@thunder-stack/create-thunder-app 0.0.1

package/template/server/db/src/schema/auth.ts

@@ -0,0 +1,73 @@
+import { relations } from "drizzle-orm";
+import { pgTable, text, timestamp, boolean } from "drizzle-orm/pg-core";
+import { userRole } from "./rbac";
+
+export const user = pgTable("user", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  email: text("email").notNull().unique(),
+  emailVerified: boolean("email_verified").notNull(),
+  image: text("image"),
+  createdAt: timestamp("created_at").notNull(),
+  updatedAt: timestamp("updated_at").notNull(),
+});
+
+export const userRelations = relations(user, ({ many }) => ({
+  sessions: many(session),
+  accounts: many(account),
+  userRoles: many(userRole),
+}));
+
+export const session = pgTable("session", {
+  id: text("id").primaryKey(),
+  expiresAt: timestamp("expires_at").notNull(),
+  token: text("token").notNull().unique(),
+  createdAt: timestamp("created_at").notNull(),
+  updatedAt: timestamp("updated_at").notNull(),
+  ipAddress: text("ip_address"),
+  userAgent: text("user_agent"),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+});
+
+export const sessionRelations = relations(session, ({ one }) => ({
+  user: one(user, {
+    fields: [session.userId],
+    references: [user.id],
+  }),
+}));
+
+export const account = pgTable("account", {
+  id: text("id").primaryKey(),
+  accountId: text("account_id").notNull(),
+  providerId: text("provider_id").notNull(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  accessToken: text("access_token"),
+  refreshToken: text("refresh_token"),
+  idToken: text("id_token"),
+  accessTokenExpiresAt: timestamp("access_token_expires_at"),
+  refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+  scope: text("scope"),
+  password: text("password"),
+  createdAt: timestamp("created_at").notNull(),
+  updatedAt: timestamp("updated_at").notNull(),
+});
+
+export const accountRelations = relations(account, ({ one }) => ({
+  user: one(user, {
+    fields: [account.userId],
+    references: [user.id],
+  }),
+}));
+
+export const verification = pgTable("verification", {
+  id: text("id").primaryKey(),
+  identifier: text("identifier").notNull(),
+  value: text("value").notNull(),
+  expiresAt: timestamp("expires_at").notNull(),
+  createdAt: timestamp("created_at"),
+  updatedAt: timestamp("updated_at"),
+});

package/template/server/db/src/schema/index.ts

@@ -0,0 +1,2 @@
+export * from "./auth";
+export * from "./rbac";

package/template/server/db/src/schema/rbac.ts

@@ -0,0 +1,72 @@
+import { relations } from "drizzle-orm";
+import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { user } from "./auth";
+
+export const role = pgTable("role", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull().unique(),
+  description: text("description"),
+  createdAt: timestamp("created_at").notNull(),
+  updatedAt: timestamp("updated_at").notNull(),
+});
+
+export const roleRelations = relations(role, ({ many }) => ({
+  rolePermissions: many(rolePermission),
+  userRoles: many(userRole),
+}));
+
+export const permission = pgTable("permission", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull().unique(),
+  description: text("description"),
+  createdAt: timestamp("created_at").notNull(),
+  updatedAt: timestamp("updated_at").notNull(),
+});
+
+export const permissionRelations = relations(permission, ({ many }) => ({
+  rolePermissions: many(rolePermission),
+}));
+
+export const rolePermission = pgTable("role_permission", {
+  id: text("id").primaryKey(),
+  roleId: text("role_id")
+    .notNull()
+    .references(() => role.id, { onDelete: "cascade" }),
+  permissionId: text("permission_id")
+    .notNull()
+    .references(() => permission.id, { onDelete: "cascade" }),
+  createdAt: timestamp("created_at").notNull(),
+});
+
+export const rolePermissionRelations = relations(rolePermission, ({ one }) => ({
+  role: one(role, {
+    fields: [rolePermission.roleId],
+    references: [role.id],
+  }),
+  permission: one(permission, {
+    fields: [rolePermission.permissionId],
+    references: [permission.id],
+  }),
+}));
+
+export const userRole = pgTable("user_role", {
+  id: text("id").primaryKey(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => user.id, { onDelete: "cascade" }),
+  roleId: text("role_id")
+    .notNull()
+    .references(() => role.id, { onDelete: "cascade" }),
+  createdAt: timestamp("created_at").notNull(),
+});
+
+export const userRoleRelations = relations(userRole, ({ one }) => ({
+  user: one(user, {
+    fields: [userRole.userId],
+    references: [user.id],
+  }),
+  role: one(role, {
+    fields: [userRole.roleId],
+    references: [role.id],
+  }),
+}));

