@flaredev/cli 0.12.2 → 0.14.0

package/templates/next/lib/dashboard.ts

@@ -4,6 +4,7 @@ import { allowedActions, can, columnName, ownershipFilter, type Policy, type Pol
 import { createResourceStore, prismaRows, type PrismaDelegate, type ResourceStore } from "@/lib/resource";
 import { prisma } from "@/lib/db";
 import { policies } from "@/policies";
+import { effectivePolicy } from "./permissions";
 import { resourceTables } from "@/resources/server";
 import { currentUser } from "./api";
 import { auth } from "./auth";
@@ -19,6 +20,13 @@ import { cached, resourceTag, revalidateResource, TTL } from "./cache";
 
 export const ADMIN_ROLES = ["admin", "staff"];
 
+/**
+ * The policy in your code, before the dashboard's grants.
+ *
+ * The store takes this one, because the half of a policy the store enforces is `own` —
+ * per-record ownership — which is a code decision and not something the roles screen
+ * can change. Role checks go through {@link effectivePolicy} instead.
+ */
 export function policyFor(resourceName: string): Policy | undefined {
   return (policies as Record<string, Policy | undefined>)[resourceName];
 }
@@ -27,7 +35,9 @@ export async function dashboardSession() {
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) return { session: null, role: null, allowed: false } as const;
   const role = (session.user as { role?: string | null }).role ?? null;
-  const readable = allResources().some((resource) => can(policyFor(resource.name), role, "read"));
+  const readable = (await Promise.all(allResources().map((resource) => effectivePolicy(resource.name)))).some((policy) =>
+    can(policy, role, "read"),
+  );
   return { session, role, allowed: (role !== null && ADMIN_ROLES.includes(role)) || readable } as const;
 }
 
@@ -46,7 +56,7 @@ export async function requireDashboard(returnTo = "/dashboard") {
  */
 export async function requireAccess(resource: Resource, action: PolicyAction) {
   const { session, role } = await requireDashboard(resourcePath(resource));
-  const policy = policyFor(resource.name);
+  const policy = await effectivePolicy(resource.name);
   if (!can(policy, role, action)) {
     redirect(action !== "read" && can(policy, role, "read") ? resourcePath(resource) : "/dashboard?error=forbidden");
   }
@@ -56,7 +66,7 @@ export async function requireAccess(resource: Resource, action: PolicyAction) {
 /** What the current user may do with a resource, for hiding actions they can't use. */
 export async function adminPermissions(resourceName: string) {
   const { role } = await dashboardSession();
-  return allowedActions(policyFor(resourceName), role);
+  return allowedActions(await effectivePolicy(resourceName), role);
 }
 
 /**
@@ -162,7 +172,11 @@ export async function resourceStats(name: string, field?: string, days = 7): Pro
       return stats;
     },
     ["flare", "resource-stats"],
-    { tags: [resourceTag(name)], revalidate: TTL.medium },
+    // TTL.short, by the TTL table's own words: "changes often, cheap to recompute:
+    // counts, dashboards". These are those counts — and `flare seed:resource` writes
+    // from outside the app, where no tag revalidates them, so at medium the overview
+    // said "0 records" for five minutes after seeding a thousand.
+    { tags: [resourceTag(name)], revalidate: TTL.short },
   );
   return read(name, field, days, limit ?? undefined);
 }
@@ -186,7 +200,8 @@ export function allResources(): Resource[] {
 /** Resources the current user may read, for the sidebar and dashboard. */
 export async function visibleResources(): Promise<Resource[]> {
   const { role } = await dashboardSession();
-  return allResources().filter((resource) => can(policyFor(resource.name), role, "read"));
+  const policies = await Promise.all(allResources().map((resource) => effectivePolicy(resource.name)));
+  return allResources().filter((resource, index) => can(policies[index], role, "read"));
 }
 
 export function resourcePath(resource: Resource, ...parts: string[]) {

package/templates/next/lib/mail.ts

@@ -9,7 +9,7 @@ import { createMailer, renderTransactionalEmail, type TransactionalEmail } from
  */
 export const mailer = createMailer({
   apiKey: process.env.RESEND_API_KEY,
-  from: process.env.MAIL_FROM || "__APP_NAME__ <onboarding@resend.dev>",
+  from: process.env.MAIL_FROM || "__APP_TITLE__ <onboarding@resend.dev>",
 });
 
