fet: add all the me routes , persists user and add rate-limiter middl…

apps/api/package.json

@@ -13,6 +13,7 @@
     "cors": "^2.8.6",
     "dotenv": "^17.4.2",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.6.2",
     "jsonwebtoken": "^9.0.3",
     "zod": "^4.4.3"
   },

apps/api/src/controllers/auth.controllers.ts

@@ -6,6 +6,9 @@ import {
   createUser,
   deleteRefreshToken,
   deleteAllRefreshTokens,
+  findUserById,
+  updateUser,
+  deleteUser,
 } from "@devdraw/db";
 import { issueTokens } from "../services/auth.services";
 import { config } from "../config/config";
@@ -66,3 +69,50 @@ export const logoutall = async (req: Request, res: Response) => {
   res.clearCookie("refreshToken", { path: "/api/v1/auth" });
   res.json({ message: "Logged out everywhere" });
 };
+
+export const getMe = async (req:Request, res:Response) => {
+  const user = await findUserById((req as any).userId);
+  if(!user) throw new ApiError(404, "User not found");
+
+  const { password: _, ...safeUser } = user;
+
+  res.json({ user: safeUser });
+};
+
+export const updateMe = async (req:Request, res:Response) => {
+  const {name, email} = req.body;
+
+  const user = await updateUser((req as any).userId,{name,email});
+  if (!user) throw new ApiError(404, "User not found");
+
+  const { password: _, ...safeUser } = user;
+
+  res.json({user:safeUser})
+
+};
+
+export const patchMe = async (req:Request, res:Response) => {
+  const { name, email } = req.body; // only forward fields updateUser can persist
+
+  const user = await updateUser((req as any).userId, { name, email });
+  if (!user) throw new ApiError(404,"User not found");
+
+  const{ password:_, ...safeUser} = user;
+
+  res.json({user:safeUser})
+};
+
+export const deleteMe = async (req:Request, res:Response) => {
+  const {password} = req.body;
+
+  const userId = (req as any).userId;
+
+  const user = await findUserById(userId);
+  if(!user) throw new ApiError(404,"User not found");
+  if(!(await Bun.password.verify(password,user.password)))
+    throw new ApiError(401,"Incorrect password");
+  await deleteUser(userId);
+  res.clearCookie("refreshToken",{path:"/api/v1/auth"});
+  res.json({message:"Account deleted"});
+};
+

apps/api/src/middleware/auth.middleware.ts

@@ -2,7 +2,7 @@ import type{ ZodType } from "zod";
 import type { Request, Response, NextFunction } from "express";
 import jwt from "jsonwebtoken"
 import {config} from "../config/config"
-
+import { rateLimit } from 'express-rate-limit';
 
 export class ApiError extends Error{
     constructor(public statusCode:number,message:string){
@@ -56,3 +56,42 @@ export const requireAuth = async(req:Request,res:Response , next:NextFunction) =
     throw new ApiError(401, "Invalid or expired token");
   }
 };
+
+// Configure the specific limiter for auth routes
+export const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10, // Strict limit for sign-in attempts
+  standardHeaders: 'draft-8',
+  legacyHeaders: false,
+  handler: (req: Request, res: Response) => {
+    res.status(429).json({ 
+      error: 'Too many sign-in attempts. Please try again in 15 minutes.' 
+    });
+  }
+});
+
+// DO NOT TOUCH THIS I AM KEEPING IT FOR MY KNOWLEDGE 
+
+// const store = new Map<string, { count: number; resetAt: number }>();
+
+// export const rateLimiter = (req: Request, res: Response, next: NextFunction) => {
+//   const ip = req.ip ?? "unknown";
+//   const now = Date.now();
+//   const window = 15 * 60 * 1000; // 15 min
+//   const limit = 10;
+
+//   let record = store.get(ip);
+
+//   if (!record || now > record.resetAt) {
+//     record = { count: 0, resetAt: now + window };
+//   }
+
+//   record.count++;
+//   store.set(ip, record);
+
+//   if (record.count > limit) {
+//     return res.status(429).json({ message: "Too many requests" });
+//   }
+
+//   next();
+// };

