Build your first feature

--- a/infra/projects/drizzle-project-repository.ts
+++ b/infra/projects/drizzle-project-repository.ts
@@ -19,4 +19,5 @@
     name: row.name,
     description: row.description,
+    userId: row.userId,
     version: row.version,
     createdAt: row.createdAt,
@@ -50,6 +51,9 @@
 }

-function projectListWhere(query: ListProjectsQuery): SQL<unknown> | undefined {
-  const filters: SQL<unknown>[] = [];
+function projectListWhere(
+  query: ListProjectsQuery,
+  userId: string,
+): SQL<unknown> | undefined {
+  const filters: SQL<unknown>[] = [eq(schema.projects.userId, userId)];
   const cursor = projectCursorFilter(query);

@@ -82,6 +86,6 @@
 ): ProjectRepository {
   return {
-    async list(query) {
-      const where = projectListWhere(query);
+    async list(query, userId) {
+      const where = projectListWhere(query, userId);
       const rows = await db
         .select()
@@ -106,4 +110,5 @@
           name: input.name,
           description: input.description ?? null,
+          userId: input.userId,
           version: 1,
           createdAt: now,
@@ -132,4 +137,5 @@
         .set({
           name: input.name,
+          description: input.description,
           version: input.version + 1,
           updatedAt: new Date().toISOString(),
--- a/infra/projects/in-memory-project-repository.ts
+++ b/infra/projects/in-memory-project-repository.ts
@@ -14,4 +14,5 @@
     name: project.name,
     description: project.description,
+    userId: project.userId,
     version: project.version,
     createdAt: project.createdAt,
@@ -72,7 +73,8 @@

   return {
-    async list(query) {
+    async list(query, userId) {
       const name = query.name?.toLocaleLowerCase();
       const allProjects = Array.from(projects.values())
+        .filter((project) => project.userId === userId)
         .filter(
           (project) => !name || project.name.toLocaleLowerCase().includes(name),
@@ -94,4 +96,5 @@
         name: input.name,
         description: input.description ?? null,
+        userId: input.userId,
         version: 1,
         createdAt: now,
@@ -114,4 +117,5 @@
         ...existing,
         name: input.name,
+        description: input.description ?? existing.description,
         version: existing.version + 1,
         updatedAt: new Date().toISOString(),

--- a/features/projects/use-cases/create-project.ts
+++ b/features/projects/use-cases/create-project.ts
@@ -1,3 +1,4 @@
 import "@beignet/core/server-only";
+import { requireUserId } from "@beignet/core/ports";
 import { useCase } from "../../../lib/use-case";
 import { CreateProjectInputSchema, ProjectSchema } from "../schemas";
@@ -8,5 +9,6 @@
   .output(ProjectSchema)
   .run(async ({ ctx, input }) => {
-    const project = await ctx.ports.projects.create(input);
+    const userId = requireUserId(ctx);
+    const project = await ctx.ports.projects.create({ ...input, userId });

     return project;
--- a/features/projects/use-cases/list-projects.ts
+++ b/features/projects/use-cases/list-projects.ts
@@ -1,4 +1,5 @@
 import "@beignet/core/server-only";
 import { normalizeCursorPage } from "@beignet/core/pagination";
+import { requireUserId } from "@beignet/core/ports";
 import { useCase } from "../../../lib/use-case";
 import {
@@ -13,4 +14,5 @@
   .output(ListProjectsOutputSchema)
   .run(async ({ ctx, input }) => {
+    const userId = requireUserId(ctx);
     const page = normalizeCursorPage(input, {
       defaultLimit: 20,
@@ -18,10 +20,13 @@
     });

