@rebasepro/cli 0.0.1-canary.2 → 0.0.1-canary.3263433

package/templates/template/README.md

@@ -2,15 +2,31 @@
 
 A [Rebase](https://rebase.pro) project with a PostgreSQL backend.
 
-## Getting Started
+## Quick Start
 
-### Prerequisites
+### Option 1: Docker (recommended for production)
+
+```bash
+cp .env.example .env
+# Edit .env — set JWT_SECRET and DATABASE_URL (see comments for generators)
+
+docker compose up -d
+```
+
+That's it. Your app is running:
+- **Frontend**: http://localhost (port 80)
+- **Backend API**: http://localhost:3001
+- **PostgreSQL**: localhost:5432
+
+### Option 2: Local Development
+
+#### Prerequisites
 
 - [Node.js](https://nodejs.org) >= 18
 - [pnpm](https://pnpm.io)
 - A PostgreSQL database
 
-### Setup
+#### Setup
 
 1. Install dependencies:
 
@@ -18,17 +34,18 @@ A [Rebase](https://rebase.pro) project with a PostgreSQL backend.
 pnpm install
 ```
 
-2. Configure your database — edit `.env` and set `DATABASE_URL`:
+2. Configure environment:
 
-```
-DATABASE_URL=postgresql://postgres:password@localhost:5432/mydb
+```bash
+cp .env.example .env
+# Edit .env — set DATABASE_URL, JWT_SECRET
 ```
 
-3. Generate and run database migrations:
+3. Generate schema and push to database:
 
 ```bash
-pnpm db:generate
-pnpm db:migrate
+rebase schema generate
+rebase db push
 ```
 
 4. Start the dev server:
@@ -37,23 +54,73 @@ pnpm db:migrate
 pnpm dev
 ```
 
-This starts both the backend (Express + PostgreSQL on port 3001) and the frontend (Vite + React on port 5173) concurrently.
+Backend (Hono + PostgreSQL) on port 3001, frontend (Vite + React) on port 5173.
 
 ## Project Structure
 