apps/api/src/routes/auth.routess.ts

@@ -1,13 +1,39 @@
 import { Router } from "express";
-import {signup,signin,logout,logoutall , refresh} from "../controllers/auth.controllers";
-import { requireAuth, validate } from "../middleware/auth.middleware";
-import { signinSchema, signupSchema } from "@devdraw/shared";
+import {
+    signup,
+    signin,
+    logout,
+    logoutall,
+    refresh,
+    getMe,
+    deleteMe,
+    patchMe,
+    updateMe,
+} from "../controllers/auth.controllers";
+import { 
+    requireAuth,
+    validate ,
+    authLimiter
+} from "../middleware/auth.middleware";
+import { 
+    deleteMeSchema,
+    signinSchema,
+    signupSchema,
+    updateMeSchema,
+    patchMeSchema
+} from "@devdraw/shared";
+
 const router = Router()
 
-router.route("/signup").post(validate(signupSchema), signup);
-router.route("/signin").post(validate(signinSchema),signin);
-router.route("/refresh-token").post(refresh);
-router.route("/logout").post(requireAuth,logout);
+router.route("/signup").post(authLimiter,validate(signupSchema), signup);
+router.route("/signin").post(authLimiter,validate(signinSchema),signin);
+router.route("/refresh-token").post(authLimiter,refresh);
+router.route("/logout").post(logout);
 router.route("/logoutall").post(requireAuth,logoutall);
+router.route("/me")
+      .get(requireAuth, getMe)
+      .put(requireAuth, validate(updateMeSchema), updateMe)
+      .patch(requireAuth, validate(patchMeSchema), patchMe)
+      .delete(requireAuth, validate(deleteMeSchema), deleteMe);
 
 export default router;

apps/web/src/App.tsx

@@ -1,14 +1,15 @@
 import { Route, Routes } from "react-router-dom";
 import { Auth } from "./pages/features/Auth";
 import { Home } from "./pages/features/Home";
+import { ProtectedRoute } from "./components/ProtectedRoutes";
 
 export default function App() {
 
   return (
     <>
     <Routes>
       <Route path="/" element={<Auth/>}/>
-      <Route path="/home" element={<Home/>}/>
+      <Route path="/home" element={<ProtectedRoute><Home /></ProtectedRoute>}/>
     </Routes>
     </>
   );

apps/web/src/api/auth.api.ts

@@ -1,5 +1,5 @@
 import axiosInstance from "./axios.config";
-import type { Signin, Signup , AuthResponse } from "@devdraw/shared";
+import { type Signin, type Signup , type AuthResponse,type User } from "@devdraw/shared";
 
 
 const authApi = {
@@ -14,7 +14,18 @@ const authApi = {
             withCredentials:true
         });
         return response.data;
-    }
+    },
+    refresh: async () : Promise<{ accessToken:string }> => {
+        const response = await axiosInstance.post("/api/v1/auth/refresh-token");
+        return response.data;
+    },
+    me: async (accessToken:string) : Promise<{user:User}> => {
+        const response = await axiosInstance.get("/api/v1/auth/me",{
+            headers:{Authorization:`Bearer ${accessToken}`},
+        });
+        return response.data;
+    },
+    logout: async () => axiosInstance.post("/api/v1/auth/logout"),
 }
 
 export default authApi;

apps/web/src/api/axios.config.ts

@@ -9,4 +9,61 @@ const axiosInstance = axios.create({
     withCredentials: true,
 });
 
