create-nexwire 4.3.0 → 4.4.0

package/fastify/src/modules/auth/database/models/user.ts

@@ -0,0 +1,46 @@
+import { relations } from "drizzle-orm";
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+import { roles } from "@/modules/auth/database/models/role.js";
+
+export const users = sqliteTable("users", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  password: text("password").notNull(),
+  roleId: integer("role_id").references(() => roles.id, { onUpdate: "cascade", onDelete: "set null" }),
+  emailVerifiedAt: integer("email_verified_at", { mode: "timestamp" }),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const emailVerificationTokens = sqliteTable("email_verification_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  email: text("email").notNull(),
+  token: text("token").notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const passwordResetTokens = sqliteTable("password_reset_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  email: text("email").notNull(),
+  token: text("token").notNull(),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const refreshTokens = sqliteTable("refresh_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: integer("user_id").references(() => users.id, { onUpdate: "cascade", onDelete: "set null" }),
+  jti: text("jti").notNull().unique(),
+  revoked: integer("revoked", { mode: "boolean" }).default(false),
+  expiresAt: integer("expires_at", { mode: "timestamp" }).notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull()
+});
+
+export const usersRelations = relations(users, ({ one }) => ({
+  role: one(roles, {
+    fields: [users.roleId],
+    references: [roles.id]
+  })
+}));

package/fastify/src/modules/auth/database/seeders/role.ts

@@ -0,0 +1,18 @@
+import { eq } from "drizzle-orm";
+import { db } from "@/framework/facade.js";
+import { roles } from "@/modules/auth/database/models/role.js";
+
+export const table = roles;
+
+export default async function RoleSeeder() {
+  const rows = [{ name: "admin" }, { name: "user" }];
+
+  for (const row of rows) {
+    const existing = await db.query.roles.findFirst({ where: eq(roles.name, row.name) });
+    if (!existing) {
+      await db.insert(roles).values({ name: row.name });
+    }
+  }
+
+  console.log("Role seeder completed");
+}

package/fastify/src/modules/auth/database/seeders/user.ts

@@ -0,0 +1,35 @@
+import { eq } from "drizzle-orm";
+import { db, password } from "@/framework/facade.js";
+import { roles } from "@/modules/auth/database/models/role.js";
+import { users } from "@/modules/auth/database/models/user.js";
+
+export const table = users;
+
+export default async function UserSeeder() {
+  const adminRole = await db.query.roles.findFirst({ where: eq(roles.name, "admin") });
+  const userRole = await db.query.roles.findFirst({ where: eq(roles.name, "user") });
+
+  const rows = [
+    {
+      name: "Admin",
+      email: "admin@example.com",
+      password: await password.hashPassword("Password@123"),
+      roleId: adminRole?.id ?? null
+    },
+    {
+      name: "User One",
+      email: "user1@example.com",
+      password: await password.hashPassword("Password@123"),
+      roleId: userRole?.id ?? null
+    }
+  ];
+
+  for (const row of rows) {
+    const existing = await db.query.users.findFirst({ where: eq(users.email, row.email) });
+    if (!existing) {
+      await db.insert(users).values(row);
+    }
+  }
+
+  console.log("User seeder completed");
+}

package/fastify/src/modules/auth/facade.ts

@@ -0,0 +1,12 @@
+/**
+ * Public API for the auth module.
+ *
+ * Other modules import from this file, never from controllers/ or services/ directly.
+ * Re-export the pieces they are allowed to depend on:
+ *
+ * export { list, findOne } from "./services/auth.js";
+ *
+ * Rule: a facade must never import another module's facade.
+ */
+
+export { getCurrentUser, hasRole } from "@/modules/auth/helpers/auth.js";

