exp-node-server 1.1.7 → 2.0.0

package/templates/mongoose/tests/routes/profile.test.ts

@@ -0,0 +1,95 @@
+import request from 'supertest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import app from '../../src/app.js';
+import { profile_model } from '../../src/app/modules/profile/profile.schema.js';
+import uploadCloud from '../../src/app/utils/cloudinary.js';
+import { bearer, createAccount } from '../helpers/fixtures.js';
+
+vi.mock('../../src/app/utils/cloudinary.js', () => ({ default: vi.fn() }));
+
+const PNG = Buffer.from('89504e470d0a1a0a', 'hex');
+
+describe('PATCH /api/profile', () => {
+  let auth: string;
+  let accountId: string;
+
+  beforeEach(async () => {
+    const account = await createAccount();
+    auth = bearer(account);
+    accountId = String(account._id);
+  });
+
+  const storedProfile = () => profile_model.findOne({ accountId }).lean();
+
+  it('requires a token', async () => {
+    const res = await request(app).patch('/api/profile').field('data', '{}');
+    expect(res.status).toBe(401);
+  });
+
+  it('updates the signed-in user profile', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', auth)
+      .field('data', JSON.stringify({ fullName: '  Jane Doe  ' }));
+
+    expect(res.status).toBe(200);
+    expect(res.body.data.fullName).toBe('Jane Doe');
+    expect((await storedProfile())!.fullName).toBe('Jane Doe');
+    expect(uploadCloud).not.toHaveBeenCalled();
+  });
+
+  it('ignores fields that are not in the schema', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', auth)
+      .field('data', JSON.stringify({ fullName: 'Jane', accountId: '507f1f77bcf86cd799439011' }));
+
+    expect(res.status).toBe(200);
+    expect(String((await storedProfile())!.accountId)).toBe(accountId);
+  });
+
+  it('uploads the photo and stores its url', async () => {
+    vi.mocked(uploadCloud).mockResolvedValue({ secure_url: 'https://cdn.test/p.png' } as never);
+
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', auth)
+      .attach('file', PNG, { filename: 'me.png', contentType: 'image/png' });
+
+    expect(res.status).toBe(200);
+    expect(vi.mocked(uploadCloud).mock.calls[0]![0].buffer).toEqual(PNG);
+    expect((await storedProfile())!.profilePhoto).toBe('https://cdn.test/p.png');
+    expect((await storedProfile())!.fullName).toBe('Test User'); // untouched
+  });
+
+  it('rejects files that are not images', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', auth)
+      .attach('file', Buffer.from('#!/bin/sh'), { filename: 'x.sh', contentType: 'text/x-sh' });
+
+    expect(res.status).toBe(400);
+    expect(uploadCloud).not.toHaveBeenCalled();
+  });
+
+  it('rejects invalid data without uploading anything', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', auth)
+      .field('data', JSON.stringify({ fullName: '' }))
+      .attach('file', PNG, { filename: 'me.png', contentType: 'image/png' });
+
+    expect(res.status).toBe(400);
+    expect(uploadCloud).not.toHaveBeenCalled();
+    expect((await storedProfile())!.fullName).toBe('Test User');
+  });
+
+  it('rejects malformed JSON in `data`', async () => {
+    const res = await request(app)
+      .patch('/api/profile')
+      .set('Authorization', auth)
+      .field('data', '{not json');
+
+    expect(res.status).toBe(400);
+  });
+});

