npm - create-tigra - Versions diffs - 3.0.2 → 3.0.3 - Mend

create-tigra 3.0.2 → 3.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (33) hide show

package/package.json +1 -1
package/template/client/.env.example +19 -0
package/template/client/Dockerfile +3 -3
package/template/client/next.config.ts +7 -42
package/template/client/package-lock.json +1896 -146
package/template/client/package.json +2 -0
package/template/client/src/app/layout.tsx +10 -3
package/template/client/src/app/providers.tsx +15 -2
package/template/client/src/instrumentation-client.ts +30 -0
package/template/client/src/instrumentation.ts +38 -0
package/template/client/src/lib/env.ts +13 -2
package/template/client/src/middleware.ts +105 -18
package/template/server/.env.example +22 -1
package/template/server/.env.example.production +16 -1
package/template/server/Dockerfile +7 -5
package/template/server/package-lock.json +2136 -86
package/template/server/package.json +6 -0
package/template/server/src/app.ts +30 -11
package/template/server/src/config/env.ts +23 -2
package/template/server/src/config/rate-limit.config.ts +6 -0
package/template/server/src/libs/logger.ts +15 -0
package/template/server/src/libs/observability/sentry.ts +42 -0
package/template/server/src/libs/requestLogger.ts +8 -2
package/template/server/src/libs/storage/file-storage.service.ts +144 -16
package/template/server/src/modules/admin/__tests__/admin.integration.test.ts +128 -0
package/template/server/src/modules/auth/__tests__/auth.integration.test.ts +138 -0
package/template/server/src/modules/files/__tests__/files.integration.test.ts +157 -0
package/template/server/src/modules/files/files.controller.ts +180 -0
package/template/server/src/modules/files/files.routes.ts +46 -0
package/template/server/src/server.ts +6 -0
package/template/server/src/test/integration.setup.ts +170 -0
package/template/server/vitest.config.ts +10 -1
package/template/server/vitest.integration.config.ts +50 -0

package/template/client/package.json CHANGED Viewed

@@ -8,11 +8,13 @@
     "start": "next start",
     "lint": "eslint src/",
     "typecheck": "tsc --noEmit",
+    "audit": "npm audit --audit-level=high",
     "generate:env": "node -e \"import('fs').then(f=>{if(f.existsSync('.env'))console.log('.env already exists, skipping');else{f.copyFileSync('.env.example','.env');console.log('.env created from .env.example')}})\""
   },
   "dependencies": {
     "@hookform/resolvers": "^5.2.2",
     "@reduxjs/toolkit": "^2.11.2",
+    "@sentry/nextjs": "^10.62.0",
     "@tanstack/react-query": "^5.90.21",
     "axios": "^1.13.5",
     "class-variance-authority": "^0.7.1",

package/template/client/src/app/layout.tsx CHANGED Viewed

@@ -1,3 +1,4 @@
+import { headers } from 'next/headers';
 import type { Metadata, Viewport } from 'next';
 import type React from 'react';
 import { Inter, JetBrains_Mono } from 'next/font/google';
@@ -27,15 +28,21 @@ export const viewport: Viewport = {
   viewportFit: 'cover',
 };
-export default function RootLayout({
+export default async function RootLayout({
   children,
 }: Readonly<{
   children: React.ReactNode;
-}>): React.ReactElement {
+}>): Promise<React.ReactElement> {
+  // Read the per-request nonce set by middleware. next-themes injects an inline
+  // anti-FOUC <script> via dangerouslySetInnerHTML that Next does NOT auto-nonce,
+  // so under our 'strict-dynamic' CSP it must be passed the nonce explicitly or
+  // the browser refuses it (causing a flash / hydration mismatch).
+  const nonce = (await headers()).get('x-nonce') ?? undefined;
   return (
     <html lang="en" suppressHydrationWarning>
       <body className={`${inter.variable} ${jetbrainsMono.variable} font-sans antialiased`}>
-        <Providers>{children}</Providers>
+        <Providers nonce={nonce}>{children}</Providers>
       </body>
     </html>
   );

