com')
+      expect(data.data.profile.username).toBe('loginuser')
+    })
+
+    it('should login with account field using username', async () => {
+      await insertTestDeveloper({ email: 'acct@example.com', username: 'acctuser' })
+
+      const res = await loginUser({ account: 'acctuser', password: 'password123' })
+
+      expect(res.status).toBe(200)
+      const data = (await res.json()) as { success: boolean; data: { profile: { username: string } } }
+      expect(data.success).toBe(true)
+      expect(data.data.profile.username).toBe('acctuser')
+    })
+
+    it('should login with account field using email', async () => {
+      await insertTestDeveloper({ email: 'acctemail@example.com', username: 'acctemailuser' })
+
+      const res = await loginUser({ account: 'acctemail@example.com', password: 'password123' })
+
+      expect(res.status).toBe(200)
+      const data = (await res.json()) as { success: boolean; data: { profile: { email: string } } }
+      expect(data.success).toBe(true)
+      expect(data.data.profile.email).toBe('acctemail@example.com')
+    })
+
+    it('should return a valid JWT token', async () => {
+      await insertTestDeveloper({
+        id: 'jwt-login-id',
+        email: 'jwtlogin@example.com',
+        username: 'jwtlogin',
+      })
+
+      const res = await loginUser({ email: 'jwtlogin@example.com', password: 'password123' })
+      const data = (await res.json()) as { success: boolean; data: { token: string } }
+      expect(data.success).toBe(true)
+
+      const decoded = jwt.verify(data.data.token, secretKey) as jwt.JwtPayload
+      expect(decoded.userId).toBe('jwt-login-id')
+      expect(decoded.username).toBe('jwtlogin')
+    })
+
+    it('should return error on wrong password', async () => {
+      await insertTestDeveloper({ email: 'wrongpw@example.com' })
+
+      const res = await loginUser({ email: 'wrongpw@example.com', password: 'wrongpassword' })
+
+      expect(res.status).toBeGreaterThanOrEqual(400)
+    })
+
+    it('should return error with non-existent email', async () => {
+      const res = await loginUser({ email: 'nonexistent@example.com', password: 'password123' })
+
+      expect(res.status).toBeGreaterThanOrEqual(400)
+    })
+
+    it('should return 400 with missing both account and email', async () => {
+      const res = await loginUser({ password: 'password123' })
+      expect(res.status).toBe(400)
+    })
+
+    it('should return 400 with password shorter than 6 chars', async () => {
+      const res = await loginUser({ email: 'any@example.com', password: '12345' })
+      expect(res.status).toBe(400)
+    })
+
+    it('should not return passwordHash in profile', async () => {
+      await insertTestDeveloper({ email: 'safe@example.com', username: 'safeuser' })
+
+      const res = await loginUser({ email: 'safe@example.com', password: 'password123' })
+      const data = (await res.json()) as { success: boolean; data: { profile: Record<string, unknown> } }
+      expect(data.success).toBe(true)
+
+      const profile = data.data.profile as Record<string, unknown>
+      expect(profile).not.toHaveProperty('passwordHash')
+      expect(profile).not.toHaveProperty('password_hash')
+    })
+  })
+
+  describe('Register then Login flow', () => {
+    it('should register and then login with same credentials', async () => {
+      const registerRes = await registerUser('flowuser', 'flow@example.com', 'password123')
+      expect(registerRes.status).toBe(201)
+
+      const loginRes = await loginUser({ email: 'flow@example.com', password: 'password123' })
+      expect(loginRes.status).toBe(200)
+
+      const loginData = (await loginRes.json()) as { success: boolean; data: { profile: { username: string; email: string } } }
+      expect(loginData.success).toBe(true)
+      expect(loginData.data.profile.username).toBe('flowuser')
+      expect(loginData.data.profile.email).toBe('flow@example.com')
+    })
+
+    it('should register and verify token contains correct claims', async () => {
+      const res = await registerUser('verifyflow', 'verifyflow@example.com', 'password123')
+      const data = (await res.json()) as { success: boolean; data: { token: string } }
+      expect(data.success).toBe(true)
+
+      const decoded = jwt.verify(data.data.token, secretKey) as jwt.JwtPayload
+      expect(decoded.username).toBe('verifyflow')
+      expect(decoded.email).toBe('verifyflow@example.com')
+      expect(decoded.role).toBe('developer')
+    })
+
+    it('should register two developers with unique IDs and tokens', async () => {
+      const res1 = await registerUser('user1', 'user1@example.com', 'password123')
+      const res2 = await registerUser('user2', 'user2@example.com', 'password123')
+
+      const data1 = (await res1.json()) as { success: boolean; data: { profile: { id: string }; token: string } }
+      const data2 = (await res2.json()) as { success: boolean; data: { profile: { id: string }; token: string } }
+      expect(data1.success).toBe(true)
+      expect(data2.success).toBe(true)
+      expect(data1.data.profile.id).not.toBe(data2.data.profile.id)
+      expect(data1.data.token).not.toBe(data2.data.token)
+    })
+
+    it('should register, login, and get matching profile data', async () => {
+      const regRes = await registerUser('matchuser', 'match@example.com', 'password123')
+      const regData = (await regRes.json()) as { success: boolean; data: { profile: { id: string; username: string; email: string } } }
+      const regProfile = regData.data.profile
+
+      const loginRes = await loginUser({ email: 'match@example.com', password: 'password123' })
+      const loginData = (await loginRes.json()) as { success: boolean; data: { profile: { id: string; username: string; email: string } } }
+      const loginProfile = loginData.data.profile
+
+      expect(regProfile.id).toBe(loginProfile.id)
+      expect(regProfile.username).toBe(loginProfile.username)
+      expect(regProfile.email).toBe(loginProfile.email)
+    })
+  })
+})

