@rebasepro/cli 0.0.1-canary.0 → 0.0.1-canary.09e5ec5

package/templates/template/backend/Dockerfile

@@ -1,25 +1,70 @@
-FROM node:24-alpine AS base
+# ─── Multi-stage production Dockerfile for the Rebase backend ─────────
+# Produces a minimal image (~150MB) with only the runtime needed.
+#
+# Build context: the project root (where pnpm-workspace.yaml lives)
+# Usage:
+#   docker build -t my-app-backend -f backend/Dockerfile .
+#   docker run -p 3001:3001 --env-file .env my-app-backend
+
+# ── Stage 1: Install + Build ─────────────────────────────────────────
+FROM node:22-alpine AS builder
+
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable
+
+# Native dependencies for bcrypt, pg, etc.
 RUN apk add --no-cache python3 make g++
 
 WORKDIR /app
 
-# Copy root configurations
-COPY package.json ./
+# Copy workspace root files first (cache-friendly layer)
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
-# Copy internal workspaces
+# Copy workspace packages
 COPY backend ./backend
-COPY shared ./shared
+COPY config ./config
+
+# Install all deps (including devDependencies for build)
+RUN pnpm install --frozen-lockfile
+
+# Build config first, then backend
+RUN pnpm --filter "*-config" run build
+RUN pnpm --filter "*-backend" run build
+
+# Prune dev dependencies for a smaller runtime
+RUN pnpm install --frozen-lockfile --prod
+
+# ── Stage 2: Production Runtime ──────────────────────────────────────
+FROM node:22-alpine AS runtime
+
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+ENV NODE_ENV=production
+
+RUN corepack enable
 
-# Install dependencies
-RUN pnpm install
+# Security: run as non-root
+RUN addgroup -g 1001 rebase && adduser -u 1001 -G rebase -s /bin/sh -D rebase
+
+WORKDIR /app
 
-# Build shared and backend
-RUN pnpm run build:shared
-RUN pnpm run build:backend
+# Copy only production artifacts
+COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml ./
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/backend ./backend
+COPY --from=builder /app/config ./config
+
+# Create uploads directory
+RUN mkdir -p /app/backend/uploads && chown -R rebase:rebase /app
+
+USER rebase
 
 WORKDIR /app/backend
 EXPOSE 3001
+
+# Health check for orchestrators (Docker Compose, ECS, k8s)
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=10s \
+    CMD wget --no-verbose --tries=1 --spider http://localhost:3001/health || exit 1
+
 CMD ["pnpm", "start"]

package/templates/template/backend/drizzle.config.ts

@@ -7,8 +7,9 @@ if (!process.env.DATABASE_URL) {
     throw new Error("DATABASE_URL is not set. Make sure .env file exists in the project root and contains DATABASE_URL");
 }
 
-// Extract table names from the generated schema
-// This ensures drizzle-kit ONLY manages tables defined in the schema
+// Extract table names from the generated schema.
+// This ensures drizzle-kit ONLY manages tables defined in the schema.
+// Any tables in the database that are NOT part of the Rebase schema are left untouched.
 const tableNames = Object.values(tables).map(table => getTableName(table as Table));
 
 export default defineConfig({
@@ -18,5 +19,16 @@ export default defineConfig({
     dbCredentials: {
         url: process.env.DATABASE_URL
     },
-    tablesFilter: tableNames
+    // Only manage tables defined in the generated schema.
+    // Unmapped tables in the database are completely ignored.
+    tablesFilter: tableNames,
+    // Restrict drizzle-kit to the public schema only — tables in other schemas
+    // (e.g. extensions, custom schemas) are never touched.
+    schemaFilter: ["public"],
+    // Prevent drizzle-kit from managing roles not defined in the schema
+    entities: {
+        roles: false
+    },
+    // If PostGIS or other extensions create helper tables, ignore them
+    extensionsFilters: ["postgis"]
 });

