create-nexwire 4.0.0 → 4.1.1

package/express/src/modules/auth/services/resetpassword.ts

@@ -0,0 +1,69 @@
+import { and, eq, gt } from "drizzle-orm";
+import { db, password } from "@/framework/facade.js";
+import { passwordResetTokens, refreshTokens, users } from "@/modules/auth/database/models/user.js";
+import { hashResetToken } from "@/modules/auth/helpers/auth.js";
+import type { ResetPasswordInput } from "@/modules/auth/types/auth.js";
+
+export type ResetPasswordResult = { kind: "invalid_token"; message: string } | { kind: "reset"; message: string };
+
+export const resetPasswordService = {
+  resetPassword: async (body: ResetPasswordInput): Promise<ResetPasswordResult> => {
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (!user) {
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired reset token"
+      };
+    }
+
+    const hashedPassword = await password.hashPassword(body.password);
+    const hashedToken = hashResetToken(body.token);
+    const now = new Date();
+
+    try {
+      const consumed = await db.transaction(async (tx) => {
+        // Consume the token atomically inside the transaction.
+        // If anything below fails, the delete rolls back and the
+        // user can retry with the same token.
+        const [row] = await tx
+          .delete(passwordResetTokens)
+          .where(
+            and(
+              eq(passwordResetTokens.email, body.email),
+              eq(passwordResetTokens.token, hashedToken),
+              gt(passwordResetTokens.expiresAt, now)
+            )
+          )
+          .returning();
+
+        if (!row) return false;
+
+        await tx.update(users).set({ password: hashedPassword, updatedAt: now }).where(eq(users.id, user.id));
+
+        await tx.update(refreshTokens).set({ revoked: 1 }).where(eq(refreshTokens.userId, user.id));
+
+        return true;
+      });
+
+      if (!consumed) {
+        return {
+          kind: "invalid_token",
+          message: "Invalid or expired reset token"
+        };
+      }
+
+      return { kind: "reset", message: "Password reset successfully" };
+    } catch (err) {
+      // Token was NOT consumed — the transaction rolled back, so the
+      // user can retry with the same token. Log so failures aren't silent.
+      // logger.error({ err, email: body.email }, "password reset failed");
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired reset token"
+      };
+    }
+  }
+};

package/express/src/modules/auth/services/verifyemail.ts

@@ -0,0 +1,77 @@
+import { and, eq, gt } from "drizzle-orm";
+import { authConfig } from "@/config/index.js";
+import { db } from "@/framework/facade.js";
+import { emailVerificationTokens, users } from "@/modules/auth/database/models/user.js";
+import { hashEmailVerificationToken } from "@/modules/auth/helpers/auth.js";
+import type { VerifyEmailInput } from "@/modules/auth/types/auth.js";
+
+export type VerifyEmailResult =
+  | { kind: "not_required"; message: string }
+  | { kind: "invalid_token"; message: string }
+  | { kind: "verified"; message: string };
+
+export const verifyEmailService = {
+  verifyEmail: async (body: VerifyEmailInput): Promise<VerifyEmailResult> => {
+    if (!authConfig.requireEmailVerification) {
+      return {
+        kind: "not_required",
+        message: "Email verification is not required"
+      };
+    }
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (!user) {
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired verification token"
+      };
+    }
+
+    const hashedToken = hashEmailVerificationToken(body.token);
+    const now = new Date();
+
+    try {
+      const verified = await db.transaction(async (tx) => {
+        // Consume the token atomically INSIDE the transaction.
+        // If the update below fails, the delete rolls back and the
+        // user can retry with the same token.
+        const [consumed] = await tx
+          .delete(emailVerificationTokens)
+          .where(
+            and(
+              eq(emailVerificationTokens.email, body.email),
+              eq(emailVerificationTokens.token, hashedToken),
+              gt(emailVerificationTokens.expiresAt, now)
+            )
+          )
+          .returning();
+
+        if (!consumed) return false;
+
+        await tx.update(users).set({ emailVerifiedAt: now, updatedAt: now }).where(eq(users.id, user.id));
+
+        return true;
+      });
+
+      if (!verified) {
+        return {
+          kind: "invalid_token",
+          message: "Invalid or expired verification token"
+        };
+      }
+
+      return { kind: "verified", message: "Email verified successfully" };
+    } catch (err) {
+      // Token was NOT consumed — the transaction rolled back, so the
+      // user can retry with the same token. Log so failures aren't silent.
+      // logger.error({ err, email: body.email }, "email verification failed");
+      return {
+        kind: "invalid_token",
+        message: "Invalid or expired verification token"
+      };
+    }
+  }
+};