package/templates/mongoose/tests/routes/social.test.ts

@@ -0,0 +1,310 @@
+import { createHash } from 'node:crypto';
+import passport, { type Profile } from 'passport';
+import request from 'supertest';
+import { describe, expect, it, vi } from 'vitest';
+import app from '../../src/app.js';
+import {
+  account_model,
+  social_account_model,
+  social_login_code_model,
+} from '../../src/app/modules/account/account.schema.js';
+import { profile_model } from '../../src/app/modules/profile/profile.schema.js';
+import { hashLoginCode } from '../../src/app/passport-js/social-account.js';
+import { createAccount, findAccount } from '../helpers/fixtures.js';
+
+const FRONT_END_CALLBACK = 'http://localhost:5173/auth/social/callback';
+
+type Callback = (...args: unknown[]) => void;
+type OAuth2Internals = {
+  _oauth2: { getOAuthAccessToken: Callback };
+  userProfile: Callback;
+};
+type OAuth1Internals = {
+  _oauth: { getOAuthRequestToken: Callback; getOAuthAccessToken: Callback };
+  userProfile: Callback;
+};
+const strategy = <T>(name: string) =>
+  (passport as unknown as { _strategy: (n: string) => T })._strategy(name);
+
+/** Calls the node-style callback passed as the last argument. */
+const reply =
+  (...result: unknown[]) =>
+  (...args: unknown[]) =>
+    (args.at(-1) as Callback)(null, ...result);
+
+const googleProfile = (overrides: Partial<Profile> = {}): Profile => ({
+  provider: 'google',
+  id: 'google-123',
+  displayName: 'Jane Doe',
+  emails: [{ value: 'Jane@Example.com', verified: true } as never],
+  photos: [{ value: 'https://photos.test/jane.png' }],
+  ...overrides,
+});
+
+/** Stubs the provider's HTTP calls (code -> token, token -> profile). */
+const stubGoogle = (profile: Profile) => {
+  const google = strategy<OAuth2Internals>('google');
+  const tokenCall = vi
+    .spyOn(google._oauth2, 'getOAuthAccessToken')
+    .mockImplementation(reply('access-token', 'refresh-token', {}));
+  vi.spyOn(google, 'userProfile').mockImplementation(reply(profile));
+  return tokenCall;
+};
+
+const firstCookie = (res: request.Response) =>
+  ([] as string[]).concat(res.headers['set-cookie'] ?? [])[0]!.split(';')[0]!;
+
+/** Starts a login and returns what the browser would carry back to the callback. */
+const startGoogleLogin = async (query = '') => {
+  const res = await request(app).get(`/api/auth/social/google${query}`);
+  const location = new URL(res.headers.location);
+  return { res, location, cookie: firstCookie(res), state: location.searchParams.get('state')! };
+};
+
+const finishGoogleLogin = (state: string, cookie: string) =>
+  request(app)
+    .get(`/api/auth/social/google/callback?code=auth-code&state=${state}`)
+    .set('Cookie', cookie);
+
+const loginWithGoogle = async (query = '') => {
+  const { cookie, state } = await startGoogleLogin(query);
+  return finishGoogleLogin(state, cookie);
+};
+
+const redirectParams = (res: request.Response) => {
+  const url = new URL(res.headers.location);
+  expect(`${url.origin}${url.pathname}`).toBe(FRONT_END_CALLBACK);
+  return url.searchParams;
+};
+
+describe('GET /api/auth/social/providers', () => {
+  it('lists only the enabled providers', async () => {
+    const res = await request(app).get('/api/auth/social/providers');
+
+    expect(res.status).toBe(200);
+    expect(res.body.data.map((p: { name: string }) => p.name)).toEqual([
+      'google',
+      'github',
+      'twitter',
+    ]);
+  });
+
+  it('has no routes for disabled providers', async () => {
+    const res = await request(app).get('/api/auth/social/facebook');
+    expect(res.status).toBe(404);
+  });
+});
+
+describe('GET /api/auth/social/<provider>', () => {
+  it('redirects to the provider with state and PKCE, kept in an httpOnly cookie', async () => {
+    const { res, location, cookie } = await startGoogleLogin();
+
+    expect(res.status).toBe(302);
+    expect(location.host).toBe('accounts.google.com');
+    expect(location.searchParams.get('state')).toBeTruthy();
+    expect(location.searchParams.get('code_challenge_method')).toBe('S256');