 /**
@@ -30,6 +30,6 @@ export async function sendTransactionalEmail({
   idempotencyKey,
   ...content
 }: Omit<TransactionalEmail, "appName"> & { to: string | string[]; subject: string; idempotencyKey?: string }) {
-  const { html, text } = renderTransactionalEmail({ appName: "__APP_NAME__", ...content });
+  const { html, text } = renderTransactionalEmail({ appName: "__APP_TITLE__", ...content });
   return mailer.send({ to, subject, html, text, idempotencyKey });
 }

package/templates/next/lib/permissions.ts

@@ -0,0 +1,100 @@
+import { revalidateTag } from "next/cache";
+import { withGrants, type PermissionGrant, type Policy, type PolicyAction } from "@flaredev/core";
+import { prisma } from "@/lib/db";
+import { policies } from "@/policies";
+import { cached, TTL } from "./cache";
+
+/**
+ * Permissions managed from the dashboard, on top of the policies in your code.
+ *
+ * `policies/*.policy.ts` is the floor and this only ever widens it — the reasoning is
+ * in `withGrants` (@flaredev/core), and the short version is that a row in a table must
+ * never be able to lock an app out or quietly restrict something the code left open.
+ *
+ * Everything here is cached under one tag and revalidated on every write, so a role
+ * change takes effect on the editor's next request rather than in a minute's time.
+ */
+
+export const GRANTS_TAG = "flare/permissions";
+
+/** The four things a role can be granted. "list" is read, so it is not one of them. */
+export const GRANTABLE: Exclude<PolicyAction, "list">[] = ["read", "create", "update", "delete"];
+
+const readGrants = cached(
+  async (): Promise<PermissionGrant[]> => {
+    const rows = await prisma.rolePermission.findMany({ select: { role: true, resource: true, action: true } });
+    return rows as PermissionGrant[];
+  },
+  ["flare", "permissions"],
+  { tags: [GRANTS_TAG], revalidate: TTL.medium },
+);
+
+/** Every grant in the database. */
+export function allGrants(): Promise<PermissionGrant[]> {
+  return readGrants();
+}
+
+/** The policy in your code, before the dashboard's grants. */
+export function codePolicy(resourceName: string): Policy | undefined {
+  return (policies as Record<string, Policy | undefined>)[resourceName];
+}
+
+/**
+ * The policy actually enforced for a resource: the file, widened by the grants.
+ *
+ * Undefined when there is no policy file, which means the resource is open to every
+ * signed-in user — and grants on it do nothing. The roles screen says so.
+ */
+export async function effectivePolicy(resourceName: string): Promise<Policy | undefined> {
+  return withGrants(codePolicy(resourceName), resourceName, await allGrants());
+}
+
+/** Roles that exist, newest last. Registering one is what makes it offerable in the UI. */
+export async function listRoles(): Promise<{ name: string; label: string }[]> {
+  const rows = await prisma.role.findMany({ orderBy: { createdAt: "asc" }, select: { name: true, label: true } });
+  return rows;
+}
+
+/**
+ * Roles that accounts actually hold, registered or not.
+ *
+ * `flare user:role someone@example.com auditor` is a complete way to create a role —
+ * the string on the account is the role. If this screen only listed the `role` table it
+ * would hide the ones already in use, and you could not grant anything to them. So the
+ * two lists are merged, and holding a role is enough to appear.
+ */
+export async function rolesInUse(): Promise<string[]> {
+  const rows = await prisma.user.findMany({ where: { role: { not: null } }, distinct: ["role"], select: { role: true } });
+  return rows.map((row) => row.role).filter((role): role is string => Boolean(role));
+}
+
+export async function createRole(name: string, label: string): Promise<void> {
+  await prisma.role.upsert({ where: { name }, update: { label }, create: { name, label } });
+  revalidateTag(GRANTS_TAG, { expire: 0 });
+}
+
+/**
+ * Forget a role.
+ *
+ * Its grants go with it — a grant naming a role nobody holds is noise that will outlive
+ * everyone who remembers what it was for. Accounts keep the role string they have;
+ * `can()` simply stops finding grants for it, and the policy file still decides.
+ */
+export async function deleteRole(name: string): Promise<void> {
+  await prisma.$transaction([prisma.rolePermission.deleteMany({ where: { role: name } }), prisma.role.delete({ where: { name } })]);
+  revalidateTag(GRANTS_TAG, { expire: 0 });
+}
+
+/** Tick or untick one cell of the matrix. */
+export async function setGrant(role: string, resource: string, action: string, granted: boolean): Promise<void> {
+  if (granted) {
+    await prisma.rolePermission.upsert({
+      where: { role_resource_action: { role, resource, action } },
+      update: {},
+      create: { role, resource, action },
+    });
+  } else {
+    await prisma.rolePermission.deleteMany({ where: { role, resource, action } });
+  }
+  revalidateTag(GRANTS_TAG, { expire: 0 });
+}

