create-rigel 0.1.0

package/templates/nestjs/.claude/agents/security-auditor.md

@@ -0,0 +1,72 @@
+---
+name: security-auditor
+description: OWASP Top 10 security review for NestJS. Run before any PR touching auth, guards, or sensitive data.
+model: claude-sonnet-4-5
+tools: [Read, Bash]
+color: red
+---
+
+You are a senior application security engineer reviewing NestJS code against OWASP Top 10.
+
+## Pre-Review
+```bash
+git diff main --name-only
+```
+Read each changed file.
+
+## Checklist
+
+### A01 — Broken Access Control
+- [ ] Global `JwtAuthGuard` is registered in `app.module.ts` (APP_GUARD)
+- [ ] All public routes have `@Public()` decorator
+- [ ] Every repository query has `userId` in WHERE clause
+- [ ] Admin routes have `@Roles('ADMIN')` + `RolesGuard`
+- [ ] No horizontal escalation (user A can't access user B's data)
+
+### A02 — Cryptographic Failures
+- [ ] Passwords: `argon2.hash()` — not bcrypt, not MD5
+- [ ] JWT secret: `config.getOrThrow('JWT_SECRET')` — min 32 chars
+- [ ] No secrets hardcoded anywhere
+- [ ] HTTPS enforced (helmet HSTS header)
+
+### A03 — Injection
+- [ ] All DB via Sequelize ORM or named replacements
+- [ ] No string-interpolated `sequelize.query()`
+- [ ] All inputs through ValidationPipe + class-validator DTOs
+
+### A04 — Insecure Design
+- [ ] Auth endpoints rate-limited (10/min via @nestjs/throttler)
+- [ ] UUIDs (not sequential ints) on user-facing IDs
+- [ ] Duplicate detection before creation
+
+### A05 — Security Misconfiguration
+- [ ] Helmet middleware applied globally
+- [ ] CORS configured centrally with explicit origins
+- [ ] No stack traces in error responses (AllExceptionsFilter)
+- [ ] Swagger UI disabled in production
+
+### A07 — Auth Failures
+- [ ] Access token: max 15 min (ConfigService value)
+- [ ] Refresh token: single-use, revoked after use
+- [ ] Token revocation: Redis `revoked:{jti}` checked in JwtStrategy
+- [ ] Login: same error for bad user vs bad password
+
+### A09 — Logging Failures
+- [ ] Auth events logged: login, logout, failed auth
+- [ ] 401/403 logged via LoggingInterceptor
+- [ ] No PII in log values (nestjs-pino redaction)
+
+## Verdict
+```
+APPROVED — all checks pass.
+
+OR
+
+CHANGES REQUIRED:
+CRITICAL (block merge):
+1. [file:line] [problem]
+   Fix: [exact code]
+
+HIGH (fix before production):
+2. [file:line] [problem]
+```

