create-tigra 3.0.3 → 3.0.5

package/README.md

@@ -82,6 +82,10 @@ cd my-app/server
 docker compose --profile tools up -d
 ```
 
+## Security and Migration Notes
+
+- [Account deactivation login reactivation: issue, fix, and existing-project migration](docs/account-deactivation-login-reactivation.md)
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-tigra",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "type": "module",
   "description": "Create a production-ready full-stack app with Next.js 16 + Fastify 5 + Prisma + Redis",
   "bin": {

package/template/client/Dockerfile

@@ -1,8 +1,13 @@
+# syntax=docker/dockerfile:1
 # ===================================================================
 # Multi-stage Dockerfile for Next.js Production Deployment
 # Optimized for Coolify, Docker Compose, and Kubernetes
 # Requires `output: "standalone"` in next.config.ts
 # ===================================================================
+# BuildKit cache mount (--mount=type=cache) keeps the npm download cache warm
+# across builds, so a lockfile/dep-change rebuild re-installs from cache
+# (measured ~2.8x: 49s->18s on a real create-tigra client) instead of
+# re-downloading every tarball. Requires the `# syntax` line above (BuildKit).
 
 # ===================================================================
 # Stage 1: Dependencies (cached layer)
@@ -15,7 +20,8 @@ WORKDIR /app
 COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* ./
 
 # Install dependencies (use the lockfile that exists)
-RUN if [ -f pnpm-lock.yaml ]; then \
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f pnpm-lock.yaml ]; then \
       npm install -g pnpm && pnpm install --frozen-lockfile; \
     elif [ -f yarn.lock ]; then \
       yarn install --frozen-lockfile; \
@@ -49,6 +55,10 @@ ENV NEXT_PUBLIC_APP_NAME=$NEXT_PUBLIC_APP_NAME
 ENV NEXT_TELEMETRY_DISABLED=1
 
 # Build the application (outputs to .next/standalone)
+# NOTE: a `--mount=type=cache,target=/app/.next/cache` was tested here and REMOVED —
+# it measured SLOWER (next build 29s→58s on a real create-tigra client), because Next's
+# persistent-cache serialization overhead exceeds the incremental savings for small/mid
+# apps. Re-add it only for a genuinely large client after measuring a win.
 RUN npm run build
 
 # ===================================================================

package/template/client/package.json

@@ -3,7 +3,7 @@
   "version": "0.1.0",
   "private": true,
   "scripts": {
-    "dev": "next dev",
+    "dev": "node ./scripts/next-dev.cjs",
     "build": "next build",
     "start": "next start",
     "lint": "eslint src/",

package/template/client/scripts/next-dev.cjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+"use strict";
+
+const { spawn } = require("node:child_process");
+
+const DEFAULT_MAX_OLD_SPACE_SIZE = "768";
+const nextBin = require.resolve("next/dist/bin/next");
+
+function applyOldSpaceLimit(nodeOptions, sizeMb) {
+  if (/(^|\s)--max[-_]old[-_]space[-_]size(=|\s|$)/.test(nodeOptions)) {
+    return nodeOptions;
+  }
+
+  return [nodeOptions, `--max-old-space-size=${sizeMb}`].filter(Boolean).join(" ").trim();
+}
+
+const env = { ...process.env };
+env.NEXT_DISABLE_MEM_OVERRIDE = "1";
+env.NODE_OPTIONS = applyOldSpaceLimit(
+  env.NODE_OPTIONS || "",
+  env.NEXT_DEV_MAX_OLD_SPACE_SIZE || DEFAULT_MAX_OLD_SPACE_SIZE,
+);
+
+const args = [
+  nextBin,
+  "dev",
+  "--webpack",
+  "--disable-source-maps",
+  "--no-server-fast-refresh",
+  ...process.argv.slice(2),
+];
+
+const child = spawn(process.execPath, args, { stdio: "inherit", env });
+
+child.on("error", (error) => {
+  console.error(error);
+  process.exit(1);
+});
+
+child.on("exit", (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+
+  process.exit(code ?? 0);
+});

package/template/client/src/instrumentation-client.ts

@@ -1,30 +1,38 @@
 /**
- * Browser (client) instrumentation — env-gated Sentry, INERT by default.
