create-nexwire 4.2.1 → 4.2.3

package/hono/src/middlewares/auth-middleware.ts

@@ -1,19 +1,23 @@
-import { eq } from "drizzle-orm";
 import type { Context, Next } from "hono";
-import { cookie, db, HttpStatusCodes, jwt } from "@/framework/facade.js";
-import { refreshTokens, users } from "@/modules/auth/database/models/user.js";
+import { cookie, HttpStatusCodes, jwt } from "@/framework/facade.js";
+import { resolveAuthProvider } from "@/framework/providers/adapter.js";
 
 export async function authMiddleware(c: Context, next: Next) {
+  const provider = await resolveAuthProvider();
+  if (!provider) {
+    console.warn(
+      "[auth-middleware] auth provider not available; skipping auth. Register one in src/providers/ or restore src/modules/auth."
+    );
+    return await next();
+  }
+
   const accessToken = await cookie.getAuth(c);
 
   if (accessToken) {
-    const accessPayload = await jwt.verifyToken(accessToken, "access");
+    const accessPayload: any = await jwt.verifyToken(accessToken, "access");
 
     if (accessPayload) {
-      const user = await db.query.users.findFirst({
-        where: eq(users.id, accessPayload.id as number),
-        with: { role: true }
-      });
+      const user = await provider.getUserById((accessPayload as any)?.id);
 
       if (!user) {
         cookie.deleteAuth(c);
@@ -21,13 +25,20 @@ export async function authMiddleware(c: Context, next: Next) {
         return c.json({ message: "Unauthorized" }, HttpStatusCodes.UNAUTHORIZED);
       }
 
-      c.set("auth", {
-        ...accessPayload,
-        id: user.id,
-        email: user.email,
-        roleId: user.role?.id ?? null,
-        role: user.role?.name ?? null
-      });
+      let authCtx: any;
+      if (provider.getAuthContext) {
+        authCtx = await provider.getAuthContext(user, accessPayload);
+      } else {
+        authCtx = {
+          ...(accessPayload || {}),
+          id: (user as any).id,
+          email: (user as any).email,
+          roleId: (user as any).role?.id ?? (user as any).roleId ?? null,
+          role: (user as any).role?.name ?? (user as any).role ?? null,
+          ...(user as any)
+        };
+      }
+      c.set("auth", authCtx);
       return await next();
     }
   }
@@ -40,7 +51,7 @@ export async function authMiddleware(c: Context, next: Next) {
     return c.json({ message: "Unauthorized" }, HttpStatusCodes.UNAUTHORIZED);
   }
 
-  const refreshPayload = await jwt.verifyToken(refreshToken, "refresh");
+  const refreshPayload: any = await jwt.verifyToken(refreshToken, "refresh");
 
   if (!refreshPayload?.jti) {
     cookie.deleteAuth(c);
@@ -48,27 +59,27 @@ export async function authMiddleware(c: Context, next: Next) {
     return c.json({ message: "Invalid token" }, HttpStatusCodes.UNAUTHORIZED);
   }
 
-  const storedToken = await db.query.refreshTokens.findFirst({
-    where: eq(refreshTokens.jti, refreshPayload.jti as string)
-  });
+  const storedToken = await provider.findRefreshToken((refreshPayload as any)?.jti);
 
-  if (!storedToken || storedToken.revoked) {
+  if (!storedToken || (storedToken as any).revoked) {
     cookie.deleteAuth(c);
     cookie.deleteRefresh(c);
     return c.json({ message: "Invalid token" }, HttpStatusCodes.UNAUTHORIZED);
   }
 
-  if (storedToken.expiresAt.getTime() < Date.now()) {
-    await db.delete(refreshTokens).where(eq(refreshTokens.id, storedToken.id));
-    cookie.deleteAuth(c);
-    cookie.deleteRefresh(c);
-    return c.json({ message: "Invalid token" }, HttpStatusCodes.UNAUTHORIZED);
+  const expiresAt = (storedToken as any).expiresAt;
+  if (expiresAt) {
+    const exp = expiresAt instanceof Date ? expiresAt.getTime() : new Date(expiresAt).getTime();
+    if (!Number.isNaN(exp) && exp < Date.now()) {
+      if (provider.deleteRefreshToken) await provider.deleteRefreshToken((storedToken as any).id);
+      else if (provider.revokeRefreshToken) await provider.revokeRefreshToken((storedToken as any).id);
+      cookie.deleteAuth(c);
+      cookie.deleteRefresh(c);
+      return c.json({ message: "Invalid token" }, HttpStatusCodes.UNAUTHORIZED);
+    }
   }
 
