exp-node-server 1.1.7 → 2.0.0

package/templates/mongoose/src/app/utils/mail_sender.ts

@@ -1,102 +1,36 @@
 import nodemailer from 'nodemailer';
-import { configs } from '../configs';
+import { configs } from '../configs/index.js';
+
 type TMailContent = {
-    to: string,
-    subject: string,
-    textBody: string,
-    htmlBody: string,
-    name?: string
-}
+  to: string;
+  subject: string;
+  textBody: string;
+  htmlBody: string;
+};
 
 const transporter = nodemailer.createTransport({
-    host: "smtp.gmail.com",
-    port: 465,
-    secure: true, // true for 465, false for other ports
-    auth: {
-        user: configs.email.app_email!,
-        pass: configs.email.app_password!,
-    },
+  host: 'smtp.gmail.com',
+  port: 465,
+  secure: true, // true for 465, false for other ports
+  auth: {
+    user: configs.email.app_email,
+    pass: configs.email.app_password,
+  },
 });
 
-// ✅ Email Sender Function
+// Email Sender Function
 const sendMail = async (payload: TMailContent) => {
-    const info = await transporter.sendMail({
-        from: 'info@digitalcreditai.com',
-        to: payload.to,
-        subject: payload.subject,
-        text: payload.textBody,
-        html: `
-        <!DOCTYPE html>
-<html lang="en">
-
-<head>
-    <meta charset="UTF-8">
-    <title>Welcome Email</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <style>
-        * {
-            margin: 0;
-            padding: 0;
-            box-sizing: border-box;
-        }
-
-        /* Fallback styles for unsupported clients (some email clients ignore <style> tags) */
-        @media only screen and (max-width: 600px) {
-            .container {
-                padding: 20px !important;
-            }
-
-            .btn {
-                padding: 12px 18px !important;
-                font-size: 16px !important;
-            }
-        }
-    </style>
-</head>
-
-<body
-    style="margin: 0; padding: 0;  font-family: Arial, sans-serif;">
-
-    <div style="max-width: 600px; margin: 40px auto; background-color: #f4f4f4; padding: 40px; border-radius: 8px; box-shadow: 0 2px 8px rgba(0,0,0,0.05);"
-        class="container">
-
-        <div style="font-size: 16px; color: #555555; line-height: 1.6;">
-            <p style="margin-bottom: 30px;">Hi <strong>${payload?.name || ""}</strong>,</p>
-
-            ${payload?.htmlBody}
-
-            <div
-                style=" margin-top: 60px; text-align: center;">
-                
-                    <img style="width: 50px; height: 50px; border-radius: 50%;"
-                        src="https://imgs.search.brave.com/IZoN38NQxnIIuB1I9E70bW6q5OvbEtz68YaxTe1j-o0/rs:fit:860:0:0:0/g:ce/aHR0cHM6Ly9lbGVt/ZW50cy1yZXNpemVk/LmVudmF0b3VzZXJj/b250ZW50LmNvbS9l/bGVtZW50cy1jb3Zl/ci1pbWFnZXMvMjhi/NmVjMTQtMGMwOS00/NGY1LWE5NGUtNmIy/OTM5NTZkMDM2P3c9/NDMzJmNmX2ZpdD1z/Y2FsZS1kb3duJnE9/ODUmZm9ybWF0PWF1/dG8mcz04Mjc0OWYy/ZDUyMmJiM2NlMjNi/OWNhNjhlZmFhNjdk/MTg5OGI4NWIwNzBh/MjQ1NjM4NmI1ZmFj/NWVmNmM5ZTNl"
-                        alt="">
-               
-                <p style="font-size: 12px;">The Support Team</p>
-                <h3>Company Name</h3>
-            </div>
-        </div>
-        <p style="font-size: 14px; color: #999999; margin-top: 20px; margin-bottom: 10px; text-align: center;">
-            This is an automated message — please do not reply to this email.
-            <br>
-            If you need assistance, feel free to contact our support team.
-            <br><br>
-            Thank you for choosing us!
-        </p>
-
-        <hr>
-        <div style="text-align: center; font-size: 12px; color: #999999; margin-top: 20px;">
-            &copy; {{year}} Your Company. All rights reserved.
-        </div>
-
-    </div>
-</body>
-
-</html>
-        
-        `,
-    });
-    return info
+  if (!configs.email.app_email || !configs.email.app_password) {
+    throw new Error('Email is not configured. Set APP_USER_EMAIL and APP_PASSWORD.');
+  }
+
+  return transporter.sendMail({
+    from: configs.email.from,
+    to: payload.to,
+    subject: payload.subject,
+    text: payload.textBody,
+    html: payload.htmlBody,
+  });
 };
 
