@nextsparkjs/core 0.1.0-beta.75 → 0.1.0-beta.77

package/templates/app/api/devtools/config/entities/route.ts

@@ -1,13 +1,6 @@
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { auth } from "@nextsparkjs/core/lib/auth";
 import { NextResponse } from "next/server";
-import { getEntityRegistry } from "@nextsparkjs/core/lib/entities/queries";
-import type { EntityConfig, ChildEntityDefinition } from "@nextsparkjs/core/lib/entities/types";
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
-
-// Type guard to check if entity is a full EntityConfig
-function isEntityConfig(entity: EntityConfig | ChildEntityDefinition): entity is EntityConfig {
-  return 'slug' in entity
-}
+import { ENTITY_REGISTRY } from "@nextsparkjs/registries/entity-registry";
 
 /**
  * Entity information structure
@@ -30,8 +23,11 @@ interface EntityInfo {
     label?: string;
     required?: boolean;
   }[];
-  // Note: Permissions are now defined centrally in permissions.config.ts
-  // Use PermissionService to query entity permissions
+  // Permissions are now optional in entity config (centralized in permissions.config.ts)
+  permissions?: {
+    actions: Array<{ action: string; label: string; description?: string }>;
+    customActions?: Array<{ action: string; label: string; description?: string }>;
+  };
 }
 
 /**
@@ -40,10 +36,10 @@ interface EntityInfo {
  * Returns entity registry information
  * Only accessible to developer role
  */
-export const GET = withRateLimitTier(async (request: Request) => {
+export async function GET(request: Request) {
   try {
     // Verify developer role
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({ headers: request.headers });
 
     if (!session?.user || session.user.role !== "developer") {
       return NextResponse.json(
@@ -57,12 +53,9 @@ export const GET = withRateLimitTier(async (request: Request) => {
 
     // Build entity info array
     const entities: EntityInfo[] = [];
-    const registry = getEntityRegistry();
 
-    for (const [, entry] of Object.entries(registry)) {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const config = (entry as any).config;
-      if (!isEntityConfig(config)) continue;
+    for (const [, entry] of Object.entries(ENTITY_REGISTRY)) {
+      const config = entry.config;
 
       entities.push({
         slug: config.slug,
@@ -82,7 +75,6 @@ export const GET = withRateLimitTier(async (request: Request) => {
           label: field.label,
           required: field.required,
         })) || [],
-        // Note: Permissions are now centralized in permissions.config.ts
       });
     }
 
@@ -113,4 +105,4 @@ export const GET = withRateLimitTier(async (request: Request) => {
       { status: 500 }
     );
   }
-}, 'read');
+}

package/templates/app/api/devtools/config/theme/route.ts

@@ -1,7 +1,6 @@
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { auth } from "@nextsparkjs/core/lib/auth";
 import { NextResponse } from "next/server";
 import { ThemeService } from "@nextsparkjs/core/lib/services/theme.service";
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 /**
  * GET /api/devtools/config/theme
@@ -9,10 +8,10 @@ import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
  * Returns current theme configuration
  * Only accessible to developer role
  */
-export const GET = withRateLimitTier(async (request: Request) => {
+export async function GET(request: Request) {
   try {
     // Verify developer role
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({ headers: request.headers });
 
     if (!session?.user || session.user.role !== "developer") {
       return NextResponse.json(
@@ -64,4 +63,4 @@ export const GET = withRateLimitTier(async (request: Request) => {
       { status: 500 }
     );
   }
-}, 'read');
+}

package/templates/app/api/devtools/tests/[...path]/route.ts

@@ -1,9 +1,8 @@
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { auth } from "@nextsparkjs/core/lib/auth";
 import { NextResponse } from "next/server";
 import { readFile, stat } from "fs/promises";
 import { join } from "path";
 import matter from "gray-matter";
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 /**
  * GET /api/devtools/tests/[...path]
@@ -13,13 +12,13 @@ import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
  *
  * @param path - Array of path segments (e.g., ['auth', 'login.md'])
  */
-export const GET = withRateLimitTier(async (
+export async function GET(
   request: Request,
   { params }: { params: Promise<{ path: string[] }> }
-) => {
+) {
   try {
     // Verify developer role
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({ headers: request.headers });
 
     if (!session?.user || session.user.role !== "developer") {
       return NextResponse.json(
@@ -128,4 +127,4 @@ export const GET = withRateLimitTier(async (
       { status: 500 }
     );
   }
-}, 'read');
+}

