insforge 0.3.3 → 1.3.0

package/backend/tests/unit/rate-limit.test.ts

@@ -0,0 +1,154 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { Request, Response } from 'express';
+import { perEmailCooldown } from '../../src/api/middleware/rate-limiters';
+import { AppError } from '../../src/api/middleware/error';
+
+describe('Rate Limit Middleware', () => {
+  describe('perEmailCooldown', () => {
+    let req: Partial<Request>;
+    let res: Partial<Response>;
+    let next: ReturnType<typeof vi.fn>;
+
+    beforeEach(() => {
+      req = {
+        body: {},
+      };
+      res = {};
+      next = vi.fn();
+    });
+
+    it('allows first request for an email', () => {
+      req.body = { email: 'test@example.com' };
+      const middleware = perEmailCooldown(60000);
+
+      middleware(req as Request, res as Response, next);
+
+      expect(next).toHaveBeenCalledOnce();
+      expect(next).toHaveBeenCalledWith();
+    });
+
+    it('blocks second request within cooldown period', () => {
+      req.body = { email: 'test2@example.com' };
+      const middleware = perEmailCooldown(60000);
+
+      // First request should pass
+      middleware(req as Request, res as Response, next);
+      expect(next).toHaveBeenCalledOnce();
+
+      // Second request should be blocked
+      expect(() => {
+        middleware(req as Request, res as Response, next);
+      }).toThrow(AppError);
+
+      expect(() => {
+        middleware(req as Request, res as Response, next);
+      }).toThrow(/Please wait.*seconds before requesting another code/);
+    });
+
+    it('allows request after cooldown period expires', async () => {
+      req.body = { email: 'test3@example.com' };
+      const shortCooldown = 100; // 100ms cooldown
+      const middleware = perEmailCooldown(shortCooldown);
+
+      // First request
+      middleware(req as Request, res as Response, next);
+      expect(next).toHaveBeenCalledTimes(1);
+
+      // Wait for cooldown to expire
+      await new Promise((resolve) => setTimeout(resolve, shortCooldown + 10));
+
+      // Second request after cooldown should pass
+      middleware(req as Request, res as Response, next);
+      expect(next).toHaveBeenCalledTimes(2);
+    });
+
+    it('treats emails case-insensitively', () => {
+      const middleware = perEmailCooldown(60000);
+      const uniqueEmail = `case-test-${Date.now()}@example.com`;
+
+      // First request with mixed case
+      req.body = { email: uniqueEmail.toUpperCase() };
+      middleware(req as Request, res as Response, next);
+      expect(next).toHaveBeenCalledOnce();
+
+      // Second request with lowercase should be blocked
+      req.body = { email: uniqueEmail.toLowerCase() };
+      expect(() => {
+        middleware(req as Request, res as Response, next);
+      }).toThrow(AppError);
+    });
+
+    it('allows requests for different emails', () => {
+      const middleware = perEmailCooldown(60000);
+
+      // Request for first email
+      req.body = { email: 'user1@example.com' };
+      middleware(req as Request, res as Response, next);
+      expect(next).toHaveBeenCalledTimes(1);
+
+      // Request for second email should also pass
+      req.body = { email: 'user2@example.com' };
+      middleware(req as Request, res as Response, next);
+      expect(next).toHaveBeenCalledTimes(2);
+    });
+
+    it('passes through when no email in body', () => {
+      req.body = {}; // No email
+      const middleware = perEmailCooldown(60000);
+
+      middleware(req as Request, res as Response, next);
+
+      expect(next).toHaveBeenCalledOnce();
+      expect(next).toHaveBeenCalledWith();
+    });
+
+    it('calculates remaining cooldown time correctly', () => {
+      req.body = { email: 'timing@example.com' };
+      const cooldownMs = 60000;
+      const middleware = perEmailCooldown(cooldownMs);
+
+      // First request
+      middleware(req as Request, res as Response, next);
+
+      // Try second request immediately
+      try {
+        middleware(req as Request, res as Response, next);
+      } catch (error) {
+        if (error instanceof AppError) {
+          // Should show approximately 60 seconds remaining
+          expect(error.message).toMatch(/wait (\d+) seconds/);
+          const match = error.message.match(/wait (\d+) seconds/);
+          if (match) {
+            const seconds = parseInt(match[1]);
+            expect(seconds).toBeGreaterThanOrEqual(59);
+            expect(seconds).toBeLessThanOrEqual(60);
+          }
+        }
+      }
+    });
+
+    it('uses custom cooldown duration', () => {
+      req.body = { email: 'custom@example.com' };
+      const customCooldown = 30000; // 30 seconds
+      const middleware = perEmailCooldown(customCooldown);
+
+      // First request
+      middleware(req as Request, res as Response, next);
+
+      // Second request should show 30 second cooldown
+      try {
+        middleware(req as Request, res as Response, next);
+      } catch (error) {
+        if (error instanceof AppError) {
+          expect(error.message).toMatch(/wait \d+ seconds/);
+          const match = error.message.match(/wait (\d+) seconds/);
+          if (match) {
+            const seconds = parseInt(match[1]);
+            expect(seconds).toBeGreaterThanOrEqual(29);
+            expect(seconds).toBeLessThanOrEqual(30);
+          }
+        }
+      }
+    });
+  });
+});

