create-wabck 1.0.0

package/src/templates/middlewares.js

@@ -0,0 +1,294 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// Middleware Templates
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** Generate src/middlewares/error.middleware.js */
+export function errorMiddleware(options) {
+  const { language } = options;
+  const isTS = language === 'typescript';
+
+  const typeImports = isTS
+    ? `import { Request, Response, NextFunction } from 'express';\n`
+    : '';
+  const fnSig = isTS
+    ? '(err: any, _req: Request, res: Response, _next: NextFunction): void'
+    : '(err, _req, res, _next)';
+
+  return `${typeImports}import { ApiError } from '../utils/apiError.js';
+
+/**
+ * Global Error Handling Middleware
+ *
+ * Catches all errors passed to next(err) and returns a consistent JSON
+ * response. Must be the LAST middleware registered in app.js.
+ */
+export const errorMiddleware = ${fnSig} => {
+  let statusCode = err.statusCode || 500;
+  let message    = err.message    || 'Internal Server Error';
+  let errors     = err.errors     || [];
+
+  // ── Handle specific error types ──────────────────────────────────────────
+
+  // Mongoose CastError (invalid ObjectId)
+  if (err.name === 'CastError') {
+    statusCode = 400;
+    message    = \`Invalid \${err.path}: \${err.value}\`;
+  }
+
+  // Mongoose duplicate key error
+  if (err.code === 11000) {
+    statusCode = 409;
+    const field = Object.keys(err.keyValue || {})[0] || 'field';
+    message    = \`Duplicate value for \${field}\`;
+  }
+
+  // Mongoose validation error
+  if (err.name === 'ValidationError') {
+    statusCode = 422;
+    errors     = Object.values(err.errors || {}).map((e${isTS ? ': any' : ''}) => e.message);
+    message    = 'Validation failed';
+  }
+
+  // JWT errors
+  if (err.name === 'JsonWebTokenError') {
+    statusCode = 401;
+    message    = 'Invalid token';
+  }
+  if (err.name === 'TokenExpiredError') {
+    statusCode = 401;
+    message    = 'Token has expired';
+  }
+
+  // Zod validation error
+  if (err.name === 'ZodError') {
+    statusCode = 422;
+    errors     = err.errors?.map((e${isTS ? ': any' : ''}) => \`\${e.path.join('.')}: \${e.message}\`) || [];
+    message    = 'Validation failed';
+  }
+
+  res.status(statusCode).json({
+    success:    false,
+    statusCode,
+    message,
+    errors,
+    ...(process.env.NODE_ENV === 'development' && { stack: err.stack }),
+  });
+};
+`;
+}
+
+/** Generate src/middlewares/notFound.middleware.js */
+export function notFoundMiddleware(options) {
+  const { language } = options;
+  const isTS = language === 'typescript';
+  const typeImports = isTS ? `import { Request, Response } from 'express';\n` : '';
+  const fnSig = isTS ? '(req: Request, res: Response): void' : '(req, res)';
+
+  return `${typeImports}
+/**
+ * 404 Not Found Middleware
+ *
+ * Catches any request that doesn't match a registered route and returns
+ * a structured 404 response.
+ */
+export const notFoundMiddleware = ${fnSig} => {
+  res.status(404).json({
+    success:    false,
+    statusCode: 404,
+    message:    \`Route \${req.method} \${req.originalUrl} not found\`,
+  });
+};
+`;
+}
+
+/** Generate src/middlewares/rateLimiter.middleware.js */
+export function rateLimiterMiddleware(options) {
+  const { language } = options;
+  const isTS = language === 'typescript';
+
+  return `import rateLimit from 'express-rate-limit';
+
+/**
+ * Global Rate Limiter
+ *
+ * Limits repeated requests from the same IP to prevent abuse.
+ * Configured to allow 100 requests per 15-minute window.
+ */
+export const rateLimiter = rateLimit({
+  windowMs:         15 * 60 * 1000, // 15 minutes
+  max:              100,             // max requests per window per IP
+  standardHeaders:  true,           // Return rate limit info in RateLimit-* headers
+  legacyHeaders:    false,          // Disable the X-RateLimit-* headers
+  message: {
+    success:    false,
+    statusCode: 429,
+    message:    'Too many requests from this IP, please try again after 15 minutes.',
+  },
+});
+
+/**
+ * Stricter rate limiter for sensitive auth endpoints.