 export default sendMail;

package/templates/mongoose/src/app/utils/manage_response.ts

@@ -1,24 +1,24 @@
-import { Response } from "express"
+import { Response } from 'express';
 interface IResponse<T> {
-    success: boolean,
-    statusCode: number,
-    message: string,
-    data?: T,
-    meta?: {
-        page?: number,
-        limit?: number,
-        skip?: number,
-        total?: number
-    }
+  success: boolean;
+  statusCode: number;
+  message: string;
+  data?: T;
+  meta?: {
+    page?: number;
+    limit?: number;
+    skip?: number;
+    total?: number;
+  };
 }
 
 const manageResponse = <T>(res: Response, payload: IResponse<T>) => {
-    res.status(payload.statusCode).json({
-        success: payload.success,
-        message: payload.message,
-        data: payload.data || undefined || null,
-        meta: payload.meta || undefined || null
-    })
-}
+  res.status(payload.statusCode).json({
+    success: payload.success,
+    message: payload.message,
+    data: payload.data ?? null,
+    meta: payload.meta ?? null,
+  });
+};
 
-export default manageResponse
+export default manageResponse;

package/templates/mongoose/src/app/utils/otp.ts

@@ -0,0 +1,20 @@
+import { createHmac, randomInt, timingSafeEqual } from 'node:crypto';
+import { configs } from '../configs/index.js';
+
+export const OTP_EXPIRY_MS = 5 * 60 * 1000;
+export const OTP_MAX_ATTEMPTS = 5;
+export const OTP_RESEND_COOLDOWN_MS = 60 * 1000;
+
+/** A cryptographically random 6-digit code. */
+export const generateOtp = (): string => randomInt(0, 1_000_000).toString().padStart(6, '0');
+
+/** OTPs are stored as an HMAC, never in plain text. */
+export const hashOtp = (otp: string): string =>
+  createHmac('sha256', configs.jwt.verified_token).update(otp).digest('hex');
+
+export const isOtpMatch = (otp: string, storedHash: string | null): boolean => {
+  if (!storedHash) return false;
+  const a = Buffer.from(hashOtp(otp), 'hex');
+  const b = Buffer.from(storedHash, 'hex');
+  return a.length === b.length && timingSafeEqual(a, b);
+};

package/templates/mongoose/src/app/utils/session.ts

@@ -0,0 +1,55 @@
+import type { CookieOptions, Request, Response } from 'express';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { configs } from '../configs/index.js';
+import { refresh_token_model } from '../modules/account/account.schema.js';
+import { clearAccessToken, issueAccessToken } from './auth_cookie.js';
+import type { TokenUser } from './JWT.js';
+
+export const REFRESH_TOKEN_COOKIE = 'refresh_token';
+
+const refreshCookieOptions: CookieOptions = {
+  httpOnly: true,
+  secure: configs.is_production,
+  sameSite: 'lax',
+  // only sent to the auth routes (refresh, sign out), never to the rest of the API
+  path: '/api/auth',
+};
+
+export const hashRefreshToken = (token: string) => createHash('sha256').update(token).digest('hex');
+
+/** The refresh token from the cookie (browsers) or the body (mobile / other clients). */
+export const readRefreshToken = (req: Request): string | undefined => {
+  const token = req.cookies?.[REFRESH_TOKEN_COOKIE] ?? req.body?.refreshToken;
+  return typeof token === 'string' && token ? token : undefined;
+};
+
+/**
+ * Signs `user` in: a new access token plus a refresh token, both set as httpOnly
+ * cookies and returned. Pass `familyId` when rotating, so the new refresh token
+ * belongs to the same session.
+ */
+export const createSession = async (
+  res: Response,
+  user: TokenUser,
+  familyId: string = randomUUID(),
+) => {
+  const refreshToken = randomBytes(32).toString('base64url');
+  const expiresAt = new Date(Date.now() + configs.jwt.refresh_expires_days * 24 * 60 * 60 * 1000);
+
+  await refresh_token_model.create({
+    _id: hashRefreshToken(refreshToken),
+    accountId: user.accountId,
+    familyId,
+    tokenVersion: user.tokenVersion,
+    expiresAt,
+  });
+
+  res.cookie(REFRESH_TOKEN_COOKIE, refreshToken, { ...refreshCookieOptions, expires: expiresAt });
+  const accessToken = issueAccessToken(res, user);
+  return { accessToken, refreshToken };
+};
+
+export const clearSessionCookies = (res: Response) => {
+  clearAccessToken(res);
+  res.clearCookie(REFRESH_TOKEN_COOKIE, refreshCookieOptions);
+};