package/templates/nestjs/.claude/hooks/post-write.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# Fires after every Write/Edit on TypeScript files.
+# Catches NestJS-specific violations immediately.
+
+set -euo pipefail
+
+FILE=$(cat | python3 -c "
+import sys, json
+try:
+    data = json.load(sys.stdin)
+    print(data.get('file_path') or data.get('path') or '')
+except:
+    print('')
+" 2>/dev/null || echo "")
+
+[[ -z "$FILE" ]] && exit 0
+[[ ! -f "$FILE" ]] && exit 0
+[[ ! "$FILE" =~ \.ts$ ]] && exit 0
+
+WARNINGS=()
+
+# 1. console.log — use Logger from @nestjs/common
+if [[ "$FILE" =~ ^src/ ]]; then
+  if grep -qn "console\.\(log\|error\|warn\|info\)" "$FILE" 2>/dev/null; then
+    LINE=$(grep -n "console\.\(log\|error\|warn\|info\)" "$FILE" | head -1 | cut -d: -f1)
+    WARNINGS+=("⚠ [HOOK] console.log at $FILE:$LINE — use Logger from @nestjs/common or nestjs-pino")
+  fi
+fi
+
+# 2. process.env — use ConfigService
+if [[ "$FILE" =~ ^src/ ]] && [[ ! "$FILE" =~ src/config/ ]]; then
+  if grep -qn "process\.env" "$FILE" 2>/dev/null; then
+    LINE=$(grep -n "process\.env" "$FILE" | head -1 | cut -d: -f1)
+    WARNINGS+=("⚠ [HOOK] process.env at $FILE:$LINE — inject ConfigService instead")
+  fi
+fi
+
+# 3. HttpException in service files — use NestJS semantic exceptions
+if [[ "$FILE" =~ \.service\.ts$ ]]; then
+  if grep -qn "throw new HttpException\b" "$FILE" 2>/dev/null; then
+    LINE=$(grep -n "throw new HttpException" "$FILE" | head -1 | cut -d: -f1)
+    WARNINGS+=("⚠ [HOOK] HttpException in service at $FILE:$LINE — use NotFoundException, ConflictException etc.")
+  fi
+fi
+
+# 4. @InjectModel in service files — inject repository instead
+if [[ "$FILE" =~ \.service\.ts$ ]]; then
+  if grep -qn "@InjectModel\b" "$FILE" 2>/dev/null; then
+    LINE=$(grep -n "@InjectModel" "$FILE" | head -1 | cut -d: -f1)
+    WARNINGS+=("⚠ [HOOK] @InjectModel in service at $FILE:$LINE — inject the repository class, not the model directly")
+  fi
+fi
+
+# 5. Raw .toJSON() without Zod parse in repository files
+if [[ "$FILE" =~ \.repository\.ts$ ]]; then
+  if grep -qn "\.toJSON()" "$FILE" 2>/dev/null; then
+    # Check if .parse( is on the same or next line
+    if ! grep -qn "Schema\.parse\|\.parse(" "$FILE" 2>/dev/null; then
+      WARNINGS+=("⚠ [HOOK] .toJSON() without ZodSchema.parse() in $FILE — validate every DB result")
+    fi
+  fi
+fi
+
+# 6. Business logic in controller files (if/else, calculations)
+if [[ "$FILE" =~ \.controller\.ts$ ]]; then
+  if grep -qnE "^\s+(if|else|switch|for|while|const .* = .* \? )" "$FILE" 2>/dev/null; then
+    LINE=$(grep -nE "^\s+(if|else|switch|for|while)" "$FILE" | head -1 | cut -d: -f1)
+    WARNINGS+=("⚠ [HOOK] Possible business logic in controller at $FILE:$LINE — controllers should delegate to service only")
+  fi
+fi
+
+# 7. File size > 400 lines
+LINE_COUNT=$(wc -l < "$FILE" 2>/dev/null || echo 0)
+if [[ $LINE_COUNT -gt 400 ]]; then
+  WARNINGS+=("⚠ [HOOK] $FILE has $LINE_COUNT lines — exceeds 400-line limit. Split into focused modules.")
+fi
+
+# 8. Missing @ApiProperty in DTO files
+if [[ "$FILE" =~ \.dto\.ts$ ]]; then
+  PROP_COUNT=$(grep -c "^\s*\(readonly\s\+\)\?[a-zA-Z]" "$FILE" 2>/dev/null || echo 0)
+  API_PROP_COUNT=$(grep -c "@ApiProperty" "$FILE" 2>/dev/null || echo 0)
+  if [[ $PROP_COUNT -gt 0 ]] && [[ $API_PROP_COUNT -eq 0 ]]; then
+    WARNINGS+=("⚠ [HOOK] DTO $FILE has properties without @ApiProperty() — Swagger will be incomplete")
+  fi
+fi
+
+for w in "${WARNINGS[@]}"; do
+  echo "$w"
+done
+
+exit 0

