iec-cli 0.6.6

package/dist/templates/mga/{{name}}-api/catalog-info.yaml

@@ -0,0 +1,44 @@
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: {{name}}-api
+  description: {{description}} — API service
+  tags:
+    - tawa
+    - mga
+    - api
+    - express
+    - cyber-insurance
+  annotations:
+    insureco.io/framework: express
+    insureco.io/language: typescript
+    insureco.io/pod-tier: small
+spec:
+  type: service
+  lifecycle: production
+  owner: {{owner}}
+  databases:
+    - type: mongodb
+  auth:
+    mode: sso
+  routes:
+    - path: /api/products
+      methods: [GET, POST, PUT, DELETE]
+      auth: required
+      description: Cyber insurance product management
+    - path: /api/applications
+      methods: [GET, POST, PUT]
+      auth: required
+      description: Insurance application workflow
+    - path: /api/quotes
+      methods: [GET, POST]
+      auth: required
+      description: Quote generation and management
+    - path: /api/policies
+      methods: [GET, POST]
+      auth: required
+      description: Policy binding and management
+    - path: /api/reports
+      methods: [GET]
+      auth: required
+      description: Reporting and analytics

package/dist/templates/mga/{{name}}-api/gitignore

@@ -0,0 +1,31 @@
+# Dependencies
+node_modules/
+
+# Build output
+dist/
+
+# Environment files
+.env
+.env.local
+.env.*.local
+
+# Logs
+*.log
+npm-debug.log*
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Test coverage
+coverage/
+
+# Temporary files
+tmp/
+temp/

package/dist/templates/mga/{{name}}-api/helm/{{name}}-api/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: {{name}}-api
+description: Helm chart for {{name}}-api
+type: application
+version: 0.1.0
+appVersion: "1.0.0"
+maintainers:
+  - name: team-platform
+    email: platform@insureco.io

package/dist/templates/mga/{{name}}-api/helm/{{name}}-api/templates/deployment.yaml

@@ -0,0 +1,72 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+        app.kubernetes.io/name: {{ .Release.Name }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: {{ .Release.Name }}-config
+                optional: true
+            - secretRef:
+                name: {{ .Release.Name }}-secrets
+                optional: true
+            {{- if .Values.secretRef }}
+            - secretRef:
+                name: {{ .Values.secretRef }}
+            {{- end }}
+          {{- with .Values.env }}
+          env:
+            {{- range $key, $value := . }}
+            - name: {{ $key }}
+              value: {{ $value | quote }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

package/dist/templates/mga/{{name}}-api/helm/{{name}}-api/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ $.Release.Name }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

package/dist/templates/mga/{{name}}-api/helm/{{name}}-api/templates/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app: {{ .Release.Name }}

package/dist/templates/mga/{{name}}-api/helm/{{name}}-api/values.yaml

@@ -0,0 +1,65 @@
+replicaCount: 1
+
+image:
+  repository: registry.digitalocean.com/insureco/{{name}}-api
+  tag: latest
+  pullPolicy: IfNotPresent
+
+imagePullSecrets:
+  - name: insureco
+
+service:
+  type: ClusterIP
+  port: 3000
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 5
+  targetCPUUtilizationPercentage: 80
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+env: {}
+# Example:
+#   MONGODB_URI: mongodb://mongodb:27017/{{name}}
+#   BIO_ID_URL: https://bio.tawa.insureco.io
+
+secrets: {}
+# Example:
+#   JWT_SECRET: change-me-in-production
+
+ingress:
+  enabled: false
+  className: nginx
+  annotations: {}
+  hosts: []
+  tls: []
+
+secretRef: ""
+
+livenessProbe:
+  httpGet:
+    path: /health
+    port: 3000
+  initialDelaySeconds: 10
+  periodSeconds: 10
+
+readinessProbe:
+  httpGet:
+    path: /health
+    port: 3000
+  initialDelaySeconds: 5
+  periodSeconds: 5

