create-tigra 3.0.3 → 3.1.0

package/template/server/package.json

@@ -39,20 +39,20 @@
     "@fastify/jwt": "^10.1.0",
     "@fastify/multipart": "^9.0.2",
     "@fastify/rate-limit": "^10.3.0",
-    "@fastify/static": "^9.1.3",
+    "@fastify/static": "^10.1.4",
     "@prisma/client": "^6.19.3",
     "@sentry/node": "^10.62.0",
     "argon2": "^0.44.0",
-    "axios": "^1.17.0",
+    "axios": "^1.20.0",
     "dotenv": "^16.4.7",
-    "fastify": "^5.8.5",
+    "fastify": "^5.12.5",
     "fastify-type-provider-zod": "^6.1.0",
     "ioredis": "^5.9.2",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "resend": "^6.9.4",
-    "sharp": "^0.33.5",
-    "uuid": "^10.0.0",
+    "sharp": "^0.35.4",
+    "uuid": "^14.0.2",
     "zod": "^4.3.6"
   },
   "overrides": {
@@ -68,8 +68,8 @@
     "@testcontainers/redis": "^12.0.3",
     "@types/node": "^20.17.10",
     "@types/uuid": "^10.0.0",
-    "@vitest/coverage-v8": "^4.0.18",
-    "@vitest/ui": "^4.0.18",
+    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/ui": "^4.1.11",
     "eslint": "^10.0.1",
     "prisma": "^6.19.3",
     "testcontainers": "^12.0.3",
@@ -77,6 +77,6 @@
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.55.0",
-    "vitest": "^4.0.18"
+    "vitest": "^4.1.11"
   }
 }

package/template/server/src/modules/auth/__tests__/auth.service.test.ts

@@ -137,6 +137,9 @@ describe('Auth Service', () => {
 
       // Act & Assert
       await expect(authService.register(validRegisterInput)).rejects.toThrow(ConflictError);
+      await expect(authService.register(validRegisterInput)).rejects.toThrow(
+        'An account with this email was recently deleted and cannot be registered yet.',
+      );
       expect(authRepo.createUser).not.toHaveBeenCalled();
     });
   });
@@ -193,12 +196,33 @@ describe('Auth Service', () => {
     it('should throw UnauthorizedError if user not found', async () => {
       // Arrange
       vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(null);
 
       // Act & Assert
       await expect(authService.login(validLoginInput)).rejects.toThrow(UnauthorizedError);
       await expect(authService.login(validLoginInput)).rejects.toThrow('Invalid email or password');
+      expect(authRepo.findDeletedUserByEmail).not.toHaveBeenCalled();
+      expect(verifyPassword).not.toHaveBeenCalled();
+    });
+
+    it('should not restore or authenticate a soft-deleted account with correct credentials', async () => {
+      // findUserByEmail excludes soft-deleted records, so login must stop before
+      // password verification, token creation, or session creation.
+      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
+      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue({
+        ...testUsers.validUser,
+        deletedAt: new Date('2024-02-01T00:00:00Z'),
+        isActive: false,
+      });
+      vi.mocked(verifyPassword).mockResolvedValue(true);
+
+      await expect(authService.login(validLoginInput)).rejects.toThrow(UnauthorizedError);
+      await expect(authService.login(validLoginInput)).rejects.toThrow('Invalid email or password');
+      expect(authRepo.findDeletedUserByEmail).not.toHaveBeenCalled();
       expect(verifyPassword).not.toHaveBeenCalled();
+      expect(authLib.signAccessToken).not.toHaveBeenCalled();
+      expect(authLib.generateRefreshToken).not.toHaveBeenCalled();
+      expect(sessionRepository.createSession).not.toHaveBeenCalled();
+      expect(authRepo.createRefreshToken).not.toHaveBeenCalled();
     });
 
     it('should throw ForbiddenError if account is not activated', async () => {
@@ -325,46 +349,6 @@ describe('Auth Service', () => {
     });
   });
 
