create-restack-pattern 0.1.8 → 0.2.1

package/template/{backend → base/backend}/src/domains/auth/auth.repo.ts

@@ -9,7 +9,7 @@ type SessionRow = typeof authSessionsTable.$inferSelect
 /**
  * Repository layer for the Auth domain.
  * Encapsulates sessions management and credential-based queries.
- * 
+ *
  * Semi-DDD rules:
  * - Direct database interactions (Drizzle client) must live only inside `.repo.ts` files.
  * - Under cross-domain rules, the Auth domain can query the User domain's tables (e.g. `usersTable`)
@@ -24,13 +24,24 @@ export const authRepo = {
     return user ?? null
   },
 
-  create: async (data: { name: string; email: string; password: string }) => {
+  create: async (data: {
+    name: string
+    email: string
+    password: string
+    role?: string
+  }): Promise<UserRow> => {
     const [user] = await db.insert(usersTable).values(data).returning()
+    if (!user) throw new Error("Failed to create user record")
     return user
   },
 
-  createSession: async (data: { userId: number; refreshTokenHash: string; expiresAt: Date }) => {
+  createSession: async (data: {
+    userId: number
+    refreshTokenHash: string
+    expiresAt: Date
+  }): Promise<SessionRow> => {
     const [session] = await db.insert(authSessionsTable).values(data).returning()
+    if (!session) throw new Error("Failed to create auth session")
     return session
   },
 
@@ -40,12 +51,19 @@ export const authRepo = {
   consumeSessionByHash: async (refreshTokenHash: string): Promise<SessionRow | null> => {
     const [session] = await db
       .delete(authSessionsTable)
-      .where(and(eq(authSessionsTable.refreshTokenHash, refreshTokenHash), gt(authSessionsTable.expiresAt, new Date())))
+      .where(
+        and(
+          eq(authSessionsTable.refreshTokenHash, refreshTokenHash),
+          gt(authSessionsTable.expiresAt, new Date()),
+        ),
+      )
       .returning()
     return session ?? null
   },
 
   deleteSessionByHash: async (refreshTokenHash: string) => {
-    await db.delete(authSessionsTable).where(eq(authSessionsTable.refreshTokenHash, refreshTokenHash))
+    await db
+      .delete(authSessionsTable)
+      .where(eq(authSessionsTable.refreshTokenHash, refreshTokenHash))
   },
 }

package/template/{backend → base/backend}/src/domains/auth/auth.routes.ts

@@ -1,27 +1,34 @@
-import { Hono } from "hono"
-import type { Context } from "hono"
-import { setCookie, deleteCookie, getCookie } from "hono/cookie"
 import { zValidator } from "@hono/zod-validator"
 import { LoginSchema, RegisterSchema } from "@restack/shared"
-import { authService, ACCESS_TOKEN_TTL_SECONDS, REFRESH_TOKEN_TTL_SECONDS } from "./auth.service.js"
+import type { Context } from "hono"
+import { Hono } from "hono"
+import { deleteCookie, getCookie, setCookie } from "hono/cookie"
 import { env } from "../../config/env.js"
-import { logger, type AppVariables } from "../../utils/logger.js"
+import { type AppVariables, logger } from "../../utils/logger.js"
+import { ACCESS_TOKEN_TTL_SECONDS, authService, REFRESH_TOKEN_TTL_SECONDS } from "./auth.service.js"
 
 /**
  * Routing layer for the Auth domain.
  * Defines the public endpoints for login, registration, logout, and token rotation.
- * 
+ *
  * Semi-DDD rules:
  * - `.routes.ts` files define HTTP endpoints, validate request payloads, and apply CORS/CSRF configurations.
  * - Endpoints should delegate business flow execution directly to the service layer.
  */
 const isProduction = env.NODE_ENV === "production"
-const sameSite = (env.COOKIE_SAME_SITE || (isProduction ? "None" : "Lax")) as "Lax" | "None" | "Strict"
+const sameSite = (env.COOKIE_SAME_SITE || (isProduction ? "None" : "Lax")) as
+  | "Lax"
+  | "None"
+  | "Strict"
 const secure = sameSite === "None" ? true : isProduction
 