package/dist/templates/mga/{{name}}-api/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "{{name}}-api",
+  "version": "0.1.0",
+  "description": "{{description}} — API service",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js",
+    "lint": "eslint src --ext .ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "express": "^4.21.0",
+    "cors": "^2.8.5",
+    "helmet": "^8.0.0",
+    "mongoose": "^8.9.0",
+    "zod": "^3.24.0",
+    "jsonwebtoken": "^9.0.2"
+  },
+  "devDependencies": {
+    "@types/cors": "^2.8.17",
+    "@types/express": "^5.0.0",
+    "@types/jsonwebtoken": "^9.0.7",
+    "@types/node": "^22.0.0",
+    "eslint": "^9.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.7.0",
+    "vitest": "^2.0.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/dist/templates/mga/{{name}}-api/src/index.ts

@@ -0,0 +1,82 @@
+import express, { type Request, type Response, type NextFunction } from 'express'
+import cors from 'cors'
+import helmet from 'helmet'
+import { connectToDatabase } from './lib/mongo.js'
+import { productsRouter } from './routes/products.js'
+import { agentsRouter } from './routes/agents.js'
+import { invitesRouter } from './routes/invites.js'
+import { applicationsRouter } from './routes/applications.js'
+import { quotesRouter } from './routes/quotes.js'
+import { policiesRouter } from './routes/policies.js'
+import { reportsRouter } from './routes/reports.js'
+
+const app = express()
+const PORT = process.env.PORT || 3000
+
+// Middleware
+app.use(helmet())
+app.use(cors())
+app.use(express.json())
+
+// Request logging
+app.use((req: Request, _res: Response, next: NextFunction) => {
+  const timestamp = new Date().toISOString()
+  process.stdout.write(`[${timestamp}] ${req.method} ${req.path}\n`)
+  next()
+})
+
+// Health check endpoint
+app.get('/health', (_req: Request, res: Response) => {
+  res.json({
+    status: 'healthy',
+    service: '{{name}}-api',
+    timestamp: new Date().toISOString(),
+    uptime: process.uptime(),
+  })
+})
+
+// API routes
+app.use('/api/products', productsRouter)
+app.use('/api/agents', agentsRouter)
+app.use('/api/invites', invitesRouter)
+app.use('/api/applications', applicationsRouter)
+app.use('/api/quotes', quotesRouter)
+app.use('/api/policies', policiesRouter)
+app.use('/api/reports', reportsRouter)
+
+// 404 handler
+app.use((_req: Request, res: Response) => {
+  res.status(404).json({
+    success: false,
+    error: {
+      code: 'NOT_FOUND',
+      message: 'The requested resource was not found',
+    },
+  })
+})
+
+// Error handler
+app.use((err: Error, _req: Request, res: Response, _next: NextFunction) => {
+  process.stderr.write(`Error: ${err.message}\n`)
+  res.status(500).json({
+    success: false,
+    error: {
+      code: 'INTERNAL_ERROR',
+      message: process.env.NODE_ENV === 'production'
+        ? 'An internal error occurred'
+        : err.message,
+    },
+  })
+})
+
+async function start(): Promise<void> {
+  await connectToDatabase()
+  app.listen(PORT, () => {
+    process.stdout.write(`{{name}}-api listening on port ${PORT}\n`)
+  })
+}
+
+start().catch((err: unknown) => {
+  process.stderr.write(`Failed to start: ${err instanceof Error ? err.message : String(err)}\n`)
+  process.exit(1)
+})

