create-mantiq 0.5.5 → 0.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-mantiq",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Scaffold a new MantiqJS application",
   "type": "module",
   "license": "MIT",

package/skeleton/app/Models/User.ts

@@ -1,5 +1,6 @@
 import { Model } from '@mantiq/database'
 import type { Authenticatable } from '@mantiq/auth'
+import { applyHasApiTokens } from '@mantiq/auth'
 
 export class User extends Model implements Authenticatable {
   static override table = 'users'
@@ -15,4 +16,13 @@ export class User extends Model implements Authenticatable {
   getRememberToken(): string | null { return (this.getAttribute('remember_token') as string) ?? null }
   setRememberToken(token: string | null): void { this.setAttribute('remember_token', token) }
   getRememberTokenName(): string { return 'remember_token' }
+
+  // Token methods: createToken(), tokens(), currentAccessToken(), tokenCan(), tokenCant()
+  declare createToken: (name: string, abilities?: string[], expiresAt?: Date) => Promise<{ accessToken: any; plainTextToken: string }>
+  declare tokens: () => any
+  declare currentAccessToken: () => any
+  declare tokenCan: (ability: string) => boolean
+  declare tokenCant: (ability: string) => boolean
 }
+
+applyHasApiTokens(User)

package/skeleton/config/app.ts

@@ -10,5 +10,5 @@ export default {
   basePath: import.meta.dir + '/..',
 
   // Global middleware applied to every request
-  middleware: ['cors', 'encrypt.cookies', 'session', 'heartbeat'],
+  middleware: ['cors', 'encrypt.cookies', 'session', 'csrf'],
 }

package/src/index.ts

@@ -181,6 +181,24 @@ if (kit) {
       }
     }
   }
+} else {
+  // API-only: overlay token-based auth stubs
+  const stubsDir = resolve(import.meta.dir, '..', 'stubs')
+  const apiOnlyFiles = [
+    { stub: 'api-only/routes/api.ts.stub', target: 'routes/api.ts' },
+    { stub: 'shared/app/Http/Controllers/ApiAuthController.ts.stub', target: 'app/Http/Controllers/ApiAuthController.ts' },
+    { stub: 'shared/database/seeders/DatabaseSeeder.ts.stub', target: 'database/seeders/DatabaseSeeder.ts' },
+    { stub: 'shared/database/factories/UserFactory.ts.stub', target: 'database/factories/UserFactory.ts' },
+  ]
+  for (const { stub, target } of apiOnlyFiles) {
+    const src = resolve(stubsDir, stub)
+    if (existsSync(src)) {
+      const dest = resolve(projectDir, target)
+      mkdirSync(dirname(dest), { recursive: true })
+      await Bun.write(dest, Bun.file(src))
+      fileCount++
+    }
+  }
 }
 console.log(`  ${dim(`${fileCount} files created`)}`)
 

