@tulip-systems/core 0.10.1 → 0.10.2

package/src/modules/auth/handler/service.server.ts

@@ -1,125 +1,76 @@
-import { passkey } from "@better-auth/passkey";
+import type { Session, User } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { createAuthMiddleware } from "better-auth/api";
-import { betterAuth } from "better-auth/minimal";
-import { admin, emailOTP } from "better-auth/plugins";
-import { eq } from "drizzle-orm";
-import ForgetPasswordEmail from "@/components/emails/forget-password-email";
-import { url } from "@/lib/utils/url";
-import type { TDatabaseSchema } from "@/modules/config/entry";
-import type { TulipConfig } from "@/modules/config/lib/config";
+import { type BetterAuthOptions, betterAuth } from "better-auth/minimal";
+import type { AdminOptions } from "better-auth/plugins";
 import type { Database } from "@/modules/database/lib/service.server";
-import type { Email } from "@/modules/emails/lib/service.server";
-import { users } from "../entry";
-import type { createAccessControl, Role } from "../lib/permissions";
+import type { TDatabaseSchema } from "@/modules/database/lib/types";
+import { adminPlugin } from "../plugins/admin";
+import { emailOtpPlugin } from "../plugins/email-otp";
 
 export const authCookiePrefix = "tulip";
 
-type InitAuthProps<TSchema extends TDatabaseSchema> = {
-  db: Database<TSchema>;
-  email: Email;
-  config: TulipConfig;
-  ac: ReturnType<typeof createAccessControl>;
-  roles: {
-    [key in string]?: Role;
-  };
-  allowedHosts: string[];
-  defaultRole?: string;
-};
+export type TAuthServerOptions = Omit<BetterAuthOptions, "database">;
+
+/**
+ * Additional fields
+ */
+export const authAdditionalFields = {
+  firstName: {
+    type: "string",
+    required: true,
+    input: true,
+  },
+  lastName: {
+    type: "string",
+    required: true,
+    input: true,
+  },
+} as const;
 
 /**
  * Create the Better Auth server instance.
  */
-function createAuth<TSchema extends TDatabaseSchema>(props: InitAuthProps<TSchema>) {
-  return betterAuth({
+type InitAuthServerProps<TOptions extends TAuthServerOptions> = TOptions & {
+  db: Database<TDatabaseSchema>;
+};
+
+export function createAuthServer<TOptions extends TAuthServerOptions>(
+  props: InitAuthServerProps<TOptions>,
+) {
+  const { db, advanced, user, baseURL, emailAndPassword, hooks, plugins } = props;
+
+  return betterAuth<TOptions>({
+    ...props,
     advanced: {
       cookiePrefix: authCookiePrefix,
-      database: {
-        generateId: () => false,
-      },
-    },
-    baseURL: {
-      allowedHosts: props.allowedHosts,
+      database: { generateId: () => false as const },
+      ...(advanced ?? {}),
     },
-    database: drizzleAdapter(props.db, {
+    baseURL,
+    database: drizzleAdapter(db, {
       provider: "pg",
       usePlural: true,
     }),
     emailAndPassword: {
       enabled: true,
+      ...(emailAndPassword ?? {}),
     },
     user: {
+      ...(user ?? {}),
       changeEmail: {
         enabled: true,
-      },
-      additionalFields: {
-        firstName: {
-          type: "string",
-          required: true,
-          input: true,
-        },
-        lastName: {
-          type: "string",
-          required: true,
-          input: true,
-        },
+        ...(user?.changeEmail ?? {}),
       },
     },
-    hooks: {
-      after: createAuthMiddleware(async (ctx) => {
-        if (!ctx.path.startsWith("/sign-up")) return;
-
-        const session = ctx.context.newSession;
-        if (!session) return;
-
-        const existingUsers = await props.db.select().from(users);
-
-        if (existingUsers.length === 1) {
-          await props.db
-            .update(users)
-            .set({ role: "developer" })
-            .where(eq(users.id, session.user.id));
-        }
-      }),
-    },
-    plugins: [
-      passkey(),
-      admin({
-        roles: props.roles,
-        ac: props.ac,
-        adminRoles: ["admin", "developer"],
-        defaultRole: props.defaultRole ?? "user",
-      }),
-      emailOTP({
-        sendVerificationOTP: async ({ email, otp, type }) => {
-          /**
-           * Send a forget password mail
-           */
-          if (type === "forget-password") {
-            const searchParams = new URLSearchParams();
-            searchParams.set("email", email);
-            searchParams.set("otp", otp);
-
-            const resetPasswordHref = url(`/auth/reset-password?${searchParams.toString()}`);
-
-            const result = await props.email.emails.send({
-              from: props.config.email.defaultFrom,
-              to: email,
-              subject: "Wachtwoord herstellen",
-              react: ForgetPasswordEmail({ resetPasswordHref }),
-            });
-            if (result.error) throw new Error(result.error.message);
-          }
-        },
-      }),
-    ],
+    hooks,
+    plugins,
   });
 }
 
