nodejs-quickstart-structure 2.0.1 → 2.1.1

package/templates/mvc/js/src/index.js.ejs

@@ -4,6 +4,8 @@ const cors = require('cors');
 <%_ if (communication === 'REST APIs' || communication === 'Kafka') { -%>const apiRoutes = require('./routes/api');<%_ } %>
 const healthRoutes = require('./routes/healthRoute');
 <%_ if (communication === 'Kafka') { -%>const { connectKafka, sendMessage } = require('./services/kafkaService');<%_ } -%>
+<%_ if (auth.includes('JWT')) { -%>const authRoutes = require('./routes/authRoutes');<%_ } -%>
+
 <%_ if (communication === 'GraphQL') { -%>
 const { ApolloServer } = require('@apollo/server');
 const { expressMiddleware } = require('@as-integrations/express4');
@@ -27,6 +29,7 @@ const { errorMiddleware } = require('./utils/errorMiddleware');
 
 app.use(cors());
 app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
 app.use(morgan('combined', { stream: { write: message => logger.info(message.trim()) } }));
 
 <%_ if (communication === 'REST APIs' || communication === 'Kafka') { -%>
@@ -40,15 +43,25 @@ app.set('view engine', '<%= viewEngine.toLowerCase() %>');
 app.use(express.static(path.join(__dirname, '../public')));<%_ } %>
 <%_ if (communication === 'REST APIs' || communication === 'Kafka') { -%>
 app.use('/api', apiRoutes);
-<%_ } -%><% if (viewEngine && viewEngine !== 'None') { -%>
+<%_ } -%><%_ if (auth.includes('JWT')) { -%>
+app.use('/api/auth', authRoutes);
+<%_ } -%>
+
+<% if (viewEngine && viewEngine !== 'None') { -%>
 app.get('/', (req, res) => {
   res.render('index', { 
-    projectName: 'NodeJS Service',
+    projectName: '<%= projectName %>',
     architecture: 'MVC',
     database: '<%= database %>',
-    communication: '<%= communication %>'
+    communication: '<%= communication %>',
+    auth: <%- JSON.stringify(auth) %>
   });
 });
+
+<% if (auth.includes('JWT')) { %>
+app.get('/login', (req, res) => res.render('login', { projectName: '<%= projectName %>' }));
+app.get('/signup', (req, res) => res.render('signup', { projectName: '<%= projectName %>' }));
+<% } %>
 <% } -%>
 app.use('/health', healthRoutes);
 

package/templates/mvc/js/src/routes/api.js.ejs

@@ -0,0 +1,14 @@
+const { Router } = require('express');
+const { getUsers, createUser, updateUser, deleteUser } = require('../controllers/userController');
+<%_ if (auth.includes('JWT')) { _%>
+const authMiddleware = require('../middleware/authMiddleware');
+<%_ } _%>
+
+const router = Router();
+
+router.get('/users', <% if (auth.includes('JWT')) { %>authMiddleware, <% } %>getUsers);
+router.post('/users', createUser);
+router.patch('/users/:id', <% if (auth.includes('JWT')) { %>authMiddleware, <% } %>updateUser);
+router.delete('/users/:id', <% if (auth.includes('JWT')) { %>authMiddleware, <% } %>deleteUser);
+
+module.exports = router;

package/templates/mvc/js/src/routes/api.spec.js.ejs

@@ -14,6 +14,9 @@ jest.mock('@/controllers/userController', () => ({
   updateUser: (...args) => mockUpdateUser(...args),
   deleteUser: (...args) => mockDeleteUser(...args)
 }));
+<%_ if (auth.includes('JWT')) { _%>
+jest.mock('@/middleware/authMiddleware', () => (req, res, next) => next());
+<%_ } _%>
 
 describe('ApiRoutes', () => {
     let app;

package/templates/mvc/js/src/utils/errorMessages.js

@@ -5,6 +5,7 @@ const ERROR_MESSAGES = {
     INTERNAL_SERVER_ERROR: 'Internal Server Error',
     BAD_REQUEST: 'Bad Request',
     FETCH_USERS_ERROR: 'Error fetching users',
+    FETCH_USER_ERROR: 'Error fetching user',
     CREATE_USER_ERROR: 'Error creating user',
     UPDATE_USER_ERROR: 'Error updating user',
     DELETE_USER_ERROR: 'Error deleting user',