+ * Browser instrumentation.
  *
- * Next.js 15.3+/16 loads this module in the browser before the app hydrates.
- * We init Sentry ONLY when the public DSN is set, so with no DSN this file is a
- * no-op and ships nothing that phones home.
- *
- * `process.env.NEXT_PUBLIC_*` is inlined at build time by Next — reference it
- * literally (not via a computed key) so the value is statically replaced.
- *
- * Like the server side, this stays runtime + env-gated: we do NOT wrap
- * next.config.ts with `withSentryConfig` (that would couple `next build` to a
- * source-map upload auth token). withSentryConfig is the opt-in upgrade.
+ * Keep local dev cold: do not import @sentry/nextjs unless production has a
+ * public DSN. This avoids compiling the Sentry SDK for every local dev server.
  */
-import * as Sentry from '@sentry/nextjs';
+type SentryNext = typeof import('@sentry/nextjs');
+type RouterTransitionStart = SentryNext['captureRouterTransitionStart'];
 
 const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN;
+const sentryEnabled = process.env.NODE_ENV === 'production' && Boolean(dsn);
+
+let sentryPromise: Promise<SentryNext> | null = null;
+
+function loadSentry(): Promise<SentryNext | null> {
+  if (!sentryEnabled || !dsn) return Promise.resolve(null);
 
-if (dsn) {
-  Sentry.init({
-    dsn,
-    tracesSampleRate: process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
-      ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
-      : 0.1,
+  sentryPromise ??= import('@sentry/nextjs').then((Sentry) => {
+    Sentry.init({
+      dsn,
+      tracesSampleRate: process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
+        ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
+        : 0.1,
+    });
+
+    return Sentry;
   });
+
+  return sentryPromise;
 }
 
-// Instruments App Router navigations for tracing. Harmless when Sentry is
-// uninitialized (no DSN).
-export const onRouterTransitionStart = Sentry.captureRouterTransitionStart;
+void loadSentry();
+
+export const onRouterTransitionStart = ((...args: Parameters<RouterTransitionStart>) => {
+  void loadSentry().then((Sentry) => {
+    Sentry?.captureRouterTransitionStart(...args);
+  });
+}) as RouterTransitionStart;

package/template/client/src/instrumentation.ts

@@ -1,28 +1,30 @@
 /**
- * Server/Edge runtime instrumentation — env-gated Sentry, INERT by default.
+ * Server/Edge runtime instrumentation.
  *
- * Next.js calls `register()` once per server runtime at startup. We init Sentry
- * ONLY when a DSN is present (a server `SENTRY_DSN`, or the public DSN shared
- * with the browser), so with no DSN this is a clean no-op and `next build`
- * succeeds with zero Sentry credentials.
- *
- * NOTE: we deliberately do NOT wrap next.config.ts with `withSentryConfig`.
- * That adds build-time source-map upload which requires a SENTRY_AUTH_TOKEN and
- * would couple `next build` to credentials. Source-map upload is the opt-in
- * upgrade — add `withSentryConfig` + an auth token when you want it. This setup
- * stays purely runtime + env-gated.
+ * Keep local dev cold: importing @sentry/nextjs at module top-level makes Next
+ * compile the Sentry SDK before the first page, even with no DSN.
  */
-import * as Sentry from '@sentry/nextjs';
+type SentryNext = typeof import('@sentry/nextjs');
+type RequestErrorHandler = SentryNext['captureRequestError'];
 
 const dsn = process.env.NEXT_PUBLIC_SENTRY_DSN ?? process.env.SENTRY_DSN;
+const sentryEnabled = process.env.NODE_ENV === 'production' && Boolean(dsn);
 
 const tracesSampleRate = process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE
   ? Number(process.env.NEXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE)
   : 0.1;
 
+let sentryPromise: Promise<SentryNext> | null = null;
+
+function loadSentry(): Promise<SentryNext | null> {
+  if (!sentryEnabled) return Promise.resolve(null);
+  sentryPromise ??= import('@sentry/nextjs');
+  return sentryPromise;
+}
+
 export async function register(): Promise<void> {
-  // No DSN → stay inert.
