@flaredev/cli 0.2.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaredev/cli",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "The flare command-line tool: create, generate, migrate, and deploy Flare apps",
   "license": "MIT",
   "author": "Muke Johnbaptist",
@@ -41,7 +41,7 @@
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
-    "@flaredev/core": "0.2.0"
+    "@flaredev/core": "0.4.0"
   },
   "engines": {
     "node": ">=22"

package/templates/app/app/admin/page.tsx

@@ -1,63 +1,11 @@
-import Link from "next/link";
-import { ArrowRightIcon, PlusIcon } from "lucide-react";
-import { Button } from "@/components/ui/button";
-import { Card, CardAction, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
-import { Empty, EmptyDescription, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
-import { resourceIcon } from "@/components/admin/resource-icon";
-import { adminPath, recordCount, visibleResources } from "@/lib/admin";
+import { permanentRedirect } from "next/navigation";
 
-/** Admin landing page: one card per resource with its record count. */
-export default async function AdminPage() {
-  const resources = await visibleResources();
-  const counts = await Promise.all(resources.map((resource) => recordCount(resource.name)));
-
-  if (resources.length === 0) {
-    return (
-      <Empty className="rounded-lg border border-dashed">
-        <EmptyHeader>
-          <EmptyTitle>No resources yet</EmptyTitle>
-          <EmptyDescription>
-            Generate one with <code>flare gen resource Contact --fields &quot;name:string, email:string&quot;</code>.
-          </EmptyDescription>
-        </EmptyHeader>
-      </Empty>
-    );
-  }
-
-  return (
-    <div className="flex flex-col gap-6">
-      <h1 className="text-2xl font-semibold">Overview</h1>
-      <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
-        {resources.map((resource, index) => {
-          const Icon = resourceIcon(resource.icon);
-          return (
-            <Card key={resource.name}>
-              <CardHeader>
-                <CardDescription className="flex items-center gap-2">
-                  <Icon className="size-5" />
-                  {resource.pluralLabel}
-                </CardDescription>
-                <CardTitle className="text-3xl font-bold tabular-nums">{counts[index]!.toLocaleString()}</CardTitle>
-                <CardAction>
-                  <Button variant="ghost" size="icon" aria-label={`New ${resource.label.toLowerCase()}`} asChild>
-                    <Link href={adminPath(resource, "new")}>
-                      <PlusIcon />
-                    </Link>
-                  </Button>
-                </CardAction>
-              </CardHeader>
-              <CardContent>
-                <Button variant="link" className="h-auto p-0" asChild>
-                  <Link href={adminPath(resource)}>
-                    View {resource.pluralLabel.toLowerCase()}
-                    <ArrowRightIcon data-icon="inline-end" />
-                  </Link>
-                </Button>
-              </CardContent>
-            </Card>
-          );
-        })}
-      </div>
-    </div>
-  );
+/**
+ * The admin used to live here. It's the dashboard now — one signed-in area, with the
+ * resources, the account pages, security and observability in the same shell.
+ *
+ * Kept so links and bookmarks still land somewhere.
+ */
+export default function AdminPage() {
+  permanentRedirect("/dashboard");
 }

package/templates/app/app/dashboard/account/layout.tsx

@@ -0,0 +1,30 @@
+import { AccountNav } from "@/components/account/account-nav";
+import { PageHeader } from "@/components/dashboard/page-header";
+import { twoFactorAvailable, authConfig } from "@/lib/auth-config";
+import { enabledSocialProviders } from "@/lib/auth";
+import { requireSession } from "@/lib/session";
+
+/** The frame the account's pages share: one header, one set of links. */
+export default async function AccountLayout({ children }: { children: React.ReactNode }) {
+  await requireSession("/dashboard/account");
+  const security = twoFactorAvailable || authConfig.passkeys || enabledSocialProviders().length > 0;
+
+  return (
+    <>
+      <PageHeader
+        title="Account"
+        description="Your profile, how you sign in, and where you're signed in."
+        crumbs={[{ label: "Dashboard", href: "/dashboard" }, { label: "Account" }]}
+      />
+      <AccountNav
+        links={[
+          { href: "/dashboard/account", label: "Profile" },
+          { href: "/dashboard/account/password", label: "Password" },
+          ...(security ? [{ href: "/dashboard/account/security", label: "Security" }] : []),
+          { href: "/dashboard/account/sessions", label: "Devices" },
+        ]}
+      />
+      <div className="flex max-w-3xl flex-col gap-6">{children}</div>
+    </>
+  );
+}