package/stubs/api-only/routes/api.ts.stub

@@ -0,0 +1,119 @@
+import type { Router } from '@mantiq/core'
+import { MantiqResponse } from '@mantiq/core'
+import { ApiAuthController } from '../app/Http/Controllers/ApiAuthController.ts'
+import { User } from '../app/Models/User.ts'
+
+export default function (router: Router) {
+  router.get('/api/ping', () => {
+    return MantiqResponse.json({ status: 'ok', timestamp: new Date().toISOString() })
+  })
+
+  // ── Token Auth ─────────────────────────────────────────────────────────
+  // Sanctum-style: register/login return a bearer token.
+  // Send it as: Authorization: Bearer {token}
+
+  router.post('/api/register', [ApiAuthController, 'register'])
+  router.post('/api/login', [ApiAuthController, 'login'])
+  router.post('/api/logout', [ApiAuthController, 'logout']).middleware('auth:api')
+  router.get('/api/user', [ApiAuthController, 'user']).middleware('auth:api')
+  router.get('/api/tokens', [ApiAuthController, 'tokens']).middleware('auth:api')
+
+  // ── Users CRUD (protected) ────────────────────────────────────────────
+
+  router.get('/api/users', async (request: any) => {
+    const search = request.query('search') ?? ''
+    const page = Math.max(1, Number(request.query('page') ?? 1))
+    const perPage = Math.min(100, Math.max(1, Number(request.query('per_page') ?? 10)))
+    const sortBy = request.query('sort') ?? 'created_at'
+    const sortDir = request.query('dir') === 'asc' ? 'asc' : 'desc'
+
+    let query = User.query()
+
+    if (search) {
+      query = query.where('name', 'LIKE', `%${search}%`)
+        .orWhere('email', 'LIKE', `%${search}%`) as any
+    }
+
+    const total = await (User.query() as any).count() as number
+    const filteredQuery = search
+      ? User.query().where('name', 'LIKE', `%${search}%`).orWhere('email', 'LIKE', `%${search}%`) as any
+      : User.query()
+
+    const filteredTotal = await filteredQuery.count() as number
+
+    const users = search
+      ? await User.query()
+          .where('name', 'LIKE', `%${search}%`)
+          .orWhere('email', 'LIKE', `%${search}%`)
+          .orderBy(sortBy, sortDir)
+          .limit(perPage)
+          .offset((page - 1) * perPage)
+          .get() as any[]
+      : await User.query()
+          .orderBy(sortBy, sortDir)
+          .limit(perPage)
+          .offset((page - 1) * perPage)
+          .get() as any[]
+
+    return MantiqResponse.json({
+      data: users.map((u: any) => u.toObject()),
+      meta: {
+        total,
+        filtered_total: filteredTotal,
+        page,
+        per_page: perPage,
+        last_page: Math.ceil(filteredTotal / perPage),
+      },
+    })
+  }).middleware('auth:api')
+
+  router.post('/api/users', async (request: any) => {
+    const body = await request.input()
+    if (!body?.name || !body?.email || !body?.password) {
+      return MantiqResponse.json({ error: 'Name, email and password are required.' }, 422)
+    }
+
+    const existing = await User.where('email', body.email).first()
+    if (existing) {
+      return MantiqResponse.json({ error: 'Email already exists.' }, 422)
+    }
+
+    const { HashManager } = await import('@mantiq/core')
+    const hasher = new HashManager({ bcrypt: { rounds: 10 } })
+    const user = await User.create({
+      name: body.name,
+      email: body.email,
+      password: await hasher.make(body.password),
+    })
+
+    return MantiqResponse.json({ data: user.toObject() }, 201)
+  }).middleware('auth:api')
+
+  router.put('/api/users/:id', async (request: any) => {
+    const id = request.param('id')
+    const body = await request.input()
+    const user = await User.find(Number(id))
+    if (!user) return MantiqResponse.json({ error: 'User not found.' }, 404)
+
+    if (body.name) user.setAttribute('name', body.name)
+    if (body.email) user.setAttribute('email', body.email)
+
+    if (body.password) {
+      const { HashManager } = await import('@mantiq/core')
+      const hasher = new HashManager({ bcrypt: { rounds: 10 } })
+      user.setAttribute('password', await hasher.make(body.password))
+    }
+
+    await user.save()
+    return MantiqResponse.json({ data: user.toObject() })
+  }).middleware('auth:api')
+
+  router.delete('/api/users/:id', async (request: any) => {
+    const id = request.param('id')
+    const user = await User.find(Number(id))
+    if (!user) return MantiqResponse.json({ error: 'User not found.' }, 404)
+
+    await user.delete()
+    return MantiqResponse.json({ success: true })
+  }).middleware('auth:api')
+}

package/stubs/react/src/pages/Login.tsx.stub

@@ -11,8 +11,8 @@ interface LoginProps {
 }
 
 export default function Login({ appName = 'Mantiq', navigate }: LoginProps) {
-  const [email, setEmail] = useState('admin@example.com')
-  const [password, setPassword] = useState('password')
+  const [email, setEmail] = useState('')
+  const [password, setPassword] = useState('')
   const [error, setError] = useState('')
   const [loading, setLoading] = useState(false)
 
@@ -81,7 +81,7 @@ export default function Login({ appName = 'Mantiq', navigate }: LoginProps) {
                 value={email}
                 onChange={(e) => setEmail(e.target.value)}
                 required
-                placeholder="admin@example.com"
+                placeholder="you@example.com"
                 autoComplete="email"
               />
             </div>

