When prompted choose:

* JavaScript or TypeScript (TS recommended)
* Tests folder: `tests`
* GitHub Actions: YES

---

# 📁 2. Project structure



```plaintext id="pw2"
my-app/
 ├── tests/
 │    ├── example.spec.ts
 ├── playwright.config.ts
 ├── package.json

---

# 🚀 4. Run tests locally



```bash id="run1"
npx playwright test

---

# 📸 5. Auto screenshots on failure

Playwright automatically captures:

* screenshots
* videos
* traces

Enable in config:



```ts id="cfg1"
use: {
  screenshot: 'only-on-failure',
  video: 'retain-on-failure',
  trace: 'on-first-retry'
}

steps:
  - uses: actions/checkout@v4

  - name: Setup Node
    uses: actions/setup-node@v4
    with:
      node-version: 20

  - name: Install dependencies
    run: npm install

  - name: Install Playwright browsers
    run: npx playwright install --with-deps

  - name: Run Playwright tests
    run: npx playwright test

---

# 🧠 7. What happens in CI



```plaintext id="flow1"
Push code
   ↓
GitHub Actions starts
   ↓
Install dependencies
   ↓
Install browsers (Chromium, Firefox, WebKit)
   ↓
Run E2E tests
   ↓
Pass → allow merge
Fail → block PR + show report

Then in CI:



```yaml id="rep2"
- name: Upload Playwright report
  uses: actions/upload-artifact@v4
  if: always()
  with:
    name: playwright-report
    path: playwright-report

👉 This turns it into **true production E2E testing**

---

# 🧪 10. Advanced real-world test examples

---

## 🟢 UI navigation test



```ts id="nav1"
test('navigate to dashboard', async ({ page }) => {
  await page.goto('/');
  await page.click('text=Dashboard');
  await expect(page).toHaveURL(/dashboard/);
});

---

## 🔵 API + UI combined test



```ts id="api1"
test('data loads after API call', async ({ page }) => {
  await page.goto('/dashboard');

  await expect(page.locator('.loading')).toBeHidden();
  await expect(page.locator('.chart')).toBeVisible();
});

---

# ⚠️ 12. Common mistakes

### ❌ Testing implementation instead of behavior

Bad:



```ts id="bad1"
expect(component.state).toBe(true)

---

### ❌ No stable selectors

Use:



```html id="sel1"
data-testid="login-button"

---

### ❌ Running E2E without CI

Always run in GitHub Actions

---

# 🧠 Final architecture



```plaintext id="final1"
Push / PR
   ↓
CI (unit tests)
   ↓
E2E tests (Playwright)
   ↓
Build app
   ↓
Deploy to staging/production
   ↓
Report + screenshots stored in GitHub

# Copilot suggests the full function from the comment
def calculate_shipping_cost(weight: float, distance: float, carrier: str) -> float:
    """
    Calculate shipping cost based on weight (kg), distance (km), and carrier.
    Returns the cost in the user's local currency.
    """
    base_rates = {
        "ups": 0.45,
        "fedex": 0.52,
        "usps": 0.38,
    }
    rate = base_rates.get(carrier.lower(), 0.40)
    return weight * distance * rate

// copilot.nvim or VS Code Copilot Chat
// You can now have multi-turn conversations about code
// Copilot Edits allows targeting specific files/folders for changes

// Session example:
/edit Refactor this function to handle null values more gracefully
/edit Add TypeScript types to all functions in this file
/edit Write tests for the authentication flow

# Copilot often suggests the "average" solution
# For a complex task, the suggestion is rarely the best solution

# Given this prompt:
# "Implement a rate limiter with sliding window algorithm"

# Copilot suggests: A basic token bucket (generic, not what was asked for)

# What you wanted: Sliding window log, sliding window counter, or fixed window
# with counter reset. These are all different algorithms with different tradeoffs.