package/backend/tests/unit/response.test.ts

@@ -0,0 +1,58 @@
+import { successResponse, errorResponse, paginatedResponse } from '../../src/utils/response';
+import { Response } from 'express';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+describe('Response Utilities', () => {
+  let res: Partial<Response>;
+
+  beforeEach(() => {
+    res = {
+      status: vi.fn().mockReturnThis(),
+      json: vi.fn().mockReturnThis(),
+      setHeader: vi.fn().mockReturnThis(),
+    };
+  });
+
+  it('successResponse returns data with correct status', () => {
+    const data = { message: 'ok' };
+    successResponse(res as Response, data, 201);
+    expect(res.status).toHaveBeenCalledWith(201);
+    expect(res.json).toHaveBeenCalledWith(data);
+  });
+
+  it('errorResponse returns error with correct status', () => {
+    const error = 'ERROR';
+    const message = 'Something went wrong';
+    errorResponse(res as Response, error, message, 400, 'Retry');
+    expect(res.status).toHaveBeenCalledWith(400);
+    expect(res.json).toHaveBeenCalledWith({
+      error,
+      message,
+      statusCode: 400,
+      nextActions: 'Retry',
+    });
+  });
+
+  it('paginatedResponse sets headers and status correctly', () => {
+    const data = [1, 2, 3];
+    const total = 10;
+    const offset = 0;
+
+    paginatedResponse(res as Response, data, total, offset);
+
+    expect(res.setHeader).toHaveBeenCalledWith('Content-Range', '0-2/10');
+    expect(res.setHeader).toHaveBeenCalledWith('Preference-Applied', 'count=exact');
+    expect(res.status).toHaveBeenCalledWith(206); // partial content
+    expect(res.json).toHaveBeenCalledWith(data);
+  });
+
+  it('paginatedResponse returns 200 when all items returned', () => {
+    const data = [1, 2, 3];
+    const total = 3;
+    const offset = 0;
+
+    paginatedResponse(res as Response, data, total, offset);
+
+    expect(res.status).toHaveBeenCalledWith(200);
+  });
+});