 const domainOpt = env.COOKIE_DOMAIN ? { domain: env.COOKIE_DOMAIN } : {}
 const deleteCookieOpts = (path: string) => ({ path, secure, sameSite, ...domainOpt })
-const cookieOpts = (path: string, maxAge: number) => ({ ...deleteCookieOpts(path), httpOnly: true, maxAge })
+const cookieOpts = (path: string, maxAge: number) => ({
+  ...deleteCookieOpts(path),
+  httpOnly: true,
+  maxAge,
+})
 
 const accessTokenCookieOptions = cookieOpts("/", ACCESS_TOKEN_TTL_SECONDS)
 const refreshTokenCookieOptions = cookieOpts("/", REFRESH_TOKEN_TTL_SECONDS)
@@ -47,10 +54,18 @@ export const authRoutes = new Hono<{ Variables: AppVariables }>()
 
       setAuthCookies(c, tokens)
 
-      return c.json({ user }, 201)
-    } catch (e: any) {
-      reqLogger.error({ err: e.message }, "Register failed")
-      return c.json({ error: e.message }, 400)
+      return c.json(
+        {
+          user,
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+        },
+        201,
+      )
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e)
+      reqLogger.error({ err: msg }, "Register failed")
+      return c.json({ error: msg }, 400)
     }
   })
   .post("/login", zValidator("json", LoginSchema), async (c) => {
@@ -63,32 +78,72 @@ export const authRoutes = new Hono<{ Variables: AppVariables }>()
 
       setAuthCookies(c, tokens)
 
-      return c.json({ user })
-    } catch (e: any) {
-      reqLogger.error({ err: e.message }, "Login failed")
-      return c.json({ error: e.message }, 401)
+      return c.json(
+        {
+          user,
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+        },
+        200,
+      )
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e)
+      reqLogger.error({ err: msg }, "Login failed")
+      return c.json({ error: msg }, 401)
     }
   })
   .post("/refresh", async (c) => {
     const reqLogger = c.get("logger") || logger
-    const refreshToken = getCookie(c, "refresh_token")
+    let refreshToken = getCookie(c, "refresh_token")
+
+    if (!refreshToken) {
+      try {
+        const body = (await c.req.json().catch(() => null)) as { refreshToken?: string } | null
+        if (body && typeof body.refreshToken === "string" && body.refreshToken.length > 0) {
+          refreshToken = body.refreshToken
+        }
+      } catch {
+        // Ignore body parsing failures
+      }
+    }
+
     if (!refreshToken) return c.json({ error: "Missing refresh token" }, 401)
 
     try {
       reqLogger.info("Attempting token rotation")
       const tokens = await authService.refresh(refreshToken)
       setAuthCookies(c, tokens)
-      return c.json({ user: tokens.user })
-    } catch (e: any) {
+      return c.json(
+        {
+          user: tokens.user,
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+        },
+        200,
+      )
+    } catch (e: unknown) {
+      const msg = e instanceof Error ? e.message : String(e)
       clearAuthCookies(c)
-      reqLogger.error({ err: e.message }, "Refresh failed")
+      reqLogger.error({ err: msg }, "Refresh failed")
       return c.json({ error: "Invalid refresh token" }, 401)
     }
   })
   .post("/logout", async (c) => {
-    const refreshToken = getCookie(c, "refresh_token")
+    let refreshToken = getCookie(c, "refresh_token")
+
+    if (!refreshToken) {
+      try {
+        const body = (await c.req.json().catch(() => null)) as { refreshToken?: string } | null
+        if (body && typeof body.refreshToken === "string" && body.refreshToken.length > 0) {
+          refreshToken = body.refreshToken
+        }
+      } catch {
+        // Ignore body parsing failures
+      }
+    }
+
     if (refreshToken) await authService.revokeSession(refreshToken)
 