# composer.py — The killer feature
# You describe what you want across multiple files, Cursor creates them all

"""
Create a task queue system with:
1. A Redis-backed TaskQueue class with:
   - enqueue(task_id, payload, priority)
   - dequeue(worker_id)
   - ack(task_id, worker_id)
   - retry(task_id, max_retries=3)
2. A FastAPI endpoint /tasks/enqueue
3. A worker script worker.py that polls the queue
4. Unit tests in test_task_queue.py
"""

# Agent mode in Cursor
# Cursor can:
# - Read your entire codebase
# - Run shell commands
# - Edit multiple files
# - Run tests and fix failures

# Example workflow:
# "Migrate our authentication from session-based to JWT tokens"
# Cursor will:
# 1. Find all auth-related files
# 2. Understand the current flow
# 3. Propose changes to each file
# 4. Run tests after each change
# 5. You review and approve each step

# Analyzing a complex codebase
claude-code --system "You are an expert in distributed systems"
# "Review our microservices architecture and identify single points of failure"

# Claude reads all services, understands the dependencies, identifies:
# - The message broker is a single point of failure
# - No circuit breakers between services
# - Database connection pool exhaustion risk
# - 47 other issues you didn't see

# Large refactors that Copilot would struggle with
# "Extract all string literals to i18n keys across the entire codebase"
# Copilot: Would need to run this 1000 times, file by file
# Claude Code: Can do it in one session, understanding the full context

# Claude Code is significantly slower than Copilot
# Copilot suggestions: < 50ms
# Claude Code response: 2-10 seconds depending on task complexity

# For boilerplate and simple completions, this is painful
# For complex analysis, the speed trade-off is worth it

// In a Java/Kotlin project, JetBrains AI understands:
// - Type hierarchies
// - Method call graphs
// - Spring/dependency injection context

// You ask: "Add retry logic to this service call"
// JetBrains AI:
# 1. Knows this is a Spring @Service
# 2. Identifies the external HTTP client being used
# 3. Suggests @Retryable annotation or Resilience4j wrapper
# 4. Understands the transaction context
# 5. Warns about retrying non-idempotent operations

# For Python/JS/TS projects, JetBrains AI is less impressive
# The IDE understanding helps most for statically typed languages
# with deep frameworks (Spring, Kotlin, Scala)

# For Django, FastAPI, React: Copilot or Cursor are better choices

# Use the right tool for the right task

copilot:
  # Fast, boilerplate, pattern completion
  # When you know exactly what you want
  use_for:
    - Boilerplate code
    - Simple functions
    - Pattern-based completions
    - Inline suggestions while typing

cursor:
  # Agent tasks, multi-file changes
  # When you need to think through a problem
  use_for:
    - Large refactors
    - New feature scaffolding
    - Code review and improvements
    - Understanding unfamiliar codebases

claude_code:
  # Deep analysis, architecture decisions
  # When you need to think with the AI
  use_for:
    - Architectural reviews
    - Security audits
    - Complex debugging sessions
    - Legacy code understanding

jetbrains_ai:
  # Java/Kotlin production work
  # When you're in the JVM ecosystem
  use_for:
    - Spring Boot development
    - Kotlin Multiplatform
    - Complex type refactoring
    - Enterprise Java migration

-- Before PG17, this query might not prune partitions efficiently
EXPLAIN SELECT * FROM events
WHERE event_date BETWEEN '2026-01-01' AND '2026-03-31'
  AND event_type = 'purchase';

-- You'd see: Seq Scan on events (lots of partitions scanned)
-- Even with partitions on event_date, the event_type filter
-- sometimes prevented effective pruning

-- PG17 can prune based on multiple columns even when they're not
-- the partition key
EXPLAIN SELECT * FROM events
WHERE event_date BETWEEN '2026-01-01' AND '2026-03-31'
  AND event_type = 'purchase';

-- Now shows: Only scanning relevant partitions
-- Even with the additional filter, PG17 prunes more effectively

-- Before PG17, partition-wise joins only worked with hash joins
-- PG17 extends this to merge joins

-- Example: Sales partitioned by region, Products partitioned by region
-- PG17 can now do a merge join at the partition level

EXPLAIN SELECT s.sale_id, p.product_name, s.amount
FROM sales s
JOIN products p ON s.region = p.region AND s.product_id = p.id
WHERE s.sale_date >= '2026-01-01';

-- PG17 can now push the join down to individual partitions
-- instead of joining after all data is collected

-- PG17 can now parallelize COPY FROM for certain file formats
-- This was a massive bottleneck for data loading

