partweave 0.1.1

package/modules/auth/mobile/src/auth/auth-context.tsx

@@ -0,0 +1,61 @@
+import { createContext, useContext, useEffect, useState } from "react";
+import type { ReactNode } from "react";
+import type { AuthUser, Credentials } from "@app/shared";
+import * as auth from "@/auth/client";
+
+interface AuthState {
+  user: AuthUser | null;
+  loading: boolean;
+  login: (creds: Credentials) => Promise<void>;
+  register: (creds: Credentials) => Promise<void>;
+  logout: () => Promise<void>;
+}
+
+const AuthCtx = createContext<AuthState | null>(null);
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [user, setUser] = useState<AuthUser | null>(null);
+  const [loading, setLoading] = useState(true);
+
+  async function load() {
+    try {
+      setUser(await auth.fetchMe());
+    } catch (err) {
+      // A 401 means the stored token is stale/expired — clear it so it isn't
+      // re-sent on later requests. Other errors (e.g. server down) keep it.
+      if (err instanceof auth.ApiError && err.status === 401) await auth.logout();
+      setUser(null);
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  useEffect(() => {
+    void load();
+  }, []);
+
+  const value: AuthState = {
+    user,
+    loading,
+    login: async (creds) => {
+      await auth.login(creds);
+      await load();
+    },
+    register: async (creds) => {
+      await auth.register(creds);
+      await load();
+    },
+    logout: async () => {
+      await auth.logout();
+      setUser(null);
+    },
+  };
+
+  return <AuthCtx.Provider value={value}>{children}</AuthCtx.Provider>;
+}
+
+export function useAuth(): AuthState {
+  const ctx = useContext(AuthCtx);
+  if (!ctx) throw new Error("useAuth must be used within <AuthProvider>");
+  return ctx;
+}

package/modules/auth/mobile/src/auth/client.test.ts

@@ -0,0 +1,69 @@
+/** @jest-environment node */
+let mockToken: string | null = null;
+
+jest.mock("@/lib/config", () => ({ API_URL: "http://api.test" }));
+jest.mock("@/lib/token-store", () => ({
+  tokenStore: {
+    get: jest.fn(async () => mockToken),
+    set: jest.fn(async () => {}),
+    clear: jest.fn(async () => {}),
+  },
+}));
+
+import { register, login, fetchMe, logout, ApiError } from "./client";
+import { tokenStore } from "@/lib/token-store";
+
+// A minimal Response-shaped object so the test doesn't depend on a global
+// Response being present in the test environment.
+function fakeRes(body: unknown, status = 200) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: async () => body,
+    text: async () => JSON.stringify(body),
+  };
+}
+function callTo(path: string): unknown[] | undefined {
+  return (global.fetch as jest.Mock).mock.calls.find((c) => String(c[0]).endsWith(path));
+}
+function authHeaderOf(call: unknown[] | undefined): unknown {
+  const init = call?.[1] as { headers?: Record<string, unknown> } | undefined;
+  return init?.headers?.Authorization;
+}
+
+describe("mobile auth client", () => {
+  beforeEach(() => {
+    mockToken = "STALE.TOKEN"; // a leftover token is present
+    global.fetch = jest.fn(async () => fakeRes({ access: "a", refresh: "r" })) as unknown as typeof fetch;
+  });
+
+  it("register sends NO Authorization even with a stored token (regression: 401 on register)", async () => {
+    await register({ email: "a@b.com", password: "supersecret" });
+    const call = callTo("/api/auth/register");
+    expect(call).toBeTruthy();
+    expect(authHeaderOf(call)).toBeUndefined();
+  });
+
+  it("login sends NO Authorization", async () => {
+    await login({ email: "a@b.com", password: "supersecret" });
+    expect(authHeaderOf(callTo("/api/auth/token"))).toBeUndefined();
+  });
+
+  it("fetchMe DOES send the stored token", async () => {
+    (global.fetch as jest.Mock).mockResolvedValueOnce(fakeRes({ id: 1, email: "a@b.com" }));
+    await fetchMe();
+    expect(authHeaderOf(callTo("/api/auth/me"))).toBe("Bearer STALE.TOKEN");
+  });
+
+  it("throws ApiError carrying the HTTP status on failure", async () => {
+    (global.fetch as jest.Mock).mockResolvedValueOnce(fakeRes({ detail: "no" }, 401));
+    await expect(fetchMe()).rejects.toBeInstanceOf(ApiError);
+    (global.fetch as jest.Mock).mockResolvedValueOnce(fakeRes({ detail: "no" }, 401));
+    await expect(fetchMe()).rejects.toMatchObject({ status: 401 });
+  });
+
+  it("logout clears the token store", async () => {
+    await logout();
+    expect(tokenStore.clear).toHaveBeenCalled();
+  });
+});

