create-lumina-project 1.2.0 → 2.0.0

package/template/src/middlewares/WebAuth.ts

@@ -0,0 +1,122 @@
+import { Request, Response, NextFunction } from 'express';
+import jwt from 'jsonwebtoken';
+import env from '../config/env.js';
+import AuthService from '../services/AuthService.js';
+import Logger from '../utils/Logger.js';
+import { UserPayload } from '../types/express/index.js';
+
+
+class WebAuth {
+  /**
+   * Middleware to protect web routes and redirect to login if not authenticated.
+   */
+  public async handle(req: Request, res: Response, next: NextFunction) {
+    const accessToken = req.cookies?.access_token;
+    const refreshToken = req.cookies?.refresh_token;
+
+    if (!accessToken) {
+      // If no access token, try to refresh
+      if (refreshToken) {
+        return this.silentRefresh(req, res, next, refreshToken);
+      }
+      return res.redirect('/login');
+    }
+
+    try {
+      // Verify access token
+      const decoded = jwt.verify(accessToken, env.JWT_SECRET) as UserPayload;
+      req.user = decoded;
+      next();
+    } catch (error) {
+      // Access token invalid/expired, try refresh
+      if (refreshToken) {
+        return this.silentRefresh(req, res, next, refreshToken);
+      }
+      res.clearCookie('access_token');
+      return res.redirect('/login');
+    }
+  }
+
+  /**
+   * Middleware to detect the user but allow the request to continue.
+   * Useful for public pages that need to know if a user is logged in.
+   */
+  public async detect(req: Request, res: Response, next: NextFunction) {
+    const accessToken = req.cookies?.access_token;
+    const refreshToken = req.cookies?.refresh_token;
+
+    if (!accessToken) {
+      if (refreshToken) {
+        try {
+          const { accessToken: newToken } = await AuthService.refresh(refreshToken);
+          res.cookie('access_token', newToken, {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === 'production',
+            sameSite: 'strict',
+            maxAge: 15 * 60 * 1000,
+          });
+          const decoded = jwt.verify(newToken, env.JWT_SECRET) as UserPayload;
+          req.user = decoded;
+        } catch (error) {
+          // Silent failure
+          Logger.debug('Silent refresh failed in detect middleware');
+        }
+      }
+      return next();
+    }
+
+    try {
+      const decoded = jwt.verify(accessToken, env.JWT_SECRET) as UserPayload;
+      req.user = decoded;
+      next();
+    } catch (error) {
+      // Access token invalid/expired, try silent refresh
+      if (refreshToken) {
+        try {
+          const { accessToken: newToken } = await AuthService.refresh(refreshToken);
+          res.cookie('access_token', newToken, {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === 'production',
+            sameSite: 'strict',
+            maxAge: 15 * 60 * 1000,
+          });
+          const decoded = jwt.verify(newToken, env.JWT_SECRET) as UserPayload;
+          req.user = decoded;
+        } catch (err) {
+          Logger.debug('Silent refresh failed in detect middleware after verify error');
+        }
+      }
+      next();
+    }
+  }
+
+  /**
+   * Attempt to refresh the access token silently.
+   */
+  private async silentRefresh(req: Request, res: Response, next: NextFunction, token: string) {
+    try {
+      const { accessToken } = await AuthService.refresh(token);
+
+      // Set new access token cookie
+      res.cookie('access_token', accessToken, {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'strict',
+        maxAge: 15 * 60 * 1000,
+      });
+
+      // Verify the new token to get user data
+      const decoded = jwt.verify(accessToken, env.JWT_SECRET) as UserPayload;
+      req.user = decoded;
+
+      next();
+    } catch (error) {
+      res.clearCookie('access_token');
+      res.clearCookie('refresh_token');
+      return res.redirect('/login');
+    }
+  }
+}
+
+
+export default new WebAuth();