-- Create a table for parallel import
CREATE TABLE large_events (
  id BIGSERIAL,
  event_type TEXT,
  event_data JSONB,
  created_at TIMESTAMPTZ
) PARTITION BY RANGE (created_at);

-- PG17: This can now use parallel workers for large files
COPY large_events (event_type, event_data, created_at)
FROM '/data/events_2026.csv'
WITH (FORMAT csv, HEADER true);

-- Performance improvement: 2-4x faster on multi-core systems
-- for large CSV imports

-- COPY to/from binary format is now more reliable
-- and handles edge cases better

COPY events TO '/tmp/events.bin' (FORMAT binary);
COPY events FROM '/tmp/events.bin' (FORMAT binary);

-- PG17 fixes several edge cases with NULL handling in binary
-- and improves performance for mixed NULL/data rows

-- PG17 adds JSON_TABLE for relational-style querying of JSON
-- This is a massive improvement for semi-structured data

-- Sample data
CREATE TABLE api_logs (
  id BIGSERIAL PRIMARY KEY,
  request JSONB
);

-- Query JSON like a table
SELECT jt.method, jt.path, jt.status
FROM api_logs,
JSON_TABLE(
  request,
  '$.request'
  COLUMNS (
    method TEXT PATH '$.method',
    path TEXT PATH '$.path',
    status INT PATH '$.status'
  )
) AS jt
WHERE jt.status >= 400;

-- This is PostgreSQL's answer to MongoDB's aggregation pipeline
-- for JSON documents

-- Incremental sort (added in PG13) is now smarter in PG17
-- It can use incremental sort for more query patterns

EXPLAIN SELECT customer_id, order_date, total
FROM orders
WHERE order_date >= '2026-01-01'
ORDER BY customer_id, order_date DESC;

-- Before PG17: Might not use incremental sort
-- PG17: Recognizes that order_date DESC can use incremental sort
-- after the initial sort by customer_id

-- PG17 adds several useful aggregate functions

-- listagg with deduplication
SELECT 
  customer_id,
  LISTAGG(DISTINCT product_category, ', ') WITHIN GROUP (ORDER BY product_category)
FROM orders
GROUP BY customer_id;

-- mode() for finding the most common value
SELECT 
  department,
  MODE() WITHIN GROUP (ORDER BY salary) as common_salary
FROM employees
GROUP BY department;

-- any_value() with preference
SELECT 
  product_id,
  ANY_VALUE(purchases ORDER BY purchase_date DESC) as latest_purchase
FROM purchases
GROUP BY product_id;

-- New function to inspect WAL contents without external tools
-- Extremely useful for replication debugging

SELECT * FROM pg_walinspect('000000010000000000000001', '000000010000000000000002');

-- Returns: WAL record details, LSN ranges, transaction info
-- Before: Required pg_receivewal or third-party tools

-- PG17 still doesn't solve the connection pooling problem
-- For 1000+ connections, you still need PgBouncer or pgpool-II

-- pg_bouncer.ini
[databases]
mydb = host=127.0.0.1 port=5432 dbname=mydb

[pgbouncer]
pool_mode = transaction
max_client_conn = 1000
default_pool_size = 25

-- PG17 improved partitioning performance but didn't automate
-- the tedious parts

-- You still need to manually create new partitions
CREATE TABLE events_2026_q2 PARTITION OF events
  FOR VALUES FROM ('2026-04-01') TO ('2026-07-01');

-- PG17 doesn't auto-create partitions for time-series data
-- This remains a significant operational burden

# The upgrade path is straightforward

# 1. Install PG17 alongside PG16
brew install postgresql@17

# 2. Run pg_upgrade (in-place)
pg_upgrade 
  -d /usr/local/var/postgresql@16 
  -D /usr/local/var/postgresql@17 
  -b /usr/local/Cellar/postgresql@16/16.0/bin 
  -B /usr/local/Cellar/postgresql@17/17.0/bin

# 3. Analyze the new cluster (automated by pg_upgrade)
./analyze_new_cluster.sh

# Total downtime for our 500GB database: ~4 minutes
# Acceptable for most production systems

-- PG17 is stricter about certain behaviors

-- 1. Casting to regproc now requires explicit function call
-- Before: SELECT 'now'::regproc;
-- Now requires: SELECT 'now'::regprocedure;

-- 2. Certain JSON path expressions behave differently
-- Test your JSON queries after upgrade

-- 3. pg_hba.conf changes: some legacy authentication
-- options are deprecated

---

# 🤖 1. Auto Create Pull Request Workflow

This automatically creates a PR when you push a feature branch.

