@rebasepro/cli 0.8.0 → 0.9.1-canary.09aaf62

package/templates/template/backend/src/index.ts

@@ -7,14 +7,14 @@ import path from "path";
 import { fileURLToPath } from "url";
 import {
     initializeRebaseBackend,
+    installShutdownHandlers,
     serveSPA,
     HonoEnv,
     listenWithPortRetry,
     cleanupDevPortFile,
     logger
-} from "@rebasepro/server-core";
-import type { SecurityRule } from "@rebasepro/types";
-import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgresql";
+} from "@rebasepro/server";
+import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
 import { enums, relations, tables } from "./schema.generated.js";
 import { env } from "./env.js";
 import usersCollection from "../../config/collections/users.js";
@@ -39,10 +39,26 @@ const allowedOrigins = isProduction
     })()
     : [];
 
+// In dev we still restrict which origins are reflected. Because `credentials`
+// is enabled, reflecting an arbitrary Origin would let any website the
+// developer happens to visit make credentialed cross-origin requests to this
+// dev server (and read the responses) using the developer's session. So dev
+// reflects only localhost origins; requests with no Origin (curl, same-origin)
+// are unaffected.
+const isLocalhostOrigin = (origin: string): boolean => {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+    } catch {
+        return false;
+    }
+};
+
 app.use("/*", cors({
     origin: (origin) => {
-        if (!isProduction) return origin || "*";
-        return allowedOrigins.includes(origin) ? origin : null;
+        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
+        if (!origin) return "*";
+        return isLocalhostOrigin(origin) ? origin : null;
     },
     credentials: true
 }));
@@ -60,15 +76,6 @@ async function startServer() {
     const PORT = env.PORT;
     const server = createServer(getRequestListener(app.fetch));
 
-    // Default security rules for collections that don't define their own.
-    // Authenticated users can read all rows; only admins can write.
-    const defaultSecurityRules: SecurityRule[] = [
-        { operation: "select",
-access: "public" },
-        { operations: ["insert", "update", "delete"],
-roles: ["admin"] }
-    ];
-
     const backend = await initializeRebaseBackend({
         collectionsDir: path.resolve(__dirname, "../../config/collections"),
         functionsDir: path.resolve(__dirname, "../functions"),
@@ -88,6 +95,12 @@ relations },
             accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
             refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
             serviceKey: env.REBASE_SERVICE_KEY,
+            // Cookie-based auth: the refresh token is stored in an httpOnly
+            // cookie (not readable by JS) instead of localStorage, so it is
+            // not exposed to XSS. The frontend opts in via
+            // `authFlowMode: "cookie"` on createRebaseClient. Requires CORS
+            // `credentials: true` (set above).
+            cookieAuth: { sameSite: "Lax" },
             google: env.GOOGLE_CLIENT_ID
                 ? { clientId: env.GOOGLE_CLIENT_ID }
                 : undefined,
@@ -124,8 +137,7 @@ pass: env.SMTP_PASS! }
                 type: "local",
                 basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
             },
-        history: true,
-        defaultSecurityRules
+        history: true
     });
 
     // ─── Health check ─────────────────────────────────────────────
@@ -163,17 +175,11 @@ pass: env.SMTP_PASS! }
     }
 
     // ─── Graceful Shutdown ───────────────────────────────────────────────
-    // Uses the framework's built-in shutdown() which drains connections,
-    // stops the cron scheduler, and force-exits after 15s timeout.
-    const gracefulShutdown = async (signal: string) => {
-        logger.info(`Received ${signal}, shutting down...`);
-        await backend.shutdown();
-        await pool.end();
-        logger.info("Database pool closed");
-        process.exit(0);
-    };
-    process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
-    process.on("SIGINT", () => gracefulShutdown("SIGINT"));
+    // Drains HTTP, stops crons, tears down realtime, then closes the pool.
+    // Guards against double signals and force-exits if shutdown hangs.
+    installShutdownHandlers(backend, {
+        onCleanup: () => pool.end()
+    });
 }
 
 startServer().catch(err => {

package/templates/template/config/collections/authors.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const authorsCollection: EntityCollection = {
+const authorsCollection: CollectionConfig = {
     name: "Authors",
     singularName: "Author",
     slug: "authors",

