added: fly.toml

Author: talhadevelopes

apps/web/services/api.ts

@@ -1,6 +1,5 @@
- export const BASE_URL = "https://pixel-ui.fly.dev";
-
- // export const BASE_URL = "http://localhost:4000";
+// Backend base URL. Configure via NEXT_PUBLIC_API_BASE_URL in envs.
+export const BASE_URL = process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:4000";
 
 export const API = {
     auth: {

packages/server/fly.toml

@@ -2,7 +2,7 @@ app = "pixel-ui"
 primary_region = "bom"
 
 [build]
-  image = "talhadevelopes/pixel-ui-server:latest"
+  dockerfile = "Dockerfile"
 
 [env]
   NODE_ENV = "production"

packages/server/src/controllers/authController.ts

@@ -1,4 +1,5 @@
-import { GoogleCallbackInput, LoginInput, RegisterInput, googleCallbackSchema, verifyOtpSchema, resendOtpSchema } from "../validation/authValidation";
+import { GoogleCallbackInput, LoginInput, RegisterInput, googleCallbackSchema, verifyOtpSchema, resendOtpSchema, loginSchema, registerSchema } from "../validation/authValidation";
+
 import { AuthRequest } from "../middleware/authMiddleware";
 import { Response, NextFunction } from "express";
 import z from "zod";
@@ -13,7 +14,7 @@ import { prisma } from "../utils/prisma";
 export class AuthController {
     static async register(req: AuthRequest, res: Response, next: NextFunction) {
         try {
-            const { name, email, password } = req.body as RegisterInput;
+            const { name, email, password } = registerSchema.parse(req.body);
             const emailLower = email.trim().toLowerCase();
 
             const existingUser = await prisma.user.findUnique({ where: { email: emailLower } });
@@ -54,32 +55,16 @@ export class AuthController {
 
     static async login(req: AuthRequest, res: Response, next: NextFunction) {
         try {
-            const { email, password } = req.body as LoginInput;
+            const { email, password } = loginSchema.parse(req.body);
             const emailLower = email.trim().toLowerCase();
 
             console.log(`[Auth] Login attempt for ${emailLower}`);
 
-            let user = await prisma.user.findUnique({ where: { email: emailLower } });
+            const user = await prisma.user.findUnique({ where: { email: emailLower } });
 
             if (!user) {
-                console.log(`[Auth] No existing user for ${emailLower}. Creating new user.`);
-                const hashed = await hashPassword(password);
-                user = await prisma.user.create({
-                    data: {
-                        id: crypto.randomUUID(),
-                        name: emailLower.split("@")[0],
-                        email: emailLower,
-                        password: hashed,
-                        credits: 5,
-                        tier: "free",
-                        dailyCreditsLimit: 5,
-                        lastCreditReset: new Date(),
-                        subscriptionStatus: "inactive",
-                    },
-                });
-                console.log(`[Auth] User created with id ${user.id}`);
-            } else {
-                console.log(`[Auth] Existing user ${user.id} found for ${emailLower}`);
+                console.warn(`[Auth] Login failed - user not found for ${emailLower}`);
+                return sendError(res, "Invalid credentials", 401);
             }
 
             const isPasswordValid = await verifyPassword(password, user.password);

packages/server/src/index.ts

@@ -21,15 +21,24 @@ import { prisma } from './utils/prisma'
 const app = express();
 
 const corsOrigin = process.env.CLIENT_URL || "http://localhost:3000";
-console.log('🔥 CORS ORIGIN BEING USED:', corsOrigin);
+const allowedOrigins = (process.env.ALLOWED_ORIGINS || corsOrigin)
+  .split(',')
+  .map((s) => s.trim())
+  .filter(Boolean);
+console.log('🔥 CORS ALLOWED ORIGINS:', allowedOrigins);
 
 // Middlewares
 app.use(express.json());
 app.use(hpp());
 app.use(helmet());
 
 app.use(cors({
-    origin: corsOrigin,
+    origin: function (origin, callback) {
+        if (!origin) return callback(null, true);
+        if (allowedOrigins.includes(origin)) return callback(null, true);
+        console.warn('❌ CORS blocked origin:', origin);
+        return callback(new Error('Not allowed by CORS'));
+    },
     credentials: true,
 }));
 
@@ -50,12 +59,32 @@ app.use((req, res, next) => {
 app.use('/health', (req, res) => {
     res.json({ status: "OK", message: "Server is working" });
 });
+app.get('/health', async (req, res) => {
+    try {
+        // Simple DB connectivity check
+        // @ts-ignore
+        await prisma.$queryRaw`SELECT 1`;
+        res.json({ status: 'ok', db: true });
+    } catch (e: any) {
+        console.error('❌ Healthz DB check failed:', e);
+        res.status(500).json({ status: 'degraded', db: false, error: e?.message || 'db_error' });
+    }
+});
 app.use('/api/auth', authRoutes)
 app.use('/api/projects', projectRoutes)
 app.use('/api/frames', frameRoutes)
 app.use('/api/chat', chatRoute)
 app.use('/api/subscriptions', subscriptionRoutes)
 
+// Global error handler
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+app.use((err: any, req: express.Request, res: express.Response, next: express.NextFunction) => {
+  const status = err?.status || 500;
+  const message = err?.message || 'Internal Server Error';
+  console.error('🔥 Unhandled error:', { status, message, stack: err?.stack });
+  res.status(status).json({ success: false, message });
+});
+
 const PORT = process.env.PORT || 4000;
 //@ts-ignore
 app.listen(PORT, '0.0.0.0', async () => {

packages/server/src/utils/jwt.ts

@@ -3,23 +3,30 @@ import bcrypt from 'bcryptjs';
 import dotenv from 'dotenv';
 dotenv.config();
 
-const JWT_REFRESH_SECRET = (process.env.JWT_REFRESH_SECRET as string) || 'dev_refresh_secret';
-const JWT_ACCESS_SECRET = (process.env.JWT_ACCESS_SECRET as string) || 'dev_access_secret';
+const isProd = process.env.NODE_ENV === 'production';
+const JWT_REFRESH_SECRET = process.env.JWT_REFRESH_SECRET as string | undefined;
+const JWT_ACCESS_SECRET = process.env.JWT_ACCESS_SECRET as string | undefined;
+
+if (isProd) {
+    if (!JWT_REFRESH_SECRET || !JWT_ACCESS_SECRET) {
+        throw new Error('JWT secrets are not configured in production');
+    }
+}
 
 export function generateAccessToken(payload: any): string {
-    return jwt.sign(payload, JWT_ACCESS_SECRET, { expiresIn: "60m" });
+    return jwt.sign(payload, JWT_ACCESS_SECRET || 'dev_access_secret', { expiresIn: "60m" });
 }
 
 export function generateRefreshToken(payload: any): string {
-    return jwt.sign(payload, JWT_REFRESH_SECRET, { expiresIn: "7d" });
+    return jwt.sign(payload, JWT_REFRESH_SECRET || 'dev_refresh_secret', { expiresIn: "7d" });
 }
 
 export function verifyAccessToken(token: string): any {
-    return jwt.verify(token, JWT_ACCESS_SECRET);
+    return jwt.verify(token, JWT_ACCESS_SECRET || 'dev_access_secret');
 }
 
 export function verifyRefreshToken(token: string): any {
-    return jwt.verify(token, JWT_REFRESH_SECRET);
+    return jwt.verify(token, JWT_REFRESH_SECRET || 'dev_refresh_secret');
 }
 
 export async function hashPassword(password: string): Promise<string> {