-  if (!dsn) return;
+  const Sentry = await loadSentry();
+  if (!Sentry || !dsn) return;
 
   if (process.env.NEXT_RUNTIME === 'nodejs' || process.env.NEXT_RUNTIME === 'edge') {
     Sentry.init({
@@ -33,6 +35,8 @@ export async function register(): Promise<void> {
   }
 }
 
-// Capture errors from Server Components, route handlers, and middleware.
-// Safe no-op when Sentry was never initialized (no DSN).
-export const onRequestError = Sentry.captureRequestError;
+export const onRequestError = (async (...args: Parameters<RequestErrorHandler>) => {
+  const Sentry = await loadSentry();
+  if (!Sentry) return;
+  return Sentry.captureRequestError(...args);
+}) as RequestErrorHandler;

package/template/server/Dockerfile

@@ -1,7 +1,11 @@
+# syntax=docker/dockerfile:1
 # ===================================================================
 # Multi-stage Dockerfile for Production Deployment
 # Optimized for Coolify, Docker Compose, and Kubernetes
 # ===================================================================
+# BuildKit cache mounts (--mount=type=cache) keep the npm download cache warm
+# ACROSS builds, so a lockfile-change rebuild re-installs without re-downloading.
+# Requires the `# syntax` line above; auto-enabled on Docker 23+ / any BuildKit.
 
 # ===================================================================
 # Stage 1: Dependencies (cached layer)
@@ -15,7 +19,8 @@ WORKDIR /app
 COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* ./
 
 # Install dependencies (use the lockfile that exists)
-RUN if [ -f pnpm-lock.yaml ]; then \
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f pnpm-lock.yaml ]; then \
       npm install -g pnpm && pnpm install --prod --frozen-lockfile; \
     elif [ -f yarn.lock ]; then \
       yarn install --production --frozen-lockfile; \
@@ -32,7 +37,7 @@ RUN if [ -f pnpm-lock.yaml ]; then \
 # --no-save keeps package.json and the lockfile untouched. Because this stage
 # runs on the same Alpine (musl) base as the runtime stage, the engine binaries
 # downloaded here are the correct ones for production.
-RUN npm install --no-save --no-audit --no-fund \
+RUN --mount=type=cache,target=/root/.npm npm install --no-save --no-audit --no-fund \
       "prisma@$(node -p "require('@prisma/client/package.json').version")"
 
 # ===================================================================
@@ -50,7 +55,8 @@ WORKDIR /app
 # Copy package files and install ALL dependencies (including dev)
 COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* ./
 
-RUN if [ -f pnpm-lock.yaml ]; then \
+RUN --mount=type=cache,target=/root/.npm \
+    if [ -f pnpm-lock.yaml ]; then \
       npm install -g pnpm && pnpm install --frozen-lockfile; \
     elif [ -f yarn.lock ]; then \
       yarn install --frozen-lockfile; \

package/template/server/src/modules/auth/__tests__/auth.service.test.ts

@@ -137,6 +137,9 @@ describe('Auth Service', () => {
 
       // Act & Assert
       await expect(authService.register(validRegisterInput)).rejects.toThrow(ConflictError);
+      await expect(authService.register(validRegisterInput)).rejects.toThrow(
+        'An account with this email was recently deleted and cannot be registered yet.',
+      );
       expect(authRepo.createUser).not.toHaveBeenCalled();
     });
   });
@@ -193,12 +196,33 @@ describe('Auth Service', () => {
     it('should throw UnauthorizedError if user not found', async () => {
       // Arrange
       vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(null);
 
       // Act & Assert
       await expect(authService.login(validLoginInput)).rejects.toThrow(UnauthorizedError);
       await expect(authService.login(validLoginInput)).rejects.toThrow('Invalid email or password');
+      expect(authRepo.findDeletedUserByEmail).not.toHaveBeenCalled();
+      expect(verifyPassword).not.toHaveBeenCalled();
+    });
+
+    it('should not restore or authenticate a soft-deleted account with correct credentials', async () => {
+      // findUserByEmail excludes soft-deleted records, so login must stop before
+      // password verification, token creation, or session creation.