package/dist/templates/mga/{{name}}-api/src/lib/mongo.ts

@@ -0,0 +1,19 @@
+import mongoose from 'mongoose'
+
+const MONGODB_URI = process.env.MONGODB_URI ?? 'mongodb://localhost:27017/{{name}}'
+
+export async function connectToDatabase(): Promise<typeof mongoose> {
+  mongoose.connection.on('connected', () => {
+    process.stdout.write(`[mongodb] Connected to ${MONGODB_URI}\n`)
+  })
+
+  mongoose.connection.on('error', (err: unknown) => {
+    process.stderr.write(`[mongodb] Connection error: ${err instanceof Error ? err.message : String(err)}\n`)
+  })
+
+  mongoose.connection.on('disconnected', () => {
+    process.stdout.write('[mongodb] Disconnected\n')
+  })
+
+  return mongoose.connect(MONGODB_URI)
+}

package/dist/templates/mga/{{name}}-api/src/middleware/auth.ts

@@ -0,0 +1,133 @@
+import { type Request, type Response, type NextFunction } from 'express'
+import jwt from 'jsonwebtoken'
+
+export type MgaRole = 'mga_admin' | 'agent' | 'insured'
+
+export interface AuthUser {
+  id: string
+  email: string
+  name: string
+  roles: MgaRole[]
+  orgId: string
+}
+
+declare global {
+  namespace Express {
+    interface Request {
+      user?: AuthUser
+    }
+  }
+}
+
+function extractBearerToken(header: string | undefined): string | null {
+  if (!header) {
+    return null
+  }
+  const parts = header.split(' ')
+  if (parts.length !== 2 || parts[0] !== 'Bearer') {
+    return null
+  }
+  return parts[1] ?? null
+}
+
+function decodeUserFromPayload(payload: jwt.JwtPayload): AuthUser {
+  return {
+    id: String(payload.sub ?? payload.id ?? ''),
+    email: String(payload.email ?? ''),
+    name: String(payload.name ?? ''),
+    roles: Array.isArray(payload.roles)
+      ? payload.roles.filter((r): r is MgaRole =>
+          typeof r === 'string' && ['mga_admin', 'agent', 'insured'].includes(r)
+        )
+      : [],
+    orgId: String(payload.orgId ?? payload.org_id ?? ''),
+  }
+}
+
+/**
+ * JWT authentication middleware.
+ *
+ * In production, Janus (the API gateway) verifies the token before it reaches
+ * this service. The middleware decodes the payload and attaches user context.
+ *
+ * In development, it falls back to HS256 verification with JWT_SECRET.
+ */
+export function authMiddleware(req: Request, res: Response, next: NextFunction): void {
+  const token = extractBearerToken(req.headers.authorization)
+
+  if (!token) {
+    res.status(401).json({
+      success: false,
+      error: {
+        code: 'UNAUTHORIZED',
+        message: 'Missing or invalid authorization header',
+      },
+    })
+    return
+  }
+
+  try {
+    const secret = process.env.JWT_SECRET ?? 'dev-secret-change-in-production'
+    const payload = jwt.verify(token, secret, { algorithms: ['HS256'] }) as jwt.JwtPayload
+    req.user = decodeUserFromPayload(payload)
+    next()
+  } catch {
+    // In production behind Janus, try decoding without verification
+    // since the gateway already validated the token
+    if (process.env.NODE_ENV === 'production') {
+      try {
+        const payload = jwt.decode(token) as jwt.JwtPayload | null
+        if (payload) {
+          req.user = decodeUserFromPayload(payload)
+          next()
+          return
+        }
+      } catch {
+        // fall through to 401
+      }
+    }
+
+    res.status(401).json({
+      success: false,
+      error: {
+        code: 'UNAUTHORIZED',
+        message: 'Invalid or expired token',
+      },
+    })
+  }
+}
+
+/**
+ * Role authorization middleware. Requires at least one of the specified roles.
+ */
+export function requireRole(...roles: MgaRole[]) {
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const user = req.user
+
+    if (!user) {
+      res.status(401).json({
+        success: false,
+        error: {
+          code: 'UNAUTHORIZED',
+          message: 'Authentication required',
+        },
+      })
+      return
+    }
+
+    const hasRole = user.roles.some((r) => roles.includes(r))
+
+    if (!hasRole) {
+      res.status(403).json({
+        success: false,
+        error: {
+          code: 'FORBIDDEN',
+          message: 'Insufficient permissions',
+        },
+      })
+      return
+    }
+
+    next()
+  }
+}