package/templates/app/api/devtools/tests/route.ts

@@ -1,8 +1,7 @@
-import { getTypedSession } from "@nextsparkjs/core/lib/auth";
+import { auth } from "@nextsparkjs/core/lib/auth";
 import { NextResponse } from "next/server";
 import { readdir, stat } from "fs/promises";
 import { join } from "path";
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 /**
  * File tree node structure
@@ -59,10 +58,10 @@ async function buildFileTree(dirPath: string, basePath: string): Promise<FileTre
  * Returns file tree structure of test documentation files
  * Only accessible to developer role
  */
-export const GET = withRateLimitTier(async (request: Request) => {
+export async function GET(request: Request) {
   try {
     // Verify developer role
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({ headers: request.headers });
 
     if (!session?.user || session.user.role !== "developer") {
       return NextResponse.json(
@@ -132,4 +131,4 @@ export const GET = withRateLimitTier(async (request: Request) => {
       { status: 500 }
     );
   }
-}, 'read');
+}

package/templates/app/api/health/route.ts

@@ -1,13 +1,11 @@
 import { queryWithRLS } from "@nextsparkjs/core/lib/db";
-import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
-import { NextResponse } from "next/server";
 
-export const GET = withRateLimitTier(async () => {
+export async function GET() {
   try {
     // Test database connection
     await queryWithRLS('SELECT 1');
     
-    return NextResponse.json({
+    return Response.json({ 
       status: 'healthy',
       timestamp: new Date().toISOString(),
       services: {
@@ -17,7 +15,7 @@ export const GET = withRateLimitTier(async () => {
     });
   } catch (error) {
     console.error('Health check failed:', error);
-    return NextResponse.json({
+    return Response.json({ 
       status: 'unhealthy',
       timestamp: new Date().toISOString(),
       error: 'Database connection failed',
@@ -27,5 +25,5 @@ export const GET = withRateLimitTier(async () => {
       }
     }, { status: 503 });
   }
-}, 'read');
+}
 

package/templates/app/api/internal/user-metadata/route.ts

@@ -1,9 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { MetaService } from '@nextsparkjs/core/lib/services/meta.service'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 // Endpoint interno para crear metadata default después del signup
-export const POST = withRateLimitTier(async (req: NextRequest) => {
+export async function POST(req: NextRequest) {
   try {
     const body = await req.json()
     const { userId, metadata } = body
@@ -34,4 +33,4 @@ export const POST = withRateLimitTier(async (req: NextRequest) => {
       error: 'Internal server error'
     }, { status: 500 })
   }
-}, 'write');
+}

package/templates/app/api/superadmin/subscriptions/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { getTypedSession } from '@nextsparkjs/core/lib/auth';
+import { auth } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 interface SubscriptionResult {
   id: string;
@@ -52,10 +51,12 @@ interface PlanDistribution {
  * Retrieves all subscriptions with stats for superadmin overview.
  * Supports filtering by status and pagination.
  */
-export const GET = withRateLimitTier(async (request: NextRequest) => {
+export async function GET(request: NextRequest) {
   try {
     // Get the current session using Better Auth
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({
+      headers: request.headers
+    });
 
     // Check if user is authenticated
     if (!session?.user) {
@@ -306,4 +307,4 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
       { status: 500 }
     );
   }
-}, 'strict');
+}

package/templates/app/api/superadmin/teams/[teamId]/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { getTypedSession } from '@nextsparkjs/core/lib/auth';
+import { auth } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 interface TeamResult {
   id: string;
@@ -63,15 +62,17 @@ interface UsageResult {
  * Retrieves a single team with owner info and members.
  * Only accessible by superadmin or developer users.
  */
-export const GET = withRateLimitTier(async (
+export async function GET(
   request: NextRequest,
   { params }: { params: Promise<{ teamId: string }> }
-) => {
+) {
   try {
     const { teamId } = await params;
 
     // Get the current session using Better Auth
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({
+      headers: request.headers
+    });
 
     // Check if user is authenticated
     if (!session?.user) {
@@ -282,4 +283,4 @@ export const GET = withRateLimitTier(async (
       { status: 500 }
     );
   }
-}, 'strict');
+}

package/templates/app/api/superadmin/teams/route.ts

@@ -1,8 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { getTypedSession } from '@nextsparkjs/core/lib/auth';
+import { auth } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
 import { SYSTEM_ADMIN_TEAM_ID } from '@nextsparkjs/core/lib/api/auth/dual-auth';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 interface TeamWithStats {
   id: string;
@@ -32,10 +31,12 @@ interface TeamWithStats {
  * - counts: Object with team counts
  * - pagination: Pagination info
  */
-export const GET = withRateLimitTier(async (request: NextRequest) => {
+export async function GET(request: NextRequest) {
   try {
     // Get the current session using Better Auth
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({
+      headers: request.headers
+    });
 