package/template/server/db/src/schema.ts

@@ -0,0 +1 @@
+export * from "./schema/index";

package/template/server/db/src/seed.ts

@@ -0,0 +1,204 @@
+import { createDbClient } from "./index";
+import { user, role, permission, rolePermission, userRole } from "./schema";
+import { eq } from "drizzle-orm";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+
+const dbUrl = process.env.DATABASE_URL;
+if (!dbUrl) {
+  console.error("DATABASE_URL environment variable is required to run the seed script.");
+  process.exit(1);
+}
+
+const db = createDbClient(dbUrl);
+
+async function main() {
+  console.log("Starting database seed...");
+
+  // 1. Insert permissions
+  const permissionsData = [
+    { id: "perm_view_dashboard", name: "view_dashboard", description: "Allows viewing the dashboard and stats" },
+    { id: "perm_manage_user", name: "manage:user", description: "Allows managing user roles and viewing user lists" },
+    { id: "perm_manage_role", name: "manage:role", description: "Allows creating, editing, and deleting roles" },
+    { id: "perm_manage_role_perm", name: "manage:role-perm", description: "Allows mapping permissions to roles" },
+  ];
+
+  console.log("Upserting permissions...");
+  for (const perm of permissionsData) {
+    await db
+      .insert(permission)
+      .values({
+        id: perm.id,
+        name: perm.name,
+        description: perm.description,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      })
+      .onConflictDoNothing();
+  }
+
+  // 2. Insert roles
+  const rolesData = [
+    { id: "role_admin", name: "Admin", description: "System administrator with full access permissions" },
+    { id: "role_user", name: "User", description: "Regular system user with dashboard access only" },
+  ];
+
+  console.log("Upserting roles...");
+  for (const r of rolesData) {
+    await db
+      .insert(role)
+      .values({
+        id: r.id,
+        name: r.name,
+        description: r.description,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      })
+      .onConflictDoNothing();
+  }
+
+  // 3. Link permissions to roles
+  console.log("Linking permissions to Admin role...");
+  for (const perm of permissionsData) {
+    await db
+      .insert(rolePermission)
+      .values({
+        id: `rp_admin_${perm.name}`,
+        roleId: "role_admin",
+        permissionId: perm.id,
+        createdAt: new Date(),
+      })
+      .onConflictDoNothing();
+  }
+
+  console.log("Linking permissions to User role...");
+  await db
+    .insert(rolePermission)
+    .values({
+      id: "rp_user_view_dashboard",
+      roleId: "role_user",
+      permissionId: "perm_view_dashboard",
+      createdAt: new Date(),
+    })
+    .onConflictDoNothing();
+
+  // 4. Create default admin user via Better Auth (so the password gets hashed correctly)
+  const adminEmail = "admin@thunderstack.dev";
+  const adminPassword = "AdminPassword123!";
+
+  console.log("Initializing Better Auth for seed...");
+  const auth = betterAuth({
+    database: drizzleAdapter(db, {
+      provider: "pg",
+    }),
+    secret: process.env.BETTER_AUTH_SECRET || "temp_secret_for_seeding_12345678",
