minutework 0.1.0

package/assets/templates/next-tenant-app/postcss.config.mjs

@@ -0,0 +1,8 @@
+/** @type {import('postcss-load-config').Config} */
+const config = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};
+
+export default config;

package/assets/templates/next-tenant-app/src/app/api/auth/context/route.test.ts

@@ -0,0 +1,90 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const fetchSessionContext = vi.fn();
+const resetSessionContext = vi.fn();
+const updateSessionContext = vi.fn();
+const readPlatformAuthState = vi.fn();
+const syncPlatformAuthStateToResponse = vi.fn();
+
+vi.mock("@/lib/platform/client.server", () => ({
+  fetchSessionContext,
+  resetSessionContext,
+  updateSessionContext,
+}));
+
+vi.mock("@/lib/platform/session.server", () => ({
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+}));
+
+describe("auth context route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("proxies valid tenant context updates through the BFF", async () => {
+    const authState = { sessionId: "session-1", csrfToken: "csrf-1" };
+    const payload = {
+      authenticated: true as const,
+      user: {
+        id: "user-1",
+        username: "demo-user",
+        email: "demo@example.com",
+      },
+      active_tenant_id: "tenant-2",
+      active_tenant: {
+        tenant_id: "tenant-2",
+        tenant_slug: "beta",
+        tenant_name: "Beta",
+        role: "member",
+      },
+      memberships: [
+        {
+          tenant_id: "tenant-2",
+          tenant_slug: "beta",
+          tenant_name: "Beta",
+          role: "member",
+        },
+      ],
+    };
+
+    readPlatformAuthState.mockResolvedValue(authState);
+    updateSessionContext.mockResolvedValue({
+      data: payload,
+      authState: authState,
+    });
+
+    const route = await import("./route");
+    const response = await route.PUT(
+      new Request("http://localhost/api/auth/context", {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ tenant_id: "tenant-2" }),
+      }),
+    );
+
+    expect(updateSessionContext).toHaveBeenCalledWith(authState, {
+      tenant_id: "tenant-2",
+    });
+    expect(syncPlatformAuthStateToResponse).toHaveBeenCalledWith(
+      response,
+      authState,
+      authState,
+    );
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual(payload);
+  });
+
+  it("returns 401 when the browser has no stored platform session", async () => {
+    readPlatformAuthState.mockResolvedValue({
+      sessionId: null,
+      csrfToken: "csrf-1",
+    });
+
+    const route = await import("./route");
+    const response = await route.DELETE();
+
+    expect(resetSessionContext).not.toHaveBeenCalled();
+    expect(response.status).toBe(401);
+  });
+});

package/assets/templates/next-tenant-app/src/app/api/auth/context/route.ts

@@ -0,0 +1,78 @@
+import { NextResponse } from "next/server";
+
+import {
+  fetchSessionContext,
+  resetSessionContext,
+  updateSessionContext,
+} from "@/lib/platform/client.server";
+import { tenantSessionContextRequestSchema } from "@/lib/platform/contracts";
+import { toPlatformErrorResponse } from "@/lib/platform/route-response";
+import {
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+} from "@/lib/platform/session.server";
+
+function unauthorizedResponse() {
+  return NextResponse.json({ detail: "Authentication required." }, { status: 401 });
+}
+
+export async function GET() {
+  const authState = await readPlatformAuthState();
+
+  if (!authState.sessionId) {
+    return unauthorizedResponse();
+  }
+
+  try {
+    const result = await fetchSessionContext(authState);
+    const response = NextResponse.json(result.data, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(error, "Unable to load tenant context.", authState);
+  }
+}
+
+export async function PUT(request: Request) {
+  const authState = await readPlatformAuthState();
+
+  if (!authState.sessionId) {
+    return unauthorizedResponse();
+  }
+
+  const body = await request.json().catch(() => null);
+  const parsed = tenantSessionContextRequestSchema.safeParse(body);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { detail: "Invalid tenant context payload." },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const result = await updateSessionContext(authState, parsed.data);
+    const response = NextResponse.json(result.data, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(error, "Unable to update tenant context.", authState);
+  }
+}
+
+export async function DELETE() {
+  const authState = await readPlatformAuthState();
+
+  if (!authState.sessionId) {
+    return unauthorizedResponse();
+  }
+
+  try {
+    const result = await resetSessionContext(authState);
+    const response = NextResponse.json(result.data, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(error, "Unable to reset tenant context.", authState);
+  }
+}