package/templates/template/backend/functions/hello.ts

@@ -0,0 +1,52 @@
+import { Hono } from "hono";
+import type { HonoEnv } from "@rebasepro/server-core";
+import { rebase } from "@rebasepro/server-core";
+
+/**
+ * Example custom function route.
+ *
+ * This file is auto-discovered by Rebase and mounted at:
+ *   POST /api/functions/hello
+ *   GET  /api/functions/hello
+ *
+ * Call from the client SDK:
+ *   const result = await client.call("functions/hello", { name: "World" });
+ *
+ * This is a standard Hono app — use any Hono middleware,
+ * define any HTTP methods, access the request/response directly.
+ *
+ * The `rebase` singleton gives you admin-level access to all
+ * app-scoped services (data, auth, storage, email) from anywhere.
+ * For request-scoped / RLS-scoped access, use c.get("user") and c.get("driver").
+ */
+const app = new Hono<HonoEnv>();
+
+app.post("/", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const user = c.get("user");
+
+    const userId = (user && typeof user === "object" && "userId" in user)
+        ? user.userId
+        : "anonymous";
+
+    // Access any Rebase service — just import and use:
+    // await rebase.email?.send({
+    //     to: "admin@example.com",
+    //     subject: "Function called",
+    //     html: `<p>Hello from ${userId}!</p>`,
+    // });
+    //
+    // const authors = await rebase.data.authors.find({ limit: 5 });
+
+    return c.json({
+        message: `Hello, ${body.name || "World"}!`,
+        user: userId
+    });
+});
+
+app.get("/", (c) => {
+    return c.json({ status: "ok",
+endpoint: "hello" });
+});
+
+export default app;

package/templates/template/backend/package.json

@@ -1,36 +1,32 @@
 {
-  "name": "{{PROJECT_NAME}}-backend",
-  "version": "1.0.0",
-  "description": "Rebase backend with PostgreSQL",
-  "main": "src/index.ts",
-  "type": "module",
-  "scripts": {
-    "dev": "tsx watch --watch=\"../shared/**/*\" src/index.ts",
-    "build": "tsc --noEmit",
-    "start": "tsx src/index.ts",
-    "generate:schema": "tsx node_modules/@rebasepro/backend/src/generate-drizzle-schema.ts --collections=../shared/collections --output=src/schema.generated.ts",
-    "db:generate": "pnpm generate:schema && tsx scripts/db-generate.ts",
-    "db:migrate": "DOTENV_CONFIG_PATH=../.env drizzle-kit migrate",
-    "db:push": "DOTENV_CONFIG_PATH=../.env drizzle-kit push",
-    "db:studio": "DOTENV_CONFIG_PATH=../.env drizzle-kit studio"
-  },
-  "dependencies": {
-    "{{PROJECT_NAME}}-shared": "workspace:*",
-    "@rebasepro/backend": "^4.0.0",
-    "cors": "^2.8.5",
-    "drizzle-orm": "^0.44.4",
-    "express": "^5.1.0",
-    "pg": "^8.11.3",
-    "ws": "^8.16.0",
-    "zod": "^3.22.4",
-    "dotenv": "^16.0.0"
-  },
-  "devDependencies": {
-    "@types/pg": "^8.6.5",
-    "@types/node": "^20.10.5",
-    "@types/ws": "^8.5.10",
-    "drizzle-kit": "^0.31.4",
-    "tsx": "^4.20.6",
-    "typescript": "^5.9.2"
-  }
+    "name": "{{PROJECT_NAME}}-backend",
+    "version": "1.0.0",
+    "description": "Rebase backend with PostgreSQL",
+    "main": "src/index.ts",
+    "type": "module",
+    "scripts": {
+        "dev": "tsx watch --watch=\"../config/**/*\" src/index.ts",
+        "build": "tsc --noEmit",
+        "start": "tsx src/index.ts"
+    },
+    "dependencies": {
+        "{{PROJECT_NAME}}-config": "workspace:*",
+        "@rebasepro/server-core": "workspace:*",
+        "@rebasepro/server-postgresql": "workspace:*",
+        "drizzle-orm": "^0.44.4",
+        "hono": "^4.2.0",
+        "@hono/node-server": "^1.11.0",
+        "pg": "^8.11.3",
+        "ws": "^8.16.0",
+        "zod": "^3.22.4",
+        "dotenv": "^16.0.0"
+    },
+    "devDependencies": {
+        "@types/pg": "^8.6.5",
+        "@types/node": "^20.10.5",
+        "@types/ws": "^8.5.10",
+        "drizzle-kit": "^0.31.4",
+        "tsx": "^4.20.6",
+        "typescript": "^5.9.2"
+    }
 }

