create-nexwire 4.0.0 → 4.1.1

package/{hono/src/modules/auth/controllers/auth.schema.ts → express/src/modules/auth/schemas/auth.ts}

@@ -1,102 +1,102 @@
-import { z } from "@/framework/facade.js";
-
-export const MessageSchema = z.object({
-  message: z.string()
-});
-
-export const RoleSchema = z.object({
-  id: z.number(),
-  name: z.string(),
-  createdAt: z.string().nullable().optional(),
-  updatedAt: z.string().nullable().optional()
-});
-
-export const UserSchema = z.object({
-  id: z.number(),
-  name: z.string(),
-  email: z.email(),
-  roleId: z.number().nullable().optional(),
-  role: RoleSchema.nullable().optional(),
-  emailVerifiedAt: z.string().nullable().optional(),
-  createdAt: z.string().nullable().optional(),
-  updatedAt: z.string().nullable().optional()
-});
-
-export const RegisterSchema = z
-  .object({
-    name: z.string().min(2).max(100),
-    email: z.email(),
-    password: z
-      .string()
-      .min(6)
-      .max(100)
-      .regex(/[a-z]/, "Password must contain lowercase letter")
-      .regex(/[A-Z]/, "Password must contain uppercase letter")
-      .regex(/[^A-Za-z0-9]/, "Password must contain special character"),
-    password_confirmation: z.string()
-  })
-  .superRefine((data, ctx) => {
-    if (data.password !== data.password_confirmation) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["password_confirmation"],
-        message: "Password confirmation does not match"
-      });
-    }
-  });
-
-export const LoginSchema = z.object({
-  email: z.email(),
-  password: z.string().min(1),
-  remember: z.boolean().optional().default(false)
-});
-
-export const ForgotPasswordSchema = z.object({
-  email: z.email()
-});
-
-export const ResetPasswordSchema = z
-  .object({
-    email: z.email(),
-    token: z.string().min(1),
-    password: z
-      .string()
-      .min(6)
-      .max(100)
-      .regex(/[a-z]/, "Password must contain lowercase letter")
-      .regex(/[A-Z]/, "Password must contain uppercase letter")
-      .regex(/[^A-Za-z0-9]/, "Password must contain special character"),
-    password_confirmation: z.string()
-  })
-  .superRefine((data, ctx) => {
-    if (data.password !== data.password_confirmation) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["password_confirmation"],
-        message: "Password confirmation does not match"
-      });
-    }
-  });
-
-export const RefreshTokenSchema = z.object({
-  refresh_token: z.string().min(1)
-});
-
-export const VerifyEmailSchema = z.object({
-  email: z.email(),
-  token: z.string().min(1)
-});
-
-export const AuthResponseSchema = z.object({
-  message: z.string(),
-  data: z.object({
-    user: UserSchema,
-    access_token: z.string(),
-    refresh_token: z.string(),
-    token_type: z.literal("Bearer")
-  })
-});
-
-export const IdParamsSchema = z.object({
-  id: z.coerce.number()
-});
+import { z } from "@/framework/facade.js";
+
+export const MessageSchema = z.object({
+  message: z.string()
+});
+
+export const RoleSchema = z.object({
+  id: z.number(),
+  name: z.string(),
+  createdAt: z.string().nullable().optional(),
+  updatedAt: z.string().nullable().optional()
+});
+
+export const UserSchema = z.object({
+  id: z.number(),
+  name: z.string(),
+  email: z.email(),
+  roleId: z.number().nullable().optional(),
+  role: RoleSchema.nullable().optional(),
+  emailVerifiedAt: z.string().nullable().optional(),
+  createdAt: z.string().nullable().optional(),
+  updatedAt: z.string().nullable().optional()
+});
+
+export const RegisterSchema = z
+  .object({
+    name: z.string().min(2).max(100),
+    email: z.email(),
+    password: z
+      .string()
+      .min(6)
+      .max(100)
+      .regex(/[a-z]/, "Password must contain lowercase letter")
+      .regex(/[A-Z]/, "Password must contain uppercase letter")
+      .regex(/[^A-Za-z0-9]/, "Password must contain special character"),
+    password_confirmation: z.string()
+  })
+  .superRefine((data, ctx) => {
+    if (data.password !== data.password_confirmation) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["password_confirmation"],
+        message: "Password confirmation does not match"
+      });
+    }
+  });
+
+export const LoginSchema = z.object({
+  email: z.email(),
+  password: z.string().min(1),
+  remember: z.boolean().optional().default(false)
+});
+
+export const ForgotPasswordSchema = z.object({
+  email: z.email()
+});
+
+export const ResetPasswordSchema = z
+  .object({
+    email: z.email(),
+    token: z.string().min(1),
+    password: z
+      .string()
+      .min(6)
+      .max(100)
+      .regex(/[a-z]/, "Password must contain lowercase letter")
+      .regex(/[A-Z]/, "Password must contain uppercase letter")
+      .regex(/[^A-Za-z0-9]/, "Password must contain special character"),
+    password_confirmation: z.string()
+  })
+  .superRefine((data, ctx) => {
+    if (data.password !== data.password_confirmation) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["password_confirmation"],
+        message: "Password confirmation does not match"
+      });
+    }
+  });
+
+export const RefreshTokenSchema = z.object({
+  refresh_token: z.string().min(1)
+});
+
+export const VerifyEmailSchema = z.object({
+  email: z.email(),
+  token: z.string().min(1)
+});
+
+export const AuthResponseSchema = z.object({
+  message: z.string(),
+  data: z.object({
+    user: UserSchema,
+    access_token: z.string(),
+    refresh_token: z.string(),
+    token_type: z.literal("Bearer")
+  })
+});
+
+export const IdParamsSchema = z.object({
+  id: z.coerce.number()
+});

