@rebasepro/cli 0.10.1-canary.d8d45b2 → 0.10.1-canary.ed78a2c

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.10.1-canary.d8d45b2",
+  "version": "0.10.1-canary.ed78a2c",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,12 +31,12 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/agent-skills": "0.10.1-canary.d8d45b2",
-    "@rebasepro/client": "0.10.1-canary.d8d45b2",
-    "@rebasepro/codegen": "0.10.1-canary.d8d45b2",
-    "@rebasepro/types": "0.10.1-canary.d8d45b2",
-    "@rebasepro/server-postgres": "0.10.1-canary.d8d45b2",
-    "@rebasepro/server": "0.10.1-canary.d8d45b2"
+    "@rebasepro/agent-skills": "0.10.1-canary.ed78a2c",
+    "@rebasepro/client": "0.10.1-canary.ed78a2c",
+    "@rebasepro/server": "0.10.1-canary.ed78a2c",
+    "@rebasepro/server-postgres": "0.10.1-canary.ed78a2c",
+    "@rebasepro/codegen": "0.10.1-canary.ed78a2c",
+    "@rebasepro/types": "0.10.1-canary.ed78a2c"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",

package/templates/overlays/baas/backend/src/index.ts

@@ -15,6 +15,7 @@ import {
 } from "@rebasepro/server";
 import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
 import { env } from "./env.js";
+import { storageAuthorize } from "./storage.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -153,6 +154,12 @@ pass: env.SMTP_PASS! }
                         type: "local",
                         basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
                     },
+        // Storage is not under row-level security, so this hook IS its access
+        // model — the server refuses to boot in production without one, because
+        // "signed in" would otherwise be the only thing between a caller and every
+        // file in the bucket. See storage.ts; the default scopes each caller to
+        // `users/<uid>/` and is meant to be replaced with your own rule.
+        storageAuthorize,
         history: true,
         enableSwagger: true
     });

package/templates/overlays/baas/backend/src/storage.ts

@@ -0,0 +1,71 @@
+import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
+
+/**
+ * Who may do what to files in storage.
+ *
+ * Storage is **not** under row-level security. Tables are: a request runs as
+ * `rebase_user` and Postgres decides row by row. Object storage has no equivalent,
+ * so keys share one flat namespace and this hook is the whole authorization model.
+ * Without it the server refuses to boot in production, because "authenticated"
+ * would be the only thing between a signed-in caller and every file in the bucket —
+ * they can `GET /storage/list?prefix=` to enumerate every key, then read, overwrite
+ * or delete any of them.
+ *
+ * It lives in `backend/src/` rather than a config package because BaaS mode has no
+ * config package: collections come from the live database, so there is nothing to
+ * declare and nowhere else to put this.
+ *
+ * ## The default this starter ships
+ *
+ * A deliberately conservative one, because a BaaS project's storage semantics are
+ * whatever *your* application says they are and this file cannot know:
+ *
+ * | operation | who |
+ * | --- | --- |
+ * | `read` of `public/…` | anyone, signed in or not |
+ * | everything else | a signed-in caller under their own `users/<uid>/` prefix |
+ *
+ * Gating `list` on the prefix is the important half. Enumeration is what turns "keys
+ * are hard to guess" into "keys are known", and it is step one of the attack the
+ * boot guard exists to prevent.
+ *
+ * ## Replace this with your model
+ *
+ * Prefix rules are a starting point, not a general answer: they work for writes
+ * because a write *puts* the object there, but anything already in the bucket needs
+ * the row that owns it consulted. `ctx.data` is handed in for exactly that — trusted,
+ * RLS-bypassing reads, because the hook *is* the authorization decision and running
+ * it through a reader already narrowed by the caller's permissions would be circular:
+ *
+ * ```ts
+ * export const storageAuthorize: StorageAuthorize = async ({ key, user, operation, data }) => {
+ *     if (operation === "read" && isPublicStoragePath(key)) return true;
+ *     if (!user) return false;
+ *     const row = (await data?.collection("attachments").find({
+ *         where: { storage_key: ["==", key] }, limit: 1
+ *     }))?.data?.[0];
+ *     return row?.owner_id === user.uid;
+ * };
+ * ```
+ *
+ * If your bucket really is a public read-only CDN, `storagePublicRead: true` says so
+ * instead. If every signed-in caller is genuinely trusted with every file,
+ * `storageInsecureAllowAnyAuthenticated: true` says *that* — it is named to be read
+ * twice. Both are set on `initializeRebaseBackend` in `index.ts`.
+ */
+export const storageAuthorize: StorageAuthorize = ({ key, user, operation }) => {
+    // The `public/` prefix is the framework's convention for world-readable objects.
+    if (operation === "read" && isPublicStoragePath(key)) {
+        return true;
+    }
+
+    // `user` is null on routes that allow unauthenticated access.
+    if (!user) {
+        return false;
+    }
+
+    // Each caller gets their own namespace. A listing is scoped the same way, so a
+    // prefix outside it — including the empty prefix, which would enumerate the
+    // whole bucket — is denied.
+    return key.startsWith(`users/${user.uid}/`);
+};

package/templates/template/.env.example

@@ -34,6 +34,9 @@ DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20sea
 # DB_POOL_CONNECT_TIMEOUT=10000
 