package/templates/template/backend/src/env.ts

@@ -0,0 +1,52 @@
+import { z } from "zod";
+import * as dotenv from "dotenv";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+dotenv.config({ path: path.resolve(__dirname, "../../.env") });
+
+const envSchema = z.object({
+    NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
+    PORT: z.string().default("3001").transform(Number),
+    DATABASE_URL: z.string().url("DATABASE_URL must be a valid URL"),
+    ADMIN_CONNECTION_STRING: z.string().url().optional(),
+    JWT_SECRET: z.string().min(32, "JWT_SECRET must be at least 32 characters long"),
+    JWT_ACCESS_EXPIRES_IN: z.string().default("1h"),
+    JWT_REFRESH_EXPIRES_IN: z.string().default("30d"),
+    GOOGLE_CLIENT_ID: z.string().optional(),
+    ALLOW_REGISTRATION: z.enum(["true", "false", ""]).default("false").transform(v => v === "true"),
+    CORS_ORIGINS: z.string().optional(),
+    FRONTEND_URL: z.string().optional(),
+    DB_POOL_MAX: z.string().default("20").transform(Number),
+    DB_POOL_IDLE_TIMEOUT: z.string().default("30000").transform(Number),
+    DB_POOL_CONNECT_TIMEOUT: z.string().default("10000").transform(Number),
+    FORCE_LOCAL_STORAGE: z.enum(["true", "false", ""]).optional().transform(v => v === "true"),
+    STORAGE_TYPE: z.enum(["local", "s3"]).default("local"),
+    STORAGE_PATH: z.string().optional(),
+    S3_BUCKET: z.string().optional(),
+    S3_REGION: z.string().optional(),
+    S3_ACCESS_KEY_ID: z.string().optional(),
+    S3_SECRET_ACCESS_KEY: z.string().optional(),
+    S3_ENDPOINT: z.string().url().optional(),
+    S3_FORCE_PATH_STYLE: z.enum(["true", "false", ""]).optional().transform(v => v === "true"),
+    /**
+     * Service key for admin-level script / server-to-server authentication.
+     * When set, scripts can send `Authorization: Bearer <key>` to get admin access.
+     * Generate with: node -e "console.log(require('crypto').randomBytes(48).toString('base64'))"
+     */
+    REBASE_SERVICE_KEY: z.string().min(32, "REBASE_SERVICE_KEY must be at least 32 characters").optional()
+}).superRefine((data, ctx) => {
+    if (data.NODE_ENV === "production" && !data.CORS_ORIGINS && !data.FRONTEND_URL) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "CORS_ORIGINS or FRONTEND_URL must be set in production to secure the API.",
+            path: ["CORS_ORIGINS"]
+        });
+    }
+});
+
+// Parse and export
+export const env = envSchema.parse(process.env);

