create-nextdevtpl 2.6.0

package/template/src/middleware.ts

@@ -0,0 +1,162 @@
+import { type NextRequest, NextResponse } from "next/server";
+import createIntlMiddleware from "next-intl/middleware";
+
+import { routing } from "@/i18n/routing";
+import {
+  checkRateLimit,
+  createRateLimitResponse,
+  getClientIp,
+  getRateLimitHeaders,
+  type RateLimitType,
+} from "@/lib/rate-limit";
+
+/**
+ * 创建国际化中间件
+ */
+const intlMiddleware = createIntlMiddleware(routing);
+
+/**
+ * API 路由限流配置（白名单模式）
+ *
+ * 只对敏感接口做限流，其余放行
+ * 未匹配到的路由不触发 Redis 调用
+ */
+const API_RATE_LIMITS: Array<{ pattern: RegExp; type: RateLimitType }> = [
+  // 认证相关 - 严格限流防暴力破解
+  { pattern: /^\/api\/auth\/sign-in/, type: "auth" },
+  { pattern: /^\/api\/auth\/sign-up/, type: "auth" },
+  { pattern: /^\/api\/auth\/forgot-password/, type: "auth" },
+  { pattern: /^\/api\/auth\/reset-password/, type: "auth" },
+  // 上传相关
+  { pattern: /^\/api\/upload/, type: "upload" },
+];
+
+/**
+ * 获取 API 路由的限流类型
+ *
+ * @returns 限流类型，未匹配返回 null（不限流）
+ */
+function getApiRateLimitType(pathname: string): RateLimitType | null {
+  for (const { pattern, type } of API_RATE_LIMITS) {
+    if (pattern.test(pathname)) {
+      return type;
+    }
+  }
+  return null;
+}
+
+/**
+ * 中间件配置
+ *
+ * 功能:
+ * 1. API 限流（全局 + 路由级别）
+ * 2. 国际化路由处理 (next-intl)
+ * 3. 认证保护 (Better Auth)
+ *    - /dashboard/* 需要登录才能访问
+ *    - 未登录用户将被重定向到 /sign-in
+ */
+export async function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  // ============================================
+  // API 路由限流
+  // ============================================
+  if (pathname.startsWith("/api/")) {
+    // 跳过健康检查和 webhook（webhook 需要验证签名，不应被限流阻断）
+    if (pathname === "/api/health" || pathname.startsWith("/api/webhooks/")) {
+      return NextResponse.next();
+    }
+
+    // 白名单模式：只对匹配的敏感路由做限流
+    const rateLimitType = getApiRateLimitType(pathname);
+    if (rateLimitType) {
+      const ip = getClientIp(request);
+      const result = await checkRateLimit(ip, rateLimitType);
+
+      if (!result.success) {
+        return createRateLimitResponse(result);
+      }
+
+      const response = NextResponse.next();
+      const headers = getRateLimitHeaders(result);
+      for (const [key, value] of Object.entries(headers)) {
+        response.headers.set(key, value);
+      }
+      return response;
+    }
+
+    // 未匹配的 API 路由直接放行，不触发 Redis
+    return NextResponse.next();
+  }
+
+  // ============================================
+  // 非 API 路由：国际化 + 认证保护
+  // ============================================
+
+  // 获取 Better Auth 的 session token
+  const sessionToken =
+    request.cookies.get("better-auth.session_token")?.value ||
+    request.cookies.get("__Secure-better-auth.session_token")?.value;
+
+  // 从路径中提取不带语言前缀的路径
+  // 例如: /en/dashboard -> /dashboard, /zh/sign-in -> /sign-in
+  const pathnameWithoutLocale = pathname.replace(/^\/(en|zh)/, "") || "/";
+
+  // 定义需要保护的路由
+  const protectedRoutes = ["/dashboard"];
+
+  // 定义认证页面路由 (已登录用户不应访问)
+  const authRoutes = ["/sign-in", "/sign-up"];
+
+  // 检查当前路径是否是受保护的路由
+  const isProtectedRoute = protectedRoutes.some(
+    (route) =>
+      pathnameWithoutLocale === route ||
+      pathnameWithoutLocale.startsWith(`${route}/`)
+  );
+
+  // 检查当前路径是否是认证页面
+  const isAuthRoute = authRoutes.some(
+    (route) => pathnameWithoutLocale === route
+  );
+
+  // 获取当前语言前缀 (用于重定向)
+  const localeMatch = pathname.match(/^\/(en|zh)/);
+  const locale = localeMatch ? localeMatch[1] : routing.defaultLocale;
+
+  // 如果访问受保护路由但未登录，重定向到登录页
+  if (isProtectedRoute && !sessionToken) {
+    const signInUrl = new URL(`/${locale}/sign-in`, request.url);
+    // 保存原始 URL，登录后可以重定向回来
+    signInUrl.searchParams.set("callbackUrl", pathname);
+    return NextResponse.redirect(signInUrl);
+  }
+
+  // 如果已登录用户访问认证页面，重定向到 Dashboard
+  if (isAuthRoute && sessionToken) {
+    return NextResponse.redirect(new URL(`/${locale}/dashboard`, request.url));
+  }
+
+  // 执行国际化中间件
+  return intlMiddleware(request);
+}
+
+/**
+ * 中间件匹配配置
+ *
+ * 现在也匹配 API 路由，以便进行全局限流
+ */
+export const config = {
+  matcher: [
+    /*
+     * 匹配所有路径除了:
+     * - _next/static (static files)
+     * - _next/image (image optimization files)
+     * - favicon.ico (favicon file)
+     * - public folder files
+     *
+     * 注意: 现在包含 /api 路由以便进行限流
+     */
+    "/((?!_next/static|_next/image|favicon.ico|sitemap\\.xml|robots\\.txt|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico)$).*)",
+  ],
+};

