create-stackr 0.2.0

package/templates/base/backend/controllers/rest-api/routes/auth.ts.ejs

@@ -0,0 +1,180 @@
+import type { AuthFastifyRequest } from "fastify";
+import { FastifyPluginAsync, FastifyRequest } from "fastify";
+import { auth } from "../../../lib/auth";
+import { Type } from "@sinclair/typebox";
+import { updateUserProfile, deleteUser } from "../../../domain/user/repository";
+import { findUserSessionById, revokeSessionByToken } from "../../../domain/session/repository";
+
+/**
+ * Convert Fastify request to Fetch API Request for BetterAuth
+ * BetterAuth expects a standard Fetch API Request object
+ */
+function toFetchRequest(request: FastifyRequest): Request {
+  // Construct full URL
+  const url = `${request.protocol}://${request.hostname}${request.url}`;
+
+  // Convert Fastify headers to Fetch API Headers
+  const headers = new Headers();
+  Object.entries(request.headers).forEach(([key, value]) => {
+    if (value) {
+      headers.set(key, Array.isArray(value) ? value[0] : value);
+    }
+  });
+
+  // Create Fetch API compatible Request
+  // Note: GET and HEAD requests cannot have a body
+  const hasBody = request.method !== "GET" && request.method !== "HEAD" && request.body;
+
+  return new Request(url, {
+    method: request.method,
+    headers,
+    body: hasBody ? JSON.stringify(request.body) : undefined,
+  });
+}
+
+const authRoutes: FastifyPluginAsync = async (server) => {
+  // Mount BetterAuth handler for all /* routes under this plugin
+  // Since this plugin is registered at /api/auth, BetterAuth handles /api/auth/*
+  // BetterAuth handles: sign-in, sign-up, sign-out, oauth callbacks, etc.
+  server.all("/*", async (request, reply) => {
+    // Convert Fastify request to Fetch API Request for BetterAuth
+    const fetchRequest = toFetchRequest(request);
+    const response = await auth.handler(fetchRequest);
+
+    // Copy response headers
+    response.headers.forEach((value, key) => {
+      reply.header(key, value);
+    });
+
+    // Send response body
+    // Use text() to get the response body as BetterAuth may return JSON or other content
+    const body = await response.text();
+    reply.status(response.status).send(body);
+  });
+
+  // Keep custom endpoints that extend BetterAuth functionality
+
+  // Get current user (uses BetterAuth session)
+  server.get(
+    "/me",
+    {
+      onRequest: server.requireAuth,
+      schema: {
+        response: {
+          200: Type.Object({
+            id: Type.String(),
+            email: Type.String(),
+            name: Type.Optional(Type.Union([Type.String(), Type.Null()])),
+            emailVerified: Type.Boolean(),
+            image: Type.Optional(Type.Union([Type.String(), Type.Null()])),
+            createdAt: Type.String(),
+            updatedAt: Type.String(),
+          }),
+        },
+      },
+    },
+    async (request, reply) => {
+      // user is attached by requireAuth middleware
+      const { user } = request as AuthFastifyRequest;
+      return reply.send({
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        emailVerified: user.emailVerified,
+        image: user.image,
+        createdAt: user.createdAt.toISOString(),
+        updatedAt: user.updatedAt.toISOString(),
+      });
+    }
+  );
+
+  // Update profile (custom endpoint, BetterAuth doesn't provide this)
+  server.put(
+    "/profile",
+    {
+      onRequest: server.requireAuth,
+      schema: {
+        body: Type.Object({
+          name: Type.Optional(Type.String()),
+        }),
+      },
+    },
+    async (request, reply) => {
+      const { user } = request as AuthFastifyRequest;
+      const { name } = request.body as { name?: string };
+
+      const updatedUser = await updateUserProfile(user.id, { name });
+
+      return reply.send({
+        id: updatedUser.id,
+        email: updatedUser.email,
+        name: updatedUser.name,
+        emailVerified: updatedUser.emailVerified,
+        image: updatedUser.image,
+        createdAt: updatedUser.createdAt.toISOString(),
+        updatedAt: updatedUser.updatedAt.toISOString(),
+      });
+    }
+  );
+
+  // Delete account
+  server.delete(
+    "/account",
+    {
+      onRequest: server.requireAuth,
+    },
+    async (request, reply) => {
+      const { user } = request as AuthFastifyRequest;
+
+      await deleteUser(user.id);
+
+      return reply.send({ message: "Account deleted successfully" });
+    }
+  );
+
+  // Revoke a specific session by ID (BFF endpoint)
+  // Better Auth's native revokeSession requires the token, but list-sessions
+  // doesn't expose tokens for security. This endpoint looks up the token by ID
+  // and calls the native Better Auth revocation.