## 📁 `.github/workflows/auto-pr.yml`



```yaml id="pr1"
name: Auto Create Pull Request

on:
  push:
    branches-ignore:
      - main

jobs:
  create-pr:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create Pull Request
        uses: repo-sync/pull-request@v2
        with:
          destination_branch: main
          github_token: ${{ secrets.GITHUB_TOKEN }}
          pr_title: "Auto PR: ${{ github.ref_name }}"
          pr_body: |
            ## 🤖 Auto-generated PR

            Branch: `${{ github.ref_name }}`
            Please review changes before merging.

steps:
  - uses: actions/checkout@v4

  - name: Setup Node
    uses: actions/setup-node@v4
    with:
      node-version: 20

  - name: Install dependencies
    run: npm install

  - name: Run lint
    run: npm run lint

  - name: Run tests
    run: npm test

---

## 🧠 What this does:

Before merge:

* Runs lint checks
* Runs tests
* Blocks bad code from merging

---

# 🚀 3. Auto Deploy on Merge to Main

This deploys your app when PR is merged.

## 📁 `.github/workflows/deploy.yml`

### Example: Deploy React + Node (Vercel + Render)



```yaml id="deploy1"
name: Auto Deploy

on:
  push:
    branches: [ main ]

jobs:
  deploy-frontend:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install frontend
        working-directory: client
        run: npm install

      - name: Build frontend
        working-directory: client
        run: npm run build

      - name: Deploy to Vercel
        run: npx vercel --prod --token=${{ secrets.VERCEL_TOKEN }}

  deploy-backend:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Install backend
        working-directory: server
        run: npm install

      - name: Deploy backend (Render webhook)
        run: curl -X POST ${{ secrets.RENDER_DEPLOY_HOOK }}

---

# 🧭 5. Full Workflow in action

## Developer flow:



```plaintext id="flow2"
git checkout -b feature-login
git push origin feature-login

---

# ⚠️ Common mistakes

### ❌ Auto-deploy without tests

→ leads to broken production

### ❌ No branch protection

→ anyone can push to main

### ❌ Missing secrets

→ deployment fails silently

---

# 🧠 Final Architecture (Pro level)



```plaintext id="final1"
Feature Branch
   ↓
Auto PR Created
   ↓
CI (tests + lint)
   ↓
Review + Approval
   ↓
Merge to main
   ↓
CD Pipeline
   ↓
Frontend deploy (Vercel)
Backend deploy (Render/AWS)
   ↓
Slack/Discord notification

/* This card component behaves differently based on viewport width */
/* But what if the same component appears in a narrow sidebar AND a wide main area? */
.card {
  display: flex;
  flex-direction: column;
}

@media (min-width: 768px) {
  .card {
    flex-direction: row; /* Works for main content, breaks for sidebar */
  }
}

/* First: define a container */
.card-grid {
  container-type: inline-size;
  container-name: card-grid;
}

/* The card responds to its CONTAINER, not the viewport */
.card {
  display: flex;
  flex-direction: column;
}

@container card-grid (min-width: 400px) {
  .card {
    flex-direction: row; /* Works in both sidebar and main! */
  }
}

/* Define containers at different levels */
.page-layout {
  container-type: inline-size;
}

.sidebar {
  container-type: inline-size;
  container-name: sidebar;
}

.main-content {
  container-type: inline-size;
  container-name: main;
}

/* Article card responds to ANY container */
.article-card {
  display: grid;
  grid-template-areas:
    "image"
    "title"
    "meta"
    "excerpt";
  gap: 1rem;
}

@container (min-width: 300px) {
  .article-card {
    grid-template-areas:
      "image title"
      "image meta"
      "image excerpt";
    grid-template-columns: 120px 1fr;
  }
}

