create-nexwire 4.0.0

package/express/src/modules/auth/controllers/auth.controller.ts

@@ -0,0 +1,358 @@
+import { and, eq, gt, lt } from "drizzle-orm";
+import type { NextFunction, Request, Response } from "express";
+import { authConfig, jwtConfig } from "@/config/index.js";
+import { cookie, db, dispatchEvent, HttpStatusCodes, jwt, password, urls } from "@/framework/facade.js";
+import { roles } from "@/modules/auth/database/models/role.js";
+import { emailVerificationTokens, passwordResetTokens, refreshTokens, users } from "@/modules/auth/database/models/user.js";
+import {
+  hashEmailVerificationToken,
+  hashResetToken,
+  issueTokens,
+  makeEmailVerificationToken,
+  makeResetToken,
+  revokeCurrentRefreshToken,
+  sanitizeUser
+} from "./auth.helpers.js";
+
+export const register = async (req: Request, res: Response, _next: NextFunction) => {
+  try {
+    const body = req.body;
+    const defaultRole = await db.query.roles.findFirst({
+      where: eq(roles.name, "user")
+    });
+    const existingUser = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (existingUser) {
+      return res.status(HttpStatusCodes.UNPROCESSABLE_ENTITY).json({ message: "Email already exists" });
+    }
+
+    const insertResult = await db.insert(users).values({
+      name: body.name,
+      email: body.email,
+      password: await password.hashPassword(body.password),
+      roleId: defaultRole?.id ?? null
+    });
+
+    const insertedId = Number(
+      (insertResult as any)[0]?.insertId ?? (insertResult as any).insertId ?? (insertResult as any).lastInsertRowid
+    );
+    if (!insertedId) {
+      throw new Error("Failed to resolve inserted user id");
+    }
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.id, insertedId),
+      with: { role: true }
+    });
+
+    if (!user) throw new Error("Inserted user not found");
+
+    if (authConfig.requireEmailVerification) {
+      const plainToken = makeEmailVerificationToken();
+      const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000);
+
+      await db.delete(emailVerificationTokens).where(eq(emailVerificationTokens.email, user.email));
+      await db.insert(emailVerificationTokens).values({
+        email: user.email,
+        token: hashEmailVerificationToken(plainToken),
+        expiresAt,
+        createdAt: new Date()
+      });
+
+      const verifyUrl = urls.url(`/verify-email?token=${plainToken}&email=${encodeURIComponent(user.email)}`);
+      await dispatchEvent("user:verify-email", { email: user.email, name: user.name, verifyUrl }, { queue: "mail" });
+
+      return res
+        .status(HttpStatusCodes.CREATED)
+        .json({ message: "User registered successfully. Please verify your email before logging in." });
+    }
+
+    await revokeCurrentRefreshToken(req, res);
+    const tokens = await issueTokens(req, res, user, { remember: !!body.remember });
+    await dispatchEvent(
+      "user:signup",
+      {
+        userId: user.id,
+        email: user.email,
+        name: user.name,
+        password: body.password
+      },
+      { queue: "mail" }
+    );
+
+    return res.status(HttpStatusCodes.CREATED).json({
+      message: "User registered successfully",
+      data: {
+        user: sanitizeUser(user),
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        token_type: "Bearer"
+      }
+    });
+  } catch (error) {
+    console.error("Register error:", error);
+    return res.status(HttpStatusCodes.INTERNAL_SERVER_ERROR).json({ message: "Failed to register user" });
+  }
+};
+
+export const login = async (req: Request, res: Response, _next: NextFunction) => {
+  try {
+    const body = req.body;
+    const user = await db.query.users.findFirst({ where: eq(users.email, body.email), with: { role: true } });
+
+    if (!user || !(await password.verifyPassword(body.password, user.password))) {
+      return res.status(HttpStatusCodes.UNAUTHORIZED).json({ message: "Invalid credentials" });
+    }
+
+    if (authConfig.requireEmailVerification && !user.emailVerifiedAt) {
+      return res.status(HttpStatusCodes.FORBIDDEN).json({ message: "Please verify your email before logging in" });
+    }
+
+    await revokeCurrentRefreshToken(req, res);
+    const tokens = await issueTokens(req, res, user, { remember: !!body.remember });
+
+    return res.status(HttpStatusCodes.OK).json({
+      message: "User logged in successfully",