package/express/src/modules/auth/types/auth.ts

@@ -0,0 +1,31 @@
+export type RegisterInput = {
+  name: string;
+  email: string;
+  password: string;
+  remember?: boolean;
+};
+
+export type LoginInput = {
+  email: string;
+  password: string;
+  remember?: boolean;
+};
+
+export type ForgotPasswordInput = {
+  email: string;
+};
+
+export type ResetPasswordInput = {
+  email: string;
+  token: string;
+  password: string;
+};
+
+export type VerifyEmailInput = {
+  email: string;
+  token: string;
+};
+
+export type RefreshTokenInput = {
+  refresh_token: string;
+};

package/express/src/resources/src/pages/auth/forgetPassword.vue

@@ -66,6 +66,7 @@ const onSubmit = async () => {
     },
     {
       onSuccess: (res) => {
+        console.log(res);
         isError.value = false;
         message.value = res.data.message;
         form.reset();

package/express/src/resources/src/pages/auth/login.vue

@@ -50,10 +50,10 @@
 import { useHead } from "@vueuse/head";
 import { ref } from "vue";
 import { useRouter } from "vue-router";
+import Button from "@/components/Button.vue";
 import Checkbox from "@/components/Checkbox.vue";
 import Input from "@/components/Input.vue";
 import InputPasswordToggle from "@/components/InputPasswordToggle.vue";
-import Button from "@/components/Button.vue";
 import { useGumForm } from "@/plugins/gum";
 import { useAuthStore } from "@/stores/auth";
 

package/hono/README.md

@@ -7,7 +7,7 @@
 <h3 align="center">Full-stack TypeScript framework for modern web applications</h3>
 
 <p align="center">
-  <a href="https://niyamulahsan.github.io/nexwire"><img src="https://img.shields.io/badge/docs-3b8eed" alt="Documentation"></a>
+  <a href="https://niyamulahsan.github.io/nexwire"><img src="https://img.shields.io/badge/docs%20%7C%20nexwire-3b8eed" alt="Documentation"></a>
   <a href="https://www.npmjs.com/package/create-nexwire"><img src="https://img.shields.io/npm/v/create-nexwire" alt="npm version"></a>
   <a href="https://www.npmjs.com/package/create-nexwire"><img src="https://img.shields.io/npm/dt/create-nexwire" alt="npm downloads"></a>
   <a href="https://github.com/niyamulahsan/nexwire/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="MIT License"></a>
@@ -59,8 +59,8 @@ Works with any package manager: `pnpm`, `yarn`, or `bun`.
 
