zyket 1.2.18 → 1.2.19

package/src/extensions/interactive-storage/index.js

@@ -15,13 +15,15 @@ module.exports = class InteractiveStorageExtension extends Extension {
   path;
   maxFileSize;
   middlewares;
+  maxDeleteBatch;
 
-  constructor({ path = '/storage', bucketName = 'dropbox', maxFileSize = 100 * 1024 * 1024, middlewares = [] } = {}) {
+  constructor({ path = '/storage', bucketName = 'dropbox', maxFileSize = 100 * 1024 * 1024, middlewares = [], maxDeleteBatch = 100 } = {}) {
     super("InteractiveStorageExtension");
     this.path = path || '/storage';
     InteractiveStorageExtension.bucketName = bucketName;
     this.maxFileSize = maxFileSize;
     this.middlewares = middlewares || [];
+    this.maxDeleteBatch = maxDeleteBatch;
   }
 
   load(container) {
@@ -47,15 +49,24 @@ module.exports = class InteractiveStorageExtension extends Extension {
       new BrowseRoute(`${this.path}/browse`, s3, InteractiveStorageExtension.bucketName, normalizePath, listFilesAndFolders),
       new DownloadRoute(`${this.path}/download/:fileName`, s3, InteractiveStorageExtension.bucketName, getFileStat),
       new InfoRoute(`${this.path}/info/:fileName`, s3, InteractiveStorageExtension.bucketName, getFileStat),
-      new DeleteRoute(`${this.path}/delete`, s3, InteractiveStorageExtension.bucketName),
+      new DeleteRoute(`${this.path}/delete`, s3, InteractiveStorageExtension.bucketName, this.maxDeleteBatch),
       new CreateFolderRoute(`${this.path}/create-folder`, s3, InteractiveStorageExtension.bucketName, normalizePath),
-      new DeleteFolderRoute(`${this.path}/delete-folder`, s3, InteractiveStorageExtension.bucketName, normalizePath, listFiles)
+      new DeleteFolderRoute(`${this.path}/delete-folder`, s3, InteractiveStorageExtension.bucketName, normalizePath, listFiles, this.maxDeleteBatch)
     ];
 
-    // Add multer middleware to upload route
-    routes[0].middlewares = {
-      post: [new MulterMiddleware(this.maxFileSize)]
-    };
+    // Apply the user-provided middlewares (e.g. authentication) to every
+    // storage route and method. They run before the route handler.
+    const userMiddlewares = this.middlewares || [];
+    for (const route of routes) {
+      route.middlewares = {
+        get: [...userMiddlewares],
+        post: [...userMiddlewares],
+        delete: [...userMiddlewares]
+      };
+    }
+
+    // Add multer middleware to the upload route, after any auth middlewares.
+    routes[0].middlewares.post = [...userMiddlewares, new MulterMiddleware(this.maxFileSize)];
 
     // Register routes using the express service pattern
     express.registerRoutes(routes);
@@ -148,8 +159,13 @@ module.exports = class InteractiveStorageExtension extends Extension {
   }
 
   #normalizePath(path) {
-    // Remove leading/trailing slashes and normalize
-    return path.replace(/^\/+|\/+$/g, '').replace(/\/+/g, '/');
+    // Normalize slashes and strip any path-traversal segments so a crafted
+    // "folder"/"folderPath" value cannot escape the intended prefix.
+    return String(path)
+      .replace(/\\/g, '/')
+      .split('/')
+      .filter((segment) => segment && segment !== '.' && segment !== '..')
+      .join('/');
   }
 
   async #getFileStat(s3, fileName) {

package/src/extensions/interactive-storage/routes/delete-folder.js

@@ -5,13 +5,15 @@ module.exports = class DeleteFolderRoute extends Route {
   bucketName;
   normalizePath;
   listFiles;
+  maxDeleteBatch;
 
