create-nexwire 4.0.0 → 4.1.0

package/hono/src/modules/auth/services/resetpassword.ts

@@ -0,0 +1,69 @@
+import { and, eq, gt } from "drizzle-orm";
+import { db, password } from "@/framework/facade.js";
+import { passwordResetTokens, refreshTokens, users } from "@/modules/auth/database/models/user.js";
+import { hashResetToken } from "@/modules/auth/helpers/auth.js";
+import type { ResetPasswordInput } from "@/modules/auth/types/auth.js";
+
+export type ResetPasswordResult = { kind: "invalid_token"; message: string } | { kind: "reset"; message: string };
+
+export const resetPasswordService = {
+  resetPassword: async (body: ResetPasswordInput): Promise<ResetPasswordResult> => {
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (!user) {
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired reset token"
+      };
+    }
+
+    const hashedPassword = await password.hashPassword(body.password);
+    const hashedToken = hashResetToken(body.token);
+    const now = new Date();
+
+    try {
+      const consumed = await db.transaction(async (tx) => {
+        // Consume the token atomically inside the transaction.
+        // If anything below fails, the delete rolls back and the
+        // user can retry with the same token.
+        const [row] = await tx
+          .delete(passwordResetTokens)
+          .where(
+            and(
+              eq(passwordResetTokens.email, body.email),
+              eq(passwordResetTokens.token, hashedToken),
+              gt(passwordResetTokens.expiresAt, now)
+            )
+          )
+          .returning();
+
+        if (!row) return false;
+
+        await tx.update(users).set({ password: hashedPassword, updatedAt: now }).where(eq(users.id, user.id));
+
+        await tx.update(refreshTokens).set({ revoked: 1 }).where(eq(refreshTokens.userId, user.id));
+
+        return true;
+      });
+
+      if (!consumed) {
+        return {
+          kind: "invalid_token",
+          message: "Invalid or expired reset token"
+        };
+      }
+
+      return { kind: "reset", message: "Password reset successfully" };
+    } catch (err) {
+      // Token was NOT consumed — the transaction rolled back, so the
+      // user can retry with the same token. Log so failures aren't silent.
+      // logger.error({ err, email: body.email }, "password reset failed");
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired reset token"
+      };
+    }
+  }
+};

package/hono/src/modules/auth/services/verifyemail.ts

@@ -0,0 +1,77 @@
+import { and, eq, gt } from "drizzle-orm";
+import { authConfig } from "@/config/index.js";
+import { db } from "@/framework/facade.js";
+import { emailVerificationTokens, users } from "@/modules/auth/database/models/user.js";
+import { hashEmailVerificationToken } from "@/modules/auth/helpers/auth.js";
+import type { VerifyEmailInput } from "@/modules/auth/types/auth.js";
+
+export type VerifyEmailResult =
+  | { kind: "not_required"; message: string }
+  | { kind: "invalid_token"; message: string }
+  | { kind: "verified"; message: string };
+
+export const verifyEmailService = {
+  verifyEmail: async (body: VerifyEmailInput): Promise<VerifyEmailResult> => {
+    if (!authConfig.requireEmailVerification) {
+      return {
+        kind: "not_required",
+        message: "Email verification is not required"
+      };
+    }
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (!user) {
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired verification token"
+      };
+    }
+
+    const hashedToken = hashEmailVerificationToken(body.token);
+    const now = new Date();
+
+    try {
+      const verified = await db.transaction(async (tx) => {
+        // Consume the token atomically INSIDE the transaction.
+        // If the update below fails, the delete rolls back and the
+        // user can retry with the same token.
+        const [consumed] = await tx
+          .delete(emailVerificationTokens)
+          .where(
+            and(
+              eq(emailVerificationTokens.email, body.email),
+              eq(emailVerificationTokens.token, hashedToken),
+              gt(emailVerificationTokens.expiresAt, now)
+            )
+          )
+          .returning();
+
+        if (!consumed) return false;
+
+        await tx.update(users).set({ emailVerifiedAt: now, updatedAt: now }).where(eq(users.id, user.id));
+
+        return true;
+      });
+
+      if (!verified) {
+        return {
+          kind: "invalid_token",
+          message: "Invalid or expired verification token"
+        };
+      }
+
+      return { kind: "verified", message: "Email verified successfully" };
+    } catch (err) {
+      // Token was NOT consumed — the transaction rolled back, so the
+      // user can retry with the same token. Log so failures aren't silent.