 # ── Server ────────────────────────────────────────────────────────────────────
+# Used by `rebase start` (production). `rebase dev` IGNORES this and binds a
+# port derived from the project path, so several projects can run at once —
+# trust the URL `rebase dev` prints, or pin one with `rebase dev --port 3001`.
 PORT=3001
 NODE_ENV=development
 # Allow connecting to localhost / 127.0.0.1 in production mode (for local testing of prod builds)
@@ -74,6 +77,8 @@ FRONTEND_URL=http://localhost:5173
 # GOOGLE_CLIENT_ID=
 
 # ── Frontend (Vite) ──────────────────────────────────────────────────────────
+# For production builds. In dev, `rebase dev` injects the backend port it
+# actually bound, overriding this — see the PORT note above.
 VITE_API_URL=http://localhost:3001
 # VITE_GOOGLE_CLIENT_ID=
 

package/templates/template/README.md

@@ -43,9 +43,14 @@ pnpm run db:push   # or: npm run db:push
 pnpm dev   # or: npm run dev
 ```
 
-Open **http://localhost:5173** — the admin panel. The first account you
-register becomes the admin. The backend API (Hono + PostgreSQL) runs on
-port 3001; the frontend (Vite + React) on port 5173.
+`rebase dev` prints the two URLs it actually bound and opens the admin panel
+there. The first account you register becomes the admin.
+
+Ports are **derived from this project's path**, not fixed at 3001/5173, so
+several Rebase projects can run at once without colliding. That is why the URL
+in your terminal is the one to trust — and why the `PORT` and `VITE_API_URL` in
+`.env` are ignored by `rebase dev` (they apply to `rebase start`, the production
+server). Pin a port with `rebase dev --port 3001` if you need a stable one.
 
 > The `db:push` step is what creates the tables for the example `posts`,
 > `authors`, and `tags` collections. Skip it and the admin panel still opens,

package/templates/template/backend/src/index.ts

@@ -16,6 +16,7 @@ import {
 } from "@rebasepro/server";
 import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
 import { enums, relations, tables } from "./schema.generated.js";
+import { storageAuthorize } from "../../config/storage.js";
 import { env } from "./env.js";
 import usersCollection from "../../config/collections/users.js";
 
@@ -154,6 +155,12 @@ pass: env.SMTP_PASS! }
                         type: "local",
                         basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
                     },
+        // Storage is not under row-level security, so this hook IS its access
+        // model — the server refuses to boot in production without one, because
+        // "signed in" would otherwise be the only thing between a visitor and
+        // every file in the bucket. See config/storage.ts, which also shows the
+        // multi-tenant (per-owner) shape and the two escape hatches.
+        storageAuthorize,
         history: true
     });
 

package/templates/template/config/admin.d.ts

@@ -0,0 +1,9 @@
+/// <reference types="@rebasepro/admin-types" />
+
+// One line, once per project. `@rebasepro/admin-types` declares the `admin` block on
+// `CollectionConfig` and on every property type by declaration merging, and an
+// augmentation applies to the whole *program* — so this reference is what makes
+// `admin: { … }` legal in every collection file here.
+//
+// A BaaS project has no admin panel and no reason for this file. Without it, `admin` on
+// a collection or a property is a type error, which is the guarantee.

package/templates/template/config/collections/authors.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import { defineCollection } from "@rebasepro/admin-types";
 
-const authorsCollection: CollectionConfig = {
+const authorsCollection = defineCollection({
     name: "Authors",
     singularName: "Author",
     slug: "authors",
     table: "authors",
-    icon: "Person",
     properties: {
         id: {
             name: "ID",
@@ -34,12 +33,15 @@ const authorsCollection: CollectionConfig = {
             }
         }
     },
-    propertiesOrder: [
-        "id",
-        "name",
-        "email",
-        "picture"
-    ]
-};
+    admin: {
+        icon: "Person",
+        propertiesOrder: [
+            "id",
+            "name",
+            "email",
+            "picture"
+        ]
+    }
+});
 
 export default authorsCollection;

package/templates/template/config/collections/posts.ts

@@ -1,13 +1,12 @@
-import { CollectionConfig } from "@rebasepro/types";
+import { defineCollection } from "@rebasepro/admin-types";
 import authorsCollection from "./authors.js";
 import tagsCollection from "./tags.js";
 
-const postsCollection: CollectionConfig = {
+const postsCollection = defineCollection({
     name: "Posts",
     singularName: "Post",
     slug: "posts",
     table: "posts",
-    icon: "Article",
     properties: {
         id: {
             name: "ID",
@@ -24,7 +23,7 @@ const postsCollection: CollectionConfig = {
         content: {
             name: "Content",
             type: "string",
-            ui: {
+            admin: {
                 markdown: true
             }
         },
@@ -52,20 +51,25 @@ const postsCollection: CollectionConfig = {
         author: {
             name: "Author",
