create-theta-code 1.0.1

package/templates/pg-js/src/config/db.config.js

@@ -0,0 +1,30 @@
+// src/config/db.config.js — PostgreSQL/Prisma connection. Client initialization and lifecycle.
+
+import { PrismaClient } from '@prisma/client';
+import envConfig from './env.config.js';
+
+const prisma = new PrismaClient({
+  log: process.env.NODE_ENV === 'development' ? ['query', 'info', 'warn', 'error'] : ['warn', 'error'],
+});
+
+async function connectDB() {
+  try {
+    await prisma.$connect();
+    console.log('✅ PostgreSQL connected successfully');
+    return prisma;
+  } catch (err) {
+    console.error('❌ PostgreSQL connection failed:', err.message);
+    process.exit(1);
+  }
+}
+
+async function disconnectDB() {
+  try {
+    await prisma.$disconnect();
+    console.log('✅ PostgreSQL disconnected');
+  } catch (err) {
+    console.error('❌ PostgreSQL disconnection failed:', err.message);
+  }
+}
+
+export { connectDB, disconnectDB, prisma };

package/templates/pg-js/src/config/env.config.js

@@ -0,0 +1,36 @@
+// src/config/env.config.js — Validates ALL required env vars at startup. App refuses to boot if missing.
+
+import { z } from 'zod';
+
+const envSchema = z.object({
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+  PORT: z.string().transform(Number).default('3000'),
+  DATABASE_URL: z.string().url('Invalid DATABASE_URL'),
+  JWT_SECRET: z.string().min(32, 'JWT_SECRET must be at least 32 characters'),
+  JWT_REFRESH_SECRET: z.string().min(32, 'JWT_REFRESH_SECRET must be at least 32 characters'),
+  CORS_ORIGIN: z.string().default('http://localhost:3000'),
+  LOG_LEVEL: z.enum(['error', 'warn', 'info', 'debug']).default('info'),
+});
+
+let envConfig;
+
+try {
+  const rawEnv = {
+    NODE_ENV: process.env.NODE_ENV,
+    PORT: process.env.PORT,
+    DATABASE_URL: process.env.DATABASE_URL,
+    JWT_SECRET: process.env.JWT_SECRET,
+    JWT_REFRESH_SECRET: process.env.JWT_REFRESH_SECRET,
+    CORS_ORIGIN: process.env.CORS_ORIGIN,
+    LOG_LEVEL: process.env.LOG_LEVEL,
+  };
+
+  envConfig = envSchema.parse(rawEnv);
+  Object.freeze(envConfig);
+} catch (err) {
+  console.error('❌ Environment validation failed:');
+  console.error(err.errors || err.message);
+  process.exit(1);
+}
+
+export default envConfig;

package/templates/pg-js/src/config/rateLimiter.config.js

@@ -0,0 +1,22 @@
+// src/config/rateLimiter.config.js — Global and auth-specific rate limiters. Non-negotiable.
+
+import rateLimit from 'express-rate-limit';
+import { APP_CONSTANTS } from '../utils/constants.js';
+
+const globalRateLimiter = rateLimit({
+  windowMs: APP_CONSTANTS.RATE_LIMIT_WINDOW_MS,
+  max: APP_CONSTANTS.RATE_LIMIT_MAX_REQUESTS,
+  message: 'Too many requests, please try again later',
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+const authRateLimiter = rateLimit({
+  windowMs: APP_CONSTANTS.RATE_LIMIT_WINDOW_MS,
+  max: APP_CONSTANTS.AUTH_RATE_LIMIT_MAX_REQUESTS,
+  message: 'Too many login attempts, please try again later',
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+export { globalRateLimiter, authRateLimiter };

package/templates/pg-js/src/middlewares/auth.middleware.js

@@ -0,0 +1,32 @@
+// src/middlewares/auth.middleware.js — Verifies JWT from Authorization header. Attaches req.user.
+
+import { HTTP_STATUS } from '../utils/constants.js';
+import { AppError } from '../utils/AppError.js';
+import { verifyToken } from '../utils/jwt.utils.js';
+import { asyncHandler } from '../utils/asyncHandler.js';
+
+const authMiddleware = asyncHandler((req, res, next) => {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    throw new AppError('Missing or invalid Authorization header', HTTP_STATUS.UNAUTHORIZED);
+  }
+
+  const token = authHeader.slice(7);
+
+  try {
+    const decoded = verifyToken(token);
+    req.user = decoded;
+    next();
+  } catch (err) {
+    if (err.name === 'TokenExpiredError') {
+      throw new AppError('Token expired', HTTP_STATUS.UNAUTHORIZED);
+    }
+    if (err.name === 'JsonWebTokenError') {
+      throw new AppError('Invalid token', HTTP_STATUS.UNAUTHORIZED);
+    }
+    throw new AppError('Authentication failed', HTTP_STATUS.UNAUTHORIZED);
+  }
+});
+
+export { authMiddleware };