@container main (min-width: 600px) {
  .article-card {
    grid-template-areas:
      "image title meta"
      "image excerpt excerpt";
    grid-template-columns: 200px 1fr auto;
  }
}

/* You're fighting specificity everywhere */
.button.primary {
  background: blue;
}

.header .nav .button.primary {
  background: darkblue; /* Have to be MORE specific */
}

.nav-container .header .nav .button.primary {
  background: navy; /* This is exhausting */
}

/* Eventually you resort to !important */
.button.primary {
  background: blue !important; /* This is a code smell */
}

/* Define layers in order of priority (lowest to highest) */
@layer reset, base, components, utilities, overrides;

@layer reset {
  * { box-sizing: border-box; }
}

@layer base {
  h1 { font-size: 2rem; }
  a { color: blue; }
}

@layer components {
  .button {
    padding: 0.75rem 1.5rem;
    border-radius: 0.375rem;
    font-weight: 500;
  }

  .button.primary {
    background: blue;
    color: white;
  }
}

@layer utilities {
  .text-center { text-align: center; }
  .mt-4 { margin-top: 1rem; }
}

/* Anything in overrides ALWAYS wins */
@layer overrides {
  .button.primary {
    background: darkblue; /* This beats components without !important */
  }
}

@layer components {
  /* This has high specificity but is in a lower layer */
  .header .nav .button.primary {
    background: blue; /* Lower layer */
  }
}

@layer overrides {
  /* This has LOW specificity but wins because it's in a higher layer */
  .button.primary {
    background: darkblue; /* Higher layer wins */
  }
}

/* Bootstrap/Tailwind in a low layer, your code in a higher layer */
@layer vendors, base, components, custom;

@layer vendors {
  /* Import Bootstrap but put it in vendors layer */
  @import url('bootstrap.css') layer(vendors);
}

@layer base {
  /* Your base styles */
}

@layer components {
  /* Your components */
}

@layer custom {
  /* Overrides everything — put your customizations here */
}

/* Any .button override in custom layer beats Bootstrap's .button */
@layer custom {
  .button {
    background: custom-blue; /* Always wins */
  }
}

/* Style a form group if it contains an invalid input */
.form-group:has(:invalid) {
  border-color: red;
  background: rgba(255, 0, 0, 0.05);
}

/* Style a card differently if it has an image */
.card:has(.card-image) {
  grid-template-columns: 200px 1fr;
}

/* Style a nav differently if it has a dropdown */
.nav:has(.dropdown) {
  position: relative;
}

/* Style an article if the previous sibling is also an article */
.article:not(:has(+ .article)) {
  border-bottom: none; /* Last article in a list */
}

/* Style a label if its input is checked */
.checkbox-label:has(input:checked) {
  font-weight: bold;
  color: green;
}

/* Style a list that has more than 5 items */
.list:has(> :nth-child(5)) {
  columns: 2; /* Multi-column for long lists */
}

/* Style a grid differently based on item count */
.grid:has(> :nth-child(4)) {
  grid-template-columns: repeat(2, 1fr);
}

@property --gradient-angle {
  syntax: '<angle>';
  initial-value: 0deg;
  inherits: false;
}

@property --gradient-position {
  syntax: '<percentage>';
  initial-value: 0%;
  inherits: false;
}

.gradient-animated {
  background: linear-gradient(
    var(--gradient-angle),
    red,
    blue
  );
  animation: rotate-gradient 3s linear infinite;
}

@keyframes rotate-gradient {
  to {
    --gradient-angle: 360deg;
  }
}

/* Now animations work because TypeScript knows it's an angle */

.header {
  position: sticky;
  top: 0;
  z-index: 100;
  background: white;
  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
}

.carousel {
  display: flex;
  overflow-x: auto;
  scroll-snap-type: x mandatory;
  gap: 1rem;

  /* Hide scrollbar but keep functionality */
  scrollbar-width: none;
  &::-webkit-scrollbar { display: none; }
}