package/templates/app/app/dashboard/account/page.tsx

@@ -1,38 +1,18 @@
-import { and, eq } from "drizzle-orm";
-import { SecuritySettings } from "@/components/account/security-settings";
-import { getDb } from "@/db";
-import { account } from "@/db/auth-schema";
-import { enabledSocialProviders } from "@/lib/auth";
-import { authConfig } from "@/lib/auth-config";
+import { Profile } from "@/components/account/sections";
 import { requireSession } from "@/lib/session";
 
-export const metadata = { title: "Account" };
+export const metadata = { title: "Profile" };
 
-export default async function AccountPage() {
+export default async function ProfilePage() {
   const { user } = await requireSession("/dashboard/account");
-  const credential = await getDb()
-    .select({ id: account.id })
-    .from(account)
-    .where(and(eq(account.userId, user.id), eq(account.providerId, "credential")))
-    .get();
-
   return (
-    <>
-      <div className="flex flex-col gap-1">
-        <h1 className="text-3xl">Account</h1>
-        <p className="text-foreground-muted">Your profile, how you sign in, and where you&apos;re signed in.</p>
-      </div>
-      <SecuritySettings
-        user={{
-          name: user.name,
-          email: user.email,
-          emailVerified: user.emailVerified,
-          twoFactorEnabled: Boolean((user as { twoFactorEnabled?: boolean | null }).twoFactorEnabled),
-        }}
-        hasPassword={Boolean(credential)}
-        methods={{ passkeys: authConfig.passkeys, twoFactor: authConfig.twoFactor }}
-        socialProviders={enabledSocialProviders()}
-      />
-    </>
+    <Profile
+      user={{
+        name: user.name,
+        email: user.email,
+        emailVerified: user.emailVerified,
+        twoFactorEnabled: Boolean((user as { twoFactorEnabled?: boolean | null }).twoFactorEnabled),
+      }}
+    />
   );
 }

package/templates/app/app/dashboard/account/password/page.tsx

@@ -0,0 +1,22 @@
+import { and, eq } from "drizzle-orm";
+import { Password } from "@/components/account/sections";
+import { getDb } from "@/db";
+import { account } from "@/db/auth-schema";
+import { requireSession } from "@/lib/session";
+
+export const metadata = { title: "Password" };
+
+/** Whether this person signs in with a password at all: social and passkey accounts have none. */
+async function hasPassword(userId: string) {
+  const credential = await getDb()
+    .select({ id: account.id })
+    .from(account)
+    .where(and(eq(account.userId, userId), eq(account.providerId, "credential")))
+    .get();
+  return Boolean(credential);
+}
+
+export default async function PasswordPage() {
+  const { user } = await requireSession("/dashboard/account/password");
+  return <Password hasPassword={await hasPassword(user.id)} email={user.email} />;
+}

package/templates/app/app/dashboard/account/security/page.tsx

@@ -0,0 +1,34 @@
+import { and, eq } from "drizzle-orm";
+import { ConnectedAccounts, Passkeys, TwoFactor } from "@/components/account/sections";
+import { getDb } from "@/db";
+import { account } from "@/db/auth-schema";
+import { enabledSocialProviders } from "@/lib/auth";
+import { authConfig, twoFactorAvailable } from "@/lib/auth-config";
+import { requireSession } from "@/lib/session";
+
+export const metadata = { title: "Security" };
+
+/** Two-factor, passkeys and the accounts you can sign in with. */
+export default async function SecurityPage() {
+  const { user } = await requireSession("/dashboard/account/security");
+  const credential = await getDb()
+    .select({ id: account.id })
+    .from(account)
+    .where(and(eq(account.userId, user.id), eq(account.providerId, "credential")))
+    .get();
+  const providers = enabledSocialProviders();
+
+  return (
+    <>
+      {twoFactorAvailable && (
+        <TwoFactor
+          enabled={Boolean((user as { twoFactorEnabled?: boolean | null }).twoFactorEnabled)}
+          hasPassword={Boolean(credential)}
+          methods={authConfig.twoFactor}
+        />
+      )}
+      {authConfig.passkeys && <Passkeys />}
+      {providers.length > 0 && <ConnectedAccounts providers={providers} />}
+    </>
+  );
+}