package/stubs/shared/app/Http/Controllers/ApiAuthController.ts.stub

@@ -0,0 +1,119 @@
+import type { MantiqRequest } from '@mantiq/core'
+import { MantiqResponse, HashManager } from '@mantiq/core'
+import { auth } from '@mantiq/auth'
+import { User } from '../../Models/User.ts'
+
+/**
+ * Sanctum-style token authentication for API-only apps.
+ * Issues bearer tokens instead of session cookies.
+ */
+export class ApiAuthController {
+  async register(request: MantiqRequest): Promise<Response> {
+    const body = await request.input() as { name?: string; email?: string; password?: string; device_name?: string }
+
+    if (!body.name || !body.email || !body.password) {
+      return MantiqResponse.json({ error: 'Name, email and password are required.' }, 422)
+    }
+    if (body.password.length < 6) {
+      return MantiqResponse.json({ error: 'Password must be at least 6 characters.' }, 422)
+    }
+
+    const existing = await User.where('email', body.email).first()
+    if (existing) {
+      return MantiqResponse.json({ error: 'A user with this email already exists.' }, 422)
+    }
+
+    const hasher = new HashManager({ bcrypt: { rounds: 10 } })
+    const user = await User.create({
+      name: body.name,
+      email: body.email,
+      password: await hasher.make(body.password),
+    })
+
+    const { plainTextToken } = await (user as any).createToken(
+      body.device_name ?? 'api',
+    )
+
+    return MantiqResponse.json({
+      message: 'Registered.',
+      user: user.toObject(),
+      token: plainTextToken,
+    }, 201)
+  }
+
+  async login(request: MantiqRequest): Promise<Response> {
+    const body = await request.input() as { email?: string; password?: string; device_name?: string }
+
+    if (!body.email || !body.password) {
+      return MantiqResponse.json({ error: 'Email and password are required.' }, 422)
+    }
+
+    const user = await User.where('email', body.email).first()
+    if (!user) {
+      return MantiqResponse.json({ error: 'Invalid credentials.' }, 401)
+    }
+
+    const hasher = new HashManager({ bcrypt: { rounds: 10 } })
+    const valid = await hasher.check(body.password, user.getAuthPassword())
+    if (!valid) {
+      return MantiqResponse.json({ error: 'Invalid credentials.' }, 401)
+    }
+
+    const { plainTextToken } = await (user as any).createToken(
+      body.device_name ?? 'api',
+    )
+
+    return MantiqResponse.json({
+      message: 'Logged in.',
+      user: user.toObject(),
+      token: plainTextToken,
+    })
+  }
+
+  async logout(request: MantiqRequest): Promise<Response> {
+    const manager = auth()
+    manager.setRequest(request)
+    const user = await manager.guard('api').user()
+
+    if (user) {
+      // Revoke the current token
+      const token = (user as any).currentAccessToken?.()
+      if (token) await token.delete()
+    }
+
+    return MantiqResponse.json({ message: 'Token revoked.' })
+  }
+
+  async user(request: MantiqRequest): Promise<Response> {
+    const manager = auth()
+    manager.setRequest(request)
+    const user = await manager.guard('api').user()
+
+    if (!user) {
+      return MantiqResponse.json({ error: 'Unauthenticated.' }, 401)
+    }
+
+    return MantiqResponse.json({ user: (user as any).toObject() })
+  }
+
+  async tokens(request: MantiqRequest): Promise<Response> {
+    const manager = auth()
+    manager.setRequest(request)
+    const user = await manager.guard('api').user()
+
+    if (!user) {
+      return MantiqResponse.json({ error: 'Unauthenticated.' }, 401)
+    }
+
+    const tokens = await (user as any).tokens().get()
+    return MantiqResponse.json({
+      data: tokens.map((t: any) => ({
+        id: t.getKey(),
+        name: t.getAttribute('name'),
+        abilities: JSON.parse(t.getAttribute('abilities') ?? '["*"]'),
+        last_used_at: t.getAttribute('last_used_at'),
+        created_at: t.getAttribute('created_at'),
+      })),
+    })
+  }
+}

package/stubs/svelte/src/pages/Login.svelte.stub

@@ -13,8 +13,8 @@
     [key: string]: any
   } = $props()
 
-  let email = $state('admin@example.com')
-  let password = $state('password')
+  let email = $state('')
+  let password = $state('')
   let error = $state('')
   let loading = $state(false)
 
@@ -82,7 +82,7 @@
             type="email"
             bind:value={email}
             required
-            placeholder="admin@example.com"
+            placeholder="you@example.com"
             autocomplete="email"
           />
         </div>

package/stubs/vue/src/pages/Login.vue.stub

@@ -12,8 +12,8 @@ const props = withDefaults(defineProps<{
   appName: 'Mantiq',
 })
 
-const email = ref('admin@example.com')
-const password = ref('password')
+const email = ref('')
+const password = ref('')
 const error = ref('')
 const loading = ref(false)
 
@@ -82,7 +82,7 @@ async function handleSubmit() {
               v-model="email"
               type="email"
               required
-              placeholder="admin@example.com"
+              placeholder="you@example.com"
               autocomplete="email"
             />
           </div>