package/template/client/src/app/providers.tsx CHANGED Viewed

@@ -11,7 +11,15 @@ import { Toaster } from 'sonner';
 import { store } from '@/store';
 import { AuthInitializer } from '@/features/auth/components/AuthInitializer';
-export function Providers({ children }: { children: React.ReactNode }): React.ReactElement {
+export function Providers({
+  children,
+  nonce,
+}: {
+  children: React.ReactNode;
+  // Per-request CSP nonce from middleware (via the root layout). Forwarded to
+  // next-themes so its inline anti-FOUC script is allowed under 'strict-dynamic'.
+  nonce?: string;
+}): React.ReactElement {
   const [queryClient] = useState(
     () =>
       new QueryClient({
@@ -30,7 +38,12 @@ export function Providers({ children }: { children: React.ReactNode }): React.Re
   return (
     <ReduxProvider store={store}>
       <QueryClientProvider client={queryClient}>
-        <ThemeProvider attribute="class" defaultTheme="light" enableColorScheme={false}>
+        <ThemeProvider
+          attribute="class"
+          defaultTheme="light"
+          enableColorScheme={false}
+          nonce={nonce}
+        >
           <AuthInitializer>
             {children}
           </AuthInitializer>

package/template/client/src/instrumentation-client.ts ADDED Viewed

@@ -0,0 +1,30 @@
+/**
+ * Browser (client) instrumentation — env-gated Sentry, INERT by default.
+ *
+ * Next.js 15.3+/16 loads this module in the browser before the app hydrates.
+ * We init Sentry ONLY when the public DSN is set, so with no DSN this file is a
+ * no-op and ships nothing that phones home.
+ *
+ * `process.env.NEXT_PUBLIC_*` is inlined at build time by Next — reference it
+ * literally (not via a computed key) so the value is statically replaced.
+ *
+ * Like the server side, this stays runtime + env-gated: we do NOT wrap
+ * next.config.ts with `withSentryConfig` (that would couple `next build` to a
+ * source-map upload auth token). withSentryConfig is the opt-in upgrade.
+ */
+import * as Sentry from '@sentry/nextjs';
+const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN;
+if (dsn) {
+  Sentry.init({
+    dsn,
+    tracesSampleRate: process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
+      ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
+      : 0.1,
+  });
+}
+// Instruments App Router navigations for tracing. Harmless when Sentry is
+// uninitialized (no DSN).
+export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;

package/template/client/src/instrumentation.ts ADDED Viewed

@@ -0,0 +1,38 @@
+/**
+ * Server/Edge runtime instrumentation — env-gated Sentry, INERT by default.
+ *
+ * Next.js calls `register()` once per server runtime at startup. We init Sentry
+ * ONLY when a DSN is present (a server `SENTRY_DSN`, or the public DSN shared
+ * with the browser), so with no DSN this is a clean no-op and `next build`
+ * succeeds with zero Sentry credentials.
+ *
+ * NOTE: we deliberately do NOT wrap next.config.ts with `withSentryConfig`.
+ * That adds build-time source-map upload which requires a SENTRY_AUTH_TOKEN and
+ * would couple `next build` to credentials. Source-map upload is the opt-in
+ * upgrade — add `withSentryConfig` + an auth token when you want it. This setup
+ * stays purely runtime + env-gated.
+ */
+import * as Sentry from '@sentry/nextjs';
+const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN ?? process.env.SENTRY_DSN;
+const tracesSampleRate = process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
+  ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
+  : 0.1;
+export async function register(): Promise<void> {
+  // No DSN → stay inert.
+  if (!dsn) return;
+  if (process.env.NEXT_RUNTIME === 'nodejs' || process.env.NEXT_RUNTIME === 'edge') {
+    Sentry.init({
+      dsn,
+      tracesSampleRate,
+      environment: process.env.SENTRY_ENVIRONMENT ?? process.env.NODE_ENV,
+    });
+  }
+}
+// Capture errors from Server Components, route handlers, and middleware.
+// Safe no-op when Sentry was never initialized (no DSN).
+export const onRequestError = Sentry.captureRequestError;