package/backend/tests/unit/sql-parser.test.ts

@@ -0,0 +1,74 @@
+import { describe, it, expect } from 'vitest';
+import { parseSQLStatements } from '../../src/utils/sql-parser';
+
+describe('parseSQLStatements', () => {
+  it('splits multiple statements by semicolon', () => {
+    const sql = `
+      SELECT * FROM users;
+      INSERT INTO users (name) VALUES ('John');
+      DELETE FROM users WHERE id = 1;
+    `;
+    const result = parseSQLStatements(sql);
+    expect(result).toEqual([
+      'SELECT * FROM users',
+      "INSERT INTO users (name) VALUES ('John')",
+      'DELETE FROM users WHERE id = 1',
+    ]);
+  });
+
+  it('ignores line comments', () => {
+    const sql = `
+      -- This is a comment
+      SELECT * FROM users; -- Inline comment
+    `;
+    const result = parseSQLStatements(sql);
+    // Parser returns the statement with comments filtered out
+    expect(result).toHaveLength(1);
+    expect(result[0]).toContain('SELECT * FROM users');
+  });
+
+  it('ignores block comments', () => {
+    const sql = `
+      /* Block comment */
+      SELECT * FROM users;
+      /* Another comment */
+    `;
+    const result = parseSQLStatements(sql);
+    // Parser returns the statement with comments filtered out
+    expect(result).toHaveLength(1);
+    expect(result[0]).toContain('SELECT * FROM users');
+  });
+
+  it('handles semicolons inside string literals', () => {
+    const sql = `INSERT INTO messages (text) VALUES ('Hello; World')`;
+    const result = parseSQLStatements(sql);
+    // Parser includes the trailing semicolon
+    expect(result).toEqual([`INSERT INTO messages (text) VALUES ('Hello; World')`]);
+  });
+
+  it('throws error on empty input', () => {
+    expect(() => parseSQLStatements('')).toThrow();
+  });
+
+  it('returns empty array for comments-only SQL', () => {
+    const sql = `
+      -- Only comment
+      /* Another comment */
+    `;
+    const result = parseSQLStatements(sql);
+    // Parser filters out comment-only content
+    expect(result).toEqual([]);
+  });
+
+  it('trims statements and removes empty results', () => {
+    const sql = `
+      SELECT * FROM users;
+      -- comment
+      INSERT INTO users (id) VALUES (1);
+    `;
+    const result = parseSQLStatements(sql);
+    expect(result.length).toBeGreaterThan(0);
+    expect(result[0]).toContain('SELECT * FROM users');
+    expect(result[result.length - 1] || result[0]).toContain('INSERT INTO users');
+  });
+});

package/backend/tests/unit/uuid.test.ts

@@ -0,0 +1,21 @@
+import { describe, test, expect } from 'vitest';
+import { generateUUID } from '../../src/utils/utils';
+
+describe('generateUUID', () => {
+  const uuidV4Regex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+  test('returns a string', () => {
+    const uuid = generateUUID();
+    expect(typeof uuid).toBe('string');
+  });
+
+  test('returns a valid UUID v4', () => {
+    const uuid = generateUUID();
+    expect(uuid).toMatch(uuidV4Regex);
+  });
+
+  test('generates unique UUIDs on multiple calls', () => {
+    const uuids = new Set(Array.from({ length: 10 }, () => generateUUID()));
+    expect(uuids.size).toBe(10);
+  });
+});

