@rebasepro/cli 0.10.0 → 0.10.1-canary.0a881d4

package/templates/template/config/collections/presets/ecommerce/categories.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const categoriesCollection: CollectionConfig = {
+const categoriesCollection: PostgresCollectionConfig = {
     name: "Categories",
     singularName: "Category",
     slug: "categories",
     table: "categories",
-    icon: "Category",
     properties: {
         id: {
             name: "ID",
@@ -25,7 +24,7 @@ const categoriesCollection: CollectionConfig = {
         description: {
             name: "Description",
             type: "string",
-            ui: {
+            admin: {
                 multiline: true
             }
         },
@@ -34,7 +33,10 @@ const categoriesCollection: CollectionConfig = {
             type: "string"
         }
     },
-    propertiesOrder: ["id", "name", "slug", "description", "icon"]
+    admin: {
+        icon: "Category",
+        propertiesOrder: ["id", "name", "slug", "description", "icon"]
+    }
 };
 
 export default categoriesCollection;

package/templates/template/config/collections/presets/ecommerce/orders.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const ordersCollection: CollectionConfig = {
+const ordersCollection: PostgresCollectionConfig = {
     name: "Orders",
     singularName: "Order",
     slug: "orders",
     table: "orders",
-    icon: "Receipt",
     properties: {
         id: {
             name: "ID",
@@ -22,21 +21,31 @@ const ordersCollection: CollectionConfig = {
             name: "Status",
             type: "string",
             enum: [
-                { id: "pending",
-label: "Pending",
-color: "gray" },
-                { id: "processing",
-label: "Processing",
-color: "blue" },
-                { id: "shipped",
-label: "Shipped",
-color: "orange" },
-                { id: "delivered",
-label: "Delivered",
-color: "green" },
-                { id: "cancelled",
-label: "Cancelled",
-color: "red" }
+                {
+                    id: "pending",
+                    label: "Pending",
+                    color: "gray"
+                },
+                {
+                    id: "processing",
+                    label: "Processing",
+                    color: "blue"
+                },
+                {
+                    id: "shipped",
+                    label: "Shipped",
+                    color: "orange"
+                },
+                {
+                    id: "delivered",
+                    label: "Delivered",
+                    color: "green"
+                },
+                {
+                    id: "cancelled",
+                    label: "Cancelled",
+                    color: "red"
+                }
             ]
         },
         total: {
@@ -47,7 +56,7 @@ color: "red" }
         notes: {
             name: "Notes",
             type: "string",
-            ui: {
+            admin: {
                 multiline: true
             }
         },
@@ -56,10 +65,13 @@ color: "red" }
             type: "date",
             columnName: "created_at",
             autoValue: "on_create",
-            ui: {
+            admin: {
                 readOnly: true
             }
         }
+    },
+    admin: {
+        icon: "Receipt"
     }
 };
 

package/templates/template/config/collections/presets/ecommerce/products.ts

@@ -1,12 +1,11 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 import categoriesCollection from "./categories.js";
 
-const productsCollection: CollectionConfig = {
+const productsCollection: PostgresCollectionConfig = {
     name: "Products",
     singularName: "Product",
     slug: "products",
     table: "products",
-    icon: "ShoppingCart",
     properties: {
         id: {
             name: "ID",
@@ -21,7 +20,7 @@ const productsCollection: CollectionConfig = {
         description: {
             name: "Description",
             type: "string",
-            ui: {
+            admin: {
                 markdown: true
             }
         },
@@ -39,15 +38,21 @@ const productsCollection: CollectionConfig = {
             name: "Status",
             type: "string",
             enum: [
-                { id: "draft",
-label: "Draft",
-color: "gray" },
-                { id: "active",
-label: "Active",
-color: "green" },
-                { id: "archived",
-label: "Archived",
-color: "orange" }
+                {
+                    id: "draft",
+                    label: "Draft",
+                    color: "gray"
+                },
+                {
+                    id: "active",
+                    label: "Active",
+                    color: "green"
+                },
+                {
+                    id: "archived",
+                    label: "Archived",
+                    color: "orange"
+                }
             ]
         },
         category: {
@@ -58,6 +63,9 @@ color: "orange" }
             cardinality: "one",
             direction: "owning"
         }
+    },
+    admin: {
+        icon: "ShoppingCart"
     }
 };
 

package/templates/template/config/collections/tags.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const tagsCollection: CollectionConfig = {
+const tagsCollection: PostgresCollectionConfig = {
     name: "Tags",
     singularName: "Tag",
     slug: "tags",
     table: "tags",
-    icon: "Tag",
     properties: {
         id: {
             name: "ID",
@@ -19,6 +18,9 @@ const tagsCollection: CollectionConfig = {
                 required: true
             }
         }
+    },
+    admin: {
+        icon: "Tag"
     }
 };
 