 /**
  * Better Auth instance type returned by `Auth.init()`.
  */
-export type Auth = ReturnType<typeof createAuth>;
+export type Auth<Options extends TAuthServerOptions> = ReturnType<typeof betterAuth<Options>>;
 
 /**
  * Auth service namespace.
@@ -128,5 +79,30 @@ export type Auth = ReturnType<typeof createAuth>;
  * const auth = Auth.init({ db, email, config, ac, roles, allowedHosts });
  */
 export const Auth = {
-  init: createAuth,
+  init: createAuthServer,
+  plugins: {
+    admin: adminPlugin,
+    emailOTP: emailOtpPlugin,
+  },
 };
+
+/**
+ * Session and user types for the Auth service.
+ */
+export type AuthServerUser<TOptions extends TAuthServerOptions> = User<
+  TOptions["user"],
+  TOptions["plugins"]
+>;
+
+export type AuthServerSession<TOptions extends TAuthServerOptions> = Session<
+  TOptions["session"],
+  TOptions["plugins"]
+>;
+
+/**
+ * Plugin types
+ */
+export type AuthServerAdminPlugin<Options extends AdminOptions> = ReturnType<
+  typeof adminPlugin<Options>
+>;
+export type AuthServerEmailOtpPlugin = ReturnType<typeof emailOtpPlugin>;

package/src/modules/auth/hooks/use-auth-client.tsx

@@ -1,38 +1,26 @@
 "use client";
 
-import type { AccessControl, Role } from "better-auth/plugins";
 import { createContext, type PropsWithChildren, use } from "react";
-import type { ClientAuth } from "../handler/create-client.client";
+import type { AnyAuthClient, AuthClient } from "../handler/create-client.client";
 
 /**
  * Auth client context
  */
-
-export const AuthClientContext = createContext(null as unknown as ClientAuth<never, never>);
+export const AuthClientContext = createContext(null as AnyAuthClient | null);
 
 /**
  * Use auth client
  */
-export function useAuthClient<
-  TAccessControl extends AccessControl = never,
-  TRoles extends { [key in string]: Role } = never,
->() {
+export function useAuthClient<TAuthClient extends AnyAuthClient = AuthClient<object>>() {
   const context = use(AuthClientContext);
   if (!context) throw new Error("Auth client is not provided");
 
-  return context as ClientAuth<TAccessControl, TRoles>;
+  return context as TAuthClient;
 }
 