package/assets/templates/next-tenant-app/src/app/api/auth/login/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from "next/server";
+
+import { loginWithPassword } from "@/lib/platform/client.server";
+import { loginRequestSchema } from "@/lib/platform/contracts";
+import { toPlatformErrorResponse } from "@/lib/platform/route-response";
+import {
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+} from "@/lib/platform/session.server";
+
+export async function POST(request: Request) {
+  const authState = await readPlatformAuthState();
+  const body = await request.json().catch(() => null);
+  const parsed = loginRequestSchema.safeParse(body);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { detail: "Invalid login payload." },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const result = await loginWithPassword(authState, parsed.data);
+    const response = NextResponse.json({ authenticated: true }, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(error, "Unable to sign in.", authState);
+  }
+}

package/assets/templates/next-tenant-app/src/app/api/auth/logout/route.ts

@@ -0,0 +1,16 @@
+import { NextResponse } from "next/server";
+
+import { logoutPlatformSession } from "@/lib/platform/client.server";
+import {
+  clearPlatformSessionFromResponse,
+  readPlatformAuthState,
+} from "@/lib/platform/session.server";
+
+export async function POST() {
+  const authState = await readPlatformAuthState();
+  await logoutPlatformSession(authState).catch(() => null);
+
+  const response = new NextResponse(null, { status: 204 });
+  clearPlatformSessionFromResponse(response);
+  return response;
+}

package/assets/templates/next-tenant-app/src/app/api/auth/password-change/route.test.ts

@@ -0,0 +1,79 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const changePassword = vi.fn();
+const readPlatformAuthState = vi.fn();
+const syncPlatformAuthStateToResponse = vi.fn();
+
+vi.mock("@/lib/platform/client.server", () => ({
+  changePassword,
+}));
+
+vi.mock("@/lib/platform/session.server", () => ({
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+}));
+
+describe("password change route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("rejects invalid password payloads before proxying upstream", async () => {
+    readPlatformAuthState.mockResolvedValue({
+      sessionId: "session-1",
+      csrfToken: "csrf-1",
+    });
+
+    const route = await import("./route");
+    const response = await route.POST(
+      new Request("http://localhost/api/auth/password-change", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          current_password: "old",
+          new_password: "new-password",
+          confirm_password: "different-password",
+        }),
+      }),
+    );
+
+    expect(changePassword).not.toHaveBeenCalled();
+    expect(response.status).toBe(400);
+  });
+
+  it("proxies valid password changes through the BFF", async () => {
+    const authState = { sessionId: "session-1", csrfToken: "csrf-1" };
+
+    readPlatformAuthState.mockResolvedValue(authState);
+    changePassword.mockResolvedValue({
+      data: { has_password: true },
+      authState,
+    });
+
+    const route = await import("./route");
+    const response = await route.POST(
+      new Request("http://localhost/api/auth/password-change", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          current_password: "old-password",
+          new_password: "new-password",
+          confirm_password: "new-password",
+        }),
+      }),
+    );
+
+    expect(changePassword).toHaveBeenCalledWith(authState, {
+      current_password: "old-password",
+      new_password: "new-password",
+      confirm_password: "new-password",
+    });
+    expect(syncPlatformAuthStateToResponse).toHaveBeenCalledWith(
+      response,
+      authState,
+      authState,
+    );
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ has_password: true });
+  });
+});

package/assets/templates/next-tenant-app/src/app/api/auth/password-change/route.ts

