@flaredev/cli 0.9.1 → 0.11.0

package/templates/next/.env.example

@@ -1,20 +1,36 @@
-# Postgres, from your Neon project (Dashboard → Connection string).
-DATABASE_URL=
+# Copy to .env. `flare create` already wrote one with a secret and the local service
+# addresses below, so this file is here for the values you change when you deploy.
+#
+# Two ways to run the services this app needs:
+#
+#   With Docker     docker compose up -d     — Postgres, MinIO and Redis on your machine.
+#                                              The values below already match it.
+#   Without Docker  Neon, Cloudflare R2 and Upstash. Replace the values below with theirs.
+#
+# Nothing in the app knows which you chose: MinIO speaks S3 like R2, and the Redis proxy
+# speaks Upstash's REST protocol.
+
+# Postgres. Docker: the compose file. Hosted: Neon (Dashboard -> Connection string),
+# pooled rather than direct.
+DATABASE_URL=postgresql://flare:flare@127.0.0.1:5432/app
 
 # Sessions and signed upload URLs. Generate with: openssl rand -base64 32
 BETTER_AUTH_SECRET=
+# A bare origin: no trailing slash, or every sign-in returns 403.
 BETTER_AUTH_URL=http://localhost:3000
 
-# File uploads, on an R2 bucket (Cloudflare → R2 → Manage API tokens).
-# R2 serves what it stores for free, which is why it's here rather than Blob storage.
-R2_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
-R2_BUCKET=
-R2_ACCESS_KEY_ID=
-R2_SECRET_ACCESS_KEY=
+# File uploads. Docker: MinIO, below. Hosted: an R2 bucket (Cloudflare -> R2 -> Manage
+# API tokens). R2 serves what it stores for free, which is why it is here rather than
+# Blob storage.
+R2_ENDPOINT=http://127.0.0.1:9000
+R2_BUCKET=app-uploads
+R2_ACCESS_KEY_ID=flare
+R2_SECRET_ACCESS_KEY=flare-secret-123
 
 # Optional. Rate limits and anything that has to be true across every instance.
-UPSTASH_REDIS_REST_URL=
-UPSTASH_REDIS_REST_TOKEN=
+# Docker: the serverless-redis-http proxy. Hosted: Upstash.
+UPSTASH_REDIS_REST_URL=http://127.0.0.1:8079
+UPSTASH_REDIS_REST_TOKEN=flare-local-token
 
 # Optional. Without these, email is printed to the console instead of sent.
 RESEND_API_KEY=

package/templates/next/docker-compose.yml

@@ -0,0 +1,74 @@
+# The services this app expects, running on your machine.
+#
+#   docker compose up -d
+#
+# Without Docker you point the same variables at hosted services instead — Neon for
+# Postgres, Cloudflare R2 for uploads, Upstash for Redis. Nothing in the app knows the
+# difference: MinIO speaks S3 like R2 does, and the Redis proxy speaks Upstash's REST
+# protocol, so `lib/storage.ts` and `lib/redis.ts` are the same code either way.
+#
+# `.env.example` already holds the values that match this file.
+
+services:
+  postgres:
+    image: postgres:17
+    environment:
+      POSTGRES_USER: flare
+      POSTGRES_PASSWORD: flare
+      POSTGRES_DB: app
+    ports: ["5432:5432"]
+    volumes: [postgres-data:/var/lib/postgresql/data]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U flare -d app"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  # R2 speaks S3, and so does MinIO, which is how file uploads work locally without a
+  # Cloudflare account.
+  #
+  # bitnamilegacy, pinned: bitnami/minio stopped publishing tags, and both minio/minio on
+  # Docker Hub and quay.io now refuse an anonymous pull. This archived tag still works and
+  # creates the bucket on startup, so there is no setup step after `up`.
+  minio:
+    image: bitnamilegacy/minio:2025.7.23-debian-12-r5
+    environment:
+      MINIO_ROOT_USER: flare
+      MINIO_ROOT_PASSWORD: flare-secret-123
+      MINIO_DEFAULT_BUCKETS: app-uploads
+    # 9000 is the S3 API, 9001 the web console (http://localhost:9001).
+    ports: ["9000:9000", "9001:9001"]
+    volumes: [minio-data:/bitnami/minio/data]
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://127.0.0.1:9000/minio/health/live"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  redis:
+    image: redis:8-alpine
+    # Not published: only the proxy below talks to it, and the app never speaks RESP.
+    expose: ["6379"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  # `@upstash/redis` is a REST client, not a socket client, so it cannot talk to the Redis
+  # above directly. This proxy speaks Upstash's REST protocol in front of it, which keeps
+  # `lib/redis.ts` identical whether you are on your laptop or on Upstash.
+  redis-http:
+    image: hiett/serverless-redis-http:latest
+    environment:
+      SRH_MODE: env
+      SRH_TOKEN: flare-local-token
+      SRH_CONNECTION_STRING: redis://redis:6379
+    ports: ["8079:80"]
+    depends_on:
+      redis:
+        condition: service_healthy
+
+volumes:
+  postgres-data:
+  minio-data:

package/templates/next/lib/auth.ts

@@ -16,8 +16,31 @@ import { sendEmailCode, sendMagicLink, sendPasswordReset, sendTwoFactorCode, sen
 
 const vars = process.env as Record<string, string | undefined>;
 
