exp-node-server 1.1.7 → 2.0.0

package/templates/prisma/src/app/utils/cloudinary.ts

@@ -1,66 +1,33 @@
-import { v2 as cloudinary } from 'cloudinary';
-import fs from 'fs';
-import { configs } from '../configs';
+import { v2 as cloudinary, type UploadApiResponse } from 'cloudinary';
+import { configs } from '../configs/index.js';
+import { AppError } from './app_error.js';
 
-type ICloudinaryResponse = {
-    asset_id: string;
-    public_id: string;
-    version: number;
-    version_id: string;
-    signature: string;
-    width: number;
-    height: number;
-    format: string;
-    resource_type: string;
-    created_at: string;
-    tags: string[];
-    bytes: number;
-    type: string;
-    etag: string;
-    placeholder: boolean;
-    url: string;
-    secure_url: string;
-    folder: string;
-    overwritten: boolean;
-    original_filename: string;
-    original_extension: string;
-    api_key: string;
-};
-
-type IFile = {
-    fieldname: string;
-    originalname: string;
-    encoding: string;
-    mimetype: string;
-    destination: string;
-    filename: string;
-    path: string;
-    size: number;
-};
+const { cloud_name, cloud_api_key, cloud_api_secret } = configs.cloudinary;
+const isConfigured = Boolean(cloud_name && cloud_api_key && cloud_api_secret);
 
-// Configuration
 cloudinary.config({
-    cloud_name: configs.cloudinary.cloud_name!,
-    api_key: configs.cloudinary.cloud_api_key!,
-    api_secret: configs.cloudinary.cloud_api_secret!,
+  cloud_name,
+  api_key: cloud_api_key,
+  api_secret: cloud_api_secret,
 });
 
-const uploadCloud = async (
-    file: IFile
-): Promise<ICloudinaryResponse | undefined> => {
-    return new Promise((resolve, reject) => {
-        cloudinary.uploader.upload(
-            file.path,
-            (error: Error, result: ICloudinaryResponse) => {
-                fs.unlinkSync(file.path);
-                if (error) {
-                    reject(error);
-                } else {
-                    resolve(result);
-                }
-            }
-        );
-    });
+/**
+ * Streams an in-memory image to Cloudinary. `resource_type: 'image'` makes
+ * Cloudinary reject anything that isn't really an image, whatever its mimetype said.
+ */
+const uploadCloud = (file: Express.Multer.File, folder = 'uploads'): Promise<UploadApiResponse> => {
+  if (!isConfigured) {
+    return Promise.reject(new AppError('Image upload is not configured', 503));
+  }
+
+  return new Promise((resolve, reject) => {
+    cloudinary.uploader
+      .upload_stream({ resource_type: 'image', folder }, (error, result) => {
+        if (error || !result) return reject(error ?? new Error('Upload failed'));
+        resolve(result);
+      })
+      .end(file.buffer);
+  });
 };
 
-export default uploadCloud;
+export default uploadCloud;

package/templates/prisma/src/app/utils/mail_sender.ts

@@ -1,102 +1,36 @@
 import nodemailer from 'nodemailer';
-import { configs } from '../configs';
+import { configs } from '../configs/index.js';
+
 type TMailContent = {
-    to: string,
-    subject: string,
-    textBody: string,
-    htmlBody: string,
-    name?: string
-}
+  to: string;
+  subject: string;
+  textBody: string;
+  htmlBody: string;
+};
 
 const transporter = nodemailer.createTransport({
-    host: "smtp.gmail.com",
-    port: 465,
-    secure: true, // true for 465, false for other ports
-    auth: {
-        user: configs.email.app_email!,
-        pass: configs.email.app_password!,
-    },
+  host: 'smtp.gmail.com',
+  port: 465,
+  secure: true, // true for 465, false for other ports
+  auth: {
+    user: configs.email.app_email,
+    pass: configs.email.app_password,
+  },
 });
 