package/express/src/modules/auth/services/forgetpassword.ts

@@ -0,0 +1,66 @@
+import { and, eq, lt } from "drizzle-orm";
+import { db, dispatchEvent, urls } from "@/framework/facade.js";
+import { passwordResetTokens, users } from "@/modules/auth/database/models/user.js";
+import { hashResetToken, makeResetToken } from "@/modules/auth/helpers/auth.js";
+import type { ForgotPasswordInput } from "@/modules/auth/types/auth.js";
+
+export type ForgotPasswordResult = {
+  kind: "sent";
+  message: string;
+};
+
+const TOKEN_TTL_MS = 15 * 60 * 1000;
+
+export const forgotPasswordService = {
+  forgotPassword: async (body: ForgotPasswordInput): Promise<ForgotPasswordResult> => {
+    const now = new Date();
+
+    // Cleanup + replace happen atomically so a crash mid-flow can't leave
+    // the user without a valid token.
+    const issued = await db.transaction(async (tx) => {
+      // 1. Drop this email's expired tokens (housekeeping, not critical)
+      await tx.delete(passwordResetTokens).where(and(eq(passwordResetTokens.email, body.email), lt(passwordResetTokens.expiresAt, now)));
+
+      const user = await tx.query.users.findFirst({
+        where: eq(users.email, body.email)
+      });
+
+      if (!user) return null;
+
+      // 2. Revoke any existing unexpired token for this email
+      await tx.delete(passwordResetTokens).where(eq(passwordResetTokens.email, body.email));
+
+      // 3. Issue a fresh one
+      const plainToken = makeResetToken();
+      const expiresAt = new Date(now.getTime() + TOKEN_TTL_MS);
+
+      await tx.insert(passwordResetTokens).values({
+        email: user.email,
+        token: hashResetToken(plainToken),
+        expiresAt,
+        createdAt: now
+      });
+
+      return { user, plainToken };
+    });
+
+    // Same response whether or not the user exists (no enumeration).
+    if (!issued) {
+      return { kind: "sent", message: "Reset link has been sent" };
+    }
+
+    const resetUrl = urls.url(`/reset-password?token=${issued.plainToken}&email=${encodeURIComponent(issued.user.email)}`);
+
+    await dispatchEvent(
+      "user:forget-password",
+      {
+        email: issued.user.email,
+        name: issued.user.name,
+        resetUrl
+      },
+      { queue: "mail" }
+    );
+
+    return { kind: "sent", message: "Reset link has been sent" };
+  }
+};