package/templates/mvc/js/src/utils/httpCodes.js

@@ -2,6 +2,7 @@ const HTTP_STATUS = {
     OK: 200,
     CREATED: 201,
     BAD_REQUEST: 400,
+    UNAUTHORIZED: 401,
     NOT_FOUND: 404,
     INTERNAL_SERVER_ERROR: 500
 };

package/templates/mvc/ts/src/config/env.ts.ejs

@@ -33,13 +33,22 @@ const envSchema = z.object({
 <%_ if (communication === 'Kafka') { -%>
   KAFKA_BROKER: z.string(),
 <%_ } -%>
+<%_ if (auth.includes('JWT')) { -%>
+  JWT_SECRET: z.string(),
+  JWT_EXPIRES_IN: z.string().default('15m'),
+  JWT_REFRESH_SECRET: z.string().default('your-secret-refresh-key'),
+  JWT_REFRESH_EXPIRES_IN: z.string().default('7d'),
+<%_ } -%>
 });
 
 const _env = envSchema.safeParse(process.env);
 
 if (!_env.success) {
-  logger.error('❌ Invalid environment variables:', _env.error.format());
-  process.exit(1);
+  if (process.env.NODE_ENV !== 'test') {
+    logger.error('❌ Invalid environment variables:', _env.error.format());
+    process.exit(1);
+  }
+  logger.warn('⚠️ Environment validation failed. Continuing in test mode.');
 }
 
-export const env = _env.data;
+export const env = (_env.success ? _env.data : process.env) as unknown as z.infer<typeof envSchema>;

package/templates/mvc/ts/src/controllers/userController.spec.ts.ejs

@@ -1,5 +1,9 @@
+<% if (communication !== 'GraphQL') { -%>
 import { HTTP_STATUS } from '@/utils/httpCodes';
+<% } -%>
+<%_ if (communication === 'GraphQL') { _%>
 import { ERROR_MESSAGES } from '@/utils/errorMessages';
+<%_ } _%>
 <% if (communication !== 'GraphQL') { -%>
 import { Request, Response, NextFunction } from 'express';
 <% } -%>
@@ -26,6 +30,12 @@ jest.mock('@/models/User', () => {
     };
 });
 const User = require('@/models/User');
+<%_ if (auth.includes('JWT')) { _%>
+jest.mock('bcryptjs', () => ({
+    hash: jest.fn().mockResolvedValue('hashed_password'),
+    compare: jest.fn().mockResolvedValue(true)
+}));
+<%_ } _%>
 <%_ if (caching === 'Redis') { -%>
 jest.mock('@/config/redisClient', () => ({
     getOrSet: jest.fn((_key, fetcher) => fetcher()),
@@ -179,7 +189,7 @@ describe('UserController', () => {
     describe('createUser', () => {
         it('should successfully create a new user (Happy Path)', async () => {
             // Arrange
-            const payload = { name: 'Alice', email: 'alice@example.com' };
+            const payload = { name: 'Alice', email: 'alice@example.com'<% if (auth.includes('JWT')) { %>, password: 'password123'<% } %> };
 <% if (communication === 'GraphQL') { -%>
             const dataArg = payload;
 <% } else { -%>
@@ -200,14 +210,21 @@ describe('UserController', () => {
             const result = await userController.createUser(dataArg) as any;
 
             // Assert
-            expect(result!).toEqual(expectedUser);
+            expect(result!.password).toBeUndefined();
+            const { password, ...expectedUserWithoutPassword } = expectedUser as any;
+            expect(result!).toEqual(expectedUserWithoutPassword);
 <% } else { -%>
             await userController.createUser(mockRequest as Request, mockResponse as Response, mockNext);
 