package/modules/auth/mobile/src/auth/client.ts

@@ -0,0 +1,59 @@
+import type { AuthTokens, AuthUser, Credentials } from "@app/shared";
+import { API_URL } from "@/lib/config";
+import { tokenStore } from "@/lib/token-store";
+
+/** Error carrying the HTTP status, so callers can react to e.g. a 401. */
+export class ApiError extends Error {
+  constructor(
+    public status: number,
+    body: string,
+  ) {
+    super(`${status} ${body}`);
+    this.name = "ApiError";
+  }
+}
+
+// `auth` defaults to true — the stored token is attached. Public endpoints
+// (register/login/refresh) MUST pass `auth: false`: sending a stale/expired
+// token to them makes the server's JWTAuthentication reject the request with a
+// 401 before it ever reaches the AllowAny permission.
+async function req<T>(path: string, init: RequestInit & { auth?: boolean } = {}): Promise<T> {
+  const { auth = true, headers, ...rest } = init;
+  const token = auth ? await tokenStore.get() : null;
+  const res = await fetch(`${API_URL}${path}`, {
+    ...rest,
+    headers: {
+      "Content-Type": "application/json",
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...(headers ?? {}),
+    },
+  });
+  if (!res.ok) throw new ApiError(res.status, await res.text());
+  return (res.status === 204 ? null : await res.json()) as T;
+}
+
+export async function login(creds: Credentials): Promise<void> {
+  const tokens = await req<AuthTokens>("/api/auth/token", {
+    method: "POST",
+    body: JSON.stringify(creds),
+    auth: false,
+  });
+  await tokenStore.set(tokens);
+}
+
+export async function register(creds: Credentials): Promise<void> {
+  await req("/api/auth/register", {
+    method: "POST",
+    body: JSON.stringify(creds),
+    auth: false,
+  });
+  await login(creds);
+}
+
+export async function fetchMe(): Promise<AuthUser> {
+  return req<AuthUser>("/api/auth/me");
+}
+
+export async function logout(): Promise<void> {
+  await tokenStore.clear();
+}

package/modules/auth/mobile/src/lib/config.ts

@@ -0,0 +1,22 @@
+import Constants from "expo-constants";
+
+/**
+ * A physical device (Expo Go) can't reach the server at "localhost" — that's the
+ * phone itself. In dev we derive the dev machine's LAN IP from Metro's host URI
+ * (e.g. "192.168.1.78:8081") and point at its :8000.
+ *
+ * Set EXPO_PUBLIC_API_URL to override (required for production / device builds
+ * and simulators on a different network).
+ */
+function devServerUrl(): string | undefined {
+  const c = Constants as unknown as {
+    expoConfig?: { hostUri?: string } | null;
+    expoGoConfig?: { debuggerHost?: string } | null;
+  };
+  const hostUri = c.expoConfig?.hostUri ?? c.expoGoConfig?.debuggerHost;
+  const host = hostUri?.split(":")[0];
+  return host ? `http://${host}:8000` : undefined;
+}
+
+export const API_URL =
+  process.env.EXPO_PUBLIC_API_URL ?? devServerUrl() ?? "http://localhost:8000";

package/modules/auth/mobile/src/lib/token-store.ts

@@ -0,0 +1,20 @@
+import * as SecureStore from "expo-secure-store";
+import type { AuthTokens, TokenStore } from "@app/shared";
+
+const ACCESS = "access_token";
+const REFRESH = "refresh_token";
+
+/** Mobile TokenStore over the device secure enclave (same interface as web). */
+export const tokenStore: TokenStore = {
+  async get() {
+    return SecureStore.getItemAsync(ACCESS);
+  },
+  async set(tokens: AuthTokens) {
+    await SecureStore.setItemAsync(ACCESS, tokens.access);
+    await SecureStore.setItemAsync(REFRESH, tokens.refresh);
+  },
+  async clear() {
+    await SecureStore.deleteItemAsync(ACCESS);
+    await SecureStore.deleteItemAsync(REFRESH);
+  },
+};