package/express/src/modules/auth/services/login.ts

@@ -0,0 +1,63 @@
+import { eq } from "drizzle-orm";
+import type { Request, Response } from "express";
+import { authConfig } from "@/config/index.js";
+import { db, password } from "@/framework/facade.js";
+import { users } from "@/modules/auth/database/models/user.js";
+import { issueTokens, revokeCurrentRefreshToken, sanitizeUser } from "@/modules/auth/helpers/auth.js";
+import type { LoginInput } from "@/modules/auth/types/auth.js";
+
+export type LoginResult =
+  | { kind: "invalid_credentials"; message: string }
+  | { kind: "email_not_verified"; message: string }
+  | {
+      kind: "logged_in";
+      message: string;
+      data: {
+        user: ReturnType<typeof sanitizeUser>;
+        access_token: string;
+        refresh_token: string;
+        token_type: "Bearer";
+      };
+    };
+
+export const loginService = {
+  login: async (req: Request, res: Response, body: LoginInput): Promise<LoginResult> => {
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email),
+      with: { role: true }
+    });
+
+    // Generic message for both "user missing" and "wrong password" —
+    // never tell an attacker which one it was.
+    const passwordOk = user && (await password.verifyPassword(body.password, user.password));
+
+    if (!user || !passwordOk) {
+      return { kind: "invalid_credentials", message: "Invalid credentials" };
+    }
+
+    if (authConfig.requireEmailVerification && !user.emailVerifiedAt) {
+      return {
+        kind: "email_not_verified",
+        message: "Please verify your email before logging in"
+      };
+    }
+
+    // Rotate the current refresh token before issuing a new pair.
+    await revokeCurrentRefreshToken(req, res);
+
+    const tokens = await issueTokens(req, res, user, {
+      remember: !!body.remember
+    });
+
+    return {
+      kind: "logged_in",
+      message: "User logged in successfully",
+      data: {
+        user: sanitizeUser(user),
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        token_type: "Bearer"
+      }
+    };
+  }
+};

package/express/src/modules/auth/services/logout.ts

@@ -0,0 +1,25 @@
+import type { Request, Response } from "express";
+import { cookie, logger } from "@/framework/facade.js";
+import { revokeCurrentRefreshToken } from "@/modules/auth/helpers/auth.js";
+
+export type LogoutResult = {
+  kind: "logged_out";
+  message: string;
+};
+
+export const logoutService = {
+  logout: async (req: Request, res: Response): Promise<LogoutResult> => {
+    try {
+      await revokeCurrentRefreshToken(req, res);
+    } catch (err) {
+      // Log and continue — the user is logging out either way.
+      // The server-side token will expire on its own.
+      logger.error("failed to revoke refresh token on logout", { err });
+    }
+
+    cookie.deleteAuth(res);
+    cookie.deleteRefresh(res);
+
+    return { kind: "logged_out", message: "Logged out successfully" };
+  }
+};

package/express/src/modules/auth/services/logoutalldevices.ts

@@ -0,0 +1,19 @@
+import { eq } from "drizzle-orm";
+import { db } from "@/framework/facade.js";
+import { refreshTokens } from "@/modules/auth/database/models/user.js";
+
+export type LogoutAllDevicesResult = {
+  kind: "logged_out";
+  message: string;
+};
+
+export const logoutAllDevicesService = {
+  logoutAllDevices: async (userId: number): Promise<LogoutAllDevicesResult> => {
+    await db.delete(refreshTokens).where(eq(refreshTokens.userId, userId));
+
+    return {
+      kind: "logged_out",
+      message: "Logged out from all devices successfully"
+    };
+  }
+};

package/express/src/modules/auth/services/me.ts

@@ -0,0 +1,31 @@
+import { eq } from "drizzle-orm";
+import { db } from "@/framework/facade.js";
+import { users } from "@/modules/auth/database/models/user.js";
+import { sanitizeUser } from "@/modules/auth/helpers/auth.js";
+
+export type MeResult =
+  | { kind: "not_found"; message: string }
+  | {
+      kind: "found";
+      message: string;
+      data: ReturnType<typeof sanitizeUser>;
+    };
+
+export const meService = {
+  me: async (userId: number): Promise<MeResult> => {
+    const user = await db.query.users.findFirst({
+      where: eq(users.id, userId),
+      with: { role: true }
+    });
+
+    if (!user) {
+      return { kind: "not_found", message: "User not found" };
+    }
+
+    return {
+      kind: "found",
+      message: "Authenticated user fetched successfully",
+      data: sanitizeUser(user)
+    };
+  }
+};