             // Assert
             expect(mockResponse.status).toHaveBeenCalledWith(HTTP_STATUS.CREATED);
-            expect(mockResponse.json).toHaveBeenCalledWith(expectedUser);
-            expect(User.create).toHaveBeenCalledWith(payload);
+            const { password: _, ...expectedUserWithoutPassword } = expectedUser as any;
+            expect(mockResponse.json).toHaveBeenCalledWith(expectedUserWithoutPassword);
+            expect(User.create).toHaveBeenCalledWith({
+                name: payload.name,
+                email: payload.email
+                <%_ if (auth.includes('JWT')) { _%>, password: 'hashed_password'<%_ } _%>
+            });
 <% } -%>
 <%_ if (caching === 'Redis' || caching === 'Memory Cache') { -%>
             expect(cacheService.del).toHaveBeenCalledWith('users:all');
@@ -217,10 +234,27 @@ describe('UserController', () => {
 <%_ } -%>
         });
 
+<% if (auth.includes('JWT')) { %>
+        it('should throw error if password is missing when auth is enabled', async () => {
+            // Arrange
+            const payload = { name: 'Alice', email: 'alice@example.com' };
+
+            // Act & Assert
+<% if (communication === 'GraphQL') { -%>
+            await expect(userController.createUser(payload as any)).rejects.toThrow('Password is required');
+<% } else { -%>
+            mockRequest.body = payload;
+            await userController.createUser(mockRequest as Request, mockResponse as Response, mockNext);
+            expect(mockResponse.status).toHaveBeenCalledWith(HTTP_STATUS.BAD_REQUEST);
+            expect(mockResponse.json).toHaveBeenCalledWith({ error: 'Password is required' });
+<% } -%>
+        });
+<% } -%>
+
         it('should handle errors when creation fails (Error Handling)', async () => {
             // Arrange
             const error = new Error('Creation Error');
-            const payload = { name: 'Bob', email: 'bob@example.com' };
+            const payload = { name: 'Bob', email: 'bob@example.com'<% if (auth.includes('JWT')) { %>, password: 'password123'<% } %> };
 <% if (communication === 'GraphQL') { -%>
             const dataArg = payload;
 <% } else { -%>
@@ -445,9 +479,17 @@ describe('UserController', () => {
             const error = new Error('Database Error');
             (User.create as jest.Mock).mockRejectedValue(error);
 <% if (communication === 'GraphQL') { -%>
-            await expect(userController.createUser({ name: 'Alice', email: 'alice@example.com' })).rejects.toThrow(error);
+            await expect(userController.createUser({ 
+                name: 'Alice', 
+                email: 'alice@example.com' 
+                <%_ if (auth.includes('JWT')) { %>, password: 'password123' <%_ } %> 
+            })).rejects.toThrow(error);
 <% } else { -%>
-            mockRequest.body = { name: 'Alice', email: 'alice@example.com' };
+            mockRequest.body = { 
+                name: 'Alice', 
+                email: 'alice@example.com' 
+                <%_ if (auth.includes('JWT')) { %>, password: 'password123' <%_ } %> 
+            };
             await userController.createUser(mockRequest as Request, mockResponse as Response, mockNext);
             expect(mockNext).toHaveBeenCalledWith(error);
 <% } -%>
@@ -475,6 +517,52 @@ describe('UserController', () => {
             mockRequest.body = { name: 'Bob' };
             await userController.updateUser(mockRequest as Request, mockResponse as Response, mockNext);
             expect(mockNext).toHaveBeenCalledWith(error);
+<% } -%>
+        });
+    });
+
+    describe('getUserById', () => {
+        it('should successfully fetch a user by id', async () => {
+            const id = '1';
+            const expectedUser = { id, name: 'Alice', email: 'alice@test.com' };
+<% if (communication === 'GraphQL') { -%>
+            const idArg = id;
+<% } else { -%>
+            mockRequest.params = { id };
+<% } -%>
+
+<%_ if (database === 'MongoDB') { -%>
+            (User.findById as jest.Mock).mockResolvedValue(expectedUser);
+<%_ } else if (database === 'None') { -%>
+            (User.findByPk as jest.Mock).mockResolvedValue(expectedUser);
+<%_ } else { -%>
+            (User.findByPk as jest.Mock).mockResolvedValue(expectedUser);
+<%_ } -%>
+
+<% if (communication === 'GraphQL') { -%>
+            const result = await userController.getUserById(idArg);
+            expect(result).toEqual(expectedUser);
+<% } else { -%>
+            await userController.getUserById(mockRequest as Request, mockResponse as Response, mockNext);
+            expect(mockResponse.status).toHaveBeenCalledWith(HTTP_STATUS.OK);
+            expect(mockResponse.json).toHaveBeenCalledWith(expectedUser);
+<% } -%>
+        });
+
+        it('should return 404 if user not found', async () => {
+<% if (communication === 'GraphQL') { -%>
+            (User.findById as jest.Mock).mockResolvedValue(null);
+            (User.findByPk as jest.Mock).mockResolvedValue(null);
+            await expect(userController.getUserById('999')).rejects.toThrow();
+<% } else { -%>
+            mockRequest.params = { id: '999' };
+<%_ if (database === 'MongoDB') { -%>
+            (User.findById as jest.Mock).mockResolvedValue(null);
+<%_ } else { -%>
+            (User.findByPk as jest.Mock).mockResolvedValue(null);
+<%_ } -%>
+            await userController.getUserById(mockRequest as Request, mockResponse as Response, mockNext);
+            expect(mockResponse.status).toHaveBeenCalledWith(HTTP_STATUS.NOT_FOUND);
 <% } -%>
         });
     });

