@beignet/cli 0.0.23 → 0.0.25

package/src/templates/base.ts

@@ -419,7 +419,7 @@ export function envExample(ctx: TemplateContext): string {
     "# Copy to .env.local and fill in values for your app.",
     "APP_URL=http://localhost:3000",
     "",
-    "# Dev-only default; remove in production.",
+    "# Dev-only default; remove or protect in production.",
     "DEVTOOLS_ENABLED=true",
     "",
     "LOG_LEVEL=info",
@@ -428,7 +428,8 @@ export function envExample(ctx: TemplateContext): string {
     "",
     ...databaseLines,
     "",
-    "BETTER_AUTH_SECRET=local-dev-better-auth-secret-change-me",
+    "# Optional for local development; required in production.",
+    "# BETTER_AUTH_SECRET=replace-with-a-random-32-character-secret",
     "BETTER_AUTH_URL=http://localhost:3000",
     "# BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000",
     "",

package/src/templates/db/mysql.ts

@@ -115,7 +115,7 @@ export const todos = mysqlTable(
 	}),
 );
 `,
-    drizzleTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+    drizzleTodoRepository: `import "@beignet/core/server-only";
 import { offsetPageResult } from "@beignet/core/pagination";
 import type { DrizzleMysqlDatabase } from "@beignet/provider-db-drizzle/mysql";
 import { count, desc, eq } from "drizzle-orm";
@@ -255,7 +255,7 @@ async function prepare(pool: Pool): Promise<void> {
 	await migrate(drizzle(pool), { migrationsFolder: "drizzle" });
 }
 `,
-    dbProvider: `import type { beignetServerOnly } from "@beignet/core/server-only";
+    dbProvider: `import "@beignet/core/server-only";
 import { createProvider } from "@beignet/core/providers";
 import {
 	createDrizzleMysqlIdempotencyPort,

package/src/templates/db/postgres.ts

@@ -105,7 +105,7 @@ export const todos = pgTable(
 	}),
 );
 `,
-    drizzleTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+    drizzleTodoRepository: `import "@beignet/core/server-only";
 import { offsetPageResult } from "@beignet/core/pagination";
 import type { DrizzlePostgresDatabase } from "@beignet/provider-db-drizzle/postgres";
 import { count, desc, eq } from "drizzle-orm";
@@ -243,7 +243,7 @@ async function prepare(pool: Pool): Promise<void> {
 	await migrate(drizzle(pool), { migrationsFolder: "drizzle" });
 }
 `,
-    dbProvider: `import type { beignetServerOnly } from "@beignet/core/server-only";
+    dbProvider: `import "@beignet/core/server-only";
 import { createProvider } from "@beignet/core/providers";
 import {
 	createDrizzlePostgresIdempotencyPort,

package/src/templates/db/sqlite.ts

@@ -101,7 +101,7 @@ export const todos = sqliteTable(
 	}),
 );
 `,
-  drizzleTodoRepository: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  drizzleTodoRepository: `import "@beignet/core/server-only";
 import { offsetPageResult } from "@beignet/core/pagination";
 import type { DrizzleSqliteDatabase } from "@beignet/provider-db-drizzle/sqlite";
 import { count, desc, eq } from "drizzle-orm";
@@ -242,7 +242,7 @@ async function prepare(client: Client): Promise<void> {
 	await migrate(drizzle(client), { migrationsFolder: "drizzle" });
 }
 `,
-  dbProvider: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  dbProvider: `import "@beignet/core/server-only";
 import { createProvider } from "@beignet/core/providers";
 import {
 	createDrizzleSqliteIdempotencyPort,

package/src/templates/index.ts

@@ -132,6 +132,7 @@ export function getTemplateFiles(ctx: TemplateContext): TemplateFile[] {
     { path: "lib/env.ts", content: env(ctx) },
     { path: "lib/auth.ts", content: serverFiles.authHelpers },
     { path: "lib/better-auth.ts", content: betterAuth(ctx) },
+    { path: "lib/tenant.ts", content: serverFiles.tenantHelper },
     { path: "lib/use-case.ts", content: serverFiles.useCaseBuilder },
     { path: "server/index.ts", content: server(ctx) },
     { path: "server/context.ts", content: serverFiles.serverContext },

package/src/templates/server.ts

@@ -8,7 +8,7 @@ import {
 export function serverProviders(ctx: TemplateContext): string {
   const db = databaseDescriptor(ctx);
   const imports = [
-    'import type { beignetServerOnly } from "@beignet/core/server-only";',
+    'import "@beignet/core/server-only";',
     'import { createDevtoolsProvider } from "@beignet/devtools";',
     'import { createAuthBetterAuthProvider } from "@beignet/provider-auth-better-auth";',
     `import { ${db.providerFactory} } from "@beignet/provider-db-drizzle/${db.subpath}";`,
@@ -155,6 +155,19 @@ export function env(ctx: TemplateContext): string {
 import { z } from "zod";
 
