create-hazejs 0.0.0-stage → 0.1.2

package/templates/vue/server/database/migrations/meta/0001_snapshot.json

@@ -0,0 +1,78 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "1138ad71-fa8c-4b78-a94a-5dbce374d676",
+  "prevId": "1b28388a-9186-40de-9d67-bb08f562b58c",
+  "tables": {
+    "users": {
+      "name": "users",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "users_email_unique": {
+          "name": "users_email_unique",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}

package/templates/vue/server/database/migrations/meta/0002_snapshot.json

@@ -0,0 +1,86 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "d41d3fc5-5742-40b2-9f99-4f4870f40ebf",
+  "prevId": "1138ad71-fa8c-4b78-a94a-5dbce374d676",
+  "tables": {
+    "users": {
+      "name": "users",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'member'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        }
+      },
+      "indexes": {
+        "users_email_unique": {
+          "name": "users_email_unique",
+          "columns": [
+            "email"
+          ],
+          "isUnique": true
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}

package/templates/vue/server/database/migrations/meta/_journal.json

@@ -0,0 +1,27 @@
+{
+  "version": "7",
+  "dialect": "sqlite",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "6",
+      "when": 1793072281689,
+      "tag": "0000_create_users",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1793084099573,
+      "tag": "0001_add_user_password",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1793086076027,
+      "tag": "0002_add_user_role",
+      "breakpoints": true
+    }
+  ]
+}

package/templates/vue/server/database/schema/users.ts

@@ -0,0 +1,17 @@
+import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core'
+
+// 表结构定义（drizzle）：此文件只依赖 drizzle-orm，不要使用 ~ 别名（drizzle-kit 需要直接读取）
+// 修改后运行 haze db:generate 生成迁移，再 haze db:migrate
+export const users = sqliteTable('users', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  name: text('name').notNull(),
+  email: text('email').notNull().unique(),
+  // 密码哈希（Hash.make()），通过 /api/auth/register 注册的用户才有
+  password: text('password'),
+  // 角色：admin 可以管理所有用户（app/policy/UserPolicy.ts）
+  role: text('role', {
+    enum: ['member', 'admin'],
+  }).notNull().default('member'),
+  createdAt: integer('created_at', { mode: 'timestamp' }),
+  updatedAt: integer('updated_at', { mode: 'timestamp' }),
+})

package/templates/vue/server/database/seeders/01-users.ts

@@ -0,0 +1,15 @@
+import { Hash } from '@hazejs/core'
+import { User } from '~/app/model/User'
+
+/** haze db:seed：按文件名顺序执行 database/seeders 下的文件 */
+export default async function seed(): Promise<void> {
+  if (await User.where('email', 'admin@example.com').exists())
+    return
+  // 开发用账号，上线前请修改密码
+  await User.create({
+    name: 'Admin',
+    email: 'admin@example.com',
+    password: await Hash.make('password'),
+    role: 'admin',
+  })
+}

package/templates/vue/server/route/api.ts

@@ -0,0 +1,24 @@
+import { defineRoutes } from '@hazejs/core'
+import { AuthController } from '~/app/controller/AuthController'
+import { GreetingController } from '~/app/controller/GreetingController'
+import { UserController } from '~/app/controller/UserController'
+import { GreetSchema } from '~/app/validate/greeting'
+import { UserIdParams } from '~/app/validate/user'
+
+export default defineRoutes((r) => {
+  r.group({ prefix: '/api', as: 'api.' }, (r) => {
+    r.get('/hello', [GreetingController, 'index']).name('hello')
+    // 下发 XSRF-TOKEN Cookie（前端首次发起修改类请求前调用，见 src/api.ts）
+    r.get('/csrf-cookie', ctx => ctx.noContent())
+    r.post('/hello', [GreetingController, 'store']).validate({ body: GreetSchema })
+    r.resource('/users', UserController).validateMember({ params: UserIdParams })
+
+    r.group({ prefix: '/auth', as: 'auth.' }, (r) => {
+      r.post('/register', [AuthController, 'register']).name('register')
+      // 登录限流：同一 IP 每分钟最多 10 次
+      r.post('/login', [AuthController, 'login']).middleware('throttle:10,60').name('login')
+      r.get('/me', [AuthController, 'me']).middleware('auth').name('me')
+      r.post('/avatar', [AuthController, 'avatar']).middleware(['auth', 'bodyLimit:3mb']).name('avatar')
+    })
+  })
+})