-  const user = await db.query.users.findFirst({
-    where: eq(users.id, refreshPayload.id as number),
-    with: { role: true }
-  });
+  const user = await provider.getUserById((refreshPayload as any)?.id);
 
   if (!user) {
     cookie.deleteAuth(c);
@@ -76,23 +87,39 @@ export async function authMiddleware(c: Context, next: Next) {
     return c.json({ message: "Unauthorized" }, HttpStatusCodes.UNAUTHORIZED);
   }
 
+  let baseCtx: any;
+  if (provider.getAuthContext) {
+    baseCtx = await provider.getAuthContext(user, refreshPayload);
+  } else {
+    baseCtx = {
+      ...(refreshPayload || {}),
+      id: (user as any).id,
+      email: (user as any).email,
+      roleId: (user as any).role?.id ?? (user as any).roleId ?? null,
+      role: (user as any).role?.name ?? (user as any).role ?? null,
+      ...(user as any)
+    };
+  }
+
   const newAccessToken = await jwt.generateToken(
     {
-      id: user.id,
-      email: user.email,
-      roleId: user.role?.id ?? null,
-      role: user.role?.name ?? null
+      id: (user as any).id,
+      email: (user as any).email,
+      roleId: baseCtx?.roleId ?? (user as any).role?.id ?? (user as any).roleId ?? null,
+      role: baseCtx?.role ?? (user as any).role?.name ?? (user as any).role ?? null
     },
     "access"
   );
 
   await cookie.setAuth(c, newAccessToken.token);
   c.set("auth", {
-    id: user.id,
-    email: user.email,
-    roleId: user.role?.id ?? null,
-    role: user.role?.name ?? null,
-    type: "access"
+    ...(baseCtx || {}),
+    id: (user as any).id,
+    email: (user as any).email,
+    roleId: baseCtx?.roleId ?? (user as any).role?.id ?? (user as any).roleId ?? null,
+    role: baseCtx?.role ?? (user as any).role?.name ?? (user as any).role ?? null,
+    type: "access",
+    ...(user as any)
   });
   return await next();
 }