+      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
+      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue({
+        ...testUsers.validUser,
+        deletedAt: new Date('2024-02-01T00:00:00Z'),
+        isActive: false,
+      });
+      vi.mocked(verifyPassword).mockResolvedValue(true);
+
+      await expect(authService.login(validLoginInput)).rejects.toThrow(UnauthorizedError);
+      await expect(authService.login(validLoginInput)).rejects.toThrow('Invalid email or password');
+      expect(authRepo.findDeletedUserByEmail).not.toHaveBeenCalled();
       expect(verifyPassword).not.toHaveBeenCalled();
+      expect(authLib.signAccessToken).not.toHaveBeenCalled();
+      expect(authLib.generateRefreshToken).not.toHaveBeenCalled();
+      expect(sessionRepository.createSession).not.toHaveBeenCalled();
+      expect(authRepo.createRefreshToken).not.toHaveBeenCalled();
     });
 
     it('should throw ForbiddenError if account is not activated', async () => {
@@ -325,46 +349,6 @@ describe('Auth Service', () => {
     });
   });
 
-  describe('login — soft-deleted account restore path (lockout)', () => {
-    const loginInput = { email: 'test@example.com', password: 'WrongPassword!' };
-    const attackerIp = '203.0.113.7';
-    const softDeletedUser = {
-      ...testUsers.validUser,
-      deletedAt: new Date('2024-02-01T00:00:00Z'),
-      isActive: false,
-    };
-
-    it('should record a failed attempt against the email+IP pair on wrong password for a soft-deleted account', async () => {
-      // Arrange
-      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(softDeletedUser);
-      vi.mocked(verifyPassword).mockResolvedValue(false);
-      mockRedis.incr.mockResolvedValue(3); // below the first lockout threshold
-
-      // Act & Assert
-      await expect(authService.login(loginInput, 'test-agent', attackerIp)).rejects.toThrow(
-        'Invalid email or password',
-      );
-      expect(mockRedis.incr).toHaveBeenCalledWith(`login-fail:test@example.com:${attackerIp}`);
-      expect(authRepo.restoreUser).not.toHaveBeenCalled();
-    });
-
-    it('should reject a locked email+IP pair on the soft-delete path before verifying the password', async () => {
-      // Arrange
-      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(softDeletedUser);
-      mockRedis.exists.mockResolvedValue(1); // lock key present for this pair
-
-      // Act & Assert
-      await expect(authService.login(loginInput, 'test-agent', attackerIp)).rejects.toThrow(
-        'Invalid email or password',
-      );
-      expect(mockRedis.exists).toHaveBeenCalledWith(`login-lock:test@example.com:${attackerIp}`);
-      expect(verifyPassword).not.toHaveBeenCalled();
-      expect(authRepo.restoreUser).not.toHaveBeenCalled();
-    });
-  });
-
   describe('refresh', () => {
     const validRefreshToken = 'valid-refresh-token';
 

package/template/server/src/modules/auth/auth.repo.ts

@@ -13,18 +13,6 @@ export async function findDeletedUserByEmail(email: string): Promise<User | null
   });
 }
 
-export async function restoreUser(userId: string): Promise<void> {
-  await prisma.user.update({
-    where: { id: userId },
-    data: {
-      deletedAt: null,
-      isActive: true,
-      failedLoginAttempts: 0,
-      lockedUntil: null,
-    },
-  });
-}
-
 export async function findUserById(id: string): Promise<User | null> {
   return prisma.user.findUnique({
     where: { id, deletedAt: null },

package/template/server/src/modules/auth/auth.service.ts

@@ -157,11 +157,11 @@ export async function register(
     throw new ConflictError('Email already registered', 'EMAIL_ALREADY_EXISTS');
   }
 
-  // Check if a soft-deleted account exists with this email — direct them to login to restore
+  // Keep the email reserved while the soft-deleted account is retained.
