@edgedev/create-edge-app 1.1.29 → 1.2.30

package/agents.md

@@ -7,6 +7,7 @@ This project is Nuxt 3 + Vue 3, SPA mode. Follow these rules so new code matches
 - Components and composables from `edge/composables/**` are auto-imported; avoid manual imports unless needed.
 - Utilities: use `cn` from `@/lib/utils` for class merging, `lucide-vue-next` for icons, Tailwind for layout/styling. Keep comments minimal and useful.
 - Components under `edge/components` are globally registered with the `edge-` prefix (e.g., `edge-dashboard`, `edge-editor`, `edge-shad-button`).
+- Check the project's lint tooling (package.json scripts + config files) before coding and follow its rules; avoid using functions before they are defined.
 
 ## Firebase and data access
 - Never import Firebase SDKs directly. All Auth/Firestore/Functions/Storage access goes through the injected `edgeFirebase` plugin (`plugins/firebase.client.ts` from `@edgedev/firebase`).
@@ -78,3 +79,4 @@ Adjust props (search, filters, pagination, save overrides) using the existing co
 ## Firebase Functions guidance
 - Review `functions/config.js`, `functions/edgeFirebase.js`, and `functions/cms.js` to mirror established patterns, but do not edit those files.
 - When adding new cloud functions, create a new JS file under `functions/` and export handlers using the shared imports from `config.js`. Wire it up by requiring it in `functions/index.js` (same pattern as `stripe.js`), instead of modifying restricted files.
+- For every `onCall` function, always enforce both checks up front: `request.auth?.uid` must exist, and `request.data?.uid` must exactly match `request.auth.uid`. Throw `HttpsError('unauthenticated', ...)` when auth is missing and `HttpsError('permission-denied', ...)` when the uid does not match.

package/bin/cli.js

@@ -63,8 +63,9 @@ const cleanGitignore = (repoName) => {
 
 const repoName = process.argv[2]
 
-const gitCheckoutCommand = `git clone --depth 1 https://github.com/Edge-Marketing-and-Design/edgeApp.git ${repoName}`
-const removeGitDirCommand = `rm -rf ${repoName}/.git`
+const gitCheckoutCommand = `git clone https://github.com/Edge-Marketing-and-Design/edgeApp.git ${repoName}`
+const removeOriginRemoteCommand = `cd ${repoName} && git remote remove origin`
+const addEdgeComponentsRemoteCommand = `cd ${repoName} && git remote add edge-vue-components https://github.com/Edge-Marketing-and-Design/edge-vue-components.git`
 const installDependenciesCommand = `cd ${repoName} && pnpm store prune && pnpm install --force --ignore-scripts=false`
 const installFunctionDependenciesCommand = `cd ${repoName}/functions && npm install`
 // const cloneFirebaseFrameworkCommand = `cd ${repoName} && git clone https://github.com/Edge-Marketing-and-Design/edge-vue-components.git edge`
@@ -75,9 +76,15 @@ if (!checkedOut) {
   process.exit(1)
 }
 
-console.log(`Removing .git directory from ${repoName}...`)
-const removedGitDir = runCommand(removeGitDirCommand)
-if (!removedGitDir) {
+console.log(`Detaching template origin remote from ${repoName}...`)
+const removedOriginRemote = runCommand(removeOriginRemoteCommand)
+if (!removedOriginRemote) {
+  process.exit(1)
+}
+
+console.log(`Adding edge-vue-components remote to ${repoName}...`)
+const addedEdgeComponentsRemote = runCommand(addEdgeComponentsRemoteCommand)
+if (!addedEdgeComponentsRemote) {
   process.exit(1)
 }
 
