@flaredev/cli 0.6.1 → 0.7.0

package/dist/index.js

@@ -323,7 +323,7 @@ function installArgs(pm) {
 }
 
 // src/commands/create.ts
-var ALLOW_BUILDS = ["'@prisma/engines': true", "esbuild: true", "prisma: true", "sharp: false", "workerd: true"].map((line) => `  ${line}`).join("\n");
+var ALLOW_BUILDS = ["'@prisma/engines': false", "esbuild: true", "prisma: true", "sharp: false", "workerd: true"].map((line) => `  ${line}`).join("\n");
 function toAppName(dir) {
   const name = basename(resolve2(dir)).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
   if (!name) throw new Error(`Cannot derive an app name from "${dir}". Use letters, digits, and dashes.`);
@@ -2310,31 +2310,23 @@ ${lines.join("\n")}
   const imports = [...used].sort((a, b) => a.table.localeCompare(b.table)).map((resource) => `import { ${tableExport(resource)} } from "./schema/${resource.table}";`);
   return [`import { relations } from "drizzle-orm";`, ...imports, "", blocks.join("\n")].join("\n");
 }
-var handlerImports = (entry, stack = "cloudflare") => {
+var routeHeader = (entry, stack) => {
   const local = resourceLocal(entry.stem);
-  const source = stack === "next" ? {
-    imports: [`import { createResourceHandlers, prismaRows } from "@/lib/resource";`, `import { prisma } from "@/lib/db";`],
-    wiring: [`  rows: prismaRows(prisma.${camelCase4(entry.resource.name)}, prisma),`]
-  } : {
-    imports: [
-      `import { createResourceHandlers, drizzleRows } from "@/lib/resource";`,
-      `import { getDb } from "@/db";`,
-      `import { ${tableExport(entry.resource)} } from "@/db/schema";`
-    ],
-    // Named rather than implied: the adapter is the one thing about this route
-    // that differs between stacks, so it is written out.
-    wiring: [`  rows: drizzleRows(${tableExport(entry.resource)}, getDb),`]
+  const source = stack === "next" ? { imports: [`import { prisma } from "@/lib/db";`], rows: `prismaRows(prisma.${camelCase4(entry.resource.name)}, prisma)` } : {
+    imports: [`import { getDb } from "@/db";`, `import { ${tableExport(entry.resource)} } from "@/db/schema";`],
+    rows: `drizzleRows(${tableExport(entry.resource)}, getDb)`
   };
-  return [
+  const adapter = stack === "next" ? "prismaRows" : "drizzleRows";
+  return (helpers) => [
+    `import { createResourceStore, ${[adapter, ...helpers].join(", ")} } from "@/lib/resource";`,
     ...source.imports,
     `import { authorize, currentUser } from "@/lib/api";`,
     `import { revalidateResource } from "@/lib/cache";`,
     `import ${local} from "@/resources/${entry.stem}.resource";`,
     "",
-    `const handlers = createResourceHandlers({`,
+    `const store = createResourceStore({`,
     `  resource: ${local},`,
-    ...source.wiring,
-    `  authorize,`,
+    `  rows: ${source.rows},`,
     `  currentUser,`,
     `  onChange: revalidateResource,`,
     `});`,
@@ -2342,18 +2334,99 @@ var handlerImports = (entry, stack = "cloudflare") => {
   ];
 };
 function renderCollectionRoute(entry, stack = "cloudflare") {
-  return [...handlerImports(entry, stack), "export const GET = handlers.collection.GET;", "export const POST = handlers.collection.POST;", ""].join(
-    "\n"
-  );
+  const local = resourceLocal(entry.stem);
+  const plural = entry.resource.pluralLabel.toLowerCase();
+  return [
+    ...routeHeader(entry, stack)(["crossOrigin", "drain", "failureResponse", "problem", "readJson", "respond"]),
+    `/** GET /api/${entry.resource.slug} \u2014 list ${plural}. Query: page, perPage, sort, q, filter[field], cursor. */`,
+    `export async function GET(request: Request): Promise<Response> {`,
+    `  const denied = await authorize({ request, resource: ${local}, action: "list" });`,
+    `  if (denied) return denied;`,
+    "",
+    `  return respond(await store.list(new URL(request.url).searchParams));`,
+    `}`,
+    "",
+    `/** POST /api/${entry.resource.slug} \u2014 create one. */`,
+    `export async function POST(request: Request): Promise<Response> {`,
+    `  try {`,
+    `    const denied = await authorize({ request, resource: ${local}, action: "create" });`,
+    `    if (denied) return denied;`,
+    `    if (crossOrigin(request)) return problem(403, "Cross-origin request blocked.");`,
+    "",
+    `    const read = await readJson(request);`,
+    `    if ("response" in read) return read.response;`,