package/templates/app/app/dashboard/account/sessions/page.tsx

@@ -0,0 +1,9 @@
+import { Sessions } from "@/components/account/sections";
+import { requireSession } from "@/lib/session";
+
+export const metadata = { title: "Devices" };
+
+export default async function SessionsPage() {
+  await requireSession("/dashboard/account/sessions");
+  return <Sessions />;
+}

package/templates/app/app/dashboard/actions.ts

@@ -0,0 +1,246 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { createObjectKey, fileKeyPrefix, fileMaxBytes, matchesContentType, mimeTypesFor, type FileField } from "@flaredev/core";
+import type { FieldIssue } from "@flaredev/core/server";
+import { diffFields, recordAudit } from "@/lib/audit";
+import { listViews, MAX_VIEWS } from "@/lib/views";
+import { and, eq } from "drizzle-orm";
+import { getDb } from "@/db";
+import { savedView } from "@/db/flare-schema";
+import { toCsv } from "@/lib/csv";
+import { storage } from "@/lib/storage";
+import { can, storedFields, type PolicyAction } from "@flaredev/core";
+import { resourcePath, dashboardSession, dashboardStore, policyFor } from "@/lib/dashboard";
+
+export type ActionResult<T = unknown> =
+  | { ok: true; data: T }
+  | { ok: false; status: number; error: string; issues?: FieldIssue[]; field?: string };
+
+const forbidden = (message = "You don't have access to this."): ActionResult<never> => ({ ok: false, status: 403, error: message });
+
+/** Session + policy check for one action on one resource. */
+async function allowed(resourceName: string, action: PolicyAction): Promise<ActionResult<never> | undefined> {
+  const { allowed: inAdmin, role } = await dashboardSession();
+  if (!inAdmin) return forbidden();
+  if (!can(policyFor(resourceName), role, action)) return forbidden(`Your role can't ${action} this record.`);
+}
+
+export async function deleteRecordAction(resourceName: string, id: string): Promise<ActionResult<{ id: string }>> {
+  const denied = await allowed(resourceName, "delete");
+  if (denied) return denied;
+
+  const store = dashboardStore(resourceName);
+  const existing = await store.get(id);
+  const result = await store.delete(id);
+  if (result.ok) {
+    await recordAudit({
+      action: "delete",
+      resource: resourceName,
+      recordId: id,
+      recordLabel: existing.ok ? recordTitle(store.resource, existing.data) : null,
+    });
+    revalidatePath(resourcePath(store.resource));
+  }
+  return result;
+}
+
+/** What to call a record in the audit log: its title field, falling back to its id. */
+function recordTitle(resource: { titleField: string }, record: Record<string, unknown>): string {
+  const value = record[resource.titleField];
+  return typeof value === "string" && value ? value : String(record.id ?? "");
+}
+
+/** How many rows one export may fetch: enough for a spreadsheet, not enough to exhaust the Worker. */
+const EXPORT_LIMIT = 50_000;
+const EXPORT_PAGE = 500;
+
+export async function deleteManyAction(resourceName: string, ids: string[]): Promise<ActionResult<{ deleted: number; failed: number }>> {
+  const denied = await allowed(resourceName, "delete");
+  if (denied) return denied;
+  if (ids.length === 0) return { ok: true, data: { deleted: 0, failed: 0 } };
+  if (ids.length > 500) return { ok: false, status: 400, error: "That's more than 500 records. Delete them in smaller batches." };
+
+  const store = dashboardStore(resourceName);
+  // One at a time, through the store: deleting a record runs its policy, its hooks and
+  // its cache invalidation, and a row that refuses to go (a foreign key still pointing
+  // at it) shouldn't take the rest of the batch with it.
+  let deleted = 0;
+  let failed = 0;
+  for (const id of ids) {
+    const result = await store.delete(id);
+    if (result.ok) deleted++;
+    else failed++;
+  }
+  if (deleted > 0) {
