create-mantiq 0.5.6 → 0.5.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-mantiq",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Scaffold a new MantiqJS application",
   "type": "module",
   "license": "MIT",

package/skeleton/app/Models/User.ts

@@ -1,5 +1,6 @@
 import { Model } from '@mantiq/database'
 import type { Authenticatable } from '@mantiq/auth'
+import { applyHasApiTokens } from '@mantiq/auth'
 
 export class User extends Model implements Authenticatable {
   static override table = 'users'
@@ -15,4 +16,13 @@ export class User extends Model implements Authenticatable {
   getRememberToken(): string | null { return (this.getAttribute('remember_token') as string) ?? null }
   setRememberToken(token: string | null): void { this.setAttribute('remember_token', token) }
   getRememberTokenName(): string { return 'remember_token' }
+
+  // Token methods: createToken(), tokens(), currentAccessToken(), tokenCan(), tokenCant()
+  declare createToken: (name: string, abilities?: string[], expiresAt?: Date) => Promise<{ accessToken: any; plainTextToken: string }>
+  declare tokens: () => any
+  declare currentAccessToken: () => any
+  declare tokenCan: (ability: string) => boolean
+  declare tokenCant: (ability: string) => boolean
 }
+
+applyHasApiTokens(User)

package/skeleton/config/app.ts

@@ -10,5 +10,5 @@ export default {
   basePath: import.meta.dir + '/..',
 
   // Global middleware applied to every request
-  middleware: ['cors', 'encrypt.cookies', 'session', 'heartbeat'],
+  middleware: ['cors', 'encrypt.cookies', 'session', 'csrf'],
 }

package/src/index.ts

@@ -181,6 +181,24 @@ if (kit) {
       }
     }
   }
+} else {
+  // API-only: overlay token-based auth stubs
+  const stubsDir = resolve(import.meta.dir, '..', 'stubs')
+  const apiOnlyFiles = [
+    { stub: 'api-only/routes/api.ts.stub', target: 'routes/api.ts' },
+    { stub: 'shared/app/Http/Controllers/ApiAuthController.ts.stub', target: 'app/Http/Controllers/ApiAuthController.ts' },
+    { stub: 'shared/database/seeders/DatabaseSeeder.ts.stub', target: 'database/seeders/DatabaseSeeder.ts' },
+    { stub: 'shared/database/factories/UserFactory.ts.stub', target: 'database/factories/UserFactory.ts' },
+  ]
+  for (const { stub, target } of apiOnlyFiles) {
+    const src = resolve(stubsDir, stub)
+    if (existsSync(src)) {
+      const dest = resolve(projectDir, target)
+      mkdirSync(dirname(dest), { recursive: true })
+      await Bun.write(dest, Bun.file(src))
+      fileCount++
+    }
+  }
 }
 console.log(`  ${dim(`${fileCount} files created`)}`)
 