package/templates/vue/server/route/ws.ts

@@ -0,0 +1,18 @@
+import { defineRoutes } from '@hazejs/core'
+
+/**
+ * WebSocket：ws://<host>/api/ws。升级请求同样经过中间件，需要登录时加 .middleware('auth')。
+ * 服务端任意位置用 Socket.publish('users', data) 推送给订阅者（多实例见 config/websocket.ts）
+ */
+export default defineRoutes((r) => {
+  r.ws('/api/ws', {
+    open(peer) {
+      peer.subscribe('users')
+      peer.send(JSON.stringify({ type: 'connected' }))
+    },
+    message(peer, message) {
+      if (message.text() === 'ping')
+        peer.send(JSON.stringify({ type: 'pong' }))
+    },
+  })
+})

package/templates/vue/server/schedule/app.ts

@@ -0,0 +1,11 @@
+import { defineSchedule } from '@hazejs/core'
+
+/**
+ * 定时任务：haze schedule:work（开发 / 常驻），或系统 cron 每分钟执行 haze schedule:run；
+ * 构建产物：node dist/…/worker.mjs schedule，Workers 为 Cron Triggers，Lambda 为 index.schedule。
+ */
+export default defineSchedule((s) => {
+  s.call('heartbeat', () => {
+    // 示例：替换为清理过期数据、生成报表等；onOneServer 保证多实例时只执行一次
+  }).dailyAt('03:00').onOneServer()
+})

package/templates/vue/src/App.vue

@@ -0,0 +1,92 @@
+<script setup lang="ts">
+import { onMounted, onUnmounted, ref } from 'vue'
+import { api } from '@/api'
+import { chat } from '@/socket'
+
+const title = import.meta.env.VITE_APP_TITLE
+const hello = ref('')
+const name = ref('')
+const reply = ref('')
+const error = ref('')
+const online = ref(0)
+
+onMounted(async () => {
+  chat.on('online', (count: number) => (online.value = count))
+  chat.connect()
+  hello.value = (await api<{ message: string }>('/api/hello')).message
+})
+
+onUnmounted(() => {
+  chat.off('online')
+  chat.disconnect()
+})
+
+async function greet() {
+  error.value = ''
+  try {
+    const data = await api<{ message: string }>('/api/hello', {
+      method: 'POST',
+      body: JSON.stringify({ name: name.value }),
+    })
+    reply.value = data.message
+  }
+  catch (e) {
+    reply.value = ''
+    error.value = (e as Error).message
+  }
+}
+</script>
+
+<template>
+  <main class="page">
+    <h1>{{ title }}</h1>
+    <p class="hello">
+      {{ hello || '加载中…' }}
+    </p>
+    <p class="online">
+      在线 {{ online }} 人（Socket.IO）
+    </p>
+
+    <form class="form" @submit.prevent="greet">
+      <input v-model="name" placeholder="输入名字" aria-label="名字">
+      <button type="submit">
+        打招呼
+      </button>
+    </form>
+    <p v-if="reply" class="reply">
+      {{ reply }}
+    </p>
+    <p v-if="error" class="error">
+      {{ error }}
+    </p>
+
+    <p class="tip">
+      修改 <code>server/app/service/GreetingService.ts</code>，刷新页面即可看到后端变化，无需重启。
+    </p>
+  </main>
+</template>
+
+<style scoped>
+.page {
+  max-width: 560px;
+  margin: 64px auto;
+  padding: 0 16px;
+  font-family: system-ui, sans-serif;
+}
+.form {
+  display: flex;
+  gap: 8px;
+}
+.form input {
+  flex: 1;
+  padding: 6px 10px;
+}
+.error {
+  color: #c0392b;
+}
+.tip {
+  margin-top: 32px;
+  color: #666;
+  font-size: 14px;
+}
+</style>