-  describe('login — soft-deleted account restore path (lockout)', () => {
-    const loginInput = { email: 'test@example.com', password: 'WrongPassword!' };
-    const attackerIp = '203.0.113.7';
-    const softDeletedUser = {
-      ...testUsers.validUser,
-      deletedAt: new Date('2024-02-01T00:00:00Z'),
-      isActive: false,
-    };
-
-    it('should record a failed attempt against the email+IP pair on wrong password for a soft-deleted account', async () => {
-      // Arrange
-      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(softDeletedUser);
-      vi.mocked(verifyPassword).mockResolvedValue(false);
-      mockRedis.incr.mockResolvedValue(3); // below the first lockout threshold
-
-      // Act & Assert
-      await expect(authService.login(loginInput, 'test-agent', attackerIp)).rejects.toThrow(
-        'Invalid email or password',
-      );
-      expect(mockRedis.incr).toHaveBeenCalledWith(`login-fail:test@example.com:${attackerIp}`);
-      expect(authRepo.restoreUser).not.toHaveBeenCalled();
-    });
-
-    it('should reject a locked email+IP pair on the soft-delete path before verifying the password', async () => {
-      // Arrange
-      vi.mocked(authRepo.findUserByEmail).mockResolvedValue(null);
-      vi.mocked(authRepo.findDeletedUserByEmail).mockResolvedValue(softDeletedUser);
-      mockRedis.exists.mockResolvedValue(1); // lock key present for this pair
-
-      // Act & Assert
-      await expect(authService.login(loginInput, 'test-agent', attackerIp)).rejects.toThrow(
-        'Invalid email or password',
-      );
-      expect(mockRedis.exists).toHaveBeenCalledWith(`login-lock:test@example.com:${attackerIp}`);
-      expect(verifyPassword).not.toHaveBeenCalled();
-      expect(authRepo.restoreUser).not.toHaveBeenCalled();
-    });
-  });
-
   describe('refresh', () => {
     const validRefreshToken = 'valid-refresh-token';
 

package/template/server/src/modules/auth/auth.repo.ts

@@ -13,18 +13,6 @@ export async function findDeletedUserByEmail(email: string): Promise<User | null
   });
 }
 
-export async function restoreUser(userId: string): Promise<void> {
-  await prisma.user.update({
-    where: { id: userId },
-    data: {
-      deletedAt: null,
-      isActive: true,
-      failedLoginAttempts: 0,
-      lockedUntil: null,
-    },
-  });
-}
-
 export async function findUserById(id: string): Promise<User | null> {
   return prisma.user.findUnique({
     where: { id, deletedAt: null },

package/template/server/src/modules/auth/auth.service.ts

@@ -157,11 +157,11 @@ export async function register(
     throw new ConflictError('Email already registered', 'EMAIL_ALREADY_EXISTS');
   }
 
-  // Check if a soft-deleted account exists with this email — direct them to login to restore
+  // Keep the email reserved while the soft-deleted account is retained.
   const deletedUser = await authRepo.findDeletedUserByEmail(input.email);
   if (deletedUser) {
     throw new ConflictError(
-      'An account with this email was recently deleted. Log in to restore it.',
+      'An account with this email was recently deleted and cannot be registered yet.',
       'EMAIL_ALREADY_EXISTS',
     );
   }
@@ -219,68 +219,40 @@ export async function login(
   deviceInfo?: string,
   ipAddress?: string,
 ): Promise<AuthResult> {
-  let user = await authRepo.findUserByEmail(input.email);
-
-  // If no active user found, check for a soft-deleted account that can be restored
+  const user = await authRepo.findUserByEmail(input.email);
   if (!user) {
-    const deletedUser = await authRepo.findDeletedUserByEmail(input.email);
-    if (!deletedUser) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Same email+IP lockout as the normal path — the restore flow must not be
-    // a brute-force side door around the lockout.
-    if (await isLoginLocked(input.email, ipAddress)) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Verify password before restoring — don't restore on wrong password
-    const validPassword = await verifyPassword(input.password, deletedUser.password);
-    if (!validPassword) {
-      await recordFailedLogin(input.email, ipAddress);
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
-
-    // Successful restore-login — clear the email+IP failure counter, same as
-    // the normal path.
-    await clearFailedLogins(input.email, ipAddress);
-
-    // Restore account: clears deletedAt, sets isActive = true, resets lockout
-    await authRepo.restoreUser(deletedUser.id);
-    user = { ...deletedUser, deletedAt: null, isActive: true, failedLoginAttempts: 0, lockedUntil: null };
-  } else {
-    // Normal login flow for active accounts
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // Distinct error for inactive accounts so the client can show proper messaging
-    if (!user.isActive) {
-      throw new ForbiddenError('Account is not activated. Please verify your account.', 'ACCOUNT_NOT_ACTIVE');
-    }
+  // Distinct error for inactive accounts so the client can show proper messaging
+  if (!user.isActive) {
+    throw new ForbiddenError('Account is not activated. Please verify your account.', 'ACCOUNT_NOT_ACTIVE');
+  }
 