package/template/src/server/module-auth/__tests__/profile-routes.test.ts

@@ -0,0 +1,83 @@
+// @vitest-environment node
+import { describe, it, expect } from 'vitest'
+import { profileRoutes } from '../routes/profile-routes'
+
+describe('Profile Routes', () => {
+  describe('GET /profile', () => {
+    it('should return profile with 200', async () => {
+      const res = await profileRoutes.fetch(new Request('http://localhost/profile'))
+
+      expect(res.status).toBe(200)
+      const data = (await res.json()) as Record<string, any>
+      expect(data.success).toBe(true)
+    })
+
+    it('should return profile with required fields', async () => {
+      const res = await profileRoutes.fetch(new Request('http://localhost/profile'))
+      const data = (await res.json()) as Record<string, any>
+
+      expect(data.success).toBe(true)
+      expect(data.data.id).toBeDefined()
+      expect(data.data.username).toBeDefined()
+      expect(data.data.email).toBeDefined()
+      expect(data.data.joinDate).toBeDefined()
+      expect(data.data.stats).toBeDefined()
+    })
+
+    it('should return valid email format', async () => {
+      const res = await profileRoutes.fetch(new Request('http://localhost/profile'))
+      const data = (await res.json()) as Record<string, any>
+
+      expect(data.success).toBe(true)
+      expect(data.data.email).toMatch(/^[^\s@]+@[^\s@]+\.[^\s@]+$/)
+    })
+
+    it('should return stats with numeric values', async () => {
+      const res = await profileRoutes.fetch(new Request('http://localhost/profile'))
+      const data = (await res.json()) as Record<string, any>
+
+      expect(data.success).toBe(true)
+      expect(typeof data.data.stats.posts).toBe('number')
+      expect(typeof data.data.stats.followers).toBe('number')
+      expect(typeof data.data.stats.following).toBe('number')
+    })
+
+    it('should return a valid ISO date for joinDate', async () => {
+      const res = await profileRoutes.fetch(new Request('http://localhost/profile'))
+      const data = (await res.json()) as Record<string, any>
+
+      expect(data.success).toBe(true)
+      expect(data.data.joinDate).toMatch(/^\d{4}-\d{2}-\d{2}T/)
+    })
+
+    it('should return consistent data across requests', async () => {
+      const res1 = await profileRoutes.fetch(new Request('http://localhost/profile'))
+      const data1 = (await res1.json()) as Record<string, any>
+      const res2 = await profileRoutes.fetch(new Request('http://localhost/profile'))
+      const data2 = (await res2.json()) as Record<string, any>
+
+      expect(data1.success).toBe(true)
+      expect(data2.success).toBe(true)
+      expect(data1.data.id).toBe(data2.data.id)
+      expect(data1.data.username).toBe(data2.data.username)
+      expect(data1.data.email).toBe(data2.data.email)
+    })
+
+    it('should include timestamp in response', async () => {
+      const res = await profileRoutes.fetch(new Request('http://localhost/profile'))
+      const data = (await res.json()) as Record<string, any>
+
+      expect(data.success).toBe(true)
+      expect(data.timestamp).toBeDefined()
+      expect(data.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T/)
+    })
+
+    it('should return bio field', async () => {
+      const res = await profileRoutes.fetch(new Request('http://localhost/profile'))
+      const data = (await res.json()) as Record<string, any>
+
+      expect(data.success).toBe(true)
+      expect(data.data.bio).toBeDefined()
+    })
+  })
+})

package/template/src/server/module-auth/module.ts

@@ -35,6 +35,8 @@ const authManifest: ModuleManifest = {
     files: ['developers'],
     hasSeed: false,
   },
+
+  cliModule: { dir: 'auth', registerFunction: 'registerAuthCommands' },
 }
 
 export default authManifest