-  constructor(path, s3, bucketName, normalizePath, listFiles) {
+  constructor(path, s3, bucketName, normalizePath, listFiles, maxDeleteBatch = 100) {
     super(path);
     this.s3 = s3;
     this.bucketName = bucketName;
     this.normalizePath = normalizePath;
     this.listFiles = listFiles;
+    this.maxDeleteBatch = maxDeleteBatch;
   }
 
   async delete({ container, request }) {
@@ -36,6 +38,16 @@ module.exports = class DeleteFolderRoute extends Route {
       };
     }
 
+    // Cap the batch size to avoid mass-deletion / resource-exhaustion when a
+    // prefix contains a very large number of objects.
+    if (files.length > this.maxDeleteBatch) {
+      return {
+        success: false,
+        message: `Folder contains too many files (${files.length}). Maximum allowed per request is ${this.maxDeleteBatch}`,
+        status: 400
+      };
+    }
+
     // Delete all files
     const deletePromises = files.map(file => 
       this.s3.removeFile(this.bucketName, file.name).catch(err => ({ error: err.message, fileName: file.name }))

package/src/extensions/interactive-storage/routes/delete.js

@@ -3,24 +3,35 @@ const { Route } = require('../../../services/express');
 module.exports = class DeleteRoute extends Route {
   s3;
   bucketName;
+  maxDeleteBatch;
 
-  constructor(path, s3, bucketName) {
+  constructor(path, s3, bucketName, maxDeleteBatch = 100) {
     super(path);
     this.s3 = s3;
     this.bucketName = bucketName;
+    this.maxDeleteBatch = maxDeleteBatch;
   }
 
   async delete({ container, request }) {
     const logger = container.get('logger');
     const { fileName, fileNames } = request.body;
-    
+
     // Support both single file and multiple files
     const filesToDelete = fileNames || (fileName ? [fileName] : []);
-    
+
     if (!Array.isArray(filesToDelete) || filesToDelete.length === 0) {
       return { success: false, message: 'fileName or fileNames array is required', status: 400 };
     }
 
+    // Cap the batch size to avoid mass-deletion / resource-exhaustion in a single request.
+    if (filesToDelete.length > this.maxDeleteBatch) {
+      return {
+        success: false,
+        message: `Too many files in a single request. Maximum allowed is ${this.maxDeleteBatch}`,
+        status: 400
+      };
+    }
+
     const deletePromises = filesToDelete.map(file => 
       this.s3.removeFile(this.bucketName, file).catch(err => ({ error: err.message, fileName: file }))
     );

package/src/extensions/interactive-storage/routes/download.js

@@ -1,4 +1,13 @@
 const { Route } = require('../../../services/express');
+const path = require('path');
+
+// Reject object keys that try to escape the bucket prefix or are malformed,
+// before they reach the S3 client.
+function isUnsafeKey(key) {
+  if (typeof key !== 'string' || key.length === 0) return true;
+  if (key.includes('\\') || key.startsWith('/')) return true;
+  return key.split('/').some((segment) => segment === '..' || segment === '.');
+}
 
 module.exports = class DownloadRoute extends Route {
   s3;
@@ -15,14 +24,24 @@ module.exports = class DownloadRoute extends Route {
   async get({ container, request, response }) {
     const logger = container.get('logger');
     const { fileName } = request.params;
-    
+
+    if (isUnsafeKey(fileName)) {
+      return { success: false, message: 'Invalid file name', status: 400 };
+    }
+
     try {
       // Get file info first
       const stat = await this.getFileStat(this.s3, fileName);
       
-      // Set response headers
+      // Set response headers. Sanitize the filename to prevent header
+      // injection (CRLF / quote breakout) from the user-controlled key.
+      const baseName = path.posix.basename(fileName);
+      const asciiName = baseName.replace(/[^\w.\- ]/g, '_') || 'download';
       response.setHeader('Content-Type', stat.metaData?.['content-type'] || 'application/octet-stream');
-      response.setHeader('Content-Disposition', `attachment; filename="${fileName}"`);
+      response.setHeader(
+        'Content-Disposition',
+        `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(baseName)}`
+      );
       response.setHeader('Content-Length', stat.size);
 
       // Stream the file

package/src/extensions/interactive-storage/routes/info.js

@@ -1,5 +1,13 @@
 const { Route } = require('../../../services/express');
 