-    // Check account lockout — scoped to this email+IP pair (Redis), so an
-    // attacker spamming bad passwords only locks out their OWN address and
-    // cannot remotely lock the real user out (lockout DoS).
-    if (await isLoginLocked(input.email, ipAddress)) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  // Check account lockout — scoped to this email+IP pair (Redis), so an
+  // attacker spamming bad passwords only locks out their OWN address and
+  // cannot remotely lock the real user out (lockout DoS).
+  if (await isLoginLocked(input.email, ipAddress)) {
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // DB-level lock (legacy data or manual admin lock) is still honored.
-    if (user.lockedUntil && user.lockedUntil > new Date()) {
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  // DB-level lock (legacy data or manual admin lock) is still honored.
+  if (user.lockedUntil && user.lockedUntil > new Date()) {
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    const valid = await verifyPassword(input.password, user.password);
+  const valid = await verifyPassword(input.password, user.password);
 
-    if (!valid) {
-      await recordFailedLogin(input.email, ipAddress);
-      throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
-    }
+  if (!valid) {
+    await recordFailedLogin(input.email, ipAddress);
+    throw new UnauthorizedError('Invalid email or password', 'INVALID_CREDENTIALS');
+  }
 
-    // Successful login — clear the email+IP failure counter and any stale
-    // DB-level lockout state from before lockout moved to Redis.
-    await clearFailedLogins(input.email, ipAddress);
-    if (user.failedLoginAttempts > 0 || user.lockedUntil) {
-      await authRepo.resetFailedAttempts(user.id);
-    }
+  // Successful login — clear the email+IP failure counter and any stale
+  // DB-level lockout state from before lockout moved to Redis.
+  await clearFailedLogins(input.email, ipAddress);
+  if (user.failedLoginAttempts > 0 || user.lockedUntil) {
+    await authRepo.resetFailedAttempts(user.id);
   }
 
