@thunder-stack/create-thunder-app 0.0.1

package/template/server/hono/src/index.ts

@@ -0,0 +1,215 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { createDbClient, RbacService, UserService } from "@thunder/db";
+import { getAuthInstance } from "./auth";
+
+type Bindings = {
+  DATABASE_URL: string;
+  BETTER_AUTH_SECRET: string;
+  BETTER_AUTH_URL: string;
+  GOOGLE_CLIENT_ID: string;
+  GOOGLE_CLIENT_SECRET: string;
+};
+
+const app = new Hono<{ Bindings: Bindings }>();
+
+// Enable CORS for frontend applications (localhost and production web/app origins)
+app.use("*", async (c, next) => {
+  const corsMiddleware = cors({
+    origin: (origin) => origin, // Dynamically reflect requested origin
+    allowHeaders: ["Content-Type", "Authorization"],
+    allowMethods: ["POST", "GET", "OPTIONS", "PUT", "DELETE"],
+    exposeHeaders: ["Content-Length"],
+    maxAge: 600,
+    credentials: true,
+  });
+  return corsMiddleware(c, next);
+});
+
+// Better Auth Mounting Route handlers
+app.on(["POST", "GET"], "/api/auth/*", async (c) => {
+  const db = createDbClient(c.env.DATABASE_URL);
+  const auth = getAuthInstance(db, {
+    BETTER_AUTH_SECRET: c.env.BETTER_AUTH_SECRET,
+    BETTER_AUTH_URL: c.env.BETTER_AUTH_URL,
+    GOOGLE_CLIENT_ID: c.env.GOOGLE_CLIENT_ID,
+    GOOGLE_CLIENT_SECRET: c.env.GOOGLE_CLIENT_SECRET,
+  });
+  return auth.handler(c.req.raw);
+});
+
+// Helper middleware to verify permissions
+const checkPermission = (...requiredPermissions: string[]) => {
+  return async (c: any, next: any) => {
+    const db = createDbClient(c.env.DATABASE_URL);
+    const auth = getAuthInstance(db, {
+      BETTER_AUTH_SECRET: c.env.BETTER_AUTH_SECRET,
+      BETTER_AUTH_URL: c.env.BETTER_AUTH_URL,
+      GOOGLE_CLIENT_ID: c.env.GOOGLE_CLIENT_ID,
+      GOOGLE_CLIENT_SECRET: c.env.GOOGLE_CLIENT_SECRET,
+    });
+
+    const session = await auth.api.getSession({
+      headers: c.req.raw.headers,
+    });
+
+    if (!session) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
+
+    const rbacService = new RbacService(db);
+    const userPerms = await rbacService.getUserPermissions(session.user.id);
+    const hasPerm = userPerms.some((p) => requiredPermissions.includes(p.name));
+
+    if (!hasPerm) {
+      return c.json({ error: `Forbidden: Requires one of permissions [${requiredPermissions.join(", ")}]` }, 403);
+    }
+
+    c.set("userId", session.user.id);
+    c.set("user", session.user);
+    await next();
+  };
+};
+
+// Authenticated hello route
+app.get("/hello", async (c) => {
+  const db = createDbClient(c.env.DATABASE_URL);
+  const auth = getAuthInstance(db, {
+    BETTER_AUTH_SECRET: c.env.BETTER_AUTH_SECRET,
+    BETTER_AUTH_URL: c.env.BETTER_AUTH_URL,
+    GOOGLE_CLIENT_ID: c.env.GOOGLE_CLIENT_ID,
+    GOOGLE_CLIENT_SECRET: c.env.GOOGLE_CLIENT_SECRET,
+  });
+
+  const session = await auth.api.getSession({
+    headers: c.req.raw.headers,
+  });
+
+  if (!session) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+
+  return c.json({
+    message: `Hello ${session.user.name}! Welcomed by Hono on Cloudflare Edge.`,
+  });
+});
+
+app.get("/api/dashboard/stats", checkPermission("view_dashboard"), async (c) => {
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  const stats = await rbacService.getStats();
+  return c.json(stats);
+});
+
+// Get current user details, active roles, and permissions
+app.get("/api/me", async (c) => {
+  const db = createDbClient(c.env.DATABASE_URL);
+  const auth = getAuthInstance(db, {
+    BETTER_AUTH_SECRET: c.env.BETTER_AUTH_SECRET,
+    BETTER_AUTH_URL: c.env.BETTER_AUTH_URL,
+    GOOGLE_CLIENT_ID: c.env.GOOGLE_CLIENT_ID,
+    GOOGLE_CLIENT_SECRET: c.env.GOOGLE_CLIENT_SECRET,
+  });
+
+  const session = await auth.api.getSession({
+    headers: c.req.raw.headers,
+  });
+
+  if (!session) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+
+  const rbacService = new RbacService(db);
+  const roles = await rbacService.getUserRoles(session.user.id);
+  const permissions = await rbacService.getUserPermissions(session.user.id);
+
+  return c.json({
+    user: session.user,
+    roles: roles.map((r) => r.name),
+    permissions: permissions.map((p) => p.name),
+  });
+});
+
+// Management sub-router
+const management = new Hono<{ Bindings: Bindings }>();
+
+// 1. User Management
+management.get("/users", checkPermission("manage:user"), async (c) => {
+  const db = createDbClient(c.env.DATABASE_URL);
+  const userService = new UserService(db);
+  const users = await userService.getUsersWithRoles();
+  return c.json(users);
+});
+
+management.post("/users/:id/roles", checkPermission("manage:user"), async (c) => {
+  const userId = c.req.param("id");
+  const { roleId } = await c.req.json<{ roleId: string }>();
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  await rbacService.assignRoleToUser(userId, roleId);
+  return c.json({ success: true });
+});
+
+management.delete("/users/:id/roles/:roleId", checkPermission("manage:user"), async (c) => {
+  const userId = c.req.param("id");
+  const roleId = c.req.param("roleId");
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  await rbacService.removeRoleFromUser(userId, roleId);
+  return c.json({ success: true });
+});
+
+// 2. Role & Permission Management
+management.get("/roles", checkPermission("manage:role", "manage:role-perm"), async (c) => {
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  const roles = await rbacService.getRoles();
+  return c.json(roles);
+});
+
+management.post("/roles", checkPermission("manage:role"), async (c) => {
+  const { name, description } = await c.req.json<{ name: string; description?: string }>();
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  const role = await rbacService.createRole(name, description);
+  return c.json(role);
+});
+
+management.delete("/roles/:id", checkPermission("manage:role"), async (c) => {
+  const id = c.req.param("id");
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  await rbacService.deleteRole(id);
+  return c.json({ success: true });
+});
+
+management.get("/permissions", checkPermission("manage:role", "manage:role-perm"), async (c) => {
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  const permissions = await rbacService.getPermissions();
+  return c.json(permissions);
+});
+
+management.post("/roles/:id/permissions", checkPermission("manage:role-perm"), async (c) => {
+  const roleId = c.req.param("id");
+  const { permissionId } = await c.req.json<{ permissionId: string }>();
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  await rbacService.assignPermissionToRole(roleId, permissionId);
+  return c.json({ success: true });
+});
+
+management.delete("/roles/:id/permissions/:permissionId", checkPermission("manage:role-perm"), async (c) => {
+  const roleId = c.req.param("id");
+  const permissionId = c.req.param("permissionId");
+  const db = createDbClient(c.env.DATABASE_URL);
+  const rbacService = new RbacService(db);
+  await rbacService.removePermissionFromRole(roleId, permissionId);
+  return c.json({ success: true });
+});
+
+// Mount management routes
+app.route("/api/management", management);
+
+export default app;
+export type AppType = typeof app;

