@flaredev/cli 0.11.0 → 0.12.1

package/templates/app/lib/storage.ts

@@ -1,12 +1,35 @@
 import { env } from "cloudflare:workers";
-import { createObjectKey, createStorage } from "@flaredev/core";
+import { createObjectKey, createStorage, type StorageBucket } from "@flaredev/core";
+import { cloudinaryBucket } from "./storage/cloudinary";
+import { uploadThingBucket } from "./storage/uploadthing";
 
 /**
- * File storage on the `STORAGE` R2 bucket.
+ * Where uploaded files go.
  *
- * `createUploadUrl` / `createReadUrl` return short-lived signed URLs redeemed by
- * `app/api/storage/route.ts`. A URL grants access to whoever holds it, so check
- * that the current user may upload or view the object before issuing one.
+ * The default is the `STORAGE` R2 bucket this app is already bound to: no account to
+ * create, no keys to copy, and Wrangler simulates it locally as a directory. Set
+ * `STORAGE_DRIVER` to send files to a content delivery network instead.
+ *
+ *   r2           The bound bucket. The default, and nothing to configure.
+ *   cloudinary   A CDN with an image pipeline. Serves from res.cloudinary.com.
+ *   uploadthing  A CDN with an uploader. Serves from <app>.ufs.sh.
+ *
+ * The drivers are in `lib/storage/`, in your repository, and are ordinary files you can
+ * read and change. Adding one means writing `get`, `put` and `delete`.
+ *
+ * `disk` exists on the Next.js stack and not here: a Worker has no filesystem to write
+ * to, and the bound bucket already covers what it is for.
+ *
+ * ## Private by default, and what breaks that
+ *
+ * With `r2`, a read URL is a short-lived signed token redeemed by
+ * `app/api/storage/route.ts`, so whoever issued it decided the viewer was allowed it.
+ *
+ * `cloudinary` and `uploadthing` are content delivery networks, and serving through
+ * this Worker would throw away the thing you are paying them for. So they hand back
+ * their own URL, which **anyone with the link can read, forever**. That is the normal
+ * way to use them and the wrong way to store a medical record. Set
+ * `STORAGE_PUBLIC=false` to keep every read signed and proxied.
  *
  *   const { url } = await storage.createUploadUrl({
  *     key: createObjectKey(file.name, `users/${user.id}`),
@@ -17,8 +40,51 @@ import { createObjectKey, createStorage } from "@flaredev/core";
  *
  *   const src = await storage.createReadUrl({ key });
  */
+
+type StorageDriver = "r2" | "cloudinary" | "uploadthing";
+
+const DRIVERS: StorageDriver[] = ["r2", "cloudinary", "uploadthing"];
+
+const vars = env as unknown as Record<string, string | undefined>;
+
+const configured = (vars.STORAGE_DRIVER ?? "r2").trim().toLowerCase();
+if (!DRIVERS.includes(configured as StorageDriver)) {
+  throw new Error(`Unknown STORAGE_DRIVER "${configured}". One of: ${DRIVERS.join(", ")}.`);
+}
+const driver = configured as StorageDriver;
+
+/** Required configuration, named in the error rather than left as `undefined`. */
+function required(name: string): string {
+  const value = vars[name];
+  if (!value) throw new Error(`STORAGE_DRIVER is "${driver}" and needs ${name}, which is not set. Add it with: wrangler secret put ${name}`);
+  return value;
+}
+
+/** Public delivery is the point of a CDN, so it is on unless it is turned off. */
+const publicDelivery = vars.STORAGE_PUBLIC !== "false";
+
+function selectBucket(): StorageBucket {
+  switch (driver) {
+    case "cloudinary":
+      return cloudinaryBucket({
+        cloudName: required("CLOUDINARY_CLOUD_NAME"),
+        apiKey: required("CLOUDINARY_API_KEY"),
+        apiSecret: required("CLOUDINARY_API_SECRET"),
+        publicDelivery,
+      });
+    case "uploadthing":
+      return uploadThingBucket({
+        // The app id lives inside the token; the driver reads it from there.
+        token: required("UPLOADTHING_TOKEN"),
+        publicDelivery,
+      });
+    case "r2":
+      return env.STORAGE;
+  }
+}
+
 export const storage = createStorage({
-  bucket: env.STORAGE,
+  bucket: selectBucket(),
   // Signing keys are derived from the auth secret with a storage-specific label.
   secret: env.BETTER_AUTH_SECRET,
 });

