@flaredev/cli 0.2.0 → 0.4.0

package/templates/app/app/admin/actions.ts

@@ -1,113 +0,0 @@
-"use server";
-
-import { revalidatePath } from "next/cache";
-import { createObjectKey, fileKeyPrefix, fileMaxBytes, matchesContentType, mimeTypesFor, type FileField } from "@flaredev/core";
-import type { FieldIssue } from "@flaredev/core/server";
-import { storage } from "@/lib/storage";
-import { can, type PolicyAction } from "@flaredev/core";
-import { adminPath, adminSession, adminStore, policyFor } from "@/lib/admin";
-
-export type ActionResult<T = unknown> =
-  | { ok: true; data: T }
-  | { ok: false; status: number; error: string; issues?: FieldIssue[]; field?: string };
-
-const forbidden = (message = "You don't have access to the admin."): ActionResult<never> => ({ ok: false, status: 403, error: message });
-
-/** Session + policy check for one action on one resource. */
-async function allowed(resourceName: string, action: PolicyAction): Promise<ActionResult<never> | undefined> {
-  const { allowed: inAdmin, role } = await adminSession();
-  if (!inAdmin) return forbidden();
-  if (!can(policyFor(resourceName), role, action)) return forbidden(`Your role can't ${action} this record.`);
-}
-
-export async function deleteRecordAction(resourceName: string, id: string): Promise<ActionResult<{ id: string }>> {
-  const denied = await allowed(resourceName, "delete");
-  if (denied) return denied;
-
-  const store = adminStore(resourceName);
-  const result = await store.delete(id);
-  if (result.ok) revalidatePath(adminPath(store.resource));
-  return result;
-}
-
-export async function createRecordAction(resourceName: string, input: unknown): Promise<ActionResult<Record<string, unknown>>> {
-  const denied = await allowed(resourceName, "create");
-  if (denied) return denied;
-
-  const store = adminStore(resourceName);
-  const result = await store.create(input);
-  if (result.ok) revalidatePath(adminPath(store.resource));
-  return result;
-}
-
-export async function updateRecordAction(resourceName: string, id: string, input: unknown): Promise<ActionResult<Record<string, unknown>>> {
-  const denied = await allowed(resourceName, "update");
-  if (denied) return denied;
-
-  const store = adminStore(resourceName);
-  const result = await store.update(id, input);
-  if (result.ok) revalidatePath(adminPath(store.resource));
-  return result;
-}
-
-/** The file field `fieldKey` of a resource, or a failure when it doesn't exist. */
-function fileField(
-  resourceName: string,
-  fieldKey: string,
-): { failure: ActionResult<never> } | { field: FileField & { label: string }; prefix: string } {
-  const { resource } = adminStore(resourceName);
-  const field = resource.fields[fieldKey];
-  if (!field || field.kind !== "file") {
-    return { failure: { ok: false, status: 400, error: `${resourceName} has no file field "${fieldKey}".` } };
-  }
-  return { field, prefix: fileKeyPrefix(resource, fieldKey) };
-}
-
-/**
- * A short-lived signed URL for uploading to a `file:[…]` field. The declared type and
- * size are checked against the descriptor before signing, so a browser can't widen
- * what the field accepts; the storage route then checks the bytes really are that type.
- */
-export async function createUploadUrlAction(
-  resourceName: string,
-  fieldKey: string,
-  file: { name: string; type: string; size: number },
-): Promise<ActionResult<{ url: string; key: string }>> {
-  // Uploading is part of creating or editing a record, so either permission is enough.
-  const deniedCreate = await allowed(resourceName, "create");
-  const deniedUpdate = await allowed(resourceName, "update");
-  if (deniedCreate && deniedUpdate) return deniedUpdate;
-
-  const target = fileField(resourceName, fieldKey);
-  if ("failure" in target) return target.failure;
-  const { field, prefix } = target;
-
-  const contentTypes = mimeTypesFor(field.accept);
-  if (!matchesContentType(file.type || "application/octet-stream", contentTypes)) {
-    return { ok: false, status: 415, error: `${field.label} accepts ${field.accept.join(", ")} files.`, field: fieldKey };
-  }
-  const maxBytes = fileMaxBytes(field);
-  if (file.size > maxBytes) {
-    return { ok: false, status: 413, error: `${field.label} must be ${Math.round(maxBytes / 1024 / 1024)} MB or smaller.`, field: fieldKey };
-  }
-
-  const upload = await storage.createUploadUrl({ key: createObjectKey(file.name, prefix), contentTypes, maxBytes });
-  return { ok: true, data: { url: upload.url, key: upload.key } };
-}
-
-/**
- * A short-lived URL for viewing a file stored in a `file:[…]` field. Only keys under that
- * field's prefix are signed, and only for roles that can work with the resource, so a
- * guessed or borrowed key can't be read through a resource the role can't see.
- */
-export async function createReadUrlAction(resourceName: string, fieldKey: string, key: string): Promise<ActionResult<{ url: string }>> {
-  const denied = await allowed(resourceName, "read");
-  // Someone creating or editing a record can view what they just uploaded.
-  if (denied && (await allowed(resourceName, "create")) && (await allowed(resourceName, "update"))) return denied;
-
-  const target = fileField(resourceName, fieldKey);
-  if ("failure" in target) return target.failure;
-  if (!key.startsWith(target.prefix)) return { ok: false, status: 403, error: "That file doesn't belong to this field.", field: fieldKey };
-
-  return { ok: true, data: { url: await storage.createReadUrl({ key }) } };
-}

