create-warlock 5.29.0 → 5.31.0

package/templates/warlock/skills/testing-strategy/SKILL.md

@@ -170,6 +170,23 @@ vi.advanceTimersByTime(1000);
 
 A test that sleeps is a test that's slow and flaky. Stub the clock.
 
+Code that reads time through `clock.now()` / `clock.timestamp()` from `@warlock.js/core` gets a frozen clock in tests already (`clockFake.travel(ms)` moves it), with no fake timers involved.
+
+### 4.5 Mail, queue, cache, storage — fakes are already on
+
+In the test environment `setupTest()` installs fakes for mail, queue, cache, storage, clock and ids. Assert on them instead of mocking the drivers:
+
+```typescript
+import { mailFake, queueFake } from "@warlock.js/core/tests";
+
+const order = { id: 42 }; // what the code under test placed
+
+mailFake.assertSent({ to: "ada@example.test" });
+queueFake.assertPushed("invoices.send", { orderId: order.id });
+```
+
+Fixtures come from `defineFactory()` (deterministic, no faker). Opt out of a fake in `src/config/tests.ts` (`fakes: { cache: false }`). `warlock test --changed` runs only the tests a change affects. See the `test-fakes` and `model-factories` skills of `@warlock.js/core`.
+
 ---
 
 ## 5. AAA structure

package/templates/warlock/src/app/auth/routes.ts

@@ -1,3 +1,8 @@
+import {
+  loginThrottleMiddleware,
+  tokenConsumeThrottleMiddleware,
+  tokenIssueThrottleMiddleware,
+} from "@warlock.js/auth";
 import { router } from "@warlock.js/core";
 import { guarded } from "app/shared/utils/router";
 import { forgotPasswordController } from "./controllers/forgot-password.controller";
@@ -8,12 +13,27 @@ import { meController } from "./controllers/me.controller";
 import { refreshTokenController } from "./controllers/refresh-token.controller";
 import { resetPasswordController } from "./controllers/reset-password.controller";
 
-// Auth routes
+// Auth routes. Sign-in and password recovery are open by design (`public: true`)
+// and throttled; the rest need a signed-in user.
 router.prefix("/auth", () => {
-  router.post("/login", loginController);
-  router.post("/refresh-token", refreshTokenController);
-  router.post("/forgot-password", forgotPasswordController);
-  router.post("/reset-password", resetPasswordController);
+  // Failed sign-ins lock the account and the IP after 5 tries in 15 minutes.
+  router.post("/login", loginController, {
+    public: true,
+    middleware: [loginThrottleMiddleware()],
+  });
+  router.post("/refresh-token", refreshTokenController, {
+    public: true,
+    rateLimit: { max: 30, timeWindow: 60_000 },
+  });
+  // Reset mails: 3 per hour per email and per IP. Reset attempts: 10 failures per 15 minutes.
+  router.post("/forgot-password", forgotPasswordController, {
+    public: true,
+    middleware: [tokenIssueThrottleMiddleware()],
+  });
+  router.post("/reset-password", resetPasswordController, {
+    public: true,
+    middleware: [tokenConsumeThrottleMiddleware()],
+  });
   guarded(() => {
     router.post("/logout", logoutController);
     router.post("/logout-all", logoutAllController);

package/templates/warlock/src/app/auth/utils/types.ts

@@ -7,4 +7,9 @@ export type OTPChannel = "email" | "sms" | "whatsapp" | "push";
  * Common OTP types
  */
 export type OTPType =
-  "password-reset" | "email-verification" | "phone-verification" | "two-factor" | string;
+  | "password-reset"
+  | "email-verification"
+  | "phone-verification"
+  | "two-factor"
+  // Applications may also define their own OTP purposes.
+  | string;

package/templates/warlock/src/app/contact/routes.ts

@@ -1,4 +1,4 @@
 import { router } from "@warlock.js/core";
 import { contactController } from "./controllers/contact.controller";
 
-router.post("/api/contact", contactController);
+router.post("/api/contact", contactController, { public: true });

package/templates/warlock/src/app/locale/routes.ts

@@ -1,4 +1,4 @@
 import { router } from "@warlock.js/core";
 import { localeController } from "./controllers/locale.controller";
 
-router.post("/api/locale", localeController);
+router.post("/api/locale", localeController, { public: true });

package/templates/warlock/src/app/users/controllers/list-users.controller.ts

@@ -1,8 +1,12 @@
 import { type GuardedRequestHandler } from "app/auth/requests/guarded.request";
 import { usersRepository } from "../repositories/users.repository";
+import { type ListUsersSchema, listUsersSchema } from "../schema/list-users.schema";
 
-export const listUsersController: GuardedRequestHandler = async ({ request, response }) => {
-  const users = await usersRepository.listCached(request.all());
+export const listUsersController: GuardedRequestHandler<ListUsersSchema> = async ({
+  request,
+  response,
+}) => {
+  const users = await usersRepository.listCached(request.validated());
 
   return response.success({
     users,
@@ -10,3 +14,7 @@ export const listUsersController: GuardedRequestHandler = async ({ request, resp
 };
 
 listUsersController.description = "List Users Controller";
+
+listUsersController.validation = {
+  schema: listUsersSchema,
+};

package/templates/warlock/src/app/users/schema/list-users.schema.ts

@@ -0,0 +1,15 @@
+import { type Infer, v } from "@warlock.js/seal";
+
+/**
+ * Query parameters the user list accepts. Unknown keys are stripped, so a
+ * smuggled operator (`?email[$ne]=`) never reaches the repository filters.
+ */
+export const listUsersSchema = v.object({
+  id: v.string().optional(),
+  name: v.string().max(100).optional(),
+  email: v.string().max(255).optional(),
+  page: v.numeric().min(1).optional(),
+  limit: v.numeric().min(1).max(100).optional(),
+});
+
+export type ListUsersSchema = Infer<typeof listUsersSchema>;

package/templates/warlock/src/config/tests.ts

@@ -1,5 +1,13 @@
 const testsConfigurations = {
+  // In tests, mail, queue, cache, storage, clock and ids are faked by default:
+  // nothing is delivered, pushed to Redis or uploaded, and assertions such as
+  // mailFake.assertSent(...) work (see @warlock.js/core/tests).
   //
+  // Opt out of every fake, keeping the real drivers:
+  // fakes: false,
+  //
+  // ...or of one, e.g. keep the configured cache driver:
+  // fakes: { cache: false },
 };
 
 export default testsConfigurations;

package/templates/warlock/src/web/404.css

@@ -14,12 +14,8 @@
   padding-inline: clamp(1.5rem, 7vw, 8rem);
   background: #fafafa;
   color: #18181b;
-  font-family:
-    system-ui,
-    -apple-system,
-    BlinkMacSystemFont,
-    "Segoe UI",
-    sans-serif;
+  /* prettier-ignore */
+  font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
 }
 
 .not-found__content {

package/templates/warlock/src/web/root.tsx

@@ -15,6 +15,11 @@ export default function App({ children }: AppProps) {
   return (
     <html lang={locale} dir={direction}>
       <head>
+        {/*
+          <Head /> also renders the viewport tag (width=device-width,
+          initial-scale=1). Change it with `metadata.viewport`,
+          or set it to false to leave it out; do not add a second one here.
+        */}
         {/*
           Placement only. The framework injects the page's `metadata`, the
           stylesheet and preload tags for this route, and the canonical links