package/templates/template/config/collections/users.ts

@@ -1,29 +1,28 @@
-import type { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const usersCollection: CollectionConfig = {
+const usersCollection: PostgresCollectionConfig = {
     name: "Users",
     singularName: "User",
     slug: "users",
     auth: { enabled: true },
     table: "users",
     schema: "rebase",
-    icon: "Users",
-    group: "Settings",
-    openEntityMode: "dialog",
-    disableDefaultActions: ["copy"],
     securityRules: [
-        { operation: "select",
-roles: ["admin"] },
-        { operations: ["insert", "update", "delete"],
-roles: ["admin"] }
+        {
+            operation: "select",
+            roles: ["admin"]
+        },
+        {
+            operations: ["insert", "update", "delete"],
+            roles: ["admin"]
+        }
     ],
-    sort: ["createdAt", "desc"],
     properties: {
         id: {
             name: "ID",
             type: "string",
             isId: "uuid",
-            ui: {
+            admin: {
                 readOnly: true
             }
         },
@@ -44,9 +43,8 @@ roles: ["admin"] }
             name: "Photo URL",
             type: "string",
             columnName: "photo_url",
-            ui: {
-                url: "image"
-            }
+            url: true,
+            admin: { urlPreview: "image" }
         },
         roles: {
             name: "Roles",
@@ -67,7 +65,7 @@ roles: ["admin"] }
             type: "string",
             columnName: "password_hash",
             excludeFromApi: true,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -77,7 +75,7 @@ roles: ["admin"] }
             type: "boolean",
             columnName: "email_verified",
             defaultValue: false,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -87,7 +85,7 @@ roles: ["admin"] }
             type: "string",
             columnName: "email_verification_token",
             excludeFromApi: true,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -96,7 +94,7 @@ roles: ["admin"] }
             name: "Email Verification Sent At",
             type: "date",
             columnName: "email_verification_sent_at",
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -107,7 +105,7 @@ roles: ["admin"] }
             keyValue: true,
             properties: {},
             defaultValue: {},
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -117,7 +115,7 @@ roles: ["admin"] }
             type: "date",
             columnName: "created_at",
             autoValue: "on_create",
-            ui: {
+            admin: {
                 readOnly: true
             }
         },
@@ -126,19 +124,26 @@ roles: ["admin"] }
             type: "date",
             columnName: "updated_at",
             autoValue: "on_update",
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
         }
     },
-    propertiesOrder: [
-        "id",
-        "email",
-        "displayName",
-        "roles",
-        "createdAt"
-    ]
+    admin: {
+        icon: "Users",
+        group: "Settings",
+        openEntityMode: "dialog",
+        disableDefaultActions: ["copy"],
+        sort: ["createdAt", "desc"],
+        propertiesOrder: [
+            "id",
+            "email",
+            "displayName",
+            "roles",
+            "createdAt"
+        ]
+    }
 };
 
 export default usersCollection;

package/templates/template/config/frontend-assets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Ambient declarations for the asset imports a frontend component makes.
+ *
+ * A collection that points at a custom `Field` or `Preview` with a lazy `import()`
+ * thunk gets that reference type-checked — which means TypeScript resolves the
+ * component's *own* imports too, including `import icon from "./icon.png"`. That
+ * import is Vite's doing and means nothing to `tsc`: the frontend gets away with it
+ * through `vite/client` types, but those belong to the frontend's program, not this
+ * one, and Vite is not a dependency here (nothing in `config/` runs in a browser).
+ *
+ * Without these three lines, adding your first custom component fails the config and
+ * backend builds with `Cannot find module './icon.png'` — pointing at a frontend file
+ * from a build that has no obvious business compiling it.
+ */
+declare module "*.png" { const src: string; export default src; }
+declare module "*.svg" { const src: string; export default src; }
+declare module "*.jpg" { const src: string; export default src; }

package/templates/template/config/index.ts

@@ -4,3 +4,9 @@
  */
 
 export { collections } from "./collections/index.js";
+
+// Who may read, write, delete and list files in storage. Exported from here
+// because that is where the runtime and `rebase cloud deploy` look for it — the
+// bundle manifest records whether this export exists, so a managed deploy can be
+// refused with a readable message instead of turning into a boot crash-loop.
+export { storageAuthorize } from "./storage.js";

package/templates/template/config/package.json

@@ -1,28 +1,29 @@
 {
-    "name": "{{PROJECT_NAME}}-config",
-    "version": "1.0.0",
-    "description": "Shared collections for frontend and backend",
-    "main": "dist/index.js",
-    "types": "dist/index.d.ts",
-    "type": "module",
-    "private": true,
-    "scripts": {
-        "build": "tsc",
-        "dev": "tsc --watch",
-        "clean": "rm -rf dist"
+  "name": "{{PROJECT_NAME}}-config",
+  "version": "1.0.0",
+  "description": "Shared collections for frontend and backend",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@rebasepro/admin-types": "workspace:*",
+    "@rebasepro/types": "workspace:*"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.2"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     },
-    "dependencies": {
-        "@rebasepro/types": "workspace:*"
-    },
-    "devDependencies": {
-        "typescript": "^5.9.2"
-    },
-    "exports": {
-        ".": {
-            "import": "./dist/index.js",
-            "types": "./dist/index.d.ts",
-            "default": "./dist/index.js"
-        },
-        "./package.json": "./package.json"
-    }
+    "./package.json": "./package.json"
+  }
 }

