exp-node-server 1.1.7 → 2.0.0

package/templates/prisma/package.json

@@ -4,44 +4,82 @@
   "description": "",
   "main": "index.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "dev": "tsx watch src/server.ts",
-    "build": "tsc"
+    "build": "tsc",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "check": "tsc --noEmit",
+    "db:migrate": "prisma migrate dev",
+    "db:deploy": "prisma migrate deploy"
   },
   "keywords": [],
   "author": "",
   "license": "ISC",
   "type": "module",
   "dependencies": {
-    "@prisma/adapter-pg": "^7.5.0",
-    "@prisma/client": "^7.5.0",
+    "@prisma/adapter-pg": "^7.8.0",
+    "@prisma/client": "^7.8.0",
     "bcrypt": "^6.0.0",
     "cloudinary": "^2.7.0",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
-    "dotenv": "^17.3.1",
+    "dotenv": "^17.4.2",
     "express": "^5.1.0",
+    "express-rate-limit": "^8.7.1",
+    "helmet": "^8.3.0",
     "jsonwebtoken": "^9.0.2",
     "multer": "^2.0.2",
-    "nodemailer": "^7.0.9",
+    "nodemailer": "^8.0.5",
+    "passport": "^0.7.0",
+    "passport-facebook": "^3.0.0",
+    "passport-github": "^1.1.0",
+    "passport-google-oauth20": "^2.0.0",
+    "passport-oauth1": "^1.3.0",
+    "passport-oauth2": "^1.8.0",
     "pg": "^8.20.0",
+    "pg-boss": "^12.37.1",
+    "pino": "^10.3.1",
     "swagger-jsdoc": "^6.2.8",
     "swagger-ui-express": "^5.0.1",
     "zod": "^4.1.12"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "@types/bcrypt": "^6.0.0",
     "@types/cookie-parser": "^1.4.9",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.3",
     "@types/jsonwebtoken": "^9.0.10",
     "@types/multer": "^2.0.0",
-    "@types/node": "^24.10.9",
+    "@types/node": "^24.12.2",
     "@types/nodemailer": "^7.0.2",
+    "@types/passport": "^1.0.17",
+    "@types/passport-facebook": "^3.0.4",
+    "@types/passport-github": "^1.1.13",
+    "@types/passport-google-oauth20": "^2.0.17",
+    "@types/passport-oauth2": "^1.8.0",
     "@types/pg": "^8.20.0",
+    "@types/supertest": "^7.2.1",
     "@types/swagger-jsdoc": "^6.0.4",
     "@types/swagger-ui-express": "^4.1.8",
-    "prisma": "^7.5.0",
-    "tsx": "^4.21.0"
+    "@typescript-eslint/eslint-plugin": "^8.59.0",
+    "@typescript-eslint/parser": "^8.59.0",
+    "eslint": "^10.2.1",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-prettier": "^5.5.5",
+    "pino-pretty": "^13.1.3",
+    "prettier": "^3.8.3",
+    "prisma": "^7.8.0",
+    "supertest": "^7.3.1",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.59.0",
+    "vitest": "^5.0.4"
+  },
+  "engines": {
+    "node": ">=22.12.0"
   }
 }