package/fastify/src/modules/auth/helpers/auth.ts

@@ -0,0 +1,115 @@
+import { createHash, randomBytes } from "node:crypto";
+import { eq } from "drizzle-orm";
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { jwtConfig } from "@/config/index.js";
+import { cookie, db, jwt } from "@/framework/facade.js";
+import { refreshTokens, users } from "@/modules/auth/database/models/user.js";
+
+export function hasRole(auth: any, rolesToMatch: string[]) {
+  const role = String(auth?.role || "").toLowerCase();
+  return rolesToMatch.includes(role);
+}
+
+export async function getCurrentUser(auth: any) {
+  if (!auth?.id) return null;
+  return db.query.users.findFirst({
+    where: eq(users.id, Number(auth.id)),
+    with: { role: true },
+    columns: {
+      password: false,
+      rememberToken: false
+    }
+  });
+}
+
+export function sanitizeUser(user: any) {
+  return {
+    id: user.id,
+    name: user.name,
+    email: user.email,
+    emailVerifiedAt: user.emailVerifiedAt ? String(user.emailVerifiedAt) : null,
+    roleId: user.roleId ?? null,
+    role: user.role
+      ? {
+          id: user.role.id,
+          name: user.role.name,
+          createdAt: user.role.createdAt ? String(user.role.createdAt) : null,
+          updatedAt: user.role.updatedAt ? String(user.role.updatedAt) : null
+        }
+      : null,
+    createdAt: user.createdAt ? String(user.createdAt) : null,
+    updatedAt: user.updatedAt ? String(user.updatedAt) : null
+  };
+}
+
+export function makeResetToken() {
+  return randomBytes(32).toString("hex");
+}
+
+export function makeEmailVerificationToken() {
+  return randomBytes(32).toString("hex");
+}
+
+export function hashResetToken(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export function hashEmailVerificationToken(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+export async function revokeCurrentRefreshToken(request: FastifyRequest) {
+  const token = await cookie.getRefresh(request);
+  if (!token) return;
+
+  const payload = await jwt.verifyToken(token, "refresh");
+  if (payload?.jti) {
+    await db.delete(refreshTokens).where(eq(refreshTokens.jti, payload.jti as string));
+  }
+}
+
+export async function issueTokens(
+  _request: FastifyRequest,
+  reply: FastifyReply,
+  user: any,
+  options?: { remember?: boolean }
+) {
+  const remember = !!options?.remember;
+  const refreshExpiry = remember ? jwtConfig.refreshRememberExpirySeconds : jwtConfig.refreshExpirySeconds;
+  const role = user.role || null;
+  const accessToken = await jwt.generateToken(
+    {
+      id: user.id,
+      email: user.email,
+      roleId: role?.id ?? null,
+      role: role?.name ?? null,
+      remember
+    },
+    "access"
+  );
+  const refreshToken = await jwt.generateToken(
+    {
+      id: user.id,
+      email: user.email,
+      roleId: role?.id ?? null,
+      role: role?.name ?? null,
+      remember
+    },
+    "refresh",
+    refreshExpiry
+  );
+
+  if (refreshToken.jti) {
+    await db.insert(refreshTokens).values({
+      userId: user.id,
+      jti: refreshToken.jti,
+      revoked: 0,
+      expiresAt: new Date(refreshToken.exp * 1000)
+    });
+  }
+
+  await cookie.setAuth(reply, accessToken.token);
+  await cookie.setRefresh(reply, refreshToken.token, refreshExpiry);
+
+  return { accessToken: accessToken.token, refreshToken: refreshToken.token };
+}

package/fastify/src/modules/auth/jobs/forgetpass.ts

@@ -0,0 +1,20 @@
+import { dispatchEvent, mail, shouldQueue } from "@/framework/facade.js";
+
+shouldQueue("user:forget-password", "mail", async (job: any) => {
+  const { email, name, resetUrl } = job.data;
+
+  await mail.sendMail({
+    to: email,
+    subject: "Reset Your Password",
+    html: `
+      <p>Hello ${name},</p>
+      <p>Click the link below to reset your password:</p>
+      <p><a href="${resetUrl}">${resetUrl}</a></p>
+      <p>This link will expire in 15 minutes.</p>
+    `
+  });
+
+  await dispatchEvent("user.changed", { email: email }, { broadcast: { auth: true } });
+
+  return { ok: true, resetUrl };
+});

package/fastify/src/modules/auth/jobs/registeruser.ts

@@ -0,0 +1,23 @@
+import { DateTime as Datetime } from "luxon";
+import { dispatchEvent, mail, shouldQueue } from "@/framework/facade.js";
+
+shouldQueue("user:signup", "mail", async (job: any) => {
+  const { email, name, userId } = job.data;
+
+  await mail.sendMail({
+    to: email,
+    subject: "Welcome to <AppName>",
+    html: `
+      <p>Hello ${name},</p>
+      <p>Your account was created successfully.</p>
+      <p>You can log in with the email and password you chose during signup.</p>
+      <p><a href="https://app.example.com/login">Log in</a></p>
+    `
+  });
+
+  await dispatchEvent("admin.user.registered", { userId, name, email, createdAt: Datetime.now() }, { broadcast: { roles: ["admin"] } });
+
+  await dispatchEvent("user.registered", { message: "Welcome! Your account has been created." }, { broadcast: { users: [userId] } });
+
+  return { ok: true, userId };
+});