+    await recordAudit({ action: "bulk-delete", resource: resourceName, changes: { deleted, failed } });
+    revalidatePath(resourcePath(store.resource));
+  }
+  return { ok: true, data: { deleted, failed } };
+}
+
+/**
+ * Every record matching the current search and filters, as CSV.
+ *
+ * Read through the same store the table uses, so the export shows exactly what the
+ * person can see — their policy, their filters, their sort.
+ */
+export async function exportRecordsAction(resourceName: string, query: string): Promise<ActionResult<{ csv: string; rows: number; truncated: boolean }>> {
+  const denied = await allowed(resourceName, "read");
+  if (denied) return denied;
+
+  const store = dashboardStore(resourceName);
+  const fields = storedFields(store.resource).filter(([, def]) => def.kind !== "file");
+  const columns = [["id", "Id"] as const, ...fields.map(([key, def]) => [key, def.label] as const), ["createdAt", "Created"] as const];
+
+  const rows: Record<string, unknown>[] = [];
+  let truncated = false;
+  for (let page = 1; rows.length < EXPORT_LIMIT; page++) {
+    const params = new URLSearchParams(query);
+    params.set("page", String(page));
+    params.set("perPage", String(EXPORT_PAGE));
+    const result = await store.list(params);
+    if (!result.ok) return result;
+    rows.push(...result.data.data);
+    if (page >= result.data.meta.totalPages) break;
+    if (rows.length >= EXPORT_LIMIT) {
+      truncated = true;
+      break;
+    }
+  }
+
+  const csv = toCsv(rows, columns.map(([key, label]) => ({ key, label })));
+  return { ok: true, data: { csv, rows: rows.length, truncated } };
+}
+
+/** Keep the table's current query as a named view, for this person. */
+export async function saveViewAction(resourceName: string, name: string, query: string): Promise<ActionResult<{ id: string }>> {
+  const denied = await allowed(resourceName, "read");
+  if (denied) return denied;
+  const { session } = await dashboardSession();
+  if (!session) return { ok: false, status: 401, error: "Sign in to save a view." };
+
+  const label = name.trim().slice(0, 60);
+  if (!label) return { ok: false, status: 400, error: "Give the view a name." };
+  const existing = await listViews(resourceName);
+  if (existing.length >= MAX_VIEWS) {
+    return { ok: false, status: 400, error: `That's ${MAX_VIEWS} views for ${resourceName}. Delete one first.` };
+  }
+
+  const [row] = await getDb()
+    .insert(savedView)
+    .values({ userId: session.user.id, resource: resourceName, name: label, query: query.replace(/^\?/, "").slice(0, 2000) })
+    .returning({ id: savedView.id });
+  revalidatePath("/dashboard", "layout");
+  return { ok: true, data: { id: row!.id } };
+}
+
+/** Views belong to the person who saved them, so only they can remove one. */
+export async function deleteViewAction(id: string): Promise<ActionResult<{ id: string }>> {
+  const { session } = await dashboardSession();
+  if (!session) return { ok: false, status: 401, error: "Sign in first." };
+  await getDb().delete(savedView).where(and(eq(savedView.id, id), eq(savedView.userId, session.user.id)));
+  revalidatePath("/dashboard", "layout");
+  return { ok: true, data: { id } };
+}
+
+export async function createRecordAction(resourceName: string, input: unknown): Promise<ActionResult<Record<string, unknown>>> {
+  const denied = await allowed(resourceName, "create");
+  if (denied) return denied;
+
+  const store = dashboardStore(resourceName);
+  const result = await store.create(input);
+  if (result.ok) {
+    await recordAudit({
+      action: "create",
+      resource: resourceName,
+      recordId: String(result.data.id),
+      recordLabel: recordTitle(store.resource, result.data),
+      changes: diffFields(null, result.data),
+    });
+    revalidatePath(resourcePath(store.resource));
+  }
+  return result;
