create-pyro 0.1.0 → 0.2.0

package/template/apps/api/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@repo/api",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "dotenv-run -- tsx watch --include '../../packages/*/dist/**' src/index.ts",
+    "build": "tsdown",
+    "start": "dotenv-run -- node dist/index.mjs",
+    "typecheck": "tsc",
+    "test": "dotenv-run -- vitest run",
+    "test:watch": "dotenv-run -- vitest"
+  },
+  "dependencies": {
+    "@better-auth/drizzle-adapter": "catalog:",
+    "@hono/node-server": "catalog:",
+    "@paralleldrive/cuid2": "catalog:",
+    "@repo/config": "workspace:*",
+    "@repo/db": "workspace:*",
+    "@repo/shared": "workspace:*",
+    "better-auth": "catalog:",
+    "drizzle-orm": "catalog:",
+    "hono": "catalog:"
+  },
+  "devDependencies": {
+    "@dotenv-run/cli": "catalog:",
+    "@types/node": "catalog:",
+    "@types/pg": "catalog:",
+    "pg": "catalog:",
+    "tsdown": "catalog:",
+    "tsx": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    }
+  },
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts"
+}

package/template/apps/api/src/app.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import { createApp } from "./app";
+import type { SessionResolver } from "./lib/session";
+
+const signedOut: SessionResolver = async () => null;
+
+describe("app", () => {
+  it("answers the health check", async () => {
+    const app = createApp({ sessionResolver: signedOut });
+    const res = await app.request("/api/health");
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true });
+  });
+
+  it("rejects /api/me when signed out", async () => {
+    const app = createApp({ sessionResolver: signedOut });
+    const res = await app.request("/api/me");
+    expect(res.status).toBe(401);
+    expect(await res.json()).toMatchObject({
+      success: false,
+      error: { code: "UNAUTHORIZED" },
+    });
+  });
+
+  it("returns a JSON 404 for unknown routes", async () => {
+    const app = createApp({ sessionResolver: signedOut });
+    const res = await app.request("/api/nope");
+    expect(res.status).toBe(404);
+  });
+
+  it("only allows the configured web origin", async () => {
+    const app = createApp({ sessionResolver: signedOut });
+    const allowed = await app.request("/api/health", {
+      headers: { Origin: "http://localhost:3000" },
+    });
+    const denied = await app.request("/api/health", {
+      headers: { Origin: "https://evil.example" },
+    });
+    expect(allowed.headers.get("access-control-allow-origin")).toBe(
+      "http://localhost:3000",
+    );
+    expect(denied.headers.get("access-control-allow-origin")).toBeNull();
+  });
+});

package/template/apps/api/src/app.ts

@@ -0,0 +1,54 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { HTTPException } from "hono/http-exception";
+import { logger } from "hono/logger";
+import { apiEnv } from "@repo/config";
+import { fail } from "./lib/response";
+import { resolveSession, type SessionResolver } from "./lib/session";
+import { createAuthMiddleware } from "./middleware/auth";
+import api from "./routes";
+import type { AppEnv } from "./types/context";
+
+export type CreateAppOptions = {
+  /** Swap how a request's session is resolved, e.g. with a stub in tests. */
+  sessionResolver?: SessionResolver;
+};
+
+const SKIP_LOG = new Set(["/api/health", "/api/auth/get-session"]);
+
+export function createApp(options: CreateAppOptions = {}) {
+  const resolver = options.sessionResolver ?? resolveSession;
+
+  return new Hono<AppEnv>()
+    .use("*", async (c, next) => {
+      if (apiEnv.NODE_ENV === "test" || SKIP_LOG.has(c.req.path)) return next();
+      return logger()(c, next);
+    })
+
+    .use(
+      "/api/*",
+      cors({
+        origin: (origin) => (origin === apiEnv.CORS_ORIGIN ? origin : null),
+        credentials: true,
+      }),
+    )
+
+    .use("/api/*", createAuthMiddleware(resolver))
+
+    .get("/api/health", (c) => c.json({ ok: true }))
+
+    .route("/api", api)
+
+    .notFound((c) => fail(c, "NOT_FOUND", "Not found", 404))
+
+    .onError((err, c) => {
+      if (err instanceof HTTPException) return err.getResponse();
+
+      console.error(err);
+      return fail(c, "INTERNAL", "Internal server error", 500);
+    });
+}
+
+const app = createApp();
+
+export default app;