package/templates/pg-js/src/middlewares/error.middleware.js

@@ -0,0 +1,50 @@
+// src/middlewares/error.middleware.js — Global error handler. Operational vs programmer errors. No stack in prod.
+
+import { HTTP_STATUS } from '../utils/constants.js';
+import { sendError } from '../utils/apiResponse.js';
+
+const errorMiddleware = (err, req, res, next) => {
+  const isDevelopment = process.env.NODE_ENV === 'development';
+
+  // Prisma UniqueConstraintError
+  if (err.code === 'P2002') {
+    const field = err.meta?.target?.[0] || 'field';
+    return sendError(res, HTTP_STATUS.CONFLICT, `${field} already in use`, isDevelopment ? err : null);
+  }
+
+  // Prisma RecordNotFoundError
+  if (err.code === 'P2025') {
+    return sendError(res, HTTP_STATUS.NOT_FOUND, 'Record not found', isDevelopment ? err : null);
+  }
+
+  // Prisma ValidationError
+  if (err.code === 'P2003' || err.code === 'P2014') {
+    return sendError(res, HTTP_STATUS.BAD_REQUEST, 'Invalid data provided', isDevelopment ? err : null);
+  }
+
+  // JWT TokenExpiredError
+  if (err.name === 'TokenExpiredError') {
+    return sendError(res, HTTP_STATUS.UNAUTHORIZED, 'Token expired', isDevelopment ? err : null);
+  }
+
+  // JWT JsonWebTokenError
+  if (err.name === 'JsonWebTokenError') {
+    return sendError(res, HTTP_STATUS.UNAUTHORIZED, 'Invalid token', isDevelopment ? err : null);
+  }
+
+  // AppError (operational)
+  if (err.isOperational) {
+    return sendError(res, err.statusCode, err.message, isDevelopment ? { stack: err.stack } : null);
+  }
+
+  // Programmer error (unhandled)
+  console.error('UNHANDLED ERROR:', err);
+  return sendError(
+    res,
+    HTTP_STATUS.INTERNAL_SERVER_ERROR,
+    'Internal server error',
+    isDevelopment ? { error: err.message, stack: err.stack } : null
+  );
+};
+
+export { errorMiddleware };

package/templates/pg-js/src/middlewares/notFound.middleware.js

@@ -0,0 +1,11 @@
+// src/middlewares/notFound.middleware.js — Catches 404s. Creates AppError, passes to error handler.
+
+import { HTTP_STATUS } from '../utils/constants.js';
+import { AppError } from '../utils/AppError.js';
+
+const notFoundMiddleware = (req, res, next) => {
+  const error = new AppError(`Route ${req.originalUrl} not found`, HTTP_STATUS.NOT_FOUND);
+  next(error);
+};
+
+export { notFoundMiddleware };

package/templates/pg-js/src/middlewares/validate.middleware.js

@@ -0,0 +1,21 @@
+// src/middlewares/validate.middleware.js — Validates req.body with Zod schema. 400 on fail.
+
+import { HTTP_STATUS } from '../utils/constants.js';
+import { sendError } from '../utils/apiResponse.js';
+
+const validate = (schema) => (req, res, next) => {
+  const result = schema.safeParse(req.body);
+
+  if (!result.success) {
+    const errors = result.error.errors.map((err) => ({
+      field: err.path.join('.'),
+      message: err.message,
+    }));
+    return sendError(res, HTTP_STATUS.BAD_REQUEST, 'Validation failed', errors);
+  }
+
+  req.body = result.data;
+  next();
+};
+
+export { validate };