package/modules/auth/module.json

@@ -0,0 +1,47 @@
+{
+  "id": "auth",
+  "title": "Authentication (JWT)",
+  "description": "Email/password auth with JWT — register, login, refresh, and a current-user endpoint.",
+  "kind": "feature",
+  "targets": ["server", "web", "mobile", "shared"],
+  "requiresApps": ["server"],
+  "requires": ["db-postgres"],
+  "provides": "auth",
+  "default": true,
+  "wiring": {
+    "server": {
+      "installedApps": ["\"accounts\","],
+      "urls": ["path(\"api/auth/\", include(\"accounts.urls\")),"],
+      "settings": ["AUTH_USER_MODEL = \"accounts.User\""],
+      "deps": ["djangorestframework-simplejwt>=5.3"],
+      "anchors": {
+        "drf-auth": ["\"rest_framework_simplejwt.authentication.JWTAuthentication\","]
+      }
+    },
+    "shared": {
+      "anchors": {
+        "exports": ["export * from \"./auth\";"]
+      }
+    },
+    "web": {
+      "providers": ["AuthProvider,"],
+      "routes": ["{ href: \"/login\", label: \"Log in\" },"],
+      "deps": ["@app/shared@workspace:*"],
+      "anchors": {
+        "providers-import": ["import { AuthProvider } from \"@/auth/auth-context\";"]
+      }
+    },
+    "mobile": {
+      "providers": ["AuthProvider,"],
+      "routes": ["{ href: \"/login\", label: \"Log in\" },"],
+      "deps": ["@app/shared@workspace:*", "expo-secure-store@~15.0.8"],
+      "anchors": {
+        "providers-import": ["import { AuthProvider } from \"@/auth/auth-context\";"]
+      }
+    }
+  },
+  "notes": [
+    "Auth endpoints: POST /api/auth/register, POST /api/auth/token, POST /api/auth/token/refresh, GET /api/auth/me",
+    "Web stores tokens in localStorage (swap for httpOnly cookies in production); mobile uses expo-secure-store."
+  ]
+}

package/modules/auth/server/accounts/admin.py

@@ -0,0 +1,4 @@
+from django.contrib import admin
+from django.contrib.auth import get_user_model
+
+admin.site.register(get_user_model())

package/modules/auth/server/accounts/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class AccountsConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "accounts"

package/modules/auth/server/accounts/migrations/0001_initial.py

@@ -0,0 +1,38 @@
+# Generated by Django 5.2.16 on 2026-07-08 09:52
+
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('auth', '0012_alter_user_first_name_max_length'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='User',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('password', models.CharField(max_length=128, verbose_name='password')),
+                ('last_login', models.DateTimeField(blank=True, null=True, verbose_name='last login')),
+                ('is_superuser', models.BooleanField(default=False, help_text='Designates that this user has all permissions without explicitly assigning them.', verbose_name='superuser status')),
+                ('first_name', models.CharField(blank=True, max_length=150, verbose_name='first name')),
+                ('last_name', models.CharField(blank=True, max_length=150, verbose_name='last name')),
+                ('is_staff', models.BooleanField(default=False, help_text='Designates whether the user can log into this admin site.', verbose_name='staff status')),
+                ('is_active', models.BooleanField(default=True, help_text='Designates whether this user should be treated as active. Unselect this instead of deleting accounts.', verbose_name='active')),
+                ('date_joined', models.DateTimeField(default=django.utils.timezone.now, verbose_name='date joined')),
+                ('email', models.EmailField(max_length=254, unique=True)),
+                ('groups', models.ManyToManyField(blank=True, help_text='The groups this user belongs to. A user will get all permissions granted to each of their groups.', related_name='user_set', related_query_name='user', to='auth.group', verbose_name='groups')),
+                ('user_permissions', models.ManyToManyField(blank=True, help_text='Specific permissions for this user.', related_name='user_set', related_query_name='user', to='auth.permission', verbose_name='user permissions')),
+            ],
+            options={
+                'verbose_name': 'user',
+                'verbose_name_plural': 'users',
+                'abstract': False,
+            },
+        ),
+    ]

package/modules/auth/server/accounts/models.py

@@ -0,0 +1,39 @@
+from django.contrib.auth.models import AbstractUser, BaseUserManager
+from django.db import models
+
+
+class UserManager(BaseUserManager):
+    """User manager keyed on email instead of username."""
+
+    def _create_user(self, email: str, password: str | None, **extra):
+        if not email:
+            raise ValueError("Users must have an email address")
+        user = self.model(email=self.normalize_email(email), **extra)
+        user.set_password(password)
+        user.save(using=self._db)
+        return user
+
+    def create_user(self, email: str, password: str | None = None, **extra):
+        extra.setdefault("is_staff", False)
+        extra.setdefault("is_superuser", False)
+        return self._create_user(email, password, **extra)
+
+    def create_superuser(self, email: str, password: str | None = None, **extra):
+        extra.setdefault("is_staff", True)
+        extra.setdefault("is_superuser", True)
+        return self._create_user(email, password, **extra)
+
+
+class User(AbstractUser):
+    """Custom user: log in with email, no username."""
+
+    username = None  # type: ignore[assignment]
+    email = models.EmailField(unique=True)
+
+    USERNAME_FIELD = "email"
+    REQUIRED_FIELDS: list[str] = []
+
+    objects = UserManager()
+
+    def __str__(self) -> str:
+        return self.email