+      // logger.error({ err, email: body.email }, "email verification failed");
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired verification token"
+      };
+    }
+  }
+};

package/hono/src/modules/auth/types/auth.ts

@@ -0,0 +1,31 @@
+export type RegisterInput = {
+  name: string;
+  email: string;
+  password: string;
+  remember?: boolean;
+};
+
+export type LoginInput = {
+  email: string;
+  password: string;
+  remember?: boolean;
+};
+
+export type ForgotPasswordInput = {
+  email: string;
+};
+
+export type ResetPasswordInput = {
+  email: string;
+  token: string;
+  password: string;
+};
+
+export type VerifyEmailInput = {
+  email: string;
+  token: string;
+};
+
+export type RefreshTokenInput = {
+  refresh_token: string;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nexwire",
-  "version": "4.0.0",
+  "version": "4.1.0",
   "type": "module",
   "description": "Scaffold a new nexwire project",
   "bin": {

package/express/src/framework/maker-cli/stubs/example/console.ts.stub

@@ -1,34 +0,0 @@
-import { defineSchedule, dispatchEvent } from "@/framework/facade.js";
-
-/**
- * name: Unique schedule id used as the distributed lock key.
- * expression: Cron expression that controls when the task runs.
- * timezone: IANA timezone for cron evaluation (example: "UTC").
- * runOnInit: Runs once immediately when scheduler starts.
- * enabled: Enables or disables this schedule without deleting code.
- * ttlMs: Lock TTL in milliseconds to avoid duplicate execution.
- */
-defineSchedule({
-  name: "{{module}}:scheduler-tick",
-  expression: "*/30 * * * * *",
-  // timezone: "UTC",
-  runOnInit: true,
-  // enabled: true,
-  // ttlMs: 120000,
-  handler: async () => {
-    /**
-     * dispatchEvent name: Event id to publish to listeners.
-     * payload: Data sent to queue/broadcast consumers.
-     * queue: Optional queue target for async event consumers.
-     * broadcast: Optional realtime fanout (all/users/roles/rooms).
-     */
-    await dispatchEvent("{{module}}.scheduler.tick", {
-      origin: "scheduler",
-      createdAt: new Date().toISOString()
-    }, {
-      queue: "default",
-      broadcast: { all: true }
-    });
-  }
-});
-

package/express/src/framework/maker-cli/stubs/example/controller.ts.stub

@@ -1,418 +0,0 @@
-import crypto from "node:crypto";
-import type { Request, Response } from "express";
-import { cache, dispatchCommand, dispatchEvent, session, storage } from "@/framework/facade.js";
-
-/**
- * Example controller guide:
- * - req.body / req.params: validated payloads from the route schema (validation middleware runs first).
- * - dispatchEvent(name, payload, options): emits domain events.
- * - dispatchCommand(name, payload, { async, queue }): queues command-style work.
- * - storage.generateForDownload(...): creates one-time temp download token.
- * - storage.consumeGenerated(token): reads temp file and deletes it.
- * - cache.put/get/remember: lightweight state for async flows (PDF status).
- * - securityMiddleware: sets CSP, HSTS, X-Frame headers (toggle via SECURITY_HEADERS env).
- */
-
-type PdfRequest = {
-  title: string;
-  rows: number;
-  chunkSize: number;
-};
-
-function pdfStatusKey(requestId: string) {
-  return "{{module}}:pdf:status:" + requestId;
-}
-
-function sessionId(res: Response) {
-  return res.locals.sessionId as string;
-}
-
-/**
- * Why: Demonstrates event dispatch with both queue and websocket broadcast.
- * When: Use as the baseline event example for async + realtime flow.
- * Where: POST /{{module}}/event.