-// ✅ Email Sender Function
+// Email Sender Function
 const sendMail = async (payload: TMailContent) => {
-    const info = await transporter.sendMail({
-        from: 'info@digitalcreditai.com',
-        to: payload.to,
-        subject: payload.subject,
-        text: payload.textBody,
-        html: `
-        <!DOCTYPE html>
-<html lang="en">
-
-<head>
-    <meta charset="UTF-8">
-    <title>Welcome Email</title>
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <style>
-        * {
-            margin: 0;
-            padding: 0;
-            box-sizing: border-box;
-        }
-
-        /* Fallback styles for unsupported clients (some email clients ignore <style> tags) */
-        @media only screen and (max-width: 600px) {
-            .container {
-                padding: 20px !important;
-            }
-
-            .btn {
-                padding: 12px 18px !important;
-                font-size: 16px !important;
-            }
-        }
-    </style>
-</head>
-
-<body
-    style="margin: 0; padding: 0;  font-family: Arial, sans-serif;">
-
-    <div style="max-width: 600px; margin: 40px auto; background-color: #f4f4f4; padding: 40px; border-radius: 8px; box-shadow: 0 2px 8px rgba(0,0,0,0.05);"
-        class="container">
-
-        <div style="font-size: 16px; color: #555555; line-height: 1.6;">
-            <p style="margin-bottom: 30px;">Hi <strong>${payload?.name || ""}</strong>,</p>
-
-            ${payload?.htmlBody}
-
-            <div
-                style=" margin-top: 60px; text-align: center;">
-                
-                    <img style="width: 50px; height: 50px; border-radius: 50%;"
-                        src="https://imgs.search.brave.com/IZoN38NQxnIIuB1I9E70bW6q5OvbEtz68YaxTe1j-o0/rs:fit:860:0:0:0/g:ce/aHR0cHM6Ly9lbGVt/ZW50cy1yZXNpemVk/LmVudmF0b3VzZXJj/b250ZW50LmNvbS9l/bGVtZW50cy1jb3Zl/ci1pbWFnZXMvMjhi/NmVjMTQtMGMwOS00/NGY1LWE5NGUtNmIy/OTM5NTZkMDM2P3c9/NDMzJmNmX2ZpdD1z/Y2FsZS1kb3duJnE9/ODUmZm9ybWF0PWF1/dG8mcz04Mjc0OWYy/ZDUyMmJiM2NlMjNi/OWNhNjhlZmFhNjdk/MTg5OGI4NWIwNzBh/MjQ1NjM4NmI1ZmFj/NWVmNmM5ZTNl"
-                        alt="">
-               
-                <p style="font-size: 12px;">The Support Team</p>
-                <h3>Company Name</h3>
-            </div>
-        </div>
-        <p style="font-size: 14px; color: #999999; margin-top: 20px; margin-bottom: 10px; text-align: center;">
-            This is an automated message — please do not reply to this email.
-            <br>
-            If you need assistance, feel free to contact our support team.
-            <br><br>
-            Thank you for choosing us!
-        </p>
-
-        <hr>
-        <div style="text-align: center; font-size: 12px; color: #999999; margin-top: 20px;">
-            &copy; {{year}} Your Company. All rights reserved.
-        </div>
-
-    </div>
-</body>
-
-</html>
-        
-        `,
-    });
-    return info
+  if (!configs.email.app_email || !configs.email.app_password) {
+    throw new Error('Email is not configured. Set APP_USER_EMAIL and APP_PASSWORD.');
+  }
+
+  return transporter.sendMail({
+    from: configs.email.from,
+    to: payload.to,
+    subject: payload.subject,
+    text: payload.textBody,
+    html: payload.htmlBody,
+  });
 };
 
 export default sendMail;

package/templates/prisma/src/app/utils/manage_response.ts

@@ -1,24 +1,24 @@
-import { Response } from "express"
+import { Response } from 'express';
 interface IResponse<T> {
-    success: boolean,
-    statusCode: number,
-    message: string,
-    data?: T,
-    meta?: {
-        page?: number,
-        limit?: number,
-        skip?: number,
-        total?: number
-    }
+  success: boolean;
+  statusCode: number;
+  message: string;
+  data?: T;
+  meta?: {
+    page?: number;
+    limit?: number;
+    skip?: number;
+    total?: number;
+  };
 }
 
 const manageResponse = <T>(res: Response, payload: IResponse<T>) => {
-    res.status(payload.statusCode).json({
-        success: payload.success,
-        message: payload.message,
-        data: payload.data || undefined || null,
-        meta: payload.meta || undefined || null
-    })
-}
+  res.status(payload.statusCode).json({
+    success: payload.success,
+    message: payload.message,
+    data: payload.data ?? null,
+    meta: payload.meta ?? null,
+  });
+};
 
