Initialize project with monorepo structure, authentication, and admin features

.gitattributes

@@ -0,0 +1,33 @@
+# Force LF line endings for all text files — prevents CRLF issues on Windows dev machines
+* text=auto eol=lf
+
+# Explicitly LF
+*.ts        text eol=lf
+*.tsx       text eol=lf
+*.js        text eol=lf
+*.mjs       text eol=lf
+*.json      text eol=lf
+*.md        text eol=lf
+*.yml       text eol=lf
+*.yaml      text eol=lf
+*.env*      text eol=lf
+*.sh        text eol=lf
+
+# Binary — never diff or merge
+*.png       binary
+*.jpg       binary
+*.ico       binary
+*.woff2     binary
+*.pdf       binary
+*.pem       binary
+
+# PEM key files — never show in diffs (sensitive)
+*.pem       diff=nodiff
+
+# Linguist — tell GitHub what this repo is
+*.ts        linguist-language=TypeScript
+*.tsx       linguist-language=TypeScript
+
+# Collapse generated/vendored files in GitHub diffs
+CHANGELOG.md        linguist-generated=true
+package-lock.json   linguist-generated=true

.github/CODEOWNERS

@@ -0,0 +1,22 @@
+# Global fallback — all files require review from a core maintainer
+*                               @logusivam
+
+# Backend auth module — security-critical, requires security review
+apps/api/src/modules/auth/      @logusivam
+apps/api/src/modules/token/     @logusivam
+apps/api/src/modules/oauth/     @logusivam
+apps/api/src/middleware/        @logusivam
+
+# RBAC — permission model changes require admin sign-off
+apps/api/src/modules/rbac/      @logusivam
+
+# CI/CD workflows — pipeline changes require maintainer approval
+.github/workflows/              @logusivam
+
+# Shared types — breaking change risk
+packages/types/                 @logusivam
+
+# Environment + deployment config
+apps/api/.env.example           @logusivam
+apps/web/.env.example           @logusivam
+docker-compose*.yml             @logusivam

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+github: [logusivam]
+patreon: logusivam
+ko_fi: logusivam
+custom: ['https://loganathangp-dev-portfolio.vercel.app']

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,63 @@
+name: Bug Report
+description: Report a bug or unexpected behaviour in TokenForge
+title: "[BUG] "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for reporting a bug. Please fill in all fields — incomplete reports will be closed.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Affected Area
+      options:
+        - Authentication (login / register)
+        - Token Refresh / Rotation
+        - OAuth2 (Google / GitHub)
+        - RBAC / Permissions
+        - Admin Panel
+        - Frontend / UI
+        - CI / CD / Deployment
+        - Documentation
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      placeholder: What happened? What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      placeholder: |
+        1. POST /api/v1/auth/login with ...
+        2. Then POST /api/v1/auth/refresh ...
+        3. Observe ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      placeholder: |
+        Node.js version:
+        OS:
+        Browser (if frontend):
+        Deployment: local / Railway / other
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: security
+    attributes:
+      label: Security Impact
+      options:
+        - label: This bug has a security implication (token bypass, privilege escalation, data leak)

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,47 @@
+name: Feature Request
+description: Propose a new feature, enhancement, or visual element for TokenForge
+title: '[FEATURE] '
+labels: ['enhancement', 'triage']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for suggesting a feature! Please provide details to help us evaluate the request.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: Is your feature request related to a problem or limitation?
+      placeholder: A clear and concise description of what the problem is. e.g., I'm frustrated when...
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: Provide a clear description of what you want to happen.
+      placeholder: A clear and concise description of the feature or enhancement you want added.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Describe any alternative solutions or workarounds you have considered.
+      placeholder: A description of alternative behaviors or API structures you've thought about.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Affected Component Scopes
+      description: Select the parts of the codebase this change would affect.
+      options:
+        - label: '@tokenforge/api (Backend API endpoints, database schemas)'
+        - label: '@tokenforge/web (Frontend React UI components, states)'
+        - label: CI/CD Workflows / Docker configs
+        - label: Documentation

.github/ISSUE_TEMPLATE/security_vulnerability.yml

@@ -0,0 +1,23 @@
+name: Security Vulnerability
+description: >
+  STOP — do not file a public issue for security vulnerabilities.
+  Please email devbridgeenquirz@gmail.com or use GitHub's private
+  vulnerability reporting (Security → Report a vulnerability).
+title: '[SECURITY] Use private reporting — see description'
+labels: ['invalid']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## ⚠️ Do NOT report security vulnerabilities here
+
+        Public issues are visible to everyone, including potential attackers.
+
+        **To report a security vulnerability:**
+        1. Go to the **Security** tab of this repository
+        2. Click **"Report a vulnerability"** (GitHub private reporting)
+        3. Or email **devbridgeenquirz@gmail.com**
+
+        We will respond within 48 hours and coordinate a responsible disclosure.
+
+        See [SECURITY.md](../../SECURITY.md) for our full disclosure policy.