+    baseURL: process.env.BETTER_AUTH_URL || "http://localhost:8787",
+    emailAndPassword: {
+      enabled: true,
+    },
+  });
+
+  let adminUser = await db.query.user.findFirst({
+    where: eq(user.email, adminEmail),
+  });
+
+  if (!adminUser) {
+    console.log(`Creating default Admin user: ${adminEmail}...`);
+    try {
+      const result = await auth.api.signUpEmail({
+        headers: new Headers(),
+        body: {
+          email: adminEmail,
+          password: adminPassword,
+          name: "System Admin",
+        },
+      });
+
+      if (result && result.user) {
+        adminUser = {
+          ...result.user,
+          image: result.user.image ?? null,
+        };
+        console.log("Admin user created.");
+      } else {
+        throw new Error("Invalid response from auth.api.signUpEmail");
+      }
+    } catch (err) {
+      console.error("Failed to create admin user via Better Auth API:", err);
+      process.exit(1);
+    }
+  } else {
+    console.log("Admin user already exists.");
+  }
+
+  if (adminUser) {
+    // 5. Assign Admin role to the Admin user
+    console.log("Assigning Admin role to Admin user...");
+    await db
+      .insert(userRole)
+      .values({
+        id: `ur_${adminUser.id}_role_admin`,
+        userId: adminUser.id,
+        roleId: "role_admin",
+        createdAt: new Date(),
+      })
+      .onConflictDoNothing();
+  }
+
+  // 6. Create extra dummy users
+  const dummyUsers = [
+    { email: "jane@thunderstack.dev", password: "UserPassword123!", name: "Jane Doe", roleId: "role_user" },
+    { email: "john@thunderstack.dev", password: "UserPassword123!", name: "John Smith", roleId: "role_user" },
+    { email: "moderator@thunderstack.dev", password: "ModPassword123!", name: "Alex Moderator", roleId: "role_user" },
+  ];
+
+  for (const u of dummyUsers) {
+    let existingUser = await db.query.user.findFirst({
+      where: eq(user.email, u.email),
+    });
+
+    if (!existingUser) {
+      console.log(`Creating dummy user: ${u.email}...`);
+      try {
+        const result = await auth.api.signUpEmail({
+          headers: new Headers(),
+          body: {
+            email: u.email,
+            password: u.password,
+            name: u.name,
+          },
+        });
+
+        if (result && result.user) {
+          existingUser = {
+            ...result.user,
+            image: result.user.image ?? null,
+          };
+          console.log(`User ${u.email} created.`);
+        }
+      } catch (err) {
+        console.error(`Failed to create user ${u.email}:`, err);
+      }
+    }
+
+    if (existingUser) {
+      console.log(`Assigning role ${u.roleId} to user ${u.email}...`);
+      await db
+        .insert(userRole)
+        .values({
+          id: `ur_${existingUser.id}_${u.roleId}`,
+          userId: existingUser.id,
+          roleId: u.roleId,
+          createdAt: new Date(),
+        })
+        .onConflictDoNothing();
+    }
+  }
+
+  console.log("Database seeding completed successfully!");
+}
+
+main().catch((err) => {
+  console.error("Unhandled database seed error:", err);
+  process.exit(1);
+});