package/template/src/modules/index.ts

@@ -0,0 +1,10 @@
+export { moduleRegistry } from "./registry";
+export {
+  createModuleSelection,
+  createPresetSelection,
+  type ModuleSelection,
+} from "./selection";
+export {
+  type ModulePresetName,
+  modulePresets,
+} from "./presets";

package/template/src/modules/presets.ts

@@ -0,0 +1,8 @@
+import { MODULE_IDS, type ModuleId } from "@/core/modules";
+
+export const modulePresets = {
+  minimal: ["auth", "dashboard"],
+  full: MODULE_IDS,
+} as const satisfies Record<string, readonly ModuleId[]>;
+
+export type ModulePresetName = keyof typeof modulePresets;

package/template/src/modules/registry.ts

@@ -0,0 +1,34 @@
+import { createModuleRegistry } from "@/core/modules";
+import { adminModule } from "@/features/admin/manifest";
+import { analyticsModule } from "@/features/analytics/manifest";
+import { authModule } from "@/features/auth/manifest";
+import { blogModule } from "@/features/blog/manifest";
+import { creditsModule } from "@/features/credits/manifest";
+import { dashboardModule } from "@/features/dashboard/manifest";
+import { mailModule } from "@/features/mail/manifest";
+import { marketingModule } from "@/features/marketing/manifest";
+import { paymentModule } from "@/features/payment/manifest";
+import { pseoModule } from "@/features/pseo/manifest";
+import { settingsModule } from "@/features/settings/manifest";
+import { sharedModule } from "@/features/shared/manifest";
+import { storageModule } from "@/features/storage/manifest";
+import { subscriptionModule } from "@/features/subscription/manifest";
+import { supportModule } from "@/features/support/manifest";
+
+export const moduleRegistry = createModuleRegistry([
+  sharedModule,
+  mailModule,
+  authModule,
+  subscriptionModule,
+  paymentModule,
+  creditsModule,
+  storageModule,
+  dashboardModule,
+  settingsModule,
+  supportModule,
+  adminModule,
+  analyticsModule,
+  blogModule,
+  marketingModule,
+  pseoModule,
+]);

package/template/src/modules/selection.ts

@@ -0,0 +1,45 @@
+import type { ModuleId, ModuleSchemaGroup } from "@/core/modules";
+
+import { moduleRegistry } from "./registry";
+import { type ModulePresetName, modulePresets } from "./presets";
+import { resolveModuleClosure } from "@/core/modules";
+
+export interface ModuleSelection {
+  modules: readonly ModuleId[];
+  excludedModules: readonly ModuleId[];
+  routeSources: readonly string[];
+  schema: readonly ModuleSchemaGroup[];
+  translations: readonly string[];
+}
+
+export function createModuleSelection(
+  selectedIds: readonly ModuleId[]
+): ModuleSelection {
+  const modules = resolveModuleClosure(moduleRegistry, selectedIds);
+  const selected = new Set(modules);
+  const manifests = modules.map((id) => {
+    const manifest = moduleRegistry.byId.get(id);
+    if (!manifest) {
+      throw new Error(`模块未注册：${id}`);
+    }
+    return manifest;
+  });
+
+  return {
+    modules,
+    excludedModules: moduleRegistry.manifests
+      .map((manifest) => manifest.id)
+      .filter((id) => !selected.has(id)),
+    routeSources: manifests.flatMap((manifest) =>
+      manifest.routes.map((route) => route.source)
+    ),
+    schema: manifests.flatMap((manifest) => manifest.schema),
+    translations: manifests.flatMap((manifest) => manifest.translations),
+  };
+}
+
+export function createPresetSelection(
+  preset: ModulePresetName
+): ModuleSelection {
+  return createModuleSelection(modulePresets[preset]);
+}