package/templates/template/config/storage.ts

@@ -0,0 +1,88 @@
+import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
+
+/**
+ * Who may do what to files in storage.
+ *
+ * Storage is **not** under row-level security. Collections are: a request runs as
+ * `rebase_user` and Postgres decides row by row. Object storage has no equivalent,
+ * so keys share one flat namespace and this hook is the whole authorization model.
+ * Without it the server refuses to boot in production, because "authenticated"
+ * would be the only thing standing between a signed-in visitor and every file in
+ * the bucket — they could `GET /storage/list?prefix=` to enumerate every key, then
+ * read, overwrite or delete any of them.
+ *
+ * ## The model this starter ships
+ *
+ * A CMS's files are **shared content**, not private per-user documents: hero
+ * images, author pictures, product photos. The collections in this template upload
+ * to `author_pictures/`, `posts/hero/`, `product_images/` — paths named after the
+ * content, not after a user. So the boundary that matters here is not *whose file
+ * is this* but *who is allowed to change the library*:
+ *
+ * | operation | who |
+ * | --- | --- |
+ * | `read` of `public/…` | anyone, signed in or not |
+ * | `read` | any signed-in user — it is content, and the admin panel renders it |
+ * | `write`, `delete`, `list` | `admin` or `editor` only |
+ *
+ * Gating `list` is the important half. Enumeration is what turns "keys are hard to
+ * guess" into "keys are trivially known", and it is the first step of the attack
+ * the boot guard exists to prevent.
+ *
+ * ## If your app is multi-tenant, replace this
+ *
+ * Per-user or per-tenant files need an **ownership** check, and ownership lives in
+ * a row rather than in a key — so `ctx.data` hands you trusted, RLS-bypassing read
+ * access to answer it:
+ *
+ * ```ts
+ * export const storageAuthorize: StorageAuthorize = async ({ key, user, operation, data }) => {
+ *     if (operation === "read" && isPublicStoragePath(key)) return true;
+ *     if (!user) return false;
+ *
+ *     // Writes land under the caller's own prefix.
+ *     if (operation === "write") return key.startsWith(`users/${user.uid}/`);
+ *     if (operation === "list") return key.startsWith(`users/${user.uid}/`);
+ *
+ *     // Reads and deletes check the row that owns the object.
+ *     const attachment = (await data?.collection("attachments").find({
+ *         where: { storage_key: ["==", key] }, limit: 1
+ *     }))?.data?.[0];
+ *     return attachment?.owner_id === user.uid;
+ * };
+ * ```
+ *
+ * Note that a prefix rule alone is not an access-control model for reads — it only
+ * works because a write *puts* the object there. Anything already in the bucket
+ * needs the row consulted.
+ *
+ * The two escape hatches, if you would rather not write a hook at all:
+ * `storagePublicRead: true` when the bucket genuinely is a public read-only CDN,
+ * or `storageInsecureAllowAnyAuthenticated: true` for a single-tenant app where
+ * every signed-in user is trusted with every file. Both are set on
+ * `initializeRebaseBackend` in `backend/src/index.ts`.
+ */
+export const storageAuthorize: StorageAuthorize = ({ key, user, operation }) => {
+    // The `public/` prefix is the framework's convention for world-readable
+    // objects, and it is what signed download URLs for public assets rely on.
+    if (operation === "read" && isPublicStoragePath(key)) {
+        return true;
+    }
+
+    // Everything else needs a caller. `user` is null on routes that allow
+    // unauthenticated access, so this is the anonymous denial.
+    if (!user) {
+        return false;
+    }
+
+    // Content is shared: any signed-in user may read it. A `viewer` has to be able
+    // to see the images the admin panel shows them.
+    if (operation === "read") {
+        return true;
+    }
+
+    // Changing or enumerating the library is an editor's job. Matches the roles in
+    // `collections/users.ts` — widen this if you add your own.
+    const roles = user.roles ?? [];
+    return roles.includes("admin") || roles.includes("editor");
+};

package/templates/template/gitignore

@@ -29,3 +29,7 @@ uploads/
 # Rebase dev
 .rebase-dev-url
 .rebase-dev-port
+
+# Built project bundle (`rebase build`)
+dist-bundle/
+.rebase/

package/templates/template/rebase.json

@@ -0,0 +1,20 @@
+{
+    "$schema": "https://rebase.pro/schemas/rebase.json",
+    "runtime": "^1",
+    "apps": {
+        "backend": {
+            "type": "backend"
+        },
+        "web": {
+            "type": "static",
+            "root": "frontend",
+            "build": "npm run build --workspace frontend",
+            "output": "frontend/dist",
+            "spa": true
+        },
+        "admin": {
+            "type": "admin",
+            "mode": "hosted"
+        }
+    }
+}