package/template/client/src/lib/env.ts CHANGED Viewed

@@ -1,19 +1,30 @@
 import { z } from 'zod';
-// Every field MUST have a .default() so the dev fallback (envSchema.parse({}))
-// can produce valid defaults when env vars are missing in development.
+// Every required field MUST have a .default() so the dev fallback
+// (envSchema.parse({})) can produce valid defaults when env vars are missing in
+// development. Genuinely optional integrations (e.g. Sentry) use .optional()
+// instead — unset means "disabled", and the build must pass with them absent.
 const envSchema = z.object({
   NEXT_PUBLIC_API_BASE_URL: z
     .string()
     .url('NEXT_PUBLIC_API_BASE_URL must be a valid URL')
     .default('http://localhost:8000/api/v1'),
   NEXT_PUBLIC_APP_NAME: z.string().default('My App'),
+  // --- Error Tracking (Optional, Sentry) ---
+  // Inert without a DSN: instrumentation only inits Sentry when this is set.
+  // Optional so `next build` passes with it unset. Never hardcode a DSN.
+  NEXT_PUBLIC_SENTRY_DSN: z.string().url().optional(),
+  // Fraction of transactions sampled for browser performance tracing (0..1).
+  NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE: z.coerce.number().min(0).max(1).optional(),
 });
 function validateEnv(): z.infer<typeof envSchema> {
   const result = envSchema.safeParse({
     NEXT_PUBLIC_API_BASE_URL: process.env.NEXT_PUBLIC_API_BASE_URL,
     NEXT_PUBLIC_APP_NAME: process.env.NEXT_PUBLIC_APP_NAME,
+    NEXT_PUBLIC_SENTRY_DSN: process.env.NEXT_PUBLIC_SENTRY_DSN,
+    NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE: process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE,
   });
   if (!result.success) {

package/template/client/src/middleware.ts CHANGED Viewed

@@ -14,9 +14,94 @@ function isTokenExpired(token: string): boolean {
   }
 }
+/**
+ * Derive the origin (scheme://host[:port]) of a URL, falling back to the input
+ * when it can't be parsed. Used to turn NEXT_PUBLIC_API_BASE_URL (which may
+ * carry a path like .../api/v1) and the Sentry DSN into bare CSP source values.
+ */
+function toOrigin(url: string | undefined): string | null {
+  if (!url) return null;
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+const apiOrigin = toOrigin(process.env.NEXT_PUBLIC_API_BASE_URL) ?? 'http://localhost:8000';
+// When Sentry is configured, its browser SDK POSTs envelopes to the DSN origin;
+// it must be allowed in connect-src or every error report is blocked by CSP.
+const sentryOrigin = toOrigin(process.env.NEXT_PUBLIC_SENTRY_DSN);
+/**
+ * Build the per-request Content-Security-Policy. A fresh nonce is minted for
+ * every request and threaded onto Next's own scripts (see middleware below), so
+ * 'strict-dynamic' can trust them while refusing any attacker-injected inline
+ * script that lacks the nonce.
+ *
+ * DEV relaxes script-src with 'unsafe-eval' (Next's HMR/react-refresh evals) and
+ * style-src with 'unsafe-inline' (the dev overlay injects inline styles). PROD
+ * is strict. Style-src keeps 'unsafe-inline' in PROD too: Tailwind v4 and some
+ * libraries emit inline <style>/style="" that a nonce cannot cover and that a
+ * strict style-src would REFUSE, breaking the page. Inline styles cannot
+ * exfiltrate data the way inline scripts can, so this is an accepted tradeoff —
+ * the high-value half (the strict, nonce-gated script-src) stays intact.
+ */
+function buildCsp(nonce: string, isProd: boolean): string {
+  const connectSrc = ["'self'", apiOrigin, sentryOrigin].filter(Boolean).join(' ');
+  const scriptSrc = isProd
+    ? `'self' 'nonce-${nonce}' 'strict-dynamic' https:`
+    : `'self' 'nonce-${nonce}' 'strict-dynamic' 'unsafe-eval' https:`;
+  // 'unsafe-inline' in style-src in BOTH modes (see note above).
+  const styleSrc = `'self' 'unsafe-inline'`;
+  return [
+    `default-src 'self'`,
+    `script-src ${scriptSrc}`,
+    `style-src ${styleSrc}`,
+    `img-src 'self' blob: data: ${apiOrigin}`,
+    `font-src 'self'`,
+    `connect-src ${connectSrc}`,
+    `object-src 'none'`,
+    `base-uri 'none'`,
+    `form-action 'self'`,
+    `frame-ancestors 'none'`,
+    `upgrade-insecure-requests`,
+  ].join('; ');
+}
+/**
+ * Attach the static security headers shared by every response. HSTS is
+ * deliberately NOT set here — it is managed at the Cloudflare edge.
+ */
+function applySecurityHeaders(response: NextResponse): NextResponse {
+  response.headers.set('X-Content-Type-Options', 'nosniff');
+  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+  // Redundant with frame-ancestors 'none' but harmless for legacy browsers.
+  response.headers.set('X-Frame-Options', 'DENY');
+  return response;
+}
 export function middleware(request: NextRequest): NextResponse {
   const { pathname } = request.nextUrl;
+  const isProd = process.env.NODE_ENV === 'production';
+  // --- Per-request nonce + CSP (canonical Next.js pattern) ---
+  // base64-encoded random UUID. Minted fresh per request so 'strict-dynamic'
+  // only trusts scripts we (and Next) emit this request.
+  const nonce = Buffer.from(crypto.randomUUID()).toString('base64');
+  const cspHeader = buildCsp(nonce, isProd);
+  // Propagate the nonce + CSP on the REQUEST headers. Next reads the CSP from
+  // the request to extract the nonce and stamps it onto its own <script> tags;
+  // without this, strict-dynamic would refuse Next's scripts and break the page.
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.set('x-nonce', nonce);
+  requestHeaders.set('content-security-policy', cspHeader);
   // NOTE: This middleware only checks COOKIE PRESENCE (and a best-effort,
   // unverified exp claim) for UX-level routing — redirecting users who are
   // obviously logged out away from protected pages. It does NOT verify the
@@ -29,36 +114,38 @@ export function middleware(request: NextRequest): NextResponse {
   const isProtectedPath = protectedPaths.some((path) => pathname.startsWith(path));
   if (isProtectedPath) {
-    // No access_token AND no auth_session — truly unauthenticated
+    // No access_token AND no auth_session — truly unauthenticated.
     if (!accessToken && !authSession) {
       const loginUrl = new URL('/login', request.url);
       loginUrl.searchParams.set('from', pathname);
-      return NextResponse.redirect(loginUrl);
+      const redirect = NextResponse.redirect(loginUrl);
+      redirect.headers.set('content-security-policy', cspHeader);
+      return applySecurityHeaders(redirect);
     }
+  }
-    // No access_token BUT auth_session exists — session is alive,
-    // let through so client-side can do getMe() → 401 → refresh → retry
-    if (!accessToken && authSession) {
-      return NextResponse.next();
-    }
+  // Single .next() response carrying the propagated request headers, the CSP
+  // (also on the response, for the browser), and the static security headers.
+  const response = NextResponse.next({ request: { headers: requestHeaders } });
+  response.headers.set('content-security-policy', cspHeader);
+  applySecurityHeaders(response);
-    // Expired access_token — delete stale cookie, let through for client-side refresh
+  if (isProtectedPath) {
+    // No access_token BUT auth_session exists — session is alive, let through
+    // so client-side can do getMe() → 401 → refresh → retry.
+    // (response already passes through; nothing extra needed here.)
+    // Expired access_token — delete stale cookie, let through for client refresh.
     if (accessToken && isTokenExpired(accessToken)) {
-      const response = NextResponse.next();
       response.cookies.delete('access_token');
-      return response;
     }
-    return NextResponse.next();
   }
-  return NextResponse.next();
+  return response;
 }
 export const config = {
-  matcher: [
-    '/dashboard/:path*',
-    '/profile/:path*',
-    '/admin/:path*',
-  ],
+  // Apply security headers site-wide, but skip Next's static assets and the
+  // favicon (no CSP needed on immutable static files / images).
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
 };