package/backend/tests/unit/validations.test.ts

@@ -0,0 +1,80 @@
+import {
+  validateEmail,
+  validateIdentifier,
+  isValidIdentifier,
+  validateTableName,
+  getIdentifierErrorMessage,
+  escapeSqlLikePattern,
+  escapeRegexPattern,
+} from '../../src/utils/validations';
+import { AppError } from '../../src/api/middleware/error';
+import { describe, test, expect } from 'vitest';
+
+describe('Validations Utils', () => {
+  describe('validateEmail', () => {
+    test('valid email returns true', () => {
+      expect(validateEmail('test@example.com')).toBe(true);
+    });
+
+    test('invalid email returns false', () => {
+      expect(validateEmail('invalid-email')).toBe(false);
+    });
+  });
+
+  describe('validateIdentifier', () => {
+    test('valid identifier returns true', () => {
+      expect(validateIdentifier('my_table')).toBe(true);
+    });
+
+    test('empty identifier throws AppError', () => {
+      expect(() => validateIdentifier('')).toThrow(AppError);
+    });
+
+    test('identifier with quotes throws AppError', () => {
+      expect(() => validateIdentifier('bad"identifier')).toThrow(AppError);
+    });
+  });
+
+  describe('isValidIdentifier', () => {
+    test('valid identifier returns true', () => {
+      expect(isValidIdentifier('column1')).toBe(true);
+    });
+
+    test('invalid identifier returns false', () => {
+      expect(isValidIdentifier('')).toBe(false);
+      expect(isValidIdentifier('bad"identifier')).toBe(false);
+    });
+  });
+
+  describe('validateTableName', () => {
+    test('valid table name returns true', () => {
+      expect(validateTableName('users')).toBe(true);
+    });
+
+    test('table name starting with _ throws AppError', () => {
+      expect(() => validateTableName('_internal')).toThrow(AppError);
+    });
+  });
+
+  describe('getIdentifierErrorMessage', () => {
+    test('empty identifier returns proper message', () => {
+      expect(getIdentifierErrorMessage('')).toContain('cannot be empty');
+    });
+
+    test('bad identifier returns proper message', () => {
+      expect(getIdentifierErrorMessage('bad"identifier')).toContain('cannot contain quotes');
+    });
+  });
+
+  describe('escapeSqlLikePattern', () => {
+    test('escapes % and _ and \\', () => {
+      expect(escapeSqlLikePattern('50%_test\\')).toBe('50\\%\\_test\\\\');
+    });
+  });
+
+  describe('escapeRegexPattern', () => {
+    test('escapes regex metacharacters', () => {
+      expect(escapeRegexPattern('test.file(1)')).toBe('test\\.file\\(1\\)');
+    });
+  });
+});

package/backend/tsconfig.json

@@ -1,23 +1,23 @@
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "ES2022",
-    "lib": ["ES2022"],
-    "outDir": "../dist",
-    "baseUrl": ".",
-    "paths": {
-      "@/*": ["./src/*"],
-      "@insforge/shared-schemas": ["../shared-schemas/src/index.ts"]
-    },
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "forceConsistentCasingInFileNames": true,
-    "moduleResolution": "node",
-    "resolveJsonModule": true,
-    "allowSyntheticDefaultImports": true,
-    "types": ["node"]
-  },
-  "include": ["src/**/*", "../shared-schemas/src/**/*"],
-  "exclude": ["node_modules", "dist"]
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ES2022",
+    "lib": ["ES2022"],
+    "outDir": "../dist",
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"],
+      "@insforge/shared-schemas": ["../shared-schemas/src/index.ts"]
+    },
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "allowSyntheticDefaultImports": true,
+    "types": ["node","vitest" ]
+  },
+  "include": ["src/**/*", "../shared-schemas/src/**/*"],
+  "exclude": ["node_modules", "dist"]
 }

package/backend/vitest.config.ts

@@ -1,6 +1,16 @@
 import { defineConfig } from 'vitest/config';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 export default defineConfig({
+  resolve: {
+    alias: {
+      '@': path.resolve(__dirname, './src'),
+      '@insforge/shared-schemas': path.resolve(__dirname, '../shared-schemas/src'),
+    },
+  },
   test: {
     environment: 'node',
     globals: true,
@@ -10,6 +20,7 @@ export default defineConfig({
       reporter: ['text', 'json', 'html'],
       exclude: ['node_modules/', 'dist/', 'frontend/', 'tests/', '**/*.d.ts', '**/*.config.*'],
     },
+
     testTimeout: 10000,
     // Run tests sequentially to avoid database conflicts
     pool: 'forks',