package/express/src/modules/auth/services/refreshtoken.ts

@@ -0,0 +1,110 @@
+import { and, eq } from "drizzle-orm";
+import { jwtConfig } from "@/config/index.js";
+import { db, jwt } from "@/framework/facade.js";
+import { refreshTokens, users } from "@/modules/auth/database/models/user.js";
+import { sanitizeUser } from "@/modules/auth/helpers/auth.js";
+import type { RefreshTokenInput } from "@/modules/auth/types/auth.js";
+
+export type RefreshTokenResult =
+  | { kind: "invalid_token"; message: string }
+  | { kind: "revoked"; message: string }
+  | { kind: "expired"; message: string }
+  | { kind: "user_not_found"; message: string }
+  | {
+      kind: "refreshed";
+      message: string;
+      data: {
+        user: ReturnType<typeof sanitizeUser>;
+        access_token: string;
+        refresh_token: string;
+        token_type: "Bearer";
+      };
+      cookies: {
+        accessToken: string;
+        refreshToken: string;
+        refreshExpiry?: number;
+      };
+    };
+
+export const refreshTokenService = {
+  refreshToken: async (body: RefreshTokenInput): Promise<RefreshTokenResult> => {
+    const payload = await jwt.verifyToken(body.refresh_token, "refresh");
+
+    if (!payload?.jti || typeof payload.jti !== "string") {
+      return { kind: "invalid_token", message: "Invalid refresh token" };
+    }
+
+    const userId = Number(payload.id);
+    if (!Number.isInteger(userId) || userId <= 0) {
+      return { kind: "invalid_token", message: "Invalid refresh token" };
+    }
+
+    const storedToken = await db.query.refreshTokens.findFirst({
+      where: eq(refreshTokens.jti, payload.jti)
+    });
+
+    if (!storedToken || storedToken.revoked === 1) {
+      return { kind: "revoked", message: "Refresh token revoked" };
+    }
+
+    if (storedToken.expiresAt.getTime() < Date.now()) {
+      await db.delete(refreshTokens).where(eq(refreshTokens.id, storedToken.id));
+      return { kind: "expired", message: "Refresh token expired" };
+    }
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.id, userId),
+      with: { role: true }
+    });
+
+    if (!user) {
+      return { kind: "user_not_found", message: "User not found" };
+    }
+
+    const remember = !!payload.remember;
+    const refreshExpiry = remember ? jwtConfig.refreshRememberExpirySeconds : undefined;
+
+    const tokenPayload = {
+      id: user.id,
+      email: user.email,
+      roleId: user.role?.id,
+      role: user.role?.name,
+      remember
+    };
+
+    const accessToken = await jwt.generateToken(tokenPayload, "access");
+    const newRefreshToken = await jwt.generateToken(tokenPayload, "refresh", refreshExpiry);
+
+    // Compare-and-swap: only rotate if the jti is still the one we read.
+    // Two concurrent requests with the same old token → exactly one wins.
+    const [rotated] = await db
+      .update(refreshTokens)
+      .set({
+        jti: newRefreshToken.jti,
+        expiresAt: new Date(newRefreshToken.exp * 1000),
+        revoked: 0
+      })
+      .where(and(eq(refreshTokens.id, storedToken.id), eq(refreshTokens.jti, payload.jti)))
+      .returning();
+
+    if (!rotated) {
+      return { kind: "revoked", message: "Refresh token revoked" };
+    }
+
+    return {
+      kind: "refreshed",
+      message: "Token refreshed successfully",
+      data: {
+        user: sanitizeUser(user),
+        access_token: accessToken.token,
+        refresh_token: newRefreshToken.token,
+        token_type: "Bearer"
+      },
+      cookies: {
+        accessToken: accessToken.token,
+        refreshToken: newRefreshToken.token,
+        refreshExpiry
+      }
+    };
+  }
+};