package/templates/nestjs/.claude/rules/api.md

@@ -0,0 +1,87 @@
+---
+paths:
+  - "src/**/*.controller.ts"
+---
+
+# API Rules — Auto-injected on controller file edits
+
+## Every Controller Checklist
+
+### Required Class Decorators
+```typescript
+@ApiTags('Applications')         // ← group in Swagger UI
+@ApiBearerAuth()                 // ← shows auth in Swagger
+@Controller('v1/applications')   // ← always under v1/ prefix
+export class ApplicationController {
+  constructor(private readonly appService: ApplicationService) {}
+```
+
+### Required Method Decorators (every route)
+```typescript
+@Get(':id')
+@ApiOperation({ summary: 'Get application by ID' })
+@ApiOkResponse({ type: ApplicationResponseDto })
+@ApiNotFoundResponse({ description: 'Application not found' })
+findOne(
+  @Param('id', ParseUUIDPipe) id: string,
+  @CurrentUser() user: JwtPayload,
+) {
+  return this.appService.findOne(user.sub, id)  // ← one-liner
+}
+```
+
+### Rate Limiting Tiers
+```typescript
+// On controller or method level:
+@Throttle({ default: { limit: 10, ttl: 60000 } })   // Auth: 10/min
+@Throttle({ default: { limit: 60, ttl: 60000 } })   // Public: 60/min
+@Throttle({ default: { limit: 300, ttl: 60000 } })  // User: 300/min (default)
+```
+
+### Route Versioning (all routes under v1/)
+```typescript
+// ✅ v1 prefix in controller
+@Controller('v1/applications')
+
+// OR use versioning module:
+// main.ts: app.enableVersioning({ type: VersioningType.URI })
+// @Controller({ path: 'applications', version: '1' })
+
+// ❌ Never unversioned
+@Controller('applications')
+```
+
+### Pagination Response
+```typescript
+@Get()
+@ApiOkResponse({ description: 'Paginated list' })
+list(
+  @Query() query: PaginationDto,
+  @CurrentUser() user: JwtPayload,
+) {
+  return this.appService.list(user.sub, query.cursor, query.limit)
+}
+// Response: { items: [...], nextCursor: string | null, hasMore: boolean }
+```
+
+### Public Routes
+```typescript
+@Public()                                           // ← bypass JWT guard
+@Throttle({ default: { limit: 10, ttl: 60000 } }) // ← strict rate limit on auth
+@Post('register')
+@ApiOperation({ summary: 'Register new account' })
+@ApiCreatedResponse({ type: AuthResultDto })
+register(@Body() dto: RegisterDto) {
+  return this.authService.register(dto)
+}
+```
+
+### Admin Routes
+```typescript
+@Roles('ADMIN')    // ← requires ADMIN role
+@Delete(':id')
+@ApiOperation({ summary: 'Admin: delete any resource' })
+adminDelete(@Param('id', ParseUUIDPipe) id: string) {
+  return this.appService.adminDelete(id)
+}
+```

package/templates/nestjs/.claude/rules/architecture.md

@@ -0,0 +1,104 @@
+---
+paths:
+  - "src/**/*.ts"
+---
+
+# Architecture Rules — Auto-injected on every src/ file edit
+
+## Import Hierarchy (one-way, enforced)
+
+| Your file | May import from |
+|---|---|
+| `*.model.ts` | Types, sequelize-typescript decorators only |
+| `*.dto.ts` | class-validator, @nestjs/swagger, Types only |
+| `*.repository.ts` | Model, Config (ConfigService), Types, Zod |
+| `*.service.ts` | Repository, Config, Types — NO HTTP imports |
+| `*.controller.ts` | Service, DTOs, Common decorators, @nestjs/common |
+| `*.module.ts` | All of the above |
+| `src/common/**` | Config, Types only |
+
+## Model Rules
+```typescript
+// ✅ Model = schema only
+@Table({ tableName: 'applications', paranoid: true })
+export class Application extends Model {
+  @Default(() => newId())
+  @Column({ type: DataType.UUID, primaryKey: true })
+  id!: string
+
+  // ❌ Never add methods with business logic to models
+  // getActiveStages() { ... }  ← WRONG, belongs in service
+}
+```
+
+## Repository Rules
+```typescript
+// ✅ Always validate output with Zod
+async findById(id: string, userId: string): Promise<ApplicationRecord> {
+  const raw = await this.appModel.findOne({ where: { id, userId } })
+  if (!raw) throw new NotFoundException(`Application ${id} not found`)
+  return ApplicationSchema.parse(raw.toJSON())   // REQUIRED
+}
+
+// ❌ Never return raw Sequelize instances
+async findById(id: string): Promise<Application> {
+  return this.appModel.findByPk(id)  // WRONG — unvalidated, exposes ORM internals
+}
+
+// ✅ Ownership in every query
+where: { id, userId }    // userId always from auth context, never from user input
+
+// ✅ Cursor pagination on all list methods
+async list(userId: string, cursor?: PageCursor, limit = 20) {
+  const where: WhereOptions = { userId }
+  if (cursor) {
+    where[Op.or] = [
+      { createdAt: { [Op.lt]: cursor.createdAt } },
+      { createdAt: cursor.createdAt, id: { [Op.lt]: cursor.id } },
+    ]
+  }
+  // ...
+}
+```
+
+## Service Rules
+```typescript
+// ✅ Takes typed inputs, returns typed outputs, throws semantic exceptions
+async createApplication(userId: string, dto: CreateApplicationDto): Promise<ApplicationRecord> {
+  return this.applicationRepository.create(userId, dto)
+}
+
+// ❌ No HTTP types in service
+import { Request } from 'express'        // FORBIDDEN
+throw new HttpException('error', 404)   // FORBIDDEN — use NotFoundException
+```
+
+## Controller Rules
+```typescript
+// ✅ One-liner handlers only
+@Post()
+@ApiOperation({ summary: 'Create application' })
+@ApiCreatedResponse({ type: ApplicationResponseDto })
+create(@Body() dto: CreateApplicationDto, @CurrentUser() user: JwtPayload) {
+  return this.applicationService.createApplication(user.sub, dto)
+}
+
+// ✅ Swagger on every route — no exceptions
+// Every controller class: @ApiTags('Applications') @ApiBearerAuth()
+// Every handler: @ApiOperation() + @ApiResponse() or @ApiOkResponse()
+
+// ❌ Logic in controllers
+create(@Body() dto: CreateApplicationDto) {
+  if (dto.stage === 'APPLIED') { ... }  // WRONG — belongs in service
+}
+```
+
+## ConfigService Pattern
+```typescript
+// ✅ Always inject ConfigService
+constructor(private config: ConfigService) {}
+const jwtSecret = this.config.getOrThrow<string>('JWT_SECRET')
+
+// ❌ Never
+process.env.JWT_SECRET
+```