- */
-export const fire = async (req: Request, res: Response) => {
-  // Route validates body using ExampleEventSchema in route stub.
-  const body = req.body;
-
-  // Session example: keeps last payload for this visitor/session.
-  await session.put(sessionId(res), "lastExampleEvent", body);
-
-  // Event options shown here:
-  // - queue: true -> send to default async event queue
-  // - broadcast: { all: true } -> fanout to realtime listeners
-  await dispatchEvent("{{module}}.created", body, {
-    queue: true,
-    broadcast: { all: true }
-  });
-
-  res.status(202).json({ message: "Event dispatched", data: body });
-};
-
-/**
- * Why: Demonstrates command-style background processing via queue.
- * When: Use when work should run asynchronously and return 202 immediately.
- * Where: POST /{{module}}/queue/command.
- */
-export const queueCommand = async (req: Request, res: Response) => {
-  const body = req.body;
-
-  // Command options:
-  // - async: true -> run in worker, do not block request
-  // - queue: "default" -> explicit queue channel
-  await dispatchCommand("{{module}}.process", body, {
-    async: true,
-    queue: "default"
-  });
-
-  res.status(202).json({ message: "Queue command dispatched", data: body });
-};
-
-/**
- * Why: Demonstrates queued events without realtime fanout.
- * When: Use when consumers should process event in workers only.
- * Where: POST /{{module}}/event/queued.
- */
-export const fireQueued = async (req: Request, res: Response) => {
-  const body = req.body;
-
-  await dispatchEvent("{{module}}.created", body, { queue: "default" });
-
-  res.status(202).json({ message: "Queued event dispatched", data: body });
-};
-
-/**
- * Why: Demonstrates one event feeding both queue workers and broadcast listeners.
- * When: Use when background processing and client updates are both needed.
- * Where: POST /{{module}}/event/queued-broadcast.
- */
-export const fireQueuedBroadcast = async (req: Request, res: Response) => {
-  const body = req.body;
-
-  await dispatchEvent("{{module}}.created", body, {
-    queue: "default",
-    broadcast: { all: true }
-  });
-
-  res.status(202).json({ message: "Queued broadcast event dispatched", data: body });
-};
-
-/**
- * Why: Demonstrates broadcast-only realtime events.
- * When: Use for transient notifications with no worker processing.
- * Where: POST /{{module}}/event/broadcast.
- */
-export const fireBroadcast = async (_req: Request, res: Response) => {
-  const payload = {
-    message: "Examples broadcast fired",
-    firedAt: new Date().toISOString()
-  };
-
-  await dispatchEvent("{{module}}.realtime", payload, { broadcast: { all: true } });
-
-  res.json({ message: "Broadcast event dispatched", data: payload });
-};
-
-/**
- * Why: Demonstrates multipart upload with storage facade.
- * When: Use when API accepts binary files from forms/clients.
- * Where: POST /{{module}}/upload.
- */
-export const upload = async (req: Request, res: Response) => {
-  const file = (req.body as any)?.file;
-
-  if (!(file instanceof File)) {
-    return res.status(422).json({ message: "File is required" });
-  }
-
-  // Writes to public disk. Name is auto-generated when omitted.
-  const path = await storage.disk("public").putFile("uploads", file);
-
-  res.json({
-    message: "File uploaded successfully",
-    path,
-    url: storage.disk("public").url(path)
-  });
-};
-
-/**
- * Why: Demonstrates Excel import by reading uploaded workbook rows.
- * When: Use when clients submit .xlsx files for server-side processing.
- * Where: POST /{{module}}/import/excel.