+    expect(location.searchParams.get('scope')).toBe('openid email profile');
+    expect(cookie).toMatch(/^oauth_google=/);
+    expect(res.headers['set-cookie']![0]).toMatch(/HttpOnly/);
+    // the cookie is encrypted: the state isn't readable in it
+    expect(cookie).not.toContain(location.searchParams.get('state'));
+  });
+
+  it('uses state (no PKCE) for GitHub', async () => {
+    const res = await request(app).get('/api/auth/social/github');
+    const location = new URL(res.headers.location);
+
+    expect(location.host).toBe('github.com');
+    expect(location.searchParams.get('state')).toBeTruthy();
+    expect(location.searchParams.get('code_challenge')).toBeNull();
+  });
+});
+
+describe('GET /api/auth/social/<provider>/callback', () => {
+  it('creates an account on first login and redirects with a single-use code', async () => {
+    const tokenCall = stubGoogle(googleProfile());
+
+    const { location, cookie, state } = await startGoogleLogin('?returnTo=/dashboard');
+    const res = await finishGoogleLogin(state, cookie);
+
+    expect(res.status).toBe(302);
+    const params = redirectParams(res);
+    expect(params.get('returnTo')).toBe('/dashboard');
+
+    const account = await findAccount('jane@example.com');
+    expect(account).toMatchObject({ provider: 'GOOGLE', password: null, isAccountVerified: true });
+    expect(await profile_model.findOne({ accountId: account!._id }).lean()).toMatchObject({
+      fullName: 'Jane Doe',
+      profilePhoto: 'https://photos.test/jane.png',
+    });
+    expect(
+      await social_account_model.exists({ provider: 'GOOGLE', providerUserId: 'google-123' }),
+    ).toBeTruthy();
+
+    // the code in the URL is stored only as a hash, for the new account
+    const code = await social_login_code_model.findById(hashLoginCode(params.get('code')!)).lean();
+    expect(String(code!.accountId)).toBe(String(account!._id));
+
+    // PKCE: the verifier sent with the code matches the challenge from the start
+    const verifier = (tokenCall.mock.calls[0]![1] as { code_verifier: string }).code_verifier;
+    expect(createHash('sha256').update(verifier).digest('base64url')).toBe(
+      location.searchParams.get('code_challenge'),
+    );
+  });
+
+  it('logs a linked identity into its account, even if the email changed', async () => {
+    const account = await createAccount();
+    await social_account_model.create({
+      accountId: account._id,
+      provider: 'GOOGLE',
+      providerUserId: 'google-123',
+    });
+    stubGoogle(googleProfile({ emails: [] }));
+
+    const res = await loginWithGoogle();
+
+    const code = redirectParams(res).get('code')!;
+    const row = await social_login_code_model.findById(hashLoginCode(code)).lean();
+    expect(String(row!.accountId)).toBe(String(account._id));
+    expect(await account_model.countDocuments()).toBe(1);
+  });
+
+  it('links to an existing unverified account and drops its unproven password', async () => {
+    await createAccount({ email: 'jane@example.com', isAccountVerified: false });
+    stubGoogle(googleProfile());
+
+    const res = await loginWithGoogle();
+
+    expect(redirectParams(res).get('code')).toBeTruthy();
+    expect(await findAccount('jane@example.com')).toMatchObject({
+      isAccountVerified: true,
+      password: null,
+    });
+    expect(await social_account_model.countDocuments()).toBe(1);
+  });
+
+  it('refuses unverified provider emails', async () => {
+    stubGoogle(
+      googleProfile({ emails: [{ value: 'jane@example.com', verified: false } as never] }),
+    );
+
+    const res = await loginWithGoogle();
+
+    expect(redirectParams(res).get('error')).toBe('email_unverified');
+    expect(await account_model.countDocuments()).toBe(0);
+  });
+
+  it('refuses deleted accounts', async () => {
+    await createAccount({ email: 'jane@example.com', isDeleted: true });
+    stubGoogle(googleProfile());
+
+    const res = await loginWithGoogle();
+
+    expect(redirectParams(res).get('error')).toBe('account_disabled');
+    expect(await social_login_code_model.countDocuments()).toBe(0);