 ```
-├── frontend/       # React frontend (Vite)
-├── backend/        # Express backend with PostgreSQL
-├── shared/         # Shared collection definitions
-├── .env            # Environment variables
-└── package.json    # Root workspace config
+├── frontend/           # React frontend (Vite)
+│   ├── Dockerfile      # Production build → nginx
+│   └── nginx.conf      # SPA routing + compression
+├── backend/            # Hono backend with PostgreSQL
+│   ├── Dockerfile      # Multi-stage production build
+│   ├── functions/      # Custom API endpoints (auto-discovered)
+│   └── src/
+├── config/             # Shared collection definitions
+│   └── collections/    # Schema-as-Code TypeScript files
+├── docker-compose.yml  # Production stack (Postgres + Backend + Frontend)
+├── .env.example        # Environment variable reference
+└── package.json        # Root workspace config
+```
+
+### Custom Functions
+
+Drop a Hono app in `backend/functions/` and it's auto-mounted at `/api/functions/<name>`:
+
+```typescript
+// backend/functions/hello.ts
+import { Hono } from "hono";
+const app = new Hono();
+app.post("/", async (c) => {
+    const body = await c.req.json();
+    return c.json({ message: `Hello, ${body.name}!` });
+});
+export default app;
 ```
 
+Call from the client SDK: `client.call("functions/hello", { name: "World" })`
+
 ### Shared Collections
 
-Collections are defined once in `shared/collections/` and used by both the frontend and backend. This ensures your schema stays in sync across the stack.
+Collections are defined once in `config/collections/` and used by both the frontend and backend. This ensures your schema stays in sync across the stack.
+
+## Environment Configuration
+
+All configuration is managed through a single `.env` file in the project root. Both the backend and frontend read from this file:
+
+- **Backend**: loads via `dotenv` from `../../.env` (relative to `backend/src/`)
+- **Frontend**: Vite reads `VITE_*` variables via `envDir` pointing to the project root
+- **Scripts**: load via `dotenv` from the project root
+
+Copy `.env.example` to `.env` to get started. See the comments in `.env.example` for details on each variable.
+
+## Production Deployment
+
+```bash
+# Build and start
+docker compose up -d --build
+
+# View logs
+docker compose logs -f backend
+
+# Stop
+docker compose down
+
+# Stop and remove data
+docker compose down -v
+```
 
 ## Documentation
 
 - [Rebase Docs](https://rebase.pro/docs)
-- [GitHub](https://github.com/rebaseco/rebase)
+- [GitHub](https://github.com/rebasepro/rebase)

package/templates/template/backend/Dockerfile

@@ -1,25 +1,70 @@
-FROM node:24-alpine AS base
+# ─── Multi-stage production Dockerfile for the Rebase backend ─────────
+# Produces a minimal image (~150MB) with only the runtime needed.
+#
+# Build context: the project root (where pnpm-workspace.yaml lives)
+# Usage:
+#   docker build -t my-app-backend -f backend/Dockerfile .
+#   docker run -p 3001:3001 --env-file .env my-app-backend
+
+# ── Stage 1: Install + Build ─────────────────────────────────────────
+FROM node:22-alpine AS builder
+
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable
+
+# Native dependencies for bcrypt, pg, etc.
 RUN apk add --no-cache python3 make g++
 
 WORKDIR /app
 
-# Copy root configurations
-COPY package.json ./
+# Copy workspace root files first (cache-friendly layer)
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
-# Copy internal workspaces
+# Copy workspace packages
 COPY backend ./backend
-COPY shared ./shared
+COPY config ./config
+
+# Install all deps (including devDependencies for build)
+RUN pnpm install --frozen-lockfile
+
+# Build config first, then backend
+RUN pnpm --filter "*-config" run build
+RUN pnpm --filter "*-backend" run build
+
+# Prune dev dependencies for a smaller runtime
+RUN pnpm install --frozen-lockfile --prod
+
+# ── Stage 2: Production Runtime ──────────────────────────────────────
+FROM node:22-alpine AS runtime
+
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+ENV NODE_ENV=production
+
+RUN corepack enable
 
-# Install dependencies
-RUN pnpm install
+# Security: run as non-root
+RUN addgroup -g 1001 rebase && adduser -u 1001 -G rebase -s /bin/sh -D rebase
+
+WORKDIR /app
 
-# Build shared and backend
-RUN pnpm run build:shared
-RUN pnpm run build:backend
+# Copy only production artifacts
+COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml ./
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/backend ./backend
+COPY --from=builder /app/config ./config
+
+# Create uploads directory
+RUN mkdir -p /app/backend/uploads && chown -R rebase:rebase /app
+
+USER rebase
 
 WORKDIR /app/backend
 EXPOSE 3001
+
+# Health check for orchestrators (Docker Compose, ECS, k8s)
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 --start-period=10s \
+    CMD wget --no-verbose --tries=1 --spider http://localhost:3001/health || exit 1
+
 CMD ["pnpm", "start"]

package/templates/template/backend/drizzle.config.ts

@@ -1,14 +1,23 @@
-import "dotenv/config";
+import * as dotenv from "dotenv";
+import path from "path";
+import { fileURLToPath } from "url";
 import { defineConfig } from "drizzle-kit";
 import { tables } from "./src/schema.generated";
 import { getTableName, Table } from "drizzle-orm";
 
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// Load .env from the project root (single file for the entire project)
+dotenv.config({ path: path.resolve(__dirname, "../.env") });
+
 if (!process.env.DATABASE_URL) {
     throw new Error("DATABASE_URL is not set. Make sure .env file exists in the project root and contains DATABASE_URL");
 }
 
-// Extract table names from the generated schema
-// This ensures drizzle-kit ONLY manages tables defined in the schema
+// Extract table names from the generated schema.
+// This ensures drizzle-kit ONLY manages tables defined in the schema.
+// Any tables in the database that are NOT part of the Rebase schema are left untouched.
 const tableNames = Object.values(tables).map(table => getTableName(table as Table));
 
 export default defineConfig({
@@ -18,5 +27,16 @@ export default defineConfig({
     dbCredentials: {
         url: process.env.DATABASE_URL
     },
-    tablesFilter: tableNames
+    // Only manage tables defined in the generated schema.
+    // Unmapped tables in the database are completely ignored.
+    tablesFilter: tableNames,
+    // Restrict drizzle-kit to the public schema only — tables in other schemas
+    // (e.g. extensions, custom schemas) are never touched.
+    schemaFilter: ["public"],
+    // Prevent drizzle-kit from managing roles not defined in the schema
+    entities: {
+        roles: false
+    },
+    // If PostGIS or other extensions create helper tables, ignore them
+    extensionsFilters: ["postgis"]
 });

package/templates/template/backend/functions/hello.ts

@@ -0,0 +1,52 @@
+import { Hono } from "hono";
+import type { HonoEnv } from "@rebasepro/server-core";
+import { rebase } from "@rebasepro/server-core";
+
+/**
+ * Example custom function route.
+ *
+ * This file is auto-discovered by Rebase and mounted at:
+ *   POST /api/functions/hello
+ *   GET  /api/functions/hello
+ *
+ * Call from the client SDK:
+ *   const result = await client.call("functions/hello", { name: "World" });
+ *
+ * This is a standard Hono app — use any Hono middleware,
+ * define any HTTP methods, access the request/response directly.
+ *
+ * The `rebase` singleton gives you admin-level access to all
+ * app-scoped services (data, auth, storage, email) from anywhere.
+ * For request-scoped / RLS-scoped access, use c.get("user") and c.get("driver").
+ */
+const app = new Hono<HonoEnv>();
+
+app.post("/", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const user = c.get("user");
+
+    const userId = (user && typeof user === "object" && "userId" in user)
+        ? user.userId
+        : "anonymous";
+
+    // Access any Rebase service — just import and use:
+    // await rebase.email?.send({
+    //     to: "admin@example.com",
+    //     subject: "Function called",
+    //     html: `<p>Hello from ${userId}!</p>`,
+    // });
+    //
+    // const authors = await rebase.data.authors.find({ limit: 5 });
+
+    return c.json({
+        message: `Hello, ${body.name || "World"}!`,
+        user: userId
+    });
+});
+
+app.get("/", (c) => {
+    return c.json({ status: "ok",
+endpoint: "hello" });
+});
+
+export default app;

package/templates/template/backend/package.json

@@ -1,36 +1,32 @@
 {
-  "name": "{{PROJECT_NAME}}-backend",
-  "version": "1.0.0",
-  "description": "Rebase backend with PostgreSQL",
-  "main": "src/index.ts",
-  "type": "module",
-  "scripts": {
-    "dev": "tsx watch --watch=\"../shared/**/*\" src/index.ts",
-    "build": "tsc --noEmit",