package/templates/template/config/collections/index.ts

@@ -2,5 +2,25 @@ import postsCollection from "./posts.js";
 import authorsCollection from "./authors.js";
 import tagsCollection from "./tags.js";
 import usersCollection from "./users.js";
+import type { SecurityRule } from "@rebasepro/types";
 
 export const collections = [postsCollection, authorsCollection, tagsCollection, usersCollection];
+
+/**
+ * Applied to any collection in this directory that declares no
+ * `securityRules` of its own: anyone can read, only admins can write.
+ *
+ * These live here, next to the collections, because `rebase db push`
+ * generates the Postgres policies from these files — that is what actually
+ * enforces access. A default declared on the server could never reach the
+ * database.
+ *
+ * A collection that declares neither its own rules nor inherits these is
+ * locked by default: admin-only.
+ */
+export const defaultSecurityRules: SecurityRule[] = [
+    { operation: "select",
+access: "public" },
+    { operations: ["insert", "update", "delete"],
+roles: ["admin"] }
+];

package/templates/template/config/collections/posts.ts

@@ -1,8 +1,8 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 import authorsCollection from "./authors.js";
 import tagsCollection from "./tags.js";
 
-const postsCollection: EntityCollection = {
+const postsCollection: CollectionConfig = {
     name: "Posts",
     singularName: "Post",
     slug: "posts",

package/templates/template/config/collections/presets/blank/index.ts

@@ -1,3 +1,5 @@
-import usersCollection from "../../users.js";
+// Resolves after `rebase init` copies this file into config/collections/,
+// next to the shared users.ts — not from inside presets/, which never runs.
+import usersCollection from "./users.js";
 
 export const collections = [usersCollection];

package/templates/template/config/collections/presets/ecommerce/categories.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const categoriesCollection: EntityCollection = {
+const categoriesCollection: CollectionConfig = {
     name: "Categories",
     singularName: "Category",
     slug: "categories",

package/templates/template/config/collections/presets/ecommerce/index.ts

@@ -1,6 +1,8 @@
 import productsCollection from "./products.js";
 import categoriesCollection from "./categories.js";
 import ordersCollection from "./orders.js";
-import usersCollection from "../../users.js";
+// Resolves after `rebase init` copies this file into config/collections/,
+// next to the shared users.ts — not from inside presets/, which never runs.
+import usersCollection from "./users.js";
 
 export const collections = [productsCollection, categoriesCollection, ordersCollection, usersCollection];

package/templates/template/config/collections/presets/ecommerce/orders.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const ordersCollection: EntityCollection = {
+const ordersCollection: CollectionConfig = {
     name: "Orders",
     singularName: "Order",
     slug: "orders",

package/templates/template/config/collections/presets/ecommerce/products.ts

@@ -1,7 +1,7 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 import categoriesCollection from "./categories.js";
 
-const productsCollection: EntityCollection = {
+const productsCollection: CollectionConfig = {
     name: "Products",
     singularName: "Product",
     slug: "products",

package/templates/template/config/collections/tags.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const tagsCollection: EntityCollection = {
+const tagsCollection: CollectionConfig = {
     name: "Tags",
     singularName: "Tag",
     slug: "tags",

package/templates/template/config/collections/users.ts

@@ -1,6 +1,6 @@
-import type { EntityCollection } from "@rebasepro/types";
+import type { CollectionConfig } from "@rebasepro/types";
 
-const usersCollection: EntityCollection = {
+const usersCollection: CollectionConfig = {
     name: "Users",
     singularName: "User",
     slug: "users",
@@ -66,6 +66,7 @@ roles: ["admin"] }
             name: "Password Hash",
             type: "string",
             columnName: "password_hash",
+            excludeFromApi: true,
             ui: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
@@ -85,6 +86,7 @@ roles: ["admin"] }
             name: "Email Verification Token",
             type: "string",
             columnName: "email_verification_token",
+            excludeFromApi: true,
             ui: {
                 hideFromCollection: true,
                 disabled: { hidden: true }

package/templates/template/config/package.json

@@ -12,8 +12,7 @@
         "clean": "rm -rf dist"
     },
     "dependencies": {
-        "@rebasepro/types": "workspace:*",
-        "@rebasepro/admin": "workspace:*"
+        "@rebasepro/types": "workspace:*"
     },
     "devDependencies": {
         "typescript": "^5.9.2"