package/templates/app/app/admin/layout.tsx

@@ -1,32 +0,0 @@
-import { cookies } from "next/headers";
-import { SidebarInset, SidebarProvider } from "@/components/ui/sidebar";
-import { Toaster } from "@/components/ui/sonner";
-import { AdminHeader, type Theme } from "@/components/admin/admin-header";
-import { ResourceNav } from "@/components/admin/resource-nav";
-import { adminLinks } from "@/lib/admin-nav";
-import { requireAdmin, visibleResources } from "@/lib/admin";
-
-export default async function AdminLayout({ children }: { children: React.ReactNode }) {
-  const { session } = await requireAdmin();
-  const jar = await cookies();
-  const theme = (jar.get("flare-theme")?.value ?? "system") as Theme;
-  const collapsed = jar.get("sidebar_state")?.value === "false";
-
-  const resources = (await visibleResources()).map((resource) => ({
-    name: resource.name,
-    pluralLabel: resource.pluralLabel,
-    slug: resource.slug,
-    icon: resource.icon,
-  }));
-
-  return (
-    <SidebarProvider defaultOpen={!collapsed}>
-      <ResourceNav appName="__APP_NAME__" resources={resources} links={adminLinks} />
-      <SidebarInset>
-        <AdminHeader user={{ name: session.user.name, email: session.user.email }} initialTheme={theme} />
-        <main className="flex-1 p-6 md:p-8">{children}</main>
-      </SidebarInset>
-      <Toaster theme={theme} />
-    </SidebarProvider>
-  );
-}

