@0x0501/mystack 0.0.0-stage → 0.1.0-bootstrap.0

package/template/src/server/oauth-clients.ts

@@ -0,0 +1,83 @@
+import { createServerFn } from "@tanstack/react-start";
+import { getRequestHeaders } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { adminMiddleware } from "@/middlewares/admin";
+import { logAdminAction } from "@/services/admin-security";
+import {
+	createOAuthClientInputSchema,
+	oauthClientRegistrationBody,
+} from "@/services/oauth-client";
+import { deleteOAuthClientById } from "@/services/oauth-clients";
+import { validated } from "@/utils/api-error";
+
+type OAuthClientSummary = {
+	clientId: string;
+	name: string | null;
+	redirectUris: string[];
+	grantTypes: string[];
+	responseTypes: string[];
+	tokenEndpointAuthMethod: string | null;
+	scope: string | null;
+};
+
+const stringArray = (value: unknown) =>
+	Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+
+export const getOAuthClients = createServerFn({ method: "GET" })
+	.middleware([adminMiddleware])
+	.handler(async ({ context }) => {
+		const clients = await context.auth.api.getOAuthClients({
+			headers: getRequestHeaders(),
+		});
+
+		return (clients ?? []).map(
+			(client): OAuthClientSummary => ({
+				clientId: client.client_id,
+				name: client.client_name ?? null,
+				redirectUris: stringArray(client.redirect_uris),
+				grantTypes: stringArray(client.grant_types),
+				responseTypes: stringArray(client.response_types),
+				tokenEndpointAuthMethod: client.token_endpoint_auth_method ?? null,
+				scope: client.scope ?? null,
+			}),
+		);
+	});
+
+export const createOAuthClient = createServerFn({ method: "POST" })
+	.middleware([adminMiddleware])
+	.validator(validated(createOAuthClientInputSchema))
+	.handler(async ({ context, data }) => {
+		const client = await context.auth.api.adminCreateOAuthClient({
+			body: oauthClientRegistrationBody(data),
+			headers: getRequestHeaders(),
+		});
+		await logAdminAction(context.db, {
+			actorId: context.session.user.id,
+			action: "oauth_client.create",
+			targetType: "oauth_client",
+			targetId: client.client_id,
+			detail: { name: client.client_name ?? null },
+		});
+		return {
+			clientId: client.client_id,
+			clientSecret: client.client_secret ?? null,
+			name: client.client_name ?? null,
+			redirectUris: client.redirect_uris ?? [],
+		};
+	});
+
+export const deleteOAuthClient = createServerFn({ method: "POST" })
+	.middleware([adminMiddleware])
+	.validator(validated(z.object({ clientId: z.string().trim().min(1) })))
+	.handler(async ({ context, data }) => {
+		const deleted = await deleteOAuthClientById(context.db, data.clientId);
+		if (deleted) {
+			await logAdminAction(context.db, {
+				actorId: context.session.user.id,
+				action: "oauth_client.delete",
+				targetType: "oauth_client",
+				targetId: data.clientId,
+			});
+		}
+		return { ok: deleted };
+	});

package/template/src/server/payment-toggles.ts

@@ -0,0 +1,39 @@
+import { createServerFn } from "@tanstack/react-start";
+import { z } from "zod";
+import { adminMiddleware } from "@/middlewares/admin";
+import { databaseMiddleware } from "@/middlewares/database";
+import { logAdminAction } from "@/services/admin-security";
+import {
+	getPaymentToggles,
+	type PaymentToggles,
+	setPaymentToggles,
+} from "@/services/payment-toggles";
+import { validated } from "@/utils/api-error";
+
+export const getPaymentMethodToggles = createServerFn({ method: "GET" })
+	.middleware([databaseMiddleware, adminMiddleware])
+	.handler(({ context }) => getPaymentToggles(context.db));
+
+export const updatePaymentMethodToggles = createServerFn({ method: "POST" })
+	.middleware([databaseMiddleware, adminMiddleware])
+	.validator(
+		validated(
+			z.object({
+				stripe: z.boolean(),
+				creem: z.boolean(),
+				nowpayments: z.boolean(),
+			}),
+		),
+	)
+	.handler(async ({ context, data }) => {
+		const next = data as PaymentToggles;
+		await setPaymentToggles(context.db, next);
+		await logAdminAction(context.db, {
+			actorId: context.session.user.id,
+			action: "payment_toggle.change",
+			targetType: "system_config",
+			targetId: "payment_toggles",
+			detail: next,
+		});
+		return { ok: true as const, toggles: next };
+	});

package/template/src/server.ts

@@ -0,0 +1,20 @@
+/**
+ * Worker / SSR entry — Paraglide ambient locale + original Request handoff.
+ *
+ * Pass the ORIGINAL localized request into Start. Router `rewrite` does
+ * de-/re-localization; handing it an already-de-localized URL causes a 307 loop.
+ * paraglideMiddleware still sets ambient getLocale() for SSR messages.
+ */
+import handler, { createServerEntry } from "@tanstack/react-start/server-entry";
+import { withSecurityHeaders } from "@/lib/security-headers";
+import { paraglideMiddleware } from "./paraglide/server.js";
+
+export default createServerEntry({
+	fetch: async (request) => {
+		return paraglideMiddleware(request, async () => {
+			// Original request — not the middleware-delocalized one.
+			const res = await handler.fetch(request);
+			return withSecurityHeaders(res);
+		});
+	},
+});

package/template/src/services/README.md

@@ -0,0 +1,3 @@
+# Services
+
+Business / domain logic. Keep it framework-agnostic so routes, server functions, and middleware can all import it. `src/lib/` stays for framework glue and config (auth, email, clients); real domain logic goes here.