package/template/server/.env.example CHANGED Viewed

@@ -129,6 +129,18 @@ REQUIRE_USER_VERIFICATION=true
 # Maximum file upload size in MB (default: 10)
 MAX_FILE_SIZE_MB=10
+# Two-tier upload storage. BOTH optional — leave unset to use the defaults
+# (<cwd>/uploads/public and <cwd>/uploads/private).
+#   PUBLIC  tier: served as static files at /uploads/ — viewable by ANYONE,
+#                 including unauthenticated users (e.g. avatars). @fastify/static
+#                 is scoped to ONLY this dir so it can never serve a private file.
+#   PRIVATE tier: lives OUTSIDE the static root; served ONLY through the
+#                 auth-gated, owner-scoped route GET /api/v1/files/:filename.
+# Both must live UNDER the Coolify uploads volume (/app/uploads/...) so files
+# survive redeploys — see COOLIFY PERSISTENT STORAGE below.
+# UPLOAD_PUBLIC_DIR=/app/uploads/public
+# UPLOAD_PRIVATE_DIR=/app/uploads/private
 # COOLIFY PERSISTENT STORAGE (required for uploads to survive redeployments):
 # Go to your service in Coolify → Storages → Add Volume Mount:
 #   Name:             uploads (or <project-name>-uploads)
@@ -243,6 +255,15 @@ LOG_LEVEL=info
 # Sentry DSN for error tracking and monitoring
 # Get your DSN from: https://sentry.io/settings/projects/
-# Leave empty to disable Sentry
+# Leave empty to disable Sentry — with no DSN, init is a no-op (fully inert).
+# COOLIFY: Runtime only. Do NOT check "Available at Buildtime".
 # Example: SENTRY_DSN="https://examplePublicKey@o0.ingest.sentry.io/0"
 # SENTRY_DSN=""
+# Fraction of transactions sampled for performance tracing (0.0–1.0, default 0.1).
+# Only takes effect when SENTRY_DSN is set.
+# SENTRY_TRACES_SAMPLE_RATE=0.1
+# Environment tag attached to Sentry events (e.g. production, staging).
+# Defaults to NODE_ENV when unset.
+# SENTRY_ENVIRONMENT=""