     clearAuthCookies(c)
-    return c.json({ success: true })
+    return c.json({ success: true }, 200)
   })

package/template/{backend → base/backend}/src/domains/auth/auth.service.test.ts

@@ -1,8 +1,8 @@
-import { describe, it, expect, vi, beforeEach } from "vitest"
 import bcrypt from "bcryptjs"
-import { authService } from "./auth.service.js"
-import { authRepo } from "./auth.repo.js"
+import { beforeEach, describe, expect, it, vi } from "vitest"
 import { userRepo } from "../user/user.repo.js"
+import { authRepo } from "./auth.repo.js"
+import { authService } from "./auth.service.js"
 
 vi.mock("./auth.repo.js", () => ({
   authRepo: {
@@ -24,16 +24,32 @@ vi.mock("../user/user.repo.js", () => ({
 const mockedAuthRepo = vi.mocked(authRepo, true)
 const mockedUserRepo = vi.mocked(userRepo, true)
 
-const dbUser = (overrides: Partial<{ id: number; name: string; email: string; password: string }> = {}) => ({
+const dbUser = (
+  overrides: Partial<{
+    id: number
+    name: string
+    email: string
+    password: string
+    role: string
+  }> = {},
+) => ({
   id: 1,
   name: "X",
   email: "a@b.com",
   password: "hash",
+  role: "user",
   createdAt: new Date(),
   ...overrides,
 })
 
-const dbSession = (overrides: Partial<{ id: number; userId: number; refreshTokenHash: string; expiresAt: Date }> = {}) => ({
+const dbSession = (
+  overrides: Partial<{
+    id: number
+    userId: number
+    refreshTokenHash: string
+    expiresAt: Date
+  }> = {},
+) => ({
   id: 1,
   userId: 1,
   refreshTokenHash: "hash",
@@ -50,7 +66,7 @@ describe("authService.register", () => {
   it("throws if the email is already in use", async () => {
     mockedAuthRepo.findByEmail.mockResolvedValue(dbUser())
     await expect(
-      authService.register({ name: "X", email: "a@b.com", password: "password123" })
+      authService.register({ name: "X", email: "a@b.com", password: "password123" }),
     ).rejects.toThrow("Email already in use")
   })
 
@@ -58,9 +74,13 @@ describe("authService.register", () => {
     mockedAuthRepo.findByEmail.mockResolvedValue(null)
     mockedAuthRepo.create.mockImplementation(async (data) => dbUser(data))
 
-    const user = await authService.register({ name: "X", email: "  A@B.com  ", password: "password123" })
+    const user = await authService.register({
+      name: "X",
+      email: "  A@B.com  ",
+      password: "password123",
+    })
 
-    expect(user).toEqual({ id: 1, name: "X", email: "a@b.com" })
+    expect(user).toEqual({ id: 1, name: "X", email: "a@b.com", role: "user" })
     const createdArg = mockedAuthRepo.create.mock.calls[0][0]
     expect(createdArg.email).toBe("a@b.com")
     expect(createdArg.password).not.toBe("password123")
@@ -70,24 +90,24 @@ describe("authService.register", () => {
 describe("authService.login", () => {
   it("throws on an unknown email", async () => {
     mockedAuthRepo.findByEmail.mockResolvedValue(null)
-    await expect(authService.login({ email: "nope@example.com", password: "whatever1" })).rejects.toThrow(
-      "Invalid credentials"
-    )
+    await expect(
+      authService.login({ email: "nope@example.com", password: "whatever1" }),
+    ).rejects.toThrow("Invalid credentials")
   })
 
   it("throws on a wrong password", async () => {
     const passwordHash = await bcrypt.hash("correct-password", 4)
     mockedAuthRepo.findByEmail.mockResolvedValue(dbUser({ password: passwordHash }))
-    await expect(authService.login({ email: "a@b.com", password: "wrong-password" })).rejects.toThrow(
-      "Invalid credentials"
-    )
+    await expect(
+      authService.login({ email: "a@b.com", password: "wrong-password" }),
+    ).rejects.toThrow("Invalid credentials")
   })
 