             type: "relation",
-            relationName: "author",
-            target: () => authorsCollection,
-            cardinality: "one",
-            direction: "owning"
+            relation: {
+                kind: "belongsTo",
+                target: () => authorsCollection,
+                relationName: "author",
+            }
         },
         tags: {
             name: "Tags",
             type: "relation",
-            relationName: "tags",
-            target: () => tagsCollection,
-            cardinality: "many",
-            direction: "owning"
+            relation: {
+                kind: "manyToMany",
+                target: () => tagsCollection,
+                relationName: "tags",
+            }
         }
+    },
+    admin: {
+        icon: "Article"
     }
-};
+});
 
 export default postsCollection;

package/templates/template/config/collections/presets/ecommerce/categories.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import { defineCollection } from "@rebasepro/admin-types";
 
-const categoriesCollection: CollectionConfig = {
+const categoriesCollection = defineCollection({
     name: "Categories",
     singularName: "Category",
     slug: "categories",
     table: "categories",
-    icon: "Category",
     properties: {
         id: {
             name: "ID",
@@ -25,7 +24,7 @@ const categoriesCollection: CollectionConfig = {
         description: {
             name: "Description",
             type: "string",
-            ui: {
+            admin: {
                 multiline: true
             }
         },
@@ -34,7 +33,10 @@ const categoriesCollection: CollectionConfig = {
             type: "string"
         }
     },
-    propertiesOrder: ["id", "name", "slug", "description", "icon"]
-};
+    admin: {
+        icon: "Category",
+        propertiesOrder: ["id", "name", "slug", "description", "icon"]
+    }
+});
 
 export default categoriesCollection;

package/templates/template/config/collections/presets/ecommerce/orders.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import { defineCollection } from "@rebasepro/admin-types";
 
-const ordersCollection: CollectionConfig = {
+const ordersCollection = defineCollection({
     name: "Orders",
     singularName: "Order",
     slug: "orders",
     table: "orders",
-    icon: "Receipt",
     properties: {
         id: {
             name: "ID",
@@ -22,21 +21,31 @@ const ordersCollection: CollectionConfig = {
             name: "Status",
             type: "string",
             enum: [
-                { id: "pending",
-label: "Pending",
-color: "gray" },
-                { id: "processing",
-label: "Processing",
-color: "blue" },
-                { id: "shipped",
-label: "Shipped",
-color: "orange" },
-                { id: "delivered",
-label: "Delivered",
-color: "green" },
-                { id: "cancelled",
-label: "Cancelled",
-color: "red" }
+                {
+                    id: "pending",
+                    label: "Pending",
+                    color: "gray"
+                },
+                {
+                    id: "processing",
+                    label: "Processing",
+                    color: "blue"
+                },
+                {
+                    id: "shipped",
+                    label: "Shipped",
+                    color: "orange"
+                },
+                {
+                    id: "delivered",
+                    label: "Delivered",
+                    color: "green"
+                },
+                {
+                    id: "cancelled",
+                    label: "Cancelled",
+                    color: "red"
+                }
             ]
         },
         total: {
@@ -47,7 +56,7 @@ color: "red" }
         notes: {
             name: "Notes",
             type: "string",
-            ui: {
+            admin: {
                 multiline: true
             }
         },
@@ -56,11 +65,14 @@ color: "red" }
             type: "date",
             columnName: "created_at",
             autoValue: "on_create",
-            ui: {
+            admin: {
                 readOnly: true
             }
         }
+    },
+    admin: {
+        icon: "Receipt"
     }
-};
+});
 
 export default ordersCollection;

package/templates/template/config/collections/presets/ecommerce/products.ts

@@ -1,12 +1,11 @@
-import { CollectionConfig } from "@rebasepro/types";
+import { defineCollection } from "@rebasepro/admin-types";
 import categoriesCollection from "./categories.js";
 
-const productsCollection: CollectionConfig = {
+const productsCollection = defineCollection({
     name: "Products",
     singularName: "Product",
     slug: "products",
     table: "products",
-    icon: "ShoppingCart",
     properties: {
         id: {
             name: "ID",
@@ -21,7 +20,7 @@ const productsCollection: CollectionConfig = {
         description: {
             name: "Description",
             type: "string",
-            ui: {
+            admin: {
                 markdown: true
             }
         },
@@ -39,26 +38,36 @@ const productsCollection: CollectionConfig = {
             name: "Status",
             type: "string",
             enum: [
-                { id: "draft",