package/templates/mvc/ts/src/controllers/userController.ts.ejs

@@ -12,6 +12,8 @@ import cacheService from '@/config/memoryCache';
 <%_ } -%><%_ if (communication === 'Kafka') { -%>
 import { kafkaService } from '@/services/kafkaService';
 import { KAFKA_ACTIONS } from '@/utils/kafkaEvents';
+<%_ } -%><%_ if (auth.includes('JWT')) { %>
+import bcrypt from 'bcryptjs';
 <%_ } -%>
 
 export class UserController {
@@ -40,22 +42,47 @@ export class UserController {
         }
     }
 
-    async createUser(data: { name: string, email: string }) {
+    async getUserById(id: string) {
         try {
-            const { name, email } = data;
+<%_ if (database === 'MongoDB') { -%>
+            const user = await User.findById(id);
+<%_ } else { -%>
+            const user = await User.findByPk(id);
+<%_ } -%>
+            if (!user) throw new Error(ERROR_MESSAGES.USER_NOT_FOUND);
+            return user;
+        } catch (error) {
+            logger.error(`${ERROR_MESSAGES.FETCH_USER_ERROR}:`, error);
+            throw error;
+        }
+    }
+
+    async createUser(data: { name: string, email: string<% if (auth.includes('JWT')) { %>, password?: string<% } %> }) {
+        try {
+            const { name, email<% if (auth.includes('JWT')) { %>, password<% } %> } = data;
+            <% if (auth.includes('JWT')) { %>
+            if (!password) throw new Error('Password is required');
+            const hashedPassword = await bcrypt.hash(password, 10);
+            const user = await User.create({ name, email, password: hashedPassword });
+            <% } else { %>
             const user = await User.create({ name, email });
+            <% } %>
+
 <%_ if (caching === 'Redis' || caching === 'Memory Cache') { -%>
             await cacheService.del('users:all');
 <%_ } -%>
 <%_ if (communication === 'Kafka') { -%>
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const userId = (user as any).id || (user as any)._id;
+            const rawUserForKafka = user as unknown as { id?: string | number; _id?: string | number; email: string };
+            const userId = rawUserForKafka.id || rawUserForKafka._id;
             await kafkaService.sendMessage('user-topic', JSON.stringify({
                 action: KAFKA_ACTIONS.USER_CREATED,
-                payload: { id: userId, email: user.email }
+                payload: { id: userId, email: rawUserForKafka.email }
             }), userId?.toString() || '');
 <%_ } -%>
-            return user;
+            const rawUser = user as unknown as { toJSON?: () => Record<string, unknown> };
+            const userJson = typeof rawUser.toJSON === 'function' ? rawUser.toJSON() : (user as unknown as Record<string, unknown>);
+            const { password: _, ...userWithoutPassword } = userJson;
+            return userWithoutPassword;
         } catch (error) {
             logger.error(`${ERROR_MESSAGES.CREATE_USER_ERROR}:`, error);
             throw error;
@@ -147,22 +174,52 @@ export class UserController {
         }
     }
 