   const accessToken = signAccessToken({

package/template/_claude/QUICK_REFERENCE.md

@@ -1,193 +0,0 @@
-# Quick Reference for AI Assistants
-
-**Read this first, then dive into specific rule files as needed.**
-
----
-
-If project is empty start server/client commands (`/create-server`, `/create-client`)
-
-## How Rules Are Organized
-
-Rules are scoped by directory:
-
-| Scope | Path | Applies To |
-|-------|------|------------|
-| **Global** | `.claude/rules/global/` | Entire workspace (server + client) |
-| **Server** | `.claude/rules/server/` | Backend (Fastify API server) only |
-| **Client** | `.claude/rules/client/` | Frontend (Next.js App Router) only |
-
-Always check which scope you're working in before writing code.
-
----
-
-## Global Rules (Always Apply)
-
-### Safe Editing
-- Keep changes **small and focused**
-- Preserve existing function signatures and exports unless explicitly asked
-- Extend modules, don't rewrite
-- Add `// TODO:` comments for ambiguities or follow-ups
-- Never leave half-implemented features without explanation
-- No noisy debug logs; mark temporary ones with `// TODO: remove debug log`
-- Never delete or radically restructure large parts of the codebase
-- Preserve existing behavior for critical flows (auth, payments, core business logic)
-
-See: `global/core.md`
-
----
-
-## Server Rules Summary
-
-### Architecture
-```
-Request -> Routes -> Controller -> Service -> Repository -> Database
-```
-
-- **Controllers**: Validate input (Zod), call services, return responses, throw typed errors. NO business logic, NO direct DB access.
-- **Services**: All business logic. Throw typed `AppError` instances. NO HTTP concepts (request/reply). Return data or throw.
-- **Repositories**: Database queries only.
-
-### Module Structure
-```
-src/modules/<domain>/
-  <domain>.routes.ts
-  <domain>.controller.ts
-  <domain>.service.ts
-  <domain>.repo.ts
-  <domain>.schemas.ts
-  <domain>.types.ts (optional)
-```
-
-### API Response Format (Mandatory)
-```json
-// Success
-{ "success": true, "message": "...", "data": { ... } }
-
-// Error
-{ "success": false, "error": { "code": "ERROR_CODE", "message": "..." } }
-```
-- Use `successResponse()` / `paginatedResponse()` helpers
-- Throw typed errors only (`AppError` subclasses)
-- Global error handler formats all errors
-
-### Auth Architecture
-- **httpOnly cookies** for token storage (access_token + refresh_token)
-- Account lockout with progressive thresholds
-- Session tracking with device info and IP
-- Transparent password rehash (bcrypt legacy -> argon2id)
-
-### Database
-- Schema changes via Prisma migrations only
-- Development: `prisma:reset` freely; Production: `prisma:migrate deploy` only
-- Prisma models: `PascalCase`; Fields: `camelCase`
-- All main tables need: `id`, `createdAt`, `updatedAt`
-
-### Code Style
-- TypeScript strict mode, type all params and returns
-- `async/await` over `.then()`
-- Named exports (exception: `app.ts` default-exports `buildApp`)
-- Use `logger` from `src/libs/`, never `console.log`
-- Detect package manager from lockfile
-
-See: `server/core.md`, `server/project-conventions.md`, `server/response-handling.md`, `server/database.md`
-
----
-
-## Client Rules Summary
-
-### Architecture
-- Next.js App Router with Server Components by default
-- Client Components only when interactivity is needed (`'use client'`)
-- Feature modules under `src/features/<domain>/`
-
-### Auth Flow
-- **httpOnly cookies** — no tokens stored in Redux or localStorage
-- `AuthInitializer` component hydrates user state on page load via `getMe()` API call
-- Redux auth state: `{ user, isAuthenticated, isInitializing, isLoggingOut }`
-- Axios `withCredentials: true` sends cookies automatically
-
-### Module Structure
-```
-src/features/<domain>/
-  components/
-  hooks/
-  services/
-  store/ (Redux, if needed)
-  types/
-  actions/ (Server Actions, optional)
-```
-
-### State Management
-| State Type | Tool |
-|------------|------|
-| Server data (SSR) | Server Components |
-| Server data (client) | React Query |
-| Global client state | Redux (auth only) |
-| Local state | useState / useReducer |
-| URL state | useSearchParams |
-
-### Component Rules
-- Max 250 lines per component
-- Max 5 props (use object if more)
-- Max 3 levels of JSX nesting
-- Use `cn()` for conditional classes
-- Use Next.js `Image` and `Link` components
-- Follow import order: React/Next -> third-party -> UI -> local -> hooks -> services -> types -> utils
-
-### Styling
-- Tailwind CSS v4 only, no inline styles
-- OKLCH color space via CSS custom properties
-- Use semantic color tokens (e.g., `bg-primary`, `text-foreground`)
-- Never hardcode hex/rgb values
-- Pair backgrounds with foregrounds for contrast
-
-### Forms
-- React Hook Form + Zod for complex forms
-- Server Actions for simple forms
-- Always validate client-side AND server-side
-
-### Security
-- Never inject raw HTML without sanitization (use DOMPurify)
-- Never prefix secrets with `NEXT_PUBLIC_`
-- Validate all inputs, sanitize all outputs
-- Secure external links with `rel="noopener noreferrer"`
-
-See: `client/core.md`, `client/01-project-structure.md` through `client/06-ux-checklist.md`
-
----
-
-## When Implementing Features
-
-1. **Identify scope** - Are you working in server, client, or both?
-2. **Read relevant rules** - Check the scoped rule files for that directory
-3. **Summarize** what needs to be done
-4. **List** files to create/modify
-5. **Provide** complete code for each file
-6. **Mention** migrations, env variables, or dependencies needed
-7. **State assumptions** if unsure
-
----
-
-## Full Documentation Index
-
-### Global
-- `global/core.md` - Safe editing, TypeScript, git, env, testing rules
-
-### Server
-- `server/core.md` - Index and non-negotiables
-- `server/project-conventions.md` - Stack, folder structure, coding style, Postman
-- `server/response-handling.md` - Response contract, error classes
-- `server/database.md` - Database standards, migrations, indexing
-
-### Client
-- `client/core.md` - Architecture and non-negotiables
-- `client/01-project-structure.md` - Folder structure, naming, imports, constants
-- `client/02-components-and-types.md` - Component rules, TypeScript, API types
-- `client/03-data-and-state.md` - State management, React Query, Redux, Axios, forms
-- `client/04-design-system.md` - Colors, typography, spacing, motion, dark mode
-- `client/05-security.md` - Token storage, env vars, CSP, validation
-- `client/06-ux-checklist.md` - Cognitive load, accessibility, performance
-
----
-
-**Last Updated**: 2026-02-20

