@rebasepro/cli 0.10.1-canary.d8d45b2 → 0.10.1-canary.ed78a2c

package/templates/template/config/frontend-assets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Ambient declarations for the asset imports a frontend component makes.
+ *
+ * A collection that points at a custom `Field` or `Preview` with a lazy `import()`
+ * thunk gets that reference type-checked — which means TypeScript resolves the
+ * component's *own* imports too, including `import icon from "./icon.png"`. That
+ * import is Vite's doing and means nothing to `tsc`: the frontend gets away with it
+ * through `vite/client` types, but those belong to the frontend's program, not this
+ * one, and Vite is not a dependency here (nothing in `config/` runs in a browser).
+ *
+ * Without these three lines, adding your first custom component fails the config and
+ * backend builds with `Cannot find module './icon.png'` — pointing at a frontend file
+ * from a build that has no obvious business compiling it.
+ */
+declare module "*.png" { const src: string; export default src; }
+declare module "*.svg" { const src: string; export default src; }
+declare module "*.jpg" { const src: string; export default src; }

package/templates/template/config/index.ts

@@ -4,3 +4,9 @@
  */
 
 export { collections } from "./collections/index.js";
+
+// Who may read, write, delete and list files in storage. Exported from here
+// because that is where the runtime and `rebase cloud deploy` look for it — the
+// bundle manifest records whether this export exists, so a managed deploy can be
+// refused with a readable message instead of turning into a boot crash-loop.
+export { storageAuthorize } from "./storage.js";

package/templates/template/config/package.json

@@ -1,28 +1,29 @@
 {
-    "name": "{{PROJECT_NAME}}-config",
-    "version": "1.0.0",
-    "description": "Shared collections for frontend and backend",
-    "main": "dist/index.js",
-    "types": "dist/index.d.ts",
-    "type": "module",
-    "private": true,
-    "scripts": {
-        "build": "tsc",
-        "dev": "tsc --watch",
-        "clean": "rm -rf dist"
+  "name": "{{PROJECT_NAME}}-config",
+  "version": "1.0.0",
+  "description": "Shared collections for frontend and backend",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@rebasepro/admin-types": "workspace:*",
+    "@rebasepro/types": "workspace:*"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.2"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     },
-    "dependencies": {
-        "@rebasepro/types": "workspace:*"
-    },
-    "devDependencies": {
-        "typescript": "^5.9.2"
-    },
-    "exports": {
-        ".": {
-            "import": "./dist/index.js",
-            "types": "./dist/index.d.ts",
-            "default": "./dist/index.js"
-        },
-        "./package.json": "./package.json"
-    }
+    "./package.json": "./package.json"
+  }
 }

package/templates/template/config/storage.ts

@@ -0,0 +1,88 @@
+import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
+
+/**
+ * Who may do what to files in storage.
+ *
+ * Storage is **not** under row-level security. Collections are: a request runs as
+ * `rebase_user` and Postgres decides row by row. Object storage has no equivalent,
+ * so keys share one flat namespace and this hook is the whole authorization model.
+ * Without it the server refuses to boot in production, because "authenticated"
+ * would be the only thing standing between a signed-in visitor and every file in
+ * the bucket — they could `GET /storage/list?prefix=` to enumerate every key, then
+ * read, overwrite or delete any of them.
+ *
+ * ## The model this starter ships
+ *
+ * A CMS's files are **shared content**, not private per-user documents: hero
+ * images, author pictures, product photos. The collections in this template upload
+ * to `author_pictures/`, `posts/hero/`, `product_images/` — paths named after the
+ * content, not after a user. So the boundary that matters here is not *whose file
+ * is this* but *who is allowed to change the library*:
+ *
+ * | operation | who |
+ * | --- | --- |
+ * | `read` of `public/…` | anyone, signed in or not |
+ * | `read` | any signed-in user — it is content, and the admin panel renders it |
+ * | `write`, `delete`, `list` | `admin` or `editor` only |
+ *
+ * Gating `list` is the important half. Enumeration is what turns "keys are hard to
+ * guess" into "keys are trivially known", and it is the first step of the attack
+ * the boot guard exists to prevent.
+ *
+ * ## If your app is multi-tenant, replace this
+ *
+ * Per-user or per-tenant files need an **ownership** check, and ownership lives in
+ * a row rather than in a key — so `ctx.data` hands you trusted, RLS-bypassing read
+ * access to answer it:
+ *
+ * ```ts
+ * export const storageAuthorize: StorageAuthorize = async ({ key, user, operation, data }) => {
+ *     if (operation === "read" && isPublicStoragePath(key)) return true;
+ *     if (!user) return false;
+ *
+ *     // Writes land under the caller's own prefix.
+ *     if (operation === "write") return key.startsWith(`users/${user.uid}/`);
+ *     if (operation === "list") return key.startsWith(`users/${user.uid}/`);
+ *
+ *     // Reads and deletes check the row that owns the object.
+ *     const attachment = (await data?.collection("attachments").find({
+ *         where: { storage_key: ["==", key] }, limit: 1
+ *     }))?.data?.[0];
+ *     return attachment?.owner_id === user.uid;
+ * };
+ * ```
+ *
+ * Note that a prefix rule alone is not an access-control model for reads — it only
+ * works because a write *puts* the object there. Anything already in the bucket
+ * needs the row consulted.
+ *
+ * The two escape hatches, if you would rather not write a hook at all:
+ * `storagePublicRead: true` when the bucket genuinely is a public read-only CDN,
+ * or `storageInsecureAllowAnyAuthenticated: true` for a single-tenant app where
+ * every signed-in user is trusted with every file. Both are set on
+ * `initializeRebaseBackend` in `backend/src/index.ts`.
+ */
+export const storageAuthorize: StorageAuthorize = ({ key, user, operation }) => {
+    // The `public/` prefix is the framework's convention for world-readable
+    // objects, and it is what signed download URLs for public assets rely on.
+    if (operation === "read" && isPublicStoragePath(key)) {
+        return true;
+    }
+
+    // Everything else needs a caller. `user` is null on routes that allow
+    // unauthenticated access, so this is the anonymous denial.
+    if (!user) {
+        return false;
+    }
+
+    // Content is shared: any signed-in user may read it. A `viewer` has to be able
+    // to see the images the admin panel shows them.
+    if (operation === "read") {
+        return true;
+    }
+
+    // Changing or enumerating the library is an editor's job. Matches the roles in
+    // `collections/users.ts` — widen this if you add your own.
+    const roles = user.roles ?? [];
+    return roles.includes("admin") || roles.includes("editor");
+};