package/templates/template/backend/src/index.ts

@@ -1,134 +1,148 @@
-import express from "express";
-import cors from "cors";
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { secureHeaders } from "hono/secure-headers";
+import { getRequestListener } from "@hono/node-server";
+import { createServer } from "http";
 import path from "path";
 import { fileURLToPath } from "url";
-import { createServer } from "http";
-import { createPostgresDatabaseConnection, initializeRebaseAPI, initializeRebaseBackend, serveSPA } from "@rebasepro/backend";
-
+import {
+    initializeRebaseBackend,
+    serveSPA,
+    HonoEnv,
+    listenWithPortRetry,
+    cleanupDevPortFile,
+    logger
+} from "@rebasepro/server-core";
+import { createPostgresDatabaseConnection, createPostgresBootstrapper } from "@rebasepro/server-postgresql";
 import { enums, relations, tables } from "./schema.generated";
-
-import * as dotenv from "dotenv";
+import { env } from "./env";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-// Load environment from project root
-dotenv.config({ path: path.resolve(__dirname, "../../.env") });
+// ─── App ─────────────────────────────────────────────────────────────
+const app = new Hono<HonoEnv>();
 
-const app = express();
-const server = createServer(app);
+const isProduction = env.NODE_ENV === "production";
+const allowedOrigins = isProduction
+    ? (env.CORS_ORIGINS || env.FRONTEND_URL || "https://yourdomain.com").split(",").map(s => s.trim())
+    : [];
 
-// PostgreSQL connection
-const databaseUrl = process.env.DATABASE_URL;
-if (!databaseUrl) {
-    throw new Error("DATABASE_URL environment variable is not set");
-}
-const db = createPostgresDatabaseConnection(databaseUrl);
+app.use("/*", cors({
+    origin: (origin) => {
+        if (!isProduction) return origin || "*";
+        return allowedOrigins.includes(origin) ? origin : null;
+    },
+    credentials: true
+}));
 
-// Middleware
-app.use(cors());
-app.use(express.json({ limit: "10mb" }));
+app.use("/*", secureHeaders());
 
+// ─── Database ────────────────────────────────────────────────────────
+const databaseUrl = env.DATABASE_URL;
+
+const { db, pool, connectionString } = createPostgresDatabaseConnection(databaseUrl);
+
+// ─── Start ───────────────────────────────────────────────────────────
 async function startServer() {
-    const jwtSecret = process.env.JWT_SECRET;
-    if (!jwtSecret) {
-        throw new Error("JWT_SECRET environment variable is not set");
-    }
+    const jwtSecret = env.JWT_SECRET;
+    const PORT = env.PORT;
+    const server = createServer(getRequestListener(app.fetch));
 
-    // Initialize Rebase Backend with auth
     const backend = await initializeRebaseBackend({
-        collectionsDir: path.resolve(__dirname, "../../shared/collections"),
+        collectionsDir: path.resolve(__dirname, "../../config/collections"),
+        functionsDir: path.resolve(__dirname, "../functions"),
         server,
         app,
-        datasource: {
-            "(default)": {
+        bootstrappers: [
+            createPostgresBootstrapper({
                 connection: db,
-                schema: { tables, enums, relations },
-                adminConnectionString: process.env.ADMIN_CONNECTION_STRING || process.env.DATABASE_URL
-            }
-        },
+                schema: { tables,
+enums,
+relations },
+                adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
+                connectionString
+            })
+        ],
         auth: {
             jwtSecret,
-            accessExpiresIn: process.env.JWT_ACCESS_EXPIRES_IN || "1h",
-            refreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || "30d",
-            google: process.env.GOOGLE_CLIENT_ID ? {
-                clientId: process.env.GOOGLE_CLIENT_ID
-            } : undefined,
+            accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
+            refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
+            serviceKey: env.REBASE_SERVICE_KEY,
+            google: env.GOOGLE_CLIENT_ID
+                ? { clientId: env.GOOGLE_CLIENT_ID }
+                : undefined,
             seedDefaultRoles: true,
-            allowRegistration: process.env.ALLOW_REGISTRATION === "true",
-            email: process.env.SMTP_HOST ? {
-                from: process.env.SMTP_FROM || "noreply@example.com",
-                appName: process.env.APP_NAME || "Rebase",
-                resetPasswordUrl: process.env.FRONTEND_URL || "http://localhost:5173",
-                verifyEmailUrl: process.env.FRONTEND_URL || "http://localhost:5173",
-                smtp: {
-                    host: process.env.SMTP_HOST,
-                    port: parseInt(process.env.SMTP_PORT || "587"),
-                    secure: process.env.SMTP_SECURE === "true",
-                    auth: process.env.SMTP_USER ? {
-                        user: process.env.SMTP_USER,
-                        pass: process.env.SMTP_PASS || ""
-                    } : undefined
-                }
-            } : undefined
+            allowRegistration: env.ALLOW_REGISTRATION
         },
-        storage: {
-            type: "local",
-            basePath: path.resolve(__dirname, "../../uploads")
-        }
+        storage: env.STORAGE_TYPE === "s3"
+            ? {
+                type: "s3",
+                bucket: env.S3_BUCKET!,
+                region: env.S3_REGION || "auto",
+                accessKeyId: env.S3_ACCESS_KEY_ID || "",
+                secretAccessKey: env.S3_SECRET_ACCESS_KEY || "",
+                endpoint: env.S3_ENDPOINT,
+                forcePathStyle: env.S3_FORCE_PATH_STYLE
+            }
+            : {
+                type: "local",
+                basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
+            },
+        history: true
     });
 