package/templates/prisma/prisma/schema/account.schema.prisma

@@ -3,17 +3,99 @@ enum ROLE {
     USER
 }
 
+enum PROVIDER {
+    LOCAL
+    GOOGLE
+    FACEBOOK
+    GITHUB
+    TWITTER
+    LINKEDIN
+    DISCORD
+}
+
 model Account {
-    id                String   @id @default(uuid())
-    email             String   @unique
-    password          String
-    role              ROLE     @default(USER)
-    lastOtp           String?
+    // PK
+    id                 String    @id @default(uuid())
+    email              String    @unique
+    password           String?
+    // provider the account was created with
+    provider           PROVIDER  @default(LOCAL)
+    role               ROLE      @default(USER)
+    isDeleted          Boolean   @default(false)
+    isAccountVerified  Boolean   @default(false)
+    // bumped on password change/reset and "sign out everywhere"; access tokens
+    // and reset links carrying an older version stop working
+    tokenVersion       Int       @default(0)
+
+    // email verification (the OTP is stored as an HMAC, never in plain text)
+    lastOtp            String?
     lastOtpSendingTime DateTime?
-    isDeleted         Boolean  @default(false)
-    isAccountVerified Boolean  @default(false)
-    createdAt         DateTime @default(now())
-    updatedAt         DateTime @default(now())
+    otpAttempts        Int       @default(0)
+
+    createdAt          DateTime  @default(now())
+    updatedAt          DateTime  @updatedAt
+
+    // Relation
+    profile        Profile?
+    socialAccounts SocialAccount[]
+    loginCodes     SocialLoginCode[]
+    refreshTokens  RefreshToken[]
+}
+
+/// Refresh tokens are opaque random strings; only their hash is stored. Every
+/// refresh rotates the token, and all tokens of one sign-in share a `familyId`, so
+/// a stolen token that gets reused can revoke the whole session.
+model RefreshToken {
+    tokenHash    String    @id
+    accountId    String
+    familyId     String
+    // the account's tokenVersion when issued; a password change makes it stale
+    tokenVersion Int
+    expiresAt    DateTime
+    // set when the token is rotated; kept until expiry to detect reuse
+    usedAt       DateTime?
+    createdAt    DateTime  @default(now())
+
+    account Account @relation(fields: [accountId], references: [id], onDelete: Cascade)
+
+    @@index([accountId])
+    @@index([familyId])
+    @@index([expiresAt])
+}
+
+/// A social identity linked to an account. Lookups use the provider's stable user
+/// id, so a login keeps working even if the email at the provider changes.
+model SocialAccount {
+    id             String   @id @default(uuid())
+    accountId      String
+    provider       PROVIDER
+    providerUserId String
+    createdAt      DateTime @default(now())
+
+    account Account @relation(fields: [accountId], references: [id], onDelete: Cascade)
+
+    @@unique([provider, providerUserId])
+    @@index([accountId])
+}
+
+/// Single-use code handed to the front-end after a social login, exchanged for an
+/// access token via `POST /api/auth/social/exchange`. Only the hash is stored.
+model SocialLoginCode {
+    codeHash  String   @id
+    accountId String
+    expiresAt DateTime
+    createdAt DateTime @default(now())
+
+    account Account @relation(fields: [accountId], references: [id], onDelete: Cascade)
+
+    @@index([expiresAt])
+}
+
+/// Hit counters for the auth rate limiters, shared by every app instance.
+model RateLimit {
+    key     String   @id
+    hits    Int
+    resetAt DateTime
 
-    profile Profile?
+    @@index([resetAt])
 }

package/templates/prisma/prisma/schema/profile.schema.prisma

@@ -1,8 +1,13 @@
 model Profile {
-    id        String  @id @default(uuid())
-    accountId String  @unique
-    account   Account @relation(fields: [accountId], references: [id], onDelete: Cascade)
+    // PK
+    id        String @id @default(uuid())
+    
+    // FK
+    accountId String @unique
 
     fullName     String
     profilePhoto String?
+
+    // Relation
+    account      Account @relation(fields: [accountId], references: [id], onDelete: Cascade)
 }

package/templates/prisma/prisma/schema/schema.prisma

@@ -1,6 +1,5 @@
 generator client {
-  provider = "prisma-client"
-  output   = "../generated/prisma"
+  provider = "prisma-client-js"
 }
 
 datasource db {

package/templates/prisma/prisma.config.ts

@@ -1,14 +1,14 @@
 // This file was generated by Prisma, and assumes you have installed the following:
 // npm install --save-dev prisma dotenv
-import "dotenv/config";
-import { defineConfig } from "prisma/config";
+import 'dotenv/config';
+import { defineConfig } from 'prisma/config';
 
 export default defineConfig({
-  schema: "prisma/schema",
+  schema: 'prisma/schema',
   migrations: {
-    path: "prisma/migrations",
+    path: 'prisma/migrations',
   },
   datasource: {
-    url: process.env["DATABASE_URL"],
+    url: process.env['DATABASE_URL'] as string,
   },
 });