package/template/server/db/src/services/rbac.ts

@@ -0,0 +1,144 @@
+import { eq, and, sql } from "drizzle-orm";
+import type { DbClient } from "../index";
+import * as schema from "../schema";
+import type { Role, Permission } from "../types";
+
+export class RbacService {
+  constructor(private db: DbClient) {}
+
+  async getStats(): Promise<{ users: number; roles: number; permissions: number }> {
+    const usersRes = await this.db.select({ count: sql<number>`count(*)` }).from(schema.user);
+    const rolesRes = await this.db.select({ count: sql<number>`count(*)` }).from(schema.role);
+    const permsRes = await this.db.select({ count: sql<number>`count(*)` }).from(schema.permission);
+    
+    return {
+      users: Number(usersRes[0]?.count || 0),
+      roles: Number(rolesRes[0]?.count || 0),
+      permissions: Number(permsRes[0]?.count || 0),
+    };
+  }
+
+  async getPermissions(): Promise<Permission[]> {
+    return this.db.select().from(schema.permission);
+  }
+
+  async getRoles(): Promise<(Role & { permissions: Permission[] })[]> {
+    const roles = await this.db.select().from(schema.role);
+    const result: (Role & { permissions: Permission[] })[] = [];
+
+    for (const r of roles) {
+      const perms = await this.db
+        .select({
+          id: schema.permission.id,
+          name: schema.permission.name,
+          description: schema.permission.description,
+          createdAt: schema.permission.createdAt,
+          updatedAt: schema.permission.updatedAt,
+        })
+        .from(schema.rolePermission)
+        .innerJoin(schema.permission, eq(schema.rolePermission.permissionId, schema.permission.id))
+        .where(eq(schema.rolePermission.roleId, r.id));
+
+      result.push({
+        ...r,
+        permissions: perms,
+      });
+    }
+
+    return result;
+  }
+
+  async createRole(name: string, description?: string): Promise<Role> {
+    const id = `role_${name.toLowerCase().replace(/\s+/g, "_")}`;
+    const now = new Date();
+    const [inserted] = await this.db
+      .insert(schema.role)
+      .values({
+        id,
+        name,
+        description: description || null,
+        createdAt: now,
+        updatedAt: now,
+      })
+      .returning();
+    if (!inserted) {
+      throw new Error("Failed to create role");
+    }
+    return inserted;
+  }
+
+  async deleteRole(id: string): Promise<void> {
+    await this.db.delete(schema.role).where(eq(schema.role.id, id));
+  }
+
+  async assignPermissionToRole(roleId: string, permissionId: string): Promise<void> {
+    await this.db
+      .insert(schema.rolePermission)
+      .values({
+        id: `rp_${roleId}_${permissionId}`,
+        roleId,
+        permissionId,
+        createdAt: new Date(),
+      })
+      .onConflictDoNothing();
+  }
+
+  async removePermissionFromRole(roleId: string, permissionId: string): Promise<void> {
+    await this.db
+      .delete(schema.rolePermission)
+      .where(
+        and(
+          eq(schema.rolePermission.roleId, roleId),
+          eq(schema.rolePermission.permissionId, permissionId)
+        )
+      );
+  }
+
+  async getUserRoles(userId: string): Promise<Role[]> {
+    return this.db
+      .select({
+        id: schema.role.id,
+        name: schema.role.name,
+        description: schema.role.description,
+        createdAt: schema.role.createdAt,
+        updatedAt: schema.role.updatedAt,
+      })
+      .from(schema.userRole)
+      .innerJoin(schema.role, eq(schema.userRole.roleId, schema.role.id))
+      .where(eq(schema.userRole.userId, userId));
+  }
+
+  async getUserPermissions(userId: string): Promise<Permission[]> {
+    return this.db
+      .selectDistinct({
+        id: schema.permission.id,
+        name: schema.permission.name,
+        description: schema.permission.description,
+        createdAt: schema.permission.createdAt,
+        updatedAt: schema.permission.updatedAt,
+      })
+      .from(schema.userRole)
+      .innerJoin(schema.role, eq(schema.userRole.roleId, schema.role.id))
+      .innerJoin(schema.rolePermission, eq(schema.role.id, schema.rolePermission.roleId))
+      .innerJoin(schema.permission, eq(schema.rolePermission.permissionId, schema.permission.id))
+      .where(eq(schema.userRole.userId, userId));
+  }
+
+  async assignRoleToUser(userId: string, roleId: string): Promise<void> {
+    await this.db
+      .insert(schema.userRole)
+      .values({
+        id: `ur_${userId}_${roleId}`,
+        userId,
+        roleId,
+        createdAt: new Date(),
+      })
+      .onConflictDoNothing();
+  }
+
+  async removeRoleFromUser(userId: string, roleId: string): Promise<void> {
+    await this.db
+      .delete(schema.userRole)
+      .where(and(eq(schema.userRole.userId, userId), eq(schema.userRole.roleId, roleId)));
+  }
+}