-export default manageResponse
+export default manageResponse;

package/templates/prisma/src/app/utils/otp.ts

@@ -0,0 +1,20 @@
+import { createHmac, randomInt, timingSafeEqual } from 'node:crypto';
+import { configs } from '../configs/index.js';
+
+export const OTP_EXPIRY_MS = 5 * 60 * 1000;
+export const OTP_MAX_ATTEMPTS = 5;
+export const OTP_RESEND_COOLDOWN_MS = 60 * 1000;
+
+/** A cryptographically random 6-digit code. */
+export const generateOtp = (): string => randomInt(0, 1_000_000).toString().padStart(6, '0');
+
+/** OTPs are stored as an HMAC, never in plain text. */
+export const hashOtp = (otp: string): string =>
+  createHmac('sha256', configs.jwt.verified_token).update(otp).digest('hex');
+
+export const isOtpMatch = (otp: string, storedHash: string | null): boolean => {
+  if (!storedHash) return false;
+  const a = Buffer.from(hashOtp(otp), 'hex');
+  const b = Buffer.from(storedHash, 'hex');
+  return a.length === b.length && timingSafeEqual(a, b);
+};

package/templates/prisma/src/app/utils/session.ts

@@ -0,0 +1,57 @@
+import type { CookieOptions, Request, Response } from 'express';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { configs } from '../configs/index.js';
+import { prisma } from '../lib/prisma.js';
+import { clearAccessToken, issueAccessToken } from './auth_cookie.js';
+import type { TokenUser } from './JWT.js';
+
+export const REFRESH_TOKEN_COOKIE = 'refresh_token';
+
+const refreshCookieOptions: CookieOptions = {
+  httpOnly: true,
+  secure: configs.is_production,
+  sameSite: 'lax',
+  // only sent to the auth routes (refresh, sign out), never to the rest of the API
+  path: '/api/auth',
+};
+
+export const hashRefreshToken = (token: string) => createHash('sha256').update(token).digest('hex');
+
+/** The refresh token from the cookie (browsers) or the body (mobile / other clients). */
+export const readRefreshToken = (req: Request): string | undefined => {
+  const token = req.cookies?.[REFRESH_TOKEN_COOKIE] ?? req.body?.refreshToken;
+  return typeof token === 'string' && token ? token : undefined;
+};
+
+/**
+ * Signs `user` in: a new access token plus a refresh token, both set as httpOnly
+ * cookies and returned. Pass `familyId` when rotating, so the new refresh token
+ * belongs to the same session.
+ */
+export const createSession = async (
+  res: Response,
+  user: TokenUser,
+  familyId: string = randomUUID(),
+) => {
+  const refreshToken = randomBytes(32).toString('base64url');
+  const expiresAt = new Date(Date.now() + configs.jwt.refresh_expires_days * 24 * 60 * 60 * 1000);
+
+  await prisma.refreshToken.create({
+    data: {
+      tokenHash: hashRefreshToken(refreshToken),
+      accountId: user.accountId,
+      familyId,
+      tokenVersion: user.tokenVersion,
+      expiresAt,
+    },
+  });
+
+  res.cookie(REFRESH_TOKEN_COOKIE, refreshToken, { ...refreshCookieOptions, expires: expiresAt });
+  const accessToken = issueAccessToken(res, user);
+  return { accessToken, refreshToken };
+};
+
+export const clearSessionCookies = (res: Response) => {
+  clearAccessToken(res);
+  res.clearCookie(REFRESH_TOKEN_COOKIE, refreshCookieOptions);
+};

