@tatara/cli 0.3.0 → 0.5.0

package/templates/features/prisma/files/src/core/db/migrate.ts

@@ -1,13 +1 @@
-import { execFile } from "node:child_process";
-import { resolve } from "node:path";
-import { promisify } from "node:util";
-
-const run = promisify(execFile);
-
-/** Applies prisma/migrations to the database at `url` (`prisma migrate deploy`). */
-export async function migrateDatabase(url: string): Promise<void> {
-	await run(resolve("node_modules/.bin/prisma"), ["migrate", "deploy"], {
-		// tatara-check-ignore env-access: the Prisma CLI needs the full environment
-		env: { ...process.env, DATABASE_URL: url },
-	});
-}
+export { migrateDatabase } from "@tatara/db/prisma";

package/templates/generators/resource/files+drizzle/src/modules/__moduleKebab__/services/__nameKebab__.service.ts

@@ -1,6 +1,6 @@
 import { count, desc, eq } from "drizzle-orm";
 import { db, type Executor } from "#core/db/client";
-import { newId } from "#core/db/id";
+import { newId } from "@tatara/db";
 import { NotFoundError } from "@tatara/http";
 import type { PaginationQuery } from "@tatara/http";
 import { __namePluralCamel__ } from "#modules/__moduleKebab__/db/__nameKebab__.schema";

package/templates/generators/resource/files+prisma/src/modules/__moduleKebab__/services/__nameKebab__.service.ts

@@ -1,5 +1,5 @@
 import { db, type Executor } from "#core/db/client";
-import { newId } from "#core/db/id";
+import { newId } from "@tatara/db";
 import { NotFoundError } from "@tatara/http";
 import type { PaginationQuery } from "@tatara/http";
 import type {

package/templates/versions.json

@@ -32,5 +32,9 @@
   "nodemailer": "10.1.1",
   "@types/nodemailer": "8.0.2",
   "@tatara/core": "0.1.0",
-  "@tatara/http": "0.1.0"
+  "@tatara/http": "0.1.0",
+  "@tatara/db": "0.1.0",
+  "@tatara/testing": "0.1.0",
+  "@tatara/auth": "0.1.0",
+  "@tatara/keycloak": "0.1.0"
 }

package/templates/features/auth/files/src/core/auth/middleware.ts

@@ -1,29 +0,0 @@
-import { createMiddleware } from "hono/factory";
-import type { Context } from "hono";
-import type { AppEnv, Principal } from "#core/http/context";
-import { ForbiddenError, UnauthorizedError } from "@tatara/http";
-
-/** 401 unless the request carries a valid session or token. */
-export function requireAuth() {
-	return createMiddleware<AppEnv>(async (c, next) => {
-		if (!c.get("principal")) throw new UnauthorizedError();
-		await next();
-	});
-}
-
-/** 401 without a principal, 403 unless it has at least one of the roles. */
-export function requireRole(...roles: string[]) {
-	return createMiddleware<AppEnv>(async (c, next) => {
-		const principal = c.get("principal");
-		if (!principal) throw new UnauthorizedError();
-		if (!principal.roles.some((role) => roles.includes(role))) throw new ForbiddenError();
-		await next();
-	});
-}
-
-/** The authenticated principal; use in handlers behind requireAuth(). */
-export function currentPrincipal(c: Context<AppEnv>): Principal {
-	const principal = c.get("principal");
-	if (!principal) throw new UnauthorizedError();
-	return principal;
-}