package/template/server/db/src/services/user.ts

@@ -0,0 +1,34 @@
+import { eq } from "drizzle-orm";
+import type { DbClient } from "../index";
+import * as schema from "../schema";
+import type { User, Role } from "../types";
+
+export class UserService {
+  constructor(private db: DbClient) {}
+
+  async getUsersWithRoles(): Promise<(User & { roles: Role[] })[]> {
+    const users = await this.db.select().from(schema.user);
+    const result: (User & { roles: Role[] })[] = [];
+
+    for (const u of users) {
+      const roles = await this.db
+        .select({
+          id: schema.role.id,
+          name: schema.role.name,
+          description: schema.role.description,
+          createdAt: schema.role.createdAt,
+          updatedAt: schema.role.updatedAt,
+        })
+        .from(schema.userRole)
+        .innerJoin(schema.role, eq(schema.userRole.roleId, schema.role.id))
+        .where(eq(schema.userRole.userId, u.id));
+
+      result.push({
+        ...u,
+        roles,
+      });
+    }
+
+    return result;
+  }
+}

package/template/server/db/src/types/index.ts

@@ -0,0 +1,34 @@
+import { InferSelectModel, InferInsertModel } from "drizzle-orm";
+import * as schema from "../schema";
+
+export type User = InferSelectModel<typeof schema.user>;
+export type NewUser = InferInsertModel<typeof schema.user>;
+
+export type Session = InferSelectModel<typeof schema.session>;
+export type NewSession = InferInsertModel<typeof schema.session>;
+
+export type Account = InferSelectModel<typeof schema.account>;
+export type NewAccount = InferInsertModel<typeof schema.account>;
+
+export type Verification = InferSelectModel<typeof schema.verification>;
+export type NewVerification = InferInsertModel<typeof schema.verification>;
+
+export type Role = InferSelectModel<typeof schema.role>;
+export type NewRole = InferInsertModel<typeof schema.role>;
+
+export type Permission = InferSelectModel<typeof schema.permission>;
+export type NewPermission = InferInsertModel<typeof schema.permission>;
+
+export type RolePermission = InferSelectModel<typeof schema.rolePermission>;
+export type NewRolePermission = InferInsertModel<typeof schema.rolePermission>;
+
+export type UserRole = InferSelectModel<typeof schema.userRole>;
+export type NewUserRole = InferInsertModel<typeof schema.userRole>;
+
+export interface UserWithRoles extends User {
+  roles: Role[];
+}
+
+export interface RoleWithPermissions extends Role {
+  permissions: Permission[];
+}

package/template/server/db/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@thunder/tsconfig/base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src/**/*"]
+}

package/template/server/hono/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@thunder/api",
+  "version": "0.1.0",
+  "private": true,
+  "main": "src/index.ts",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "dev": "wrangler dev src/index.ts --port 8787",
+    "deploy": "wrangler deploy src/index.ts"
+  },
+  "dependencies": {
+    "@better-auth/drizzle-adapter": "^1.6.23",
+    "@thunder/db": "workspace:*",
+    "better-auth": "^1.6.23",
+    "hono": "^4.12.28"
+  },
+  "devDependencies": {
+    "@thunder/tsconfig": "workspace:*",
+    "typescript": "^5.9.3",
+    "wrangler": "^4.107.0"
+  }
+}

package/template/server/hono/src/auth.ts

@@ -0,0 +1,29 @@
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "@better-auth/drizzle-adapter";
+import type { DbClient } from "@thunder/db";
+
+export const getAuthInstance = (db: DbClient, env: {
+  BETTER_AUTH_SECRET: string;
+  GOOGLE_CLIENT_ID: string;
+  GOOGLE_CLIENT_SECRET: string;
+  BETTER_AUTH_URL: string;
+}) => {
+  return betterAuth({
+    database: drizzleAdapter(db, {
+      provider: "pg",
+    }),
+    secret: env.BETTER_AUTH_SECRET,
+    baseURL: env.BETTER_AUTH_URL,
+    socialProviders: {
+      google: {
+        clientId: env.GOOGLE_CLIENT_ID,
+        clientSecret: env.GOOGLE_CLIENT_SECRET,
+      },
+    },
+    emailAndPassword: {
+      enabled: true,
+    },
+  });
+};
+
+export type AuthType = ReturnType<typeof getAuthInstance>;