+}
+
+export async function updateRecordAction(resourceName: string, id: string, input: unknown): Promise<ActionResult<Record<string, unknown>>> {
+  const denied = await allowed(resourceName, "update");
+  if (denied) return denied;
+
+  const store = dashboardStore(resourceName);
+  const before = await store.get(id);
+  const result = await store.update(id, input);
+  if (result.ok) {
+    await recordAudit({
+      action: "update",
+      resource: resourceName,
+      recordId: id,
+      recordLabel: recordTitle(store.resource, result.data),
+      changes: diffFields(before.ok ? before.data : null, result.data),
+    });
+    revalidatePath(resourcePath(store.resource));
+  }
+  return result;
+}
+
+/** The file field `fieldKey` of a resource, or a failure when it doesn't exist. */
+function fileField(
+  resourceName: string,
+  fieldKey: string,
+): { failure: ActionResult<never> } | { field: FileField & { label: string }; prefix: string } {
+  const { resource } = dashboardStore(resourceName);
+  const field = resource.fields[fieldKey];
+  if (!field || field.kind !== "file") {
+    return { failure: { ok: false, status: 400, error: `${resourceName} has no file field "${fieldKey}".` } };
+  }
+  return { field, prefix: fileKeyPrefix(resource, fieldKey) };
+}
+
+/**
+ * A short-lived signed URL for uploading to a `file:[…]` field. The declared type and
+ * size are checked against the descriptor before signing, so a browser can't widen
+ * what the field accepts; the storage route then checks the bytes really are that type.
+ */
+export async function createUploadUrlAction(
+  resourceName: string,
+  fieldKey: string,
+  file: { name: string; type: string; size: number },
+): Promise<ActionResult<{ url: string; key: string }>> {
+  // Uploading is part of creating or editing a record, so either permission is enough.
+  const deniedCreate = await allowed(resourceName, "create");
+  const deniedUpdate = await allowed(resourceName, "update");
+  if (deniedCreate && deniedUpdate) return deniedUpdate;
+
+  const target = fileField(resourceName, fieldKey);
+  if ("failure" in target) return target.failure;
+  const { field, prefix } = target;
+
+  const contentTypes = mimeTypesFor(field.accept);
+  if (!matchesContentType(file.type || "application/octet-stream", contentTypes)) {
+    return { ok: false, status: 415, error: `${field.label} accepts ${field.accept.join(", ")} files.`, field: fieldKey };
+  }
+  const maxBytes = fileMaxBytes(field);
+  if (file.size > maxBytes) {
+    return { ok: false, status: 413, error: `${field.label} must be ${Math.round(maxBytes / 1024 / 1024)} MB or smaller.`, field: fieldKey };
+  }
+
+  const upload = await storage.createUploadUrl({ key: createObjectKey(file.name, prefix), contentTypes, maxBytes });
+  return { ok: true, data: { url: upload.url, key: upload.key } };
+}
+
+/**
+ * A short-lived URL for viewing a file stored in a `file:[…]` field. Only keys under that
+ * field's prefix are signed, and only for roles that can work with the resource, so a
+ * guessed or borrowed key can't be read through a resource the role can't see.
+ */
+export async function createReadUrlAction(resourceName: string, fieldKey: string, key: string): Promise<ActionResult<{ url: string }>> {
+  const denied = await allowed(resourceName, "read");
+  // Someone creating or editing a record can view what they just uploaded.
+  if (denied && (await allowed(resourceName, "create")) && (await allowed(resourceName, "update"))) return denied;
+
+  const target = fileField(resourceName, fieldKey);
+  if ("failure" in target) return target.failure;
+  if (!key.startsWith(target.prefix)) return { ok: false, status: 403, error: "That file doesn't belong to this field.", field: fieldKey };
+
+  return { ok: true, data: { url: await storage.createReadUrl({ key }) } };
+}