+    async getUserById(req: Request, res: Response, next: NextFunction) {
+        try {
+            const { id } = req.params;
+<%_ if (database === 'MongoDB') { -%>
+            const user = await User.findById(id);
+<%_ } else { -%>
+            const user = await User.findByPk(id);
+<%_ } -%>
+            if (!user) {
+                return res.status(HTTP_STATUS.NOT_FOUND).json({ error: ERROR_MESSAGES.USER_NOT_FOUND });
+            }
+            res.status(HTTP_STATUS.OK).json(user);
+        } catch (error) {
+            logger.error(`${ERROR_MESSAGES.FETCH_USER_ERROR}:`, error);
+            next(error);
+        }
+    }
+
     async createUser(req: Request, res: Response, next: NextFunction) {
         try {
-            const { name, email } = req.body || {};
+            const { name, email, password } = req.body || {};
+<% if (auth.includes('JWT')) { %>
+            if (!password) {
+                return res.status(HTTP_STATUS.BAD_REQUEST).json({ error: 'Password is required' });
+            }
+            const hashedPassword = await bcrypt.hash(password, 10);
+            const user = await User.create({ name, email, password: hashedPassword });
+<% } else { %>
             const user = await User.create({ name, email });
+<% } %>
+
 <%_ if (caching === 'Redis' || caching === 'Memory Cache') { -%>
             await cacheService.del('users:all');
 <%_ } -%>
 <%_ if (communication === 'Kafka') { -%>
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const userId = (user as any).id || (user as any)._id;
+            const rawUserForKafka = user as unknown as { id?: string | number; _id?: string | number; email: string };
+            const userId = rawUserForKafka.id || rawUserForKafka._id;
             await kafkaService.sendMessage('user-topic', JSON.stringify({
                 action: KAFKA_ACTIONS.USER_CREATED,
-                payload: { id: userId, email: user.email }
+                payload: { id: userId, email: rawUserForKafka.email }
             }), userId?.toString() || '');
 <%_ } -%>
-            res.status(HTTP_STATUS.CREATED).json(user);
+            const rawUser = user as unknown as { toJSON?: () => Record<string, unknown> };
+            const userJson = typeof rawUser.toJSON === 'function' ? rawUser.toJSON() : (user as unknown as Record<string, unknown>);
+            const { password: _, ...userWithoutPassword } = userJson;
+            res.status(HTTP_STATUS.CREATED).json(userWithoutPassword);
         } catch (error) {
             logger.error('Error creating user:', error);
             next(error);

package/templates/mvc/ts/src/graphql/context.spec.ts.ejs

@@ -1,30 +1,43 @@
-import { gqlContext } from '@/graphql/context';
 import { Request } from 'express';
-import { resolvers } from '@/graphql/resolvers';
-import { typeDefs } from '@/graphql/typeDefs';
+<% if (auth.includes('JWT')) { %>import { JwtService } from '@/services/jwtService';
+jest.mock('@/services/jwtService');<% } %>
+import { gqlContext } from '@/graphql/context';
 
 describe('GraphQL Context', () => {
-  it('should exercise GraphQL index entry points', () => {
-    expect(resolvers).toBeDefined();
-    expect(typeDefs).toBeDefined();
-  });
-  it('should return context with token when authorization header is present', async () => {
-    const mockRequest = {
-      headers: {
-        authorization: 'Bearer token123',
-      },
-    } as Request;
+    afterEach(() => {
+        jest.clearAllMocks();
+    });
+
+    it('should return context with user when authorization header is present and valid', async () => {
+        <% if (auth.includes('JWT')) { %>
+        const mockUser = { id: '1', email: 'test@test.com' };
+        (JwtService.verifyToken as jest.Mock).mockReturnValue(mockUser);
+        const mockRequest = {
+            headers: {
+                authorization: 'Bearer valid-token',
+            },
+        } as Request;
 