package/template/apps/api/src/index.ts

@@ -0,0 +1,13 @@
+import { serve } from "@hono/node-server";
+import { apiEnv } from "@repo/config";
+import app from "./app";
+
+const isProd = apiEnv.NODE_ENV === "production";
+
+serve({ fetch: app.fetch, port: apiEnv.API_PORT }, (info) => {
+  console.log(
+    `API running on ${isProd ? `port ${info.port}` : `http://localhost:${info.port}`}`,
+  );
+});
+
+export type AppType = typeof app;

package/template/apps/api/src/lib/auth.ts

@@ -0,0 +1,46 @@
+import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+import { createId } from "@paralleldrive/cuid2";
+import { betterAuth } from "better-auth";
+import { apiEnv, authEnv } from "@repo/config";
+import {
+  accountsTable,
+  db,
+  sessionsTable,
+  usersTable,
+  verificationsTable,
+} from "@repo/db";
+import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH } from "@repo/shared";
+
+export const auth = betterAuth({
+  baseURL: authEnv.BETTER_AUTH_URL,
+  secret: authEnv.BETTER_AUTH_SECRET,
+  basePath: "/api/auth",
+  database: drizzleAdapter(db, {
+    provider: "pg",
+    schema: {
+      user: usersTable,
+      session: sessionsTable,
+      account: accountsTable,
+      verification: verificationsTable,
+    },
+  }),
+  emailAndPassword: {
+    enabled: true,
+    minPasswordLength: PASSWORD_MIN_LENGTH,
+    maxPasswordLength: PASSWORD_MAX_LENGTH,
+  },
+  // To add Google sign-in: add GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET to
+  // authSchema in packages/config, then uncomment this block.
+  // socialProviders: {
+  //   google: {
+  //     clientId: authEnv.GOOGLE_CLIENT_ID,
+  //     clientSecret: authEnv.GOOGLE_CLIENT_SECRET,
+  //   },
+  // },
+  advanced: {
+    database: {
+      generateId: () => createId(),
+    },
+  },
+  trustedOrigins: [apiEnv.CORS_ORIGIN],
+});

package/template/apps/api/src/lib/response.ts

@@ -0,0 +1,28 @@
+import type { Context } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import type { ApiError, ApiSuccess } from "@repo/shared";
+import type { AppEnv } from "../types/context";
+
+/** The signed-in user. Only call behind `requireAuth()`. */
+export function getUser(c: Context<AppEnv>) {
+  const user = c.get("user");
+  if (!user) throw new Error("No user on the context — requireAuth() missing");
+  return user;
+}
+
+export function ok<T>(c: Context, data: T, status: ContentfulStatusCode = 200) {
+  return c.json({ success: true, data } satisfies ApiSuccess<T>, status);
+}
+
+export function fail(
+  c: Context,
+  code: string,
+  message: string,
+  status: ContentfulStatusCode = 400,
+  details?: unknown,
+) {
+  return c.json(
+    { success: false, error: { code, message, details } } satisfies ApiError,
+    status,
+  );
+}

package/template/apps/api/src/lib/session.ts

@@ -0,0 +1,22 @@
+import { auth } from "./auth";
+
+export type Actor = {
+  id: string;
+  name: string;
+  email: string;
+};
+
+export type ResolvedSession = {
+  user: Actor;
+  sessionId: string;
+} | null;
+
+export type SessionResolver = (headers: Headers) => Promise<ResolvedSession>;
+
+export const resolveSession: SessionResolver = async (headers) => {
+  const session = await auth.api.getSession({ headers });
+  if (!session) return null;
+
+  const { id, name, email } = session.user;
+  return { user: { id, name, email }, sessionId: session.session.id };
+};