 /**
  * Auth client provider
  */
-export function AuthProvider<
-  TAccessControl extends AccessControl,
-  TRoles extends { [key in string]: Role },
->(props: PropsWithChildren<{ authClient: ClientAuth<TAccessControl, TRoles> }>) {
-  return (
-    <AuthClientContext value={props.authClient as ClientAuth<never, never>}>
-      {props.children}
-    </AuthClientContext>
-  );
+export function AuthProvider(props: PropsWithChildren<{ authClient: AnyAuthClient }>) {
+  return <AuthClientContext value={props.authClient}>{props.children}</AuthClientContext>;
 }

package/src/modules/auth/hooks/use-permission.ts

@@ -1,10 +1,11 @@
 "use client";
 
-import type { Permission } from "../lib/permissions";
+import type { AuthClient, AuthClientAdminPlugin } from "../handler/create-client.client";
+import type { AccessControl, Permission } from "../lib/permissions";
 import { useAuthClient } from "./use-auth-client";
 import { useSession } from "./use-session";
 
-export type UsePermissionProps =
+export type UsePermissionProps<TAccessControl extends AccessControl = AccessControl> =
   | {
       /**
        * Strategy to use when checking multiple permissions
@@ -18,7 +19,7 @@ export type UsePermissionProps =
        * Permission to check
        * @example { project: ["view", "create"] }
        */
-      permission?: Permission;
+      permission?: Permission<TAccessControl>;
     }
   | {
       /**
@@ -33,20 +34,24 @@ export type UsePermissionProps =
        * Permission to check
        * @example [{ project: ["view", "create"] }, { client: ["view"] }, { drive: ["view"] }]
        */
-      permission?: Permission[];
+      permission?: Permission<TAccessControl>[];
     };
 
 /**
  * UsePermission
  */
-export function usePermission({ strategy = "all", permission }: UsePermissionProps) {
-  const authClient = useAuthClient();
+export function usePermission<TAccessControl extends AccessControl = AccessControl>({
+  strategy = "all",
+  permission,
+}: UsePermissionProps<TAccessControl> = {}) {
+  const authClient =
+    useAuthClient<AuthClient<{ plugins: [AuthClientAdminPlugin<{ ac: TAccessControl }>] }>>();
   const sessionQuery = useSession(authClient);
 
   /**
    * If no role is found in the session, deny by default
    */
-  const role = sessionQuery.data?.user.role;
+  const role = sessionQuery.data?.user.role as "admin" | "user" | undefined;
   if (!role) return { permission, success: false };
 
   /**
@@ -63,7 +68,7 @@ export function usePermission({ strategy = "all", permission }: UsePermissionPro
     const success = permissions.some((permission) =>
       authClient.admin.checkRolePermission({
         role,
-        permissions: permission,
+        permissions: permission as CheckRolePermission<TAccessControl>,
       }),
     );
 
@@ -76,7 +81,7 @@ export function usePermission({ strategy = "all", permission }: UsePermissionPro
   if (strategy === "all" && !Array.isArray(permission)) {
     const success = authClient.admin.checkRolePermission({
       role,
-      permissions: permission,
+      permissions: permission as CheckRolePermission<TAccessControl>,
     });
 
     return { permission, success };
@@ -87,3 +92,12 @@ export function usePermission({ strategy = "all", permission }: UsePermissionPro
    */
   return { permission, success: false };
 }
+
+/**
+ * These types are used to extract the permissions from the checkRolePermission endpoint. They are used to ensure that the permissions passed to the hook are valid.
+ */
+type CheckRolePermission<TAccessControl extends AccessControl> = Parameters<
+  ReturnType<
+    AuthClientAdminPlugin<{ ac: TAccessControl }>["getActions"]
+  >["admin"]["checkRolePermission"]
+>[0]["permissions"];

package/src/modules/auth/hooks/use-session.ts

@@ -1,20 +1,33 @@
 "use client";
 
 import { useSuspenseQuery } from "@tanstack/react-query";
-import type { ClientAuth } from "../entry.client";
+import type { InferSessionFromClient, InferUserFromClient } from "better-auth";
+import type { AuthClient, AuthClientOptions } from "../handler/create-client.client";
 