-    const context = await gqlContext({ req: mockRequest });
-    expect(context).toEqual({ token: 'Bearer token123' });
-  });
+        const context = await gqlContext({ req: mockRequest });
+        expect(context.user).toEqual(mockUser);
+        expect(JwtService.verifyToken).toHaveBeenCalledWith('valid-token');
+        <% } else { %>
+        const mockRequest = {
+            headers: {
+                authorization: 'Bearer token123',
+            },
+        } as Request;
+        const context = await gqlContext({ req: mockRequest });
+        expect(context.user).toBeUndefined();
+        <% } %>
+    });
 
-  it('should return context with empty token when authorization header is missing', async () => {
-    const mockRequest = {
-      headers: {},
-    } as Request;
+    it('should return empty context when authorization header is missing', async () => {
+        const mockRequest = {
+            headers: {},
+        } as Request;
 
-    const context = await gqlContext({ req: mockRequest });
-    expect(context).toEqual({ token: '' });
-  });
+        const context = await gqlContext({ req: mockRequest });
+        expect(context.user).toBeUndefined();
+    });
 });

package/templates/mvc/ts/src/graphql/context.ts.ejs

@@ -1,12 +1,21 @@
 import { Request } from 'express';
+<% if (auth.includes('JWT')) { %>import { JwtService } from '../services/jwtService';<% } %>
 
 export interface MyContext {
-  token?: string;
-  // user?: User;
+  token?: string; // Kept for backward compatibility
+  user?: unknown;
 }
 
-export const gqlContext = async ({ req }: { req: Request }): Promise<MyContext> => {
-  // Setup authorization or context here
-  const token = req.headers.authorization || '';
-  return { token };
+export const gqlContext = async ({ req: <% if (auth.includes('JWT')) { %>req<% } else { %>_req<% } %> }: { req: Request }): Promise<MyContext> => {
+  const context: MyContext = {};
+  <% if (auth.includes('JWT')) { %>
+  const authHeader = req.headers.authorization || '';
+  if (authHeader.startsWith('Bearer ')) {
+    const token = authHeader.split(' ')[1];
+    const user = JwtService.verifyToken(token);
+    if (user) {
+      context.user = user;
+    }
+  }<% } %>
+  return context;
 };

package/templates/mvc/ts/src/graphql/resolvers/user.resolvers.spec.ts.ejs

@@ -15,40 +15,62 @@ jest.mock('@/controllers/userController', () => {
 });
 
 describe('User Resolvers', () => {
+  const mockContext = { 
+    <% if (auth.includes('JWT')) { %>user: { id: 'admin', email: 'admin@test.com' }<% } %>
+  };
+
   afterEach(() => {
     jest.clearAllMocks();
   });
 
   describe('Query.getAllUsers', () => {
-    it('should return all users', async () => {
-      const result = await userResolvers.Query.getAllUsers();
+    it('should return all users when authorized', async () => {
+      const result = await userResolvers.Query.getAllUsers(null, null, mockContext);
       expect(result).toEqual([{ id: '1', name: 'John Doe', email: 'john@example.com' }]);
       expect(mockGetUsers).toHaveBeenCalledTimes(1);
     });
+
+    <% if (auth.includes('JWT')) { %>
+    it('should throw error when unauthorized', async () => {
+      await expect(userResolvers.Query.getAllUsers(null, null, {})).rejects.toThrow('Unauthorized');
+    });
+    <% } %>
   });
 
   describe('Mutation.createUser', () => {
-    it('should create and return a new user', async () => {
-      const result = await userResolvers.Mutation.createUser(null, { name: 'Jane', email: 'jane@example.com' });
+    it('should create and return a new user (Public)', async () => {
+      const payload = { name: 'Jane', email: 'jane@example.com'<% if (auth.some(a => a !=='None')) { %>, password: 'password123'<% } %> };
+      const result = await userResolvers.Mutation.createUser(null, payload);
       expect(result).toEqual({ id: '1', name: 'Jane', email: 'jane@example.com' });
-      expect(mockCreateUser).toHaveBeenCalledWith({ name: 'Jane', email: 'jane@example.com' });
-      expect(mockCreateUser).toHaveBeenCalledTimes(1);
+      expect(mockCreateUser).toHaveBeenCalledWith(payload);
     });
   });
 