package/template/apps/api/src/middleware/auth.ts

@@ -0,0 +1,34 @@
+import type { MiddlewareHandler } from "hono";
+import { createMiddleware } from "hono/factory";
+import { fail } from "../lib/response";
+import type { SessionResolver } from "../lib/session";
+import type { AppEnv } from "../types/context";
+
+/** Puts the request's user (or null) on the context for every /api route. */
+export function createAuthMiddleware(
+  resolver: SessionResolver,
+): MiddlewareHandler<AppEnv> {
+  return async (c, next) => {
+    c.set("user", null);
+    c.set("sessionId", null);
+
+    const path = c.req.path;
+    if (path.startsWith("/api/auth") || path === "/api/health") return next();
+
+    const resolved = await resolver(c.req.raw.headers);
+    if (resolved) {
+      c.set("user", resolved.user);
+      c.set("sessionId", resolved.sessionId);
+    }
+
+    await next();
+  };
+}
+
+/** Rejects the request with 401 unless someone is signed in. */
+export const requireAuth = () =>
+  createMiddleware<AppEnv>(async (c, next) => {
+    if (!c.get("user"))
+      return fail(c, "UNAUTHORIZED", "You need to sign in", 401);
+    await next();
+  });

package/template/apps/api/src/routes/auth.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import { auth } from "../lib/auth";
+import type { AppEnv } from "../types/context";
+
+const authRouter = new Hono<AppEnv>().on(["GET", "POST"], "/*", (c) =>
+  auth.handler(c.req.raw),
+);
+
+export default authRouter;

package/template/apps/api/src/routes/index.ts

@@ -0,0 +1,8 @@
+import { Hono } from "hono";
+import type { AppEnv } from "../types/context";
+import authRouter from "./auth";
+import me from "./me";
+
+const api = new Hono<AppEnv>().route("/auth", authRouter).route("/me", me);
+
+export default api;

package/template/apps/api/src/routes/me.test.ts

@@ -0,0 +1,45 @@
+import { isCuid } from "@paralleldrive/cuid2";
+import { testClient } from "hono/testing";
+import { describe, expect, it } from "vitest";
+import app from "../app";
+
+// Runs against the real test database (see src/test/global-setup.ts).
+
+const ORIGIN = "http://localhost:3000";
+
+async function signUp() {
+  const email = `user-${crypto.randomUUID()}@example.com`;
+  const res = await app.request("/api/auth/sign-up/email", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Origin: ORIGIN },
+    body: JSON.stringify({ name: "Test User", email, password: "password123" }),
+  });
+  expect(res.status).toBe(200);
+
+  const cookie = res.headers
+    .getSetCookie()
+    .map((c) => c.split(";")[0])
+    .join("; ");
+  return { email, cookie };
+}
+
+describe("GET /api/me", () => {
+  const client = testClient(app);
+
+  it("returns the signed-in user, with a cuid2 id", async () => {
+    const { email, cookie } = await signUp();
+
+    const res = await client.api.me.$get({}, { headers: { cookie } });
+    expect(res.status).toBe(200);
+
+    const body = await res.json();
+    if (!body.success) throw new Error(body.error.message);
+    expect(body.data).toMatchObject({ email, name: "Test User" });
+    expect(isCuid(body.data.id)).toBe(true);
+  });
+
+  it("returns 401 without a session cookie", async () => {
+    const res = await client.api.me.$get();
+    expect(res.status).toBe(401);
+  });
+});

package/template/apps/api/src/routes/me.ts

@@ -0,0 +1,29 @@
+import { eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { db, usersTable } from "@repo/db";
+import { fail, getUser, ok } from "../lib/response";
+import { requireAuth } from "../middleware/auth";
+import type { AppEnv } from "../types/context";
+
+const me = new Hono<AppEnv>().get("/", requireAuth(), async (c) => {
+  const { id } = getUser(c);
+
+  const [user] = await db
+    .select({
+      id: usersTable.id,
+      name: usersTable.name,
+      email: usersTable.email,
+      emailVerified: usersTable.emailVerified,
+      image: usersTable.image,
+      createdAt: usersTable.createdAt,
+      updatedAt: usersTable.updatedAt,
+    })
+    .from(usersTable)
+    .where(eq(usersTable.id, id))
+    .limit(1);
+
+  if (!user) return fail(c, "NOT_FOUND", "User not found", 404);
+  return ok(c, user);
+});
+
+export default me;