package/hono/src/providers/README.md

@@ -0,0 +1,107 @@
+# Providers
+
+Provider files in this folder are imported automatically when the application
+boots. Use them for anything the **whole app** needs — a replacement auth
+implementation, a payment gateway, an SMS driver, a storage backend.
+
+There is no wiring step: drop a file in here and it runs.
+
+## How it works
+
+1. Every `src/providers/**/*.{ts,js,mjs}` file is imported at boot.
+2. Every `src/modules/<module>/providers.ts` file is imported at boot too, so a
+   module can plug itself into the app without the app knowing about it.
+3. Every `src/modules/<module>/providers/*.ts` file is imported at boot as well,
+   for a module that offers more than one implementation.
+4. A provider file claims a contract by registering an implementation.
+
+```ts
+// src/providers/payment.ts
+import { registerProvider } from "@/framework/facade.js";
+
+registerProvider("payment", {
+  async charge(order) {
+    return { id: "ch_123", status: "paid" };
+  }
+});
+```
+
+Read it back the same way:
+
+```ts
+import { getProvider } from "@/framework/facade.js";
+
+const payment = getProvider<any>("payment");
+```
+
+## Generating one
+
+```bash
+npm run maker provider:make payment
+npm run maker module:make-provider billing stripe
+```
+
+`provider:make` writes `src/providers/<name>.ts` for the whole app.
+`module:make-provider` writes `src/modules/<module>/providers/<name>.ts` for a
+single module. Both files register themselves when they are imported.
+
+## Replacing the built-in auth
+
+The framework ships with an auth module under `src/modules/auth`. To replace
+it, delete that folder and register your own auth provider:
+
+```ts
+// src/providers/auth.ts
+import { registerAuthProvider } from "@/framework/facade.js";
+import type { AuthProvider } from "@/framework/facade.js";
+
+const authProvider: AuthProvider = {
+  async getUserById(id) {
+    // Return any user shape you like. Extra fields (tenantId, plan, status, ...)
+    // are passed straight through to `c.get("auth")` / `res.locals.auth`.
+    return { id, email: "user@example.com", tenantId: 42, plan: "pro" };
+  },
+  async findRefreshToken(jti) {
+    // Return the stored refresh token, or null when it is unknown.
+    return { id: 1, jti, revoked: false, expiresAt: new Date() };
+  },
+  async revokeRefreshToken(tokenId) {
+    // Optional. Called when a refresh token is expired or revoked.
+  },
+  async getAuthContext(user, payload) {
+    // Optional. Shapes what handlers receive as the auth context.
+    return { id: user.id, email: user.email, tenantId: user.tenantId };
+  },
+  async getUserContact(userId) {
+    // Optional. Used by `notify()` to find the email address of a user.
+    return { email: "user@example.com", name: "User" };
+  }
+};
+
+registerAuthProvider(authProvider);
+```
+
+Import `registerAuthProvider` and the `AuthProvider` type from
+`@/framework/facade.js` — never from `@/framework/...` internals. The facade is
+the public API of the framework.
+
+## Module-to-module
+
+Modules do not import each other. They talk through:
+
+- `src/modules/<module>/facade.ts` — the public API of a module.
+- `dispatchEvent` / `dispatchCommand` — for cross-module notifications.
+- `src/providers/` — for app-wide implementations.
+
+## Contract reference
+
+| Method                              | Required | Purpose                                                        |
+| ----------------------------------- | -------- | -------------------------------------------------------------- |
+| `getUserById(id)`                   | Yes      | Loads a user. Any extra fields are passed through to the auth context. |
+| `findRefreshToken(jti)`             | Yes      | Loads a stored refresh token by its JWT id.                    |
+| `revokeRefreshToken(id)`            | No       | Revokes a refresh token. `deleteRefreshToken(id)` also works.  |
+| `getAuthContext(user, payload)`     | No       | Shapes the object handlers receive as `auth`.                   |
+| `getUserContact(userId)`            | No       | Finds the email/name of a user, used by notifications.         |
+
+When no provider is registered and `src/modules/auth` was deleted, the auth
+middleware logs a warning and lets the request through instead of crashing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nexwire",
-  "version": "4.2.1",
+  "version": "4.2.3",
   "type": "module",
   "description": "Scaffold a new nexwire project",
   "bin": {
@@ -235,4 +235,4 @@
       "optional": true
     }
   }
-}
+}

package/src/index.js

@@ -130,22 +130,30 @@ async function main() {
     console.log(`create-nexwire v${version}`);
     console.log();
     console.log("Usage:");
-    console.log("  npm create nexwire@latest <project-name> [--engine=<hono|express>]");
-    console.log("  pnpm create nexwire@latest <project-name> [--engine=<hono|express>]");
-    console.log("  bun create nexwire@latest <project-name> [--engine=<hono|express>]");
-    console.log("  npx create-nexwire@latest <project-name> [--engine=<hono|express>]");
+    console.log("  npm create nexwire@latest <project-name|.> [--engine=<hono|express>]");
+    console.log("  pnpm create nexwire@latest <project-name|.> [--engine=<hono|express>]");
+    console.log("  bun create nexwire@latest <project-name|.> [--engine=<hono|express>]");
+    console.log("  npx create-nexwire@latest <project-name|.> [--engine=<hono|express>]");
     console.log();
     console.log("Engines:");
     console.log("  hono     (default) Hono-based HTTP layer and OpenAPI");
     console.log("  express  Express-based HTTP layer and OpenAPI");
+    console.log();
+    console.log("Tip:");
+    console.log("  Use '.' to scaffold into the current directory (must be empty).");
     process.exit(0);
   }
 
   if (!projectName) {
-    projectName = await ask("Project name: ");
+    projectName = await ask("Project name or '.' for the current directory: ");
+  }
+
+  if (!projectName) {
+    console.error("Error: Please provide a project name or '.' to scaffold into the current directory.");
+    process.exit(1);
   }
 
-  if (!projectName || (projectName !== "." && !isValidProjectName(projectName))) {
+  if (projectName !== "." && !isValidProjectName(projectName)) {
     console.error("Error: Invalid project name. Use alphanumeric, dashes, or underscores, or '.' for the current directory.");
     process.exit(1);
   }