package/templates/app/components/admin/admin-header.tsx

@@ -1,78 +0,0 @@
-"use client";
-
-import { useState } from "react";
-import { LogOutIcon, MoonIcon, SunIcon } from "lucide-react";
-import { authClient } from "@/lib/auth-client";
-import { Button } from "@/components/ui/button";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuGroup,
-  DropdownMenuItem,
-  DropdownMenuLabel,
-  DropdownMenuSeparator,
-  DropdownMenuTrigger,
-} from "@/components/ui/dropdown-menu";
-import { Separator } from "@/components/ui/separator";
-import { SidebarTrigger } from "@/components/ui/sidebar";
-
-export type Theme = "light" | "dark" | "system";
-
-/** Persist the choice for SSR (so the first paint matches) and apply it now. */
-function applyTheme(theme: Theme) {
-  document.cookie = `flare-theme=${theme}; path=/; max-age=31536000; samesite=lax`;
-  const root = document.documentElement;
-  root.classList.remove("light", "dark");
-  if (theme !== "system") root.classList.add(theme);
-}
-
-export function AdminHeader({ user, initialTheme }: { user: { name?: string | null; email: string }; initialTheme: Theme }) {
-  const [theme, setTheme] = useState<Theme>(initialTheme);
-  const dark = theme === "dark" || (theme === "system" && typeof window !== "undefined" && window.matchMedia("(prefers-color-scheme: dark)").matches);
-
-  return (
-    <header className="sticky top-0 z-10 flex h-14 shrink-0 items-center gap-2 border-b bg-background px-4">
-      <SidebarTrigger />
-      <Separator orientation="vertical" className="mr-1 h-4" />
-      <div className="ml-auto flex items-center gap-1">
-        <Button
-          variant="ghost"
-          size="icon"
-          aria-label={dark ? "Switch to light theme" : "Switch to dark theme"}
-          onClick={() => {
-            const next: Theme = dark ? "light" : "dark";
-            setTheme(next);
-            applyTheme(next);
-          }}
-        >
-          {dark ? <SunIcon /> : <MoonIcon />}
-        </Button>
-        <DropdownMenu>
-          <DropdownMenuTrigger asChild>
-            <Button variant="ghost" size="sm" className="gap-2">
-              <span className="max-w-40 truncate">{user.name || user.email}</span>
-            </Button>
-          </DropdownMenuTrigger>
-          <DropdownMenuContent align="end" className="w-56">
-            <DropdownMenuLabel className="font-normal">
-              <span className="block truncate text-sm font-medium">{user.name || "Signed in"}</span>
-              <span className="block truncate text-xs text-muted-foreground">{user.email}</span>
-            </DropdownMenuLabel>
-            <DropdownMenuSeparator />
-            <DropdownMenuGroup>
-              <DropdownMenuItem
-                onSelect={async () => {
-                  await authClient.signOut();
-                  window.location.assign("/sign-in");
-                }}
-              >
-                <LogOutIcon />
-                Sign out
-              </DropdownMenuItem>
-            </DropdownMenuGroup>
-          </DropdownMenuContent>
-        </DropdownMenu>
-      </div>
-    </header>
-  );
-}

package/templates/app/components/admin/resource-nav.tsx

@@ -1,120 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { usePathname } from "next/navigation";
-import { LayoutDashboardIcon } from "lucide-react";
-import {
-  Sidebar,
-  SidebarContent,
-  SidebarGroup,
-  SidebarGroupContent,
-  SidebarGroupLabel,
-  SidebarHeader,
-  SidebarMenu,
-  SidebarMenuButton,
-  SidebarMenuItem,
-} from "@/components/ui/sidebar";
-import { resourceIcon } from "./resource-icon";
-
-export interface NavResource {
-  name: string;
-  pluralLabel: string;
-  slug: string;
-  icon?: string;
-  /** Optional count badge (off by default). */
-  badge?: number;
-}
-
-/**
- * Sidebar navigation, one item per registered resource. The icon comes from the
- * descriptor's `icon`, the label from its plural label, and the active item from the
- * current path.
- */
-export function ResourceNav({
-  appName,
-  resources,
-  links = [],
-}: {
-  appName: string;
-  resources: NavResource[];
-  /** Extra pages (see lib/admin-nav.ts), shown under "Platform". */
-  links?: Array<{ label: string; href: string; icon: string }>;
-}) {
-  const pathname = usePathname();
-
-  return (
-    <Sidebar collapsible="icon">
-      <SidebarHeader>
-        <SidebarMenu>
-          <SidebarMenuItem>
-            <SidebarMenuButton asChild size="lg" tooltip={appName}>
-              <Link href="/admin">
-                <div className="flex aspect-square size-8 items-center justify-center rounded-md bg-primary text-primary-foreground">
-                  <LayoutDashboardIcon className="size-4" />
-                </div>
-                <span className="truncate font-semibold">{appName}</span>
-              </Link>
-            </SidebarMenuButton>
-          </SidebarMenuItem>
-        </SidebarMenu>
-      </SidebarHeader>
-
-      <SidebarContent>
-        <SidebarGroup>
-          <SidebarGroupLabel>Resources</SidebarGroupLabel>
-          <SidebarGroupContent>
-            <SidebarMenu>
-              {resources.map((resource) => {
-                const href = `/admin/${resource.slug}`;
-                const Icon = resourceIcon(resource.icon);
-                return (
-                  <SidebarMenuItem key={resource.name}>
-                    <SidebarMenuButton asChild isActive={pathname === href || pathname.startsWith(`${href}/`)} tooltip={resource.pluralLabel}>
-                      <Link href={href}>
-                        <Icon />
-                        <span>{resource.pluralLabel}</span>
-                      </Link>
-                    </SidebarMenuButton>
-                  </SidebarMenuItem>
-                );
-              })}
-            </SidebarMenu>
-          </SidebarGroupContent>
-        </SidebarGroup>
-        {links.length > 0 && (
-          <SidebarGroup>
-            <SidebarGroupLabel>Platform</SidebarGroupLabel>
-            <SidebarGroupContent>
-              <SidebarMenu>
-                {links.map((link) => {
-                  const Icon = resourceIcon(link.icon);
-                  // Route handlers (/api/...) and other sites are whole pages: open them in a new tab.
-                  const external = link.href.startsWith("/api/") || /^https?:\/\//.test(link.href);
-                  const content = (
-                    <>
-                      <Icon />
-                      <span>{link.label}</span>
-                    </>
-                  );
-                  return (
-                    <SidebarMenuItem key={link.href}>
-                      <SidebarMenuButton asChild isActive={pathname === link.href || pathname.startsWith(`${link.href}/`)} tooltip={link.label}>
-                        {external ? (
-                          <a href={link.href} target="_blank" rel="noreferrer">
-                            {content}
-                          </a>
-                        ) : (
-                          <Link href={link.href}>{content}</Link>
-                        )}
-                      </SidebarMenuButton>
-                    </SidebarMenuItem>
-                  );
-                })}
-              </SidebarMenu>
-            </SidebarGroupContent>
-          </SidebarGroup>
-        )}
-      </SidebarContent>
-    </Sidebar>
-  );
-}