@@ -0,0 +1,40 @@
+import { NextResponse } from "next/server";
+
+import { changePassword } from "@/lib/platform/client.server";
+import { passwordChangeRequestSchema } from "@/lib/platform/contracts";
+import { toPlatformErrorResponse } from "@/lib/platform/route-response";
+import {
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+} from "@/lib/platform/session.server";
+
+export async function POST(request: Request) {
+  const authState = await readPlatformAuthState();
+
+  if (!authState.sessionId) {
+    return NextResponse.json({ detail: "Authentication required." }, { status: 401 });
+  }
+
+  const body = await request.json().catch(() => null);
+  const parsed = passwordChangeRequestSchema.safeParse(body);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { detail: "Invalid password change payload." },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const result = await changePassword(authState, parsed.data);
+    const response = NextResponse.json(result.data, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(
+      error,
+      "Unable to change password.",
+      authState,
+    );
+  }
+}

package/assets/templates/next-tenant-app/src/app/api/auth/password-status/route.test.ts

@@ -0,0 +1,42 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const fetchPasswordStatus = vi.fn();
+const readPlatformAuthState = vi.fn();
+const syncPlatformAuthStateToResponse = vi.fn();
+
+vi.mock("@/lib/platform/client.server", () => ({
+  fetchPasswordStatus,
+}));
+
+vi.mock("@/lib/platform/session.server", () => ({
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+}));
+
+describe("password status route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("returns the proxied password status for authenticated sessions", async () => {
+    const authState = { sessionId: "session-1", csrfToken: "csrf-1" };
+
+    readPlatformAuthState.mockResolvedValue(authState);
+    fetchPasswordStatus.mockResolvedValue({
+      data: { has_password: true },
+      authState,
+    });
+
+    const route = await import("./route");
+    const response = await route.GET();
+
+    expect(fetchPasswordStatus).toHaveBeenCalledWith(authState);
+    expect(syncPlatformAuthStateToResponse).toHaveBeenCalledWith(
+      response,
+      authState,
+      authState,
+    );
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ has_password: true });
+  });
+});

package/assets/templates/next-tenant-app/src/app/api/auth/password-status/route.ts

@@ -0,0 +1,29 @@
+import { NextResponse } from "next/server";
+
+import { fetchPasswordStatus } from "@/lib/platform/client.server";
+import { toPlatformErrorResponse } from "@/lib/platform/route-response";
+import {
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+} from "@/lib/platform/session.server";
+
+export async function GET() {
+  const authState = await readPlatformAuthState();
+
+  if (!authState.sessionId) {
+    return NextResponse.json({ detail: "Authentication required." }, { status: 401 });
+  }
+
+  try {
+    const result = await fetchPasswordStatus(authState);
+    const response = NextResponse.json(result.data, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(
+      error,
+      "Unable to load password status.",
+      authState,
+    );
+  }
+}

package/assets/templates/next-tenant-app/src/app/api/auth/session/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from "next/server";
+
+import {
+  loadCurrentSession,
+} from "@/lib/platform/client.server";
+import { toPlatformErrorResponse } from "@/lib/platform/route-response";
+import {
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+} from "@/lib/platform/session.server";
+
+export async function GET() {
+  const authState = await readPlatformAuthState();
+  try {
+    const result = await loadCurrentSession(authState);
+    const response = NextResponse.json(result.data, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(
+      error,
+      "Unable to load the current platform session.",
+      authState,
+    );
+  }
+}

package/assets/templates/next-tenant-app/src/app/api/gateway/commands/[runId]/route.test.ts

@@ -0,0 +1,40 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const fetchTenantCommandRun = vi.fn();
+const readPlatformAuthState = vi.fn();
+const syncPlatformAuthStateToResponse = vi.fn();
+
+vi.mock("@/lib/platform/client.server", () => ({
+  fetchTenantCommandRun,
+}));
+
+vi.mock("@/lib/platform/env.server", () => ({
+  env: {
+    MW_ENABLE_RUNTIME_COMMAND_EXAMPLE: false,
+  },
+}));
+
+vi.mock("@/lib/platform/session.server", () => ({
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+}));
+
+describe("runtime command run route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.resetModules();
+  });
+
+  it("returns 404 when the example feature is disabled", async () => {
+    const route = await import("./route");
+    const response = await route.GET(
+      new Request("http://localhost/api/gateway/commands/run-1?tenant_id=tenant-1"),
+      { params: Promise.resolve({ runId: "run-1" }) },
+    );
+
+    expect(response.status).toBe(404);
+    expect(readPlatformAuthState).not.toHaveBeenCalled();
+    expect(fetchTenantCommandRun).not.toHaveBeenCalled();
+    expect(syncPlatformAuthStateToResponse).not.toHaveBeenCalled();
+  });
+});

package/assets/templates/next-tenant-app/src/app/api/gateway/commands/[runId]/route.ts