   it("returns the public user shape on correct credentials", async () => {
     const passwordHash = await bcrypt.hash("correct-password", 4)
     mockedAuthRepo.findByEmail.mockResolvedValue(dbUser({ password: passwordHash }))
     const user = await authService.login({ email: "a@b.com", password: "correct-password" })
-    expect(user).toEqual({ id: 1, name: "X", email: "a@b.com" })
+    expect(user).toEqual({ id: 1, name: "X", email: "a@b.com", role: "user" })
   })
 })
 
@@ -104,7 +124,7 @@ describe("authService.refresh", () => {
 
     const result = await authService.refresh("old-token")
 
-    expect(result.user).toEqual({ id: 1, name: "X", email: "a@b.com" })
+    expect(result.user).toEqual({ id: 1, name: "X", email: "a@b.com", role: "user" })
     expect(typeof result.accessToken).toBe("string")
     expect(typeof result.refreshToken).toBe("string")
     expect(mockedAuthRepo.createSession).toHaveBeenCalledTimes(1)
@@ -127,17 +147,29 @@ describe("authService.revokeSession", () => {
 describe("authService.verifyAccessToken", () => {
   it("round-trips a token issued by issueTokenPair", async () => {
     mockedAuthRepo.createSession.mockResolvedValue(dbSession())
-    const { accessToken } = await authService.issueTokenPair({ id: 1, name: "X", email: "a@b.com" })
+    const { accessToken } = await authService.issueTokenPair({
+      id: 1,
+      name: "X",
+      email: "a@b.com",
+      role: "user",
+    })
     const payload = await authService.verifyAccessToken(accessToken)
     expect(payload.sub).toBe("1")
     expect(payload.email).toBe("a@b.com")
+    expect(payload.role).toBe("user")
   })
 
   it("rejects a tampered token", async () => {
     mockedAuthRepo.createSession.mockResolvedValue(dbSession())
-    const { accessToken } = await authService.issueTokenPair({ id: 1, name: "X", email: "a@b.com" })
+    const { accessToken } = await authService.issueTokenPair({
+      id: 1,
+      name: "X",
+      email: "a@b.com",
+      role: "user",
+    })
     const i = accessToken.indexOf(".") + 5
-    const tampered = accessToken.slice(0, i) + (accessToken[i] === "a" ? "b" : "a") + accessToken.slice(i + 1)
+    const tampered =
+      accessToken.slice(0, i) + (accessToken[i] === "a" ? "b" : "a") + accessToken.slice(i + 1)
     await expect(authService.verifyAccessToken(tampered)).rejects.toThrow()
   })
 })

package/template/{backend → base/backend}/src/domains/auth/auth.service.ts

@@ -1,16 +1,16 @@
-import bcrypt from "bcryptjs"
-import { SignJWT, jwtVerify } from "jose"
-import { randomBytes, createHash } from "node:crypto"
+import { createHash, randomBytes } from "node:crypto"
 import type { AuthUser, LoginInput, RegisterInput } from "@restack/shared"
+import bcrypt from "bcryptjs"
+import { jwtVerify, SignJWT } from "jose"
 import { env } from "../../config/env.js"
-import { authRepo } from "./auth.repo.js"
 import { userRepo } from "../user/user.repo.js"
+import { authRepo } from "./auth.repo.js"
 import type { AuthTokenPayload } from "./auth.types.js"
 
 /**
  * Service layer for the Auth domain.
  * Houses core validation and cryptographic flows (JWT token signing, refresh token generation, hashing).
- * 
+ *
  * Semi-DDD rules:
  * - `.service.ts` files encapsulate business rules and complex workflows (e.g. session issuance & rotation).
  * - They must never call Drizzle ORM directly; always interact through the repo layer.
@@ -24,12 +24,17 @@ const normalizeEmail = (email: string) => email.trim().toLowerCase()
 export const ACCESS_TOKEN_TTL_SECONDS = 60 * 15 // 15 minutes
 export const REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30 // 30 days
 