package/fastify/src/modules/auth/jobs/verifyemail.ts

@@ -0,0 +1,18 @@
+import { mail, shouldQueue } from "@/framework/facade.js";
+
+shouldQueue("user:verify-email", "mail", async (job: any) => {
+  const { email, name, verifyUrl } = job.data;
+
+  await mail.sendMail({
+    to: email,
+    subject: "Verify Your Email",
+    html: `
+      <p>Hello ${name},</p>
+      <p>Thanks for registering. Please verify your email by clicking the link below:</p>
+      <p><a href="${verifyUrl}">${verifyUrl}</a></p>
+      <p>This link will expire in 24 hours.</p>
+    `
+  });
+
+  return { ok: true, verifyUrl };
+});

package/fastify/src/modules/auth/routes/index.ts

@@ -0,0 +1,185 @@
+import type { FastifyPluginAsyncZod } from "fastify-type-provider-zod";
+import { HttpStatusCodes, loginLimiter, ValidationErrorSchema, z } from "@/framework/facade.js";
+import { authMiddleware } from "@/middlewares/auth-middleware.js";
+import {
+  forgotPassword,
+  login,
+  logout,
+  logoutAllDevices,
+  me,
+  refreshToken,
+  register,
+  resetPassword,
+  verifyEmail
+} from "@/modules/auth/controllers/auth.js";
+import {
+  AuthResponseSchema,
+  ForgotPasswordSchema,
+  LoginSchema,
+  MeResponseSchema,
+  MessageSchema,
+  RefreshTokenSchema,
+  RegisterResponseSchema,
+  RegisterSchema,
+  ResetPasswordSchema,
+  VerifyEmailSchema
+} from "@/modules/auth/schemas/auth.js";
+
+const ErrorSchema = z.object({ message: z.string() });
+
+/**
+ * Why: Auth HTTP surface, split into public and protected scopes.
+ * When: Mounted by the module route loader at `/api/auth`.
+ * Where: `src/modules/auth/routes/index.ts`.
+ * How: Public routes use the strict login rate limit; protected routes live in
+ *      a child plugin whose scoped `preHandler` hook resolves `request.auth`.
+ */
+const authRoutes: FastifyPluginAsyncZod = async (app) => {
+  app.route({
+    method: "POST",
+    url: "/register",
+    schema: {
+      tags: ["Auth"],
+      description: "Register a new user",
+      body: RegisterSchema,
+      response: {
+        [HttpStatusCodes.CREATED]: RegisterResponseSchema,
+        [HttpStatusCodes.UNPROCESSABLE_ENTITY]: ValidationErrorSchema
+      }
+    },
+    config: { rateLimit: loginLimiter },
+    handler: register
+  });
+
+  app.route({
+    method: "POST",
+    url: "/login",
+    schema: {
+      tags: ["Auth"],
+      description: "Login user",
+      body: LoginSchema,
+      response: {
+        [HttpStatusCodes.OK]: AuthResponseSchema,
+        [HttpStatusCodes.UNAUTHORIZED]: ErrorSchema,
+        [HttpStatusCodes.FORBIDDEN]: ErrorSchema,
+        [HttpStatusCodes.UNPROCESSABLE_ENTITY]: ValidationErrorSchema
+      }
+    },
+    config: { rateLimit: loginLimiter },
+    handler: login
+  });
+
+  app.route({
+    method: "POST",
+    url: "/forgot-password",
+    schema: {
+      tags: ["Auth"],
+      description: "Send reset password email",
+      body: ForgotPasswordSchema,
+      response: {
+        [HttpStatusCodes.OK]: MessageSchema,
+        [HttpStatusCodes.UNPROCESSABLE_ENTITY]: ValidationErrorSchema
+      }
+    },
+    config: { rateLimit: loginLimiter },
+    handler: forgotPassword
+  });
+
+  app.route({
+    method: "POST",
+    url: "/reset-password",
+    schema: {
+      tags: ["Auth"],
+      description: "Reset password using token",
+      body: ResetPasswordSchema,
+      response: {
+        [HttpStatusCodes.OK]: MessageSchema,
+        [HttpStatusCodes.UNPROCESSABLE_ENTITY]: ValidationErrorSchema
+      }
+    },
+    config: { rateLimit: loginLimiter },
+    handler: resetPassword
+  });
+
+  app.route({
+    method: "POST",
+    url: "/verify-email",
+    schema: {
+      tags: ["Auth"],
+      description: "Verify user email using token",
+      body: VerifyEmailSchema,
+      response: {
+        [HttpStatusCodes.OK]: MessageSchema,
+        [HttpStatusCodes.UNPROCESSABLE_ENTITY]: ValidationErrorSchema
+      }
+    },
+    config: { rateLimit: loginLimiter },
+    handler: verifyEmail
+  });
+
+  app.route({
+    method: "POST",
+    url: "/refresh-token",
+    schema: {
+      tags: ["Auth"],
+      description: "Refresh access token",
+      body: RefreshTokenSchema,
+      response: {
+        [HttpStatusCodes.OK]: AuthResponseSchema,
+        [HttpStatusCodes.UNAUTHORIZED]: ErrorSchema,
+        [HttpStatusCodes.UNPROCESSABLE_ENTITY]: ValidationErrorSchema
+      }
+    },
+    config: { rateLimit: loginLimiter },
+    handler: refreshToken
+  });
+
+  await app.register(async (protectedScope) => {
+    protectedScope.addHook("preHandler", authMiddleware);
+
+    protectedScope.route({
+      method: "GET",
+      url: "/me",
+      schema: {
+        tags: ["Auth"],
+        description: "Get authenticated user",
+        response: {
+          [HttpStatusCodes.OK]: MeResponseSchema,
+          [HttpStatusCodes.UNAUTHORIZED]: ErrorSchema,
+          [HttpStatusCodes.NOT_FOUND]: ErrorSchema
+        }
+      },
+      handler: me
+    });
+
+    protectedScope.route({
+      method: "POST",
+      url: "/logout",
+      schema: {
+        tags: ["Auth"],
+        description: "Logout user from current device",
+        response: {
+          [HttpStatusCodes.OK]: MessageSchema,
+          [HttpStatusCodes.UNAUTHORIZED]: ErrorSchema
+        }
+      },
+      handler: logout
+    });
+
+    protectedScope.route({
+      method: "POST",
+      url: "/logout-all",
+      schema: {
+        tags: ["Auth"],
+        description: "Logout user from all devices",
+        response: {
+          [HttpStatusCodes.OK]: MessageSchema,
+          [HttpStatusCodes.UNAUTHORIZED]: ErrorSchema
+        }
+      },
+      handler: logoutAllDevices
+    });
+  });
+};
+
+export default authRoutes;