+      data: {
+        user: sanitizeUser(user),
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        token_type: "Bearer"
+      }
+    });
+  } catch (error) {
+    console.error("Login error:", error);
+    return res.status(HttpStatusCodes.INTERNAL_SERVER_ERROR).json({ message: "Failed to login" });
+  }
+};
+
+export const me = async (_req: Request, res: Response, _next: NextFunction) => {
+  try {
+    const auth = res.locals.auth as { id: number } | undefined;
+    const user = await db.query.users.findFirst({
+      where: eq(users.id, auth.id),
+      with: { role: true }
+    });
+
+    if (!user) return res.status(HttpStatusCodes.NOT_FOUND).json({ message: "User not found" });
+
+    return res.status(HttpStatusCodes.OK).json({
+      message: "Authenticated user fetched successfully",
+      data: sanitizeUser(user)
+    });
+  } catch (error) {
+    console.error("Me error:", error);
+    return res.status(HttpStatusCodes.INTERNAL_SERVER_ERROR).json({ message: "Failed to fetch user" });
+  }
+};
+
+export const logout = async (req: Request, res: Response, _next: NextFunction) => {
+  try {
+    await revokeCurrentRefreshToken(req, res);
+    cookie.deleteAuth(res);
+    cookie.deleteRefresh(res);
+    return res.status(HttpStatusCodes.OK).json({ message: "Logged out successfully" });
+  } catch (error) {
+    console.error("Logout error:", error);
+    cookie.deleteAuth(res);
+    cookie.deleteRefresh(res);
+    return res.status(HttpStatusCodes.INTERNAL_SERVER_ERROR).json({ message: "Failed to logout" });
+  }
+};
+
+export const forgotPassword = async (req: Request, res: Response, _next: NextFunction) => {
+  try {
+    const body = req.body;
+    await db
+      .delete(passwordResetTokens)
+      .where(and(eq(passwordResetTokens.email, body.email), lt(passwordResetTokens.expiresAt, new Date())));
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+
+    if (!user) return res.status(HttpStatusCodes.OK).json({ message: "Reset link has been sent" });
+
+    const plainToken = makeResetToken();
+    const expiresAt = new Date(Date.now() + 15 * 60 * 1000);
+
+    await db.delete(passwordResetTokens).where(eq(passwordResetTokens.email, user.email));
+    await db.insert(passwordResetTokens).values({
+      email: user.email,
+      token: hashResetToken(plainToken),
+      expiresAt,
+      createdAt: new Date()
+    });
+
+    const resetUrl = urls.url(`/reset-password?token=${plainToken}&email=${encodeURIComponent(user.email)}`);
+    await dispatchEvent("user:forget-password", { email: user.email, name: user.name, resetUrl }, { queue: "mail" });
+
+    return res.status(HttpStatusCodes.OK).json({ message: "Reset link passed" });
+  } catch (error) {
+    console.error("Forgot password error:", error);
+    return res.status(HttpStatusCodes.INTERNAL_SERVER_ERROR).json({ message: "Failed to process forgot password request" });
+  }
+};
+
+export const resetPassword = async (req: Request, res: Response, _next: NextFunction) => {
+  try {
+    const body = req.body;
+    const record = await db.query.passwordResetTokens.findFirst({
+      where: and(
+        eq(passwordResetTokens.email, body.email),
+        eq(passwordResetTokens.token, hashResetToken(body.token)),
+        gt(passwordResetTokens.expiresAt, new Date())
+      )
+    });
+
+    if (!record) {
+      return res.status(HttpStatusCodes.UNPROCESSABLE_ENTITY).json({ message: "Invalid or expired reset token" });
+    }
+
+    await db
+      .update(users)
+      .set({
+        password: await password.hashPassword(body.password),
+        updatedAt: new Date()
+      })
+      .where(eq(users.email, body.email));
+
+    await db.delete(passwordResetTokens).where(eq(passwordResetTokens.email, body.email));
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.email, body.email)
+    });
+    if (user) await db.update(refreshTokens).set({ revoked: 1 }).where(eq(refreshTokens.userId, user.id));
+
+    return res.status(HttpStatusCodes.OK).json({ message: "Password reset successfully" });
+  } catch (error) {
+    console.error("Reset password error:", error);
+    return res.status(HttpStatusCodes.INTERNAL_SERVER_ERROR).json({ message: "Failed to reset password" });
+  }
+};
+
+export const verifyEmail = async (req: Request, res: Response, _next: NextFunction) => {
+  try {
+    const body = req.body;
+
+    if (!authConfig.requireEmailVerification) {