package/templates/mongoose/src/app.ts

@@ -1,42 +1,73 @@
-import cookieParser from 'cookie-parser';
-import cors from 'cors';
-import express, { Request, Response } from 'express';
-import swaggerJSDoc from 'swagger-jsdoc';
-import swaggerUi from "swagger-ui-express";
-import globalErrorHandler from './app/middlewares/global_error_handler';
-import notFound from './app/middlewares/not_found_api';
-import appRouter from './routes';
-import { swaggerOptions } from './swaggerOptions';
-
-// define app
-const app = express()
-const swaggerSpec = swaggerJSDoc(swaggerOptions);
-app.use("/docs", swaggerUi.serve, swaggerUi.setup(swaggerSpec));
-
-// middleware
-app.use(cors({
-    origin: ["http://localhost:3000"],
-    methods: ["GET", "POST", "PATCH", "DELETE", "PUT"],
-    credentials: true
-}))
-app.use(express.json({ limit: "100mb" }))
-app.use(express.raw())
-app.use(cookieParser())
-app.use(express.urlencoded({ extended: true }));
-app.use("/api", appRouter)
-
-// stating point
-app.get('/', (req: Request, res: Response) => {
-    res.status(200).json({
-        status: 'success',
-        message: 'Server is running successful !!',
-        data: null,
-    });
-});
-
-// global error handler
-app.use(globalErrorHandler);
-app.use(notFound);
-
-// export app
-export default app;
+import cookieParser from 'cookie-parser';
+import cors from 'cors';
+import express, { type Request, type Response } from 'express';
+import helmet from 'helmet';
+import swaggerJSDoc from 'swagger-jsdoc';
+import swaggerUi from 'swagger-ui-express';
+import { configs } from './app/configs/index.js';
+import globalErrorHandler from './app/middlewares/global_error_handler.js';
+import notFound from './app/middlewares/not_found_api.js';
+import { apiRateLimiter } from './app/middlewares/rate_limiter.js';
+import { setupPassport } from './app/passport-js/index.js';
+import manageResponse from './app/utils/manage_response.js';
+import appRouter from './routes.js';
+import { swaggerOptions } from './swaggerOptions.js';
+
+// define app
+const app = express();
+
+// number of reverse proxies in front of the app (e.g. 1 behind Caddy/Nginx), so
+// req.ip and rate limiting see the real client IP. Keep 0 when exposed directly.
+app.set('trust proxy', configs.trust_proxy);
+app.disable('x-powered-by');
+
+// security headers
+app.use(helmet());
+
+// swagger docs (disabled in production unless ENABLE_SWAGGER=true)
+if (configs.enable_swagger) {
+  const swaggerSpec = swaggerJSDoc(swaggerOptions);
+  app.use(
+    '/docs',
+    helmet({ contentSecurityPolicy: false }),
+    swaggerUi.serve,
+    swaggerUi.setup(swaggerSpec),
+  );
+}
+
+// cors middleware
+app.use(
+  cors({
+    origin: configs.cors_origins,
+    methods: ['GET', 'POST', 'PATCH', 'DELETE', 'PUT'],
+    credentials: true,
+  }),
+);
+
+// express middleware
+app.use(express.json({ limit: '1mb' }));
+app.use(express.urlencoded({ extended: true, limit: '1mb' }));
+app.use(cookieParser());
+
+// passport js (social login)
+setupPassport(app);
+
+// Main router (stricter per-route limits live on the auth routes)
+app.use('/api', apiRateLimiter, appRouter);
+
+// stating point
+app.get('/', (_req: Request, res: Response) => {
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Server is running successful !!',
+    data: null,
+  });
+});
+
+// not found, then global error handler (must be last)
+app.use(notFound);
+app.use(globalErrorHandler);
+
+// export app
+export default app;