package/dist/templates/mga/{{name}}-api/src/models/agent.ts

@@ -0,0 +1,45 @@
+import mongoose, { type Document, Schema } from 'mongoose'
+
+export type AgentStatus = 'active' | 'suspended' | 'inactive'
+
+export interface IAgent extends Document {
+  userId: string
+  email: string
+  firstName: string
+  lastName: string
+  licenseNumber: string
+  licenseState: string
+  status: AgentStatus
+  invitedBy: string
+  applicationCount: number
+  policyCount: number
+  totalPremium: number
+  createdAt: Date
+  updatedAt: Date
+}
+
+const agentSchema = new Schema<IAgent>(
+  {
+    userId: { type: String, required: true, unique: true },
+    email: { type: String, required: true, unique: true, lowercase: true, trim: true },
+    firstName: { type: String, required: true, trim: true },
+    lastName: { type: String, required: true, trim: true },
+    licenseNumber: { type: String, required: true },
+    licenseState: { type: String, required: true, maxlength: 2 },
+    status: {
+      type: String,
+      enum: ['active', 'suspended', 'inactive'],
+      default: 'active',
+    },
+    invitedBy: { type: String, required: true },
+    applicationCount: { type: Number, default: 0 },
+    policyCount: { type: Number, default: 0 },
+    totalPremium: { type: Number, default: 0 },
+  },
+  { timestamps: true },
+)
+
+agentSchema.index({ status: 1 })
+agentSchema.index({ licenseState: 1 })
+
+export const Agent = mongoose.model<IAgent>('Agent', agentSchema)

package/dist/templates/mga/{{name}}-api/src/models/application.ts

@@ -0,0 +1,58 @@
+import mongoose, { type Document, Schema } from 'mongoose'
+
+export type ApplicationStatus =
+  | 'draft'
+  | 'submitted'
+  | 'quoted'
+  | 'bound'
+  | 'declined'
+  | 'expired'
+
+export interface IApplication extends Document {
+  applicantName: string
+  applicantEmail: string
+  companyName: string
+  industry: string
+  employeeCount: number
+  annualRevenue: number
+  currentCoverage: boolean
+  previousClaims: number
+  requestedCoverageLimit: number
+  status: ApplicationStatus
+  agentId: string
+  productId: string
+  notes: string
+  state: string
+  createdAt: Date
+  updatedAt: Date
+}
+
+const applicationSchema = new Schema<IApplication>(
+  {
+    applicantName: { type: String, required: true, trim: true },
+    applicantEmail: { type: String, required: true, lowercase: true, trim: true },
+    companyName: { type: String, required: true, trim: true },
+    industry: { type: String, required: true },
+    employeeCount: { type: Number, required: true, min: 1 },
+    annualRevenue: { type: Number, required: true, min: 0 },
+    currentCoverage: { type: Boolean, default: false },
+    previousClaims: { type: Number, default: 0, min: 0 },
+    requestedCoverageLimit: { type: Number, required: true, min: 0 },
+    status: {
+      type: String,
+      enum: ['draft', 'submitted', 'quoted', 'bound', 'declined', 'expired'],
+      default: 'draft',
+    },
+    agentId: { type: String, required: true },
+    productId: { type: String, required: true },
+    notes: { type: String, default: '' },
+    state: { type: String, required: true, maxlength: 2, minlength: 2 },
+  },
+  { timestamps: true },
+)
+
+applicationSchema.index({ agentId: 1, status: 1 })
+applicationSchema.index({ status: 1 })
+applicationSchema.index({ applicantEmail: 1 })
+
+export const Application = mongoose.model<IApplication>('Application', applicationSchema)