.github/PULL_REQUEST_TEMPLATE/pull_request_template.md

@@ -0,0 +1,47 @@
+## Summary
+
+<!-- One paragraph: what does this PR do and why? -->
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking)
+- [ ] New feature (non-breaking)
+- [ ] Breaking change (requires version bump + CHANGELOG entry)
+- [ ] Refactor (no behaviour change)
+- [ ] Documentation update
+- [ ] CI / tooling change
+
+## Security Checklist
+
+<!-- Required for any change touching auth, token, oauth, rbac, or middleware -->
+
+- [ ] No secrets, API keys, or credentials added to source
+- [ ] Input validation added/updated for new endpoints
+- [ ] RBAC permissions verified for new/changed routes
+- [ ] Rate limiting considered for new public endpoints
+- [ ] Audit log event added for new auth actions
+- [ ] Cookie options unchanged (httpOnly, Secure, SameSite)
+- [ ] No token data exposed in URLs, logs, or response bodies
+
+## Testing
+
+- [ ] Unit tests added / updated
+- [ ] Integration tests added / updated
+- [ ] All existing tests pass (`npm test`)
+- [ ] Coverage threshold maintained (≥80%)
+
+## Documentation
+
+- [ ] JSDoc added for public functions / classes
+- [ ] `docs/api-reference.md` updated if endpoints changed
+- [ ] `docs/rbac-model.md` updated if permissions changed
+- [ ] `CHANGELOG.md` entry added (or handled by semantic-release)
+- [ ] `.env.example` updated if new env vars added
+
+## Linked Issues
+
+Closes #<!-- issue number -->
+
+## Screenshots / Logs (if UI or behaviour change)
+
+<!-- Paste relevant logs, screenshots, or curl examples -->

.github/workflows/ci.yml

@@ -0,0 +1,96 @@
+name: CI
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true # Cancel stale runs on new pushes
+
+jobs:
+  lint:
+    name: Lint & Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npx turbo run lint
+      - run: npx tsc --noEmit --project apps/api/tsconfig.json
+      - run: npx tsc --noEmit --project apps/web/tsconfig.json
+
+  test:
+    name: Unit + Integration Tests
+    runs-on: ubuntu-latest
+    needs: lint
+    services:
+      mongodb:
+        image: mongo:8
+        ports: ['27017:27017']
+      redis:
+        image: redis:7-alpine
+        ports: ['6379:6379']
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      NODE_ENV: test
+      MONGO_URI: ${{ secrets.MONGO_URI_TEST }}
+      REDIS_URL: ${{ secrets.REDIS_URL_TEST }}
+      JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY_TEST }}
+      JWT_PUBLIC_KEY: ${{ secrets.JWT_PUBLIC_KEY_TEST }}
+      JWT_ACCESS_EXPIRY: 15m
+      JWT_REFRESH_EXPIRY: 7d
+      COOKIE_SECRET: ${{ secrets.COOKIE_SECRET_TEST }}
+      CLIENT_URL: https://tokenforge-dev.vercel.app
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npx turbo run test -- --coverage
+      - uses: codecov/codecov-action@v4
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: true
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+      - run: npm ci
+      - run: npx turbo run build
+
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v4
+      - name: Deploy API → Render
+        run: |
+          curl -f -X POST "${{ secrets.RENDER_DEPLOY_HOOK_URL }}"
+      - name: Deploy Web → Vercel
+        uses: amondnet/vercel-action@v25
+        with:
+          vercel-token: ${{ secrets.VERCEL_TOKEN }}
+          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
+          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
+          vercel-args: '--prod'

.github/workflows/codeql.yml

@@ -0,0 +1,26 @@
+name: CodeQL SAST
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 2 * * 1'                 # Weekly Monday 2am scan
+
+jobs:
+  analyze:
+    name: Analyze TypeScript
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: typescript
+          queries: security-extended     # Broader security query suite
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main, dev]
+
+jobs:
+  dependency-review:
+    name: Block HIGH/CRITICAL CVE Dependencies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high # Block high + critical CVEs
+          deny-licenses: GPL-2.0, GPL-3.0 # Block copyleft licenses
+          # GHSA-qwww-vcr4-c8h2: react-router RSC Mode CSRF — only affects SSR/RSC apps.
+          # This project is a Vite client-side app (no SSR/RSC), so this CVE is not exploitable.
+          # react-router-dom has no v8.x release; no non-breaking fix exists in the 7.x line.
+          # GHSA-mh99-v99m-4gvg: brace-expansion DoS — in transitive build-tooling deps only,
+          # not reachable from production server code; no non-breaking fix available in 1.x line.
+          allow-ghsas: GHSA-qwww-vcr4-c8h2,GHSA-mh99-v99m-4gvg