package/templates/app/components/dashboard/dashboard-nav.tsx

@@ -1,35 +0,0 @@
-"use client";
-
-import Link from "next/link";
-import { usePathname } from "next/navigation";
-import { cn } from "@/lib/utils";
-
-export interface NavLink {
-  href: string;
-  label: string;
-}
-
-/** The dashboard's section links, with the current one marked. */
-export function DashboardNav({ links }: { links: NavLink[] }) {
-  const pathname = usePathname();
-  return (
-    <nav aria-label="Dashboard" className="-mb-px flex gap-1 overflow-x-auto">
-      {links.map((link) => {
-        const current = link.href === "/dashboard" ? pathname === "/dashboard" : pathname.startsWith(link.href);
-        return (
-          <Link
-            key={link.href}
-            href={link.href}
-            aria-current={current ? "page" : undefined}
-            className={cn(
-              "border-b-2 px-3 py-3 text-sm font-medium whitespace-nowrap text-foreground-muted transition-colors hover:text-foreground",
-              current ? "border-brand text-foreground" : "border-transparent",
-            )}
-          >
-            {link.label}
-          </Link>
-        );
-      })}
-    </nav>
-  );
-}

package/templates/app/lib/admin-nav.ts

@@ -1,15 +0,0 @@
-// Extra admin sidebar links (maintained by flare generators such as `flare gen security`).
-// Add your own links outside the generated block.
-// generated:start
-export interface AdminLink {
-  label: string;
-  href: string;
-  /** A resource icon name, e.g. "shield" (see components/admin/resource-icon.tsx). */
-  icon: string;
-}
-
-export const generatedAdminLinks: AdminLink[] = [];
-// generated:end
-
-/** Links shown under "Platform" in the admin sidebar. */
-export const adminLinks: AdminLink[] = [...generatedAdminLinks, { label: "API reference", href: "/api/reference", icon: "book" }];