package/template/src/models/BaseModel.ts

@@ -0,0 +1,24 @@
+import { Model, ModelAttributes, InitOptions } from 'sequelize';
+
+/**
+ * BaseModel provides shared configuration for all models.
+ * It automatically enables Soft Deletes (paranoid), Timestamps, and Underscored naming.
+ */
+export default class BaseModel<TAttributes extends {} = any, TCreationAttributes extends {} = any> 
+  extends Model<TAttributes, TCreationAttributes> {
+  
+  /**
+   * Helper to initialize the model with default options.
+   */
+  public static init<MS extends Model, M extends typeof Model>(
+    attributes: ModelAttributes<MS, any>,
+    options: InitOptions<MS>
+  ): M {
+    return super.init(attributes, {
+      paranoid: true,
+      timestamps: true,
+      underscored: true,
+      ...options,
+    }) as unknown as M;
+  }
+}

package/template/src/models/RefreshToken.ts

@@ -1,4 +1,5 @@
-import { Model, DataTypes, Sequelize, Optional } from 'sequelize';
+import { DataTypes, Sequelize, Optional } from 'sequelize';
+import BaseModel from './BaseModel.js';
 
 interface RefreshTokenAttributes {
   id: number;
@@ -8,11 +9,12 @@ interface RefreshTokenAttributes {
   revoked: boolean;
   created_at?: Date;
   updated_at?: Date;
+  deleted_at?: Date | null;
 }
 
-export interface RefreshTokenCreationAttributes extends Optional<RefreshTokenAttributes, 'id' | 'revoked' | 'created_at' | 'updated_at'> {}
+export interface RefreshTokenCreationAttributes extends Optional<RefreshTokenAttributes, 'id' | 'revoked' | 'created_at' | 'updated_at' | 'deleted_at'> {}
 
-class RefreshToken extends Model<RefreshTokenAttributes, RefreshTokenCreationAttributes> implements RefreshTokenAttributes {
+class RefreshToken extends BaseModel<RefreshTokenAttributes, RefreshTokenCreationAttributes> implements RefreshTokenAttributes {
   declare id: number;
   declare user_id: number;
   declare token: string;
@@ -20,6 +22,7 @@ class RefreshToken extends Model<RefreshTokenAttributes, RefreshTokenCreationAtt
   declare revoked: boolean;
   declare created_at: Date;
   declare updated_at: Date;
+  declare deleted_at: Date | null;
 
   static initModel(sequelize: Sequelize) {
     RefreshToken.init(
@@ -52,8 +55,6 @@ class RefreshToken extends Model<RefreshTokenAttributes, RefreshTokenCreationAtt
         sequelize,
         modelName: 'RefreshToken',
         tableName: 'refresh_tokens',
-        timestamps: true,
-        underscored: true,
       }
     );
   }

package/template/src/models/User.ts

@@ -1,4 +1,5 @@
-import { Model, DataTypes, Sequelize, Optional } from 'sequelize';
+import { DataTypes, Sequelize, Optional } from 'sequelize';
+import BaseModel from './BaseModel.js';
 import Hash from '../utils/Hash.js';
 
 interface UserAttributes {
@@ -16,7 +17,7 @@ interface UserAttributes {
 
 export interface UserCreationAttributes extends Optional<UserAttributes, 'id' | 'created_at' | 'updated_at' | 'deleted_at' | 'role' | 'avatar'> {}
 
-class User extends Model<UserAttributes, UserCreationAttributes> implements UserAttributes {
+class User extends BaseModel<UserAttributes, UserCreationAttributes> implements UserAttributes {
   declare id: number;
   declare firstname: string;
   declare lastname: string;
@@ -68,9 +69,6 @@ class User extends Model<UserAttributes, UserCreationAttributes> implements User
         sequelize,
         modelName: 'User',
         tableName: 'users',
-        paranoid: true,
-        timestamps: true,
-        underscored: true,
         hooks: {
           beforeCreate: async (user: User) => {
             if (user.password) {

package/template/src/routes/api.ts

@@ -1,6 +1,7 @@
 import { Router } from 'express';
 import UserController from '../controllers/UserController.js';
-import Authentication from '../middlewares/Authentication.js';
+import ApiAuth from '../middlewares/ApiAuth.js';
+import RoleGuard from '../middlewares/RoleGuard.js';
 import Validator from '../middlewares/Validator.js';
 import UserRequest from '../requests/UserRequest.js';
 import AuthController from '../controllers/AuthController.js';
@@ -19,17 +20,24 @@ class ApiRoutes {
    * Define all API routes here.
    */
   protected initializeRoutes(): void {
-    // Auth
+    // --- Public Routes ---
     this.router.post('/login', Limiter.auth, AuthController.login);
     this.router.post('/refresh', AuthController.refresh);
-    this.router.post('/logout', Authentication.handle, AuthController.logout);
 