-    return ctx.ports.projects.list({
-      page,
-      cursor: page.cursor ? decodeProjectCursor(page.cursor) : null,
-      name: input.name,
-      sortBy: input.sortBy,
-      sortDirection: input.sortDirection,
-    });
+    return ctx.ports.projects.list(
+      {
+        page,
+        cursor: page.cursor ? decodeProjectCursor(page.cursor) : null,
+        name: input.name,
+        sortBy: input.sortBy,
+        sortDirection: input.sortDirection,
+      },
+      userId,
+    );
   });
--- a/features/projects/use-cases/get-project.ts
+++ b/features/projects/use-cases/get-project.ts
@@ -1,3 +1,4 @@
 import "@beignet/core/server-only";
+import { requireUserId } from "@beignet/core/ports";
 import { useCase } from "../../../lib/use-case";
 import { appError } from "../../shared/errors";
@@ -9,4 +10,5 @@
   .output(ProjectSchema)
   .run(async ({ ctx, input }) => {
+    requireUserId(ctx);
     const project = await ctx.ports.projects.findById(input.id);
     if (!project) {
@@ -16,4 +18,5 @@
     }

+    await ctx.gate.authorize("projects.access", project);
     return project;
   });
--- a/features/projects/use-cases/update-project.ts
+++ b/features/projects/use-cases/update-project.ts
@@ -1,3 +1,4 @@
 import "@beignet/core/server-only";
+import { requireUserId } from "@beignet/core/ports";
 import { useCase } from "../../../lib/use-case";
 import { appError } from "../../shared/errors";
@@ -9,4 +10,5 @@
   .output(ProjectSchema)
   .run(async ({ ctx, input }) => {
+    requireUserId(ctx);
     const existing = await ctx.ports.projects.findById(input.id);
     if (!existing) {
@@ -15,4 +17,6 @@
       });
     }
+    await ctx.gate.authorize("projects.access", existing);
+
     if (existing.version !== input.version) {
       throw appError("ProjectConflict", {
--- a/features/projects/use-cases/delete-project.ts
+++ b/features/projects/use-cases/delete-project.ts
@@ -1,3 +1,4 @@
 import "@beignet/core/server-only";
+import { requireUserId } from "@beignet/core/ports";
 import { z } from "zod";
 import { useCase } from "../../../lib/use-case";
@@ -10,4 +11,10 @@
   .output(z.void())
   .run(async ({ ctx, input }) => {
+    requireUserId(ctx);
+    const project = await ctx.ports.projects.findById(input.id);
+    if (!project)
+      throw appError("ProjectNotFound", { details: { id: input.id } });
+    await ctx.gate.authorize("projects.access", project);
+
     const deleted = await ctx.ports.projects.delete(input.id);
     if (!deleted) {

--- a/features/projects/tests/projects.test.ts
+++ b/features/projects/tests/projects.test.ts
@@ -5 +4,0 @@
-  createTestAnonymousActor,
@@ -7,0 +7 @@
+  createTestUserActor,
@@ -38,0 +39 @@
+        userId: "user_test",
@@ -46,0 +48 @@
+        userId: "user_test",
@@ -54,0 +57 @@
+        userId: "user_test",
@@ -64,0 +68 @@
+        gate: initialPorts.gate,
@@ -66 +70,8 @@
-          getSession: async () => null,
+          getSession: async () => ({
+            user: {
+              id: "user_test",
+              name: "Test User",
+              email: "test@example.com",
+            },
+            session: { id: "session_test" },
+          }),
@@ -82 +93 @@
-      actor: createTestAnonymousActor(),
+      actor: createTestUserActor("user_test"),
@@ -83,0 +95,3 @@
+      auth: await testFixture.ports.auth.getSession(
+        new Request("http://localhost"),
+      ),

// features/projects/tests/access.test.ts
import { createStaticAuth } from "@beignet/core/ports";
import { defineRoutes } from "@beignet/core/server";
import {
  createTestAnonymousActor,
  createTestContextFactory,
  createTestPorts,
  createTestUserActor,
} from "@beignet/core/testing";
import { createInMemoryDevtools } from "@beignet/devtools";
import { createTestApp } from "@beignet/web/testing";
import type { AppContext } from "@/app-context";
import { createTestDatabase } from "@/infra/db/test-database";
import { initialPorts } from "@/infra/port-wiring";
import { createInMemoryProjectRepository } from "@/infra/projects/in-memory-project-repository";
import { describe, expect, it } from "@/lib/beignet-test";
import type { AuthRequest, AuthSessionMetadata, AuthUser } from "@/ports/auth";
import { appContext } from "@/server/context";
import {
  createProject,
  deleteProject,
  getProject,
  listProjects,
  updateProject,
} from "../contracts";
import type { ProjectRepository } from "../ports";
import { projectRoutes } from "../routes";
import {
  createProjectUseCase,
  deleteProjectUseCase,
  getProjectUseCase,
  listProjectsUseCase,
  updateProjectUseCase,
} from "../use-cases";