+    "",
+    `    const result = await store.create(read.body);`,
+    `    if (!result.ok) return failureResponse(result);`,
+    "",
+    '    const location = `${new URL(request.url).pathname.replace(/\\/$/, "")}/${result.data.id as string}`;',
+    `    return Response.json(result.data, { status: 201, headers: { location } });`,
+    `  } finally {`,
+    `    // A body left unread breaks the next request through wrangler's dev proxy.`,
+    `    await drain(request);`,
+    `  }`,
+    `}`,
+    ""
+  ].join("\n");
 }
 function renderItemRoute(entry, stack = "cloudflare") {
-  return [
-    ...handlerImports(entry, stack),
-    "export const GET = handlers.item.GET;",
-    "export const PATCH = handlers.item.PATCH;",
-    "export const PUT = handlers.item.PUT;",
-    "export const DELETE = handlers.item.DELETE;",
+  const local = resourceLocal(entry.stem);
+  const one = entry.resource.label.toLowerCase();
+  const write = (method, action, call, doc) => [
+    `/** ${doc} */`,
+    `export async function ${method}(request: Request, context: RouteContext): Promise<Response> {`,
+    `  try {`,
+    `    const { id } = await context.params;`,
+    `    const denied = await authorize({ request, resource: ${local}, action: "${action}", id });`,
+    `    if (denied) return denied;`,
+    `    if (crossOrigin(request)) return problem(403, "Cross-origin request blocked.");`,
+    "",
+    ...call.split("\n"),
+    `  } finally {`,
+    `    await drain(request);`,
+    `  }`,
+    `}`,
     ""
+  ];
+  return [
+    ...routeHeader(entry, stack)(["crossOrigin", "drain", "failureResponse", "problem", "readJson", "respond", "type RouteContext"]),
+    `/** GET /api/${entry.resource.slug}/[id] \u2014 read one ${one}. */`,
+    `export async function GET(request: Request, context: RouteContext): Promise<Response> {`,
+    `  const { id } = await context.params;`,
+    `  const denied = await authorize({ request, resource: ${local}, action: "read", id });`,
+    `  if (denied) return denied;`,
+    "",
+    `  return respond(await store.get(id));`,
+    `}`,
+    "",
+    ...write(
+      "PATCH",
+      "update",
+      [
+        `    const read = await readJson(request);`,
+        `    if ("response" in read) return read.response;`,
+        "",
+        `    return respond(await store.update(id, read.body));`
+      ].join("\n"),
+      `PATCH /api/${entry.resource.slug}/[id] \u2014 change some fields of one ${one}.`
+    ),
+    ...write(
+      "PUT",
+      "update",
+      [
+        `    const read = await readJson(request);`,
+        `    if ("response" in read) return read.response;`,
+        "",
+        `    return respond(await store.replace(id, read.body));`
+      ].join("\n"),
+      `PUT /api/${entry.resource.slug}/[id] \u2014 replace one ${one} entirely.`
+    ),
+    ...write(
+      "DELETE",
+      "delete",
+      [`    const result = await store.delete(id);`, `    return result.ok ? new Response(null, { status: 204 }) : failureResponse(result);`].join("\n"),
+      `DELETE /api/${entry.resource.slug}/[id] \u2014 remove one ${one}.`
+    )
   ].join("\n");
 }
 var adminImports = (entry) => [
@@ -2645,7 +2718,7 @@ function findOrphans(appRoot, all) {
 }
 function ensureSupportFiles(appRoot, log2) {
   const stack = readStack(appRoot);
-  const engine = ["rows.ts", "query.ts", "store.ts", "handlers.ts", "index.ts", stack === "next" ? "prisma-rows.ts" : "drizzle-rows.ts"].map(
+  const engine = ["rows.ts", "query.ts", "http.ts", "store.ts", "handlers.ts", "index.ts", stack === "next" ? "prisma-rows.ts" : "drizzle-rows.ts"].map(
     (name) => `lib/resource/${name}`
   );
   for (const path of ["lib/api.ts", "lib/cache.ts", ...engine]) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flaredev/cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "The flare command-line tool: create, generate, migrate, and deploy Flare apps",
   "license": "MIT",
   "author": "Muke Johnbaptist",
@@ -41,7 +41,7 @@
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
-    "@flaredev/core": "0.6.1"
+    "@flaredev/core": "0.7.0"
   },
   "engines": {
     "node": ">=22"

package/templates/app/lib/resource/handlers.ts

@@ -9,6 +9,17 @@
 // `flare update` applies the parts you choose. Neither runs unless you ask.
 