package/stubs/api-only/routes/api.ts.stub

@@ -0,0 +1,119 @@
+import type { Router } from '@mantiq/core'
+import { MantiqResponse } from '@mantiq/core'
+import { ApiAuthController } from '../app/Http/Controllers/ApiAuthController.ts'
+import { User } from '../app/Models/User.ts'
+
+export default function (router: Router) {
+  router.get('/api/ping', () => {
+    return MantiqResponse.json({ status: 'ok', timestamp: new Date().toISOString() })
+  })
+
+  // ── Token Auth ─────────────────────────────────────────────────────────
+  // Sanctum-style: register/login return a bearer token.
+  // Send it as: Authorization: Bearer {token}
+
+  router.post('/api/register', [ApiAuthController, 'register'])
+  router.post('/api/login', [ApiAuthController, 'login'])
+  router.post('/api/logout', [ApiAuthController, 'logout']).middleware('auth:api')
+  router.get('/api/user', [ApiAuthController, 'user']).middleware('auth:api')
+  router.get('/api/tokens', [ApiAuthController, 'tokens']).middleware('auth:api')
+
+  // ── Users CRUD (protected) ────────────────────────────────────────────
+
+  router.get('/api/users', async (request: any) => {
+    const search = request.query('search') ?? ''
+    const page = Math.max(1, Number(request.query('page') ?? 1))
+    const perPage = Math.min(100, Math.max(1, Number(request.query('per_page') ?? 10)))
+    const sortBy = request.query('sort') ?? 'created_at'
+    const sortDir = request.query('dir') === 'asc' ? 'asc' : 'desc'
+
+    let query = User.query()
+
+    if (search) {
+      query = query.where('name', 'LIKE', `%${search}%`)
+        .orWhere('email', 'LIKE', `%${search}%`) as any
+    }
+
+    const total = await (User.query() as any).count() as number
+    const filteredQuery = search
+      ? User.query().where('name', 'LIKE', `%${search}%`).orWhere('email', 'LIKE', `%${search}%`) as any
+      : User.query()
+
+    const filteredTotal = await filteredQuery.count() as number
+
+    const users = search
+      ? await User.query()
+          .where('name', 'LIKE', `%${search}%`)
+          .orWhere('email', 'LIKE', `%${search}%`)
+          .orderBy(sortBy, sortDir)
+          .limit(perPage)
+          .offset((page - 1) * perPage)
+          .get() as any[]
+      : await User.query()
+          .orderBy(sortBy, sortDir)
+          .limit(perPage)
+          .offset((page - 1) * perPage)
+          .get() as any[]
+
+    return MantiqResponse.json({
+      data: users.map((u: any) => u.toObject()),
+      meta: {
+        total,
+        filtered_total: filteredTotal,
+        page,
+        per_page: perPage,
+        last_page: Math.ceil(filteredTotal / perPage),
+      },
+    })
+  }).middleware('auth:api')
+
+  router.post('/api/users', async (request: any) => {
+    const body = await request.input()
+    if (!body?.name || !body?.email || !body?.password) {
+      return MantiqResponse.json({ error: 'Name, email and password are required.' }, 422)
+    }
+
+    const existing = await User.where('email', body.email).first()
+    if (existing) {
+      return MantiqResponse.json({ error: 'Email already exists.' }, 422)
+    }
+
+    const { HashManager } = await import('@mantiq/core')
+    const hasher = new HashManager({ bcrypt: { rounds: 10 } })
+    const user = await User.create({
+      name: body.name,
+      email: body.email,
+      password: await hasher.make(body.password),
+    })
+
+    return MantiqResponse.json({ data: user.toObject() }, 201)
+  }).middleware('auth:api')
+
+  router.put('/api/users/:id', async (request: any) => {
+    const id = request.param('id')
+    const body = await request.input()
+    const user = await User.find(Number(id))
+    if (!user) return MantiqResponse.json({ error: 'User not found.' }, 404)
+
+    if (body.name) user.setAttribute('name', body.name)
+    if (body.email) user.setAttribute('email', body.email)
+
+    if (body.password) {
+      const { HashManager } = await import('@mantiq/core')
+      const hasher = new HashManager({ bcrypt: { rounds: 10 } })
+      user.setAttribute('password', await hasher.make(body.password))
+    }
+
+    await user.save()
+    return MantiqResponse.json({ data: user.toObject() })
+  }).middleware('auth:api')
+
+  router.delete('/api/users/:id', async (request: any) => {
+    const id = request.param('id')
+    const user = await User.find(Number(id))
+    if (!user) return MantiqResponse.json({ error: 'User not found.' }, 404)
+
+    await user.delete()
+    return MantiqResponse.json({ success: true })
+  }).middleware('auth:api')
+}