 const BooleanEnv = z.enum(["true", "false"]).transform((value) => value === "true");
+const LOCAL_BETTER_AUTH_SECRET = "local-dev-better-auth-secret-change-me";
+const isProductionRuntime =
+	process.env.NODE_ENV === "production" &&
+	process.env.NEXT_PHASE !== "phase-production-build";
+const BetterAuthSecret = z.string().min(32).superRefine((value, ctx) => {
+	if (isProductionRuntime && value === LOCAL_BETTER_AUTH_SECRET) {
+		ctx.addIssue({
+			code: "custom",
+			message:
+				"BETTER_AUTH_SECRET must be unique in production. Generate a strong secret instead of using the local development placeholder.",
+		});
+	}
+});
 
 export const env = createEnv({
 	server: {
@@ -163,10 +176,9 @@ export const env = createEnv({
 			.default("development"),
 		APP_URL: z.string().url().default("http://localhost:3000"),
 		DEVTOOLS_ENABLED: BooleanEnv.optional(),
-		BETTER_AUTH_SECRET: z
-			.string()
-			.min(32)
-			.default("local-dev-better-auth-secret-change-me"),
+		BETTER_AUTH_SECRET: isProductionRuntime
+			? BetterAuthSecret
+			: BetterAuthSecret.default(LOCAL_BETTER_AUTH_SECRET),
 		BETTER_AUTH_URL: z.string().url().default("http://localhost:3000"),
 		BETTER_AUTH_TRUSTED_ORIGINS: z.string().optional(),
 ${databaseEnvLines}
@@ -283,7 +295,7 @@ export function server(ctx: TemplateContext): string {
 \t\t\tDB_URL: env.${db.urlEnvVar},
 \t\t},`;
 
-  return `import type { beignetServerOnly } from "@beignet/core/server-only";
+  return `import "@beignet/core/server-only";
 import { createNextServer } from "@beignet/next";
 import { createErrorReportingHooks, createIdempotencyHooks } from "@beignet/core/server";
 import type { AppContext } from "@/app-context";
@@ -369,7 +381,7 @@ export const errors = defineErrors({
 
 export const appError = createAppError(errors);
 `,
-  useCaseBuilder: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  useCaseBuilder: `import "@beignet/core/server-only";
 import { createUseCase } from "@beignet/core/application";
 import type { AppContext } from "@/app-context";
 
@@ -403,10 +415,14 @@ export type AuthUser = {
 	id: string;
 	email?: string;
 	name?: string;
+	tenantId?: string;
+	organizationId?: string;
 };
 
 export type AuthSessionMetadata = {
 	id?: string;
+	tenantId?: string;
+	organizationId?: string;
 };
 
 export type AuthSession = BeignetAuthSession<
@@ -420,7 +436,7 @@ export type AuthPort = BeignetAuthPort<
 	AuthRequest
 >;
 `,
-  serverRoutes: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  serverRoutes: `import "@beignet/core/server-only";
 import { contractsFromRoutes, defineRoutes } from "@beignet/next";
 import type { AppContext } from "@/app-context";
 import { todoRoutes } from "@/features/todos/routes";
@@ -430,17 +446,17 @@ export const routes = defineRoutes<AppContext>([
 ]);
 export const contracts = contractsFromRoutes(routes);
 `,
-  serverContext: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  serverContext: `import "@beignet/core/server-only";
 import {
 	type ActivityActor,
 	createAnonymousActor,
 	createServiceActor,
-	createTenant,
 	createUserActor,
 } from "@beignet/core/ports";
 import { defineServerContext } from "@beignet/core/server";
 import type { TraceContext } from "@beignet/core/tracing";
 import type { AppContext, AppRuntimePorts } from "@/app-context";
+import { resolveRequestTenant, resolveServiceTenant } from "@/lib/tenant";
 
 export type AppServiceContextInput =
 	| {
@@ -456,7 +472,7 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 	gate: (ports) => ports.gate,
 	request: async ({ req, ports, requestId, trace }) => {
 		const auth = await ports.auth.getSession(req);
-		const tenantId = req.headers.get("x-tenant-id") || undefined;
+		const tenant = resolveRequestTenant({ auth });
 