   describe('Mutation.updateUser', () => {
-    it('should update and return the user', async () => {
+    it('should update and return the user when authorized', async () => {
       const payload = { name: 'Updated' };
-      const result = await userResolvers.Mutation.updateUser(null, { id: '1', ...payload });
+      const result = await userResolvers.Mutation.updateUser(null, { id: '1', ...payload }, mockContext);
       expect(result).toMatchObject(payload);
     });
+
+    <% if (auth.includes('JWT')) { %>
+    it('should throw error when unauthorized', async () => {
+      await expect(userResolvers.Mutation.updateUser(null, { id: '1', name: 'N' }, {})).rejects.toThrow('Unauthorized');
+    });
+    <% } %>
   });
 
   describe('Mutation.deleteUser', () => {
-    it('should delete and return true', async () => {
-      const result = await userResolvers.Mutation.deleteUser(null, { id: '1' });
+    it('should delete and return true when authorized', async () => {
+      const result = await userResolvers.Mutation.deleteUser(null, { id: '1' }, mockContext);
       expect(result).toBe(true);
     });
+
+    <% if (auth.includes('JWT')) { %>
+    it('should throw error when unauthorized', async () => {
+      await expect(userResolvers.Mutation.deleteUser(null, { id: '1' }, {})).rejects.toThrow('Unauthorized');
+    });
+    <% } %>
   });
 <%_ if (database === 'MongoDB') { -%>
   describe('User.id', () => {

package/templates/mvc/ts/src/graphql/resolvers/user.resolvers.ts.ejs

@@ -1,24 +1,34 @@
 import { UserController } from '@/controllers/userController';
+import { MyContext } from '@/graphql/context';
 
 const userController = new UserController();
 
 export const userResolvers = {
   Query: {
-    getAllUsers: async () => {
+    getAllUsers: async (_: unknown, __: unknown, <% if (auth.includes('JWT')) { %>context<% } else { %>_context<% } %>: MyContext) => {
+      <%_ if (auth.includes('JWT')) { -%>
+      if (!context.user) throw new Error('Unauthorized');
+      <%_ } -%>
       const users = await userController.getUsers();
       return users;
     }
   },
   Mutation: {
-    createUser: async (_: unknown, { name, email }: { name: string, email: string }) => {
-      const user = await userController.createUser({ name, email });
+    createUser: async (_: unknown, { name, email<% if (auth.some(a => a !=='None')) { %>, password<% } %> }: { name: string, email: string<% if (auth.some(a => a !=='None')) { %>, password: string<% } %> }) => {
+      const user = await userController.createUser({ name, email<% if (auth.some(a => a !=='None')) { %>, password<% } %> });
       return user;
     },
-    updateUser: async (_: unknown, { id, name, email }: { id: string, name?: string, email?: string }) => {
+    updateUser: async (_: unknown, { id, name, email }: { id: string, name?: string, email?: string }, <% if (auth.includes('JWT')) { %>context<% } else { %>_context<% } %>: MyContext) => {
+      <%_ if (auth.includes('JWT')) { -%>
+      if (!context.user) throw new Error('Unauthorized');
+      <%_ } -%>
       const user = await userController.updateUser(id, { name, email });
       return user;
     },
-    deleteUser: async (_: unknown, { id }: { id: string }) => {
+    deleteUser: async (_: unknown, { id }: { id: string }, <% if (auth.includes('JWT')) { %>context<% } else { %>_context<% } %>: MyContext) => {
+      <%_ if (auth.includes('JWT')) { -%>
+      if (!context.user) throw new Error('Unauthorized');
+      <%_ } -%>
       const result = await userController.deleteUser(id);
       return result;
     }

package/templates/mvc/ts/src/graphql/typeDefs/user.types.ts.ejs

@@ -10,7 +10,7 @@ export const userTypes = `#graphql
   }
 
   type Mutation {
-    createUser(name: String!, email: String!): User
+    createUser(name: String!, email: String!<%_ if (auth.some(a => a !=='None')) { _%>, password: String!<%_ } _%>): User
     updateUser(id: ID!, name: String, email: String): User
     deleteUser(id: ID!): Boolean
   }