-    "start": "tsx src/index.ts",
-    "generate:schema": "tsx node_modules/@rebasepro/backend/src/generate-drizzle-schema.ts --collections=../shared/collections --output=src/schema.generated.ts",
-    "db:generate": "pnpm generate:schema && tsx scripts/db-generate.ts",
-    "db:migrate": "DOTENV_CONFIG_PATH=../.env drizzle-kit migrate",
-    "db:push": "DOTENV_CONFIG_PATH=../.env drizzle-kit push",
-    "db:studio": "DOTENV_CONFIG_PATH=../.env drizzle-kit studio"
-  },
-  "dependencies": {
-    "{{PROJECT_NAME}}-shared": "workspace:*",
-    "@rebasepro/backend": "^4.0.0",
-    "cors": "^2.8.5",
-    "drizzle-orm": "^0.44.4",
-    "express": "^5.1.0",
-    "pg": "^8.11.3",
-    "ws": "^8.16.0",
-    "zod": "^3.22.4",
-    "dotenv": "^16.0.0"
-  },
-  "devDependencies": {
-    "@types/pg": "^8.6.5",
-    "@types/node": "^20.10.5",
-    "@types/ws": "^8.5.10",
-    "drizzle-kit": "^0.31.4",
-    "tsx": "^4.20.6",
-    "typescript": "^5.9.2"
-  }
+    "name": "{{PROJECT_NAME}}-backend",
+    "version": "1.0.0",
+    "description": "Rebase backend with PostgreSQL",
+    "main": "src/index.ts",
+    "type": "module",
+    "scripts": {
+        "dev": "tsx watch --watch=\"../config/**/*\" src/index.ts",
+        "build": "tsc --noEmit",
+        "start": "tsx src/index.ts"
+    },
+    "dependencies": {
+        "{{PROJECT_NAME}}-config": "workspace:*",
+        "@rebasepro/server-core": "workspace:*",
+        "@rebasepro/server-postgresql": "workspace:*",
+        "drizzle-orm": "^0.44.4",
+        "hono": "^4.12.10",
+        "@hono/node-server": "^1.19.12",
+        "pg": "^8.11.3",
+        "ws": "^8.16.0",
+        "zod": "^3.22.4",
+        "dotenv": "^16.0.0"
+    },
+    "devDependencies": {
+        "@types/pg": "^8.6.5",
+        "@types/node": "^20.10.5",
+        "@types/ws": "^8.5.10",
+        "drizzle-kit": "^0.31.4",
+        "tsx": "^4.20.6",
+        "typescript": "^5.9.2"
+    }
 }

package/templates/template/backend/src/env.ts

@@ -0,0 +1,52 @@
+import { z } from "zod";
+import * as dotenv from "dotenv";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+dotenv.config({ path: path.resolve(__dirname, "../../.env") });
+
+const envSchema = z.object({
+    NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
+    PORT: z.string().default("3001").transform(Number),
+    DATABASE_URL: z.string().url("DATABASE_URL must be a valid URL"),
+    ADMIN_CONNECTION_STRING: z.string().url().optional(),
+    JWT_SECRET: z.string().min(32, "JWT_SECRET must be at least 32 characters long"),
+    JWT_ACCESS_EXPIRES_IN: z.string().default("1h"),
+    JWT_REFRESH_EXPIRES_IN: z.string().default("30d"),
+    GOOGLE_CLIENT_ID: z.string().optional(),
+    ALLOW_REGISTRATION: z.enum(["true", "false", ""]).default("false").transform(v => v === "true"),
+    CORS_ORIGINS: z.string().optional(),
+    FRONTEND_URL: z.string().optional(),
+    DB_POOL_MAX: z.string().default("20").transform(Number),
+    DB_POOL_IDLE_TIMEOUT: z.string().default("30000").transform(Number),
+    DB_POOL_CONNECT_TIMEOUT: z.string().default("10000").transform(Number),
+    FORCE_LOCAL_STORAGE: z.enum(["true", "false", ""]).optional().transform(v => v === "true"),
+    STORAGE_TYPE: z.enum(["local", "s3"]).default("local"),
+    STORAGE_PATH: z.string().optional(),
+    S3_BUCKET: z.string().optional(),
+    S3_REGION: z.string().optional(),
+    S3_ACCESS_KEY_ID: z.string().optional(),
+    S3_SECRET_ACCESS_KEY: z.string().optional(),
+    S3_ENDPOINT: z.string().url().optional(),
+    S3_FORCE_PATH_STYLE: z.enum(["true", "false", ""]).optional().transform(v => v === "true"),
+    /**
+     * Service key for admin-level script / server-to-server authentication.
+     * When set, scripts can send `Authorization: Bearer <key>` to get admin access.
+     * Generate with: node -e "console.log(require('crypto').randomBytes(48).toString('base64'))"
+     */
+    REBASE_SERVICE_KEY: z.string().min(32, "REBASE_SERVICE_KEY must be at least 32 characters").optional()
+}).superRefine((data, ctx) => {
+    if (data.NODE_ENV === "production" && !data.CORS_ORIGINS && !data.FRONTEND_URL) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "CORS_ORIGINS or FRONTEND_URL must be set in production to secure the API.",
+            path: ["CORS_ORIGINS"]
+        });
+    }
+});
+
+// Parse and export
+export const env = envSchema.parse(process.env);