@@ -112,4 +119,5 @@ if (!installedFunctionDeps) {
 // }
 
 console.log(`Successfully created ${repoName}!`)
+console.log(`Add your own git origin with: cd ${repoName} && git remote add origin <your-repo-url>`)
 console.log(`cd into ${repoName} and run 'sh firebase_init.sh' to initialize your firebase project.`)

package/deploy-services.sh

@@ -0,0 +1,237 @@
+#!/usr/bin/env sh
+set -eu
+
+ROOT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+SERVICES_DIR="$ROOT_DIR/services"
+ROOT_ENV_FILE="$ROOT_DIR/.env"
+SHARED_DEPLOY_ENV_FILE="$SERVICES_DIR/.deploy.shared.env"
+FIREBASERC_FILE="$ROOT_DIR/.firebaserc"
+FUNCTIONS_PROD_ENV_FILE="$ROOT_DIR/functions/.env.prod"
+
+trim() {
+  printf '%s' "$1" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//'
+}
+
+load_env_file() {
+  file="$1"
+  if [ ! -f "$file" ]; then
+    return 0
+  fi
+  set -a
+  # shellcheck disable=SC1090
+  . "$file"
+  set +a
+}
+
+extract_default_project_id() {
+  if [ ! -f "$FIREBASERC_FILE" ]; then
+    printf ''
+    return 0
+  fi
+  node -e "const fs=require('fs');const p=process.argv[1];const data=JSON.parse(fs.readFileSync(p,'utf8'));process.stdout.write((data.projects&&data.projects.default)||'')" "$FIREBASERC_FILE"
+}
+
+service_name_to_env_key() {
+  service_name="$1"
+  normalized=''
+  normalized="$(printf '%s' "$service_name" \
+    | tr '[:lower:]' '[:upper:]' \
+    | sed -E 's/[^A-Z0-9]+/_/g; s/^_+//; s/_+$//')"
+  printf '%s_SERVICE' "$normalized"
+}
+
+upsert_env_key_value() {
+  file="$1"
+  key="$2"
+  value="$3"
+  tmp=''
+
+  mkdir -p "$(dirname "$file")"
+  if [ ! -f "$file" ]; then
+    printf '%s=%s\n' "$key" "$value" > "$file"
+    return 0
+  fi
+
+  tmp="$(mktemp)"
+  awk -v key="$key" -v value="$value" '
+    BEGIN { updated = 0 }
+    $0 ~ ("^" key "=") {
+      if (!updated) {
+        print key "=" value
+        updated = 1
+      }
+      next
+    }
+    { print }
+    END {
+      if (!updated) {
+        print key "=" value
+      }
+    }
+  ' "$file" > "$tmp"
+  mv "$tmp" "$file"
+}
+
+build_update_env_vars_arg() {
+  env_file="$1"
+  joined=''
+  keys="$(grep -E '^[A-Za-z_][A-Za-z0-9_]*=' "$env_file" | cut -d= -f1 || true)"
+
+  for key in $keys; do
+    case "$key" in
+      SERVICE_NAME|SOURCE_DIR|PROJECT_ID|REGION|ALLOW_UNAUTHENTICATED|INVOKER_MEMBERS)
+        continue
+        ;;
+    esac
+    value="$(eval "printf '%s' \"\${$key-}\"")"
+    if [ -n "$joined" ]; then
+      joined="${joined},${key}=${value}"
+    else
+      joined="${key}=${value}"
+    fi
+  done
+
+  printf '%s' "$joined"
+}
+
+if ! command -v gcloud >/dev/null 2>&1; then
+  echo "Deploy aborted: gcloud CLI not found." >&2
+  exit 1
+fi
+
+DEFAULT_PROJECT_ID="$(extract_default_project_id)"
+if [ -z "${PROJECT_ID:-}" ] && [ -z "$DEFAULT_PROJECT_ID" ]; then
+  echo "Deploy aborted: PROJECT_ID is not set and .firebaserc has no default project." >&2
+  exit 1
+fi
+
+deployed_count=0
+
+for service_env_file in "$SERVICES_DIR"/*/.deploy.env; do
+  if [ ! -f "$service_env_file" ]; then
+    continue
+  fi
+
+  service_dir="$(cd "$(dirname "$service_env_file")" && pwd)"
+
+  (
+    load_env_file "$ROOT_ENV_FILE"
+    load_env_file "$SHARED_DEPLOY_ENV_FILE"
+    load_env_file "$service_env_file"
+
+    service_name="${SERVICE_NAME:-$(basename "$service_dir")}"
+    project_id="${PROJECT_ID:-$DEFAULT_PROJECT_ID}"
+    region="${REGION:-${VITE_FIREBASE_FUNCTIONS_REGION:-us-central1}}"
+    source_dir="${SOURCE_DIR:-$service_dir}"
+    allow_unauthenticated="$(printf '%s' "${ALLOW_UNAUTHENTICATED:-false}" | tr '[:upper:]' '[:lower:]')"
+    invoker_members_raw="${INVOKER_MEMBERS:-}"
+
+    if [ -z "$service_name" ]; then
+      echo "Skipping '$service_dir': SERVICE_NAME is empty." >&2
+      exit 0
+    fi