package/templates/template/frontend/package.json

@@ -4,9 +4,8 @@
     "private": true,
     "type": "module",
     "dependencies": {
-        "@rebasepro/auth": "workspace:*",
-        "@rebasepro/core": "workspace:*",
-        "@rebasepro/plugin-data-enhancement": "workspace:*",
+        "@rebasepro/app": "workspace:*",
+        "@rebasepro/plugin-ai": "workspace:*",
         "@rebasepro/client": "workspace:*",
         "@rebasepro/admin": "workspace:*",
         "@rebasepro/studio": "workspace:*",

package/templates/template/frontend/src/App.tsx

@@ -3,9 +3,8 @@ import React from "react";
 import "@fontsource/jetbrains-mono";
 import "@fontsource/rubik";
 
-import { useRebaseAuthController } from "@rebasepro/auth";
-import { Rebase, RebaseAuth } from "@rebasepro/core";
-import { RebaseCMS, RebaseShell } from "@rebasepro/admin";
+import { Rebase, RebaseAuth, useRebaseAuthController } from "@rebasepro/app";
+import { RebaseAdmin, RebaseShell } from "@rebasepro/admin";
 import { ErrorBoundary } from "@rebasepro/ui";
 import { RebaseStudio } from "@rebasepro/studio";
 import { createRebaseClient } from "@rebasepro/client";
@@ -17,7 +16,10 @@ const GOOGLE_CLIENT_ID = import.meta.env.VITE_GOOGLE_CLIENT_ID;
 
 export function App() {
     const rebaseClient = React.useMemo(() => createRebaseClient({
-        baseUrl: API_URL
+        baseUrl: API_URL,
+        // Store the refresh token in an httpOnly cookie (XSS-safe) rather than
+        // localStorage. The backend issues it via `auth.cookieAuth`.
+        auth: { authFlowMode: "cookie" }
     }), []);
 
     const authController = useRebaseAuthController({
@@ -32,7 +34,7 @@ export function App() {
                 authController={authController}
             >
                 <RebaseAuth />
-                <RebaseCMS
+                <RebaseAdmin
                     collections={collections}
                 />
                 <RebaseStudio/>

package/templates/template/frontend/vite.config.ts

@@ -3,10 +3,24 @@ import { defineConfig } from "vite";
 import react from "@vitejs/plugin-react";
 import svgr from "vite-plugin-svgr";
 import tailwindcss from "@tailwindcss/vite";
-import { rebaseCollectionsPlugin } from "@rebasepro/core/vitePlugin";
+import { rebaseCollectionsPlugin } from "@rebasepro/app/vitePlugin";
 
 export default defineConfig({
     envDir: path.resolve(__dirname, ".."),
+    // Force a single copy of React and React Router across the app and all
+    // @rebasepro/* packages. Without this, a locally `link:`ed Rebase checkout
+    // resolves its own copies of react-router, producing "multiple copies of
+    // React" and "useBlocker must be used within a data router" errors in the
+    // admin. Safe to keep for npm-installed setups too.
+    resolve: {
+        dedupe: [
+            "react",
+            "react-dom",
+            "react-router",
+            "react-router-dom",
+            "@remix-run/router"
+        ]
+    },
     esbuild: {
         logOverride: { "this-is-undefined-in-esm": "silent" }
     },

package/templates/template/gitignore

@@ -0,0 +1,31 @@
+# Dependencies
+node_modules/
+
+# Build output
+dist/
+build/
+
+# Environment (secrets — .env.example is tracked)
+.env
+.env.local
+!.env.example
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Drizzle
+drizzle/meta/
+
+# Uploads
+uploads/
+
+# Rebase dev
+.rebase-dev-url
+.rebase-dev-port

package/templates/template/npmrc

@@ -0,0 +1,10 @@
+# Ensure pnpm links local workspace packages when version specifiers
+# like "*" are used (instead of the pnpm-specific "workspace:*" protocol).
+# This makes the project compatible with both pnpm and npm workspaces.
+link-workspace-packages=true
+
+# Disable automatic dependency check before running scripts to prevent background install failures in read-only environments
+verify-deps-before-run=false
+
+# Prevent pnpm from prompting for confirmation when purging modules in non-TTY environments (e.g. Docker, CI)
+confirm-modules-purge=false