+ * Allows only 10 requests per 15 minutes.
+ */
+export const authRateLimiter = rateLimit({
+  windowMs:        15 * 60 * 1000,
+  max:             10,
+  standardHeaders: true,
+  legacyHeaders:   false,
+  message: {
+    success:    false,
+    statusCode: 429,
+    message:    'Too many authentication attempts, please try again after 15 minutes.',
+  },
+});
+`;
+}
+
+/** Generate src/middlewares/auth.middleware.js */
+export function authMiddleware(options) {
+  const { auth, language } = options;
+  const isTS = language === 'typescript';
+
+  const typeImports = isTS
+    ? `import { Request, Response, NextFunction } from 'express';\n`
+    : '';
+
+  if (auth === 'jwt') {
+    return `${typeImports}import jwt from 'jsonwebtoken';
+import { ApiError } from '../utils/apiError.js';
+import { asyncHandler } from '../utils/asyncHandler.js';
+
+${isTS ? `
+// Extend Express Request type to include the authenticated user
+declare global {
+  namespace Express {
+    interface Request {
+      user?: {
+        id: string;
+        email: string;
+        role: string;
+      };
+    }
+  }
+}
+` : ''}
+/**
+ * JWT Authentication Middleware
+ *
+ * Verifies the Bearer token from the Authorization header and attaches
+ * the decoded user payload to req.user for use in downstream handlers.
+ */
+export const authenticate = asyncHandler(async (req${isTS ? ': Request' : ''}, _res${isTS ? ': Response' : ''}, next${isTS ? ': NextFunction' : ''}) => {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader?.startsWith('Bearer ')) {
+    throw new ApiError(401, 'No token provided. Authorization header must be: Bearer <token>');
+  }
+
+  const token = authHeader.split(' ')[1];
+
+  const secret = process.env.JWT_SECRET;
+  if (!secret) throw new ApiError(500, 'JWT_SECRET is not configured');
+
+  const decoded = jwt.verify(token, secret)${isTS ? ' as { id: string; email: string; role: string }' : ''};
+  req.user = {
+    id:    decoded.id,
+    email: decoded.email,
+    role:  decoded.role,
+  };
+
+  next();
+});
+
+/**
+ * Role-Based Authorization Middleware Factory
+ *
+ * @param {...string} roles - Allowed roles
+ * @example
+ * router.delete('/users/:id', authenticate, authorize('admin'), deleteUser);
+ */
+export const authorize = (...roles${isTS ? ': string[]' : ''}) =>
+  asyncHandler(async (req${isTS ? ': Request' : ''}, _res${isTS ? ': Response' : ''}, next${isTS ? ': NextFunction' : ''}) => {
+    if (!req.user) {
+      throw new ApiError(401, 'Not authenticated');
+    }
+    if (!roles.includes(req.user.role)) {
+      throw new ApiError(403, \`Role '\${req.user.role}' is not allowed to access this resource\`);
+    }
+    next();
+  });
+`;
+  }
+
+  if (auth === 'clerk') {
+    return `${typeImports}import { clerkMiddleware, getAuth } from '@clerk/express';
+import { ApiError } from '../utils/apiError.js';
+import { asyncHandler } from '../utils/asyncHandler.js';
+
+/**
+ * Clerk Authentication Middleware
+ *
+ * Mount clerkMiddleware() globally in app.js, then use requireAuth
+ * on protected routes.
+ */
+export { clerkMiddleware };
+
+/**
+ * Require authentication via Clerk.
+ * Throws 401 if the request is not authenticated.