async function userContext(projects: ProjectRepository, userId: string | null) {
  const auth = userId
    ? {
        user: { id: userId, name: userId, email: `${userId}@example.com` },
        session: { id: `session_${userId}` },
      }
    : null;
  const fixture = createTestPorts<AppContext["ports"]>({
    base: initialPorts,
    overrides: {
      projects,
      gate: initialPorts.gate,
      auth: createStaticAuth<AuthUser, AuthSessionMetadata, AuthRequest>(auth),
      devtools: createInMemoryDevtools(),
    },
  });
  return createTestContextFactory<AppContext, AppContext["ports"]>({
    ports: fixture.ports,
    auth,
    actor: userId ? createTestUserActor(userId) : createTestAnonymousActor(),
  })();
}

for (const adapter of ["memory", "sqlite"]) {
  describe(`${adapter} project ownership`, () => {
    it("protects reads and writes through use cases and HTTP", async () => {
      const database =
        adapter === "sqlite" ? await createTestDatabase() : undefined;
      const projects =
        database?.repositories.projects ?? createInMemoryProjectRepository();
      try {
        const alice = await userContext(projects, "alice");
        const bob = await userContext(projects, "bob");
        const anonymous = await userContext(projects, null);
        const project = await createProjectUseCase.run({
          ctx: alice,
          input: { name: "Private", description: "Alice's project" },
        });
        expect(project.userId).toBe("alice");
        expect(
          (await listProjectsUseCase.run({ ctx: alice, input: {} })).items,
        ).toEqual([project]);
        expect(
          (await listProjectsUseCase.run({ ctx: bob, input: {} })).items,
        ).toEqual([]);
        await expect(
          createProjectUseCase.run({
            ctx: anonymous,
            input: { name: "Anonymous" },
          }),
        ).rejects.toMatchObject({ code: "UNAUTHORIZED" });
        await expect(
          listProjectsUseCase.run({ ctx: anonymous, input: {} }),
        ).rejects.toMatchObject({ code: "UNAUTHORIZED" });
        await expect(
          getProjectUseCase.run({ ctx: bob, input: { id: project.id } }),
        ).rejects.toMatchObject({ code: "FORBIDDEN" });
        await expect(
          updateProjectUseCase.run({
            ctx: bob,
            input: { id: project.id, name: "Stolen", version: project.version },
          }),
        ).rejects.toMatchObject({ code: "FORBIDDEN" });
        await expect(
          deleteProjectUseCase.run({ ctx: bob, input: { id: project.id } }),
        ).rejects.toMatchObject({ code: "FORBIDDEN" });
        expect(await projects.findById(project.id)).toEqual(project);
        const saved = await updateProjectUseCase.run({
          ctx: alice,
          input: {
            id: project.id,
            name: "Updated",
            description: "Saved",
            version: project.version,
          },
        });
        expect(saved.description).toBe("Saved");
        await expect(
          updateProjectUseCase.run({
            ctx: alice,
            input: { id: project.id, name: "Stale", version: project.version },
          }),
        ).rejects.toMatchObject({ code: "PROJECT_CONFLICT" });

