fix: generated projects are broken — repair the generator, harden secrets, prove it in CI

[tashikomaaa]

Why

aapi generate model <Name> --relations ... produced a Mongoose model that does not parse:

author: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
//                                                   ^ SyntaxError

Pulling that thread turned up a chain of defects across the generator, the templates and the security mode. Four out of six generate flags were broken, generated tests could never run, and the default Yoga server died on its first /health request.

None of it was caught because CI only listed the generated files and printed package.json — it never parsed, installed, ran or started anything it produced.

What was broken

Reported first, fixed here

Defect	Effect
Relation fragments interpolated with EJS <%= %>	Models and resolvers are invalid JavaScript whenever --relations is used
--with-subscriptions / --with-cache import utils/pubsub.js and utils/cache.js	Those files were never written by any command — the project cannot start
--no-tests read options.withTests	Commander maps the flag to options.tests, so it never had any effect
Generated tests import ../../models/… from src/__tests__/	Wrong depth; plus jest.config.js/jest.setup.js were never copied and no test script or Jest dependency was declared
Schema and resolver loaders glob from process.cwd()	Empty schema unless the server is started from the project root (breaks Docker, PM2, monorepos)
--secure falls back to a hardcoded signing key	An API deployed without a .env signs tokens with a key published in this repo: anyone can forge an admin token

Found only by actually booting the generated servers

Defect	Effect
/health registered as a second request listener alongside Yoga	Both listeners run per request; the second throws ERR_HTTP_HEADERS_SENT and kills the process on the first health check — i.e. the first load-balancer probe
pubsub.js imports PubSub from graphql-yoga	v5 exports createPubSub; subscriptions could never work
cacheResolver reads context.skipCache unconditionally	Crashes whenever a resolver is called without a context
Cache cleanup setInterval never unref()ed	Keeps the process and Jest workers alive forever

Smaller

--skip-install skipped nothing (install never ran at all) · --secure --apollo silently dropped security · .gitignore/.editorconfig templates absent from the npm tarball (npm always strips .gitignore) · aapi list reported the schema's state on the "Model" line · aapi --version hardcoded · Windows-broken new URL().pathname · apollo-server-express@3 EOL since Oct 2023 · stray Product artifacts committed into the CLI's own src/ and published to npm · no LICENSE despite the badge.

What changed

• Security: the --secure server now refuses to start in production when a JWT secret is missing, still the placeholder, under 32 characters, or identical between access and refresh tokens. Outside production it warns instead of blocking.
• Apollo path migrated from the EOL apollo-server-express v3 to @apollo/server v4 + @as-integrations/express4.
• aapi create now actually installs dependencies; --skip-install genuinely opts out.
• --with-subscriptions fails with an actionable message on non-Yoga projects rather than emitting dead imports (Apollo Server 4 needs graphql-ws wiring AAPI does not scaffold).
• Generated projects ship a working Jest setup backed by an in-memory MongoDB.

Verification

Two layers, both in CI:

• __tests__/commands/generate.integration.test.js — scaffolds projects and asserts every generated file parses under node --check, with targeted guards per regression. Mutation-tested: reverting the <%- fix makes it fail.
• npm run verify:generated / verify:generated:apollo — scaffold → generate → type-check → install → run the project's own suite → boot the server from / → hit /health twice → CRUD round-trip over GraphQL.

Starting outside the project root is what catches cwd-dependent loading; hitting /health twice is what catches the duplicate listener.

Results on both server flavours:

▶ Type-checking every generated file
  16 files parse
▶ Generated project test suite
Test Suites: 3 passed, 3 total
Tests:       43 passed, 43 total
▶ Booting the server from "/" against an in-memory MongoDB
  GET /health -> {"status":"ok",...,"mongodb":"connected"}
▶ CRUD round-trip over the generated schema
  posts -> {"items":[{"name":"verify"}],"pageInfo":{"total":1}}
✅ generated project builds, tests, boots and serves requests

Repo itself: lint clean, 59/59 tests.

Reviewing

Seven thematic commits, each self-contained — git log -p main..HEAD reads in order. Two deliberate exceptions to one-theme-per-commit, called out in the commit bodies: init.js carries the Apollo 4 dependency list in the CLI commit, and the Apollo package.json.ejs carries its test script in the security commit. That beat hunk-level splitting, which does not play well with lint-staged on partially-staged files.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ao3xH9yfS95UgmBm1VquAW