package/templates/pg-js/src/modules/user/user.controller.js

@@ -0,0 +1,57 @@
+// src/modules/user/user.controller.js — HTTP only. Read req, call service, send res. No business logic.
+
+import { HTTP_STATUS } from '../../utils/constants.js';
+import { sendSuccess, sendError } from '../../utils/apiResponse.js';
+import { asyncHandler } from '../../utils/asyncHandler.js';
+import * as userService from './user.service.js';
+
+const register = asyncHandler(async (req, res) => {
+  const { email, firstName, lastName, password } = req.body;
+
+  const user = await userService.register(email, firstName, lastName, password);
+
+  return sendSuccess(res, HTTP_STATUS.CREATED, 'User registered successfully', {
+    user,
+  });
+});
+
+const login = asyncHandler(async (req, res) => {
+  const { email, password } = req.body;
+
+  const result = await userService.login(email, password);
+
+  return sendSuccess(res, HTTP_STATUS.OK, 'Login successful', {
+    user: result.user,
+    token: result.token,
+    refreshToken: result.refreshToken,
+  });
+});
+
+const getProfile = asyncHandler(async (req, res) => {
+  const user = await userService.getUserById(req.user.id);
+
+  return sendSuccess(res, HTTP_STATUS.OK, 'User profile retrieved', {
+    user,
+  });
+});
+
+const updateProfile = asyncHandler(async (req, res) => {
+  const { firstName, lastName } = req.body;
+
+  const user = await userService.updateUser(req.user.id, {
+    firstName,
+    lastName,
+  });
+
+  return sendSuccess(res, HTTP_STATUS.OK, 'User profile updated', {
+    user,
+  });
+});
+
+const deleteAccount = asyncHandler(async (req, res) => {
+  await userService.deleteUser(req.user.id);
+
+  return sendSuccess(res, HTTP_STATUS.OK, 'Account deleted successfully', null);
+});
+
+export { register, login, getProfile, updateProfile, deleteAccount };

package/templates/pg-js/src/modules/user/user.model.js

@@ -0,0 +1,20 @@
+// src/modules/user/user.model.js — Reference to Prisma User model. See prisma/schema.prisma for definition.
+
+// This module exists for reference. The actual User model is defined in prisma/schema.prisma
+// Example schema:
+/*
+model User {
+  id        Int     @id @default(autoincrement())
+  email     String  @unique
+  firstName String
+  lastName  String
+  password  String
+  isActive  Boolean @default(true)
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@map("users")
+}
+*/
+
+export {};

package/templates/pg-js/src/modules/user/user.repository.js

@@ -0,0 +1,105 @@
+// src/modules/user/user.repository.js — DB queries only. Never business logic, never HTTP.
+
+import { prisma } from '../../config/db.config.js';
+
+async function findById(id) {
+  return prisma.user.findUnique({
+    where: { id },
+    select: {
+      id: true,
+      email: true,
+      firstName: true,
+      lastName: true,
+      isActive: true,
+      createdAt: true,
+      updatedAt: true,
+    },
+  });
+}
+
+async function findByEmail(email) {
+  return prisma.user.findUnique({
+    where: { email },
+  });
+}
+
+async function findByEmailPublic(email) {
+  return prisma.user.findUnique({
+    where: { email },
+    select: {
+      id: true,
+      email: true,
+      firstName: true,
+      lastName: true,
+      isActive: true,
+      createdAt: true,
+      updatedAt: true,
+    },
+  });
+}
+
+async function create(userData) {
+  return prisma.user.create({
+    data: userData,
+    select: {
+      id: true,
+      email: true,
+      firstName: true,
+      lastName: true,
+      isActive: true,
+      createdAt: true,
+      updatedAt: true,
+    },
+  });
+}
+
+async function updateById(id, updateData) {
+  return prisma.user.update({
+    where: { id },
+    data: updateData,
+    select: {
+      id: true,
+      email: true,
+      firstName: true,
+      lastName: true,
+      isActive: true,
+      createdAt: true,
+      updatedAt: true,
+    },
+  });
+}
+
+async function deleteById(id) {
+  return prisma.user.delete({
+    where: { id },
+  });
+}
+
+async function findAll(limit = 10, skip = 0) {
+  return prisma.user.findMany({
+    skip,
+    take: limit,
+    select: {
+      id: true,
+      email: true,
+      firstName: true,
+      lastName: true,
+      isActive: true,
+      createdAt: true,
+      updatedAt: true,
+    },
+    orderBy: {
+      createdAt: 'desc',
+    },
+  });
+}
+
+export {
+  findById,
+  findByEmail,
+  findByEmailPublic,
+  create,
+  updateById,
+  deleteById,
+  findAll,
+};