 All examples use `npm` as the default. nexwire works with any major package manager:
 
-| Manager  | Create project                     | Run commands          |
-| -------- | ---------------------------------- | --------------------- |
+| Manager  | Create project                      | Run commands          |
+| -------- | ----------------------------------- | --------------------- |
 | **npm**  | `npm create nexwire@latest my-app`  | `npm run maker <cmd>` |
 | **pnpm** | `pnpm create nexwire@latest my-app` | `pnpm maker <cmd>`    |
 | **yarn** | `yarn create nexwire@latest my-app` | `yarn maker <cmd>`    |
@@ -73,7 +73,7 @@ nexwire runs on **Node.js** or **Bun** — pick whichever fits your deployment:
 
 | Runtime     | Minimum version | Notes                                                                 |
 | ----------- | --------------- | --------------------------------------------------------------------- |
-| **Node.js** | `>= 22.12`     | Default. Uses `node` in Dockerfile.                                   |
+| **Node.js** | `>= 22.12`      | Default. Uses `node` in Dockerfile.                                   |
 | **Bun**     | `>= 1.3`        | Pass `--runtime=bun` to `deploy:init`. Uses `oven/bun` in Dockerfile. |
 
 ## Features
@@ -114,14 +114,20 @@ Every feature is a self-contained module under `src/modules/<name>/`:
 
 ```
 src/modules/posts/
+├── __tests__/         # Unit tests
 ├── console/           # CLI commands & scheduled tasks
-├── controllers/       # Request handlers + Zod schemas
+├── controllers/       # Request handlers
 ├── database/
 │   ├── models/        # Drizzle table definitions
-│   └── seeders/       # Test data generators
+│   └── seeders/       # Test data
+├── helpers/           # Pure functions — no I/O
 ├── jobs/              # BullMQ queue handlers
+├── middlewares/       # Module-local middleware
 ├── routes/            # HTTP route definitions (auto-discovered)
-└── __test__/          # Unit test
+├── schemas/           # Zod validation schemas
+├── services/          # Business logic — DB, files, network
+├── types/             # Shared TypeScript types
+└── facade.ts          # Public API for other modules
 ```
 
 Modules are **auto-discovered** — no manual registration. Create one with:

package/hono/package.json

@@ -91,7 +91,7 @@
     "vitest": "^4.1.10"
   },
   "engines": {
-    "node": ">=22.12.0",
+    "node": ">=22",
     "bun": ">=1.3",
     "pnpm": ">=11",
     "yarn": ">=4"

package/hono/src/config/session.ts

@@ -1,4 +1,4 @@
-import { cookieConfig } from "./index.js";
+import { cookieConfig } from "./cookie.js";
 import { redisConfig } from "./redis.js";
 
 /**

package/hono/src/database/migrations/sqlite/meta/0000_snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": "6",
   "dialect": "sqlite",
-  "id": "a1444283-a2b7-4ceb-98ab-b2c5d277b414",
+  "id": "8de12a3d-bc9b-4ccc-8b83-c893a59cd33b",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "tables": {
     "notifications": {

package/hono/src/database/migrations/sqlite/meta/_journal.json

@@ -5,7 +5,7 @@
     {
       "idx": 0,
       "version": "6",
-      "when": 1790701575747,
+      "when": 1790958354726,
       "tag": "0000_init",
       "breakpoints": true
     }

package/hono/src/database/schema.ts

@@ -1,3 +1,3 @@
-export * from "../modules/auth/database/models/notifications.js";
-export * from "../modules/auth/database/models/role.js";
-export * from "../modules/auth/database/models/user.js";
+export * from "../modules/auth/database/models/notification.js";
+export * from "../modules/auth/database/models/role.js";
+export * from "../modules/auth/database/models/user.js";