package/templates/vue/src/api.ts

@@ -0,0 +1,48 @@
+/** 后端统一响应格式 */
+export interface ApiResponse<T> {
+  code: number | string
+  message: string
+  data: T
+  errors?: Array<{ path: string, message: string }>
+}
+
+export class ApiError extends Error {
+  constructor(readonly response: ApiResponse<unknown>) {
+    super(response.errors?.[0]?.message ?? response.message)
+  }
+}
+
+function readCookie(name: string): string | undefined {
+  const match = document.cookie.match(new RegExp(`(?:^|; )${name}=([^;]*)`))
+  return match
+    ? decodeURIComponent(match[1])
+    : undefined
+}
+
+/** CSRF：修改类请求带上 XSRF-TOKEN（没有时先向后端取一次） */
+async function csrfHeader(method: string): Promise<Record<string, string>> {
+  if (['GET', 'HEAD', 'OPTIONS'].includes(method))
+    return {}
+  if (!readCookie('XSRF-TOKEN'))
+    await fetch('/api/csrf-cookie')
+  const token = readCookie('XSRF-TOKEN')
+  return token
+    ? { 'x-xsrf-token': token }
+    : {}
+}
+
+/** 开发时同源请求由 Vite 转给后端，生产环境由同一个 Node 进程处理，无需配置代理 */
+export async function api<T>(path: string, init: RequestInit = {}): Promise<T> {
+  const res = await fetch(path, {
+    ...init,
+    headers: {
+      'content-type': 'application/json',
+      ...await csrfHeader((init.method ?? 'GET').toUpperCase()),
+      ...init.headers,
+    },
+  })
+  const body = await res.json() as ApiResponse<T>
+  if (body.code !== 0)
+    throw new ApiError(body)
+  return body.data
+}

package/templates/vue/src/env.d.ts

@@ -0,0 +1,5 @@
+/// <reference types="vite/client" />
+
+interface ImportMetaEnv {
+  readonly VITE_APP_TITLE: string
+}

package/templates/vue/src/main.ts

@@ -0,0 +1,4 @@
+import { createApp } from 'vue'
+import App from './App.vue'
+
+createApp(App).mount('#app')

package/templates/vue/src/socket.ts

@@ -0,0 +1,5 @@
+import type { Socket } from 'socket.io-client'
+import { io } from 'socket.io-client'
+
+/** Socket.IO 命名空间 /chat（server/app/socket/chat.ts）：与页面同源，开发时由 Vite 开发服务器交给后端 */
+export const chat: Socket = io('/chat', { autoConnect: false })