+// Reject object keys that try to escape the bucket prefix or are malformed,
+// before they reach the S3 client.
+function isUnsafeKey(key) {
+  if (typeof key !== 'string' || key.length === 0) return true;
+  if (key.includes('\\') || key.startsWith('/')) return true;
+  return key.split('/').some((segment) => segment === '..' || segment === '.');
+}
+
 module.exports = class InfoRoute extends Route {
   s3;
   bucketName;
@@ -17,6 +25,11 @@ module.exports = class InfoRoute extends Route {
     
     try {
       const { fileName } = request.params;
+
+      if (isUnsafeKey(fileName)) {
+        return { success: false, message: 'Invalid file name', status: 400 };
+      }
+
       const stat = await this.getFileStat(this.s3, fileName);
       
       return {

package/src/services/auth/index.js

@@ -4,6 +4,7 @@ const { betterAuth } = require("better-auth");
 const { admin, bearer, organization } = require("better-auth/plugins");
 const { Pool } = require("pg");
 const path = require("path");
+const crypto = require("crypto");
 
 module.exports = class AuthService extends Service {
   #container;
@@ -24,13 +25,26 @@ module.exports = class AuthService extends Service {
     express.regiterRawAllRoutes("/api/auth/*splat", toNodeHandler(this.auth));
   }
 
+  // Resolve the current better-auth session from raw Node request headers
+  // (e.g. `request.headers` or `socket.handshake.headers`). Lets application
+  // code check sessions without importing better-auth directly.
+  async getSession(headers) {
+    const { fromNodeHeaders } = require('better-auth/node');
+    return this.client.api.getSession({ headers: fromNodeHeaders(headers) });
+  }
+
   #addAuthEnvVariables() {
     const EnvManager = require('../../utils/EnvManager');
     const envPath = path.join(process.cwd(), '.env');
     
-    const secretAdded = EnvManager.addEnvVariable(envPath, 'AUTH_SECRET', 'change-this-secret-in-production');
+    // Generate a strong, unique secret per project instead of a static value.
+    const generatedSecret = crypto.randomBytes(32).toString('hex');
+    const secretAdded = EnvManager.addEnvVariable(envPath, 'AUTH_SECRET', generatedSecret);
     if (secretAdded) {
-      this.#container.get('logger').info('Added AUTH_SECRET to .env file');
+      // dotenv already loaded before this file was written, so make the freshly
+      // generated value available for this first run too.
+      process.env.AUTH_SECRET = generatedSecret;
+      this.#container.get('logger').info('Generated a random AUTH_SECRET and added it to .env file');
     }
 
     const originsAdded = EnvManager.addEnvVariable(envPath, 'TRUSTED_ORIGINS', 'http://localhost:5173,http://localhost:3000');
@@ -44,6 +58,15 @@ module.exports = class AuthService extends Service {
     }
   }
 
+  #requireAuthSecret() {
+    const secret = process.env.AUTH_SECRET;
+    // Fail closed: never fall back to a hard-coded/shared secret.
+    if (!secret || secret === 'change-this-secret-in-production' || secret === 'your-secret-key-change-in-production') {
+      throw new Error('AUTH_SECRET is missing or insecure. Set a strong, unique AUTH_SECRET in your .env file.');
+    }
+    return secret;
+  }
+
   #getDatabaseConnection() {
     const dialect = process.env.DATABASE_DIALECT;
 
@@ -68,6 +91,10 @@ module.exports = class AuthService extends Service {
     return true;
   }
 