package/templates/prisma/readme.md

@@ -93,9 +93,90 @@ Swagger docs available at:
 http://localhost:5000/docs
 ```
 
+## 🔐 Environment
+
+Copy `.env.example` to `.env` and fill it in. The app validates its environment
+on startup and exits with a list of anything missing or invalid.
+
+`ACCESS_TOKEN`, `VERIFIED_TOKEN` and `RESET_SECRET` must be **different** random
+values of at least 32 characters:
+
+```bash
+openssl rand -hex 32
+```
+
+## 📬 Background Jobs
+
+Emails (account verification and password reset) are sent through a single
+`email` queue powered by [pg-boss](https://github.com/timgit/pg-boss). It stores
+jobs in a `pgboss` schema in the same PostgreSQL database, so no Redis is needed.
+Failed sends are retried with backoff.
+
+To add a new email, add a variant to `EmailJob` in `src/app/queues/email.queue.ts`
+and handle it in `render()`.
+
+A scheduled `maintenance` job (every 15 minutes, run once across all instances)
+deletes expired rate limit counters and social login codes.
+
+## 🔐 Sessions & Refresh Tokens
+
+Signing in (password or social) returns a short-lived **access token** (`ACCESS_EXPIRES`,
+15 minutes by default) and a **refresh token** (`REFRESH_EXPIRES_DAYS`, 30 by default).
+Both are also set as httpOnly cookies; the refresh cookie is only sent to `/api/auth`.
+
+- `POST /api/auth/refresh-token`: when the access token expires (401), get new tokens.
+  Browsers send the cookie automatically; other clients send `{ "refreshToken": "..." }`.
+- `POST /api/auth/sign-out`: ends this device's session.
+- `POST /api/auth/sign-out-all`: ends every session (also happens on password change/reset).
+
+Refresh tokens are random strings stored only as hashes, and are **rotated** on every
+refresh. If an already-used refresh token shows up again, it was most likely stolen,
+so the whole session is revoked. (A reuse within 30 seconds is treated as two tabs
+refreshing at once and only that request fails.)
+
+## 🔑 Social Login
+
+Supported: **Google, Facebook, GitHub, X (Twitter), LinkedIn and Discord**. Set
+`IS_<PROVIDER>_LOGIN=true` and fill in the credentials in `.env`.
+
+- `GET /api/auth/social/providers`: enabled providers, for rendering buttons
+- `GET /api/auth/social/<provider>?returnTo=/dashboard`: start the login (a link, not `fetch`)
+- `GET /api/auth/social/<provider>/callback`: OAuth callback (register this URL at the provider)
+- `POST /api/auth/social/exchange` `{ "code": "..." }`: trade the code for an access token
+
+After the provider, the browser lands on `SOCIAL_REDIRECT_URL` (default
+`FRONT_END_URL/auth/social/callback`) with either `?code=...&returnTo=...` or
+`?error=...`. The front-end posts the code (single-use, valid for 60 seconds) to
+`/exchange`, which returns the access token and sets the cookie, like `/sign-in`.
+
+Every login is protected by an OAuth `state` (and PKCE for Google), stored in a
+short-lived encrypted cookie, so no session store is needed. Identities are linked
+by the provider's user id, and only verified provider emails are used to create or
+link accounts. Providers are defined in `src/app/passport-js/providers.ts`.
+
+## 🛡️ Rate Limiting
+
+The auth endpoints have their own limits (sign-in per IP + email, emails per
+recipient, OTP / reset guesses per IP), stored in the `RateLimit` table so they are
+shared by every instance — no Redis needed. A pg-boss job removes expired rows.
+The whole API also has a lenient per-instance in-memory limit. Tune them in
+`src/app/middlewares/rate_limiter.ts`, and set `TRUST_PROXY` when running behind a
+proxy so the real client IP is used.
+
+## 🧪 Tests
+
+```bash
+npm test
+```
+
+Route tests with [supertest](https://github.com/ladjs/supertest) run each request
+through the route, controller and service. Prisma, the email queue and Cloudinary
+are mocked, so no database is needed.
+
 ## 🧠 Tech Stack
 
 - Express.js — Backend framework