+      return res.status(HttpStatusCodes.OK).json({ message: "Email verification is not required" });
+    }
+
+    const record = await db.query.emailVerificationTokens.findFirst({
+      where: and(
+        eq(emailVerificationTokens.email, body.email),
+        eq(emailVerificationTokens.token, hashEmailVerificationToken(body.token)),
+        gt(emailVerificationTokens.expiresAt, new Date())
+      )
+    });
+
+    if (!record) {
+      return res.status(HttpStatusCodes.UNPROCESSABLE_ENTITY).json({ message: "Invalid or expired verification token" });
+    }
+
+    await db.update(users).set({ emailVerifiedAt: new Date(), updatedAt: new Date() }).where(eq(users.email, body.email));
+    await db.delete(emailVerificationTokens).where(eq(emailVerificationTokens.email, body.email));
+
+    return res.status(HttpStatusCodes.OK).json({ message: "Email verified successfully" });
+  } catch (error) {
+    console.error("Verify email error:", error);
+    return res.status(HttpStatusCodes.INTERNAL_SERVER_ERROR).json({ message: "Failed to verify email" });
+  }
+};
+
+export const refreshToken = async (req: Request, res: Response, _next: NextFunction) => {
+  try {
+    const body = req.body;
+    const payload = await jwt.verifyToken(body.refresh_token, "refresh");
+
+    if (!payload?.jti) return res.status(HttpStatusCodes.UNAUTHORIZED).json({ message: "Invalid refresh token" });
+
+    const storedToken = await db.query.refreshTokens.findFirst({
+      where: eq(refreshTokens.jti, payload.jti as string)
+    });
+
+    if (!storedToken || storedToken.revoked === 1) {
+      return res.status(HttpStatusCodes.UNAUTHORIZED).json({ message: "Refresh token revoked" });
+    }
+
+    if (storedToken.expiresAt.getTime() < Date.now()) {
+      await db.delete(refreshTokens).where(eq(refreshTokens.id, storedToken.id));
+      return res.status(HttpStatusCodes.UNAUTHORIZED).json({ message: "Refresh token expired" });
+    }
+
+    const user = await db.query.users.findFirst({
+      where: eq(users.id, payload.id as number),
+      with: { role: true }
+    });
+    if (!user) return res.status(HttpStatusCodes.UNAUTHORIZED).json({ message: "User not found" });
+
+    const remember = !!payload.remember;
+    const refreshExpiry = remember ? jwtConfig.refreshRememberExpirySeconds : undefined;
+    const accessToken = await jwt.generateToken(
+      {
+        id: user.id,
+        email: user.email,
+        roleId: user.role?.id,
+        role: user.role?.name,
+        remember
+      },
+      "access"
+    );
+    const newRefreshToken = await jwt.generateToken(
+      {
+        id: user.id,
+        email: user.email,
+        roleId: user.role?.id,
+        role: user.role?.name,
+        remember
+      },
+      "refresh",
+      refreshExpiry
+    );
+
+    await db
+      .update(refreshTokens)
+      .set({
+        jti: newRefreshToken.jti as string,
+        expiresAt: new Date(newRefreshToken.exp * 1000),
+        revoked: 0
+      })
+      .where(eq(refreshTokens.id, storedToken.id));
+
+    await cookie.setAuth(res, accessToken.token);
+    await cookie.setRefresh(res, newRefreshToken.token, refreshExpiry);
+
+    return res.status(HttpStatusCodes.OK).json({
+      message: "Token refreshed successfully",
+      data: {
+        user: sanitizeUser(user),
+        access_token: accessToken.token,
+        refresh_token: newRefreshToken.token,
+        token_type: "Bearer"
+      }
+    });
+  } catch (error) {
+    console.error("Refresh token error:", error);
+    return res.status(HttpStatusCodes.UNAUTHORIZED).json({ message: "Invalid or expired refresh token" });
+  }
+};
+
+export const logoutAllDevices = async (_req: Request, res: Response, _next: NextFunction) => {
+  try {
+    const auth = res.locals.auth as { id: number } | undefined;
+
+    if (!auth) return res.status(HttpStatusCodes.UNAUTHORIZED).json({ message: "Unauthorized" });
+
+    await db.delete(refreshTokens).where(eq(refreshTokens.userId, auth.id));
+    cookie.deleteAuth(res);
+    cookie.deleteRefresh(res);
+
+    return res.status(HttpStatusCodes.OK).json({ message: "Logged out from all devices successfully" });
+  } catch (error) {
+    console.error("Logout all devices error:", error);
+    return res.status(HttpStatusCodes.INTERNAL_SERVER_ERROR).json({ message: "Failed to logout from all devices" });
+  }
+};