package/templates/nestjs/.claude/rules/database.md

@@ -0,0 +1,111 @@
+---
+paths:
+  - "src/**/*.repository.ts"
+  - "src/**/*.model.ts"
+  - "db/migrations/**/*.js"
+---
+
+# Database Rules — Auto-injected on repository/model/migration edits
+
+## The 5 Checks Before Every Repository Method Ships
+
+### 1. Zod Parse on Every Result
+```typescript
+// ✅ REQUIRED
+const raw = await this.userModel.findOne({ where: { email } })
+if (!raw) return null
+return UserSchema.parse(raw.toJSON())
+
+// ❌ FORBIDDEN
+return raw                         // Sequelize instance — unvalidated
+return raw.toJSON() as UserRecord  // cast without validation
+```
+
+### 2. No N+1 — Eager Load Always
+```typescript
+// ✅ Single query with include
+const apps = await this.appModel.findAll({
+  where: { userId },
+  include: [
+    { model: Note },
+    { model: Contact },
+  ],
+})
+
+// ❌ N+1
+const apps = await this.appModel.findAll({ where: { userId } })
+for (const app of apps) {
+  app.notes = await this.noteModel.findAll({ where: { applicationId: app.id } })
+}
+```
+
+### 3. Cursor Pagination on All List Methods
+```typescript
+// ✅ Cursor-based
+async list(userId: string, cursor?: PageCursor, limit = 20) {
+  const where: WhereOptions = { userId }
+  if (cursor) {
+    where[Op.or as symbol] = [
+      { createdAt: { [Op.lt]: cursor.createdAt } },
+      { createdAt: cursor.createdAt, id: { [Op.lt]: cursor.id } },
+    ]
+  }
+  const rows = await this.appModel.findAll({
+    where, include: [...],
+    order: [['createdAt', 'DESC'], ['id', 'DESC']],
+    limit: limit + 1,
+  })
+  const hasMore = rows.length > limit
+  const items = hasMore ? rows.slice(0, limit) : rows
+  return {
+    items: items.map(r => ApplicationSchema.parse(r.toJSON())),
+    nextCursor: hasMore ? { id: items.at(-1)!.id, createdAt: items.at(-1)!.createdAt } : null,
+    hasMore,
+  }
+}
+
+// ❌ FORBIDDEN on growing tables
+findAll({ offset: page * limit, limit })
+```
+
+### 4. Transactions for Multi-Table Writes
+```typescript
+// ✅ Inject Sequelize and use transaction
+constructor(
+  @InjectModel(Application) private appModel: typeof Application,
+  @InjectConnection() private sequelize: Sequelize,
+) {}
+
+async updateStage(id: string, stage: string, note: string) {
+  return this.sequelize.transaction(async (t) => {
+    await Application.update({ stage }, { where: { id }, transaction: t })
+    await Note.create({ applicationId: id, body: note, type: 'SYSTEM' }, { transaction: t })
+  })
+}
+```
+
+### 5. Soft Delete — paranoid: true
+```typescript
+// ✅ @Table decorator
+@Table({ tableName: 'applications', paranoid: true })
+export class Application extends Model {
+  @DeletedAt deletedAt?: Date
+}
+
+// findAll automatically excludes soft-deleted — no manual WHERE needed
+// To include deleted: { paranoid: false }
+// Hard delete: { force: true } — only for GDPR
+```
+
+## Model Checklist
+- [ ] `@Table({ paranoid: true })` — soft delete
+- [ ] `@Default(() => newId())` on id — UUIDv7
+- [ ] `indexes` array in `@Table` — FK columns + ORDER BY columns
+- [ ] Partial index for `WHERE deleted_at IS NULL` if high-volume
+- [ ] `@CreatedAt`, `@UpdatedAt`, `@DeletedAt` decorators
+
+## Migration Checklist
+- [ ] Both `up()` and `down()` implemented
+- [ ] New indexes use `CONCURRENTLY` to avoid table locks
+- [ ] FK constraints with explicit `ON DELETE` behaviour
+- [ ] Run `npm run db:migrate` to verify before committing

