@rebasepro/cli 0.10.1-canary.d8d45b2 → 0.10.1-canary.ed8caed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.10.1-canary.d8d45b2",
+  "version": "0.10.1-canary.ed8caed",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,12 +31,12 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/agent-skills": "0.10.1-canary.d8d45b2",
-    "@rebasepro/client": "0.10.1-canary.d8d45b2",
-    "@rebasepro/codegen": "0.10.1-canary.d8d45b2",
-    "@rebasepro/types": "0.10.1-canary.d8d45b2",
-    "@rebasepro/server-postgres": "0.10.1-canary.d8d45b2",
-    "@rebasepro/server": "0.10.1-canary.d8d45b2"
+    "@rebasepro/agent-skills": "0.10.1-canary.ed8caed",
+    "@rebasepro/client": "0.10.1-canary.ed8caed",
+    "@rebasepro/types": "0.10.1-canary.ed8caed",
+    "@rebasepro/server": "0.10.1-canary.ed8caed",
+    "@rebasepro/codegen": "0.10.1-canary.ed8caed",
+    "@rebasepro/server-postgres": "0.10.1-canary.ed8caed"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",

package/templates/overlays/baas/backend/src/index.ts

@@ -15,6 +15,7 @@ import {
 } from "@rebasepro/server";
 import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
 import { env } from "./env.js";
+import { storageAuthorize } from "./storage.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -153,6 +154,12 @@ pass: env.SMTP_PASS! }
                         type: "local",
                         basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
                     },
+        // Storage is not under row-level security, so this hook IS its access
+        // model — the server refuses to boot in production without one, because
+        // "signed in" would otherwise be the only thing between a caller and every
+        // file in the bucket. See storage.ts; the default scopes each caller to
+        // `users/<uid>/` and is meant to be replaced with your own rule.
+        storageAuthorize,
         history: true,
         enableSwagger: true
     });

package/templates/overlays/baas/backend/src/storage.ts

@@ -0,0 +1,71 @@
+import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
+
+/**
+ * Who may do what to files in storage.
+ *
+ * Storage is **not** under row-level security. Tables are: a request runs as
+ * `rebase_user` and Postgres decides row by row. Object storage has no equivalent,
+ * so keys share one flat namespace and this hook is the whole authorization model.
+ * Without it the server refuses to boot in production, because "authenticated"
+ * would be the only thing between a signed-in caller and every file in the bucket —
+ * they can `GET /storage/list?prefix=` to enumerate every key, then read, overwrite
+ * or delete any of them.
+ *
+ * It lives in `backend/src/` rather than a config package because BaaS mode has no
+ * config package: collections come from the live database, so there is nothing to
+ * declare and nowhere else to put this.
+ *
+ * ## The default this starter ships
+ *
+ * A deliberately conservative one, because a BaaS project's storage semantics are
+ * whatever *your* application says they are and this file cannot know:
+ *
+ * | operation | who |
+ * | --- | --- |
+ * | `read` of `public/…` | anyone, signed in or not |
+ * | everything else | a signed-in caller under their own `users/<uid>/` prefix |
+ *
+ * Gating `list` on the prefix is the important half. Enumeration is what turns "keys
+ * are hard to guess" into "keys are known", and it is step one of the attack the
+ * boot guard exists to prevent.
+ *
+ * ## Replace this with your model
+ *
+ * Prefix rules are a starting point, not a general answer: they work for writes
+ * because a write *puts* the object there, but anything already in the bucket needs
+ * the row that owns it consulted. `ctx.data` is handed in for exactly that — trusted,
+ * RLS-bypassing reads, because the hook *is* the authorization decision and running
+ * it through a reader already narrowed by the caller's permissions would be circular:
+ *
+ * ```ts
+ * export const storageAuthorize: StorageAuthorize = async ({ key, user, operation, data }) => {
+ *     if (operation === "read" && isPublicStoragePath(key)) return true;
+ *     if (!user) return false;
+ *     const row = (await data?.collection("attachments").find({
+ *         where: { storage_key: ["==", key] }, limit: 1
+ *     }))?.data?.[0];
+ *     return row?.owner_id === user.uid;
+ * };
+ * ```
+ *
+ * If your bucket really is a public read-only CDN, `storagePublicRead: true` says so
+ * instead. If every signed-in caller is genuinely trusted with every file,
+ * `storageInsecureAllowAnyAuthenticated: true` says *that* — it is named to be read
+ * twice. Both are set on `initializeRebaseBackend` in `index.ts`.
+ */
+export const storageAuthorize: StorageAuthorize = ({ key, user, operation }) => {
+    // The `public/` prefix is the framework's convention for world-readable objects.
+    if (operation === "read" && isPublicStoragePath(key)) {
+        return true;
+    }
+
+    // `user` is null on routes that allow unauthenticated access.
+    if (!user) {
+        return false;
+    }
+
+    // Each caller gets their own namespace. A listing is scoped the same way, so a
+    // prefix outside it — including the empty prefix, which would enumerate the
+    // whole bucket — is denied.
+    return key.startsWith(`users/${user.uid}/`);
+};