package/hono/src/framework/cache/cache.ts

@@ -1,81 +1,82 @@
-import { cacheConfig, redisConfig } from "@/config/index.js";
-import { redisClientIfReady } from "@/framework/redis/client.js";
-
-function cacheKey(key: string) {
-  return `${cacheConfig.keyPrefix}:${key}`;
-}
-
-/**
- * Why: Provides Redis-backed cache helpers with graceful fallback behavior.
- * When: Controllers/jobs need temporary computed data caching.
- * Where: Application module code via facade.
- * How: Uses namespaced Redis keys and JSON serialization.
- */
-export const cache = {
-  /**
-   * Why: Reads cached JSON value by key.
-   * When: A feature wants fast lookup before recomputing.
-   * Where: Controllers/jobs/services using shared cache.
-   * How: Fetches namespaced Redis key and parses JSON.
-   */
-  async get<T>(key: string, fallback: T | null = null) {
-    const client = redisClientIfReady();
-    if (!client) return fallback;
-
-    const value = await client.get(cacheKey(key));
-    return value ? (JSON.parse(value) as T) : fallback;
-  },
-
-  /**
-   * Why: Stores value in cache with TTL.
-   * When: Data should be reused for a limited period.
-   * Where: Application code caching expensive results.
-   * How: Serializes value and writes with Redis EX seconds.
-   */
-  async put(key: string, value: unknown, ttl = cacheConfig.ttlSeconds) {
-    const client = redisClientIfReady();
-    if (!client) return false;
-
-    await client.set(cacheKey(key), JSON.stringify(value), "EX", ttl);
-    return true;
-  },
-
-  /**
-   * Why: Deletes a cached value by key.
-   * When: Cached data becomes stale or must be invalidated.
-   * Where: Write/update flows that change source data.
-   * How: Removes namespaced Redis cache key.
-   */
-  async forget(key: string) {
-    const client = redisClientIfReady();
-    if (!client) return false;
-
-    await client.del(cacheKey(key));
-    return true;
-  },
-
-  /**
-   * Why: Returns cached value or computes/stores a fresh one.
-   * When: A feature needs cache-aside behavior.
-   * Where: Read paths with potentially expensive callbacks.
-   * How: Attempts get first, then executes callback and put.
-   */
-  async remember<T>(key: string, ttl: number, callback: () => Promise<T>) {
-    const cached = await cache.get<T>(key);
-    if (cached !== null) return cached;
-
-    const fresh = await callback();
-    await this.put(key, fresh, ttl);
-    return fresh;
-  },
-
-  /**
-   * Why: Indicates whether Redis cache backend is currently usable.
-   * When: Runtime checks need to branch on cache availability.
-   * Where: Health/status endpoints and conditional flows.
-   * How: Confirms REDIS flag and ready Redis client instance.
-   */
-  isAvailable() {
-    return redisConfig.enabled && redisClientIfReady() !== null;
-  }
-};
+import { cacheConfig, redisConfig } from "@/config/index.js";
+import { redisClientIfReady } from "@/framework/redis/client.js";
+
+function cacheKey(key: string) {
+  return `${cacheConfig.keyPrefix}:${key}`;
+}
+
+/**
+ * Why: Provides Redis-backed cache helpers with graceful fallback behavior.
+ * When: Controllers/jobs need temporary computed data caching.
+ * Where: Application module code via facade.
+ * How: Uses namespaced Redis keys and JSON serialization.
+ */
+export const cache = {
+  /**
+   * Why: Reads cached JSON value by key.
+   * When: A feature wants fast lookup before recomputing.
+   * Where: Controllers/jobs/services using shared cache.
+   * How: Fetches namespaced Redis key and parses JSON.
+   */
+  async get<T>(key: string, fallback: T | null = null) {
+    const client = redisClientIfReady();
+    if (!client) return fallback;
+
+    const value = await client.get(cacheKey(key));
+    return value ? (JSON.parse(value) as T) : fallback;
+  },
+
+  async set(key: string, value: unknown, ttl = cacheConfig.ttlSeconds) {
+    const client = redisClientIfReady();
+    if (!client) return false;
+
+    await client.set(cacheKey(key), JSON.stringify(value), "EX", ttl);
+    return true;
+  },
+
+  /**
+   * @deprecated Use set() instead.
+   */
+  async put(key: string, value: unknown, ttl = cacheConfig.ttlSeconds) {
+    return this.set(key, value, ttl);
+  },
+
+  /**
+   * Why: Deletes a cached value by key.
+   * When: Cached data becomes stale or must be invalidated.
+   * Where: Write/update flows that change source data.
+   * How: Removes namespaced Redis cache key.
+   */
+  async forget(key: string) {
+    const client = redisClientIfReady();
+    if (!client) return false;
+
+    await client.del(cacheKey(key));
+    return true;
+  },
+
+  /**
+   * Why: Returns cached value or computes/stores a fresh one.
+   * When: A feature needs cache-aside behavior.
+   * Where: Read paths with potentially expensive callbacks.
+   * How: Attempts get first, then executes callback and put.
+   */
+  async remember<T>(key: string, ttl: number, callback: () => Promise<T>) {
+    const cached = await cache.get<T>(key);
+    if (cached !== null) return cached;
+
+    const fresh = await callback();
+    await this.put(key, fresh, ttl);
+    return fresh;
+  },
+
+  /**
+   * Why: Indicates whether Redis cache backend is currently usable.
+   * When: Runtime checks need to branch on cache availability.
+   * Where: Health/status endpoints and conditional flows.
+   * How: Confirms REDIS flag and ready Redis client instance.
+   */
+  isAvailable() {
+    return redisConfig.enabled && redisClientIfReady() !== null;
+  }
+};