package/templates/features/auth-keycloak/files/src/core/auth/keycloak-plugin.ts

@@ -1,154 +0,0 @@
-import type { BetterAuthPlugin } from "better-auth";
-import { createAuthEndpoint } from "better-auth/api";
-import { z } from "zod";
-import {
-	type KeycloakClaims,
-	organizationOf,
-	rolesOf,
-	verifyAccessToken,
-} from "#core/auth/keycloak";
-import { logger } from "#core/logging/logger";
-
-export interface KeycloakPrincipal {
-	userId: string;
-	orgId: string | null;
-	roles: string[];
-	kind: "user" | "service";
-	claims: KeycloakClaims;
-}
-
-export interface KeycloakTokensOptions {
-	/** Record the token's organization as a better-auth organization + membership. */
-	organizations?: boolean;
-}
-
-type Adapter = Parameters<NonNullable<BetterAuthPlugin["init"]>>[0]["adapter"];
-
-const ACCOUNT_PROVIDER = "keycloak";
-
-async function ensureUser(adapter: Adapter, claims: KeycloakClaims): Promise<boolean> {
-	// an unverified email could claim someone else's address, so it is never stored
-	const verified = claims.email_verified === true && Boolean(claims.email);
-	const email = verified
-		? (claims.email as string).toLowerCase()
-		: `${claims.sub}@users.keycloak.invalid`;
-	const name = claims.name ?? claims.preferred_username ?? claims.sub;
-	const owner = await adapter.findOne<{ id: string }>({
-		model: "user",
-		where: [{ field: "email", value: email }],
-	});
-	const existing = await adapter.findOne<{ id: string }>({
-		model: "user",
-		where: [{ field: "id", value: claims.sub }],
-	});
-	if (existing) {
-		const emailFree = !owner || owner.id === claims.sub;
-		if (!emailFree) logger.warn({ sub: claims.sub }, "keycloak email belongs to another account");
-		await adapter.update({
-			model: "user",
-			where: [{ field: "id", value: claims.sub }],
-			update: {
-				name,
-				...(emailFree ? { email, emailVerified: verified } : {}),
-				updatedAt: new Date(),
-			},
-		});
-		return true;
-	}
-	if (owner) {
-		// never attach a Keycloak identity to an account that signs in another way
-		logger.warn({ sub: claims.sub }, "keycloak token email belongs to another account");
-		return false;
-	}
-	const now = new Date();
-	await adapter.create({
-		model: "user",
-		data: { id: claims.sub, email, emailVerified: verified, name, createdAt: now, updatedAt: now },
-		forceAllowId: true,
-	});
-	await adapter.create({
-		model: "account",
-		data: {
-			userId: claims.sub,
-			accountId: claims.sub,
-			providerId: ACCOUNT_PROVIDER,
-			createdAt: now,
-			updatedAt: now,
-		},
-	});
-	return true;
-}
-
-async function ensureMembership(adapter: Adapter, orgId: string, userId: string): Promise<void> {
-	const org = await adapter.findOne({
-		model: "organization",
-		where: [{ field: "id", value: orgId }],
-	});
-	if (!org) {
-		await adapter.create({
-			model: "organization",
-			data: { id: orgId, name: orgId, slug: orgId, createdAt: new Date() },
-			forceAllowId: true,
-		});
-	}
-	const member = await adapter.findOne({
-		model: "member",
-		where: [
-			{ field: "organizationId", value: orgId },
-			{ field: "userId", value: userId },
-		],
-	});
-	if (!member) {
-		await adapter.create({
-			model: "member",
-			data: { organizationId: orgId, userId, role: "member", createdAt: new Date() },
-		});
-	}
-}
-
-/**
- * Lets the API accept access tokens issued by Keycloak (a resource server).
- * Verified tokens become principals; their users and organizations are kept in better-auth's tables.
- */
-export function keycloakTokens(options: KeycloakTokensOptions = {}) {
-	// subjects already synced by this process; tokens are re-verified on every request regardless
-	const synced = new Set<string>();
-	return {
-		id: "keycloak-tokens",
-		endpoints: {
-			// no path: callable only on the server as auth.api.verifyKeycloakToken
-			verifyKeycloakToken: createAuthEndpoint(
-				{ method: "POST", body: z.object({ token: z.string() }) },
-				async (ctx): Promise<KeycloakPrincipal | null> => {
-					let claims: KeycloakClaims;
-					try {
-						claims = await verifyAccessToken(ctx.body.token);
-					} catch (error) {
-						logger.debug({ err: error }, "rejected keycloak token");
-						return null;
-					}
-					const isService = claims.preferred_username?.startsWith("service-account-") ?? false;
-					const orgId = organizationOf(claims);
-					if (!isService) {
-						const key = `${claims.sub}|${orgId ?? ""}|${claims.email ?? ""}`;
-						if (!synced.has(key)) {
-							const { adapter } = ctx.context;
-							if (!(await ensureUser(adapter, claims))) return null;
-							if (orgId && options.organizations)
-								await ensureMembership(adapter, orgId, claims.sub);
-							if (synced.size > 10_000) synced.clear();
-							synced.add(key);
-						}
-					}
-					return {
-						userId: claims.sub,
-						orgId,
-						roles: rolesOf(claims),
-						kind: isService ? "service" : "user",
-						claims,
-					};
-				},
-			),
-		},
-	} satisfies BetterAuthPlugin;
-}