package/templates/prisma/src/app.ts

@@ -1,42 +1,73 @@
-import cookieParser from 'cookie-parser';
-import cors from 'cors';
-import express, { Request, Response } from 'express';
-import swaggerJSDoc from 'swagger-jsdoc';
-import swaggerUi from "swagger-ui-express";
-import globalErrorHandler from './app/middlewares/global_error_handler';
-import notFound from './app/middlewares/not_found_api';
-import appRouter from './routes';
-import { swaggerOptions } from './swaggerOptions';
-
-// define app
-const app = express()
-const swaggerSpec = swaggerJSDoc(swaggerOptions);
-app.use("/docs", swaggerUi.serve, swaggerUi.setup(swaggerSpec));
-
-// middleware
-app.use(cors({
-    origin: ["http://localhost:3000"],
-    methods: ["GET", "POST", "PATCH", "DELETE", "PUT"],
-    credentials: true
-}))
-app.use(express.json({ limit: "100mb" }))
-app.use(express.raw())
-app.use(cookieParser())
-app.use(express.urlencoded({ extended: true }));
-app.use("/api", appRouter)
-
-// stating point
-app.get('/', (req: Request, res: Response) => {
-    res.status(200).json({
-        status: 'success',
-        message: 'Server is running successful !!',
-        data: null,
-    });
-});
-
-// global error handler
-app.use(globalErrorHandler);
-app.use(notFound);
-
-// export app
-export default app;
+import cookieParser from 'cookie-parser';
+import cors from 'cors';
+import express, { type Request, type Response } from 'express';
+import helmet from 'helmet';
+import swaggerJSDoc from 'swagger-jsdoc';
+import swaggerUi from 'swagger-ui-express';
+import { configs } from './app/configs/index.js';
+import globalErrorHandler from './app/middlewares/global_error_handler.js';
+import notFound from './app/middlewares/not_found_api.js';
+import { apiRateLimiter } from './app/middlewares/rate_limiter.js';
+import { setupPassport } from './app/passport-js/index.js';
+import manageResponse from './app/utils/manage_response.js';
+import appRouter from './routes.js';
+import { swaggerOptions } from './swaggerOptions.js';
+
+// define app
+const app = express();
+
+// number of reverse proxies in front of the app (e.g. 1 behind Caddy/Nginx), so
+// req.ip and rate limiting see the real client IP. Keep 0 when exposed directly.
+app.set('trust proxy', configs.trust_proxy);
+app.disable('x-powered-by');
+
+// security headers
+app.use(helmet());
+
+// swagger docs (disabled in production unless ENABLE_SWAGGER=true)
+if (configs.enable_swagger) {
+  const swaggerSpec = swaggerJSDoc(swaggerOptions);
+  app.use(
+    '/docs',
+    helmet({ contentSecurityPolicy: false }),
+    swaggerUi.serve,
+    swaggerUi.setup(swaggerSpec),
+  );
+}
+
+// cors middleware
+app.use(
+  cors({
+    origin: configs.cors_origins,
+    methods: ['GET', 'POST', 'PATCH', 'DELETE', 'PUT'],
+    credentials: true,
+  }),
+);
+
+// express middleware
+app.use(express.json({ limit: '1mb' }));
+app.use(express.urlencoded({ extended: true, limit: '1mb' }));
+app.use(cookieParser());
+
+// passport js (social login)
+setupPassport(app);
+
+// Main router (stricter per-route limits live on the auth routes)
+app.use('/api', apiRateLimiter, appRouter);
+
+// stating point
+app.get('/', (_req: Request, res: Response) => {
+  manageResponse(res, {
+    statusCode: 200,
+    success: true,
+    message: 'Server is running successful !!',
+    data: null,
+  });
+});
+
+// not found, then global error handler (must be last)
+app.use(notFound);
+app.use(globalErrorHandler);
+
+// export app
+export default app;

package/templates/prisma/src/routes.ts

@@ -1,11 +1,13 @@
-import { Router } from "express";
-import accountRouter from "./app/modules/account/account.route";
-import profileRoute from "./app/modules/profile/profile.route";
-
-const appRouter = Router();
-
+import { Router } from 'express';
+import accountRouter from './app/modules/account/account.route.js';
+import profileRoute from './app/modules/profile/profile.route.js';
+
+const appRouter = Router();
+
 const moduleRoutes = [
-  { path: "/profile", route: profileRoute },{ path: "/auth", route: accountRouter }];
-
-moduleRoutes.forEach((route) => appRouter.use(route.path, route.route));
-export default appRouter;
+  { path: '/profile', route: profileRoute },
+  { path: '/auth', route: accountRouter },
+];
+
+moduleRoutes.forEach((route) => appRouter.use(route.path, route.route));
+export default appRouter;