package/templates/pg-js/src/modules/user/user.routes.js

@@ -0,0 +1,27 @@
+// src/modules/user/user.routes.js — Route definitions. Middleware chain per route. Validation before controller.
+
+import { Router } from 'express';
+import { validate } from '../../middlewares/validate.middleware.js';
+import { authMiddleware } from '../../middlewares/auth.middleware.js';
+import { authRateLimiter } from '../../config/rateLimiter.config.js';
+import { registerSchema, loginSchema, updateUserSchema } from './user.validator.js';
+import {
+  register,
+  login,
+  getProfile,
+  updateProfile,
+  deleteAccount,
+} from './user.controller.js';
+
+const router = Router();
+
+// Public routes
+router.post('/register', authRateLimiter, validate(registerSchema), register);
+router.post('/login', authRateLimiter, validate(loginSchema), login);
+
+// Protected routes
+router.get('/profile', authMiddleware, getProfile);
+router.put('/profile', authMiddleware, validate(updateUserSchema), updateProfile);
+router.delete('/account', authMiddleware, deleteAccount);
+
+export default router;

package/templates/pg-js/src/modules/user/user.service.js

@@ -0,0 +1,81 @@
+// src/modules/user/user.service.js — Business logic only. Never DB queries, never HTTP.
+
+import bcryptjs from 'bcryptjs';
+import { AppError } from '../../utils/AppError.js';
+import { HTTP_STATUS, APP_CONSTANTS } from '../../utils/constants.js';
+import { signToken, signRefreshToken } from '../../utils/jwt.utils.js';
+import * as userRepository from './user.repository.js';
+
+async function register(email, firstName, lastName, password) {
+  // Check if user exists
+  const existingUser = await userRepository.findByEmailPublic(email);
+  if (existingUser) {
+    throw new AppError('Email already in use', HTTP_STATUS.CONFLICT);
+  }
+
+  // Hash password
+  const hashedPassword = await bcryptjs.hash(password, APP_CONSTANTS.BCRYPT_SALT_ROUNDS);
+
+  // Create user
+  const user = await userRepository.create({
+    email,
+    firstName,
+    lastName,
+    password: hashedPassword,
+  });
+
+  return user;
+}
+
+async function login(email, password) {
+  // Find user with password
+  const user = await userRepository.findByEmail(email);
+  if (!user) {
+    throw new AppError('Invalid email or password', HTTP_STATUS.UNAUTHORIZED);
+  }
+
+  // Verify password
+  const isPasswordValid = await bcryptjs.compare(password, user.password);
+  if (!isPasswordValid) {
+    throw new AppError('Invalid email or password', HTTP_STATUS.UNAUTHORIZED);
+  }
+
+  // Generate tokens
+  const token = signToken({ id: user.id, email: user.email });
+  const refreshToken = signRefreshToken({ id: user.id });
+
+  // Return without password
+  const { password: _, ...userWithoutPassword } = user;
+
+  return {
+    user: userWithoutPassword,
+    token,
+    refreshToken,
+  };
+}
+
+async function getUserById(id) {
+  const user = await userRepository.findById(id);
+  if (!user) {
+    throw new AppError('User not found', HTTP_STATUS.NOT_FOUND);
+  }
+  return user;
+}
+
+async function updateUser(id, updateData) {
+  const user = await userRepository.updateById(id, updateData);
+  if (!user) {
+    throw new AppError('User not found', HTTP_STATUS.NOT_FOUND);
+  }
+  return user;
+}
+
+async function deleteUser(id) {
+  const user = await userRepository.deleteById(id);
+  if (!user) {
+    throw new AppError('User not found', HTTP_STATUS.NOT_FOUND);
+  }
+  return true;
+}
+
+export { register, login, getUserById, updateUser, deleteUser };

package/templates/pg-js/src/modules/user/user.validator.js

@@ -0,0 +1,22 @@
+// src/modules/user/user.validator.js — Zod validation schemas. Never validate in controller.
+
+import { z } from 'zod';
+
+const registerSchema = z.object({
+  email: z.string().email('Invalid email format'),
+  firstName: z.string().min(2, 'First name must be at least 2 characters').max(50),
+  lastName: z.string().min(2, 'Last name must be at least 2 characters').max(50),
+  password: z.string().min(8, 'Password must be at least 8 characters'),
+});
+
+const loginSchema = z.object({
+  email: z.string().email('Invalid email format'),
+  password: z.string().min(1, 'Password is required'),
+});
+
+const updateUserSchema = z.object({
+  firstName: z.string().min(2).max(50).optional(),
+  lastName: z.string().min(2).max(50).optional(),
+});
+
+export { registerSchema, loginSchema, updateUserSchema };