 		return {
 			requestId,
@@ -466,7 +482,7 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 			auth,
 			...trace,
 			ports,
-			tenant: tenantId ? createTenant(tenantId) : undefined,
+			...(tenant ? { tenant } : {}),
 		};
 	},
 	service: ({
@@ -479,15 +495,67 @@ export const appContext = defineServerContext<AppContext, AppRuntimePorts>()({
 		input: AppServiceContextInput;
 		requestId: string;
 		trace: TraceContext;
-	}) => ({
-		requestId,
-		actor: input?.actor ?? createServiceActor("beignet-service"),
-		auth: null,
-		...trace,
-		ports,
-		tenant: createTenant(input?.tenantId ?? "tenant_default"),
-	}),
+	}) => {
+		const tenant = resolveServiceTenant(input?.tenantId);
+
+		return {
+			requestId,
+			actor: input?.actor ?? createServiceActor("beignet-service"),
+			auth: null,
+			...trace,
+			ports,
+			...(tenant ? { tenant } : {}),
+		};
+	},
 });
+`,
+  tenantHelper: `import { type ActivityTenant, createTenant } from "@beignet/core/ports";
+import type { AuthSession } from "@/ports/auth";
+
+export type TenantResolutionInput = {
+	auth: AuthSession | null;
+};
+
+export function resolveRequestTenant({
+	auth,
+}: TenantResolutionInput): ActivityTenant | undefined {
+	const tenantId = auth ? tenantIdFromAuth(auth) : undefined;
+
+	return tenantId ? createTenant(tenantId) : undefined;
+}
+
+export function resolveServiceTenant(
+	tenantId: string | undefined,
+): ActivityTenant | undefined {
+	const normalizedTenantId = normalizeTenantId(tenantId);
+
+	return normalizedTenantId ? createTenant(normalizedTenantId) : undefined;
+}
+
+function tenantIdFromAuth(auth: AuthSession) {
+	return (
+		stringProperty(auth.session, "tenantId") ??
+		stringProperty(auth.session, "organizationId") ??
+		stringProperty(auth.user, "tenantId") ??
+		stringProperty(auth.user, "organizationId")
+	);
+}
+
+function stringProperty(value: unknown, key: string) {
+	if (!isRecord(value)) return undefined;
+
+	return normalizeTenantId(value[key]);
+}
+
+function normalizeTenantId(value: unknown) {
+	return typeof value === "string" && value.trim().length > 0
+		? value.trim()
+		: undefined;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null;
+}
 `,
   apiCatchAllRoute: `import { server } from "@/server";
 
@@ -553,11 +621,13 @@ export const { GET, POST } = createDevtoolsRoute(server.ports.devtools, {
 });
 `,
   openApiRoute: `import { createOpenAPIHandler } from "@beignet/next";
+import { env } from "@/lib/env";
 import { server } from "@/server";
 
 export const GET = createOpenAPIHandler(server.contracts, {
 	title: "Beignet starter API",
 	version: "0.1.0",
+	servers: [{ url: env.APP_URL }],
 });
 `,
   authRoute: `import { toNextJsHandler } from "better-auth/next-js";

package/src/templates/todos.ts

@@ -174,7 +174,7 @@ export const todoPolicy = definePolicy({
 		authorizeOwner(ctx, todo, "delete"),
 });
 `,
-  routes: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  routes: `import "@beignet/core/server-only";
 import { defineRouteGroup } from "@beignet/next";
 import type { AppContext } from "@/app-context";
 import {
@@ -200,7 +200,7 @@ export const todoRoutes = defineRouteGroup<AppContext>()({
 	],
 });
 `,
-  listTodosUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  listTodosUseCase: `import "@beignet/core/server-only";
 import { normalizeOffsetPage } from "@beignet/core/pagination";
 import { requireUser } from "@/lib/auth";
 import { useCase } from "@/lib/use-case";
@@ -220,7 +220,7 @@ export const listTodosUseCase = useCase
 		return ctx.ports.todos.list(user.id, page);
 	});
 `,
-  createTodoUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  createTodoUseCase: `import "@beignet/core/server-only";
 import { requireUser } from "@/lib/auth";
 import { useCase } from "@/lib/use-case";
 import { CreateTodoInputSchema, TodoSchema } from "../schemas";
@@ -238,7 +238,7 @@ export const createTodoUseCase = useCase
 		);
 	});
 `,
-  updateTodoUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  updateTodoUseCase: `import "@beignet/core/server-only";
 import { appError } from "@/features/shared/errors";
 import { requireUser } from "@/lib/auth";
 import { useCase } from "@/lib/use-case";
@@ -263,7 +263,7 @@ export const updateTodoUseCase = useCase
 		});
 	});
 `,
-  deleteTodoUseCase: `import type { beignetServerOnly } from "@beignet/core/server-only";
+  deleteTodoUseCase: `import "@beignet/core/server-only";
 import { appError } from "@/features/shared/errors";
 import { requireUser } from "@/lib/auth";
 import { useCase } from "@/lib/use-case";