-const buildTokenPayload = (user: { id: number; email: string }): AuthTokenPayload => ({
+const buildTokenPayload = (user: {
+  id: number
+  email: string
+  role: string
+}): AuthTokenPayload => ({
   sub: String(user.id),
   email: user.email,
+  role: user.role,
 })
 
-const signAccessToken = (user: { id: number; email: string }) =>
+const signAccessToken = (user: { id: number; email: string; role: string }) =>
   new SignJWT(buildTokenPayload(user))
     .setProtectedHeader({ alg: "HS256" })
     .setIssuedAt()
@@ -60,7 +65,7 @@ export const authService = {
 
     const password = await bcrypt.hash(data.password, BCRYPT_COST)
     const user = await authRepo.create({ ...data, email, password })
-    return { id: user.id, name: user.name, email: user.email }
+    return { id: user.id, name: user.name, email: user.email, role: user.role }
   },
 
   login: async (data: LoginInput): Promise<AuthUser> => {
@@ -68,7 +73,7 @@ export const authService = {
     const valid = await bcrypt.compare(data.password, user ? user.password : DUMMY_HASH)
     if (!user || !valid) throw new Error("Invalid credentials")
 
-    return { id: user.id, name: user.name, email: user.email }
+    return { id: user.id, name: user.name, email: user.email, role: user.role }
   },
 
   issueTokenPair,
@@ -83,7 +88,7 @@ export const authService = {
     const user = await userRepo.findById(session.userId)
     if (!user) throw new Error("Invalid refresh token")
 
-    return issueTokenPair({ id: user.id, name: user.name, email: user.email })
+    return issueTokenPair({ id: user.id, name: user.name, email: user.email, role: user.role })
   },
 
   revokeSession: async (refreshToken: string) => {

package/template/{backend → base/backend}/src/domains/auth/auth.types.ts

@@ -3,5 +3,5 @@ import type { JWTPayload } from "jose"
 export interface AuthTokenPayload extends JWTPayload {
   sub: string
   email: string
-  // Add fields here when the user model supports them, e.g. role, permissions.
+  role: string
 }

package/template/{backend → base/backend}/src/domains/user/user.model.ts

@@ -1,4 +1,4 @@
-import { pgTable, text, timestamp, serial } from "drizzle-orm/pg-core"
+import { pgTable, serial, text, timestamp } from "drizzle-orm/pg-core"
 
 /**
  * Users Table Schema.
@@ -10,5 +10,6 @@ export const usersTable = pgTable("users", {
   name: text("name").notNull(),
   email: text("email").notNull().unique(),
   password: text("password").notNull(),
+  role: text("role").default("user").notNull(),
   createdAt: timestamp("created_at").notNull().defaultNow(),
 })

package/template/{backend → base/backend}/src/domains/user/user.repo.ts

@@ -1,3 +1,4 @@
+import type { UpdateProfileInput } from "@restack/shared"
 import { eq } from "drizzle-orm"
 import { db } from "../../infra/db/index.js"
 import { usersTable } from "./user.model.js"
@@ -7,7 +8,7 @@ export type UserRow = typeof usersTable.$inferSelect
 /**
  * Repository layer for the User domain.
  * Encapsulates all direct database queries for users.
- * 
+ *
  * Semi-DDD rules:
  * - Direct database interactions (Drizzle client) must live only inside `.repo.ts` files.
  * - Under cross-domain rules, the Auth domain can import from this repo (e.g. user lookup by ID/email),
@@ -22,7 +23,7 @@ export const userRepo = {
     return user ?? null
   },
 