package/stubs/shared/app/Http/Controllers/ApiAuthController.ts.stub

@@ -0,0 +1,119 @@
+import type { MantiqRequest } from '@mantiq/core'
+import { MantiqResponse, HashManager } from '@mantiq/core'
+import { auth } from '@mantiq/auth'
+import { User } from '../../Models/User.ts'
+
+/**
+ * Sanctum-style token authentication for API-only apps.
+ * Issues bearer tokens instead of session cookies.
+ */
+export class ApiAuthController {
+  async register(request: MantiqRequest): Promise<Response> {
+    const body = await request.input() as { name?: string; email?: string; password?: string; device_name?: string }
+
+    if (!body.name || !body.email || !body.password) {
+      return MantiqResponse.json({ error: 'Name, email and password are required.' }, 422)
+    }
+    if (body.password.length < 6) {
+      return MantiqResponse.json({ error: 'Password must be at least 6 characters.' }, 422)
+    }
+
+    const existing = await User.where('email', body.email).first()
+    if (existing) {
+      return MantiqResponse.json({ error: 'A user with this email already exists.' }, 422)
+    }
+
+    const hasher = new HashManager({ bcrypt: { rounds: 10 } })
+    const user = await User.create({
+      name: body.name,
+      email: body.email,
+      password: await hasher.make(body.password),
+    })
+
+    const { plainTextToken } = await (user as any).createToken(
+      body.device_name ?? 'api',
+    )
+
+    return MantiqResponse.json({
+      message: 'Registered.',
+      user: user.toObject(),
+      token: plainTextToken,
+    }, 201)
+  }
+
+  async login(request: MantiqRequest): Promise<Response> {
+    const body = await request.input() as { email?: string; password?: string; device_name?: string }
+
+    if (!body.email || !body.password) {
+      return MantiqResponse.json({ error: 'Email and password are required.' }, 422)
+    }
+
+    const user = await User.where('email', body.email).first()
+    if (!user) {
+      return MantiqResponse.json({ error: 'Invalid credentials.' }, 401)
+    }
+
+    const hasher = new HashManager({ bcrypt: { rounds: 10 } })
+    const valid = await hasher.check(body.password, user.getAuthPassword())
+    if (!valid) {
+      return MantiqResponse.json({ error: 'Invalid credentials.' }, 401)
+    }
+
+    const { plainTextToken } = await (user as any).createToken(
+      body.device_name ?? 'api',
+    )
+
+    return MantiqResponse.json({
+      message: 'Logged in.',
+      user: user.toObject(),
+      token: plainTextToken,
+    })
+  }
+
+  async logout(request: MantiqRequest): Promise<Response> {
+    const manager = auth()
+    manager.setRequest(request)
+    const user = await manager.guard('api').user()
+
+    if (user) {
+      // Revoke the current token
+      const token = (user as any).currentAccessToken?.()
+      if (token) await token.delete()
+    }
+
+    return MantiqResponse.json({ message: 'Token revoked.' })
+  }
+
+  async user(request: MantiqRequest): Promise<Response> {
+    const manager = auth()
+    manager.setRequest(request)
+    const user = await manager.guard('api').user()
+
+    if (!user) {
+      return MantiqResponse.json({ error: 'Unauthenticated.' }, 401)
+    }
+
+    return MantiqResponse.json({ user: (user as any).toObject() })
+  }
+
+  async tokens(request: MantiqRequest): Promise<Response> {
+    const manager = auth()
+    manager.setRequest(request)
+    const user = await manager.guard('api').user()
+
+    if (!user) {
+      return MantiqResponse.json({ error: 'Unauthenticated.' }, 401)
+    }
+
+    const tokens = await (user as any).tokens().get()
+    return MantiqResponse.json({
+      data: tokens.map((t: any) => ({
+        id: t.getKey(),
+        name: t.getAttribute('name'),
+        abilities: JSON.parse(t.getAttribute('abilities') ?? '["*"]'),
+        last_used_at: t.getAttribute('last_used_at'),
+        created_at: t.getAttribute('created_at'),
+      })),
+    })
+  }
+}