first commit

examples/basic-app/app/api/echo.ts

@@ -0,0 +1,13 @@
+import type { Context } from "@wrnexus/core";
+
+// Demonstrates method-specific handlers on a single route file.
+// GET /api/echo  -> usage hint
+// POST /api/echo -> echoes the JSON body back
+export const GET = async () => {
+  return Response.json({ usage: "POST JSON here and it will be echoed back" });
+};
+
+export const POST = async (ctx: Context) => {
+  const body = await ctx.req.json();
+  return Response.json({ received: body });
+};

examples/basic-app/app/api/hello.ts

@@ -0,0 +1,7 @@
+// GET /api/hello  ->  { message: "<translated>", lang: "<active>" }
+// Uses ctx.t / ctx.lang, resolved from the wire-lang cookie or Accept-Language.
+import type { Context } from "@wrnexus/core";
+
+export const GET = async (ctx: Context) => {
+  return Response.json({ message: ctx.t("api.greeting"), lang: ctx.lang });
+};

examples/basic-app/app/api/login.ts

@@ -0,0 +1,24 @@
+// API route: POST /api/login. Validates the body with the SAME schema the form
+// uses on the client, then checks the password hash and starts a session.
+import { verifyCsrf, verifyPassword, logIn, type Context } from "@wrnexus/core";
+import { getDb } from "@wrnexus/db";
+import { parseBody } from "@wrnexus/validation";
+import login from "../schemas/login.ts";
+import { GetUserByEmail } from "../db/queries.gen.ts";
+
+export async function POST(ctx: Context): Promise<Response> {
+  if (!verifyCsrf(ctx)) return new Response("Invalid CSRF token", { status: 403 });
+
+  const result = await parseBody(login, ctx.req);
+  if (!result.ok) return result.response; // 400 { ok:false, errors }
+
+  const { email, password } = result.value as { email: string; password: string };
+  const user = await GetUserByEmail(getDb(), { email });
+  if (!user || !(await verifyPassword(password, user.passwordHash))) {
+    return Response.json({ ok: false, error: "Invalid email or password" }, { status: 401 });
+  }
+
+  // Store only safe fields in the session — never the password hash.
+  logIn(ctx, { id: user.id, email: user.email, name: user.name });
+  return Response.json({ ok: true, user: { id: user.id, email: user.email, name: user.name } });
+}

examples/basic-app/app/api/logout.ts

@@ -0,0 +1,8 @@
+// API route: POST /api/logout. Clears the session.
+import { verifyCsrf, logOut, type Context } from "@wrnexus/core";
+
+export function POST(ctx: Context): Response {
+  if (!verifyCsrf(ctx)) return new Response("Invalid CSRF token", { status: 403 });
+  logOut(ctx);
+  return Response.json({ ok: true });
+}

examples/basic-app/app/api/me.ts

@@ -0,0 +1,11 @@
+// API route: GET /api/me. Protected by requireAuth — returns 401 when anonymous,
+// otherwise the current user hydrated onto ctx by the auth middleware.
+import { requireAuth, getUser, type Context } from "@wrnexus/core";
+
+const guard = requireAuth();
+
+export async function GET(ctx: Context): Promise<Response> {
+  const denied = await guard(ctx, () => new Response(null));
+  if (denied.status === 401) return denied;
+  return Response.json({ ok: true, user: getUser(ctx) });
+}

examples/basic-app/app/api/users/csr.ts

@@ -0,0 +1,8 @@
+// GET /api/users/csr — real users from the database (client-side data binding).
+import { getDb } from "@wrnexus/db";
+import { ListUsers } from "../../db/queries.gen.ts";
+
+export const GET = async () => {
+  const users = await ListUsers(getDb());
+  return Response.json({ users });
+};

examples/basic-app/app/api/users/ssr.ts

@@ -0,0 +1,8 @@
+// GET /api/users/ssr — real users from the database (server-side data binding).
+import { getDb } from "@wrnexus/db";
+import { ListUsers } from "../../db/queries.gen.ts";
+
+export const GET = async () => {
+  const users = await ListUsers(getDb());
+  return Response.json({ users });
+};