- */
-export const importExcel = async (req: Request, res: Response) => {
-  let ExcelJS: any;
-  try {
-    ({ default: ExcelJS } = await import("exceljs"));
-  } catch {
-    return res.status(500).json({ message: "Missing optional dependency 'exceljs'. Install with: bun add exceljs" });
-  }
-
-  const file = (req.body as any)?.file;
-  if (!(file instanceof File)) {
-    return res.status(422).json({ message: "File is required" });
-  }
-
-  const buffer = Buffer.from(await file.arrayBuffer());
-  const workbook = new ExcelJS.Workbook();
-  await workbook.xlsx.load(buffer);
-  const sheet = workbook.worksheets[0];
-  if (!sheet) return res.status(422).json({ message: "Workbook has no sheets" });
-
-  const headerRow = sheet.getRow(1);
-  const headers = headerRow.values.slice(1).map((value: unknown) => String(value || "").trim());
-  const rows: Record<string, string | number | null>[] = [];
-  sheet.eachRow((row: any, rowNumber: number) => {
-    if (rowNumber === 1) return;
-    const values = row.values.slice(1);
-    const record: Record<string, string | number | null> = {};
-    for (let i = 0; i < headers.length; i++) {
-      const value = values[i];
-      record[headers[i] || `column_${i + 1}`] = value == null ? null : (typeof value === "object" && "text" in value ? String(value.text) : value);
-    }
-    rows.push(record);
-  });
-
-  res.json({
-    message: "Excel imported",
-    data: {
-      sheetName: sheet.name,
-      headers,
-      totalRows: rows.length,
-      preview: rows.slice(0, 20)
-    }
-  });
-};
-
-/**
- * Why: Demonstrates short-lived generated downloads with one-time token consume.
- * When: Use for temporary export artifacts that should not persist.
- * Where: POST /{{module}}/download/generate.
- */
-export const generateDownload = async (_req: Request, res: Response) => {
-  const csv = ["id,title", "1,nexwire report", "2,generated and temporary"].join("\n");
-  const token = await storage.generateForDownload({
-    prefix: "{{module}}-report",
-    extension: "csv",
-    data: csv
-  });
-  res.json({
-    message: "Temporary file generated",
-    token,
-    downloadUrl: `/{{module}}/download/${encodeURIComponent(token)}`
-  });
-};
-
-/**
- * Why: Consumes a temporary token and returns the generated CSV file.
- * When: Called after generateDownload to perform one-time download.
- * Where: GET /{{module}}/download/{*token}.
- */
-export const downloadGenerated = async (req: Request, res: Response) => {
-  const token = decodeURIComponent(req.params.token);
-  try {
-    const file = await storage.consumeGenerated(token);
-    res.type("text/csv").attachment("{{module}}-report.csv").send(file);
-  } catch {
-    res.status(404).json({ message: "Download token expired or invalid" });
-  }
-};
-
-/**
- * Why: Demonstrates styled Excel export generation and temporary delivery.
- * When: Use when spreadsheet output with formatting/totals is needed.
- * Where: POST /{{module}}/download/excel/generate.
- */
-export const generateExcelDownload = async (req: Request, res: Response) => {
-  let ExcelJS: any;
-  try {
-    ({ default: ExcelJS } = await import("exceljs"));
-  } catch {
-    return res.status(500).json({ message: "Missing optional dependency 'exceljs'. Install with: bun add exceljs" });
-  }
-
-  const title = (req.body as { title?: string })?.title ?? "";
-  // remember(key, ttl, factory) caches expensive work for repeated requests.