package/hono/src/framework/database/seed.ts

@@ -1,6 +1,6 @@
+import { readFile } from "node:fs/promises";
 import { closeDatabase, initDatabase } from "@/framework/database/connection.js";
 import { discoverModuleFiles, importFile } from "@/framework/modules/discover.js";
-import { readFile } from "node:fs/promises";
 
 const NAME_SYMBOL = Symbol.for("drizzle:Name");
 const FK_SYMBOLS = [

package/hono/src/framework/http/app.ts

@@ -58,20 +58,20 @@ export function createHttpApp() {
     let allOk = true;
     try {
       database();
-      checks["database"] = "ok";
+      checks.database = "ok";
     } catch {
-      checks["database"] = "error";
+      checks.database = "error";
       allOk = false;
     }
     if (redisConfig.enabled) {
       if (redisClientIfReady()) {
-        checks["redis"] = "ok";
+        checks.redis = "ok";
       } else {
-        checks["redis"] = "error";
+        checks.redis = "error";
         allOk = false;
       }
     } else {
-      checks["redis"] = "disabled";
+      checks.redis = "disabled";
     }
     const status = allOk ? 200 : 503;
     return c.json({ status: allOk ? "ready" : "not_ready", checks }, status);

package/hono/src/framework/http/validation.ts

@@ -1,21 +1,21 @@
-import type { z } from "zod";
-
-/**
- * Why: Centralizes schema validation with consistent error shape.
- * When: Non-route code needs explicit Zod validation.
- * Where: Controllers/helpers/services.
- * How: Runs safeParseAsync and throws 422 payload on failure.
- */
-export async function validate<T extends z.ZodTypeAny>(schema: T, data: unknown): Promise<z.infer<T>> {
-  const result = await schema.safeParseAsync(data);
-
-  if (!result.success) {
-    throw {
-      status: 422,
-      message: "Validation failed",
-      errors: result.error.flatten()
-    };
-  }
-
-  return result.data;
-}
+import type { z } from "zod";
+
+/**
+ * Why: Centralizes schema validation with consistent error shape.
+ * When: Non-route code needs explicit Zod validation.
+ * Where: Controllers/helpers/services.
+ * How: Runs safeParseAsync and throws 422 payload on failure.
+ */
+export async function validate<T extends z.ZodType>(schema: T, data: unknown): Promise<z.infer<T>> {
+  const result = await schema.safeParseAsync(data);
+
+  if (!result.success) {
+    throw {
+      status: 422,
+      message: "Validation failed",
+      errors: result.error.flatten()
+    };
+  }
+
+  return result.data;
+}