package/modules/auth/server/accounts/serializers.py

@@ -0,0 +1,21 @@
+from django.contrib.auth import get_user_model
+from rest_framework import serializers
+
+User = get_user_model()
+
+
+class UserSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = User
+        fields = ["id", "email"]
+
+
+class RegisterSerializer(serializers.ModelSerializer):
+    password = serializers.CharField(write_only=True, min_length=8)
+
+    class Meta:
+        model = User
+        fields = ["id", "email", "password"]
+
+    def create(self, validated_data):
+        return User.objects.create_user(**validated_data)

package/modules/auth/server/accounts/urls.py

@@ -0,0 +1,11 @@
+from django.urls import path
+from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView
+
+from .views import MeView, RegisterView
+
+urlpatterns = [
+    path("register", RegisterView.as_view(), name="register"),
+    path("token", TokenObtainPairView.as_view(), name="token"),
+    path("token/refresh", TokenRefreshView.as_view(), name="token_refresh"),
+    path("me", MeView.as_view(), name="me"),
+]

package/modules/auth/server/accounts/views.py

@@ -0,0 +1,26 @@
+from django.contrib.auth import get_user_model
+from rest_framework import generics, permissions
+from rest_framework.request import Request
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from .serializers import RegisterSerializer, UserSerializer
+
+User = get_user_model()
+
+
+class RegisterView(generics.CreateAPIView):
+    queryset = User.objects.all()
+    serializer_class = RegisterSerializer
+    permission_classes = [permissions.AllowAny]
+    # Registration is public: don't attempt JWT authentication at all. Otherwise a
+    # stale/expired token sent by a client would make authentication fail with 401
+    # before AllowAny is ever checked, blocking registration.
+    authentication_classes: list = []
+
+
+class MeView(APIView):
+    permission_classes = [permissions.IsAuthenticated]
+
+    def get(self, request: Request) -> Response:
+        return Response(UserSerializer(request.user).data)

package/modules/auth/server/tests/test_auth.py

@@ -0,0 +1,44 @@
+import pytest
+
+CREDS = {"email": "a@b.com", "password": "supersecret"}
+
+
+@pytest.mark.django_db
+def test_register_login_me():
+    from django.test import Client
+
+    client = Client()
+
+    r = client.post("/api/auth/register", CREDS, content_type="application/json")
+    assert r.status_code == 201, r.content
+
+    r = client.post("/api/auth/token", CREDS, content_type="application/json")
+    assert r.status_code == 200, r.content
+    access = r.json()["access"]
+
+    r = client.get("/api/auth/me", HTTP_AUTHORIZATION=f"Bearer {access}")
+    assert r.status_code == 200
+    assert r.json()["email"] == CREDS["email"]
+
+    # unauthenticated request is rejected
+    assert client.get("/api/auth/me").status_code == 401
+
+
+@pytest.mark.django_db
+def test_register_ignores_stale_token():
+    """A leftover/invalid token in the client must not block registration.
+
+    Regression test: register is public, so authentication must not run on it —
+    otherwise a stale Authorization header 401s before AllowAny is checked.
+    """
+    from django.test import Client
+
+    client = Client()
+    creds = {"email": "c@d.com", "password": "supersecret"}
+    r = client.post(
+        "/api/auth/register",
+        creds,
+        content_type="application/json",
+        HTTP_AUTHORIZATION="Bearer this.is.a.stale.garbage.token",
+    )
+    assert r.status_code == 201, r.content

package/modules/auth/shared/src/auth.ts

@@ -0,0 +1,27 @@
+/** Auth contracts shared by web and mobile. Concrete impls live per-platform. */
+
+export interface Credentials {
+  email: string;
+  password: string;
+}
+
+export interface AuthTokens {
+  access: string;
+  refresh: string;
+}
+
+export interface AuthUser {
+  id: number;
+  email: string;
+}
+
+/**
+ * Where access/refresh tokens are persisted. Web implements this over
+ * localStorage/cookies; mobile over expo-secure-store. Consumers depend on this
+ * interface, never on a concrete store.
+ */
+export interface TokenStore {
+  get(): Promise<string | null>;
+  set(tokens: AuthTokens): Promise<void>;
+  clear(): Promise<void>;
+}