-  const rows = await cache.remember("{{module}}:index", 60, async () => [
-    { id: 1, title: "nexwire framework ready" },
-    { id: 2, title: "modules are auto-discovered" }
-  ]);
-
-  const workbook = new ExcelJS.Workbook();
-  const sheet = workbook.addWorksheet("Examples");
-  sheet.mergeCells("A1:C1");
-  sheet.getCell("A1").value = title;
-  sheet.getCell("A1").font = { bold: true, size: 14, color: { argb: "FFFFFFFF" } };
-  sheet.getCell("A1").alignment = { horizontal: "center", vertical: "middle" };
-  sheet.getCell("A1").fill = { type: "pattern", pattern: "solid", fgColor: { argb: "FF1F4E78" } };
-  sheet.addRow(["ID", "Title", "Length"]);
-  sheet.getRow(2).font = { bold: true, color: { argb: "FFFFFFFF" } };
-  sheet.getRow(2).alignment = { horizontal: "center" };
-  sheet.getRow(2).fill = { type: "pattern", pattern: "solid", fgColor: { argb: "FF2E75B6" } };
-  for (const row of rows) sheet.addRow([row.id, row.title, row.title.length]);
-
-  const dataStart = 3;
-  const dataEnd = dataStart + rows.length - 1;
-  const subtotalRow = dataEnd + 1;
-  const grandTotalRow = subtotalRow + 1;
-  sheet.getCell(`A${subtotalRow}`).value = "Subtotal";
-  sheet.getCell(`B${subtotalRow}`).value = rows.length;
-  sheet.getCell(`C${subtotalRow}`).value = { formula: `SUM(C${dataStart}:C${dataEnd})` };
-  sheet.getCell(`A${grandTotalRow}`).value = "Grand Total";
-  sheet.getCell(`B${grandTotalRow}`).value = rows.length;
-  sheet.getCell(`C${grandTotalRow}`).value = { formula: `SUM(C${dataStart}:C${dataEnd})` };
-  for (const rowNumber of [subtotalRow, grandTotalRow]) {
-    sheet.getRow(rowNumber).font = { bold: true };
-    sheet.getRow(rowNumber).fill = { type: "pattern", pattern: "solid", fgColor: { argb: rowNumber === grandTotalRow ? "FFFCE4D6" : "FFE2EFDA" } };
-  }
-  sheet.columns = [{ width: 10 }, { width: 48 }, { width: 14 }];
-  sheet.views = [{ state: "frozen", ySplit: 2 }];
-
-  const buffer = Buffer.from(await workbook.xlsx.writeBuffer());
-  const token = await storage.generateForDownload({
-    prefix: "{{module}}-report",
-    extension: "xlsx",
-    data: buffer
-  });
-  res.json({
-    message: "Excel generated",
-    token,
-    downloadUrl: `/{{module}}/download/excel/${encodeURIComponent(token)}`
-  });
-};
-
-/**
- * Why: Consumes a temporary token and returns the generated XLSX file.
- * When: Called after generateExcelDownload for one-time Excel download.
- * Where: GET /{{module}}/download/excel/{*token}.
- */
-export const downloadGeneratedExcel = async (req: Request, res: Response) => {
-  const token = decodeURIComponent(req.params.token);
-  try {
-    const file = await storage.consumeGenerated(token);
-    res.type("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet").attachment("{{module}}-report.xlsx").send(file);
-  } catch {
-    res.status(404).json({ message: "Download token expired or invalid" });
-  }
-};
-
-/**
- * Why: Starts hybrid PDF generation for heavy design + large data.
- * When: Use when reports should be rendered with HTML/CSS and processed in background.
- * Where: POST /{{module}}/download/pdf/generate.
- */
-export const generatePdfDownload = async (req: Request, res: Response) => {
-  const body = req.body as PdfRequest;
-  const requestId = crypto.randomUUID();
-
-  // Queue mode path: store status in cache, then worker updates it.
-  if (cache.isAvailable()) {
-    await cache.put(pdfStatusKey(requestId), {
-      state: "pending",
-      createdAt: new Date().toISOString(),
-      mode: "queued"
-    }, 1800);
-    await dispatchCommand("{{module}}.pdf.generate", { requestId, ...body }, {
-      async: true,
-      queue: "default"
-    });
-    return res.status(202).json({
-      message: "PDF generation queued",
-      requestId,
-      mode: "queued",
-      statusUrl: `/{{module}}/download/pdf/${requestId}`,
-      downloadUrl: `/{{module}}/download/pdf/${requestId}`
-    });
-  }
-
-  const token = await generatePdfToken(body);
-  res.status(202).json({
-    message: "PDF generated",
-    requestId,
-    mode: "inline",
-    statusUrl: `/{{module}}/download/pdf/${requestId}`,
-    downloadUrl: `/{{module}}/download/pdf/${encodeURIComponent(token)}`
-  });
-};
-
-/**
- * Why: Polls queued PDF status, then serves one-time PDF download when ready.
- * When: Use after generatePdfDownload returns queued request id.
- * Where: GET /{{module}}/download/pdf/{requestId}.