-  updateProfile: async (id: number, data: { name?: string }): Promise<UserRow | null> => {
+  updateProfile: async (id: number, data: UpdateProfileInput): Promise<UserRow | null> => {
     const [user] = await db.update(usersTable).set(data).where(eq(usersTable.id, id)).returning()
     return user ?? null
   },

package/template/base/backend/src/domains/user/user.routes.test.ts

@@ -0,0 +1,127 @@
+import { eq } from "drizzle-orm"
+import fc from "fast-check"
+import { testClient } from "hono/testing"
+import { afterAll, beforeAll, describe, expect, it } from "vitest"
+import { db } from "../../infra/db/index.js"
+import { authService } from "../auth/auth.service.js"
+import { usersTable } from "./user.model.js"
+import { userRoutes } from "./user.routes.js"
+
+const TEST_EMAIL = `user-routes-test-${Date.now()}@example.com`
+let accessToken: string
+let userId: number
+
+const client = testClient(userRoutes)
+
+beforeAll(async () => {
+  const user = await authService.register({
+    name: "Route Test",
+    email: TEST_EMAIL,
+    password: "password123",
+  })
+  userId = user.id
+  const tokens = await authService.issueTokenPair(user)
+  accessToken = tokens.accessToken
+})
+
+afterAll(async () => {
+  await db.delete(usersTable).where(eq(usersTable.id, userId))
+})
+
+const authHeaders = (token?: string) => ({
+  ...(token ? { Cookie: `access_token=${token}` } : {}),
+})
+
+describe("GET /me", () => {
+  it("returns 401 without a token", async () => {
+    const res = await client.me.$get()
+    expect(res.status).toBe(401)
+  })
+
+  it("returns the profile with a valid token", async () => {
+    const res = await client.me.$get({}, { headers: authHeaders(accessToken) })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    if ("error" in body) throw new Error(String(body.error))
+    expect(body.user.email).toBe(TEST_EMAIL)
+  })
+})
+
+describe("PUT /profile", () => {
+  it("returns 401 without a token", async () => {
+    const res = await client.profile.$put({ json: { name: "x" } })
+    expect(res.status).toBe(401)
+  })
+
+  it("updates the name with a valid token and body", async () => {
+    const res = await client.profile.$put(
+      { json: { name: "Updated Name" } },
+      { headers: authHeaders(accessToken) },
+    )
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    if ("error" in body) throw new Error(String(body.error))
+    expect(body.user.name).toBe("Updated Name")
+  })
+
+  it("rejects an invalid body (empty name)", async () => {
+    const res = await client.profile.$put(
+      { json: { name: "" } },
+      { headers: authHeaders(accessToken) },
+    )
+    expect(res.status).toBe(400)
+  })
+
+  it("treats an empty body as a no-op instead of erroring", async () => {
+    const res = await client.profile.$put({ json: {} }, { headers: authHeaders(accessToken) })
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    if ("error" in body) throw new Error(String(body.error))
+    expect(body.user.email).toBe(TEST_EMAIL)
+  })
+
+  it("never returns a 500 crash on arbitrary string payloads (property fuzzing)", async () => {
+    await fc.assert(
+      fc.asyncProperty(fc.string(), async (name) => {
+        const res = await client.profile.$put(
+          { json: { name } },
+          { headers: authHeaders(accessToken) },
+        )
+        // Must either succeed (200) or cleanly reject invalid input (400), never crash (500)
+        expect([200, 400]).toContain(res.status)
+      }),
+      { numRuns: 30 },
+    )
+  })
+})
+
+describe("GET /admin (RBAC Protected Route)", () => {
+  it("returns 401 without a token", async () => {
+    const res = await client.admin.$get()
+    expect(res.status).toBe(401)
+  })
+
+  it("returns 403 when user has default 'user' role", async () => {
+    const res = await client.admin.$get({}, { headers: authHeaders(accessToken) })
+    expect(res.status).toBe(403)
+    const body = (await res.json()) as { error?: string; message?: string }
+    expect(body.error).toBe("Forbidden: insufficient permissions")
+  })
+
+  it("returns 200 when user has 'admin' role (via Bearer token)", async () => {
+    const adminTokens = await authService.issueTokenPair({
+      id: userId,
+      name: "Admin User",
+      email: TEST_EMAIL,
+      role: "admin",
+    })
+    const res = await client.admin.$get(
+      {},
+      { headers: { Authorization: `Bearer ${adminTokens.accessToken}` } },
+    )
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    if ("error" in body) throw new Error(String(body.error))
+    expect(body.message).toBe("Welcome to the admin area")
+  })
+})

