create-mern-auth-crud

A CLI that scaffolds a complete MERN app with JWT authentication, role-based access control, and CRUD — React + Vite + React Router + Redux Toolkit + Tailwind CSS on the frontend, Node + Express + MongoDB/Mongoose + JWT on the backend, with a proper services → controllers → routes layered structure, centralized error handling, and toast notifications already wired up. Optional add-ons: multi-role permissions, Redis, and a full Stripe Checkout + webhook payment flow.

Usage

npx @your-npm-username/create-mern-auth-crud my-app

or run it with no project name and answer the prompt:

npx @your-npm-username/create-mern-auth-crud

You'll be asked:

? Project name: my-app
? Name of your protected CRUD resource? (e.g. Task, Product) Task
? User roles?
  ❯ Single role (just "user")
    Multi-role (admin, manager, user)
? Set up Redis (optional cache / session store, not wired into any route)? (y/N)
? Set up payment gateway (Stripe Checkout + webhook)? (y/N)
? Install dependencies now? (Y/n)

Then:

cd my-app/server && cp .env.example .env   # fill in MONGO_URI + JWT_SECRET
npm install && npm run dev

cd my-app/client
npm install && npm run dev

What you get

• JWT auth — register/login, bcrypt-hashed passwords, protect middleware, token auto-attached client-side via an Axios interceptor.
• Role setup — choose single-role (everyone manages only their own data) or multi-role (user / manager / admin, where privileged roles can view and manage everyone's data). Both modes share the exact same controller code via one isPrivileged(role) helper — nothing to keep in sync by hand. A bonus GET /api/admin/users route is admin-only regardless of mode.
• CRUD resource named whatever you typed, owner-scoped, fully wired: Mongoose model → service layer → controller (throws a standard ApiError) → Express router → Redux Toolkit slice → React components.
• Centralized error handling — every thrown ApiError(statusCode, message) is caught by one Express error-handling middleware, so the HTTP status code you get back always matches what was actually thrown (this matters — a bad login correctly returns 401, not a generic 500).
• Toasts — success and error notifications, top-right, via react-hot-toast.
• Redis (optional) — an ioredis client in server/config/redis.js, ready to import for caching, rate-limiting, or session storage. Not wired into any route by default.
• Payments (optional) — Stripe Checkout Session creation (tied to the logged-in user) + a signature-verified webhook that persists payment status to MongoDB via a Payment model linked to that user. See the generated project's own README.md for full local-testing instructions — webhooks specifically need the Stripe CLI or a tunnel since localhost isn't reachable from Stripe's servers on its own.

Full docs

Once generated, my-app/README.md documents the exact stack, folder structure, role behavior, API routes, and (if enabled) the complete payment testing walkthrough for that specific project.