.carousel-item {
  flex: 0 0 300px;
  scroll-snap-align: start;
}

input:valid {
  border-color: green;
}

input:invalid:not(:placeholder-shown) {
  border-color: red;
}

input:out-of-range {
  background: rgba(255, 0, 0, 0.1);
}

<div class="flex flex-col md:flex-row gap-4 p-4 md:p-6 lg:p-8 bg-white rounded-lg shadow-md hover:shadow-lg transition-shadow">
  <div class="w-full md:w-1/3">
    <img class="w-full h-48 md:h-full object-cover rounded-t-lg md:rounded-l-lg md:rounded-tr-none" src="..." />
  </div>
  <div class="flex-1 p-4">
    <h3 class="text-xl font-bold text-gray-900 mb-2">Title</h3>
    <p class="text-gray-600 text-sm mb-4">Content</p>
  </div>
</div>

@layer components {
  .feature-card {
    display: grid;
    grid-template-areas:
      "image"
      "content";
    background: white;
    border-radius: 0.5rem;
    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
    transition: box-shadow 0.2s;

    &:hover {
      box-shadow: 0 4px 6px rgba(0, 0, 0, 0.1);
    }
  }

  @container (min-width: 400px) {
    .feature-card {
      grid-template-areas: "image content";
      grid-template-columns: 1fr 2fr;
    }
  }

  .feature-card-image {
    grid-area: image;
    width: 100%;
    height: 12rem;
    object-fit: cover;

    @container (min-width: 400px) {
      height: 100%;
      border-radius: 0.5rem 0 0 0.5rem;
    }
  }

  .feature-card-content {
    grid-area: content;
    padding: 1rem;
  }
}

<div class="feature-card">
  <img class="feature-card-image" src="..." />
  <div class="feature-card-content">
    <h3>Title</h3>
    <p>Content</p>
  </div>
</div>

Modern CSS (2026):
├── Container Queries     → Component-level responsiveness
├── Cascade Layers        → Specificity control
├── :has() Selector       → Relational styling
├── @property            → Typed animations
├── @layer               → Import ordering
├── gap in flexbox       → No more margin hacks
├── subgrid              → Aligned nested grids
└── color-mix()          → Dynamic color utilities

Supporting Tools:
├── PostCSS with autoprefixer (minimal)
├── Lightning CSS (10x faster than PostCSS)
└── Vanilla Extract (type-safe CSS-in-TS, when needed)

certbot certonly --manual --preferred-challenges dns 
  -d "*.guardlabs.online" -d "guardlabs.online"

server {
    listen 443 ssl;
    server_name ~^partner-(?<partner_slug>.+).guardlabs.online$;
    ssl_certificate     /etc/letsencrypt/live/guardlabs.online/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/guardlabs.online/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Partner-Slug $partner_slug;
    }
}

@app.before_request
def load_partner():
    slug = request.headers.get("X-Partner-Slug")
    if slug:
        g.partner = db.execute(
            "SELECT * FROM partners WHERE slug=?", (slug,)
        ).fetchone()
        if not g.partner:
            abort(404)

@app.route("/")
def storefront():
    products = get_catalog()  # global catalog
    return render_template("store.html",
        products=products,
        ref_id=g.partner["ref_id"],  # injected into every buy link
        partner_brand=g.partner["brand_name"])

@app.route("/webhook/whop", methods=["POST"])
def whop_webhook():
    event = verify_and_parse(request)
    if event["type"] == "subscription.created":
        slug = slugify(event["user"]["username"])
        # 1. DB row
        db.execute("INSERT INTO partners (slug, ref_id, ...) VALUES (...)")
        # 2. nginx — no per-partner config needed! Regex server_name catches it.
        # 3. Done. partner-{slug}.guardlabs.online works immediately.
    return "", 200

└── src/
    ├── @types/
    ├── controllers/
    ├── middlewares/
    ├── models/
    ├── routes/
    ├── utils/
    ├── app.ts
    └── index.ts

npm install jsonwebtoken bcrypt mongoose cookie-parser
npm install -D @types/jsonwebtoken @types/bcrypt