package/templates/pg-js/src/utils/AppError.js

@@ -0,0 +1,14 @@
+// src/utils/AppError.js — Custom Error class for operational errors. All errors inherit this.
+
+class AppError extends Error {
+  constructor(message, statusCode, isOperational = true) {
+    super(message);
+    this.statusCode = statusCode;
+    this.isOperational = isOperational;
+    this.timestamp = new Date().toISOString();
+
+    Error.captureStackTrace(this, this.constructor);
+  }
+}
+
+export { AppError };

package/templates/pg-js/src/utils/apiResponse.js

@@ -0,0 +1,23 @@
+// src/utils/apiResponse.js — Standardized success/error response formatting. Always use these.
+
+import { HTTP_STATUS } from './constants.js';
+
+function sendSuccess(res, statusCode = HTTP_STATUS.OK, message = 'Success', data = null) {
+  return res.status(statusCode).json({
+    success: true,
+    message,
+    data,
+    timestamp: new Date().toISOString(),
+  });
+}
+
+function sendError(res, statusCode = HTTP_STATUS.INTERNAL_SERVER_ERROR, message = 'Internal Server Error', data = null) {
+  return res.status(statusCode).json({
+    success: false,
+    message,
+    data,
+    timestamp: new Date().toISOString(),
+  });
+}
+
+export { sendSuccess, sendError };

package/templates/pg-js/src/utils/asyncHandler.js

@@ -0,0 +1,7 @@
+// src/utils/asyncHandler.js — Wraps async controller/service functions. Zero try/catch in controllers.
+
+const asyncHandler = (fn) => (req, res, next) => {
+  return Promise.resolve(fn(req, res, next)).catch(next);
+};
+
+export { asyncHandler };

package/templates/pg-js/src/utils/constants.js

@@ -0,0 +1,24 @@
+// src/utils/constants.js — All app constants. No hardcoded strings anywhere.
+
+const HTTP_STATUS = {
+  OK: 200,
+  CREATED: 201,
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  CONFLICT: 409,
+  INTERNAL_SERVER_ERROR: 500,
+};
+
+const APP_CONSTANTS = {
+  JWT_EXPIRY: '7d',
+  JWT_REFRESH_EXPIRY: '30d',
+  BCRYPT_SALT_ROUNDS: 12,
+  RATE_LIMIT_WINDOW_MS: 15 * 60 * 1000,
+  RATE_LIMIT_MAX_REQUESTS: 100,
+  AUTH_RATE_LIMIT_MAX_REQUESTS: 5,
+  REQUEST_BODY_LIMIT: '10kb',
+};
+
+export { HTTP_STATUS, APP_CONSTANTS };

package/templates/pg-js/src/utils/jwt.utils.js

@@ -0,0 +1,39 @@
+// src/utils/jwt.utils.js — JWT token operations only. Never inline JWT logic anywhere.
+
+import jwt from 'jsonwebtoken';
+import { AppError } from './AppError.js';
+import { HTTP_STATUS, APP_CONSTANTS } from './constants.js';
+
+function signToken(payload, expiresIn = APP_CONSTANTS.JWT_EXPIRY) {
+  const secret = process.env.JWT_SECRET;
+  if (!secret) {
+    throw new AppError('JWT_SECRET not configured', HTTP_STATUS.INTERNAL_SERVER_ERROR, false);
+  }
+  return jwt.sign(payload, secret, { expiresIn });
+}
+
+function signRefreshToken(payload, expiresIn = APP_CONSTANTS.JWT_REFRESH_EXPIRY) {
+  const secret = process.env.JWT_REFRESH_SECRET;
+  if (!secret) {
+    throw new AppError('JWT_REFRESH_SECRET not configured', HTTP_STATUS.INTERNAL_SERVER_ERROR, false);
+  }
+  return jwt.sign(payload, secret, { expiresIn });
+}
+
+function verifyToken(token) {
+  const secret = process.env.JWT_SECRET;
+  if (!secret) {
+    throw new AppError('JWT_SECRET not configured', HTTP_STATUS.INTERNAL_SERVER_ERROR, false);
+  }
+  return jwt.verify(token, secret);
+}
+
+function verifyRefreshToken(token) {
+  const secret = process.env.JWT_REFRESH_SECRET;
+  if (!secret) {
+    throw new AppError('JWT_REFRESH_SECRET not configured', HTTP_STATUS.INTERNAL_SERVER_ERROR, false);
+  }
+  return jwt.verify(token, secret);
+}
+
+export { signToken, signRefreshToken, verifyToken, verifyRefreshToken };