package/template/apps/api/src/test/database-url.ts

@@ -0,0 +1,23 @@
+/**
+ * The database the suite runs against: TEST_DATABASE_URL if set, otherwise
+ * DATABASE_URL with `_test` appended to its name, so tests never touch the
+ * dev database.
+ */
+export function testDatabaseUrl() {
+  const explicit = process.env.TEST_DATABASE_URL;
+  const base = explicit ?? process.env.DATABASE_URL;
+
+  if (!base)
+    throw new Error(
+      "Set DATABASE_URL (or TEST_DATABASE_URL) before running the apps/api suite.",
+    );
+
+  if (explicit) return explicit;
+
+  const url = new URL(base);
+  const name = url.pathname.replace(/^\//, "");
+  if (!name) throw new Error("No database name in DATABASE_URL");
+  if (!name.endsWith("_test")) url.pathname = `/${name}_test`;
+
+  return url.toString();
+}

package/template/apps/api/src/test/global-setup.ts

@@ -0,0 +1,36 @@
+import { fileURLToPath } from "node:url";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Client, Pool } from "pg";
+import { testDatabaseUrl } from "./database-url";
+
+const MIGRATIONS = fileURLToPath(
+  new URL("../../../../packages/db/drizzle", import.meta.url),
+);
+
+/** Creates the test database if it's missing, then applies every migration. */
+export default async function setup() {
+  const url = testDatabaseUrl();
+  const name = new URL(url).pathname.replace(/^\//, "");
+
+  const admin = new URL(url);
+  admin.pathname = "/postgres";
+  const client = new Client({ connectionString: admin.toString() });
+  await client.connect();
+  try {
+    const { rowCount } = await client.query(
+      "select 1 from pg_database where datname = $1",
+      [name],
+    );
+    if (!rowCount) await client.query(`CREATE DATABASE "${name}"`);
+  } finally {
+    await client.end();
+  }
+
+  const pool = new Pool({ connectionString: url });
+  try {
+    await migrate(drizzle(pool), { migrationsFolder: MIGRATIONS });
+  } finally {
+    await pool.end();
+  }
+}

package/template/apps/api/src/test/setup.ts

@@ -0,0 +1,8 @@
+import { testDatabaseUrl } from "./database-url";
+
+process.env.DATABASE_URL = testDatabaseUrl();
+process.env.NODE_ENV = "test";
+
+process.env.BETTER_AUTH_URL ??= "http://localhost:3002";
+process.env.BETTER_AUTH_SECRET ??= "test-secret-at-least-32-characters-long!!";
+process.env.CORS_ORIGIN ??= "http://localhost:3000";

package/template/apps/api/src/types/context.ts

@@ -0,0 +1,8 @@
+import type { Actor } from "../lib/session";
+
+export type AppEnv = {
+  Variables: {
+    user: Actor | null;
+    sessionId: string | null;
+  };
+};

package/template/apps/api/tsconfig.build.json

@@ -0,0 +1,8 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "composite": false,
+    "noEmit": false
+  },
+  "exclude": ["src/**/*.test.ts", "src/test"]
+}

package/template/apps/api/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "src",
+    "types": ["node"]
+  },
+  "include": ["src"]
+}

package/template/apps/api/tsdown.config.ts

@@ -0,0 +1,13 @@
+import { defineConfig } from "tsdown";
+
+export default defineConfig({
+  tsconfig: "tsconfig.build.json",
+  entry: ["src/index.ts"],
+  format: ["esm"],
+  // The declarations are what apps/web imports `AppType` from.
+  dts: true,
+  sourcemap: true,
+  clean: true,
+  treeshake: true,
+  target: false,
+});

package/template/apps/api/vitest.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    globalSetup: ["./src/test/global-setup.ts"],
+    setupFiles: ["./src/test/setup.ts"],
+    fileParallelism: false,
+    hookTimeout: 30_000,
+    testTimeout: 30_000,
+  },
+});