package/templates/template/backend/src/index.ts

@@ -16,6 +16,7 @@ import {
 } from "@rebasepro/server";
 import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
 import { enums, relations, tables } from "./schema.generated.js";
+import { storageAuthorize } from "../../config/storage.js";
 import { env } from "./env.js";
 import usersCollection from "../../config/collections/users.js";
 
@@ -154,6 +155,12 @@ pass: env.SMTP_PASS! }
                         type: "local",
                         basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
                     },
+        // Storage is not under row-level security, so this hook IS its access
+        // model — the server refuses to boot in production without one, because
+        // "signed in" would otherwise be the only thing between a visitor and
+        // every file in the bucket. See config/storage.ts, which also shows the
+        // multi-tenant (per-owner) shape and the two escape hatches.
+        storageAuthorize,
         history: true
     });
 

package/templates/template/config/admin.d.ts

@@ -0,0 +1,9 @@
+/// <reference types="@rebasepro/admin-types" />
+
+// One line, once per project. `@rebasepro/admin-types` declares the `admin` block on
+// `CollectionConfig` and on every property type by declaration merging, and an
+// augmentation applies to the whole *program* — so this reference is what makes
+// `admin: { … }` legal in every collection file here.
+//
+// A BaaS project has no admin panel and no reason for this file. Without it, `admin` on
+// a collection or a property is a type error, which is the guarantee.

package/templates/template/config/collections/authors.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const authorsCollection: CollectionConfig = {
+const authorsCollection: PostgresCollectionConfig = {
     name: "Authors",
     singularName: "Author",
     slug: "authors",
     table: "authors",
-    icon: "Person",
     properties: {
         id: {
             name: "ID",
@@ -34,12 +33,15 @@ const authorsCollection: CollectionConfig = {
             }
         }
     },
-    propertiesOrder: [
-        "id",
-        "name",
-        "email",
-        "picture"
-    ]
+    admin: {
+        icon: "Person",
+        propertiesOrder: [
+            "id",
+            "name",
+            "email",
+            "picture"
+        ]
+    }
 };
 
 export default authorsCollection;

package/templates/template/config/collections/posts.ts

@@ -1,13 +1,12 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 import authorsCollection from "./authors.js";
 import tagsCollection from "./tags.js";
 
-const postsCollection: CollectionConfig = {
+const postsCollection: PostgresCollectionConfig = {
     name: "Posts",
     singularName: "Post",
     slug: "posts",
     table: "posts",
-    icon: "Article",
     properties: {
         id: {
             name: "ID",
@@ -24,7 +23,7 @@ const postsCollection: CollectionConfig = {
         content: {
             name: "Content",
             type: "string",
-            ui: {
+            admin: {
                 markdown: true
             }
         },
@@ -65,6 +64,9 @@ const postsCollection: CollectionConfig = {
             cardinality: "many",
             direction: "owning"
         }
+    },
+    admin: {
+        icon: "Article"
     }
 };
 

package/templates/template/config/collections/presets/ecommerce/categories.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const categoriesCollection: CollectionConfig = {
+const categoriesCollection: PostgresCollectionConfig = {
     name: "Categories",
     singularName: "Category",
     slug: "categories",
     table: "categories",
-    icon: "Category",
     properties: {
         id: {
             name: "ID",
@@ -25,7 +24,7 @@ const categoriesCollection: CollectionConfig = {
         description: {
             name: "Description",
             type: "string",
-            ui: {
+            admin: {
                 multiline: true
             }
         },
@@ -34,7 +33,10 @@ const categoriesCollection: CollectionConfig = {
             type: "string"
         }
     },
-    propertiesOrder: ["id", "name", "slug", "description", "icon"]
+    admin: {
+        icon: "Category",
+        propertiesOrder: ["id", "name", "slug", "description", "icon"]
+    }
 };
 
 export default categoriesCollection;