+  get requireEmailVerification() {
+    return false;
+  }
+
   get socialProviders() {
     return {}
   }
@@ -106,6 +133,17 @@ module.exports = class AuthService extends Service {
 
   get auth() {
     const cache = this.#container.get('cache');
+
+    // Environment-aware cookie security:
+    // - Cross-domain front/back (different sites): set AUTH_CROSS_DOMAIN=true ->
+    //   sameSite "none" + secure + cross-subdomain (requires HTTPS).
+    // - Otherwise (local dev, or same-site/same-domain prod): sameSite "lax" and
+    //   secure only in production, so cookies work over http://localhost in dev.
+    const crossDomain = process.env.AUTH_CROSS_DOMAIN === 'true';
+    const isProduction = process.env.NODE_ENV === 'production';
+    const cookieSameSite = crossDomain ? 'none' : 'lax';
+    const cookieSecure = crossDomain || isProduction;
+
     return betterAuth({
       hooks: this.hooks,
       plugins: [
@@ -134,32 +172,12 @@ module.exports = class AuthService extends Service {
       socialProviders: this.socialProviders,
       database: this.#getDatabaseConnection(),
       advanced: {
-        crossSubDomainCookies: {
-          enabled: true,
-        },
-        cookie: {
-          sameSite: "none",
-          secure: true,
-          path: "/",
-          state: {
-            attributes: {
-              sameSite: "none",
-              secure: true,
-            }
-          }
-        },
+        ...(crossDomain ? { crossSubDomainCookies: { enabled: true } } : {}),
         defaultCookieAttributes: {
-          secure: true,
-          sameSite: "none",
+          sameSite: cookieSameSite,
+          secure: cookieSecure,
+          httpOnly: true,
         },
-        cookies: {
-          state: {
-            attributes: {
-              sameSite: "none",
-              secure: true,
-            }
-          }
-        }
       },
       secondaryStorage: {
         get: async (key) => {
@@ -175,7 +193,7 @@ module.exports = class AuthService extends Service {
       },
       emailAndPassword: {
         enabled: true,
-        requireEmailVerification: false,
+        requireEmailVerification: this.requireEmailVerification,
         sendResetPassword: async ({ user, url, token }, request) => this.sendResetPasswordEmail({ user, url, token }, request),
       },
       emailVerification: {
@@ -195,7 +213,7 @@ module.exports = class AuthService extends Service {
         updateAge: 60 * 60 * 24
       },
       baseURL: process.env.BETTER_AUTH_URL || 'http://localhost:3000',
-      secret: process.env.AUTH_SECRET || 'your-secret-key-change-in-production',
+      secret: this.#requireAuthSecret(),
       trustedOrigins: process.env.TRUSTED_ORIGINS?.split(',') || ['http://localhost:5173', 'http://localhost:6632']
     })
   }

package/src/services/express/Express.js

@@ -29,19 +29,36 @@ module.exports = class Express extends Service {
     this.#httpServer = httpServer;
     this.#app = express();
 
-    this.#app.use(express.json({ limit: `100mb` }))
+    // Configurable JSON body limit (defaults to 10mb) to reduce DoS surface.
+    this.#app.use(express.json({ limit: process.env.HTTP_JSON_LIMIT || '10mb' }))
 
     const corsOptions = await this.#loadCorsOrCreateDefault();
 
     if(corsOptions) this.#app.use(cors(corsOptions));
 
-    // Swagger setup
-    const swaggerOptions = {
-      ...(await this.#loadSwaggerOrCreateDefault()),
-    };
+    // Swagger setup (optional). Can be fully disabled, or protected with
+    // HTTP Basic auth by setting SWAGGER_PASSWORD.
+    if (process.env.DISABLE_SWAGGER !== 'true') {
+      const swaggerOptions = {
+        ...(await this.#loadSwaggerOrCreateDefault()),
+      };
+
+      const swaggerDocs = swaggerJsDoc(swaggerOptions);
+      const swaggerPath = process?.env?.SWAGGER_PATH || "/docs";
+      const swaggerMiddlewares = [];
 
-    const swaggerDocs = swaggerJsDoc(swaggerOptions);
-    this.#app.use(process?.env?.SWAGGER_PATH || "/docs", swaggerUi.serve, swaggerUi.setup(swaggerDocs));
+      if (process.env.SWAGGER_PASSWORD) {
+        const basicAuth = require("express-basic-auth");
+        swaggerMiddlewares.push(basicAuth({
+          users: { [process.env.SWAGGER_USER || 'admin']: process.env.SWAGGER_PASSWORD },
+          challenge: true,
+        }));
+      } else {
+        this.#container.get('logger').warn(`Swagger docs are exposed without authentication at ${swaggerPath}. Set SWAGGER_PASSWORD to protect them or DISABLE_SWAGGER=true to disable.`);
+      }
+
+      this.#app.use(swaggerPath, ...swaggerMiddlewares, swaggerUi.serve, swaggerUi.setup(swaggerDocs));
+    }
 
     const routes = await this.#loadRoutesFromFolder(path.join(process.cwd(), "src", "routes"));
 