package/template/server/hono/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@thunder/tsconfig/base.json",
+  "compilerOptions": {
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src/**/*", "wrangler.toml"]
+}

package/template/server/hono/wrangler.toml

@@ -0,0 +1,12 @@
+name = "thunder-api"
+main = "src/index.ts"
+compatibility_date = "2024-03-01"
+
+[vars]
+# wrangler dev reads variables from the local shell environment or .dev.vars.
+# When deploying to production on Cloudflare Workers, set these secret bindings:
+# wrangler secret put DATABASE_URL
+# wrangler secret put BETTER_AUTH_SECRET
+# wrangler secret put BETTER_AUTH_URL
+# wrangler secret put GOOGLE_CLIENT_ID
+# wrangler secret put GOOGLE_CLIENT_SECRET

package/template/turbo.json

@@ -0,0 +1,68 @@
+{
+    "$schema": "https://turbo.build/schema.json",
+    "globalEnv": [
+        "DATABASE_URL",
+        "BETTER_AUTH_SECRET",
+        "BETTER_AUTH_URL",
+        "NEXT_PUBLIC_API_URL",
+        "GOOGLE_CLIENT_ID",
+        "GOOGLE_CLIENT_SECRET"
+    ],
+    "tasks": {
+        "build": {
+            "dependsOn": [
+                "^build"
+            ],
+            "inputs": [
+                "src/**",
+                "tsconfig.json",
+                "package.json"
+            ],
+            "outputs": [
+                ".next/**",
+                ".open-next/**",
+                "dist/**"
+            ]
+        },
+        "dev": {
+            "cache": false,
+            "persistent": true
+        },
+        "typecheck": {
+            "dependsOn": [
+                "^typecheck"
+            ],
+            "inputs": [
+                "src/**",
+                "tsconfig.json"
+            ]
+        },
+        "lint": {
+            "dependsOn": [
+                "^lint"
+            ]
+        },
+        "db:generate": {
+            "cache": false
+        },
+        "db:migrate": {
+            "cache": false
+        },
+        "db:seed": {
+            "cache": false
+        },
+        "test": {
+            "cache": false
+        },
+        "test:unit": {
+            "dependsOn": [
+                "^build"
+            ],
+            "inputs": [
+                "src/**",
+                "tests/**",
+                "vitest.config.*"
+            ]
+        }
+    }
+}