+  });
+
+  it('rejects a callback whose state does not match (login CSRF)', async () => {
+    const tokenCall = stubGoogle(googleProfile());
+    const { cookie } = await startGoogleLogin();
+
+    const res = await finishGoogleLogin('attacker-state', cookie);
+
+    expect(redirectParams(res).get('error')).toBe('invalid_state');
+    expect(tokenCall).not.toHaveBeenCalled();
+  });
+
+  it('rejects a callback without the state cookie', async () => {
+    const tokenCall = stubGoogle(googleProfile());
+    const { state } = await startGoogleLogin();
+
+    const res = await request(app).get(
+      `/api/auth/social/google/callback?code=auth-code&state=${state}`,
+    );
+
+    expect(redirectParams(res).get('error')).toBe('invalid_state');
+    expect(tokenCall).not.toHaveBeenCalled();
+  });
+
+  it('reports when the user cancels at the provider', async () => {
+    const res = await request(app).get('/api/auth/social/google/callback?error=access_denied');
+
+    expect(redirectParams(res).get('error')).toBe('access_denied');
+  });
+
+  it('never redirects to another site through returnTo', async () => {
+    stubGoogle(googleProfile());
+
+    const res = await loginWithGoogle(`?returnTo=${encodeURIComponent('//evil.com')}`);
+
+    const params = redirectParams(res);
+    expect(params.get('code')).toBeTruthy();
+    expect(params.get('returnTo')).toBeNull();
+  });
+});
+
+describe('X (Twitter) login, OAuth 1.0a', () => {
+  const twitter = () => strategy<OAuth1Internals>('twitter');
+
+  const startTwitterLogin = async (query = '') => {
+    vi.spyOn(twitter()._oauth, 'getOAuthRequestToken').mockImplementation(
+      reply('req-token', 'req-secret', {}),
+    );
+    const res = await request(app).get(`/api/auth/social/twitter${query}`);
+    return { res, cookie: firstCookie(res) };
+  };
+
+  it('keeps the request token in an encrypted cookie and completes the login', async () => {
+    const accessCall = vi
+      .spyOn(twitter()._oauth, 'getOAuthAccessToken')
+      .mockImplementation(reply('access', 'access-secret', {}));
+    vi.spyOn(twitter(), 'userProfile').mockImplementation(
+      reply({
+        provider: 'twitter',
+        id: 'x-1',
+        displayName: 'Jane',
+        emails: [{ value: 'jane@x.com' }],
+      }),
+    );
+
+    const { res: start, cookie } = await startTwitterLogin('?returnTo=/home');
+    const location = new URL(start.headers.location);
+    expect(`${location.origin}${location.pathname}`).toBe(
+      'https://api.twitter.com/oauth/authenticate',
+    );
+    expect(location.searchParams.get('oauth_token')).toBe('req-token');
+    expect(cookie).toMatch(/^oauth_twitter=/);
+    expect(cookie).not.toContain('req-secret');
+
+    const res = await request(app)
+      .get('/api/auth/social/twitter/callback?oauth_token=req-token&oauth_verifier=v')
+      .set('Cookie', cookie);
+
+    // the token secret from the cookie was used to get the access token
+    expect(accessCall.mock.calls[0]!.slice(0, 3)).toEqual(['req-token', 'req-secret', 'v']);
+    const params = redirectParams(res);
+    expect(params.get('code')).toBeTruthy();
+    expect(params.get('returnTo')).toBe('/home');
+    expect(await findAccount('jane@x.com')).toMatchObject({ provider: 'TWITTER' });
+  });
+
+  it('rejects a callback whose token does not match the one in the cookie', async () => {
+    const accessCall = vi.spyOn(twitter()._oauth, 'getOAuthAccessToken');
+    const { cookie } = await startTwitterLogin();
+
+    const res = await request(app)
+      .get('/api/auth/social/twitter/callback?oauth_token=other-token&oauth_verifier=v')
+      .set('Cookie', cookie);
+
+    expect(redirectParams(res).get('error')).toBe('invalid_state');
+    expect(accessCall).not.toHaveBeenCalled();
+  });
+
+  it('rejects a callback for a request token it did not issue', async () => {
+    const res = await request(app).get(
+      '/api/auth/social/twitter/callback?oauth_token=forged&oauth_verifier=v',
+    );
+
+    expect(redirectParams(res).get('error')).toBe('invalid_state');
+  });
+});