@@ -64,8 +81,8 @@ module.exports = class Express extends Service {
             try { 
               await mw.handle({ container: this.#container, request: req, response: res, next })
             } catch (error) {
-              this.#container.get('logger').error(`Error in middleware for route [${methodName}] ${route.path}: ${error.message}`);
-              return res.status(500).json({ success: false, message: error.message || 'Internal Server Error' });
+              this.#container.get('logger').error(`Error in middleware for route [${methodName}] ${route.path}: ${error.stack || error.message}`);
+              return res.status(500).json({ success: false, message: 'Internal Server Error' });
             }
           }), 
           async (req, res) => {
@@ -87,8 +104,8 @@ module.exports = class Express extends Service {
                 success: routeResponse?.success !== false,
               });
             } catch (error) {
-              this.#container.get('logger').error(`Error in route [${methodName}] ${route.path}: ${error.message}`);
-              return res.status(500).json({ success: false, message: error.message || 'Internal Server Error' });
+              this.#container.get('logger').error(`Error in route [${methodName}] ${route.path}: ${error.stack || error.message}`);
+              return res.status(500).json({ success: false, message: 'Internal Server Error' });
             }
           });
         }
@@ -120,8 +137,8 @@ module.exports = class Express extends Service {
             try { 
               await mw.handle({ container: this.#container, request: req, response: res, next })
             } catch (error) {
-              this.#container.get('logger').error(`Error in middleware for route [${methodName}] ${route.path}: ${error.message}`);
-              return res.status(500).json({ success: false, message: error.message || 'Internal Server Error' });
+              this.#container.get('logger').error(`Error in middleware for route [${methodName}] ${route.path}: ${error.stack || error.message}`);
+              return res.status(500).json({ success: false, message: 'Internal Server Error' });
             }
           }),
           async (req, res) => {
@@ -143,8 +160,8 @@ module.exports = class Express extends Service {
                 success: routeResponse?.success !== false,
               });
             } catch (error) {
-              this.#container.get('logger').error(`Error in route [${methodName}] ${route.path}: ${error.message}`);
-              return res.status(500).json({ success: false, message: error.message || 'Internal Server Error' });
+              this.#container.get('logger').error(`Error in route [${methodName}] ${route.path}: ${error.stack || error.message}`);
+              return res.status(500).json({ success: false, message: 'Internal Server Error' });
             }
           });
       }

package/src/services/express/RequireAdminMiddleware.js

@@ -0,0 +1,14 @@
+const RequireAuthMiddleware = require("./RequireAuthMiddleware");
+
+/**
+ * Convenience middleware that requires an authenticated user with the
+ * `admin` role (better-auth admin plugin).
+ *
+ * Usage in a Route:
+ *   middlewares = { delete: [ new RequireAdminMiddleware() ] }
+ */
+module.exports = class RequireAdminMiddleware extends RequireAuthMiddleware {
+  constructor(adminRole = 'admin') {
+    super([adminRole]);
+  }
+};