package/template/apps/web/Dockerfile

@@ -0,0 +1,49 @@
+FROM node:24-alpine AS builder
+WORKDIR /app
+
+# Vite resolves the root tsconfig's project references, so the tsconfigs of
+# workspaces this image doesn't build (api, db) still need to be present.
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml tsconfig.json ./
+COPY apps/api/package.json apps/api/tsconfig.json ./apps/api/
+COPY apps/web/package.json ./apps/web/
+COPY packages/config/package.json ./packages/config/
+COPY packages/db/package.json packages/db/tsconfig.json ./packages/db/
+COPY packages/shared/package.json ./packages/shared/
+
+RUN corepack enable && pnpm install --frozen-lockfile --filter @repo/web...
+
+COPY apps/web ./apps/web
+COPY packages/config ./packages/config
+COPY packages/shared ./packages/shared
+
+# @repo/api is a types-only devDependency; the bundler drops those imports,
+# so the api itself doesn't need building here.
+RUN pnpm --filter @repo/config --filter @repo/shared --filter @repo/web build
+
+FROM node:24-alpine
+WORKDIR /app
+
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY apps/api/package.json ./apps/api/
+COPY apps/web/package.json ./apps/web/
+COPY packages/config/package.json ./packages/config/
+COPY packages/db/package.json ./packages/db/
+COPY packages/shared/package.json ./packages/shared/
+
+RUN corepack enable && pnpm install --frozen-lockfile --filter @repo/web... --prod
+
+COPY --from=builder /app/packages/config/dist ./packages/config/dist
+COPY --from=builder /app/packages/shared/dist ./packages/shared/dist
+COPY --from=builder /app/apps/web/dist ./apps/web/dist
+
+ENV NODE_ENV=production
+ENV PORT=3000
+EXPOSE 3000
+
+USER node
+WORKDIR /app/apps/web
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:3000/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node_modules/.bin/react-router-serve", "dist/server/index.js"]

package/template/apps/web/app/app.css

@@ -0,0 +1,29 @@
+@import "tailwindcss";
+
+@theme {
+  --font-sans:
+    ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto,
+    "Helvetica Neue", Arial, sans-serif;
+  --font-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+
+  --color-ink: oklch(0.21 0.01 60);
+  --color-ink-muted: oklch(0.5 0.01 60);
+  --color-surface: oklch(0.99 0.003 80);
+  --color-surface-raised: oklch(1 0 0);
+  --color-line: oklch(0.91 0.006 80);
+  --color-accent: oklch(0.62 0.19 40);
+  --color-accent-strong: oklch(0.54 0.19 38);
+  --color-danger: oklch(0.55 0.2 25);
+}
+
+@layer base {
+  html {
+    color-scheme: light;
+    -webkit-font-smoothing: antialiased;
+    -moz-osx-font-smoothing: grayscale;
+  }
+
+  body {
+    @apply bg-surface font-sans text-ink;
+  }
+}

package/template/apps/web/app/lib/api.server.ts

@@ -0,0 +1,13 @@
+import { hc } from "hono/client";
+import type { AppType } from "@repo/api";
+import { serverEnv } from "./env.server";
+
+/**
+ * A typed api client for loaders and actions. It forwards the incoming
+ * request's cookies, so calls run as the signed-in user.
+ */
+export function api(request: Request) {
+  return hc<AppType>(serverEnv.INTERNAL_API_URL, {
+    headers: { cookie: request.headers.get("cookie") ?? "" },
+  });
+}

package/template/apps/web/app/lib/api.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import { ApiRequestError, unwrap } from "./api";
+
+const respond = (status: number, body: unknown) =>
+  new Response(JSON.stringify(body), { status });
+
+describe("unwrap", () => {
+  it("returns the data of a successful response", async () => {
+    const data = await unwrap(
+      respond(200, { success: true, data: { id: "abc" } }),
+    );
+    expect(data).toEqual({ id: "abc" });
+  });
+
+  it("throws the api's error for a failed response", async () => {
+    const promise = unwrap(
+      respond(401, {
+        success: false,
+        error: { code: "UNAUTHORIZED", message: "You need to sign in" },
+      }),
+    );
+    await expect(promise).rejects.toBeInstanceOf(ApiRequestError);
+    await expect(promise).rejects.toMatchObject({
+      code: "UNAUTHORIZED",
+      status: 401,
+    });
+  });
+});