package/templates/prisma/src/server.ts

@@ -1,19 +1,37 @@
-import app from "./app";
-import { configs } from "./app/configs/index";
-import { prisma } from "./app/lib/prisma";
-
-async function main() {
-  try {
-    app.listen(configs.port, async () => {
-      await prisma.$connect();
-      console.log(`Server is running on port ${configs.port}`);
-    });
-  } catch (error) {
-    console.error("Error starting server:", error);
-  }
-}
-
-main().catch((error) => {
-  console.error("Error in main function:", error);
-  process.exit(1);
-});
+import type { Server } from 'node:http';
+import app from './app.js';
+import { configs } from './app/configs/index.js';
+import { logger } from './app/lib/logger.js';
+import { prisma } from './app/lib/prisma.js';
+import { startQueues, stopQueues } from './app/queues/index.js';
+
+let server: Server | undefined;
+
+async function main() {
+  await prisma.$connect();
+  await startQueues();
+
+  server = app.listen(configs.port, '0.0.0.0', () => {
+    logger.info(`Server is running on port ${configs.port}`);
+  });
+}
+
+async function shutdown(signal: string) {
+  logger.info(`${signal} received, shutting down...`);
+  // stop accepting connections and let in-flight requests finish
+  await new Promise<void>((resolve) => (server ? server.close(() => resolve()) : resolve()));
+  await stopQueues().catch((err) => logger.error(err, 'Error stopping queues'));
+  await prisma.$disconnect();
+  process.exit(0);
+}
+
+process.on('SIGTERM', () => void shutdown('SIGTERM'));
+process.on('SIGINT', () => void shutdown('SIGINT'));
+process.on('unhandledRejection', (reason) => {
+  logger.error(reason, 'Unhandled promise rejection');
+});
+
+main().catch((error) => {
+  logger.error(error, 'Failed to start server');
+  process.exit(1);
+});

package/templates/prisma/src/swaggerOptions.ts

@@ -1,35 +1,36 @@
-import { fileURLToPath } from "node:url";
-import path from "path";
-import { configs } from "./app/configs";
-import { accountSwaggerDocs } from "./app/modules/account/account.swagger";
-import { profileSwaggerDocs } from "./app/modules/profile/profile.swagger";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
+import { configs } from './app/configs/index.js';
+import { accountSwaggerDocs } from './app/modules/account/account.swagger.js';
+import { profileSwaggerDocs } from './app/modules/profile/profile.swagger.js';
 
 export const swaggerOptions = {
   definition: {
-    openapi: "3.0.0",
+    openapi: '3.0.0',
     info: {
-      title: "API Doc - Build with exp-node-server",
-      version: "1.0.0",
-      description: "Express + Prisma API with auto-generated Swagger docs",
+      title: 'API Doc - Build with exp-node-server',
+      version: '1.0.0',
+      description: 'Express + Prisma API with auto-generated Swagger docs',
     },
     paths: {
       ...accountSwaggerDocs,
-          ...profileSwaggerDocs,
+      ...profileSwaggerDocs,
     },
     servers:
-      configs.env === "production"
-        ? [{ url: "https://live-url.com" }, { url: "http://localhost:5000" }]
-        : [{ url: "http://localhost:5000" }, { url: "https://live-url.com" }],
+      configs.env === 'production'
+        ? [
+            { url: configs.swagger_config.production_base_url },
+            { url: configs.swagger_config.development_base_url },
+          ]
+        : [
+            { url: configs.swagger_config.development_base_url },
+            { url: configs.swagger_config.production_base_url },
+          ],
     components: {
       securitySchemes: {
         AuthorizationToken: {
-          type: "apiKey",
-          in: "header",
-          name: "Authorization",
-          description: "Put your accessToken here ",
+          type: 'apiKey',
+          in: 'header',
+          name: 'Authorization',
+          description: 'Put your accessToken here ',
         },
       },
     },
@@ -39,10 +40,5 @@ export const swaggerOptions = {
       },
     ],
   },
-  apis: [
-    path.join(
-      __dirname,
-      configs.env === "production" ? "./**/*.js" : "./**/*.ts",
-    ),
-  ],
+  apis: [],
 };