+  server.post(
+    "/revoke-session-by-id",
+    {
+      onRequest: server.requireAuth,
+      schema: {
+        body: Type.Object({
+          sessionId: Type.String(),
+        }),
+      },
+    },
+    async (request, reply) => {
+      const { user } = request as AuthFastifyRequest;
+      const { sessionId } = request.body as { sessionId: string };
+
+      // Find the session (validates it belongs to user)
+      const session = await findUserSessionById(sessionId, user.id);
+
+      if (!session) {
+        return reply.status(404).send({ error: "Session not found" });
+      }
+
+      // Revoke using Better Auth's native method
+      const response = await revokeSessionByToken(
+        session.token,
+        request.headers as unknown as Headers
+      );
+
+      return reply.send(response);
+    }
+  );
+
+  // Health check
+  server.get("/health", async (_request, reply) => {
+    return reply.send({
+      status: "ok",
+      timestamp: new Date().toISOString(),
+      service: "auth",
+    });
+  });
+};
+
+export default authRoutes;

package/templates/base/backend/controllers/rest-api/routes/device-sessions.ts

@@ -0,0 +1,197 @@
+import type { DeviceSessionFastifyRequest } from "fastify";
+import { FastifyPluginAsync } from "fastify";
+import {
+  CreateDeviceSessionBodySchema,
+  CreateDeviceSessionResponseSchema,
+  ValidateDeviceSessionBodySchema,
+  DeviceSessionValidationResponseSchema,
+  UpdateDeviceSessionActivityBodySchema,
+  DeviceSessionMigrationEligibilityResponseSchema,
+} from "../../../domain/device-session/schema";
+import {
+  createDeviceSession,
+  validateDeviceSession,
+  updateDeviceSessionActivity,
+  validateDeviceSessionMigrationEligibility,
+  deleteDeviceSession,
+  cleanupExpiredDeviceSessions,
+} from "../../../domain/device-session/repository";
+import { Type } from "@sinclair/typebox";
+
+const deviceSessionRoutes: FastifyPluginAsync = async (server) => {
+  // Create new anonymous device session
+  server.post<{
+    Body: typeof CreateDeviceSessionBodySchema._type;
+    Reply: typeof CreateDeviceSessionResponseSchema._type;
+  }>(
+    "/",
+    {
+      schema: {
+        body: CreateDeviceSessionBodySchema,
+        response: {
+          201: CreateDeviceSessionResponseSchema,
+        },
+      },
+    },
+    async (request, reply) => {
+      const { deviceId } = request.body as typeof CreateDeviceSessionBodySchema._type;
+
+      const result = await createDeviceSession({ deviceId });
+      return reply.status(201).send(result);
+    }
+  );
+
+  // Validate device session token
+  server.post<{
+    Body: typeof ValidateDeviceSessionBodySchema._type;
+    Reply: typeof DeviceSessionValidationResponseSchema._type;
+  }>(
+    "/validate",
+    {
+      schema: {
+        body: ValidateDeviceSessionBodySchema,
+        response: {
+          200: DeviceSessionValidationResponseSchema,
+        },
+      },
+    },
+    async (request, reply) => {
+      const { sessionToken } = request.body as typeof ValidateDeviceSessionBodySchema._type;
+
+      const session = await validateDeviceSession(sessionToken);
+      return reply.status(200).send({
+        valid: !!session,
+        session: session || undefined,
+      });
+    }
+  );
+
+  // Update device session activity (heartbeat)
+  server.put<{
+    Body: typeof UpdateDeviceSessionActivityBodySchema._type;
+  }>(
+    "/activity",
+    {
+      schema: {