package/express/src/modules/auth/controllers/auth.helpers.ts

@@ -0,0 +1,104 @@
+import { createHash, randomBytes } from "node:crypto";
+import { eq } from "drizzle-orm";
+import type { Request, Response } from "express";
+import { jwtConfig } from "@/config/index.js";
+import { cookie, db, jwt } from "@/framework/facade.js";
+import { refreshTokens } from "@/modules/auth/database/models/user.js";
+import { users } from "@/modules/auth/database/models/user.js";
+
+export function hasRole(auth: any, rolesToMatch: string[]) {
+  const role = String(auth?.role || "").toLowerCase();
+  return rolesToMatch.includes(role);
+}
+
+export async function getCurrentUser(auth: any) {
+  if (!auth?.id) return null;
+  return db.query.users.findFirst({
+    where: eq(users.id, Number(auth.id)),
+    with: { role: true },
+    columns: {
+      password: false,
+      rememberToken: false,
+    }
+  });
+}
+
+export function sanitizeUser(user: any) {
+  return {
+    id: user.id,
+    name: user.name,
+    email: user.email,
+    emailVerifiedAt: user.emailVerifiedAt ? String(user.emailVerifiedAt) : null,
+    roleId: user.roleId ?? null,
+    role: user.role || null,
+    createdAt: user.createdAt ? String(user.createdAt) : null,
+    updatedAt: user.updatedAt ? String(user.updatedAt) : null
+  };
+}
+
+export function makeResetToken() {
+  return randomBytes(32).toString("hex");
+}
+
+export function makeEmailVerificationToken() {
+  return randomBytes(32).toString("hex");
+}
+
+export function hashResetToken(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function hashEmailVerificationToken(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export async function revokeCurrentRefreshToken(req: Request, _res: Response) {
+  const token = await cookie.getRefresh(req);
+  if (!token) return;
+
+  const payload = await jwt.verifyToken(token, "refresh");
+  if (payload?.jti) {
+    await db.delete(refreshTokens).where(eq(refreshTokens.jti, payload.jti as string));
+  }
+}
+
+export async function issueTokens(_req: Request, res: Response, user: any, options?: { remember?: boolean; }) {
+  const remember = !!options?.remember;
+  const refreshExpiry = remember ? jwtConfig.refreshRememberExpirySeconds : jwtConfig.refreshExpirySeconds;
+  const role = user.role || null;
+  const accessToken = await jwt.generateToken(
+    {
+      id: user.id,
+      email: user.email,
+      roleId: role?.id ?? null,
+      role: role?.name ?? null,
+      remember
+    },
+    "access"
+  );
+  const refreshToken = await jwt.generateToken(
+    {
+      id: user.id,
+      email: user.email,
+      roleId: role?.id ?? null,
+      role: role?.name ?? null,
+      remember
+    },
+    "refresh",
+    refreshExpiry
+  );
+
+  if (refreshToken.jti) {
+    await db.insert(refreshTokens).values({
+      userId: user.id,
+      jti: refreshToken.jti,
+      revoked: 0,
+      expiresAt: new Date(refreshToken.exp * 1000)
+    });
+  }
+
+  await cookie.setAuth(res, accessToken.token);
+  await cookie.setRefresh(res, refreshToken.token, refreshExpiry);
+
+  return { accessToken: accessToken.token, refreshToken: refreshToken.token };
+}