@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+
+import { fetchTenantCommandRun } from "@/lib/platform/client.server";
+import { env } from "@/lib/platform/env.server";
+import { toPlatformErrorResponse } from "@/lib/platform/route-response";
+import {
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+} from "@/lib/platform/session.server";
+
+export async function GET(
+  request: Request,
+  { params }: { params: Promise<{ runId: string }> },
+) {
+  if (!env.MW_ENABLE_RUNTIME_COMMAND_EXAMPLE) {
+    return new NextResponse(null, { status: 404 });
+  }
+
+  const authState = await readPlatformAuthState();
+  if (!authState.sessionId) {
+    return NextResponse.json({ detail: "Authentication required." }, { status: 401 });
+  }
+
+  const { runId } = await params;
+  const url = new URL(request.url);
+  const tenantId = url.searchParams.get("tenant_id") || "";
+
+  if (!tenantId) {
+    return NextResponse.json(
+      { detail: "Missing tenant_id query parameter." },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const result = await fetchTenantCommandRun(authState, runId, tenantId);
+    const response = NextResponse.json(result.data, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(
+      error,
+      "Unable to load command status.",
+      authState,
+    );
+  }
+}

package/assets/templates/next-tenant-app/src/app/api/gateway/commands/route.test.ts

@@ -0,0 +1,43 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const dispatchTenantCommand = vi.fn();
+const readPlatformAuthState = vi.fn();
+const syncPlatformAuthStateToResponse = vi.fn();
+
+vi.mock("@/lib/platform/client.server", () => ({
+  dispatchTenantCommand,
+}));
+
+vi.mock("@/lib/platform/env.server", () => ({
+  env: {
+    MW_ENABLE_RUNTIME_COMMAND_EXAMPLE: false,
+  },
+}));
+
+vi.mock("@/lib/platform/session.server", () => ({
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+}));
+
+describe("runtime command route", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.resetModules();
+  });
+
+  it("returns 404 when the example feature is disabled", async () => {
+    const route = await import("./route");
+    const response = await route.POST(
+      new Request("http://localhost/api/gateway/commands", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ command: "deploy" }),
+      }),
+    );
+
+    expect(response.status).toBe(404);
+    expect(readPlatformAuthState).not.toHaveBeenCalled();
+    expect(dispatchTenantCommand).not.toHaveBeenCalled();
+    expect(syncPlatformAuthStateToResponse).not.toHaveBeenCalled();
+  });
+});

package/assets/templates/next-tenant-app/src/app/api/gateway/commands/route.ts

@@ -0,0 +1,45 @@
+import { NextResponse } from "next/server";
+
+import { dispatchTenantCommand } from "@/lib/platform/client.server";
+import { commandDispatchRequestSchema } from "@/lib/platform/contracts";
+import { env } from "@/lib/platform/env.server";
+import { toPlatformErrorResponse } from "@/lib/platform/route-response";
+import {
+  readPlatformAuthState,
+  syncPlatformAuthStateToResponse,
+} from "@/lib/platform/session.server";
+
+export async function POST(request: Request) {
+  if (!env.MW_ENABLE_RUNTIME_COMMAND_EXAMPLE) {
+    return new NextResponse(null, { status: 404 });
+  }
+
+  const authState = await readPlatformAuthState();
+
+  if (!authState.sessionId) {
+    return NextResponse.json({ detail: "Authentication required." }, { status: 401 });
+  }
+
+  const body = await request.json().catch(() => null);
+  const parsed = commandDispatchRequestSchema.safeParse(body);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { detail: "Invalid command payload." },
+      { status: 400 },
+    );
+  }
+
+  try {
+    const result = await dispatchTenantCommand(authState, parsed.data);
+    const response = NextResponse.json(result.data, { status: 200 });
+    syncPlatformAuthStateToResponse(response, authState, result.authState);
+    return response;
+  } catch (error) {
+    return toPlatformErrorResponse(
+      error,
+      "Unable to dispatch command.",
+      authState,
+    );
+  }
+}