 import type { Resource } from "@flaredev/core";
+import {
+  crossOrigin,
+  drain,
+  failureResponse,
+  problem,
+  readJson,
+  respond,
+  type Authorize,
+  type AuthorizeContext,
+  type RouteContext,
+} from "./http";
 import type { ResourceRows } from "./rows";
 import {
   createResourceStore,
@@ -21,15 +32,7 @@ import {
 
 export type { ResourceAction } from "./store";
 
-export interface AuthorizeContext {
-  request: Request;
-  resource: Resource;
-  action: ResourceAction;
-  id?: string;
-}
-
-/** Return a Response (e.g. 401/403) to deny the request; return nothing to allow it. */
-export type Authorize = (context: AuthorizeContext) => Response | void | Promise<Response | void>;
+export type { Authorize, AuthorizeContext } from "./http";
 
 export interface ResourceHandlerOptions {
   resource: Resource;
@@ -42,59 +45,17 @@ export interface ResourceHandlerOptions {
   onChange?: (event: ChangeEvent) => void | Promise<void>;
 }
 
-type RouteContext = { params: Promise<{ id: string }> };
-
-const problem = (status: number, error: string, extra: object = {}) => Response.json({ error, ...extra }, { status });
-
-function failureResponse(failure: Failure): Response {
-  if (failure.queryIssues) return problem(failure.status, failure.error, { issues: failure.queryIssues });
-  const extra: Record<string, unknown> = {};
-  if (failure.issues) extra.issues = failure.issues;
-  if (failure.field) extra.field = failure.field;
-  return problem(failure.status, failure.error, extra);
-}
-
-const respond = <T>(result: Result<T>, init?: ResponseInit) =>
-  result.ok ? Response.json(result.data, init) : failureResponse(result);
-
 /** REST route handlers for a resource: thin HTTP wrappers over `createResourceStore`. */
 export function createResourceHandlers(options: ResourceHandlerOptions) {
   const { resource, authorize } = options;
   const store = createResourceStore(options);
 
-  /** Deny cross-site writes: browsers send Origin on POST/PATCH/PUT/DELETE. */
-  const crossOrigin = (request: Request) => {
-    const origin = request.headers.get("origin");
-    return origin !== null && origin !== new URL(request.url).origin;
-  };
-
-  async function readBody(request: Request): Promise<{ body: unknown } | { response: Response }> {
-    if (crossOrigin(request)) return { response: problem(403, "Cross-origin request blocked.") };
-    const type = request.headers.get("content-type") ?? "";
-    if (!/^application\/json\b/i.test(type)) return { response: problem(415, "Send JSON with Content-Type: application/json.") };
-    try {
-      return { body: await request.json() };
-    } catch {
-      return { response: problem(400, "Request body isn't valid JSON.") };
-    }
-  }
+  /** The cross-origin guard and the JSON read, in the order a write needs them. */
+  const readBody = async (request: Request): Promise<{ body: unknown } | { response: Response }> =>
+    crossOrigin(request) ? { response: problem(403, "Cross-origin request blocked.") } : readJson(request);
 
   const guard = async (context: AuthorizeContext) => (await authorize(context)) ?? undefined;
 
-  /**
-   * Read and drop a body the handler didn't consume (a 401/403/415 answered early).
-   * Answering with it unread breaks the next request through wrangler's local dev
-   * proxy ("Network connection lost"). Streams, so memory stays flat.
-   */
-  async function drain(request: Request) {
-    if (!request.body || request.bodyUsed) return;
-    try {
-      const reader = request.body.getReader();
-      while (!(await reader.read()).done);
-    } catch {
-      // The client went away.
-    }
-  }
   const draining =
     <Rest extends unknown[]>(handler: (request: Request, ...rest: Rest) => Promise<Response>) =>
     async (request: Request, ...rest: Rest): Promise<Response> => {