        for (const ctx of [bob, anonymous]) {
          const app = await createTestApp({
            ports: ctx.ports,
            context: appContext,
            routes: defineRoutes<AppContext>([projectRoutes]),
          });
          try {
            const code = ctx.auth ? "FORBIDDEN" : "UNAUTHORIZED";
            await expect(
              app.request(getProject, { path: { id: project.id } }),
            ).rejects.toMatchObject({ code });
            await expect(
              app.request(updateProject, {
                path: { id: project.id },
                body: { name: "Blocked", version: saved.version },
              }),
            ).rejects.toMatchObject({ code });
            await expect(
              app.request(deleteProject, { path: { id: project.id } }),
            ).rejects.toMatchObject({ code });
            if (!ctx.auth) {
              await expect(
                app.request(listProjects, { query: {} }),
              ).rejects.toMatchObject({ code });
              await expect(
                app.request(createProject, { body: { name: "Blocked" } }),
              ).rejects.toMatchObject({ code });
            }
          } finally {
            await app.stop();
          }
        }
        await deleteProjectUseCase.run({
          ctx: alice,
          input: { id: project.id },
        });
        expect(await projects.findById(project.id)).toBeNull();
      } finally {
        await database?.close();
      }
    });
  });
}

// features/projects/components/project-list.tsx
"use client";

import { useInfiniteQuery, useMutation } from "@tanstack/react-query";
import Link from "next/link";
import { rhf } from "@/client/forms";
import { Button } from "@/components/ui/button";
import { Input } from "@/components/ui/input";
import { Label } from "@/components/ui/label";
import {
  createProjectMutationOptions,
  projectsQueryOptions,
} from "../client/queries";
import { createProject } from "../contracts";

export function ProjectList() {
  const projects = useInfiniteQuery(projectsQueryOptions());
  const create = useMutation(createProjectMutationOptions());
  const form = rhf(createProject).useForm({
    defaultValues: { name: "", description: "" },
  });
  const submit = form.handleSubmit(async (body) => {
    form.clearErrors("root");
    try {
      await create.mutateAsync({ body });
      form.reset();
    } catch (error) {
      form.setError("root", {
        message:
          error instanceof Error ? error.message : "Could not create project.",
      });
    }
  });

  return (
    <div className="space-y-8">
      <h1 className="text-2xl font-semibold">Projects</h1>
      <form onSubmit={submit} className="space-y-4">
        <div className="space-y-2">
          <Label htmlFor="project-name">Name</Label>
          <Input
            id="project-name"
            readOnly={form.formState.isSubmitting}
            {...form.register("name")}
          />
          <p role="alert">{form.formState.errors.name?.message}</p>
        </div>
        <div className="space-y-2">
          <Label htmlFor="project-description">Description</Label>
          <Input
            id="project-description"
            readOnly={form.formState.isSubmitting}
            {...form.register("description")}
          />
          <p role="alert">{form.formState.errors.description?.message}</p>
        </div>
        <p role="alert">{form.formState.errors.root?.message}</p>
        <Button type="submit" disabled={form.formState.isSubmitting}>
          {form.formState.isSubmitting ? "Creating…" : "Create project"}
        </Button>
      </form>
      <section aria-label="Your projects" className="space-y-4">
        {projects.isPending && <p>Loading projects…</p>}
        {projects.isError && (
          <div role="alert">
            <p>{projects.error.message}</p>
            <Button type="button" onClick={() => void projects.refetch()}>
              Try again
            </Button>
          </div>
        )}
        {projects.data?.pages.every((page) => page.items.length === 0) && (
          <p>No projects yet. Create your first one above.</p>
        )}
        <ul className="space-y-3">
          {projects.data?.pages
            .flatMap((page) => page.items)
            .map((project) => (
              <li key={project.id}>
                <Link className="underline" href={`/projects/${project.id}`}>
                  {project.name}
                </Link>
                <p className="text-sm text-muted-foreground">
                  {project.description}
                </p>
              </li>
            ))}
        </ul>
        {projects.hasNextPage && (
          <Button
            type="button"
            disabled={projects.isFetchingNextPage}
            onClick={() => void projects.fetchNextPage()}
          >
            {projects.isFetchingNextPage ? "Loading…" : "Load more"}
          </Button>
        )}
      </section>
    </div>
  );
}