package/templates/nestjs/.claude/rules/security.md

@@ -0,0 +1,110 @@
+---
+paths:
+  - "src/**/*.controller.ts"
+  - "src/**/*.repository.ts"
+  - "src/auth/**/*.ts"
+---
+
+# Security Rules — Auto-injected on controller/repository/auth edits
+
+## Auth — Global Guard, Opt-Out Model
+
+```typescript
+// ✅ Public routes must have @Public()
+@Public()
+@Post('login')
+login(@Body() dto: LoginDto) { ... }
+
+// ✅ Protected routes have NOTHING — global guard handles it
+@Get('me')
+getProfile(@CurrentUser() user: JwtPayload) { ... }
+
+// ❌ Never add @UseGuards(JwtAuthGuard) manually — it's global
+@UseGuards(JwtAuthGuard)  // redundant and misleading
+@Get('me')
+getProfile() { ... }
+```
+
+## Ownership — Enforced in Repository
+
+```typescript
+// ✅ userId ALWAYS in WHERE clause
+const raw = await this.appModel.findOne({
+  where: { id, userId }  // userId from auth context — never from user input
+})
+
+// ❌ No ownership check — any user can access any record
+const raw = await this.appModel.findByPk(id)
+```
+
+## Input Validation — DTOs + ValidationPipe
+
+```typescript
+// ✅ ValidationPipe global (main.ts) + class-validator on DTO
+export class CreateApplicationDto {
+  @IsString() @MinLength(1) @MaxLength(200)
+  @ApiProperty({ example: 'Acme Corp' })
+  company: string
+
+  @IsOptional() @IsUrl()
+  @ApiProperty({ required: false })
+  postingUrl?: string
+}
+
+// ❌ Never accept raw body without DTO
+@Post() create(@Body() body: any) { ... }  // FORBIDDEN
+```
+
+## SQL Injection Prevention
+
+```typescript
+// ✅ Sequelize ORM parameterises automatically
+await this.appModel.findAll({ where: { userId, stage } })
+
+// ✅ Raw queries with named replacements
+await sequelize.query(
+  'SELECT * FROM applications WHERE user_id = :userId',
+  { replacements: { userId }, type: QueryTypes.SELECT }
+)
+
+// ❌ String interpolation — FORBIDDEN
+await sequelize.query(`SELECT * FROM applications WHERE user_id = '${userId}'`)
+```
+
+## Password Hashing — argon2 Only
+
+```typescript
+import * as argon2 from 'argon2'
+
+// Hash
+const hash = await argon2.hash(password)
+
+// Verify
+const valid = await argon2.verify(hash, password)
+
+// ❌ Never
+import * as bcrypt from 'bcrypt'   // GPU-vulnerable
+```
+
+## Error Responses — Never Expose Internals
+
+```typescript
+// ✅ AllExceptionsFilter in common/ catches all — sanitised output
+// { statusCode, message, timestamp, path } — no stack traces
+
+// ✅ Throw semantic NestJS exceptions
+throw new NotFoundException('Application not found')
+throw new ConflictException('Stage transition invalid')
+
+// ❌ Never expose internal errors
+res.json({ error: err.message, stack: err.stack })
+```
+
+## JWT Tokens
+
+```typescript
+// Access token: 15 minutes — from ConfigService
+// Refresh token: 7 days — single use, rotated on refresh
+// Revocation: Redis key `revoked:{jti}` — checked in JwtStrategy.validate()
+// Tokens in response body — never in cookies (frontend handles storage)
+```