package/express/src/modules/auth/controllers/auth.schema.ts

@@ -0,0 +1,102 @@
+import { z } from "@/framework/facade.js";
+
+export const MessageSchema = z.object({
+  message: z.string()
+});
+
+export const RoleSchema = z.object({
+  id: z.number(),
+  name: z.string(),
+  createdAt: z.string().nullable().optional(),
+  updatedAt: z.string().nullable().optional()
+});
+
+export const UserSchema = z.object({
+  id: z.number(),
+  name: z.string(),
+  email: z.email(),
+  roleId: z.number().nullable().optional(),
+  role: RoleSchema.nullable().optional(),
+  emailVerifiedAt: z.string().nullable().optional(),
+  createdAt: z.string().nullable().optional(),
+  updatedAt: z.string().nullable().optional()
+});
+
+export const RegisterSchema = z
+  .object({
+    name: z.string().min(2).max(100),
+    email: z.email(),
+    password: z
+      .string()
+      .min(6)
+      .max(100)
+      .regex(/[a-z]/, "Password must contain lowercase letter")
+      .regex(/[A-Z]/, "Password must contain uppercase letter")
+      .regex(/[^A-Za-z0-9]/, "Password must contain special character"),
+    password_confirmation: z.string()
+  })
+  .superRefine((data, ctx) => {
+    if (data.password !== data.password_confirmation) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["password_confirmation"],
+        message: "Password confirmation does not match"
+      });
+    }
+  });
+
+export const LoginSchema = z.object({
+  email: z.email(),
+  password: z.string().min(1),
+  remember: z.boolean().optional().default(false)
+});
+
+export const ForgotPasswordSchema = z.object({
+  email: z.email()
+});
+
+export const ResetPasswordSchema = z
+  .object({
+    email: z.email(),
+    token: z.string().min(1),
+    password: z
+      .string()
+      .min(6)
+      .max(100)
+      .regex(/[a-z]/, "Password must contain lowercase letter")
+      .regex(/[A-Z]/, "Password must contain uppercase letter")
+      .regex(/[^A-Za-z0-9]/, "Password must contain special character"),
+    password_confirmation: z.string()
+  })
+  .superRefine((data, ctx) => {
+    if (data.password !== data.password_confirmation) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["password_confirmation"],
+        message: "Password confirmation does not match"
+      });
+    }
+  });
+
+export const RefreshTokenSchema = z.object({
+  refresh_token: z.string().min(1)
+});
+
+export const VerifyEmailSchema = z.object({
+  email: z.email(),
+  token: z.string().min(1)
+});
+
+export const AuthResponseSchema = z.object({
+  message: z.string(),
+  data: z.object({
+    user: UserSchema,
+    access_token: z.string(),
+    refresh_token: z.string(),
+    token_type: z.literal("Bearer")
+  })
+});
+
+export const IdParamsSchema = z.object({
+  id: z.coerce.number()
+});