package/template/server/.env.example.production CHANGED Viewed

@@ -122,6 +122,15 @@ REQUIRE_USER_VERIFICATION=true
 # Maximum file upload size in MB
 MAX_FILE_SIZE_MB=10
+# Two-tier upload storage. BOTH optional — defaults are <cwd>/uploads/public and
+# <cwd>/uploads/private. Keep them UNDER /app/uploads (the Coolify volume below)
+# so files survive redeploys.
+#   PUBLIC  tier: static files at /uploads/ — viewable by ANYONE (e.g. avatars).
+#   PRIVATE tier: OUTSIDE the static root; served ONLY via the auth-gated,
+#                 owner-scoped route GET /api/v1/files/:filename.
+# UPLOAD_PUBLIC_DIR=/app/uploads/public
+# UPLOAD_PRIVATE_DIR=/app/uploads/private
 # COOLIFY PERSISTENT STORAGE (required for uploads to survive redeployments):
 # Go to your service in Coolify → Storages → Add Volume Mount:
 #   Name:             uploads (or <project-name>-uploads)
@@ -199,10 +208,16 @@ LOG_LEVEL=info
 # ERROR TRACKING
 # ===================================================================
-# Sentry for production error monitoring
+# Sentry for production error monitoring (leave unset to disable — fully inert)
 # Get your DSN from: https://sentry.io/settings/projects/
 SENTRY_DSN="https://YOUR_PUBLIC_KEY@o0.ingest.sentry.io/YOUR_PROJECT_ID"
+# Fraction of transactions sampled for performance tracing (0.0–1.0, default 0.1).
+SENTRY_TRACES_SAMPLE_RATE=0.1
+# Environment tag on Sentry events (defaults to NODE_ENV when unset).
+SENTRY_ENVIRONMENT=production
 # ===================================================================
 # PRODUCTION CHECKLIST
 # ===================================================================

package/template/server/Dockerfile CHANGED Viewed

@@ -6,7 +6,7 @@
 # ===================================================================
 # Stage 1: Dependencies (cached layer)
 # ===================================================================
-FROM node:20-alpine AS dependencies
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS dependencies
 # Install production dependencies only
 WORKDIR /app
@@ -38,7 +38,7 @@ RUN npm install --no-save --no-audit --no-fund \
 # ===================================================================
 # Stage 2: Build (compile TypeScript)
 # ===================================================================
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
 # Override NODE_ENV to ensure devDependencies are installed.
 # Coolify may inject NODE_ENV=production as a build arg, which causes npm ci
@@ -70,7 +70,7 @@ RUN npm run build
 # ===================================================================
 # Stage 3: Production Runtime
 # ===================================================================
-FROM node:20-alpine AS production
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS production
 # Install dumb-init for proper signal handling
 RUN apk add --no-cache dumb-init
@@ -96,8 +96,10 @@ COPY --from=builder --chown=nodejs:nodejs /app/package.json ./package.json
 # Copy Prisma files (needed for migrations)
 COPY --from=builder --chown=nodejs:nodejs /app/prisma ./prisma
-# Create uploads directory with correct ownership (must be before USER nodejs)
-RUN mkdir -p /app/uploads && chown nodejs:nodejs /app/uploads
+# Create BOTH upload tiers with correct ownership (must be before USER nodejs).
+# public/ is served as static files at /uploads/; private/ is served ONLY via
+# the auth-gated route GET /api/v1/files/:filename. See file-storage.service.ts.
+RUN mkdir -p /app/uploads/public /app/uploads/private && chown -R nodejs:nodejs /app/uploads
 # Switch to non-root user
 USER nodejs