-    // Initialize REST/GraphQL API
-    await initializeRebaseAPI(app, backend, {
-        basePath: "/api",
-        collectionsDir: path.resolve(__dirname, "../../shared/collections"),
-        enableGraphQL: true,
-        enableREST: true,
-        cors: {
-            origin: true,
-            credentials: true
-        }
+    // ─── Health check ─────────────────────────────────────────────
+    app.get("/health", async (c) => {
+        const result = await backend.healthCheck();
+        const status = result.healthy ? 200 : 503;
+        return c.json({
+            status: result.healthy ? "ok" : "degraded",
+            latencyMs: result.latencyMs,
+            ...(result.details ? { details: result.details } : {})
+        }, status);
     });
 
-    // Serve SPA in production
-    if (process.env.NODE_ENV === "production") {
-        serveSPA(app, {
-            frontendPath: path.join(__dirname, "../../frontend/dist"),
-            excludePaths: ["/health"]
-        });
+    // Serve the frontend in production
+    if (isProduction) {
+        serveSPA(app, { frontendPath: path.join(__dirname, "../../frontend/dist") });
     }
 
-    app.get("/health", (req, res) => {
-        res.json({
-            status: "ok",
-            timestamp: new Date().toISOString(),
-            environment: process.env.NODE_ENV
-        });
-    });
-
-    // Error handling
-    app.use((error: Error, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
-        console.error("Unhandled error:", error);
-        res.status(500).json({
-            error: "Internal server error",
-            message: error.message
+    if (!isProduction) {
+        // Dev mode: retry the next port if the current one is in use
+        const projectRoot = path.resolve(__dirname, "../..");
+        const actualPort = await listenWithPortRetry(server, PORT, { portFileDir: projectRoot });
+
+        // Clean up port file on exit
+        const cleanup = () => cleanupDevPortFile(projectRoot);
+        process.on("SIGINT", cleanup);
+        process.on("SIGTERM", cleanup);
+        process.on("exit", cleanup);
+
+        logger.info(`Server running at http://localhost:${actualPort}`);
+    } else {
+        server.listen(PORT, () => {
+            logger.info(`Server running at http://localhost:${PORT}`);
         });
-    });
-
-    const PORT = process.env.PORT || 3001;
+    }
 