+    if [ -z "$project_id" ]; then
+      echo "Skipping '$service_dir': PROJECT_ID resolved empty." >&2
+      exit 0
+    fi
+    if [ -z "$region" ]; then
+      echo "Skipping '$service_dir': REGION resolved empty." >&2
+      exit 0
+    fi
+
+    case "$source_dir" in
+      /*) ;;
+      *) source_dir="$ROOT_DIR/$source_dir" ;;
+    esac
+    if [ ! -d "$source_dir" ]; then
+      echo "Skipping '$service_dir': SOURCE_DIR '$source_dir' not found." >&2
+      exit 0
+    fi
+
+    update_env_vars_arg="$(build_update_env_vars_arg "$service_env_file")"
+
+    echo "Deploying service '$service_name' from '$source_dir' (project=$project_id, region=$region)..."
+    if [ -n "$update_env_vars_arg" ]; then
+      if [ "$allow_unauthenticated" = 'true' ]; then
+        gcloud run deploy "$service_name" \
+          --project "$project_id" \
+          --region "$region" \
+          --source "$source_dir" \
+          --allow-unauthenticated \
+          --update-env-vars "$update_env_vars_arg"
+      else
+        gcloud run deploy "$service_name" \
+          --project "$project_id" \
+          --region "$region" \
+          --source "$source_dir" \
+          --no-allow-unauthenticated \
+          --update-env-vars "$update_env_vars_arg"
+      fi
+    else
+      if [ "$allow_unauthenticated" = 'true' ]; then
+        gcloud run deploy "$service_name" \
+          --project "$project_id" \
+          --region "$region" \
+          --source "$source_dir" \
+          --allow-unauthenticated
+      else
+        gcloud run deploy "$service_name" \
+          --project "$project_id" \
+          --region "$region" \
+          --source "$source_dir" \
+          --no-allow-unauthenticated
+      fi
+    fi
+
+    service_url="$(gcloud run services describe "$service_name" \
+      --project "$project_id" \
+      --region "$region" \
+      --format='value(status.url)')"
+    if [ -n "$service_url" ]; then
+      service_env_key="$(service_name_to_env_key "$service_name")"
+      upsert_env_key_value "$FUNCTIONS_PROD_ENV_FILE" "$service_env_key" "$service_url"
+      echo "Updated $FUNCTIONS_PROD_ENV_FILE with ${service_env_key}."
+    else
+      echo "Warning: could not resolve URL for '$service_name'; skipped functions/.env.prod update." >&2
+    fi
+
+    if [ "$allow_unauthenticated" != 'true' ]; then
+      gcloud run services remove-iam-policy-binding "$service_name" \
+        --project "$project_id" \
+        --region "$region" \
+        --member="allUsers" \
+        --role="roles/run.invoker" \
+        --quiet >/dev/null 2>&1 || true
+
+      if [ -n "$invoker_members_raw" ]; then
+        printf '%s\n' "$invoker_members_raw" | tr ',' '\n' | while IFS= read -r member; do
+          clean_member="$(trim "$member")"
+          if [ -z "$clean_member" ]; then
+            continue
+          fi
+          case "$clean_member" in
+            *:*) ;;
+            *) clean_member="serviceAccount:${clean_member}" ;;
+          esac
+          gcloud run services add-iam-policy-binding "$service_name" \
+            --project "$project_id" \
+            --region "$region" \
+            --member="$clean_member" \
+            --role="roles/run.invoker" \
+            --quiet >/dev/null
+        done
+      else
+        echo "Info: '$service_name' is private and INVOKER_MEMBERS is empty. Using existing Cloud Run invokers (for example, the default compute service account if already granted)." >&2
+      fi
+    fi
+  )
+
+  deployed_count=$((deployed_count + 1))
+done
+
+if [ "$deployed_count" -eq 0 ]; then
+  echo "No services deployed. Add a .deploy.env file under services/<service>/ to opt in."
+  exit 0
+fi
+
+echo "Services deploy complete. Deployed $deployed_count service(s)."