-/** Optional: set when serving from a custom domain (e.g. https://example.com). */
-const configuredURL = vars.BETTER_AUTH_URL;
+/**
+ * Optional: set when serving from a custom domain (e.g. https://example.com).
+ *
+ * Better Auth compares the request's Origin header against this string, and an Origin never
+ * carries a trailing slash. So `https://example.com/` — which is what you get copying a
+ * domain out of a browser bar or the Vercel dashboard — matches nothing, and every sign-in
+ * comes back 403 with nothing in the log saying why. Correct it and say so: a warning that
+ * leaves sign-in broken is not much better than the silence it replaces.
+ */
+function authBaseURL(raw: string | undefined): string | undefined {
+  const value = raw?.trim();
+  if (!value) return undefined;
+  // Only a trailing slash is removed. A path stays: an app served under one legitimately
+  // sets BETTER_AUTH_URL to https://example.com/app.
+  const url = value.replace(/\/+$/, "");
+  if (url !== value) {
+    console.warn(`[auth] BETTER_AUTH_URL has a trailing slash, which never matches an Origin header and makes every sign-in 403. Using "${url}" — set BETTER_AUTH_URL to that to silence this.`);
+  }
+  if (url && !/^https?:\/\//.test(url)) {
+    console.warn(`[auth] BETTER_AUTH_URL ("${url}") has no scheme, so it cannot match an Origin. Set it to a full origin, e.g. https://example.com.`);
+  }
+  return url || undefined;
+}
+
+const configuredURL = authBaseURL(vars.BETTER_AUTH_URL);
 
 /** A provider's credentials from the environment, when both are set. */
 function credentials(prefix: string) {
@@ -84,6 +107,44 @@ async function guardPassword(path: string, body: Record<string, unknown> | undef
   }
 }
 
+/**
+ * The first account to exist becomes the admin.
+ *
+ * Generated resources are admin-only, so without this a fresh app has a database, an API
+ * and a dashboard that nobody can reach — and the usual fix for that is to open
+ * everything up, which is how an admin panel ends up on the internet. The person running
+ * sign-up on an empty database is the person setting the app up.
+ *
+ * Done here rather than in `databaseHooks.user.create`, because the admin plugin already
+ * registers one of those (`{ role: defaultRole, ...user }`) and Better Auth does not merge
+ * the two — a second one is silently never called. This runs after the row exists and
+ * states the rule in SQL, which no plugin can quietly win.
+ *
+ * Everyone after them keeps the plugin's default role, and no role reaches an admin-only
+ * resource until you grant one with `flare user:role them@example.com admin`.
+ *
+ * Two people signing up in the same instant would both see two rows and neither would be
+ * promoted, leaving an app with no admin. It needs a brand-new app and millisecond timing,
+ * and `flare user:role you@example.com admin` fixes it, so this stays the simple rule
+ * rather than a transaction nobody can read.
+ */
+let adminSettled = false;
+
+async function promoteFirstUser() {
+  if (adminSettled) return;
+  // Two rows is all it takes to answer "is there exactly one?".
+  const rows = await prisma.user.findMany({ select: { id: true, role: true }, take: 2 });
+  if (rows.length !== 1) {
+    // Nobody yet: the next sign-up asks again. More than one: the question is settled.
+    adminSettled = rows.length > 1;
+    return;
+  }
+  if (rows[0]!.role !== "admin") {
+    await prisma.user.update({ where: { id: rows[0]!.id }, data: { role: "admin" } });
+  }
+  adminSettled = true;
+}
+
 export const auth = betterAuth({
   appName: "__APP_NAME__",
   secret: process.env.BETTER_AUTH_SECRET,
@@ -127,6 +188,11 @@ export const auth = betterAuth({
       if (disabledPath(ctx.path)) throw new APIError("NOT_FOUND", { message: "This sign-in method isn't enabled." });
       await guardPassword(ctx.path, ctx.body as Record<string, unknown> | undefined);
     }),
+    // Any route can be the one that creates the first user — a password sign-up, a magic
+    // link, a social callback — so this asks after all of them rather than guessing which.
+    after: createAuthMiddleware(async () => {
+      await promoteFirstUser();
+    }),
   },
   plugins: [
     // Adds user.role (default "user") and admin APIs. The /admin area allows ADMIN_ROLES (lib/admin.ts).

package/templates/next/lib/db.ts

@@ -1,5 +1,9 @@
 import { PrismaPg } from "@prisma/adapter-pg";
-import { PrismaClient } from "@/lib/generated/prisma/client";
+// Relative, not "@/lib/generated/prisma/client". The alias is resolved by the bundler,
+// and `flare seed` runs this file through tsx instead, which does not resolve it under
+// `moduleResolution: "bundler"` — the seed died on its first import before reaching the
+// database. The generated client lives inside lib/ anyway, so this is the shorter path.
+import { PrismaClient } from "./generated/prisma/client";
 
 /**
  * The Prisma client, one per process.

package/templates/next/lib/resource/prisma-rows.ts

@@ -129,8 +129,9 @@ export function prismaRows(delegate: PrismaDelegate, client: unknown): ResourceR
       return delegate.findUnique({ where: { id } });
     },
 
-    async titles(ids, titleField) {
-      const rows = await delegate.findMany({ where: { id: { in: ids } }, select: { id: true, [titleField]: true } });
+    async titles(ids, titleField, owner) {
+      const where = owner ? { id: { in: ids }, [owner.field]: owner.value } : { id: { in: ids } };
+      const rows = await delegate.findMany({ where, select: { id: true, [titleField]: true } });
       return rows.map((row) => ({ id: String(row.id), title: row[titleField] }));
     },