package/templates/vue/tests/auth.test.ts

@@ -0,0 +1,77 @@
+import { Events, Mail, MailFake, Queue, Storage } from '@hazejs/core'
+import { refreshDatabase } from '@hazejs/orm'
+import { useTestApp } from '@hazejs/testing'
+import { beforeEach, describe, expect, it } from 'vitest'
+import UserRegistered from '~/app/event/UserRegistered'
+import SendWelcomeEmail from '~/app/job/SendWelcomeEmail'
+import WelcomeMail from '~/app/mail/WelcomeMail'
+import { User } from '~/app/model/User'
+
+const t = useTestApp()
+let fake: ReturnType<typeof Queue.fake>
+// 队列改为记录投递，断言后可用 fake.drain() 执行
+beforeEach(() => {
+  fake = Queue.fake()
+})
+beforeEach(() => refreshDatabase({ migrations: 'server/database/migrations' }))
+
+const ada = { name: 'Ada', email: 'ada@example.com', password: 'correct horse' }
+
+describe('auth', () => {
+  it('registers, logs in and reads the current user with a Bearer token', async () => {
+    const registered = await t.post('/api/auth/register', ada)
+    expect(registered.status).toBe(201)
+    expect(registered.body.data.user).toMatchObject({ name: 'Ada', email: 'ada@example.com' })
+    // 密码哈希不会出现在响应中
+    expect(registered.body.data.user).not.toHaveProperty('password')
+    // 注册事件的监听器投递欢迎邮件任务（app/listener/QueueWelcomeEmail.ts）
+    fake.assertDispatched(SendWelcomeEmail, payload => payload.userId === registered.body.data.user.id)
+    // 执行任务：发送欢迎邮件（Mail.fake() 只记录不投递）
+    const mail = Mail.fake()
+    await fake.drain()
+    mail.assertSent(WelcomeMail, sent => MailFake.hasRecipient(sent, ada.email) && sent.message.subject === '欢迎加入，Ada')
+
+    const login = await t.post('/api/auth/login', { email: ada.email, password: ada.password })
+    expect(login.body.data).toMatchObject({ type: 'Bearer', expiresIn: 7200 })
+
+    const me = await t.withHeaders({ authorization: `Bearer ${login.body.data.token}` }).get('/api/auth/me')
+    expect(me.body.data).toMatchObject({ email: 'ada@example.com' })
+  })
+
+  it('emits UserRegistered on registration', async () => {
+    const events = Events.fake([UserRegistered])
+    const registered = await t.post('/api/auth/register', ada)
+    events.assertEmitted(UserRegistered, payload => payload.userId === registered.body.data.user.id && payload.email === ada.email)
+    // 事件被 fake 后监听器不执行，任务也不会投递
+    fake.assertNotDispatched(SendWelcomeEmail)
+  })
+
+  it('rejects wrong passwords and anonymous requests with 401', async () => {
+    await t.post('/api/auth/register', ada)
+    const wrong = await t.post('/api/auth/login', { email: ada.email, password: 'nope' })
+    expect([wrong.status, wrong.body.message]).toEqual([401, '邮箱或密码错误'])
+    expect((await t.get('/api/auth/me')).status).toBe(401)
+  })
+
+  it('actingAs() logs a user in without going through the login endpoint', async () => {
+    const user = await User.create({ name: 'Bob', email: 'bob@example.com' })
+    const me = await (await t.actingAs(user)).get('/api/auth/me')
+    expect(me.body.data).toMatchObject({ id: user.id, email: 'bob@example.com' })
+  })
+
+  it('uploads an avatar to the public disk', async () => {
+    const disk = Storage.fake('public')
+    const user = await User.create({ name: 'Bob', email: 'bob@example.com' })
+    const form = new FormData()
+    form.set('avatar', new File([
+      new Uint8Array([137, 80, 78, 71]),
+    ], 'me.png', { type: 'image/png' }))
+    const res = await (await t.actingAs(user)).post('/api/auth/avatar', form)
+    expect(res.status).toBe(201)
+    expect(res.body.data.url).toBe(`/storage/${res.body.data.path}`)
+    await disk.assertExists(res.body.data.path)
+
+    form.set('avatar', new File(['text'], 'a.txt', { type: 'text/plain' }))
+    expect((await (await t.actingAs(user)).post('/api/auth/avatar', form)).status).toBe(422)
+  })
+})

package/templates/vue/tests/greeting.test.ts

@@ -0,0 +1,29 @@
+import { useTestApp } from '@hazejs/testing'
+import { describe, expect, it } from 'vitest'
+
+const t = useTestApp()
+
+describe('greeting', () => {
+  it('says hello', async () => {
+    const res = await t.get('/api/hello')
+    expect(res.status).toBe(200)
+    expect(res.body).toEqual({
+      code: 0,
+      message: 'ok',
+      data: { app: '{{name}}', message: 'Hello, hazejs!' },
+    })
+  })
+
+  it('greets by name', async () => {
+    const res = await t.post('/api/hello', { name: ' Ada ' })
+    expect(res.body.data).toEqual({ message: 'Hello, Ada!' })
+  })
+
+  it('validates the request body', async () => {
+    const res = await t.post('/api/hello', { name: '' })
+    expect(res.status).toBe(422)
+    expect(res.body.errors).toEqual([
+      { target: 'body', path: 'name', message: 'name 不能为空' },
+    ])
+  })
+})