package/fastify/src/modules/auth/routes/role.ts

@@ -0,0 +1,56 @@
+import type { FastifyPluginAsyncZod } from "fastify-type-provider-zod";
+import { HttpStatusCodes, ValidationErrorSchema, z } from "@/framework/facade.js";
+import { authMiddleware } from "@/middlewares/auth-middleware.js";
+import { requireRole } from "@/middlewares/role-middleware.js";
+import { index, show } from "@/modules/auth/controllers/role.js";
+import { IdParamsSchema, RoleSchema } from "@/modules/auth/schemas/auth.js";
+
+const ErrorSchema = z.object({ message: z.string() });
+
+/**
+ * Why: Admin-only role lookup endpoints.
+ * When: Mounted by the module route loader at `/api/auth`.
+ * Where: `src/modules/auth/routes/role.ts`.
+ * How: A scoped `preHandler` chain runs auth first, then the role check.
+ */
+const roleRoutes: FastifyPluginAsyncZod = async (app) => {
+  await app.register(async (scope) => {
+    scope.addHook("preHandler", authMiddleware);
+    scope.addHook("preHandler", requireRole("admin"));
+
+    scope.route({
+      method: "GET",
+      url: "/role",
+      schema: {
+        tags: ["Role"],
+        description: "List all roles",
+        response: {
+          [HttpStatusCodes.OK]: z.object({ message: z.string(), data: z.array(RoleSchema) }),
+          [HttpStatusCodes.UNAUTHORIZED]: ErrorSchema,
+          [HttpStatusCodes.UNPROCESSABLE_ENTITY]: ValidationErrorSchema,
+          [HttpStatusCodes.FORBIDDEN]: ErrorSchema
+        }
+      },
+      handler: index
+    });
+
+    scope.route({
+      method: "GET",
+      url: "/role/:id",
+      schema: {
+        tags: ["Role"],
+        description: "Show one role",
+        params: IdParamsSchema,
+        response: {
+          [HttpStatusCodes.OK]: z.object({ message: z.string(), data: RoleSchema.nullable() }),
+          [HttpStatusCodes.UNAUTHORIZED]: ErrorSchema,
+          [HttpStatusCodes.UNPROCESSABLE_ENTITY]: ValidationErrorSchema,
+          [HttpStatusCodes.FORBIDDEN]: ErrorSchema
+        }
+      },
+      handler: show
+    });
+  });
+};
+
+export default roleRoutes;