-export function useSession(authClient: ClientAuth<never, never>) {
-  const session = useSuspenseQuery({
+/**
+ * Use session return type
+ */
+type UseSessionReturnType<TOptions extends AuthClientOptions> = {
+  user: InferUserFromClient<TOptions>;
+  session: InferSessionFromClient<TOptions>;
+} | null;
+
+/**
+ * Use session
+ */
+export function useSession<TOptions extends AuthClientOptions>(authClient: AuthClient<TOptions>) {
+  const session = useSuspenseQuery<UseSessionReturnType<TOptions>>({
     queryKey: ["session"],
     queryFn: async () => {
-      const session = await authClient.getSession();
+      const client = authClient as unknown as AuthClient<object>;
+      const session = await client.getSession();
 
       if (session.error) {
         console.error(session.error);
         return null;
       }
 
-      return session.data;
+      return session.data as UseSessionReturnType<TOptions>;
     },
     staleTime: 1000 * 60 * 60,
   });

package/src/modules/auth/lib/helpers.server.ts

@@ -1,55 +1,27 @@
 import "server-cli-only";
-
-import { eq } from "drizzle-orm";
 import { headers } from "next/headers";
-import type { TulipContext } from "@/modules/config/entry";
-import type { TDatabaseSchema } from "@/modules/database/lib/types";
-import { ServerError } from "@/modules/router/lib/error.server";
-import { users } from "../entry";
-import type { CreateUserSchema, UpdateUserSchema } from "./validators";
+import type {
+  Auth,
+  AuthServerSession,
+  AuthServerUser,
+  TAuthServerOptions,
+} from "../handler/service.server";
 
 /**
  * Get the session
  */
-export async function getSession<TSchema extends TDatabaseSchema>({
-  auth,
-}: Pick<TulipContext<TSchema>, "auth">) {
-  return auth.api.getSession({ headers: await headers() });
-}
+export type GetSessionResult<TAuthOptions extends TAuthServerOptions> = {
+  session: AuthServerSession<TAuthOptions>;
+  user: AuthServerUser<TAuthOptions>;
+} | null;
 
-/**
- * Create a user
- */
-export function createUser<TSchema extends TDatabaseSchema>(
-  { auth, headers }: TulipContext<TSchema> & { headers: Headers },
-  { body }: { body: CreateUserSchema },
+export async function getSession<TAuthOptions extends TAuthServerOptions>(
+  auth: Auth<TAuthOptions>,
 ) {
-  const { firstName, lastName } = body;
-
-  return auth.api.createUser({
-    headers,
-    body: {
-      ...body,
-      name: `${firstName} ${lastName}`,
-      data: { firstName, lastName },
-    },
-  });
-}
+  const headersList = await headers();
 
-/**
- * Update a user
- */
-
-export async function updateUser<TSchema extends TDatabaseSchema>(
-  { db }: TulipContext<TSchema>,
-  { userId, body }: { userId: string; body: Partial<UpdateUserSchema> },
-) {
-  const [result] = await db.update(users).set(body).where(eq(users.id, userId)).returning();
-  if (!result) {
-    throw new ServerError("INTERNAL_SERVER_ERROR", {
-      message: "Gebruiker kon niet worden aangemaakt",
-    });
-  }
+  const api = auth.api as unknown as Auth<object>["api"];
+  const data = await api.getSession({ headers: headersList });
 
-  return result;
+  return data as GetSessionResult<TAuthOptions>;
 }

package/src/modules/auth/lib/permissions.ts

@@ -1,7 +1,40 @@
-import { createAccessControl, type Role } from "better-auth/plugins/access";
+import {
+  type AccessControl as BetterAuthAccessControl,
+  type Statements as BetterAuthStatements,
+  createAccessControl,
+  type Role,
+} from "better-auth/plugins/access";
 import { adminAc, defaultStatements } from "better-auth/plugins/admin/access";
 