package/claude-plugin/.claude-plugin/plugin.json

@@ -0,0 +1,24 @@
+{
+  "name": "insforge",
+  "version": "1.0.0",
+  "description": "Official InsForge plugin for Claude Code with skills, templates, and commands for building full-stack applications with InsForge BaaS",
+  "author": {
+    "name": "InsForge Team"
+  },
+  "repository": "https://github.com/InsForge/InsForge",
+  "homepage": "https://insforge.com",
+  "keywords": [
+    "insforge",
+    "baas",
+    "backend-as-a-service",
+    "postgresql",
+    "postgrest",
+    "full-stack",
+    "react",
+    "database",
+    "storage",
+    "edge-functions",
+    "authentication"
+  ],
+  "license": "MIT"
+}

package/claude-plugin/README.md

@@ -0,0 +1,133 @@
+# InsForge Claude Plugin
+
+Official Claude Code plugin for building with InsForge.
+
+## What's Included
+
+**Skill: `insforge-schema-patterns`**
+- Social graph patterns (follows, likes)
+- Nested comments (self-referential)
+- Multi-tenant patterns
+- Best practices for foreign keys, indexes, and RLS
+
+This skill automatically activates when you're designing database schemas with Claude.
+
+## Installation
+
+### Method 1: From Marketplace (Recommended)
+
+The easiest way to install:
+
+```bash
+# In Claude Code, run:
+/plugin marketplace add InsForge/InsForge
+
+# Then browse available plugins:
+/plugin
+
+# Select "insforge" to install
+```
+
+### Method 2: Direct Install
+
+```bash
+# Create user plugins directory if needed
+mkdir -p ~/.claude/plugins/user
+
+# Clone the repository
+git clone https://github.com/InsForge/InsForge.git
+
+# Create symlink
+ln -s "$(pwd)/InsForge/claude-plugin" ~/.claude/plugins/user/insforge
+
+# Verify installation
+ls -la ~/.claude/plugins/user/insforge/
+```
+
+### Method 3: Local Development
+
+For contributing or testing local changes:
+
+```bash
+# Navigate to your local InsForge repo
+cd /path/to/your/InsForge
+
+# Create user plugins directory
+mkdir -p ~/.claude/plugins/user
+
+# Symlink your local development version
+ln -s "$(pwd)/claude-plugin" ~/.claude/plugins/user/insforge
+
+# Verify
+ls -la ~/.claude/plugins/user/insforge/
+```
+
+## Usage
+
+Once installed, the skill automatically activates when you ask Claude about database design:
+
+```
+You: "I need to build a social media app with follows and likes"
+
+Claude: [Automatically loads insforge-schema-patterns skill]
+"I'll use the Social Graph pattern from InsForge best practices..."
+```
+
+No special commands needed - Claude knows when to use it!
+
+## What's a Skill?
+
+Skills are folders with instructions that Claude automatically loads when relevant. They're like giving Claude domain expertise.
+
+## Verification
+
+Check if the plugin is installed correctly:
+
+```bash
+# Check plugin installation
+ls -la ~/.claude/plugins/user/insforge/
+
+# Should show:
+# .claude-plugin/
+# skills/
+# README.md
+
+# Check the skill is present
+cat ~/.claude/plugins/user/insforge/skills/insforge-schema-patterns/SKILL.md
+
+# Should display database schema patterns
+```
+
+## Test the Plugin
+
+In Claude Code, ask a database design question:
+
+```
+"Help me design a database for a social media app with follows and likes"
+```
+
+Claude should automatically load the `insforge-schema-patterns` skill and provide expert schema patterns with RLS policies, indexes, and SDK examples.
+
+## Troubleshooting
+
+**Plugin not found:**
+```bash
+# Remove old symlink if exists
+rm ~/.claude/plugins/user/insforge
+
+# Recreate with absolute path
+ln -s /absolute/path/to/InsForge/claude-plugin ~/.claude/plugins/user/insforge
+```
+
+**Skill not loading:**
+1. Verify SKILL.md has proper frontmatter (name and description)
+2. Restart Claude Code
+3. Ask a database design question explicitly
+
+## Contributing
+
+Want to add more skills? Check the [main InsForge repository](https://github.com/InsForge/InsForge).
+
+## License
+
+MIT