-    // Protected
-    this.router.get('/me', Authentication.handle, AuthController.me);
-    this.router.get('/users', Authentication.handle, UserController.index);
-    this.router.post('/users', Validator.validate(UserRequest.store), UserController.store);
-    this.router.post('/users/avatar', Authentication.handle, StorageService.uploader.single('avatar'), UserController.uploadAvatar);
+    // --- Protected Routes Group ---
+    const protectedRouter = Router();
+    protectedRouter.use(ApiAuth.handle);
+
+    protectedRouter.post('/logout', AuthController.logout);
+    protectedRouter.get('/me', AuthController.me);
+    protectedRouter.get('/users', RoleGuard.allow('admin'), UserController.index);
+    protectedRouter.post('/users', RoleGuard.allow('admin'), Validator.validate(UserRequest.store), UserController.store);
+    protectedRouter.post('/users/avatar', StorageService.uploader.single('avatar'), UserController.uploadAvatar);
+
+    // Mount the group
+    this.router.use(protectedRouter);
   }
 }
 
+
 export default new ApiRoutes().router;

package/template/src/routes/web.ts

@@ -1,6 +1,6 @@
-import { Router, Request, Response } from 'express';
-import path from 'path';
-import db from '../models/index.js';
+import { Router } from 'express';
+import WebController from '../controllers/WebController.js';
+import Csrf from '../middlewares/Csrf.js';
 
 class WebRoutes {
   public router: Router;
@@ -11,48 +11,15 @@ class WebRoutes {
   }
 
   protected initializeRoutes(): void {
-    // Home Route
-    this.router.get('/', (req: Request, res: Response) => {
-      const viewPath = path.join(process.cwd(), 'views', 'welcome.html');
-      res.sendFile(viewPath);
-    });
+    // Apply CSRF protection to all web routes
+    this.router.use(Csrf.handle);
 
-    // Status Route (HTML view)
-    this.router.get('/status', (req: Request, res: Response) => {
-      const viewPath = path.join(process.cwd(), 'views', 'status.html');
-      res.sendFile(viewPath);
-    });
+    // --- Public Routes ---
+    this.router.get('/', WebController.index);
+    this.router.get('/status', WebController.status);
+    this.router.get('/health', WebController.health);
 
-    // Status JSON API (used by the status view)
-    this.router.get('/status/json', (req: Request, res: Response) => {
-      res.json({
-        status: 'UP',
-        environment: process.env.NODE_ENV,
-        uptime: process.uptime(),
-        memoryMB: (process.memoryUsage().rss / 1024 / 1024).toFixed(1),
-      });
-    });
-
-    // Health Check (for container/orchestration probes)
-    this.router.get('/health', async (req: Request, res: Response) => {
-      try {
-        await db.sequelize.authenticate();
-        res.json({
-          status: 'healthy',
-          uptime: process.uptime(),
-          database: 'connected',
-          timestamp: new Date().toISOString(),
-        });
-      } catch {
-        res.status(503).json({
-          status: 'unhealthy',
-          uptime: process.uptime(),
-          database: 'disconnected',
-          timestamp: new Date().toISOString(),
-        });
-      }
-    });
   }
 }
 
-export default new WebRoutes().router;
+export default new WebRoutes().router;