-    server.listen(PORT, () => {
-        console.log(`🚀 Server running at http://localhost:${PORT}`);
-        console.log(`   • REST API: http://localhost:${PORT}/api`);
-        console.log(`   • GraphQL: http://localhost:${PORT}/api/graphql`);
-        console.log(`   • Swagger docs: http://localhost:${PORT}/api/swagger`);
-        console.log(`   • Health: http://localhost:${PORT}/health`);
-    });
+    // ─── Graceful Shutdown ───────────────────────────────────────────────
+    // Uses the framework's built-in shutdown() which drains connections,
+    // stops the cron scheduler, and force-exits after 15s timeout.
+    const gracefulShutdown = async (signal: string) => {
+        logger.info(`Received ${signal}, shutting down...`);
+        await backend.shutdown();
+        await pool.end();
+        logger.info("Database pool closed");
+        process.exit(0);
+    };
+    process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
+    process.on("SIGINT", () => gracefulShutdown("SIGINT"));
 }
 
 startServer().catch(err => {
-    console.error("Failed to start server:", err);
+    logger.error("Failed to start server", { error: err instanceof Error ? err : new Error(String(err)) });
     process.exit(1);
 });
 
-export { app, server };
+export { app };

package/templates/template/backend/tsconfig.json

@@ -15,5 +15,5 @@
     "sourceMap": true,
     "jsx": "preserve"
   },
-  "include": ["src/**/*", "../shared/**/*", "drizzle.config.ts"]
+  "include": ["src/**/*", "../config/**/*", "drizzle.config.ts"]
 }

package/templates/template/config/collections/authors.ts

@@ -0,0 +1,45 @@
+import { EntityCollection } from "@rebasepro/types";
+
+const authorsCollection: EntityCollection = {
+    name: "Authors",
+    singularName: "Author",
+    slug: "authors",
+    table: "authors",
+    icon: "Person",
+    properties: {
+        id: {
+            name: "ID",
+            type: "number",
+            isId: "increment"
+        },
+        name: {
+            name: "Name",
+            type: "string",
+            validation: {
+                required: true
+            }
+        },
+        email: {
+            name: "Email",
+            type: "string",
+            validation: {
+                required: true
+            }
+        },
+        picture: {
+            name: "Picture",
+            type: "string",
+            storage: {
+                storagePath: "author_pictures/"
+            }
+        }
+    },
+    propertiesOrder: [
+        "id",
+        "name",
+        "email",
+        "picture"
+    ]
+};
+
+export default authorsCollection;

package/templates/template/config/collections/index.ts

@@ -0,0 +1,5 @@
+import postsCollection from "./posts";
+import authorsCollection from "./authors";
+import tagsCollection from "./tags";
+
+export const collections = [postsCollection, authorsCollection, tagsCollection];

package/templates/template/{shared → config}/collections/posts.ts

@@ -1,10 +1,12 @@
 import { EntityCollection } from "@rebasepro/types";
+import authorsCollection from "./authors";
+import tagsCollection from "./tags";
 
 const postsCollection: EntityCollection = {
     name: "Posts",
     singularName: "Post",
     slug: "posts",
-    dbPath: "posts",
+    table: "posts",
     icon: "Article",
     properties: {
         id: {
@@ -46,8 +48,44 @@ const postsCollection: EntityCollection = {
                     color: "greenLight"
                 }
             ]
+        },
+        author: {
+            name: "Author",
+            type: "relation",
+            relationName: "author",
+            relation: {
+                relationName: "author",
+                cardinality: "one",
+                direction: "owning",
+                target: () => authorsCollection
+            }
+        },
+        tags: {
+            name: "Tags",
+            type: "relation",
+            relationName: "tags",
+            relation: {
+                relationName: "tags",
+                cardinality: "many",
+                direction: "owning",
+                target: () => tagsCollection
+            }
+        }
+    },
+    relations: [
+        {
+            relationName: "author",
+            target: () => authorsCollection,
+            cardinality: "one",
+            direction: "owning"
+        },
+        {
+            relationName: "tags",
+            target: () => tagsCollection,
+            cardinality: "many",
+            direction: "owning"
         }
-    }
+    ]
 };
 
 export default postsCollection;