   const deletedUser = await authRepo.findDeletedUserByEmail(input.email);
   if (deletedUser) {
     throw new ConflictError(
-      'An account with this email was recently deleted. Log in to restore it.',
+      'An account with this email was recently deleted and cannot be registered yet.',
       'EMAIL_ALREADY_EXISTS',
     );
   }
@@ -219,68 +219,40 @@ export async function login(
   deviceInfo?: string,
   ipAddress?: string,
 ): Promise<AuthResult> {
-  let user = await authRepo.findUserByEmail(input.email);
-
-  // If no active user found, check for a soft-deleted account that can be restored
+  const user = await authRepo.findUserByEmail(input.email);
   if (!user) {
-    const deletedUser = await authRepo.findDeletedUserByEmail(input.email);
-    if (!deletedUser) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Same email+IP lockout as the normal path — the restore flow must not be
-    // a brute-force side door around the lockout.
-    if (await isLoginLocked(input.email, ipAddress)) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Verify password before restoring — don't restore on wrong password
-    const validPassword = await verifyPassword(input.password, deletedUser.password);
-    if (!validPassword) {
-      await recordFailedLogin(input.email, ipAddress);
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Successful restore-login — clear the email+IP failure counter, same as
-    // the normal path.
-    await clearFailedLogins(input.email, ipAddress);
-
-    // Restore account: clears deletedAt, sets isActive = true, resets lockout
-    await authRepo.restoreUser(deletedUser.id);
-    user = { ...deletedUser, deletedAt: null, isActive: true, failedLoginAttempts: 0, lockedUntil: null };
-  } else {
-    // Normal login flow for active accounts
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // Distinct error for inactive accounts so the client can show proper messaging
-    if (!user.isActive) {
-      throw new ForbiddenError('Account is not activated. Please verify your account.', 'ACCOUNT_NOT_ACTIVE');
-    }
+  // Distinct error for inactive accounts so the client can show proper messaging
+  if (!user.isActive) {
+    throw new ForbiddenError('Account is not activated. Please verify your account.', 'ACCOUNT_NOT_ACTIVE');
+  }
 
-    // Check account lockout — scoped to this email+IP pair (Redis), so an
-    // attacker spamming bad passwords only locks out their OWN address and
-    // cannot remotely lock the real user out (lockout DoS).
-    if (await isLoginLocked(input.email, ipAddress)) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  // Check account lockout — scoped to this email+IP pair (Redis), so an
+  // attacker spamming bad passwords only locks out their OWN address and
+  // cannot remotely lock the real user out (lockout DoS).
+  if (await isLoginLocked(input.email, ipAddress)) {
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // DB-level lock (legacy data or manual admin lock) is still honored.
-    if (user.lockedUntil && user.lockedUntil > new Date()) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  // DB-level lock (legacy data or manual admin lock) is still honored.
+  if (user.lockedUntil && user.lockedUntil > new Date()) {
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    const valid = await verifyPassword(input.password, user.password);
+  const valid = await verifyPassword(input.password, user.password);
 
-    if (!valid) {
-      await recordFailedLogin(input.email, ipAddress);
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  if (!valid) {
+    await recordFailedLogin(input.email, ipAddress);
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // Successful login — clear the email+IP failure counter and any stale
-    // DB-level lockout state from before lockout moved to Redis.
-    await clearFailedLogins(input.email, ipAddress);
-    if (user.failedLoginAttempts > 0 || user.lockedUntil) {
-      await authRepo.resetFailedAttempts(user.id);
-    }
+  // Successful login — clear the email+IP failure counter and any stale
+  // DB-level lockout state from before lockout moved to Redis.
+  await clearFailedLogins(input.email, ipAddress);
+  if (user.failedLoginAttempts > 0 || user.lockedUntil) {
+    await authRepo.resetFailedAttempts(user.id);
   }
 
   const accessToken = signAccessToken({