ACCESS_TOKEN_SECRET=
ACCESS_TOKEN_EXPIRY=

REFRESH_TOKEN_SECRET=
REFRESH_TOKEN_EXPIRY=

export class ApiError extends Error {
  statusCode: number;
  message: string;
  errors: any[];
  stack?: string;
  data: any;
  success: boolean;

  constructor(
    statusCode: number,
    message = "Something went wrong",
    errors = [],
    stack = ""
  ) {
    super(message)
    this.statusCode = statusCode
    this.data = null
    this.message = message
    this.success = false
    this.errors = errors

    if (stack) {
      this.stack = stack
    } else {
      Error.captureStackTrace(this, this.constructor)
    }
  }
}

export class ApiResponse {
  statusCode: number;
  data: any;
  message: string;
  success: boolean;

  constructor(
    statusCode: number,
    data: any,
    message: string = "Success"
  ) {
    this.statusCode = statusCode
    this.data = data
    this.message = message
    this.success = statusCode < 400
  }
}

return res.status(200).json({
  success: true,
  message: "Logged in",
  data,
});

import { model, Schema, type HydratedDocument } from "mongoose";
import jwt, { type Secret, type SignOptions } from "jsonwebtoken";
import bcrypt from "bcrypt";

export interface IUser {
  username: string;
  fullName: string;
  email: string;
  password: string;
  refreshToken?: string;

  generateAccessToken: () => string;
  generateRefreshToken: () => string;
  isPasswordCorrect: (password: string) => Promise<boolean>;
}

export type IUserDocument = HydratedDocument<IUser>;

const userSchema = new Schema<IUser>({
  username: String
  fullName: String
  email: String
  password: String
  refreshToken: String
});

userSchema.pre("save", async function (): Promise<void> {
  if (!this.isModified("password")) return;

  this.password = await bcrypt.hash(this.password, 10);
});

userSchema.methods.isPasswordCorrect = async function (
  password: string
): Promise<boolean> {
  return await bcrypt.compare(password, this.password);
};

userSchema.methods.generateAccessToken = function (): string {
  return jwt.sign(
    {
      _id: this._id,
      email: this.email,
      username: this.username,
      fullName: this.fullName,
    },
    process.env.ACCESS_TOKEN_SECRET!! as Secret,
    {
      expiresIn: process.env.ACCESS_TOKEN_EXPIRY!!,
    } as SignOptions
  );
};

userSchema.methods.generateRefreshToken = function (): string {
  return jwt.sign(
    {
      _id: this._id,
    },
    process.env.REFRESH_TOKEN_SECRET!! as Secret,
    {
      expiresIn: process.env.REFRESH_TOKEN_EXPIRY!!,
    } as SignOptions
  );
};

export const User = model<IUser>("User", userSchema);

userSchema.pre("save", async function (): Promise<void> {
  if (!this.isModified("password")) return;

  this.password = await bcrypt.hash(this.password, 10);
});

userSchema.methods.isPasswordCorrect = async function (
  password: string
): Promise<boolean> {
  return await bcrypt.compare(password, this.password);
};

const generateTokens = async (userId: Types.ObjectId | string): Promise<{ accessToken: string; refreshToken: string }> => {
  try {
    const user = await User.findById(userId);
    if (!user) {
      throw new ApiError(404, "User not found");
    }

    const refreshToken = user.generateRefreshToken();
    const accessToken = user.generateAccessToken();

    user.refreshToken = refreshToken;
    await user.save({ validateBeforeSave: false });

    return { accessToken, refreshToken };
  } catch (err) {
    console.log(err)
    throw new ApiError(500, "Error while generating tokens");
  }
}

export const registerUser = async (req: Request, res: Response) => {
  const { username, email, fullName, password } = req.body;

  if (
    [fullName, email, username, password].some((field) => field?.trim() === "")
  ) {
    throw new ApiError(400, "All fields are required");
  }

  const userExists = await User.findOne({
    $or: [{ username }, { email }]
  });

  if (userExists) {
    throw new ApiError(409, "User with the same username or email already exists");
  }


  const user = await User.create({
    fullName,
    email,
    password,
    username: username.toLowerCase(),
  });

  const createdUser = await User.findById(user._id).select("-password -refreshToken");

  if (!createdUser) {
    throw new ApiError(500, "Error while creating user");
  }

  return res.status(201).json(
    new ApiResponse(201, createdUser, "User registered successfully")
  )

};