package/templates/app/lib/user-titles.ts

@@ -0,0 +1,52 @@
+// This file is yours.
+//
+// Flare copies the code that turns a resource descriptor into a working endpoint into
+// your app rather than hiding it in node_modules, for the same reason shadcn/ui copies
+// a component: you cannot fix, read or reason about what you cannot see.
+//
+// `flare diff` shows how your copy differs from the version Flare ships, and
+// `flare update` applies the parts you choose. Neither runs unless you ask.
+
+/**
+ * Names for the accounts a `belongsTo("User")` field points at.
+ *
+ * Better Auth owns the account table, so it is not a Flare resource and has no store to
+ * ask — but the admin still has to show "Ada Lovelace" where the column holds a uuid.
+ * This is the one place that reads it, and it reads two columns and no more.
+ *
+ * An account may have no name (a passkey-only sign-up, say), so the email stands in. It
+ * is the same fallback `/api/users` uses, so a record reads the same in the table, on
+ * the detail page and in the picker.
+ */
+import { inArray } from "drizzle-orm";
+import { getDb } from "@/db";
+import { user } from "@/db/auth-schema";
+
+/** What the admin needs to treat Better Auth's account table as a relation target. */
+export const AUTH_USER_RELATION = {
+  name: "User",
+  label: "User",
+  pluralLabel: "Users",
+  slug: "users",
+  titleField: "name",
+} as const;
+
+/** id → display name, for the ids that exist. Unknown ids are simply absent. */
+export async function userTitles(ids: string[]): Promise<Record<string, string>> {
+  const wanted = [...new Set(ids.filter(Boolean))];
+  if (wanted.length === 0) return {};
+  const rows = await getDb().select({ id: user.id, name: user.name, email: user.email }).from(user).where(inArray(user.id, wanted));
+  return Object.fromEntries(rows.map((row) => [row.id, row.name?.trim() || row.email]));
+}
+
+/**
+ * Whether anybody has an account yet.
+ *
+ * Asked by the sign-up page: the gate in lib/auth.ts always lets the *first* account
+ * through, whatever `authConfig.signup` says, because an app nobody can sign into cannot
+ * be set up. So "sign-up is closed" is only true once somebody exists.
+ */
+export async function anyAccountExists(): Promise<boolean> {
+  const [first] = await getDb().select({ id: user.id }).from(user).limit(1);
+  return first !== undefined;
+}

package/templates/app/worker/index.ts

@@ -1,4 +1,5 @@
 import app from "vinext/server/app-router-entry";
+import { RateLimitCounter } from "@flaredev/core/rate-limit/server";
 import { RealtimeChannel, handleRealtimeUpgrade } from "@flaredev/core/realtime/server";
 import { SecurityMonitor } from "@flaredev/core/security/server";
 import { authorizeRealtime } from "../lib/realtime";
@@ -9,12 +10,14 @@ import { protect } from "../lib/security";
 // the `cloudflare:workers` module.
 
 // Durable Object classes must be exported from the Worker's main module.
-export { RealtimeChannel, SecurityMonitor };
+export { RateLimitCounter, RealtimeChannel, SecurityMonitor };
 
 export interface AppEnv {
   ASSETS: Fetcher;
   DB: D1Database;
   FLARE_REALTIME: DurableObjectNamespace<RealtimeChannel>;
+  /** Counters for the rate limits a descriptor declares (see lib/rate-limit.ts). */
+  FLARE_RATE_LIMIT: DurableObjectNamespace<RateLimitCounter>;
 }
 
 export interface AppContext {

package/templates/app/wrangler.jsonc

@@ -16,6 +16,13 @@
         // Object instance created on demand; wrangler provisions nothing upfront.
         "name": "FLARE_REALTIME",
         "class_name": "RealtimeChannel"
+      },
+      {
+        // Rate limit counters (see lib/rate-limit.ts). One instance per resource and
+        // action, holding a count per caller — so a limited endpoint costs one object
+        // request, not one per person calling it.
+        "name": "FLARE_RATE_LIMIT",
+        "class_name": "RateLimitCounter"
       }
     ]
   },
@@ -23,6 +30,10 @@
     {
       "tag": "v1",
       "new_sqlite_classes": ["RealtimeChannel"]
+    },
+    {
+      "tag": "v2",
+      "new_sqlite_classes": ["RateLimitCounter"]
     }
   ],
   "d1_databases": [