package/express/src/modules/auth/controllers/role.controller.ts

@@ -0,0 +1,15 @@
+import { eq } from "drizzle-orm";
+import type { NextFunction, Request, Response } from "express";
+import { db, HttpStatusCodes } from "@/framework/facade.js";
+import { roles } from "@/modules/auth/database/models/role.js";
+
+export const index = async (_req: Request, res: Response, _next: NextFunction) => {
+  const result = await db.query.roles.findMany();
+  return res.status(HttpStatusCodes.OK).json({ message: "Success", data: result });
+};
+
+export const show = async (req: Request, res: Response, _next: NextFunction) => {
+  const { id } = req.params;
+  const result = await db.query.roles.findFirst({ where: eq(roles.id, Number(id)) });
+  return res.status(HttpStatusCodes.OK).json({ message: "Success", data: result });
+};

package/express/src/modules/auth/database/models/notifications.ts

@@ -0,0 +1,24 @@
+import { relations } from "drizzle-orm";
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { users } from "@/modules/auth/database/models/user.js";
+
+export const notifications = sqliteTable("notifications", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: integer("user_id")
+    .notNull()
+    .references(() => users.id, { onUpdate: "cascade", onDelete: "cascade" }),
+  type: text("type").notNull(),
+  title: text("title").notNull(),
+  body: text("body"),
+  data: text("data"),
+  link: text("link"),
+  readAt: integer("read_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const notificationsRelations = relations(notifications, ({ one }) => ({
+  user: one(users, {
+    fields: [notifications.userId],
+    references: [users.id]
+  })
+}));

package/express/src/modules/auth/database/models/role.ts

@@ -0,0 +1,14 @@
+import { relations } from "drizzle-orm";
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { users } from "@/modules/auth/database/models/user.js";
+
+export const roles = sqliteTable("roles", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  name: text("name").notNull().unique(),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const rolesRelations = relations(roles, ({ many }) => ({
+  users: many(users)
+}));

package/express/src/modules/auth/database/models/user.ts

@@ -0,0 +1,46 @@
+import { relations } from "drizzle-orm";
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { roles } from "@/modules/auth/database/models/role.js";
+
+export const users = sqliteTable("users", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  password: text("password").notNull(),
+  roleId: integer("role_id").references(() => roles.id, { onUpdate: "cascade", onDelete: "set null" }),
+  emailVerifiedAt: integer("email_verified_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const emailVerificationTokens = sqliteTable("email_verification_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  email: text("email").notNull(),
+  token: text("token").notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const passwordResetTokens = sqliteTable("password_reset_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  email: text("email").notNull(),
+  token: text("token").notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const refreshTokens = sqliteTable("refresh_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: integer("user_id").references(() => users.id, { onUpdate: "cascade", onDelete: "set null" }),
+  jti: text("jti").notNull().unique(),
+  revoked: integer("revoked", { mode: "boolean" }).default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const usersRelations = relations(users, ({ one }) => ({
+  role: one(roles, {
+    fields: [users.roleId],
+    references: [roles.id]
+  })
+}));

package/express/src/modules/auth/database/seeders/role.ts

@@ -0,0 +1,18 @@
+import { eq } from "drizzle-orm";
+import { db } from "@/framework/facade.js";
+import { roles } from "@/modules/auth/database/models/role.js";
+
+export const table = roles;
+
+export default async function RoleSeeder() {
+  const rows = [{ name: "admin" }, { name: "user" }];
+
+  for (const row of rows) {
+    const existing = await db.query.roles.findFirst({ where: eq(roles.name, row.name) });
+    if (!existing) {
+      await db.insert(roles).values({ name: row.name });
+    }
+  }
+
+  console.log("Role seeder completed");
+}