feat: implement monorepo setup, middleware auth, and centralized routing

[Hydrax117]

Pull Request: Monorepo Setup, Middleware Auth, and Centralized Routing

Overview

This PR implements three major infrastructure improvements to the AirFlex project:

1. Monorepo setup with pnpm workspaces and Turborepo
2. Next.js middleware for server-side route protection
3. Centralized server routing architecture

Related Issues

closes #92
closes #123
closes #126
closes #139

Changes Made

1. Monorepo Setup (#92)

• Created pnpm-workspace.yaml with workspace configuration for apps/*, packages/*, frontend, and server
• Added root package.json with workspace scripts (dev, build, lint, test, clean)
• Configured turbo.json with pipeline caching for build, lint, and test tasks
• Created packages/shared/ workspace package with common TypeScript types:
  • TradeOffer interface
  • TradeStatus enum
  • User interface
• Updated frontend/package.json and server/package.json to use @airflex/shared: workspace:*
• Removed server/package-lock.json to convert from npm to pnpm
• Single pnpm-lock.yaml at root for unified dependency management

2. Next.js Middleware for Route Protection (#123)

• Created frontend/middleware.ts with path matcher for protected routes:
  • /wallet/:path*
  • /sell/:path*
  • /profile/:path*
  • /admin/:path*
  • /onboarding/:path*
• Implemented JWT validation reading from Authorization or session cookie
• Added admin role verification for /admin routes (redirects non-admin users to /)
• Added X-User-Id header to forwarded requests for server components
• Public routes (/, /auth/:path*, /trades/:path*) explicitly excluded from matcher
• Created frontend/middleware.test.ts with 9 passing unit tests
• Added Jest configuration (jest.config.js, jest.setup.js) and dependencies
• Updated frontend/tsconfig.json to include Jest types

3. Centralized Server Routing (#126, #139)

• Created server/src/routes/index.ts with registerRoutes(app: Express): void function
• Mounted all routers under /api/v1 prefix:
  • /api/v1/auth (existing auth router)
  • /api/v1/trades (existing trades router)
  • /api/v1/wallet (existing wallet router)
  • /api/v1/profile (existing profile router)
  • /api/v1/webhooks (new stub router)
  • /api/v1/admin (new stub router)
  • /api/events (existing SSE events router, kept at current path for compatibility)
• Created stub routers:
  • server/src/routes/webhooks.ts with 501 Not Implemented endpoints
  • server/src/routes/admin.ts with 501 Not Implemented endpoints
• Updated server/src/index.ts to call registerRoutes(app) after middleware setup
• /health route remains directly on app (not under /api/v1) as process probe
• TypeScript compilation passes with zero errors

4. Configuration Updates

• Updated .gitignore to exclude:
  • pr-*.md (pull request description files)
  • .kiro/ (Kiro IDE directory)
• Converted frontend/next.config.ts to frontend/next.config.js (Next.js 14 doesn't support .ts config)
• Added reactStrictMode: true and images.domains array to Next.js config

Testing

• All 9 middleware unit tests pass
• TypeScript compilation passes with zero errors (tsc --noEmit)
• Monorepo workspace installs correctly with pnpm install
• Next.js dev server starts successfully on port 3000

Breaking Changes

• Server API routes now under /api/v1 prefix (except /health and /api/events)
• Frontend middleware will redirect unauthenticated users from protected routes
• Server converted from npm to pnpm (package-lock.json removed)

Migration Notes

• Update frontend API calls to use /api/v1 prefix
• Ensure JWT cookies are set correctly for authentication
• Run pnpm install from root to install workspace dependencies

Checklist

• Monorepo workspace configured
• Shared types package created
• Middleware implemented with JWT validation
• Admin role verification added
• Centralized routing implemented
• Stub routers created for webhooks and admin
• Unit tests added for middleware
• TypeScript compilation passes
• .gitignore updated
• Branch created locally: feature/monorepo-middleware-routing
• Branch pushed to remote (requires SSH key setup)

[drips-wave]

@Hydrax117 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[dark-sarge]

LGTM