+ */
+export const requireAuth = asyncHandler(async (req${isTS ? ': Request' : ''}, _res${isTS ? ': Response' : ''}, next${isTS ? ': NextFunction' : ''}) => {
+  const { userId } = getAuth(req);
+  if (!userId) {
+    throw new ApiError(401, 'Authentication required. Please sign in.');
+  }
+  next();
+});
+`;
+  }
+
+  if (auth === 'firebase') {
+    return `${typeImports}import admin from 'firebase-admin';
+import { ApiError } from '../utils/apiError.js';
+import { asyncHandler } from '../utils/asyncHandler.js';
+
+// Initialize Firebase Admin SDK once
+if (!admin.apps.length) {
+  admin.initializeApp({
+    credential: admin.credential.cert({
+      projectId:   process.env.FIREBASE_PROJECT_ID,
+      privateKey:  process.env.FIREBASE_PRIVATE_KEY?.replace(/\\\\n/g, '\\n'),
+      clientEmail: process.env.FIREBASE_CLIENT_EMAIL,
+    }),
+  });
+}
+
+/**
+ * Firebase Authentication Middleware
+ *
+ * Verifies the Firebase ID token from the Authorization header and
+ * attaches the decoded token to req.user.
+ */
+export const authenticate = asyncHandler(async (req${isTS ? ': Request' : ''}, _res${isTS ? ': Response' : ''}, next${isTS ? ': NextFunction' : ''}) => {
+  const authHeader = req.headers.authorization;
+
+  if (!authHeader?.startsWith('Bearer ')) {
+    throw new ApiError(401, 'No Firebase token provided');
+  }
+
+  const idToken = authHeader.split(' ')[1];
+
+  const decoded = await admin.auth().verifyIdToken(idToken);
+  (req${isTS ? ' as any' : ''}).user = {
+    id:    decoded.uid,
+    email: decoded.email || '',
+    role:  (decoded.role${isTS ? ' as string' : ''}) || 'user',
+  };
+
+  next();
+});
+`;
+  }
+
+  return `// No authentication selected.\n`;
+}

package/src/templates/models.js

@@ -0,0 +1,318 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// Model Templates — user.model.js for each database
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** Generate src/models/user.model.js */
+export function userModel(options) {
+  const { database, language } = options;
+  const isTS = language === 'typescript';
+
+  switch (database) {
+    // ── MongoDB / Mongoose ──────────────────────────────────────────────────
+    case 'mongodb':
+      return `import mongoose from 'mongoose';
+import bcrypt from 'bcryptjs';
+
+${isTS ? `
+export interface IUser extends mongoose.Document {
+  name:      string;
+  email:     string;
+  password:  string;
+  role:      'user' | 'admin';
+  isActive:  boolean;
+  createdAt: Date;
+  updatedAt: Date;
+  comparePassword(candidatePassword: string): Promise<boolean>;
+}
+` : ''}
+const userSchema = new mongoose.Schema${isTS ? '<IUser>' : ''}(
+  {
+    name: {
+      type:     String,
+      required: [true, 'Name is required'],
+      trim:     true,
+      minlength: [2, 'Name must be at least 2 characters'],
+      maxlength: [50, 'Name cannot exceed 50 characters'],
+    },
+    email: {
+      type:      String,
+      required:  [true, 'Email is required'],
+      unique:    true,
+      lowercase: true,
+      trim:      true,
+      match:     [/^\\S+@\\S+\\.\\S+$/, 'Please provide a valid email'],
+    },
+    password: {
+      type:      String,
+      required:  [true, 'Password is required'],
+      minlength: [8, 'Password must be at least 8 characters'],
+      select:    false, // Never return password in queries by default
+    },
+    role: {
+      type:    String,
+      enum:    ['user', 'admin'],
+      default: 'user',
+    },
+    isActive: {
+      type:    Boolean,
+      default: true,
+    },
+  },
+  {
+    timestamps: true, // Adds createdAt and updatedAt
+    toJSON: {
+      transform(_doc, ret) {
+        delete ret.password;
+        delete ret.__v;
+        return ret;
+      },
+    },
+  }
+);
+
+// ── Pre-save hook — hash password before saving ────────────────────────────
+userSchema.pre('save', async function (next) {
+  // Only hash if the password field was modified
+  if (!this.isModified('password')) return next();
+  const salt = await bcrypt.genSalt(12);
+  this.password = await bcrypt.hash(this.password, salt);
+  next();
+});
+
+// ── Instance method — compare plain text password with hash ───────────────
+userSchema.methods.comparePassword = async function (
+  candidatePassword${isTS ? ': string' : ''}
+)${isTS ? ': Promise<boolean>' : ''} {
+  return bcrypt.compare(candidatePassword, this.password);
+};
+
+export const User = mongoose.model${isTS ? '<IUser>' : ''}('User', userSchema);
+`;
+
+    // ── PostgreSQL / Prisma ─────────────────────────────────────────────────
+    case 'postgresql':
+      // Prisma uses a schema.prisma file — this is the User service stub
+      return `/**
+ * User Model — PostgreSQL (Prisma)
+ *
+ * The actual schema is defined in prisma/schema.prisma.