package/template/src/services/ai.ts

@@ -0,0 +1,49 @@
+import { createOpenAICompatibleAdapter } from "@/adapters/ai";
+
+export type OpenAICompatibleProvider = "deepseek" | "mimo" | "openai";
+
+export function getAIProvider(): OpenAICompatibleProvider {
+  const provider = process.env.AI_PROVIDER;
+  return provider === "deepseek" || provider === "mimo" ? provider : "openai";
+}
+
+export function getAIModel(): string {
+  switch (getAIProvider()) {
+    case "deepseek":
+      return process.env.DEEPSEEK_MODEL ?? "deepseek-chat";
+    case "mimo":
+      return process.env.MIMO_MODEL ?? "mimo-v2-flash";
+    case "openai":
+      return process.env.OPENAI_MODEL ?? "gpt-4o-mini";
+  }
+}
+
+function createDefaultAIService() {
+  const provider = getAIProvider();
+  const gatewayBaseUrl = process.env.CF_AIG_BASE_URL;
+  const gatewayToken = process.env.CF_AIG_TOKEN;
+  const useGateway = Boolean(gatewayBaseUrl && gatewayToken);
+  const apiKey =
+    provider === "deepseek"
+      ? process.env.DEEPSEEK_API_KEY
+      : provider === "mimo"
+        ? process.env.MIMO_API_KEY
+        : process.env.OPENAI_API_KEY;
+
+  return createOpenAICompatibleAdapter({
+    model: getAIModel(),
+    ...(apiKey ? { apiKey } : {}),
+    ...(provider === "deepseek"
+      ? { baseURL: "https://api.deepseek.com/v1" }
+      : provider === "mimo" && !useGateway
+        ? { baseURL: "https://api.xiaomimimo.com/v1" }
+        : gatewayBaseUrl
+          ? { baseURL: gatewayBaseUrl }
+          : {}),
+    ...(useGateway && gatewayToken
+      ? { defaultHeaders: { "cf-aig-authorization": `Bearer ${gatewayToken}` } }
+      : {}),
+  });
+}
+
+export const aiService = createDefaultAIService();

package/template/src/services/index.ts

@@ -0,0 +1,6 @@
+export { aiService, getAIModel, getAIProvider } from "./ai";
+export { jobService } from "./jobs";
+export { isMailServiceConfigured, mailService } from "./mail";
+export { paymentService } from "./payment";
+export { anonymousQuotaService, rateLimitService } from "./rate-limit";
+export { storageService } from "./storage";

package/template/src/services/jobs.ts

@@ -0,0 +1,3 @@
+import { createInngestJobAdapter } from "@/adapters/jobs";
+
+export const jobService = createInngestJobAdapter();

package/template/src/services/mail.ts

@@ -0,0 +1,7 @@
+import { createResendMailAdapter } from "@/adapters/mail";
+
+export const mailService = createResendMailAdapter();
+
+export function isMailServiceConfigured(): boolean {
+  return Boolean(process.env.RESEND_API_KEY);
+}

package/template/src/services/payment.ts

@@ -0,0 +1,3 @@
+import { createCreemPaymentAdapter } from "@/adapters/payment";
+
+export const paymentService = createCreemPaymentAdapter();

package/template/src/services/rate-limit.ts

@@ -0,0 +1,12 @@
+import {
+  createUpstashServices,
+  noopRateLimitAdapter,
+  noopUsageQuotaAdapter,
+} from "@/adapters/rate-limit";
+
+const url = process.env.UPSTASH_REDIS_REST_URL;
+const token = process.env.UPSTASH_REDIS_REST_TOKEN;
+const upstash = url && token ? createUpstashServices({ url, token }) : null;
+
+export const rateLimitService = upstash?.rateLimit ?? noopRateLimitAdapter;
+export const anonymousQuotaService = upstash?.quota ?? noopUsageQuotaAdapter;