package/templates/mongoose/tests/setup.ts

@@ -0,0 +1,25 @@
+import mongoose from 'mongoose';
+import { randomUUID } from 'node:crypto';
+import { afterAll, beforeAll, beforeEach, inject, vi } from 'vitest';
+
+// external boundaries only: everything between the route and MongoDB runs for real
+vi.mock('../src/app/queues/email.queue.js', () => ({
+  enqueueEmail: vi.fn(),
+}));
+
+beforeAll(async () => {
+  await mongoose.connect(inject('mongoUri'), { dbName: `test-${randomUUID()}` });
+  // unique and TTL indexes are part of the behaviour under test
+  await mongoose.connection.syncIndexes();
+});
+
+beforeEach(async () => {
+  // a clean database, and clean rate limit counters, for every test
+  const collections = await mongoose.connection.db!.collections();
+  await Promise.all(collections.map((c) => c.deleteMany({})));
+});
+
+afterAll(async () => {
+  await mongoose.connection.dropDatabase();
+  await mongoose.disconnect();
+});

package/templates/mongoose/tsconfig.json

@@ -1,20 +1,16 @@
-{
-  "compilerOptions": {
-    "target": "es2016",
-    "module": "commonjs",
-    "rootDir": "./src",
-    "outDir": "./dist",
-    "esModuleInterop": true,
-    "forceConsistentCasingInFileNames": true,
-    "strict": true,
-    "skipLibCheck": true,
-  },
-  "include": [
-    "src/**/*.ts"
-  ],
-  "exclude": [
-    "node_modules",
-    "dist",
-    "build"
-  ]
-}
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "rootDir": "./src",
+    "outDir": "./dist",
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noImplicitAny": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "build", "generated/prisma"]
+}

package/templates/mongoose/vitest.config.ts

@@ -0,0 +1,43 @@
+import { defineConfig } from 'vitest/config';
+
+const secret = (name: string) => `${name}-test-secret-0123456789abcdefghijklmnop`;
+
+export default defineConfig({
+  test: {
+    include: ['tests/**/*.test.ts'],
+    // starts one in-memory MongoDB for the whole run
+    globalSetup: ['./tests/global-setup.ts'],
+    setupFiles: ['./tests/setup.ts'],
+    // every test starts with fresh mocks
+    mockReset: true,
+    // the first run downloads a MongoDB binary
+    hookTimeout: 120_000,
+    // set before the app reads its config; values in .env don't override these
+    env: {
+      NODE_ENV: 'test',
+      // placeholder for config validation; tests connect to the in-memory server
+      DATABASE_URL: 'mongodb://localhost:27017/unused',
+      ACCESS_TOKEN: secret('access'),
+      VERIFIED_TOKEN: secret('verify'),
+      RESET_SECRET: secret('reset'),
+      FRONT_END_URL: 'http://localhost:5173',
+      CORS_ORIGINS: 'http://localhost:5173',
+      ENABLE_SWAGGER: 'false',
+      IS_GOOGLE_LOGIN: 'true',
+      GOOGLE_CLIENT_ID: 'google-client-id',
+      GOOGLE_CLIENT_SECRET: 'google-client-secret',
+      GOOGLE_CALLBACK_URL: 'http://localhost:5000/api/auth/social/google/callback',
+      IS_GITHUB_LOGIN: 'true',
+      GITHUB_CLIENT_ID: 'github-client-id',
+      GITHUB_CLIENT_SECRET: 'github-client-secret',
+      GITHUB_CALLBACK_URL: 'http://localhost:5000/api/auth/social/github/callback',
+      IS_TWITTER_LOGIN: 'true',
+      TWITTER_CONSUMER_KEY: 'twitter-key',
+      TWITTER_CONSUMER_SECRET: 'twitter-secret',
+      TWITTER_CALLBACK_URL: 'http://localhost:5000/api/auth/social/twitter/callback',
+      IS_FACEBOOK_LOGIN: 'false',
+      IS_LINKEDIN_LOGIN: 'false',
+      IS_DISCORD_LOGIN: 'false',
+    },
+  },
+});

package/templates/prisma/.dockerignore

@@ -6,3 +6,5 @@ Dockerfile
 README.md
 .env
 dist
+docker-compose.ymltests
+coverage

package/templates/prisma/.env.example

@@ -1,20 +1,76 @@
-DATABASE_URL="postgresql://postgres:postgres123@localhost:5432/server_db?sslmode=disable"
-
+# Default Node config
 NODE_ENV=development
 PORT=5000
+# Number of reverse proxies in front of the app (1 behind Caddy/Nginx). Keep 0 if exposed directly.
+TRUST_PROXY=0
+
+# Database config
+DATABASE_URL="postgresql://postgres:change-me@localhost:5432/server_db?sslmode=disable"
+# Used by docker-compose for the postgres container
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=change-me
+POSTGRES_DB=server_db
+
 # JWT Configuration
+# Each secret must be a different random value of 32+ characters: `openssl rand -hex 32`
 ACCESS_TOKEN=
-ACCESS_EXPIRES=
-RESET_SECRET=
-RESET_EXPIRES=
+# Access tokens are short-lived; refresh tokens (opaque, rotated on every use) last longer
+ACCESS_EXPIRES=15m
+REFRESH_EXPIRES_DAYS=30
 VERIFIED_TOKEN=
-FRONT_END_URL=
+RESET_SECRET=
+RESET_EXPIRES=15m
+FRONT_END_URL=http://localhost:5173
+# Comma separated list of allowed origins. Defaults to FRONT_END_URL.
+CORS_ORIGINS=
 