package/template/{backend → base/backend}/src/domains/user/user.routes.ts

@@ -1,21 +1,26 @@
-import { Hono } from "hono"
-import type { Context } from "hono"
 import { zValidator } from "@hono/zod-validator"
 import { UpdateProfileSchema } from "@restack/shared"
+import type { Context } from "hono"
+import { Hono } from "hono"
 import { requireAuth } from "../../infra/middlewares/require-auth.js"
-import { userService, UserNotFoundError } from "./user.service.js"
-import { logger, type AppVariables } from "../../utils/logger.js"
+import { requireRole } from "../../infra/middlewares/require-role.js"
+import { type AppVariables, logger } from "../../utils/logger.js"
+import { UserNotFoundError, userService } from "./user.service.js"
 
 /**
  * Routing layer for the User domain.
  * Configures the router and defines endpoints with appropriate middlewares.
- * 
+ *
  * Semi-DDD rules:
  * - `.routes.ts` files define HTTP endpoints, parse inputs using schema validators (zValidator),
- *   apply guards (requireAuth), and serialize JSON responses.
+ *   apply guards (requireAuth, requireRole), and serialize JSON responses.
  * - Routing code should never implement business logic directly; it must delegate to the service layer.
  */
-const handleProfileError = (c: Context<{ Variables: AppVariables }>, e: unknown, action: string) => {
+const handleProfileError = (
+  c: Context<{ Variables: AppVariables }>,
+  e: unknown,
+  action: string,
+) => {
   if (e instanceof UserNotFoundError) return c.json({ error: e.message }, 404)
   const reqLogger = c.get("logger") || logger
   reqLogger.error({ err: e instanceof Error ? e.message : String(e) }, action)
@@ -30,7 +35,7 @@ export const userRoutes = new Hono<{ Variables: AppVariables }>()
       const user = c.get("user")
       if (!user) return c.json({ error: "Unauthorized" }, 401)
       const profile = await userService.getProfile(Number(user.sub))
-      return c.json({ user: profile })
+      return c.json({ user: profile }, 200)
     } catch (e) {
       return handleProfileError(c, e, "Get profile failed")
     }
@@ -43,8 +48,13 @@ export const userRoutes = new Hono<{ Variables: AppVariables }>()
       const user = c.get("user")
       if (!user) return c.json({ error: "Unauthorized" }, 401)
       const profile = await userService.updateProfile(Number(user.sub), body)
-      return c.json({ user: profile })
+      return c.json({ user: profile }, 200)
     } catch (e) {
       return handleProfileError(c, e, "Update profile failed")
     }
   })
+  .get("/admin", requireAuth, requireRole("admin"), async (c) => {
+    const reqLogger = c.get("logger") || logger
+    reqLogger.info("Admin route accessed")
+    return c.json({ message: "Welcome to the admin area", user: c.get("user") }, 200)
+  })

package/template/{backend → base/backend}/src/domains/user/user.service.ts

@@ -7,16 +7,22 @@ export class UserNotFoundError extends Error {}
  * Maps database user object into the public, safe schema shape.
  * Always filters out sensitive columns like password hashes.
  */
-const toPublicUser = (user: { id: number; name: string; email: string }): AuthUser => ({
+const toPublicUser = (user: {
+  id: number
+  name: string
+  email: string
+  role: string
+}): AuthUser => ({
   id: user.id,
   name: user.name,
   email: user.email,
+  role: user.role,
 })
 
 /**
  * Service layer for the User domain.
  * Contains core business logic and validations.
- * 
+ *
  * Semi-DDD rules:
  * - `.service.ts` encapsulates business logic, mappings, and validations.
  * - It must never interact with the database client directly; always query through the `.repo.ts` layer.