+- pg-boss — PostgreSQL job queue
 - TypeScript — Strongly typed JavaScript
 - Mongoose — MongoDB ODM
 - Prisma — PostgreSQL ORM

package/templates/prisma/src/app/configs/index.ts

@@ -1,26 +1,175 @@
-import "dotenv/config";
-
-export const configs = {
-  port: process.env.PORT,
-  env: process.env.NODE_ENV,
-  db_url: process.env.DATABASE_URL,
-  jwt: {
-    access_token: process.env.ACCESS_TOKEN,
-    refresh_token: process.env.REFRESH_TOKEN,
-    access_expires: process.env.ACCESS_EXPIRES,
-    refresh_expires: process.env.REFRESH_EXPIRES,
-    reset_secret: process.env.RESET_SECRET,
-    reset_expires: process.env.RESET_EXPIRES,
-    front_end_url: process.env.FRONT_END_URL,
-    verified_token: process.env.VERIFIED_TOKEN,
-  },
-  email: {
-    app_email: process.env.APP_USER_EMAIL,
-    app_password: process.env.APP_PASSWORD,
-  },
-  cloudinary: {
-    cloud_name: process.env.CLOUD_NAME,
-    cloud_api_key: process.env.CLOUD_API_KEY,
-    cloud_api_secret: process.env.CLOUD_API_SECRET,
-  },
-};
+import 'dotenv/config';
+import { z } from 'zod';
+
+const bool = z
+  .enum(['true', 'false'])
+  .default('false')
+  .transform((v) => v === 'true');
+
+// JWT/session secrets must be long and random, e.g. `openssl rand -hex 32`
+const secret = z.string().min(32, 'must be at least 32 characters');
+
+const envSchema = z.object({
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+  PORT: z.coerce.number().int().positive().default(5000),
+  DATABASE_URL: z.url(),
+
+  // auth
+  ACCESS_TOKEN: secret,
+  // short-lived; clients get a new one from POST /api/auth/refresh-token
+  ACCESS_EXPIRES: z.string().default('15m'),
+  REFRESH_EXPIRES_DAYS: z.coerce.number().int().positive().default(30),
+  VERIFIED_TOKEN: secret,
+  RESET_SECRET: secret,
+  RESET_EXPIRES: z.string().default('15m'),
+  FRONT_END_URL: z.url(),
+  CORS_ORIGINS: z.string().optional(),
+  TRUST_PROXY: z.coerce.number().int().min(0).default(0),
+
+  // email
+  APP_USER_EMAIL: z.string().optional(),
+  APP_PASSWORD: z.string().optional(),
+  MAIL_FROM: z.string().optional(),
+
+  // cloudinary
+  CLOUD_NAME: z.string().optional(),
+  CLOUD_API_KEY: z.string().optional(),
+  CLOUD_API_SECRET: z.string().optional(),
+
+  // swagger
+  ENABLE_SWAGGER: z.enum(['true', 'false']).optional(),
+  DEVELOPMENT_BASE_URL: z.string().default('http://localhost:5000'),
+  PRODUCTION_BASE_URL: z.string().default(''),
+
+  // social login
+  // where the browser is sent after a social login, with `?code=` or `?error=`
+  SOCIAL_REDIRECT_URL: z.url().optional(),
+
+  IS_GOOGLE_LOGIN: bool,
+  GOOGLE_CLIENT_ID: z.string().optional(),
+  GOOGLE_CLIENT_SECRET: z.string().optional(),
+  GOOGLE_CALLBACK_URL: z.string().optional(),
+
+  IS_FACEBOOK_LOGIN: bool,
+  FACEBOOK_APP_ID: z.string().optional(),
+  FACEBOOK_APP_SECRET: z.string().optional(),
+  FACEBOOK_CALLBACK_URL: z.string().optional(),
+
+  IS_GITHUB_LOGIN: bool,
+  GITHUB_CLIENT_ID: z.string().optional(),
+  GITHUB_CLIENT_SECRET: z.string().optional(),
+  GITHUB_CALLBACK_URL: z.string().optional(),
+
+  IS_TWITTER_LOGIN: bool,
+  TWITTER_CONSUMER_KEY: z.string().optional(),
+  TWITTER_CONSUMER_SECRET: z.string().optional(),
+  TWITTER_CALLBACK_URL: z.string().optional(),
+
+  IS_LINKEDIN_LOGIN: bool,
+  LINKEDIN_CLIENT_ID: z.string().optional(),
+  LINKEDIN_CLIENT_SECRET: z.string().optional(),
+  LINKEDIN_CALLBACK_URL: z.string().optional(),
+
+  IS_DISCORD_LOGIN: bool,
+  DISCORD_CLIENT_ID: z.string().optional(),
+  DISCORD_CLIENT_SECRET: z.string().optional(),
+  DISCORD_CALLBACK_URL: z.string().optional(),
+});
+
+type Env = z.infer<typeof envSchema>;
+
+// logger depends on configs, so failures here are reported with console
+const fail = (message: string): never => {
+  // eslint-disable-next-line no-console
+  console.error(message);
+  process.exit(1);
+};
+
+const parsed = envSchema.safeParse(process.env);
+if (!parsed.success) {