package/src/services/express/RequireAuthMiddleware.js

@@ -0,0 +1,46 @@
+const Middleware = require("./Middleware");
+const { fromNodeHeaders } = require("better-auth/node");
+
+/**
+ * Blocks the request unless there is a valid better-auth session.
+ * Optionally restricts access to a set of roles (admin plugin).
+ *
+ * On success it attaches `request.user` and `request.session`.
+ *
+ * Usage in a Route:
+ *   middlewares = { get: [ new RequireAuthMiddleware() ] }
+ *   middlewares = { post: [ new RequireAuthMiddleware(['admin']) ] }
+ */
+module.exports = class RequireAuthMiddleware extends Middleware {
+  constructor(roles = []) {
+    super();
+    this.roles = Array.isArray(roles) ? roles : [roles].filter(Boolean);
+  }
+
+  async handle({ container, request, response, next }) {
+    const auth = container.get('auth');
+    if (!auth || !auth.client) {
+      return response.status(500).json({ success: false, message: 'Auth service not available' });
+    }
+
+    const session = await auth.client.api.getSession({
+      headers: fromNodeHeaders(request.headers)
+    });
+
+    if (!session || !session.user) {
+      return response.status(401).json({ success: false, message: 'Unauthorized' });
+    }
+
+    if (this.roles.length > 0) {
+      const userRoles = String(session.user.role || '').split(',').map((r) => r.trim());
+      const allowed = this.roles.some((role) => userRoles.includes(role));
+      if (!allowed) {
+        return response.status(403).json({ success: false, message: 'Forbidden' });
+      }
+    }
+
+    request.user = session.user;
+    request.session = session.session;
+    next();
+  }
+};

package/src/services/express/index.js

@@ -1,5 +1,7 @@
-module.exports = {
-  Express: require("./Express"),
-  Route: require("./Route"),
-  Middleware: require("./Middleware"),
-}
+module.exports = {
+  Express: require("./Express"),
+  Route: require("./Route"),
+  Middleware: require("./Middleware"),
+  RequireAuthMiddleware: require("./RequireAuthMiddleware"),
+  RequireAdminMiddleware: require("./RequireAdminMiddleware"),
+}

package/src/services/socketio/AuthGuard.js

@@ -0,0 +1,33 @@
+const Guard = require("./Guard");
+const { fromNodeHeaders } = require("better-auth/node");
+
+/**
+ * Socket.IO guard that rejects the connection/event unless there is a valid
+ * better-auth session in the handshake. Throwing here blocks the event
+ * (see SocketIO service guard handling).
+ *
+ * On success it attaches the user to `socket.data.user`.
+ *
+ * Usage: create `src/guards/auth.js` with:
+ *   module.exports = require('zyket').AuthGuard;
+ * and reference it from a handler: `guards = ["auth"];`
+ */
+module.exports = class AuthGuard extends Guard {
+  async handle({ container, socket }) {
+    const auth = container.get('auth');
+    if (!auth || !auth.client) {
+      throw new Error('Auth service not available');
+    }
+
+    const session = await auth.client.api.getSession({
+      headers: fromNodeHeaders(socket.handshake.headers)
+    });
+
+    if (!session || !session.user) {
+      throw new Error('Unauthorized');
+    }
+
+    socket.data.user = session.user;
+    socket.data.session = session.session;
+  }
+};

package/src/services/socketio/SocketIO.js

@@ -29,7 +29,9 @@ module.exports = class SocketIO extends Service {
     this.#container.get('logger').debug(`Guards: ${guards.map(mdl => mdl.name).join(", ")}`);
     this.#container.get('logger').debug(`Handlers: ${handlers.map(hdl => hdl.event).join(", ")}`);
     
-    this.io = new Server({ cors: { origin: "*" }, maxHttpBufferSize: 10 * 1024 * 1024 });
+    // Configurable max payload size (defaults to 10mb) to reduce DoS surface.
+    const maxHttpBufferSize = Number(process.env.SOCKET_MAX_HTTP_BUFFER_SIZE) || 10 * 1024 * 1024;
+    this.io = new Server({ cors: { origin: "*" }, maxHttpBufferSize });
 
     if (process.env.REDIS_URL) {
       await this.#attachRedisAdapter();

package/src/services/socketio/index.js

@@ -1,5 +1,6 @@
 module.exports = {
   SocketIO: require("./SocketIO"),
   Handler: require("./Handler"),
-  Guard: require("./Guard")
+  Guard: require("./Guard"),
+  AuthGuard: require("./AuthGuard")
 }