package/templates/mongoose/src/routes.ts

@@ -1,13 +1,13 @@
-import { Router } from "express";
-import authRoute from "./app/modules/auth/auth.route";
-import userRoute from "./app/modules/user/user.route";
-
-const appRouter = Router();
-
-const moduleRoutes = [
-  { path: "/auth", route: authRoute },
-  { path: "/user", route: userRoute },
-];
-
-moduleRoutes.forEach((route) => appRouter.use(route.path, route.route));
-export default appRouter;
+import { Router } from 'express';
+import accountRouter from './app/modules/account/account.route.js';
+import profileRoute from './app/modules/profile/profile.route.js';
+
+const appRouter = Router();
+
+const moduleRoutes = [
+  { path: '/profile', route: profileRoute },
+  { path: '/auth', route: accountRouter },
+];
+
+moduleRoutes.forEach((route) => appRouter.use(route.path, route.route));
+export default appRouter;

package/templates/mongoose/src/server.ts

@@ -1,18 +1,38 @@
-import mongoose from "mongoose";
-import app from "./app";
-import { configs } from "./app/configs/index";
-
-async function main() {
-  try {
-    app.listen(configs.port, async () => {
-      await mongoose.connect(configs.db_url as string);
-      console.log(`Server is running on port ${configs.port}`);
-    });
-  } catch (error) {
-    console.error("Error starting server:", error);
-  }
-}
-
-main().catch((error) => {
-  console.error("Error in main function:", error);
-});
+import type { Server } from 'node:http';
+import app from './app.js';
+import { configs } from './app/configs/index.js';
+import { connectDatabase, disconnectDatabase } from './app/lib/db.js';
+import { logger } from './app/lib/logger.js';
+import { startQueues, stopQueues } from './app/queues/index.js';
+
+let server: Server | undefined;
+
+async function main() {
+  // connect before accepting requests, so nothing hits a database that isn't there
+  await connectDatabase();
+  await startQueues();
+
+  server = app.listen(configs.port, '0.0.0.0', () => {
+    logger.info(`Server is running on port ${configs.port}`);
+  });
+}
+
+async function shutdown(signal: string) {
+  logger.info(`${signal} received, shutting down...`);
+  // stop accepting connections and let in-flight requests finish
+  await new Promise<void>((resolve) => (server ? server.close(() => resolve()) : resolve()));
+  await stopQueues().catch((err) => logger.error(err, 'Error stopping queues'));
+  await disconnectDatabase();
+  process.exit(0);
+}
+
+process.on('SIGTERM', () => void shutdown('SIGTERM'));
+process.on('SIGINT', () => void shutdown('SIGINT'));
+process.on('unhandledRejection', (reason) => {
+  logger.error(reason, 'Unhandled promise rejection');
+});
+
+main().catch((error) => {
+  logger.error(error, 'Failed to start server');
+  process.exit(1);
+});

package/templates/mongoose/src/swaggerOptions.ts

@@ -1,31 +1,36 @@
-import path from "path";
-import { configs } from "./app/configs";
-import { authSwaggerDocs } from "./app/modules/auth/auth.swagger";
-import { userSwaggerDocs } from "./app/modules/user/user.swagger";
+import { configs } from './app/configs/index.js';
+import { accountSwaggerDocs } from './app/modules/account/account.swagger.js';
+import { profileSwaggerDocs } from './app/modules/profile/profile.swagger.js';
 
 export const swaggerOptions = {
   definition: {
-    openapi: "3.0.0",
+    openapi: '3.0.0',
     info: {
-      title: "API Doc - Build with Express CLI",
-      version: "1.0.0-Mahid",
-      description: "Express API with auto-generated Swagger docs",
+      title: 'API Doc - Build with exp-node-server',
+      version: '1.0.0',
+      description: 'Express + Mongoose API with auto-generated Swagger docs',
     },
     paths: {
-      ...authSwaggerDocs,
-      ...userSwaggerDocs,
+      ...accountSwaggerDocs,
+      ...profileSwaggerDocs,
     },
     servers:
-      configs.env === "production"
-        ? [{ url: "https://live-url.com" }, { url: "http://localhost:5000" }]
-        : [{ url: "http://localhost:5000" }, { url: "https://live-url.com" }],
+      configs.env === 'production'
+        ? [
+            { url: configs.swagger_config.production_base_url },
+            { url: configs.swagger_config.development_base_url },
+          ]
+        : [
+            { url: configs.swagger_config.development_base_url },
+            { url: configs.swagger_config.production_base_url },
+          ],
     components: {
       securitySchemes: {
         AuthorizationToken: {
-          type: "apiKey",
-          in: "header",
-          name: "Authorization",
-          description: "Put your accessToken here ",
+          type: 'apiKey',
+          in: 'header',
+          name: 'Authorization',
+          description: 'Put your accessToken here ',
         },
       },
     },
@@ -35,10 +40,5 @@ export const swaggerOptions = {
       },
     ],
   },
-  apis: [
-    path.join(
-      __dirname,
-      configs.env === "production" ? "./**/*.js" : "./**/*.ts",
-    ),
-  ],
+  apis: [],
 };