+  const issues = parsed.error.issues.map((i) => `  - ${i.path.join('.')}: ${i.message}`);
+  fail(`Invalid environment variables:\n${issues.join('\n')}`);
+}
+const env = parsed.data as Env;
+
+/** Credentials for a social provider; all are required once the provider is enabled. */
+const provider = (enabled: boolean, keys: [keyof Env, keyof Env, keyof Env]) => {
+  const [clientId, clientSecret, callbackUrl] = keys.map((key) => {
+    const value = env[key];
+    if (enabled && (typeof value !== 'string' || !value)) {
+      fail(`${key} is required when its login provider is enabled`);
+    }
+    return typeof value === 'string' ? value : '';
+  }) as [string, string, string];
+
+  return { enabled, client_id: clientId, client_secret: clientSecret, callback_url: callbackUrl };
+};
+
+export const configs = {
+  port: env.PORT,
+  env: env.NODE_ENV,
+  is_production: env.NODE_ENV === 'production',
+  is_test: env.NODE_ENV === 'test',
+  db_url: env.DATABASE_URL,
+  cors_origins: (env.CORS_ORIGINS ?? env.FRONT_END_URL).split(',').map((o) => o.trim()),
+  trust_proxy: env.TRUST_PROXY,
+  enable_swagger: env.ENABLE_SWAGGER
+    ? env.ENABLE_SWAGGER === 'true'
+    : env.NODE_ENV !== 'production',
+  jwt: {
+    access_token: env.ACCESS_TOKEN,
+    access_expires: env.ACCESS_EXPIRES,
+    refresh_expires_days: env.REFRESH_EXPIRES_DAYS,
+    reset_secret: env.RESET_SECRET,
+    reset_expires: env.RESET_EXPIRES,
+    verified_token: env.VERIFIED_TOKEN,
+    front_end_url: env.FRONT_END_URL,
+  },
+  email: {
+    app_email: env.APP_USER_EMAIL,
+    app_password: env.APP_PASSWORD,
+    from: env.MAIL_FROM ?? env.APP_USER_EMAIL,
+  },
+  cloudinary: {
+    cloud_name: env.CLOUD_NAME,
+    cloud_api_key: env.CLOUD_API_KEY,
+    cloud_api_secret: env.CLOUD_API_SECRET,
+  },
+  swagger_config: {
+    development_base_url: env.DEVELOPMENT_BASE_URL,
+    production_base_url: env.PRODUCTION_BASE_URL,
+  },
+  social: {
+    redirect_url: env.SOCIAL_REDIRECT_URL ?? `${env.FRONT_END_URL}/auth/social/callback`,
+    google: provider(env.IS_GOOGLE_LOGIN, [
+      'GOOGLE_CLIENT_ID',
+      'GOOGLE_CLIENT_SECRET',
+      'GOOGLE_CALLBACK_URL',
+    ]),
+    facebook: provider(env.IS_FACEBOOK_LOGIN, [
+      'FACEBOOK_APP_ID',
+      'FACEBOOK_APP_SECRET',
+      'FACEBOOK_CALLBACK_URL',
+    ]),
+    github: provider(env.IS_GITHUB_LOGIN, [
+      'GITHUB_CLIENT_ID',
+      'GITHUB_CLIENT_SECRET',
+      'GITHUB_CALLBACK_URL',
+    ]),
+    twitter: provider(env.IS_TWITTER_LOGIN, [
+      'TWITTER_CONSUMER_KEY',
+      'TWITTER_CONSUMER_SECRET',
+      'TWITTER_CALLBACK_URL',
+    ]),
+    linkedin: provider(env.IS_LINKEDIN_LOGIN, [
+      'LINKEDIN_CLIENT_ID',
+      'LINKEDIN_CLIENT_SECRET',
+      'LINKEDIN_CALLBACK_URL',
+    ]),
+    discord: provider(env.IS_DISCORD_LOGIN, [
+      'DISCORD_CLIENT_ID',
+      'DISCORD_CLIENT_SECRET',
+      'DISCORD_CALLBACK_URL',
+    ]),
+  },
+};

package/templates/prisma/src/app/errors/zodError.ts

@@ -1,20 +1,20 @@
-import { ZodError, ZodIssue } from 'zod'
-import { TErrorSources, TGenericErrorResponse } from '../types/error'
+import { ZodError, ZodIssue } from 'zod';
+import { TErrorSources, TGenericErrorResponse } from '../types/error.js';
 
 const handleZodError = (err: ZodError): TGenericErrorResponse => {
-    const errorSources: TErrorSources = err.issues.map((issue: ZodIssue) => {
-        return {
-            path: issue?.path[issue.path.length - 1] as string,
-            message: issue.message
-        }
-    })
-
-    const statusCode = 400
+  const errorSources: TErrorSources = err.issues.map((issue: ZodIssue) => {
     return {
-        statusCode,
-        message: 'Validation Error',
-        errorSources
-    }
-}
+      path: issue?.path[issue.path.length - 1] as string,
+      message: issue.message,
+    };
+  });
+
+  const statusCode = 400;
+  return {
+    statusCode,
+    message: 'Validation Error',