.select("-password -refreshToken")

export const loginUser = async (req: Request, res: Response) => {

  const { username, email, password } = req.body;

  if (!username && !email) {
    throw new ApiError(400, "Username or email is required");
  } 

  if (!password) {
    throw new ApiError(400, "Password is required");
  }

  const user = await User.findOne({
    $or: [{ username }, { email }]
  });

  if (!user) {
    throw new ApiError(404, "User not found");
  }

  const isPassValid: boolean = await user.isPasswordCorrect(password);
  if (!isPassValid) {
    throw new ApiError(401, "Invalid password");
  }

  const { accessToken, refreshToken } = await generateTokens(user._id);

  const userData = {
    _id: user._id,
    fullName: user.fullName,
    username: user.username,
    email: user.email,
    avatarUrl: user.avatarUrl,
  }

  return res
    .status(200)
    .cookie("accessToken", accessToken, cookieOptions)
    .cookie("refreshToken", refreshToken, cookieOptions)
    .json(
      new ApiResponse(200, {
        user: userData,
        accessToken,
        refreshToken
      }, "User logged in successfully")
    );
};

httpOnly: true

const cookieOptions = {
  httpOnly: true,
  secure: process.env.NODE_ENV === "production",
  sameSite: "strict" as const,
};

import type { NextFunction, Request, Response } from "express";
import { User } from "../models/User.model.js";
import { ApiError } from "../utils/ApiError.js";
import { asyncHandler } from "../utils/asyncHandler.js";
import jwt, { type JwtPayload } from "jsonwebtoken";

export const verifyJWT = async (req: Request, _: Response, next: NextFunction) => {
  try {
    const accessToken = req.cookies?.accessToken || req.header("Authorization")?.replace("Bearer ", "");

    if (!accessToken) {
      throw new ApiError(401, "Access token is missing");
    }

    const decodedToken = jwt.verify(accessToken, process.env.ACCESS_TOKEN_SECRET!!) as JwtPayload;

    const user = await User.findById(decodedToken._id).select("-password -refreshToken");

    if (!user) {
      throw new ApiError(401, "Invalid Access Token");
    }

    req.user = user;
    next();
  } catch (error: any) {
    throw new ApiError(401,  error?.message || "Invalid Access Token");
  }
};

export const refreshAccessToken = async (req: Request, res: Response) => {
  const incomingRefreshToken = req.cookies.refreshToken || req.body.refreshToken

  if (!incomingRefreshToken) {
    throw new ApiError(401, "Refresh token is missing");
  }

  try {
    const decodedToken = jwt.verify(incomingRefreshToken, process.env.REFRESH_TOKEN_SECRET!!) as JwtPayload;

    const user = await User.findById(decodedToken?._id);

    if (!user) {
      throw new ApiError(401, "Invalid refresh token - user not found");
    }

    if (user.refreshToken !== incomingRefreshToken) { 
      throw new ApiError(401, "Invalid refresh token");
    }

    const { accessToken, refreshToken: newRefreshToken } = await generateTokens(user._id);

    return res
      .status(200)
      .cookie("accessToken", accessToken, cookieOptions)
      .cookie("refreshToken", newRefreshToken, cookieOptions)
      .json(
        new ApiResponse(200, {
          accessToken,
          refreshToken: newRefreshToken,
        }, "Access token refreshed successfully"
        )
      );
  } catch (err: any) {
    throw new ApiError(401, err?.message || "Invalid refresh token");
  }
};

export const logoutUser = async (req: Request, res: Response) => {
  const userId = req.user?._id;

  if (!userId) {
    throw new ApiError(400, "User ID is required");
  }

  await User.findByIdAndUpdate(userId, {
    $unset: { refreshToken: 1 }
  }, { returnDocument: "after" });  

  return res
    .status(200)
    .clearCookie("accessToken", cookieOptions)  
    .clearCookie("refreshToken", cookieOptions)
    .json(new ApiResponse(200, {}, "User logged out successfully"));
};

import type { IUserDocument } from "../../models/User.model.js";

declare module "express-serve-static-core" {
  interface Request {
    user?: IUserDocument;
  }
}

export {};

{
  "compilerOptions": {
    "typeRoots": [
      "./node_modules/@types",
      "./src/@types"
    ]
  },

  "include": [
    "src/**/*",
    "src/@types/**/*.d.ts"
  ]
}