package/templates/mongoose/tests/app.test.ts

@@ -0,0 +1,97 @@
+import request from 'supertest';
+import { describe, expect, it } from 'vitest';
+import app from '../src/app.js';
+import { createAccount } from './helpers/fixtures.js';
+
+describe('app', () => {
+  it('GET / responds with security headers', async () => {
+    const res = await request(app).get('/');
+
+    expect(res.status).toBe(200);
+    expect(res.headers['x-powered-by']).toBeUndefined();
+    expect(res.headers['x-content-type-options']).toBe('nosniff');
+    expect(res.headers['content-security-policy']).toBeDefined();
+  });
+
+  it('unknown routes are 404', async () => {
+    const res = await request(app).get('/api/nope');
+    expect(res.status).toBe(404);
+  });
+
+  it('malformed JSON is a 400, not a 500', async () => {
+    const res = await request(app)
+      .post('/api/auth/sign-in')
+      .set('Content-Type', 'application/json')
+      .send('{"email":');
+
+    expect(res.status).toBe(400);
+    expect(res.body.message).toBe('Invalid JSON body');
+  });
+
+  it('rejects bodies over 1mb', async () => {
+    const res = await request(app)
+      .post('/api/auth/sign-in')
+      .send({ email: 'a@b.c', password: 'x'.repeat(1_100_000) });
+
+    expect(res.status).toBe(413);
+  });
+
+  it('only allows the configured CORS origin', async () => {
+    const allowed = await request(app).get('/').set('Origin', 'http://localhost:5173');
+    const other = await request(app).get('/').set('Origin', 'https://evil.example');
+
+    expect(allowed.headers['access-control-allow-origin']).toBe('http://localhost:5173');
+    expect(other.headers['access-control-allow-origin']).toBeUndefined();
+  });
+
+  it('never sends error internals to the client', async () => {
+    const res = await request(app).get('/api/auth/me').set('Authorization', 'Bearer garbage');
+
+    expect(res.status).toBe(401);
+    expect(res.body).not.toHaveProperty('err');
+  });
+});
+
+describe('rate limiting (counters stored in MongoDB)', () => {
+  it('limits sign-in attempts per email', async () => {
+    await createAccount({ email: 'target@example.com' });
+    const attempt = (email = 'target@example.com') =>
+      request(app).post('/api/auth/sign-in').send({ email, password: 'guess-guess' });
+
+    for (let i = 0; i < 10; i++) {
+      expect((await attempt()).status).toBe(401);
+    }
+    const blocked = await attempt();
+
+    expect(blocked.status).toBe(429);
+    expect(blocked.headers['ratelimit-policy']).toBeDefined();
+
+    // another account from the same client is still allowed
+    expect((await attempt('someone-else@example.com')).status).toBe(401);
+  });
+
+  it('limits emails sent to one address, whatever the endpoint', async () => {
+    const email = 'victim@example.com';
+
+    await request(app).put('/api/auth/forget-password').send({ email }).expect(200);
+    await request(app).put('/api/auth/resend-otp').send({ email }).expect(200);
+    await request(app)
+      .put('/api/auth/forget-password')
+      .send({ email: email.toUpperCase() })
+      .expect(200);
+
+    const blocked = await request(app).put('/api/auth/forget-password').send({ email });
+    expect(blocked.status).toBe(429);
+  });
+
+  it('counts parallel requests exactly', async () => {
+    const results = await Promise.all(
+      Array.from({ length: 6 }, () =>
+        request(app).put('/api/auth/forget-password').send({ email: 'burst@example.com' }),
+      ),
+    );
+
+    const statuses = results.map((r) => r.status).sort();
+    expect(statuses).toEqual([200, 200, 200, 429, 429, 429]);
+  });
+});

package/templates/mongoose/tests/global-setup.ts

@@ -0,0 +1,15 @@
+import { MongoMemoryServer } from 'mongodb-memory-server';
+import type { TestProject } from 'vitest/node';
+
+declare module 'vitest' {
+  export interface ProvidedContext {
+    mongoUri: string;
+  }
+}
+
+/** One in-memory MongoDB for the run; every test file gets its own database. */
+export default async function setup(project: TestProject) {
+  const mongod = await MongoMemoryServer.create();
+  project.provide('mongoUri', mongod.getUri());
+  return () => mongod.stop();
+}