package/modules/auth/web/app/login/page.tsx

@@ -0,0 +1,61 @@
+"use client";
+
+import { type FormEvent, useState } from "react";
+import { useRouter } from "next/navigation";
+import { useAuth } from "@/auth/auth-context";
+
+export default function LoginPage() {
+  const { login, register } = useAuth();
+  const router = useRouter();
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [mode, setMode] = useState<"login" | "register">("login");
+  const [error, setError] = useState<string | null>(null);
+
+  async function onSubmit(e: FormEvent) {
+    e.preventDefault();
+    setError(null);
+    try {
+      await (mode === "login" ? login : register)({ email, password });
+      router.push("/");
+    } catch {
+      setError(mode === "login" ? "Invalid credentials" : "Registration failed");
+    }
+  }
+
+  return (
+    <main className="mx-auto max-w-sm p-8">
+      <h1 className="text-2xl font-bold">
+        {mode === "login" ? "Log in" : "Create account"}
+      </h1>
+      <form onSubmit={onSubmit} className="mt-6 space-y-3">
+        <input
+          className="w-full rounded border p-2"
+          type="email"
+          placeholder="Email"
+          value={email}
+          onChange={(e) => setEmail(e.target.value)}
+          required
+        />
+        <input
+          className="w-full rounded border p-2"
+          type="password"
+          placeholder="Password"
+          value={password}
+          onChange={(e) => setPassword(e.target.value)}
+          required
+        />
+        {error && <p className="text-sm text-red-600">{error}</p>}
+        <button className="w-full rounded bg-blue-600 p-2 text-white" type="submit">
+          {mode === "login" ? "Log in" : "Sign up"}
+        </button>
+      </form>
+      <button
+        className="mt-4 text-sm text-blue-600 underline"
+        onClick={() => setMode(mode === "login" ? "register" : "login")}
+      >
+        {mode === "login" ? "Need an account? Sign up" : "Have an account? Log in"}
+      </button>
+    </main>
+  );
+}

package/modules/auth/web/src/auth/auth-context.test.tsx

@@ -0,0 +1,66 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen } from "@testing-library/react";
+
+// Defined via vi.hoisted so they exist when the hoisted vi.mock() factory runs.
+// A real ApiError class so the provider's `instanceof` check works.
+const { ApiError, fetchMe, logout } = vi.hoisted(() => {
+  class ApiError extends Error {
+    status: number;
+    constructor(status: number, body = "") {
+      super(`${status} ${body}`);
+      this.name = "ApiError";
+      this.status = status;
+    }
+  }
+  return { ApiError, fetchMe: vi.fn(), logout: vi.fn(async () => {}) };
+});
+
+vi.mock("@/auth/client", () => ({
+  ApiError,
+  fetchMe,
+  logout,
+  login: vi.fn(async () => {}),
+  register: vi.fn(async () => {}),
+}));
+
+import { AuthProvider, useAuth } from "./auth-context";
+
+function Probe() {
+  const { user, loading } = useAuth();
+  return <span>{loading ? "loading" : user ? user.email : "anon"}</span>;
+}
+const renderProvider = () =>
+  render(
+    <AuthProvider>
+      <Probe />
+    </AuthProvider>,
+  );
+
+describe("web AuthProvider", () => {
+  beforeEach(() => {
+    fetchMe.mockReset();
+    logout.mockReset();
+  });
+
+  it("loads the current user on mount", async () => {
+    fetchMe.mockResolvedValueOnce({ id: 1, email: "a@b.com" });
+    renderProvider();
+    expect(await screen.findByText("a@b.com")).toBeTruthy();
+    expect(logout).not.toHaveBeenCalled();
+  });
+
+  it("clears a stale token when /me returns 401", async () => {
+    fetchMe.mockRejectedValueOnce(new ApiError(401, "expired"));
+    renderProvider();
+    expect(await screen.findByText("anon")).toBeTruthy();
+    expect(logout).toHaveBeenCalledTimes(1); // stale token cleared
+  });
+
+  it("keeps the token on a non-401 failure (e.g. server unreachable)", async () => {
+    fetchMe.mockRejectedValueOnce(new Error("network down"));
+    renderProvider();
+    expect(await screen.findByText("anon")).toBeTruthy();
+    expect(logout).not.toHaveBeenCalled();
+  });
+});