package/templates/template/config/collections/presets/ecommerce/orders.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const ordersCollection: CollectionConfig = {
+const ordersCollection: PostgresCollectionConfig = {
     name: "Orders",
     singularName: "Order",
     slug: "orders",
     table: "orders",
-    icon: "Receipt",
     properties: {
         id: {
             name: "ID",
@@ -22,21 +21,31 @@ const ordersCollection: CollectionConfig = {
             name: "Status",
             type: "string",
             enum: [
-                { id: "pending",
-label: "Pending",
-color: "gray" },
-                { id: "processing",
-label: "Processing",
-color: "blue" },
-                { id: "shipped",
-label: "Shipped",
-color: "orange" },
-                { id: "delivered",
-label: "Delivered",
-color: "green" },
-                { id: "cancelled",
-label: "Cancelled",
-color: "red" }
+                {
+                    id: "pending",
+                    label: "Pending",
+                    color: "gray"
+                },
+                {
+                    id: "processing",
+                    label: "Processing",
+                    color: "blue"
+                },
+                {
+                    id: "shipped",
+                    label: "Shipped",
+                    color: "orange"
+                },
+                {
+                    id: "delivered",
+                    label: "Delivered",
+                    color: "green"
+                },
+                {
+                    id: "cancelled",
+                    label: "Cancelled",
+                    color: "red"
+                }
             ]
         },
         total: {
@@ -47,7 +56,7 @@ color: "red" }
         notes: {
             name: "Notes",
             type: "string",
-            ui: {
+            admin: {
                 multiline: true
             }
         },
@@ -56,10 +65,13 @@ color: "red" }
             type: "date",
             columnName: "created_at",
             autoValue: "on_create",
-            ui: {
+            admin: {
                 readOnly: true
             }
         }
+    },
+    admin: {
+        icon: "Receipt"
     }
 };
 

package/templates/template/config/collections/presets/ecommerce/products.ts

@@ -1,12 +1,11 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 import categoriesCollection from "./categories.js";
 
-const productsCollection: CollectionConfig = {
+const productsCollection: PostgresCollectionConfig = {
     name: "Products",
     singularName: "Product",
     slug: "products",
     table: "products",
-    icon: "ShoppingCart",
     properties: {
         id: {
             name: "ID",
@@ -21,7 +20,7 @@ const productsCollection: CollectionConfig = {
         description: {
             name: "Description",
             type: "string",
-            ui: {
+            admin: {
                 markdown: true
             }
         },
@@ -39,15 +38,21 @@ const productsCollection: CollectionConfig = {
             name: "Status",
             type: "string",
             enum: [
-                { id: "draft",
-label: "Draft",
-color: "gray" },
-                { id: "active",
-label: "Active",
-color: "green" },
-                { id: "archived",
-label: "Archived",
-color: "orange" }
+                {
+                    id: "draft",
+                    label: "Draft",
+                    color: "gray"
+                },
+                {
+                    id: "active",
+                    label: "Active",
+                    color: "green"
+                },
+                {
+                    id: "archived",
+                    label: "Archived",
+                    color: "orange"
+                }
             ]
         },
         category: {
@@ -58,6 +63,9 @@ color: "orange" }
             cardinality: "one",
             direction: "owning"
         }
+    },
+    admin: {
+        icon: "ShoppingCart"
     }
 };
 

package/templates/template/config/collections/tags.ts

@@ -1,11 +1,10 @@
-import { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const tagsCollection: CollectionConfig = {
+const tagsCollection: PostgresCollectionConfig = {
     name: "Tags",
     singularName: "Tag",
     slug: "tags",
     table: "tags",
-    icon: "Tag",
     properties: {
         id: {
             name: "ID",
@@ -19,6 +18,9 @@ const tagsCollection: CollectionConfig = {
                 required: true
             }
         }
+    },
+    admin: {
+        icon: "Tag"
     }
 };
 

package/templates/template/config/collections/users.ts

@@ -1,29 +1,28 @@
-import type { CollectionConfig } from "@rebasepro/types";
+import type { PostgresCollectionConfig } from "@rebasepro/types";
 