+let isRefreshing = false;
+let failedQueue: any[] = [];
+
+const processQueue = (error: any, token: string | null = null) => {
+  failedQueue.forEach((prom) => {
+    if (error) prom.reject(error);
+    else prom.resolve(token);
+  });
+  failedQueue = [];
+};
+
+axiosInstance.interceptors.response.use(
+  (response) => response,
+  async (error) => {
+    const originalRequest = error.config;
+
+    // Don't intercept if no response or not 401
+    if (!error.response || error.response.status !== 401) {
+      return Promise.reject(error);
+    }
+
+    // ✅ CRITICAL: Skip refresh requests to prevent infinite loop
+    if (originalRequest.url?.includes('/refresh')) {
+      return Promise.reject(error);
+    }
+
+    // Already retried once
+    if (originalRequest._retry) {
+      return Promise.reject(error);
+    }
+
+    // Queue subsequent requests while refreshing
+    if (isRefreshing) {
+      return new Promise((resolve, reject) => {
+        failedQueue.push({ resolve, reject });
+      }).then(() => axiosInstance(originalRequest));
+    }
+
+    originalRequest._retry = true;
+    isRefreshing = true;
+
+    try {
+      const { data } = await axiosInstance.post("/api/v1/auth/refresh-token");
+      processQueue(null, data.accessToken);
+      originalRequest.headers.Authorization = `Bearer ${data.accessToken}`;
+      return axiosInstance(originalRequest);
+    } catch (err) {
+      processQueue(err);
+      // Optionally redirect to login
+      // window.location.href = '/auth';
+      return Promise.reject(err);
+    } finally {
+      isRefreshing = false;
+    }
+  }
+);
+
 export default axiosInstance;

apps/web/src/components/ProtectedRoutes.tsx

@@ -0,0 +1,9 @@
+import { Navigate } from "react-router-dom";
+import { useAuth } from "../context/auth.context";
+
+export const ProtectedRoute = ({ children }: { children: React.ReactNode }) => {
+  const { user, loading } = useAuth();
+  if (loading) return null;
+  if (!user) return <Navigate to="/" replace />;
+  return <>{children}</>;
+};

apps/web/src/context/auth.context.tsx

@@ -1,9 +1,12 @@
-import { createContext,useContext,useState, type ReactNode } from "react";
+import { createContext,useContext,useEffect,useState, type ReactNode } from "react";
 import type { User } from "@devdraw/shared";
+import authApi from "../api/auth.api";
+import { useNavigate, useLocation } from "react-router-dom";
 
 type AuthCtx = {
   user: User | null;
   accessToken: string | null;
+  loading:boolean;
   setAuth: (user: User, token: string) => void;
   clearAuth: () => void;
 };
@@ -13,14 +16,29 @@ const AuthContext = createContext<AuthCtx>(null!);
 export const AuthProvider = ({ children }: { children: ReactNode }) => {
   const [user, setUser] = useState<User | null>(null);
   const [accessToken, setAccessToken] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const navigate = useNavigate();
+  const location = useLocation();
+
+  const setAuth = (u: User, t: string) => {
+    setUser(u);
+    setAccessToken(t);
+  };
+  const clearAuth = () => { setUser(null); setAccessToken(null); };
+
+  useEffect(() => {
+    authApi.refresh()
+      .then(async ({ accessToken }) => {
+        const { user } = await authApi.me(accessToken);
+        setAuth(user, accessToken);
+        if (location.pathname === "/") navigate("/home");
+      })
+      .catch((err) => console.error("Session restore failed:", err))
+      .finally(() => setLoading(false));
+  }, []);
 
   return (
-    <AuthContext.Provider value={{
-      user,
-      accessToken,
-      setAuth: (u, t) => { setUser(u); setAccessToken(t); },
-      clearAuth: () => { setUser(null); setAccessToken(null); },
-    }}>
+    <AuthContext.Provider value={{ user, accessToken, loading, setAuth, clearAuth }}>
       {children}
     </AuthContext.Provider>
   );

apps/web/src/pages/features/Home.tsx

@@ -1,10 +1,21 @@
+import { useNavigate } from "react-router-dom";
+import authApi from "../../api/auth.api";
 import { useAuth } from "../../context/auth.context";
 
 export const Home = () =>{
-      const {user} = useAuth();
+      const {user,clearAuth} = useAuth();
+      const navigate = useNavigate()
+
 
+    const logout = async() =>{
+        await authApi.logout();
+        clearAuth();
+        navigate("/");
+    }
+
     return(
-        <div className="text-2xl text-red-400 ">Welocome{user?.name}
+        <div className="text-2xl bg-amber-300 items-center ">Welocome{user?.name}
+        <div className="h-5 w-10 bg-red-400 " onClick={logout}></div>
         </div>
     )
 }