+        body: UpdateDeviceSessionActivityBodySchema,
+        response: {
+          200: Type.Object({
+            message: Type.String(),
+          }),
+        },
+      },
+    },
+    async (request, reply) => {
+      const { sessionToken } = request.body as typeof UpdateDeviceSessionActivityBodySchema._type;
+
+      await updateDeviceSessionActivity(sessionToken);
+      return reply.status(200).send({ message: "Device session activity updated" });
+    }
+  );
+
+  // Get device session info (requires device session auth)
+  server.get<{
+    Reply: typeof DeviceSessionMigrationEligibilityResponseSchema._type;
+  }>(
+    "/info",
+    {
+      onRequest: server.requireDeviceSession,
+      schema: {
+        response: {
+          200: DeviceSessionMigrationEligibilityResponseSchema,
+        },
+      },
+    },
+    async (request, reply) => {
+      const sessionRequest = request as DeviceSessionFastifyRequest;
+      const sessionToken = sessionRequest.sessionToken;
+
+      const eligibility = await validateDeviceSessionMigrationEligibility(sessionToken);
+      return reply.status(200).send(eligibility);
+    }
+  );
+
+  // Check migration eligibility
+  server.post<{
+    Body: typeof ValidateDeviceSessionBodySchema._type;
+    Reply: typeof DeviceSessionMigrationEligibilityResponseSchema._type;
+  }>(
+    "/migration-eligibility",
+    {
+      schema: {
+        body: ValidateDeviceSessionBodySchema,
+        response: {
+          200: DeviceSessionMigrationEligibilityResponseSchema,
+        },
+      },
+    },
+    async (request, reply) => {
+      const { sessionToken } = request.body as typeof ValidateDeviceSessionBodySchema._type;
+
+      const eligibility = await validateDeviceSessionMigrationEligibility(sessionToken);
+      return reply.status(200).send(eligibility);
+    }
+  );
+
+  // Delete device session
+  server.delete<{
+    Body: typeof ValidateDeviceSessionBodySchema._type;
+  }>(
+    "/",
+    {
+      schema: {
+        body: ValidateDeviceSessionBodySchema,
+        response: {
+          200: Type.Object({
+            message: Type.String(),
+          }),
+        },
+      },
+    },
+    async (request, reply) => {
+      const { sessionToken } = request.body as typeof ValidateDeviceSessionBodySchema._type;
+
+      await deleteDeviceSession(sessionToken);
+      return reply.status(200).send({ message: "Device session deleted successfully" });
+    }
+  );
+
+  // Device session cleanup endpoint (for admin/cron use)
+  server.delete<{
+    Reply: {
+      message: string;
+      deletedCount: number;
+    };
+  }>(
+    "/cleanup",
+    {
+      // Note: In production, this should be protected by admin auth or API key
+      schema: {
+        response: {
+          200: Type.Object({
+            message: Type.String(),
+            deletedCount: Type.Number(),
+          }),
+        },
+      },
+    },
+    async (request, reply) => {
+      const deletedCount = await cleanupExpiredDeviceSessions();
+      return reply.status(200).send({
+        message: `Cleaned up ${deletedCount} expired device sessions`,
+        deletedCount,
+      });
+    }
+  );
+
+  // Health check endpoint
+  server.get("/health", async (request, reply) => {
+    return reply.code(200).send({
+      status: "ok",
+      timestamp: new Date().toISOString(),
+      service: "device-session"
+    });
+  });
+};
+
+export default deviceSessionRoutes;