+ * This file re-exports the Prisma client and provides a typed User type.
+ */
+export { prisma } from '../config/db.js';
+
+${isTS ? `
+import type { User } from '@prisma/client';
+export type { User };
+export type CreateUserInput = Pick<User, 'name' | 'email'> & { password: string };
+export type UpdateUserInput = Partial<Pick<User, 'name' | 'email' | 'role' | 'isActive'>>;
+` : ''}
+`;
+
+    // ── MySQL / mysql2 ──────────────────────────────────────────────────────
+    case 'mysql':
+      return `import { pool } from '../config/db.js';
+import bcrypt from 'bcryptjs';
+
+${isTS ? `
+export interface User {
+  id:        number;
+  name:      string;
+  email:     string;
+  password?: string;
+  role:      string;
+  is_active: boolean;
+  created_at: Date;
+  updated_at: Date;
+}
+` : ''}
+/**
+ * User Model (MySQL)
+ *
+ * Provides CRUD operations wrapping raw mysql2 queries.
+ * Creates the users table if it does not exist.
+ */
+export const UserModel = {
+  /** Ensure the users table exists */
+  async initialize()${isTS ? ': Promise<void>' : ''} {
+    await pool.query(\`
+      CREATE TABLE IF NOT EXISTS users (
+        id         INT AUTO_INCREMENT PRIMARY KEY,
+        name       VARCHAR(100)  NOT NULL,
+        email      VARCHAR(255)  NOT NULL UNIQUE,
+        password   VARCHAR(255)  NOT NULL,
+        role       ENUM('user','admin') DEFAULT 'user',
+        is_active  BOOLEAN DEFAULT TRUE,
+        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+      )
+    \`);
+  },
+
+  async findAll()${isTS ? ': Promise<User[]>' : ''} {
+    const [rows] = await pool.query(
+      'SELECT id, name, email, role, is_active, created_at, updated_at FROM users WHERE is_active = 1'
+    );
+    return rows${isTS ? ' as User[]' : ''};
+  },
+
+  async findById(id${isTS ? ': number' : ''})${isTS ? ': Promise<User | null>' : ''} {
+    const [rows] = await pool.query(
+      'SELECT id, name, email, role, is_active, created_at, updated_at FROM users WHERE id = ?',
+      [id]
+    );
+    const users = rows${isTS ? ' as User[]' : ''};
+    return users[0] || null;
+  },
+
+  async findByEmail(email${isTS ? ': string' : ''})${isTS ? ': Promise<User | null>' : ''} {
+    const [rows] = await pool.query('SELECT * FROM users WHERE email = ?', [email]);
+    const users = rows${isTS ? ' as User[]' : ''};
+    return users[0] || null;
+  },
+
+  async create(data${isTS ? ': { name: string; email: string; password: string }' : ''})${isTS ? ': Promise<User>' : ''} {
+    const hashed = await bcrypt.hash(data.password, 12);
+    const [result] = await pool.query(
+      'INSERT INTO users (name, email, password) VALUES (?, ?, ?)',
+      [data.name, data.email, hashed]
+    );
+    const insertResult = result${isTS ? ' as any' : ''};
+    return this.findById(insertResult.insertId)${isTS ? ' as Promise<User>' : ''};
+  },
+
+  async update(id${isTS ? ': number' : ''}, data${isTS ? ': Partial<User>' : ''})${isTS ? ': Promise<User | null>' : ''} {
+    const fields = Object.keys(data).map((k) => \`\${k} = ?\`).join(', ');
+    await pool.query(\`UPDATE users SET \${fields} WHERE id = ?\`, [...Object.values(data), id]);
+    return this.findById(id);
+  },
+
+  async delete(id${isTS ? ': number' : ''})${isTS ? ': Promise<void>' : ''} {
+    await pool.query('DELETE FROM users WHERE id = ?', [id]);
+  },
+
+  async comparePassword(plain${isTS ? ': string' : ''}, hashed${isTS ? ': string' : ''})${isTS ? ': Promise<boolean>' : ''} {
+    return bcrypt.compare(plain, hashed);
+  },
+};
+`;
+
+    // ── SQLite / better-sqlite3 ─────────────────────────────────────────────
+    case 'sqlite':
+      return `import { db } from '../config/db.js';
+import bcrypt from 'bcryptjs';
+
+${isTS ? `
+export interface User {
+  id:         number;
+  name:       string;
+  email:      string;
+  password?:  string;
+  role:       string;
+  is_active:  number; // SQLite uses 0/1 for booleans
+  created_at: string;
+  updated_at: string;
+}
+` : ''}
+/**
+ * User Model (SQLite)
+ *
+ * better-sqlite3 is fully synchronous — no async/await for queries.