package/fastify/src/modules/auth/schemas/auth.ts

@@ -0,0 +1,116 @@
+import { z } from "@/framework/facade.js";
+
+export const MessageSchema = z.object({
+  message: z.string()
+});
+
+export const RoleSchema = z.object({
+  id: z.number(),
+  name: z.string(),
+  createdAt: z.string().nullable().optional(),
+  updatedAt: z.string().nullable().optional()
+});
+
+export const UserSchema = z.object({
+  id: z.number(),
+  name: z.string(),
+  email: z.email(),
+  roleId: z.number().nullable().optional(),
+  role: RoleSchema.nullable().optional(),
+  emailVerifiedAt: z.string().nullable().optional(),
+  createdAt: z.string().nullable().optional(),
+  updatedAt: z.string().nullable().optional()
+});
+
+export const RegisterSchema = z
+  .object({
+    name: z.string().min(2).max(100),
+    email: z.email(),
+    password: z
+      .string()
+      .min(6)
+      .max(100)
+      .regex(/[a-z]/, "Password must contain lowercase letter")
+      .regex(/[A-Z]/, "Password must contain uppercase letter")
+      .regex(/[^A-Za-z0-9]/, "Password must contain special character"),
+    password_confirmation: z.string()
+  })
+  .superRefine((data, ctx) => {
+    if (data.password !== data.password_confirmation) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["password_confirmation"],
+        message: "Password confirmation does not match"
+      });
+    }
+  });
+
+export const LoginSchema = z.object({
+  email: z.email(),
+  password: z.string().min(1),
+  remember: z.boolean().optional().default(false)
+});
+
+export const ForgotPasswordSchema = z.object({
+  email: z.email()
+});
+
+export const ResetPasswordSchema = z
+  .object({
+    email: z.email(),
+    token: z.string().min(1),
+    password: z
+      .string()
+      .min(6)
+      .max(100)
+      .regex(/[a-z]/, "Password must contain lowercase letter")
+      .regex(/[A-Z]/, "Password must contain uppercase letter")
+      .regex(/[^A-Za-z0-9]/, "Password must contain special character"),
+    password_confirmation: z.string()
+  })
+  .superRefine((data, ctx) => {
+    if (data.password !== data.password_confirmation) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["password_confirmation"],
+        message: "Password confirmation does not match"
+      });
+    }
+  });
+
+export const RefreshTokenSchema = z.object({
+  refresh_token: z.string().min(1)
+});
+
+export const VerifyEmailSchema = z.object({
+  email: z.email(),
+  token: z.string().min(1)
+});
+
+export const AuthResponseSchema = z.object({
+  message: z.string(),
+  data: z.object({
+    user: UserSchema,
+    access_token: z.string(),
+    refresh_token: z.string(),
+    token_type: z.literal("Bearer")
+  })
+});
+
+/**
+ * Register returns 201 with only `message` when email verification is required,
+ * so `data` must be optional. Fastify enforces response schemas at runtime.
+ */
+export const RegisterResponseSchema = z.object({
+  message: z.string(),
+  data: AuthResponseSchema.shape.data.optional()
+});
+
+export const MeResponseSchema = z.object({
+  message: z.string(),
+  data: UserSchema
+});
+
+export const IdParamsSchema = z.object({
+  id: z.coerce.number()
+});