// features/projects/components/project-detail.tsx
"use client";

import { useMutation, useQuery } from "@tanstack/react-query";
import Link from "next/link";
import { useRouter } from "next/navigation";
import { useEffect } from "react";
import { rq } from "@/client";
import { rhf } from "@/client/forms";
import { Button } from "@/components/ui/button";
import { Input } from "@/components/ui/input";
import { Label } from "@/components/ui/label";
import {
  deleteProjectMutationOptions,
  updateProjectMutationOptions,
} from "../client/queries";
import { getProject, updateProject } from "../contracts";
import type { Project } from "../schemas";

export function ProjectDetail({ id }: { id: string }) {
  const project = useQuery(rq(getProject).queryOptions({ path: { id } }));
  if (project.isPending) return <p>Loading project…</p>;
  if (!project.data)
    return (
      <div role="alert">
        <p>{project.error?.message ?? "Could not load project."}</p>
        <Button type="button" onClick={() => void project.refetch()}>
          Try again
        </Button>
        <Link href="/projects">Back to projects</Link>
      </div>
    );
  return (
    <div className="space-y-4">
      {project.isError && (
        <p role="alert">
          Could not refresh this project. Your draft is still open.
          {" "}{project.error.message}
        </p>
      )}
      <ProjectEditor key={id} project={project.data} />
    </div>
  );
}

function ProjectEditor({ project }: { project: Project }) {
  const router = useRouter();
  const update = useMutation(updateProjectMutationOptions());
  const remove = useMutation(deleteProjectMutationOptions());
  const form = rhf(updateProject).useForm({
    defaultValues: {
      name: project.name,
      description: project.description ?? "",
      version: project.version,
    },
  });
  const { isDirty, isSubmitting } = form.formState;
  const { getValues, reset } = form;
  const busy = isSubmitting || remove.isPending;
  useEffect(() => {
    if (!isDirty && !busy && project.version > getValues("version")) {
      reset({
        name: project.name,
        description: project.description ?? "",
        version: project.version,
      });
    }
  }, [busy, getValues, isDirty, project, reset]);
  const submit = form.handleSubmit(async (body) => {
    form.clearErrors("root");
    try {
      const saved = await update.mutateAsync({
        path: { id: project.id },
        body,
      });
      form.reset({
        name: saved.name,
        description: saved.description ?? "",
        version: saved.version,
      });
    } catch (error) {
      form.setError("root", {
        message:
          error instanceof Error ? error.message : "Could not save project.",
      });
    }
  });
  async function deleteCurrentProject() {
    if (!window.confirm("Delete this project?")) return;
    try {
      await remove.mutateAsync({ path: { id: project.id } });
      router.push("/projects");
    } catch {
      // The mutation error is rendered below; keep the current page open.
    }
  }

  return (
    <div className="space-y-6">
      <Link href="/projects" className="underline">
        Back to projects
      </Link>
      <h1 className="text-2xl font-semibold">Edit project</h1>
      <form onSubmit={submit} className="space-y-4">
        <input
          type="hidden"
          {...form.register("version", { valueAsNumber: true })}
        />
        <div className="space-y-2">
          <Label htmlFor="project-name">Name</Label>
          <Input
            id="project-name"
            readOnly={busy}
            {...form.register("name")}
          />
          <p role="alert">{form.formState.errors.name?.message}</p>
        </div>
        <div className="space-y-2">
          <Label htmlFor="project-description">Description</Label>
          <Input
            id="project-description"
            readOnly={busy}
            {...form.register("description")}
          />
          <p role="alert">{form.formState.errors.description?.message}</p>
        </div>
        <p role="alert">{form.formState.errors.root?.message}</p>
        <Button type="submit" disabled={busy}>
          {form.formState.isSubmitting ? "Saving…" : "Save project"}
        </Button>
      </form>
      <p className="text-sm text-muted-foreground">
        If another tab changed this project, reload before saving again.
        Reloading discards your unsaved edits.
      </p>
      <Button
        type="button"
        variant="outline"
        disabled={busy}
        onClick={() => window.location.reload()}
      >
        Reload project
      </Button>
      <div>
        <Button
          type="button"
          variant="destructive"
          disabled={busy}
          onClick={() => void deleteCurrentProject()}
        >
          {remove.isPending ? "Deleting…" : "Delete project"}
        </Button>
        {remove.isError && <p role="alert">{remove.error.message}</p>}
      </div>
    </div>
  );
}