+    errorSources,
+  };
+};
 
-export default handleZodError
+export default handleZodError;

package/templates/prisma/src/app/lib/logger.ts

@@ -0,0 +1,12 @@
+import pino from 'pino';
+import { configs } from '../configs/index.js';
+
+export const logger = pino({
+  level: configs.is_test ? 'silent' : configs.env === 'development' ? 'debug' : 'info',
+  transport:
+    configs.env === 'development'
+      ? {
+          target: 'pino-pretty',
+        }
+      : undefined,
+});

package/templates/prisma/src/app/lib/prisma.ts

@@ -1,10 +1,8 @@
-import { PrismaPg } from "@prisma/adapter-pg";
-import "dotenv/config";
-import { PrismaClient } from "../../../prisma/generated/prisma/client";
+import { PrismaPg } from '@prisma/adapter-pg';
+import { PrismaClient } from '@prisma/client';
+import { configs } from '../configs/index.js';
 
-const connectionString = `${process.env.DATABASE_URL}`;
-
-const adapter = new PrismaPg({ connectionString });
+const adapter = new PrismaPg({ connectionString: configs.db_url as string });
 const prisma = new PrismaClient({ adapter });
 
 export { prisma };

package/templates/prisma/src/app/middlewares/auth.ts

@@ -1,25 +1,46 @@
-import { NextFunction, Request, Response } from "express";
-import { configs } from "../configs";
-import { AppError } from "../utils/app_error";
-import { jwtHelpers, JwtPayloadType } from "../utils/JWT";
+import type { ROLE } from '@prisma/client';
+import type { NextFunction, Request, Response } from 'express';
+import { configs } from '../configs/index.js';
+import { prisma } from '../lib/prisma.js';
+import { AppError } from '../utils/app_error.js';
+import { ACCESS_TOKEN_COOKIE } from '../utils/auth_cookie.js';
+import { type JwtPayloadType, jwtHelpers } from '../utils/JWT.js';
 
-type Role = "ADMIN" | "USER";
+const getToken = (req: Request): string | undefined => {
+  const header = req.headers.authorization;
+  if (header) return header.startsWith('Bearer ') ? header.slice(7) : header;
+  return req.cookies?.[ACCESS_TOKEN_COOKIE];
+};
 
-const auth = (...roles: Role[]) => {
-  return async (req: Request, res: Response, next: NextFunction) => {
+/**
+ * Requires a valid access token. With roles, also requires one of them:
+ * `auth()` = any signed-in user, `auth('ADMIN')` = admins only.
+ */
+const auth = (...roles: ROLE[]) => {
+  return async (req: Request, _res: Response, next: NextFunction) => {
     try {
-      const token = req.headers.authorization || req.cookies.access_token;
+      const token = getToken(req);
       if (!token) {
-        throw new AppError("You are not authorize!!", 401);
+        throw new AppError('You are not authorized', 401);
+      }
+
+      const payload = jwtHelpers.verifyToken<JwtPayloadType>(token, configs.jwt.access_token);
+
+      // tokens outlive account changes, so check the account is still active and
+      // the token wasn't revoked (password change/reset, sign out everywhere)
+      const account = await prisma.account.findUnique({
+        where: { id: payload.accountId },
+        select: { id: true, email: true, role: true, isDeleted: true, tokenVersion: true },
+      });
+      if (!account || account.isDeleted || account.tokenVersion !== payload.tv) {
+        throw new AppError('You are not authorized', 401);
       }
-      const verifiedUser = jwtHelpers.verifyToken(
-        token,
-        configs.jwt.access_token as string,
-      );
-      if (!roles.length || !roles.includes(verifiedUser.role)) {
-        throw new AppError("You are not authorize!!", 401);
+
+      if (roles.length && !roles.includes(account.role)) {
+        throw new AppError('You do not have permission to perform this action', 403);
       }
-      req.user = verifiedUser as JwtPayloadType;
+
+      req.user = { accountId: account.id, email: account.email, role: account.role };
       next();
     } catch (err) {
       next(err);