package/templates/app/app/dashboard/import-actions.ts

@@ -0,0 +1,91 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { recordAudit } from "@/lib/audit";
+import { can, type PolicyAction } from "@flaredev/core";
+import type { Failure } from "@flaredev/core/server";
+import { resourcePath, dashboardSession, dashboardStore, policyFor } from "@/lib/dashboard";
+import type { ActionResult } from "./actions";
+
+/** One row that couldn't be saved, numbered from 1 within the batch that was sent. */
+export interface ImportFailure {
+  row: number;
+  error: string;
+  field?: string;
+}
+
+export interface ImportSummary {
+  created: number;
+  failed: ImportFailure[];
+}
+
+/** Rows accepted per call. The browser splits a file into batches of this size or smaller. */
+const MAX_ROWS = 5000;
+
+/** How many consecutive failures at the start of a batch count as a mis-mapped file. */
+const GIVE_UP_AFTER = 25;
+
+const forbidden = (message = "You don't have access to the admin."): ActionResult<never> => ({ ok: false, status: 403, error: message });
+
+/** Session + policy check for one action on one resource. */
+async function allowed(resourceName: string, action: PolicyAction): Promise<ActionResult<never> | undefined> {
+  const { allowed: inAdmin, role } = await dashboardSession();
+  if (!inAdmin) return forbidden();
+  if (!can(policyFor(resourceName), role, action)) return forbidden(`Your role can't ${action} this record.`);
+}
+
+/** A store failure as one line of text, attributed to a field when the issues name one. */
+function describe(failure: Failure): { error: string; field?: string } {
+  const issues = failure.issues ?? [];
+  if (issues.length === 0) return { error: failure.error, field: failure.field };
+  return {
+    error: issues.map((issue) => (issue.path ? `${issue.path}: ${issue.message}` : issue.message)).join("; "),
+    field: issues[0]?.path.split(".")[0] || failure.field,
+  };
+}
+
+/**
+ * Creates one batch of imported records and reports what happened to each row.
+ *
+ * Rows go through `store.create` one at a time rather than a bulk insert so an import
+ * gets the same validation, defaults, generated ids and change hooks as the API and the
+ * admin form; a bulk insert would let a CSV write values no other route can.
+ */
+export async function importRecordsAction(resourceName: string, rows: Record<string, unknown>[]): Promise<ActionResult<ImportSummary>> {
+  const denied = await allowed(resourceName, "create");
+  if (denied) return denied;
+
+  if (rows.length > MAX_ROWS) {
+    return { ok: false, status: 413, error: `This import sent ${rows.length} rows at once. Send at most ${MAX_ROWS} rows per batch.` };
+  }
+
+  const store = dashboardStore(resourceName);
+  const failed: ImportFailure[] = [];
+  let created = 0;
+
+  for (const [index, row] of rows.entries()) {
+    const result = await store.create(row);
+    if (result.ok) {
+      created += 1;
+    } else {
+      failed.push({ row: index + 1, ...describe(result) });
+    }
+
+    // Columns mapped to the wrong fields fail every row, so a long file would spend
+    // thousands of writes proving the same point. A short batch runs to the end, where
+    // the per-row report is more use than an early exit.
+    if (created === 0 && failed.length === GIVE_UP_AFTER && rows.length > GIVE_UP_AFTER) {
+      return {
+        ok: false,
+        status: 422,
+        error: `The first ${GIVE_UP_AFTER} rows all failed, so nothing was imported. Check the column mapping — the first row said: ${failed[0]?.error ?? "no reason given"}`,
+      };
+    }
+  }
+
+  if (created > 0) {
+    await recordAudit({ action: "import", resource: resourceName, changes: { created, failed: failed.length } });
+    revalidatePath(resourcePath(store.resource));
+  }
+  return { ok: true, data: { created, failed } };
+}