package/template/src/server.ts

@@ -0,0 +1,115 @@
+import express, { Application } from 'express';
+import cors from 'cors';
+import helmet from 'helmet';
+import compression from 'compression';
+import cookieParser from 'cookie-parser';
+import path from 'path';
+import db from './models/index.js';
+import RouteService from './services/RouteService.js';
+import ExceptionHandler from './exceptions/Handler.js';
+import Logger from './utils/Logger.js';
+import Limiter from './middlewares/Limiter.js';
+import Maintenance from './middlewares/Maintenance.js';
+import RequestLogger from './middlewares/RequestLogger.js';
+import env from './config/env.js';
+import InertiaMiddleware from './middlewares/InertiaMiddleware.js';
+import WebAuth from './middlewares/WebAuth.js';
+
+const app: Application = express();
+const PORT = env.APP_PORT;
+
+// ==========================
+// Global Middleware
+// ==========================
+app.use(Maintenance.handle);
+app.use(helmet({
+  crossOriginResourcePolicy: false,
+  contentSecurityPolicy: env.NODE_ENV === 'production' ? undefined : false,
+}));
+app.use(cors({
+  origin: env.CORS_ORIGIN,
+  credentials: true,
+}));
+app.use(compression());
+app.use(cookieParser());
+app.use(express.json({ limit: '10kb' }));
+app.use(express.urlencoded({ extended: true, limit: '10kb' }));
+
+// User detection and Inertia
+app.use(WebAuth.detect.bind(WebAuth));
+app.use(InertiaMiddleware.handle);
+
+app.use(express.static(path.join(process.cwd(), 'public')));
+app.use(Limiter.global);
+app.use(RequestLogger.handle);
+
+// ==========================
+// Register Routes
+// ==========================
+// This loads both your API and Web routes
+RouteService.boot(app);
+
+// ==========================
+// Error Handling
+// ==========================
+
+// 404 Not Found Handler
+app.use(ExceptionHandler.notFound);
+
+// Global Error Handler
+app.use(ExceptionHandler.handle);
+
+// ==========================
+// Start Server
+// ==========================
+let server: ReturnType<typeof app.listen>;
+
+const start = async () => {
+  try {
+    // Test Database Connection
+    await db.connect();
+
+    // Start Listening
+    server = app.listen(PORT, () => {
+      Logger.info(`Server running on http://localhost:${PORT}`);
+    });
+  } catch (error) {
+    Logger.error('Unable to connect to the database:', error);
+    process.exit(1);
+  }
+};
+
+// ==========================
+// Graceful Shutdown
+// ==========================
+const shutdown = async (signal: string) => {
+  Logger.info(`${signal} received. Shutting down gracefully...`);
+
+  if (server) {
+    server.close(async () => {
+      Logger.info('HTTP server closed.');
+
+      try {
+        await db.sequelize.close();
+        Logger.info('Database connection closed.');
+      } catch (error) {
+        Logger.error('Error closing database connection:', error);
+      }
+
+      process.exit(0);
+    });
+
+    // Force shutdown after 10 seconds
+    setTimeout(() => {
+      Logger.error('Forced shutdown after timeout.');
+      process.exit(1);
+    }, 10000);
+  } else {
+    process.exit(0);
+  }
+};
+
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+process.on('SIGINT', () => shutdown('SIGINT'));
+
+start();

package/template/src/types/express/index.d.ts

@@ -1,9 +1,16 @@
 import { JwtPayload } from 'jsonwebtoken';
 
+
+export interface UserPayload extends JwtPayload {
+  id: number;
+  email: string;
+  role: string;
+}
+
 declare global {
   namespace Express {
     interface Request {
-      user?: string | JwtPayload | any;
+      user?: UserPayload;
     }
   }
 }

package/template/src/types/express-inertia.d.ts

@@ -0,0 +1,28 @@
+declare module 'inertia-node' {
+  import { Request, Response, NextFunction } from 'express';
+
+  export interface Inertia {
+    render(page: { component: string; props?: Record<string, any> }): void;
+    shareProps(props: Record<string, any>): void;
+    setViewData(data: Record<string, any>): void;
+    redirect(url?: string): void;
+  }
+
+  function inertia(
+    html: (page: string) => string,
+    version?: string | (() => string)
+  ): (req: Request, res: Response, next: NextFunction) => void;
+
+  export default inertia;
+}
+
+declare namespace Express {
+  export interface Request {
+    Inertia: import('inertia-node').Inertia;
+  }
+
+  export interface Response {
+    inertia(component: string, props?: Record<string, any>): void;
+    flash(type: 'success' | 'error' | 'info' | 'warning' | string, message: string): void;
+  }
+}

package/template/vite.config.ts

@@ -0,0 +1,20 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+
+export default defineConfig({
+  plugins: [react()],
+  build: {
+    outDir: 'public/build',
+    manifest: true,
+    rollupOptions: {
+      input: 'resources/js/app.tsx',
+    },
+  },
+  server: {
+    strictPort: true,
+    port: 5173,
+    hmr: {
+      host: 'localhost',
+    },
+  },
+});