package/template/_claude/README.md

@@ -1,53 +0,0 @@
-# Claude Assistant Rules
-
-This directory contains project-specific rules and guidelines for Claude.
-
-## Directory Structure
-
-```
-.claude/
-├── README.md                    # This file
-└── rules/
-    ├── global/                  # Cross-cutting rules (always active)
-    │   └── core.md              # Safe editing, TypeScript, git, env, testing
-    ├── client/                  # Next.js App Router rules
-    │   ├── core.md              # Index — which file to read for what
-    │   ├── 01-project-structure.md
-    │   ├── 02-components-and-types.md
-    │   ├── 03-data-and-state.md
-    │   ├── 04-design-system.md
-    │   ├── 05-security.md
-    │   └── 06-ux-checklist.md
-    └── server/                  # Fastify backend rules
-        ├── core.md              # Index — which file to read for what
-        ├── project-conventions.md
-        ├── response-handling.md
-        └── database.md
-```
-
-## For Claude
-
-- This directory is the source of truth for project rules.
-- **Don't read every file upfront.** Start with the relevant `core.md` index and follow it to the file you need.
-- `global/core.md` always applies. `client/` and `server/` rules apply based on which directory you're working in.
-
-## Key Principles (TL;DR)
-
-### Global
-- TypeScript strict, no `any`, Zod validation, explicit return types
-- Small focused changes, extend don't rewrite, protect critical flows
-- Conventional commits, `.env` never committed, tests for non-trivial changes
-
-### Server
-- **Stack**: Node.js, Fastify, TypeScript, MySQL, Prisma, Redis
-- **Architecture**: Routes → Controllers → Services → Repositories → DB
-- **API**: All routes prefixed with `/api/v1`
-- **Responses**: `successResponse()` / `paginatedResponse()` — no custom shapes
-- **Errors**: Only `AppError` subclasses, global error handler formats everything
-
-### Client
-- **Stack**: Next.js App Router, React Query, Redux (auth only), shadcn/ui, Tailwind
-- **Architecture**: Server Components by default, `'use client'` only when needed
-- **State**: Server data → Server Components or React Query. Redux → auth only. URL → filters/pagination
-- **Design**: Semantic color tokens only, no hardcoded colors, neuro-minimalist aesthetic
-- **Components**: Max 250 lines, max 5 props, max 3 JSX nesting levels