package/templates/vue/tests/user.test.ts

@@ -0,0 +1,58 @@
+import { refreshDatabase } from '@hazejs/orm'
+import { useTestApp } from '@hazejs/testing'
+import { beforeEach, describe, expect, it } from 'vitest'
+import { User } from '~/app/model/User'
+
+const t = useTestApp()
+// .env.test 中 DATABASE_URL=:memory:，每个用例都是执行过迁移的全新数据库
+beforeEach(() => refreshDatabase({ migrations: 'server/database/migrations' }))
+
+describe('users', () => {
+  it('creates, lists, updates and deletes users', async () => {
+    const created = await t.post('/api/users', { name: ' Ada ', email: 'ada@example.com' })
+    expect(created.status).toBe(201)
+    const ada = created.body.data
+    expect(ada).toMatchObject({ name: 'Ada', email: 'ada@example.com' })
+
+    const list = await t.get('/api/users')
+    expect(list.body.data).toMatchObject({
+      total: 1,
+      data: [
+        { id: ada.id },
+      ],
+    })
+
+    // 修改 / 删除需要登录且为本人（app/policy/UserPolicy.ts）
+    const asAda = await t.actingAs(await User.findOrFail(ada.id))
+    const updated = await asAda.patch(`/api/users/${ada.id}`, { name: 'Ada Lovelace' })
+    expect(updated.body.data.name).toBe('Ada Lovelace')
+
+    expect((await asAda.delete(`/api/users/${ada.id}`)).status).toBe(204)
+    expect((await t.get(`/api/users/${ada.id}`)).status).toBe(404)
+  })
+
+  it('only lets users change themselves, unless they are admins', async () => {
+    const ada = await User.create({ name: 'Ada', email: 'ada@example.com' })
+    const bob = await User.create({ name: 'Bob', email: 'bob@example.com' })
+    const admin = await User.create({ name: 'Admin', email: 'admin@example.com', role: 'admin' })
+
+    expect((await t.patch(`/api/users/${ada.id}`, { name: 'x' })).status).toBe(401)
+    const forbidden = await (await t.actingAs(bob)).patch(`/api/users/${ada.id}`, { name: 'x' })
+    expect([forbidden.status, forbidden.body.message]).toEqual([403, '只能修改自己的资料'])
+    expect((await (await t.actingAs(bob)).delete(`/api/users/${ada.id}`)).status).toBe(403)
+    expect((await (await t.actingAs(admin)).delete(`/api/users/${ada.id}`)).status).toBe(204)
+  })
+
+  it('rejects duplicate emails with 409', async () => {
+    await t.post('/api/users', { name: 'Ada', email: 'ada@example.com' })
+    const res = await t.post('/api/users', { name: 'Copy', email: 'ada@example.com' })
+    expect(res.status).toBe(409)
+    expect(res.body.message).toBe('数据已存在（违反唯一约束）')
+  })
+
+  it('validates input', async () => {
+    const res = await t.post('/api/users', { name: '', email: 'nope' })
+    expect(res.status).toBe(422)
+    expect(res.body.errors.map((e: { path: string }) => e.path)).toEqual(['name', 'email'])
+  })
+})

package/templates/vue/tsconfig.app.json

@@ -0,0 +1,22 @@
+{
+  "compilerOptions": {
+    "composite": true,
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "ES2022",
+    "jsx": "preserve",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "moduleDetection": "force",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "types": ["vite/client"],
+    "strict": true,
+    "noEmit": true,
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true,
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*.ts", "src/**/*.vue"]
+}

package/templates/vue/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.server.json" }
+  ],
+  "files": []
+}