-export type Permission = Record<string, string[]>;
+/**
+ * Permission Statements
+ * @description These are the statements that define the permissions for the application. They are used to create the access control and to check the permissions for the users.
+ */
+type Statements = BetterAuthStatements;
+
+/**
+ * Access Control
+ * @description The access control is created using the statements and is used to check the permissions for the users. It is also used to define the roles for the application.
+ */
+export type AccessControl<TStatements extends Statements = Statements> =
+  BetterAuthAccessControl<TStatements>;
+
+/**
+ * Permission Actions
+ * @description The actions that can be performed on a resource. For example, if the resource is "project", the actions can be "view", "create", "edit", "delete", etc.
+ */
+type Actions<T> = T extends readonly unknown[] ? T[number] : never;
+
+/**
+ * Permission
+ * @description The permission is an object that defines the resource and the actions that can be performed on that resource. For example, { project: ["view", "create"] } means that the user has permission to view and create projects.
+ */
+export type Permission<TAccessControl extends AccessControl = AccessControl> =
+  TAccessControl extends AccessControl<infer S extends Statements>
+    ? {
+        [K in keyof S]?: Actions<S[K]>[];
+      }
+    : Record<string, string[]>;
 
 /**
  * Create statements

package/src/modules/auth/plugins/admin.ts

@@ -0,0 +1,28 @@
+import { type AccessControl, type AdminOptions, admin, type Role } from "better-auth/plugins";
+
+/**
+ * Admin client options
+ */
+export type AdminClientOptions = {
+  ac?: AccessControl | undefined;
+  roles?: { [key in string]: Role } | undefined;
+};
+
+/**
+ * Admin plugin.
+ */
+export function adminPlugin<Options extends AdminOptions>({
+  roles,
+  ac,
+  adminRoles,
+  defaultRole,
+  ...props
+}: Options) {
+  return admin<Options>({
+    ...props,
+    roles,
+    ac,
+    adminRoles: adminRoles ?? ["admin", "developer"],
+    defaultRole: defaultRole ?? "user",
+  } as unknown as Options);
+}

package/src/modules/auth/plugins/email-otp.ts

@@ -0,0 +1,43 @@
+import { emailOTP } from "better-auth/plugins";
+import ForgetPasswordEmail from "@/components/emails/forget-password-email";
+import { url } from "@/lib/utils/url";
+import type { Email } from "@/modules/emails/lib/service.server";
+
+type EmailOtpOptions = Omit<NonNullable<Parameters<typeof emailOTP>[0]>, "sendVerificationOTP">;
+
+export type EmailOtpPluginConfig = EmailOtpOptions & {
+  email: Email;
+  defaultFrom: string;
+};
+
+/**
+ * Email OTP plugin.
+ *
+ * Handles Better Auth email OTP flows and provides Tulip's default
+ * forgot-password email implementation.
+ */
+export function emailOtpPlugin(config: EmailOtpPluginConfig) {
+  const { email: emailClient, defaultFrom, ...options } = config;
+
+  return emailOTP({
+    ...options,
+    sendVerificationOTP: async ({ email, otp, type }) => {
+      if (type !== "forget-password") return;
+
+      const searchParams = new URLSearchParams();
+      searchParams.set("email", email);
+      searchParams.set("otp", otp);
+
+      const resetPasswordHref = url(`/auth/reset-password?${searchParams.toString()}`);
+
+      const result = await emailClient.emails.send({
+        from: defaultFrom,
+        to: email,
+        subject: "Wachtwoord herstellen",
+        react: ForgetPasswordEmail({ resetPasswordHref }),
+      });
+
+      if (result.error) throw new Error(result.error.message);
+    },
+  });
+}

package/src/modules/config/entry.ts

@@ -1,6 +1,3 @@
-export * from "../database/lib/helpers";
-export * from "../database/lib/types";
-
 export * from "./lib/config";
 export * from "./lib/context";
 