package/src/services/template-manager/index.js

@@ -13,6 +13,7 @@ module.exports = class TemplateManager extends Service {
   async boot() {
     const zyketTemplates = await fg(['**/*'], {
       cwd: path.join(__dirname, '../../templates'),
+      dot: true, // include dotfiles like .env.example
     });
     console.log('Found templates:', zyketTemplates);
     for (const template of zyketTemplates) {

package/src/templates/api-rest/.env.example

@@ -0,0 +1,24 @@
+# --- api-rest template ---
+# Zyket auto-generates a .env on first run; these are the relevant values.
+
+DEBUG=true
+PORT=3000
+
+# Backend only: no socket, no frontend
+DISABLE_EXPRESS=false
+DISABLE_SOCKET=true
+DISABLE_VITE=true
+
+# Database (auth requires postgresql or sqlite)
+DATABASE_URL=./database.sqlite
+DATABASE_DIALECT=sqlite
+
+# Payload limits (see SECURITY.md)
+HTTP_JSON_LIMIT=10mb
+
+# Protect Swagger docs in production
+# SWAGGER_PASSWORD=change-me
+
+# Auth — AUTH_SECRET is generated automatically on first run.
+# BETTER_AUTH_URL=http://localhost:3000
+# TRUSTED_ORIGINS=http://localhost:3000

package/src/templates/api-rest/README.md

@@ -0,0 +1,50 @@
+# api-rest template
+
+Backend-only REST API starter with email/password auth and a protected CRUD
+resource (`Task`). No frontend, no sockets.
+
+## What's included
+- `index.js` — boots the kernel (auth + database + express) and syncs the `Task` table.
+- `src/services/auth/` — auth service (email/password, no organizations).
+- `src/models/Task.js` — example Sequelize model.
+- `src/routes/tasks/` — full CRUD, every endpoint protected with `RequireAuthMiddleware`.
+
+## Endpoints (all require a valid session)
+| Method | Path | Description |
+|--------|------|-------------|
+| GET    | `/tasks`      | List tasks |
+| POST   | `/tasks`      | Create a task `{ title, description? }` |
+| GET    | `/tasks/:id`  | Get one task |
+| PUT    | `/tasks/:id`  | Update a task |
+| DELETE | `/tasks/:id`  | Delete a task |
+
+Auth endpoints are mounted by better-auth under `/api/auth/*`.
+
+## Setup
+```bash
+npm install
+# 1) Create the better-auth tables (uses src/services/auth/auth.js)
+npx @better-auth/cli migrate
+# 2) Run
+node index.js
+```
+
+The `Task` table is created automatically via `sequelize.sync()` on boot.
+
+## Auth quick test
+```bash
+# Sign up
+curl -X POST http://localhost:3000/api/auth/sign-up/email \
+  -H "Content-Type: application/json" \
+  -d '{"email":"me@example.com","password":"supersecret","name":"Me"}' -c cookies.txt
+
+# Create a task with the session cookie
+curl -X POST http://localhost:3000/tasks \
+  -H "Content-Type: application/json" -b cookies.txt \
+  -d '{"title":"My first task"}'
+```
+
+## Notes
+- `RequireAuthMiddleware` attaches `request.user` / `request.session`. Restrict by role with `new RequireAuthMiddleware(['admin'])`.
+- Email sending is stubbed (logged to console) — wire a real provider in `src/services/auth/index.js`.
+- Review [SECURITY.md] in the framework for hardening (Swagger password, CORS, rate limiting).

package/src/templates/api-rest/index.js

@@ -0,0 +1,18 @@
+const { Kernel } = require('zyket');
+
+const kernel = new Kernel({
+  services: [
+    // The database and express services are auto-registered by the framework
+    // (they activate from your .env). We only register the auth service here.
+    ['auth', require('./src/services/auth'), ['@service_container']],
+  ],
+});
+
+kernel.boot().then(async () => {
+  // Create the example tables (Task). better-auth tables are created via the
+  // better-auth CLI migrate step (see README).
+  await kernel.container.get('database').sync();
+  kernel.container.get('logger').info('api-rest template ready — try GET /tasks');
+}).catch((error) => {
+  console.error('Error booting kernel:', error);
+});