package/templates/features/better-auth/files/src/core/auth/openapi.ts

@@ -1,60 +0,0 @@
-import type { OpenAPIHono } from "@hono/zod-openapi";
-import { auth } from "#core/auth/auth";
-
-type JsonObject = Record<string, unknown>;
-type OpenApiDocument = ReturnType<OpenAPIHono["getOpenAPI31Document"]>;
-type Paths = NonNullable<OpenApiDocument["paths"]>;
-type Components = NonNullable<OpenApiDocument["components"]>;
-
-interface AuthDocument {
-	paths?: Record<string, JsonObject>;
-	components?: { schemas?: JsonObject; securitySchemes?: JsonObject };
-}
-
-const SCHEMA_REF = "#/components/schemas/";
-
-// better-auth names schemas like the app (User, Member, …); prefix them so neither side is overwritten
-function renameRefs(value: unknown, rename: (name: string) => string): AuthDocument {
-	return JSON.parse(
-		JSON.stringify(value).replaceAll(
-			new RegExp(`"\\$ref":"${SCHEMA_REF}([^"]+)"`, "g"),
-			(_match, name: string) => `"$ref":"${SCHEMA_REF}${rename(name)}"`,
-		),
-	) as AuthDocument;
-}
-
-function retag(paths: Record<string, JsonObject>, tag: string): Record<string, JsonObject> {
-	for (const operations of Object.values(paths)) {
-		for (const operation of Object.values(operations as Record<string, JsonObject>)) {
-			if (operation && typeof operation === "object") operation.tags = [tag];
-		}
-	}
-	return paths;
-}
-
-/** Adds better-auth's endpoints (served under `basePath`) to the app's OpenAPI document. */
-export async function mergeAuthOpenApi(document: OpenApiDocument, basePath: string): Promise<void> {
-	const authDoc = renameRefs(await auth.api.generateOpenAPISchema(), (name) => `Auth${name}`);
-
-	document.paths ??= {};
-	for (const [path, operations] of Object.entries(retag(authDoc.paths ?? {}, "Auth"))) {
-		document.paths[`${basePath}${path}`] = operations as Paths[string];
-	}
-
-	document.components ??= {};
-	document.components.schemas ??= {};
-	for (const [name, schema] of Object.entries(authDoc.components?.schemas ?? {})) {
-		document.components.schemas[`Auth${name}`] = schema as NonNullable<
-			Components["schemas"]
-		>[string];
-	}
-	document.components.securitySchemes = {
-		...(authDoc.components?.securitySchemes as Components["securitySchemes"]),
-		...document.components.securitySchemes,
-	};
-
-	document.tags = [
-		...(document.tags ?? []),
-		{ name: "Auth", description: "Sign-up, sign-in, sessions, organizations (better-auth)" },
-	];
-}

package/templates/features/db/files/src/core/db/id.ts

@@ -1,13 +0,0 @@
-import { randomFillSync } from "node:crypto";
-
-/** UUIDv7: random but time-ordered, so sorting by id is sorting by creation time. */
-export function newId(): string {
-	const bytes = new Uint8Array(16);
-	randomFillSync(bytes);
-	const ms = BigInt(Date.now());
-	for (let i = 0; i < 6; i++) bytes[i] = Number((ms >> BigInt(8 * (5 - i))) & 0xffn);
-	bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x70;
-	bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80;
-	const hex = [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}

package/templates/features/db/files/src/core/db/seed.ts

@@ -1,14 +0,0 @@
-import type { Logger } from "#core/logging/logger";
-
-export interface SeedDefinition {
-	name: string;
-	/** lower runs first */
-	order?: number;
-	/** must be idempotent: seeds run on every `tatara dev` */
-	run(ctx: { logger: Logger }): Promise<void>;
-}
-
-/** Default export of every `db/seed.ts`; discovered by `tatara sync`. */
-export function defineSeed(definition: SeedDefinition): SeedDefinition {
-	return definition;
-}

package/templates/features/db/files/tests/helpers/database-url.ts

@@ -1,9 +0,0 @@
-/** Number of Vitest workers; global setup prepares one database per worker. */
-export const TEST_WORKERS = 4;
-
-/** postgres://…/app_test → postgres://…/app_test_<worker> */
-export function workerDatabaseUrl(baseUrl: string, worker: number | string): string {
-	const url = new URL(baseUrl);
-	url.pathname = `${url.pathname}_${worker}`;
-	return url.toString();
-}