     // Check if user is authenticated
     if (!session?.user) {
@@ -184,4 +185,4 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
       { status: 500 }
     );
   }
-}, 'strict');
+}

package/templates/app/api/superadmin/users/[userId]/route.ts

@@ -1,7 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { getTypedSession } from '@nextsparkjs/core/lib/auth';
+import { auth } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 interface UserResult {
   id: string;
@@ -47,10 +46,12 @@ interface RouteParams {
  * - teams: Array of team memberships
  * - stats: User statistics
  */
-export const GET = withRateLimitTier(async (request: NextRequest, { params }: RouteParams) => {
+export async function GET(request: NextRequest, { params }: RouteParams) {
   try {
     // Get the current session using Better Auth
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({
+      headers: request.headers
+    });
 
     // Check if user is authenticated
     if (!session?.user) {
@@ -213,7 +214,7 @@ export const GET = withRateLimitTier(async (request: NextRequest, { params }: Ro
       { status: 500 }
     );
   }
-}, 'strict');
+}
 
 interface UserActionBody {
   action: 'change-role' | 'suspend' | 'unsuspend' | 'verify-email';
@@ -232,10 +233,12 @@ interface UserActionBody {
  * - unsuspend: Restore user's role to 'member'
  * - verify-email: Manually verify user's email
  */
-export const PATCH = withRateLimitTier(async (request: NextRequest, { params }: RouteParams) => {
+export async function PATCH(request: NextRequest, { params }: RouteParams) {
   try {
     // Get the current session using Better Auth
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({
+      headers: request.headers
+    });
 
     // Check if user is authenticated
     if (!session?.user) {
@@ -391,7 +394,7 @@ export const PATCH = withRateLimitTier(async (request: NextRequest, { params }:
       { status: 500 }
     );
   }
-}, 'strict');
+}
 
 /**
  * DELETE /api/superadmin/users/[userId]
@@ -404,10 +407,12 @@ export const PATCH = withRateLimitTier(async (request: NextRequest, { params }:
  * - Delete user's personal team
  * - Delete the user account
  */
-export const DELETE = withRateLimitTier(async (request: NextRequest, { params }: RouteParams) => {
+export async function DELETE(request: NextRequest, { params }: RouteParams) {
   try {
     // Get the current session using Better Auth
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({
+      headers: request.headers
+    });
 
     // Check if user is authenticated
     if (!session?.user) {
@@ -532,4 +537,4 @@ export const DELETE = withRateLimitTier(async (request: NextRequest, { params }:
       { status: 500 }
     );
   }
-}, 'strict');
+}

package/templates/app/api/superadmin/users/route.ts

@@ -1,8 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { getTypedSession } from '@nextsparkjs/core/lib/auth';
+import { auth } from '@nextsparkjs/core/lib/auth';
 import { queryWithRLS } from '@nextsparkjs/core/lib/db';
 import type { User } from '@nextsparkjs/core/types/user.types';
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
 
 /**
  * GET /api/superadmin/users
@@ -24,10 +23,12 @@ import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit';
  * - counts: Object with user counts
  * - pagination: Pagination info for the active tab
  */
-export const GET = withRateLimitTier(async (request: NextRequest) => {
+export async function GET(request: NextRequest) {
   try {
     // Get the current session using Better Auth
-    const session = await getTypedSession(request.headers);
+    const session = await auth.api.getSession({
+      headers: request.headers
+    });
 
     // Check if user is authenticated
     if (!session?.user) {
@@ -293,7 +294,7 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
       { status: 500 }
     );
   }
-}, 'strict');
+}
 
 /**
  * POST /api/superadmin/users
@@ -301,12 +302,12 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
  * Future endpoint for user management actions (create, update roles, etc.)
  * Currently returns not implemented.
  */
-export const POST = withRateLimitTier(async () => {
+export async function POST() {
   return NextResponse.json(
     { error: 'Not implemented yet' },
     { status: 501 }
   );
-}, 'strict');
+}
 
 /**
  * PUT /api/superadmin/users
@@ -314,9 +315,9 @@ export const POST = withRateLimitTier(async () => {
  * Future endpoint for bulk user operations
  * Currently returns not implemented.
  */
-export const PUT = withRateLimitTier(async () => {
+export async function PUT() {
   return NextResponse.json(
     { error: 'Not implemented yet' },
     { status: 501 }
   );
-}, 'strict');
+}

package/templates/app/api/user/delete-account/route.ts

@@ -1,9 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
 import { auth } from "@nextsparkjs/core/lib/auth";
 import { mutateWithRLS } from "@nextsparkjs/core/lib/db";
-import { withRateLimitTier } from "@nextsparkjs/core/lib/api/rate-limit";
 