- */
-export const downloadGeneratedPdf = async (req: Request, res: Response) => {
-  const requestId = decodeURIComponent(req.params.requestId);
-  if (cache.isAvailable()) {
-    // Status API contract:
-    // - pending -> return 202
-    // - ready + token -> return file
-    // - failed -> return 500 with message
-    const status = await cache.get<{ state: string; token?: string; message?: string }>(pdfStatusKey(requestId));
-
-    if (!status) return res.status(404).json({ message: "Unknown PDF request id" });
-    if (status.state === "pending") return res.status(202).json({ message: "PDF is still generating", state: "pending" });
-    if (status.state === "failed") return res.status(500).json({ message: status.message || "PDF generation failed" });
-    
-    if (status.token) {
-      try {
-        const file = await storage.consumeGenerated(status.token);
-        await cache.forget(pdfStatusKey(requestId));
-        res.type("application/pdf").attachment("{{module}}-report.pdf").send(file);
-        return;
-      } catch {
-        return res.status(404).json({ message: "PDF token expired or invalid" });
-      }
-    }
-  }
-
-  try {
-    const file = await storage.consumeGenerated(requestId);
-    res.type("application/pdf").attachment("{{module}}-report.pdf").send(file);
-  } catch {
-    res.status(404).json({ message: "PDF token expired or invalid" });
-  }
-};
-
-export async function generatePdfToken(payload: PdfRequest) {
-  let chromium: any;
-  try {
-    ({ chromium } = await import("playwright"));
-  } catch {
-    throw new Error("Missing optional dependency 'playwright'. Install with: bun add playwright and run: bunx playwright install chromium");
-  }
-  const browser = await chromium.launch({ headless: true });
-  try {
-    const page = await browser.newPage();
-    await page.setContent(buildPdfHtml(payload), { waitUntil: "networkidle" });
-    const pdf = await page.pdf({
-      format: "A4",
-      printBackground: true,
-      margin: { top: "16mm", right: "12mm", bottom: "16mm", left: "12mm" }
-    });
-    return storage.generateForDownload({
-      prefix: "{{module}}-report",
-      extension: "pdf",
-      data: pdf
-    });
-  } finally {
-    await browser.close();
-  }
-}
-
-function buildPdfHtml(payload: PdfRequest) {
-  const rows = Array.from({ length: payload.rows }, (_, i) => ({
-    id: i + 1,
-    label: `Record ${i + 1}`,
-    value: ((i + 1) * 17) % 1000
-  }));
-  const chunks: typeof rows[] = [];
-  for (let i = 0; i < rows.length; i += payload.chunkSize) {
-    chunks.push(rows.slice(i, i + payload.chunkSize));
-  }
-  const sections = chunks.map((chunk, index) => {
-    const tableRows = chunk.map(item => `<tr><td>${item.id}</td><td>${item.label}</td><td>${item.value}</td></tr>`).join("");
-    return `<section class="page"><h2>Batch ${index + 1}</h2><table><thead><tr><th>ID</th><th>Label</th><th>Value</th></tr></thead><tbody>${tableRows}</tbody></table></section>`;
-  }).join("");
-  return `<!doctype html><html><head><meta charset="utf-8" /><style>body{font-family:Arial,sans-serif;color:#1f2937;margin:0}.hero{padding:24px;background:linear-gradient(120deg,#0f766e,#1d4ed8);color:#fff}.hero h1{margin:0 0 4px 0;font-size:22px}.hero p{margin:0;font-size:12px;opacity:.9}.page{padding:16px 20px;page-break-after:always}.page:last-child{page-break-after:auto}h2{margin:0 0 10px 0;font-size:14px;color:#0f172a}table{width:100%;border-collapse:collapse;font-size:11px}th,td{border:1px solid #cbd5e1;padding:6px}th{background:#e2e8f0;text-align:left}tr:nth-child(even){background:#f8fafc}</style></head><body><div class="hero"><h1>${payload.title}</h1><p>Rows: ${payload.rows} | Chunk size: ${payload.chunkSize}</p></div>${sections}</body></html>`;
-}