package/templates/next/prisma/schema/base.prisma

@@ -5,11 +5,17 @@
 // regenerated: the generator, the datasource, the tables Better Auth needs and the two
 // Flare's own dashboard uses are all here, and yours to edit.
 
+// Prisma 7's generator, not a leftover from 6: `prisma-client` (the v7 provider; v6's
+// was `prisma-client-js`), and `output` is required — v7 no longer generates into
+// node_modules. The client lands in lib/generated/, git-ignored and rebuilt on every
+// install and `flare migrate`.
 generator client {
   provider = "prisma-client"
   output   = "../../lib/generated/prisma"
 }
 
+// No `url` here — that is also Prisma 7: the connection string lives in
+// prisma.config.ts, which reads DATABASE_URL from .env.
 datasource db {
   provider = "postgresql"
 }
@@ -127,6 +133,37 @@ model TwoFactor {
 }
 
 /// Who changed what, written by the dashboard's actions.
+/// Roles a user can hold (`user.role` from Better Auth's admin plugin). Register them
+/// from the dashboard's Roles screen or with `flare role:add <name>`.
+model Role {
+  name      String   @id
+  label     String
+  createdAt DateTime @default(now()) @map("created_at")
+
+  @@map("role")
+}
+
+/// Permissions granted from the dashboard, on top of the policies in your code.
+///
+/// A row says "this role may do this to this resource". It can only ever *widen* what
+/// `policies/*.policy.ts` already allows — see `withGrants` in @flaredev/core. A
+/// resource with no policy file is open to every signed-in user, and no row here
+/// changes that; the roles screen says so rather than pretending otherwise.
+model RolePermission {
+  id        String   @id @default(uuid())
+  /// The role's name, as in the Role table and user.role.
+  role      String
+  /// The resource's descriptor name, e.g. "Invoice".
+  resource  String
+  /// "read", "create", "update" or "delete".
+  action    String
+  createdAt DateTime @default(now()) @map("created_at")
+
+  /// One row per cell of the matrix: ticking a box twice is the same tick.
+  @@unique([role, resource, action])
+  @@map("role_permission")
+}
+
 model AuditLog {
   id           String   @id @default(uuid())
   action       String

package/templates/next/tsconfig.json

@@ -12,13 +12,13 @@
     "resolveJsonModule": true,
     "isolatedModules": true,
     "incremental": true,
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "types": ["node"],
     "plugins": [{ "name": "next" }],
     "paths": {
       "@/*": ["./*"]
     }
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts", ".next/dev/types/**/*.ts"],
   "exclude": ["node_modules", ".next", "lib/generated"]
 }