package/templates/app/lib/admin.ts

@@ -1,103 +0,0 @@
-import { headers } from "next/headers";
-import { notFound, redirect } from "next/navigation";
-import { allowedActions, can, type Policy, type PolicyAction, type Resource } from "@flaredev/core";
-import type { SQLiteTable } from "drizzle-orm/sqlite-core";
-import { createResourceStore, type ResourceStore } from "@flaredev/core/server";
-import { getDb } from "@/db";
-import { policies } from "@/policies";
-import { resourceTables } from "@/resources/server";
-import { auth } from "./auth";
-import { cached, resourceTag, revalidateResource, TTL } from "./cache";
-
-/**
- * Roles that always reach /admin, whatever the policies say. Other roles get in when a
- * policy grants them read access to at least one resource.
- * Register roles with `flare role:add`, assign with `flare user:role`.
- */
-export const ADMIN_ROLES = ["admin", "staff"];
-
-export function policyFor(resourceName: string): Policy | undefined {
-  return (policies as Record<string, Policy | undefined>)[resourceName];
-}
-
-export async function adminSession() {
-  const session = await auth.api.getSession({ headers: await headers() });
-  if (!session) return { session: null, role: null, allowed: false } as const;
-  const role = (session.user as { role?: string | null }).role ?? null;
-  const readable = adminResources().some((resource) => can(policyFor(resource.name), role, "read"));
-  return { session, role, allowed: (role !== null && ADMIN_ROLES.includes(role)) || readable } as const;
-}
-
-/** For admin pages: redirects signed-out visitors to sign-in and users without access to the home page. */
-export async function requireAdmin(returnTo = "/admin") {
-  const { session, role, allowed } = await adminSession();
-  if (!session) redirect(`/sign-in?next=${encodeURIComponent(returnTo)}`);
-  if (!allowed) redirect("/?error=forbidden");
-  return { session, role };
-}
-
-/**
- * For resource pages: also requires the policy to allow `action` on this resource.
- * Sends the user somewhere they can actually go — the list when they may read it,
- * the dashboard when they may not.
- */
-export async function requireAccess(resource: Resource, action: PolicyAction) {
-  const { session, role } = await requireAdmin(adminPath(resource));
-  const policy = policyFor(resource.name);
-  if (!can(policy, role, action)) {
-    redirect(action !== "read" && can(policy, role, "read") ? adminPath(resource) : "/admin?error=forbidden");
-  }
-  return { session, role };
-}
-
-/** What the current user may do with a resource, for hiding actions they can't use. */
-export async function adminPermissions(resourceName: string) {
-  const { role } = await adminSession();
-  return allowedActions(policyFor(resourceName), role);
-}
-
-const stores = new Map<string, ResourceStore>();
-
-/** CRUD store for a resource by name (404 for unknown names). */
-export function adminStore(name: string): ResourceStore {
-  const entry = (resourceTables as unknown as Record<string, { resource: Resource; table: SQLiteTable } | undefined>)[name];
-  if (!entry) notFound();
-  let store = stores.get(name);
-  if (!store) {
-    store = createResourceStore({ resource: entry.resource, table: entry.table, getDb, onChange: revalidateResource });
-    stores.set(name, store);
-  }
-  return store;
-}
-
-/**
- * How many records a resource has. Cached in the data cache under the resource's tag,
- * so the dashboard does not count every table on every visit, and a write through the
- * admin or the API drops the count on its way out.
- */
-export function recordCount(name: string): Promise<number> {
-  const count = cached(
-    async (resourceName: string) => {
-      const result = await adminStore(resourceName).list(new URLSearchParams({ perPage: "1" }));
-      return result.ok ? result.data.meta.total : 0;
-    },
-    ["flare", "record-count"],
-    { tags: [resourceTag(name)], revalidate: TTL.short },
-  );
-  return count(name);
-}
-
-/** Every resource descriptor (unfiltered): navigation uses `visibleResources()` instead. */
-export function adminResources(): Resource[] {
-  return Object.values(resourceTables as unknown as Record<string, { resource: Resource }>).map((entry) => entry.resource);
-}
-
-/** Resources the current user may read, for the sidebar and dashboard. */
-export async function visibleResources(): Promise<Resource[]> {
-  const { role } = await adminSession();
-  return adminResources().filter((resource) => can(policyFor(resource.name), role, "read"));
-}
-
-export function adminPath(resource: Resource, ...parts: string[]) {
-  return ["/admin", resource.slug, ...parts].join("/");
-}