-label: "Draft",
-color: "gray" },
-                { id: "active",
-label: "Active",
-color: "green" },
-                { id: "archived",
-label: "Archived",
-color: "orange" }
+                {
+                    id: "draft",
+                    label: "Draft",
+                    color: "gray"
+                },
+                {
+                    id: "active",
+                    label: "Active",
+                    color: "green"
+                },
+                {
+                    id: "archived",
+                    label: "Archived",
+                    color: "orange"
+                }
             ]
         },
         category: {
             name: "Category",
             type: "relation",
-            relationName: "category",
-            target: () => categoriesCollection,
-            cardinality: "one",
-            direction: "owning"
+            relation: {
+                kind: "belongsTo",
+                target: () => categoriesCollection,
+                relationName: "category",
+            }
         }
+    },
+    admin: {
+        icon: "ShoppingCart"
     }
-};
+});
 
 export default productsCollection;

package/templates/template/config/collections/tags.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import { defineCollection } from "@rebasepro/admin-types";
 
-const tagsCollection: CollectionConfig = {
+const tagsCollection = defineCollection({
     name: "Tags",
     singularName: "Tag",
     slug: "tags",
     table: "tags",
-    icon: "Tag",
     properties: {
         id: {
             name: "ID",
@@ -19,7 +18,10 @@ const tagsCollection: CollectionConfig = {
                 required: true
             }
         }
+    },
+    admin: {
+        icon: "Tag"
     }
-};
+});
 
 export default tagsCollection;

package/templates/template/config/collections/users.ts

@@ -1,29 +1,28 @@
-import type { CollectionConfig } from "@rebasepro/types";
+import { defineCollection } from "@rebasepro/admin-types";
 
-const usersCollection: CollectionConfig = {
+const usersCollection = defineCollection({
     name: "Users",
     singularName: "User",
     slug: "users",
     auth: { enabled: true },
     table: "users",
     schema: "rebase",
-    icon: "Users",
-    group: "Settings",
-    openEntityMode: "dialog",
-    disableDefaultActions: ["copy"],
     securityRules: [
-        { operation: "select",
-roles: ["admin"] },
-        { operations: ["insert", "update", "delete"],
-roles: ["admin"] }
+        {
+            operation: "select",
+            roles: ["admin"]
+        },
+        {
+            operations: ["insert", "update", "delete"],
+            roles: ["admin"]
+        }
     ],
-    sort: ["createdAt", "desc"],
     properties: {
         id: {
             name: "ID",
             type: "string",
             isId: "uuid",
-            ui: {
+            admin: {
                 readOnly: true
             }
         },
@@ -44,9 +43,8 @@ roles: ["admin"] }
             name: "Photo URL",
             type: "string",
             columnName: "photo_url",
-            ui: {
-                url: "image"
-            }
+            url: true,
+            admin: { urlPreview: "image" }
         },
         roles: {
             name: "Roles",
@@ -67,7 +65,7 @@ roles: ["admin"] }
             type: "string",
             columnName: "password_hash",
             excludeFromApi: true,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -77,7 +75,7 @@ roles: ["admin"] }
             type: "boolean",
             columnName: "email_verified",
             defaultValue: false,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -87,7 +85,7 @@ roles: ["admin"] }
             type: "string",
             columnName: "email_verification_token",
             excludeFromApi: true,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -96,7 +94,7 @@ roles: ["admin"] }
             name: "Email Verification Sent At",
             type: "date",
             columnName: "email_verification_sent_at",
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -107,7 +105,7 @@ roles: ["admin"] }
             keyValue: true,
             properties: {},
             defaultValue: {},
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -117,7 +115,7 @@ roles: ["admin"] }
             type: "date",
             columnName: "created_at",
             autoValue: "on_create",
-            ui: {
+            admin: {
                 readOnly: true
             }
         },
@@ -126,19 +124,26 @@ roles: ["admin"] }
             type: "date",
             columnName: "updated_at",
             autoValue: "on_update",
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
         }
     },
-    propertiesOrder: [
-        "id",
-        "email",
-        "displayName",
-        "roles",
-        "createdAt"
-    ]
-};
+    admin: {
+        icon: "Users",
+        group: "Settings",
+        openEntityMode: "dialog",
+        disableDefaultActions: ["copy"],
+        sort: ["createdAt", "desc"],
+        propertiesOrder: [
+            "id",
+            "email",
+            "displayName",
+            "roles",
+            "createdAt"
+        ]
+    }
+});
 
 export default usersCollection;