package/hono/src/framework/maker-cli/middleware/core.mjs

@@ -1,47 +1,41 @@
-import fs from "node:fs/promises";
-import path from "node:path";
-import { hasFlag } from "../utils/flags.mjs";
-import { assertName, pascal } from "../utils/naming.mjs";
-
-const stubsRoot = path.resolve(import.meta.dirname, "../stubs");
-
-/** Read a stub file and replace {{key}} placeholders, removing unfilled ones. */
-async function stub(name, values = {}) {
-  let content = await fs.readFile(path.join(stubsRoot, name), "utf8");
-  for (const [key, value] of Object.entries(values)) {
-    content = content.replaceAll(`{{${key}}}`, String(value));
-  }
-  return content.replace(/\{\{[A-Z0-9_]+\}\}/g, "");
-}
-
-/** Convert a name to camelCase (e.g. "rate-limit" -> "rateLimit"). */
-function camelCase(input) {
-  const p = pascal(input);
-  return p.charAt(0).toLowerCase() + p.slice(1);
-}
-
-/** Generate a middleware file in src/middlewares. */
-export async function makeMiddleware(rawName, flags = []) {
-  const name = assertName(rawName, "Middleware name");
-  const camel = camelCase(name);
-  const dryRun = hasFlag(flags, "--dry-run");
-  const force = hasFlag(flags, "--force") || hasFlag(flags, "--yes");
-
-  const filePath = path.resolve(process.cwd(), "src/middlewares", `${name}-middleware.ts`);
-  if (dryRun) return;
-
-  let exists = false;
-  try {
-    await fs.access(filePath);
-    exists = true;
-  } catch {}
-  if (exists && !force) {
-    throw new Error(`Middleware already exists: ${path.relative(process.cwd(), filePath)}. Re-run with --force to overwrite.`);
-  }
-
-  const content = await stub("middleware/name.ts.stub", { name, camel });
-  await fs.mkdir(path.dirname(filePath), { recursive: true });
-  await fs.writeFile(filePath, content);
-  console.log(`Middleware ready: ${path.relative(process.cwd(), filePath)}`);
-  console.log(`Apply it to a route group: group(${camel}Middleware)`);
+import fs from "node:fs/promises";
+import path from "node:path";
+import { hasFlag } from "../utils/flags.mjs";
+import { assertName, camelCase } from "../utils/naming.mjs";
+
+const stubsRoot = path.resolve(import.meta.dirname, "../stubs");
+
+/** Read a stub file and replace {{key}} placeholders, removing unfilled ones. */
+async function stub(name, values = {}) {
+  let content = await fs.readFile(path.join(stubsRoot, name), "utf8");
+  for (const [key, value] of Object.entries(values)) {
+    content = content.replaceAll(`{{${key}}}`, String(value));
+  }
+  return content.replace(/\{\{[A-Z0-9_]+\}\}/g, "");
+}
+
+/** Generate a middleware file in src/middlewares. */
+export async function makeMiddleware(rawName, flags = []) {
+  const name = assertName(rawName, "Middleware name");
+  const camel = camelCase(name);
+  const dryRun = hasFlag(flags, "--dry-run");
+  const force = hasFlag(flags, "--force") || hasFlag(flags, "--yes");
+
+  const filePath = path.resolve(process.cwd(), "src/middlewares", `${name}-middleware.ts`);
+  if (dryRun) return;
+
+  let exists = false;
+  try {
+    await fs.access(filePath);
+    exists = true;
+  } catch {}
+  if (exists && !force) {
+    throw new Error(`Middleware already exists: ${path.relative(process.cwd(), filePath)}. Re-run with --force to overwrite.`);
+  }
+
+  const content = await stub("middleware/name.ts.stub", { name, camel });
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
+  await fs.writeFile(filePath, content);
+  console.log(`Middleware ready: ${path.relative(process.cwd(), filePath)}`);
+  console.log(`Apply it to a route group: group(${camel}Middleware)`);
 }