+ * Initialize() should be called once at startup.
+ */
+export const UserModel = {
+  initialize()${isTS ? ': void' : ''} {
+    db.exec(\`
+      CREATE TABLE IF NOT EXISTS users (
+        id         INTEGER PRIMARY KEY AUTOINCREMENT,
+        name       TEXT NOT NULL,
+        email      TEXT NOT NULL UNIQUE,
+        password   TEXT NOT NULL,
+        role       TEXT DEFAULT 'user',
+        is_active  INTEGER DEFAULT 1,
+        created_at TEXT DEFAULT (datetime('now')),
+        updated_at TEXT DEFAULT (datetime('now'))
+      )
+    \`);
+  },
+
+  findAll()${isTS ? ': User[]' : ''} {
+    return db.prepare(
+      'SELECT id, name, email, role, is_active, created_at, updated_at FROM users WHERE is_active = 1'
+    ).all()${isTS ? ' as User[]' : ''};
+  },
+
+  findById(id${isTS ? ': number' : ''})${isTS ? ': User | undefined' : ''} {
+    return db.prepare(
+      'SELECT id, name, email, role, is_active, created_at, updated_at FROM users WHERE id = ?'
+    ).get(id)${isTS ? ' as User | undefined' : ''};
+  },
+
+  findByEmail(email${isTS ? ': string' : ''})${isTS ? ': User | undefined' : ''} {
+    return db.prepare('SELECT * FROM users WHERE email = ?').get(email)${isTS ? ' as User | undefined' : ''};
+  },
+
+  async create(data${isTS ? ': { name: string; email: string; password: string }' : ''}) {
+    const hashed = await bcrypt.hash(data.password, 12);
+    const stmt = db.prepare('INSERT INTO users (name, email, password) VALUES (?, ?, ?)');
+    const info = stmt.run(data.name, data.email, hashed);
+    return this.findById(info.lastInsertRowid${isTS ? ' as number' : ''});
+  },
+
+  update(id${isTS ? ': number' : ''}, data${isTS ? ': Partial<User>' : ''}) {
+    const fields = Object.keys(data).map((k) => \`\${k} = ?\`).join(', ');
+    db.prepare(\`UPDATE users SET \${fields}, updated_at = datetime('now') WHERE id = ?\`).run(
+      ...Object.values(data), id
+    );
+    return this.findById(id);
+  },
+
+  delete(id${isTS ? ': number' : ''})${isTS ? ': void' : ''} {
+    db.prepare('DELETE FROM users WHERE id = ?').run(id);
+  },
+
+  async comparePassword(plain${isTS ? ': string' : ''}, hashed${isTS ? ': string' : ''})${isTS ? ': Promise<boolean>' : ''} {
+    return bcrypt.compare(plain, hashed);
+  },
+};
+`;
+
+    default:
+      return `// No database selected — no user model generated.\n`;
+  }
+}
+
+/** Generate prisma/schema.prisma */
+export function prismaSchema(options) {
+  const { projectName } = options;
+  return `// Prisma Schema for ${projectName}
+// Run: npx prisma migrate dev --name init
+
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+model User {
+  id        String   @id @default(cuid())
+  name      String
+  email     String   @unique
+  password  String
+  role      Role     @default(USER)
+  isActive  Boolean  @default(true)
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  @@index([email])
+  @@map("users")
+}
+
+enum Role {
+  USER
+  ADMIN
+}
+`;
+}