package/src/modules/config/lib/context.ts

@@ -1,17 +1,21 @@
-import type { Auth } from "@/modules/auth/handler/service.server";
+import type { BetterAuthOptions } from "better-auth";
+import type { Auth, TAuthServerOptions } from "@/modules/auth/handler/service.server";
 import type { Database } from "@/modules/database/lib/service.server";
 import type { TDatabaseSchema } from "@/modules/database/lib/types";
 import type { Email } from "@/modules/emails/lib/service.server";
 import type { Storage } from "@/modules/storage/lib/service.server";
 
-export type TulipContext<TSchema extends TDatabaseSchema> = {
+export type TulipContext<TSchema extends TDatabaseSchema, TOptions extends TAuthServerOptions> = {
   db: Database<TSchema>;
   schema: TSchema;
-  auth: Auth;
+  auth: Auth<TOptions>;
   email: Email;
   storage: Storage<TSchema>;
 };
 
-export function createContext<TSchema extends TDatabaseSchema>(props: TulipContext<TSchema>) {
+export function createContext<
+  TSchema extends TDatabaseSchema,
+  TAuthOptions extends BetterAuthOptions = BetterAuthOptions,
+>(props: TulipContext<TSchema, TAuthOptions>) {
   return props;
 }

package/src/modules/data-tables/components/filters/date-range.client.tsx

@@ -25,11 +25,7 @@ export type TableFilterDateRangePreset = {
   value: [Date, Date];
 };
 
-export function TableFilterDateRange({
-  title,
-  filter,
-  presets,
-}: TableFilterDateRangeProps) {
+export function TableFilterDateRange({ title, filter, presets }: TableFilterDateRangeProps) {
   const [open, setOpen] = useState(false);
   const [query, setQuery] = useQueryState(filter.name, filter.parser);
 

package/src/modules/data-tables/entry.ts

@@ -11,6 +11,7 @@ export * from "./components/toolbar";
 /**
  * Lib
  */
+export * from "./lib/converters/dto";
 export * from "./lib/filters/config";
 export * from "./lib/filters/helpers";
 export * from "./lib/filters/parsers";

package/src/modules/data-tables/lib/converters/dto.ts

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import type { TableQuerySchema } from "../validators";
 
 /**
@@ -19,6 +20,17 @@ export type TableQueryPaginationResponse = {
   previousCursor: number | null;
 };
 
+export const tableQueryPaginationResponseSchema = z.object({
+  total: z.number(),
+  totalPages: z.number(),
+  limit: z.number(),
+  hasNextPage: z.boolean(),
+  hasPreviousPage: z.boolean(),
+  cursor: z.number(),
+  nextCursor: z.number().nullable(),
+  previousCursor: z.number().nullable(),
+});
+
 /**
  * Table query response input
  */

package/src/modules/data-tables/lib/converters/filters.ts

@@ -1,6 +1,6 @@
-import type { TDatabaseSchema } from "@tulip-systems/core/config";
 import { and, type SQL } from "drizzle-orm";
 import type { Database } from "@/modules/database/lib/service.server";
+import type { TDatabaseSchema } from "@/modules/database/lib/types";
 
 /**
  * Parser function for a single filter key.

package/src/modules/data-tables/lib/filters/parsers.ts

@@ -93,8 +93,7 @@ export const parseFilterDatetimeRange = <TSchema extends ParseFilterDatetimeRang
     const [from, to] = encoded.split("_");
     return (from && to ? [new Date(from), new Date(to)] : null) as unknown as z.input<TSchema>;
   },
-  encode: (decoded) =>
-    decoded ? `${decoded[0].toISOString()}_${decoded[1].toISOString()}` : "",
+  encode: (decoded) => (decoded ? `${decoded[0].toISOString()}_${decoded[1].toISOString()}` : ""),
 });
 
 /**