package/templates/app/lib/resource/http.ts

@@ -0,0 +1,92 @@
+// This file is yours.
+//
+// The small pieces a route handler needs: how a failure becomes a status code, how a
+// JSON body is read safely, and the two guards that are easy to forget. Routes call
+// these by name so the request flow is visible where it happens, rather than hidden
+// behind a factory.
+//
+// `flare diff` shows how your copy differs from the version Flare ships, and
+// `flare update` applies the parts you choose. Neither runs unless you ask.
+
+import type { Resource } from "@flaredev/core";
+import type { Failure, ResourceAction, Result } from "./store";
+
+export interface AuthorizeContext {
+  request: Request;
+  resource: Resource;
+  action: ResourceAction;
+  id?: string;
+}
+
+/** Return a Response (401/403) to deny the request; return nothing to allow it. */
+export type Authorize = (context: AuthorizeContext) => Response | void | Promise<Response | void>;
+
+/** The context Next.js and vinext hand a route under `[id]`. */
+export type RouteContext = { params: Promise<{ id: string }> };
+
+/** A JSON error response. */
+export const problem = (status: number, error: string, extra: object = {}) => Response.json({ error, ...extra }, { status });
+
+/**
+ * A store failure as HTTP.
+ *
+ * The status is decided in store.ts, where the reason is known: 422 with field issues
+ * for validation, 409 with the column for a unique conflict, 404 for a missing row.
+ */
+export function failureResponse(failure: Failure): Response {
+  if (failure.queryIssues) return problem(failure.status, failure.error, { issues: failure.queryIssues });
+  const extra: Record<string, unknown> = {};
+  if (failure.issues) extra.issues = failure.issues;
+  if (failure.field) extra.field = failure.field;
+  return problem(failure.status, failure.error, extra);
+}
+
+/** A store result as HTTP: the data, or the failure above. */
+export const respond = <T>(result: Result<T>, init?: ResponseInit) => (result.ok ? Response.json(result.data, init) : failureResponse(result));
+
+/**
+ * Whether this write came from another site.
+ *
+ * Browsers always send `Origin` on POST, PATCH, PUT and DELETE, so a mismatch is a
+ * cross-site request and a request with no Origin at all is not from a browser form.
+ * This is the CSRF guard; a route that writes should call it.
+ */
+export const crossOrigin = (request: Request) => {
+  const origin = request.headers.get("origin");
+  return origin !== null && origin !== new URL(request.url).origin;
+};
+
+/**
+ * The request's JSON body, or the response to send instead.
+ *
+ * Returns `{ body }` or `{ response }`, so a caller can't forget to handle the bad
+ * cases: the wrong content type, or a body that isn't JSON.
+ */
+export async function readJson(request: Request): Promise<{ body: unknown } | { response: Response }> {
+  const type = request.headers.get("content-type") ?? "";
+  if (!/^application\/json\b/i.test(type)) return { response: problem(415, "Send JSON with Content-Type: application/json.") };
+  try {
+    return { body: await request.json() };
+  } catch {
+    return { response: problem(400, "Request body isn't valid JSON.") };
+  }
+}
+
+/**
+ * Read and discard a body the handler never consumed.
+ *
+ * A request answered early — 401, 403, 415 — still has its body waiting. Replying
+ * without reading it breaks the *next* request through wrangler's local dev proxy
+ * ("Network connection lost"), which is a baffling thing to debug. Routes call this in
+ * a `finally`, so it happens whichever way they returned. It streams, so memory stays
+ * flat however large the body was.
+ */
+export async function drain(request: Request): Promise<void> {
+  if (!request.body || request.bodyUsed) return;
+  try {
+    const reader = request.body.getReader();
+    while (!(await reader.read()).done);
+  } catch {
+    // The client went away.
+  }
+}

package/templates/app/lib/resource/index.ts

@@ -8,6 +8,7 @@
 // contract — about fifty lines in rows.ts, and the reason a descriptor doesn't care
 // which database it is on.
 export * from "./rows";
+export * from "./http";
 export * from "./query";
 export * from "./store";
 export * from "./handlers";

package/templates/next/lib/resource/index.ts

@@ -8,6 +8,7 @@
 // which is the whole contract — about fifty lines in rows.ts, and the reason a
 // descriptor doesn't care which database it is on.
 export * from "./rows";
+export * from "./http";
 export * from "./query";
 export * from "./store";
 export * from "./handlers";