package/template/src/services/storage.ts

@@ -0,0 +1,3 @@
+import { createS3CompatibleStorageAdapter } from "@/adapters/storage";
+
+export const storageService = createS3CompatibleStorageAdapter();

package/template/src/types/fumadocs-source.d.ts

@@ -0,0 +1,14 @@
+declare module "../../.source/server" {
+  import type { InferCollectionsType } from "fumadocs-mdx/config";
+  import type {
+    blog as blogConfig,
+    docs as docsConfig,
+    legal as legalConfig,
+  } from "../../source.config";
+
+  const docs: ReturnType<typeof docsConfig.toFumadocsSource>;
+  const blog: InferCollectionsType<typeof blogConfig>;
+  const legal: InferCollectionsType<typeof legalConfig>;
+
+  export { blog, docs, legal };
+}

package/template/src/types/index.ts

@@ -0,0 +1,2 @@
+// Shared TypeScript type definitions
+export {};

package/template/tsconfig.json

@@ -0,0 +1,53 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["dom", "dom.iterable", "esnext"],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "strictNullChecks": true,
+    "strictFunctionTypes": true,
+    "strictBindCallApply": true,
+    "strictPropertyInitialization": true,
+    "noImplicitAny": true,
+    "noImplicitReturns": true,
+    "noImplicitThis": true,
+    "noUncheckedIndexedAccess": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "exactOptionalPropertyTypes": true,
+    "noFallthroughCasesInSwitch": true,
+    "forceConsistentCasingInFileNames": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": ["./src/*"]
+    }
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts",
+    "**/*.mts"
+  ],
+  "exclude": [
+    "node_modules",
+    "scripts",
+    ".next/dev",
+    "packages/*/dist",
+    "packages/*/template"
+  ]
+}

package/template/vercel.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://openapi.vercel.sh/vercel.json",
+  "framework": "nextjs",
+  "buildCommand": "pnpm build",
+  "crons": [
+    {
+      "path": "/api/jobs/credits/expire",
+      "schedule": "0 0 * * *"
+    }
+  ]
+}

package/template/vitest.config.ts

@@ -0,0 +1,51 @@
+import { resolve } from "node:path";
+import react from "@vitejs/plugin-react";
+import { config } from "dotenv";
+import { defineConfig } from "vitest/config";
+
+// 加载测试环境变量
+config({ path: ".env.test" });
+
+export default defineConfig({
+  plugins: [react()],
+  test: {
+    environment: "node",
+    globals: true,
+    setupFiles: ["./src/test/setup.ts"],
+    include: [
+      "src/test/**/*.{test,spec}.{ts,tsx}",
+      "tests/compatibility/**/*.{test,spec}.{ts,mjs}",
+      "tests/release/**/*.{test,spec}.{ts,mjs}",
+    ],
+    exclude: ["node_modules", ".next", "dist"],
+    // 集成测试需要更长的超时时间
+    testTimeout: 30000,
+    hookTimeout: 30000,
+    // 测试文件和文件内用例均串行执行，避免数据库连接竞争
+    fileParallelism: false,
+    sequence: {
+      concurrent: false,
+    },
+    coverage: {
+      provider: "v8",
+      reporter: ["text", "json", "html"],
+      include: [
+        "src/features/**/*.ts",
+        "src/lib/**/*.ts",
+        "src/config/**/*.ts",
+      ],
+      exclude: [
+        "node_modules/",
+        ".next/",
+        "**/*.config.*",
+        "**/*.d.ts",
+        "**/components/**",
+      ],
+    },
+  },
+  resolve: {
+    alias: {
+      "@": resolve(__dirname, "./src"),
+    },
+  },
+});

package/template/wrangler.jsonc

@@ -0,0 +1,30 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "nextdevtpl",
+  "main": "cloudflare/worker.mjs",
+  "compatibility_date": "2026-07-24",
+  "compatibility_flags": ["nodejs_compat", "global_fetch_strictly_public"],
+  "minify": true,
+  "assets": {
+    "directory": ".open-next/assets",
+    "binding": "ASSETS"
+  },
+  "services": [
+    {
+      "binding": "WORKER_SELF_REFERENCE",
+      "service": "nextdevtpl"
+    }
+  ],
+  "observability": {
+    "enabled": true,
+    "logs": {
+      "enabled": true,
+      "head_sampling_rate": 1,
+      "invocation_logs": true
+    },
+    "traces": {
+      "enabled": true,
+      "head_sampling_rate": 0.1
+    }
+  }
+}