 # Email Configuration
 APP_USER_EMAIL=
 APP_PASSWORD=
+# "From" address. Defaults to APP_USER_EMAIL.
+MAIL_FROM=
 
 # Cloudinary Configuration
 CLOUD_NAME=
 CLOUD_API_KEY=
 CLOUD_API_SECRET=
+
+# Swagger Config (docs are disabled in production unless ENABLE_SWAGGER=true)
+ENABLE_SWAGGER=
+DEVELOPMENT_BASE_URL=http://localhost:5000
+PRODUCTION_BASE_URL=
+
+# Social login: set IS_<PROVIDER>_LOGIN=true and fill in its credentials.
+# After the provider, the browser is sent here with `?code=` (trade it via
+# POST /api/auth/social/exchange) or `?error=`. Defaults to FRONT_END_URL/auth/social/callback
+SOCIAL_REDIRECT_URL=
+
+IS_GOOGLE_LOGIN=false
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_CALLBACK_URL=http://localhost:5000/api/auth/social/google/callback
+
+IS_FACEBOOK_LOGIN=false
+FACEBOOK_APP_ID=
+FACEBOOK_APP_SECRET=
+FACEBOOK_CALLBACK_URL=http://localhost:5000/api/auth/social/facebook/callback
+
+IS_GITHUB_LOGIN=false
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+GITHUB_CALLBACK_URL=http://localhost:5000/api/auth/social/github/callback
+
+IS_TWITTER_LOGIN=false
+TWITTER_CONSUMER_KEY=
+TWITTER_CONSUMER_SECRET=
+TWITTER_CALLBACK_URL=http://localhost:5000/api/auth/social/twitter/callback
+
+IS_LINKEDIN_LOGIN=false
+LINKEDIN_CLIENT_ID=
+LINKEDIN_CLIENT_SECRET=
+LINKEDIN_CALLBACK_URL=http://localhost:5000/api/auth/social/linkedin/callback
+
+IS_DISCORD_LOGIN=false
+DISCORD_CLIENT_ID=
+DISCORD_CLIENT_SECRET=
+DISCORD_CALLBACK_URL=http://localhost:5000/api/auth/social/discord/callback

package/templates/prisma/.prettierignore

@@ -0,0 +1,3 @@
+node_modules
+dist
+prisma/generated

package/templates/prisma/.prettierrc

@@ -0,0 +1,7 @@
+{
+  "semi": true,
+  "singleQuote": true,
+  "tabWidth": 2,
+  "trailingComma": "all",
+  "printWidth": 100
+}

package/templates/prisma/.projectrc.json

@@ -1,3 +1,3 @@
 {
   "database": "prisma"
-}
+}

package/templates/prisma/Dockerfile

@@ -1,27 +1,41 @@
 # ---------- BUILD STAGE ----------
-FROM node:18-alpine AS builder
+FROM node:22-alpine AS builder
 
 WORKDIR /app
 
+# Only install deps first (cache friendly)
 COPY package*.json ./
-RUN npm install
+RUN npm ci
 
+# Copy source
 COPY . .
+
+# Generate prisma + build
+RUN npx prisma generate
 RUN npm run build
 
 
 # ---------- PRODUCTION STAGE ----------
-FROM node:18-alpine
+FROM node:22-alpine
 
 WORKDIR /app
 
+ENV NODE_ENV=production
+
+# Only install production deps
 COPY package*.json ./
-RUN npm install && npm cache clean --force
+RUN npm ci --omit=dev && npm cache clean --force
 
+# Copy Prisma generated client + schema
+COPY --from=builder /app/node_modules/.prisma ./node_modules/.prisma
+COPY --from=builder /app/node_modules/@prisma ./node_modules/@prisma
+COPY --from=builder /app/prisma ./prisma
+
+# Copy built app
 COPY --from=builder /app/dist ./dist
- 
-RUN mkdir -p /app/uploads
+
+USER node
 
 EXPOSE 5000
 
-CMD ["node", "dist/server.js"]
+CMD ["node", "dist/server.js"]