-export const DELETE = withRateLimitTier(async (req: NextRequest) => {
+export async function DELETE(req: NextRequest) {
   try {
     // Get session from Better Auth
     const session = await auth.api.getSession({
@@ -53,4 +52,4 @@ export const DELETE = withRateLimitTier(async (req: NextRequest) => {
       { status: 500 }
     );
   }
-}, 'strict');
+}

package/templates/app/api/user/plan-flags/route.ts

@@ -6,11 +6,10 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server'
-import { getTypedSession } from '@nextsparkjs/core/lib/auth'
+import { auth } from '@nextsparkjs/core/lib/auth'
 import { getUserPlanAndFlags, updateUserPlan, updateUserFlags } from '@nextsparkjs/core/lib/user-data'
 import { z } from 'zod'
 import type { UserRole } from '@nextsparkjs/core/types/user.types'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
 // Validation schemas
 const planFlagsQuerySchema = z.object({
@@ -27,10 +26,12 @@ const planFlagsUpdateSchema = z.object({
  * GET /api/user/plan-flags
  * Fetch user plan and flags data
  */
-export const GET = withRateLimitTier(async (request: NextRequest) => {
+export async function GET(request: NextRequest) {
   try {
     // Get session
-    const session = await getTypedSession(request.headers)
+    const session = await auth.api.getSession({
+      headers: request.headers,
+    })
 
     if (!session) {
       return NextResponse.json(
@@ -83,16 +84,18 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
       { status: 500 }
     )
   }
-}, 'read');
+}
 
 /**
  * PATCH /api/user/plan-flags
  * Update user plan and/or flags
  */
-export const PATCH = withRateLimitTier(async (request: NextRequest) => {
+export async function PATCH(request: NextRequest) {
   try {
     // Get session
-    const session = await getTypedSession(request.headers)
+    const session = await auth.api.getSession({
+      headers: request.headers,
+    })
 
     if (!session) {
       return NextResponse.json(
@@ -118,6 +121,14 @@ export const PATCH = withRateLimitTier(async (request: NextRequest) => {
     const userRole = session.user.role as UserRole
 
     // Security check: users can only update their own data unless admin
+    if (userId !== session.user.id && !['admin', 'superadmin'].includes(userRole)) {
+      return NextResponse.json(
+        { error: 'Permission denied' },
+        { status: 403 }
+      )
+    }
+
+    // Additional security: only admins can update other users' data
     if (userId !== session.user.id && !['admin', 'superadmin'].includes(userRole)) {
       return NextResponse.json(
         { error: 'Only admins can update other users data' },
@@ -169,16 +180,18 @@ export const PATCH = withRateLimitTier(async (request: NextRequest) => {
       { status: 500 }
     )
   }
-}, 'write');
+}
 
 /**
  * POST /api/user/plan-flags/bulk
  * Bulk update user plans and flags (admin only)
  */
-export const POST = withRateLimitTier(async (request: NextRequest) => {
+export async function POST(request: NextRequest) {
   try {
     // Get session
-    const session = await getTypedSession(request.headers)
+    const session = await auth.api.getSession({
+      headers: request.headers,
+    })
 
     if (!session) {
       return NextResponse.json(
@@ -219,7 +232,7 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
     }
 
     const { updates } = validation.data
-    const results: Array<{ success: boolean; userId: string; plan?: boolean; flags?: boolean; error?: string }> = []
+    const results = []
 
     // Process each update
     for (const update of updates) {
@@ -267,4 +280,4 @@ export const POST = withRateLimitTier(async (request: NextRequest) => {
       { status: 500 }
     )
   }
-}, 'strict');
+}

package/templates/app/api/user/profile/route.ts

@@ -1,12 +1,11 @@
-import { NextRequest, NextResponse } from 'next/server'
+import { NextResponse } from 'next/server'
 import { auth } from '@nextsparkjs/core/lib/auth'
 import { headers } from 'next/headers'
 import { queryOneWithRLS, mutateWithRLS, queryOne } from '@nextsparkjs/core/lib/db'
 import { profileSchema } from '@nextsparkjs/core/lib/validation'
 import { MetaService } from '@nextsparkjs/core/lib/services/meta.service'
-import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
 
-export const GET = withRateLimitTier(async (request: NextRequest) => {
+export async function GET(request: Request) {
   const url = new URL(request.url)
   const includeMeta = url.searchParams.get('includeMeta') === 'true'
   try {
@@ -54,9 +53,9 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
     console.error('Error fetching user profile:', error)
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
-}, 'read');
+}
 
-export const PATCH = withRateLimitTier(async (request: NextRequest) => {
+export async function PATCH(request: Request) {
   try {
     const sessionHeaders = await headers()
     const session = await auth.api.getSession({ headers: sessionHeaders })
@@ -123,7 +122,7 @@ export const PATCH = withRateLimitTier(async (request: NextRequest) => {
       }
     }
     
-    return NextResponse.json({
+    return NextResponse.json({ 
       message: 'Profile updated successfully',
       success: true
     })
@@ -131,4 +130,4 @@ export const PATCH = withRateLimitTier(async (request: NextRequest) => {
     console.error('Error updating user profile:', error)
     return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
   }
-}, 'write');
+}