-const usersCollection: CollectionConfig = {
+const usersCollection: PostgresCollectionConfig = {
     name: "Users",
     singularName: "User",
     slug: "users",
     auth: { enabled: true },
     table: "users",
     schema: "rebase",
-    icon: "Users",
-    group: "Settings",
-    openEntityMode: "dialog",
-    disableDefaultActions: ["copy"],
     securityRules: [
-        { operation: "select",
-roles: ["admin"] },
-        { operations: ["insert", "update", "delete"],
-roles: ["admin"] }
+        {
+            operation: "select",
+            roles: ["admin"]
+        },
+        {
+            operations: ["insert", "update", "delete"],
+            roles: ["admin"]
+        }
     ],
-    sort: ["createdAt", "desc"],
     properties: {
         id: {
             name: "ID",
             type: "string",
             isId: "uuid",
-            ui: {
+            admin: {
                 readOnly: true
             }
         },
@@ -44,9 +43,8 @@ roles: ["admin"] }
             name: "Photo URL",
             type: "string",
             columnName: "photo_url",
-            ui: {
-                url: "image"
-            }
+            url: true,
+            admin: { urlPreview: "image" }
         },
         roles: {
             name: "Roles",
@@ -67,7 +65,7 @@ roles: ["admin"] }
             type: "string",
             columnName: "password_hash",
             excludeFromApi: true,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -77,7 +75,7 @@ roles: ["admin"] }
             type: "boolean",
             columnName: "email_verified",
             defaultValue: false,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -87,7 +85,7 @@ roles: ["admin"] }
             type: "string",
             columnName: "email_verification_token",
             excludeFromApi: true,
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -96,7 +94,7 @@ roles: ["admin"] }
             name: "Email Verification Sent At",
             type: "date",
             columnName: "email_verification_sent_at",
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -107,7 +105,7 @@ roles: ["admin"] }
             keyValue: true,
             properties: {},
             defaultValue: {},
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
@@ -117,7 +115,7 @@ roles: ["admin"] }
             type: "date",
             columnName: "created_at",
             autoValue: "on_create",
-            ui: {
+            admin: {
                 readOnly: true
             }
         },
@@ -126,19 +124,26 @@ roles: ["admin"] }
             type: "date",
             columnName: "updated_at",
             autoValue: "on_update",
-            ui: {
+            admin: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
             }
         }
     },
-    propertiesOrder: [
-        "id",
-        "email",
-        "displayName",
-        "roles",
-        "createdAt"
-    ]
+    admin: {
+        icon: "Users",
+        group: "Settings",
+        openEntityMode: "dialog",
+        disableDefaultActions: ["copy"],
+        sort: ["createdAt", "desc"],
+        propertiesOrder: [
+            "id",
+            "email",
+            "displayName",
+            "roles",
+            "createdAt"
+        ]
+    }
 };
 
 export default usersCollection;

package/templates/template/config/frontend-assets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Ambient declarations for the asset imports a frontend component makes.
+ *
+ * A collection that points at a custom `Field` or `Preview` with a lazy `import()`
+ * thunk gets that reference type-checked — which means TypeScript resolves the
+ * component's *own* imports too, including `import icon from "./icon.png"`. That
+ * import is Vite's doing and means nothing to `tsc`: the frontend gets away with it
+ * through `vite/client` types, but those belong to the frontend's program, not this
+ * one, and Vite is not a dependency here (nothing in `config/` runs in a browser).
+ *
+ * Without these three lines, adding your first custom component fails the config and
+ * backend builds with `Cannot find module './icon.png'` — pointing at a frontend file
+ * from a build that has no obvious business compiling it.
+ */
+declare module "*.png" { const src: string; export default src; }
+declare module "*.svg" { const src: string; export default src; }
+declare module "*.jpg" { const src: string; export default src; }

package/templates/template/config/index.ts

@@ -4,3 +4,9 @@
  */
 
 export { collections } from "./collections/index.js";
+
+// Who may read, write, delete and list files in storage. Exported from here
+// because that is where the runtime and `rebase cloud deploy` look for it — the
+// bundle manifest records whether this export exists, so a managed deploy can be
+// refused with a readable message instead of turning into a boot crash-loop.
+export { storageAuthorize } from "./storage.js";

package/templates/template/config/package.json

@@ -1,28 +1,29 @@
 {
-    "name": "{{PROJECT_NAME}}-config",
-    "version": "1.0.0",
-    "description": "Shared collections for frontend and backend",
-    "main": "dist/index.js",
-    "types": "dist/index.d.ts",
-    "type": "module",
-    "private": true,
-    "scripts": {
-        "build": "tsc",
-        "dev": "tsc --watch",
-        "clean": "rm -rf dist"
+  "name": "{{PROJECT_NAME}}-config",
+  "version": "1.0.0",
+  "description": "Shared collections for frontend and backend",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "private": true,
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@rebasepro/admin-types": "workspace:*",
+    "@rebasepro/types": "workspace:*"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.2"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     },
-    "dependencies": {
-        "@rebasepro/types": "workspace:*"
-    },
-    "devDependencies": {
-        "typescript": "^5.9.2"
-    },
-    "exports": {
-        ".": {
-            "import": "./dist/index.js",
-            "types": "./dist/index.d.ts",
-            "default": "./dist/index.js"
-        },
-        "./package.json": "./package.json"
-    }
+    "./package.json": "./package.json"
+  }
 }