package/deploy.sh

@@ -1,5 +1,92 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+check_repo() {
+  local repo_path="$1"
+  local label="$2"
+
+  if ! git -C "$repo_path" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    echo "Deploy aborted: ${label} repo not found at '$repo_path'." >&2
+    exit 1
+  fi
+
+  local current_branch
+  current_branch="$(git -C "$repo_path" rev-parse --abbrev-ref HEAD)"
+  if [ "$current_branch" != "main" ]; then
+    echo "Deploy aborted: ${label} branch is '$current_branch'. Switch to 'main' before deploying." >&2
+    exit 1
+  fi
+
+  if ! git -C "$repo_path" diff --quiet || ! git -C "$repo_path" diff --cached --quiet; then
+    echo "Deploy aborted: ${label} has uncommitted changes. Commit or stash before deploying." >&2
+    exit 1
+  fi
+
+  if ! git -C "$repo_path" rev-parse --abbrev-ref --symbolic-full-name @{upstream} >/dev/null 2>&1; then
+    echo "Deploy aborted: ${label} has no upstream set for 'main'. Set upstream before deploying." >&2
+    exit 1
+  fi
+
+  git -C "$repo_path" fetch --quiet
+
+  local counts behind ahead
+  counts="$(git -C "$repo_path" rev-list --left-right --count @{upstream}...HEAD)"
+  set -- $counts
+  behind="${1:-0}"
+  ahead="${2:-0}"
+  if [ "$behind" -ne 0 ] && [ "$ahead" -ne 0 ]; then
+    echo "Deploy aborted: ${label} branch has diverged (ahead $ahead, behind $behind). Pull/rebase and push." >&2
+    exit 1
+  fi
+  if [ "$behind" -ne 0 ]; then
+    echo "Deploy aborted: ${label} main is behind upstream by $behind commits. Pull before deploying." >&2
+    exit 1
+  fi
+  if [ "$ahead" -ne 0 ]; then
+    echo "Deploy aborted: ${label} main is ahead of upstream by $ahead commits. Push before deploying." >&2
+    exit 1
+  fi
+}
+
+warn_edge_subtree_sync() {
+  if ! git rev-parse --verify HEAD:edge >/dev/null 2>&1; then
+    echo "Deploy aborted: edge subtree path ('edge') is missing from HEAD." >&2
+    exit 1
+  fi
+
+  if ! git remote get-url edge-vue-components >/dev/null 2>&1; then
+    echo "Deploy aborted: remote 'edge-vue-components' is not configured." >&2
+    exit 1
+  fi
+
+  if ! git fetch --quiet edge-vue-components; then
+    echo "Deploy aborted: failed to fetch 'edge-vue-components'." >&2
+    exit 1
+  fi
+
+  local up_tree local_tree
+  if ! up_tree="$(git rev-parse edge-vue-components/main^{tree} 2>/dev/null)"; then
+    echo "Deploy aborted: could not resolve edge-vue-components/main." >&2
+    exit 1
+  fi
+  if ! local_tree="$(git rev-parse HEAD:edge 2>/dev/null)"; then
+    echo "Deploy aborted: could not resolve HEAD:edge." >&2
+    exit 1
+  fi
+
+  if [ "$up_tree" = "$local_tree" ]; then
+    echo "edge subtree is in sync with edge-vue-components/main"
+  else
+    echo "Warning: edge subtree differs from edge-vue-components/main. Continuing deploy." >&2
+  fi
+}
+
+check_repo "." "root"
+warn_edge_subtree_sync
+
 pnpm run generate
 export NODE_ENV=production
 firebase deploy --only functions
 firebase deploy --only hosting
-firebase deploy --only firestore
+firebase deploy --only firestore
+firebase deploy --only storage