create-tigra 2.0.3 → 2.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-tigra",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "type": "module",
   "description": "Create a production-ready full-stack app with Next.js 16 + Fastify 5 + Prisma + Redis",
   "bin": {

package/template/client/next.config.ts

@@ -1,5 +1,14 @@
 import type { NextConfig } from "next";
 
+const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:8000";
+const apiOrigin = (() => {
+  try {
+    return new URL(apiBaseUrl).origin;
+  } catch {
+    return "http://localhost:8000";
+  }
+})();
+
 const nextConfig: NextConfig = {
   async headers() {
     return [
@@ -22,7 +31,7 @@ const nextConfig: NextConfig = {
               "base-uri 'self'",
               "form-action 'self'",
               "frame-ancestors 'none'",
-              `connect-src 'self' ${process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:8000"}`,
+              `connect-src 'self' ${apiOrigin}`,
             ].join("; "),
           },
         ],

package/template/client/src/lib/api/axios.config.ts

@@ -80,12 +80,22 @@ apiClient.interceptors.response.use(
     } catch (refreshError) {
       processQueue(refreshError);
 
-      const { logout } = await import('@/features/auth/store/authSlice');
-      const { store } = await import('@/store');
-      store.dispatch(logout());
-
-      if (typeof window !== 'undefined') {
-        window.location.href = ROUTES.LOGIN;
+      // Only logout on definitive auth failures (server responded with 4xx).
+      // Network errors (server unreachable, timeout) should NOT destroy the session.
+      const isAuthFailure =
+        axios.isAxiosError(refreshError) &&
+        refreshError.response != null &&
+        refreshError.response.status >= 400 &&
+        refreshError.response.status < 500;
+
+      if (isAuthFailure) {
+        const { logout } = await import('@/features/auth/store/authSlice');
+        const { store } = await import('@/store');
+        store.dispatch(logout());
+
+        if (typeof window !== 'undefined') {
+          window.location.href = ROUTES.LOGIN;
+        }
       }
 
       return Promise.reject(refreshError);

package/template/client/src/middleware.ts

@@ -23,12 +23,21 @@ export function middleware(request: NextRequest): NextResponse {
     path === '/' ? pathname === '/' : pathname.startsWith(path)
   );
 
-  if (isProtectedPath && (!token || isTokenExpired(token))) {
+  // No token at all — user is not logged in, redirect to login
+  if (isProtectedPath && !token) {
     const loginUrl = new URL('/login', request.url);
     loginUrl.searchParams.set('from', pathname);
     return NextResponse.redirect(loginUrl);
   }
 
+  // Expired token on protected path — allow through so client-side can attempt refresh.
+  // Delete the stale access_token so AuthInitializer starts fresh: getMe() → 401 → refresh.
+  if (isProtectedPath && token && isTokenExpired(token)) {
+    const response = NextResponse.next();
+    response.cookies.delete('access_token');
+    return response;
+  }
+
   const isAuthPath = authPaths.some((path) => pathname.startsWith(path));
 
   if (isAuthPath && token) {

package/template/server/src/libs/auth.ts

@@ -1,6 +1,7 @@
 import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 import { v4 as uuidv4 } from 'uuid';
 import { env } from '@config/env.js';
+import { prisma } from '@libs/prisma.js';
 import { UnauthorizedError, ForbiddenError } from '@shared/errors/errors.js';
 import type { JwtPayload, UserRole } from '@shared/types/index.js';
 
@@ -58,6 +59,16 @@ export async function authenticate(
   } catch {
     throw new UnauthorizedError('Invalid or expired token');
   }
+
+  // Verify user still exists, is active, and not soft-deleted
+  const user = await prisma.user.findUnique({
+    where: { id: request.user.userId },
+    select: { isActive: true, deletedAt: true },
+  });
+
+  if (!user || !user.isActive || user.deletedAt) {
+    throw new UnauthorizedError('Account is deactivated or deleted');
+  }
 }
 
 export async function optionalAuth(

package/template/server/src/modules/auth/auth.service.ts

@@ -54,15 +54,17 @@ function sanitizeUser(user: {
   isActive: boolean;
   createdAt: Date;
   updatedAt: Date;
-  password: string;
 }): SanitizedUser {
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  const { password: _password, createdAt, updatedAt, avatarUrl, ...rest } = user;
   return {
-    ...rest,
-    avatarUrl: avatarUrl ?? null,
-    createdAt: createdAt.toISOString(),
-    updatedAt: updatedAt.toISOString(),
+    id: user.id,
+    email: user.email,
+    firstName: user.firstName,
+    lastName: user.lastName,
+    avatarUrl: user.avatarUrl ?? null,
+    role: user.role,
+    isActive: user.isActive,
+    createdAt: user.createdAt.toISOString(),
+    updatedAt: user.updatedAt.toISOString(),
   };
 }