package/express/src/modules/auth/services/register.ts

@@ -0,0 +1,141 @@
+import { eq } from "drizzle-orm";
+import type { Request, Response } from "express";
+import { authConfig } from "@/config/index.js";
+import { db, dispatchEvent, password, urls } from "@/framework/facade.js";
+import { roles } from "@/modules/auth/database/models/role.js";
+import { emailVerificationTokens, users } from "@/modules/auth/database/models/user.js";
+import {
+  hashEmailVerificationToken,
+  issueTokens,
+  makeEmailVerificationToken,
+  revokeCurrentRefreshToken,
+  sanitizeUser
+} from "@/modules/auth/helpers/auth.js";
+import type { RegisterInput } from "@/modules/auth/types/auth.js";
+
+export type RegisterResult =
+  | { kind: "email_exists"; message: string }
+  | { kind: "verification_required"; message: string }
+  | {
+      kind: "registered";
+      message: string;
+      data: {
+        user: ReturnType<typeof sanitizeUser>;
+        access_token: string;
+        refresh_token: string;
+        token_type: "Bearer";
+      };
+    };
+
+const VERIFY_TOKEN_TTL_MS = 24 * 60 * 60 * 1000;
+
+export const registerService = {
+  register: async (req: Request, res: Response, body: RegisterInput): Promise<RegisterResult> => {
+    const defaultRole = await db.query.roles.findFirst({
+      where: eq(roles.name, "user")
+    });
+
+    if (!defaultRole) {
+      throw new Error('Default role "user" not found — check your seeds');
+    }
+
+    const existingUser = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (existingUser) {
+      return { kind: "email_exists", message: "Email already exists" };
+    }
+
+    const hashedPassword = await password.hashPassword(body.password);
+    const now = new Date();
+
+    const created = await db.transaction(async (tx) => {
+      const [inserted] = await tx
+        .insert(users)
+        .values({
+          name: body.name,
+          email: body.email,
+          password: hashedPassword,
+          roleId: defaultRole.id
+        })
+        .returning({ id: users.id });
+
+      if (!inserted) throw new Error("Failed to insert user");
+
+      const user = await tx.query.users.findFirst({
+        where: eq(users.id, inserted.id),
+        with: { role: true }
+      });
+
+      if (!user) throw new Error("Inserted user not found");
+
+      let plainVerifyToken: string | null = null;
+
+      if (authConfig.requireEmailVerification) {
+        plainVerifyToken = makeEmailVerificationToken();
+        const expiresAt = new Date(now.getTime() + VERIFY_TOKEN_TTL_MS);
+
+        // One active verification token per email
+        await tx.delete(emailVerificationTokens).where(eq(emailVerificationTokens.email, user.email));
+
+        await tx.insert(emailVerificationTokens).values({
+          email: user.email,
+          token: hashEmailVerificationToken(plainVerifyToken),
+          expiresAt,
+          createdAt: now
+        });
+      }
+
+      return { user, plainVerifyToken };
+    });
+
+    // ---- Side effects AFTER commit ----
+
+    if (created.plainVerifyToken) {
+      const verifyUrl = urls.url(`/verify-email?token=${created.plainVerifyToken}&email=${encodeURIComponent(created.user.email)}`);
+
+      await dispatchEvent(
+        "user:verify-email",
+        {
+          email: created.user.email,
+          name: created.user.name,
+          verifyUrl
+        },
+        { queue: "mail" }
+      );
+
+      return {
+        kind: "verification_required",
+        message: "User registered successfully. Please verify your email before logging in."
+      };
+    }
+
+    await revokeCurrentRefreshToken(req, res);
+    const tokens = await issueTokens(req, res, created.user, {
+      remember: !!body.remember
+    });
+
+    await dispatchEvent(
+      "user:signup",
+      {
+        userId: created.user.id,
+        email: created.user.email,
+        name: created.user.name
+        // NO password — see explanation below
+      },
+      { queue: "mail" }
+    );
+
+    return {
+      kind: "registered",
+      message: "User registered successfully",
+      data: {
+        user: sanitizeUser(created.user),
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        token_type: "Bearer"
+      }
+    };
+  }
+};