@tulip-systems/core 0.2.0

package/src/modules/auth/db/schema.ts

@@ -0,0 +1,76 @@
+import { sql, SQL } from "drizzle-orm";
+import { pgTable } from "drizzle-orm/pg-core";
+
+export const users = pgTable("users", (t) => ({
+  id: t.text().primaryKey(),
+  name: t
+    .varchar()
+    .notNull()
+    .generatedAlwaysAs((): SQL => sql`${users.firstName} || ' ' || ${users.lastName}`),
+  firstName: t.varchar().notNull(),
+  lastName: t.varchar().notNull(),
+  email: t.text().notNull().unique(),
+  emailVerified: t.boolean().notNull(),
+  image: t.text(),
+  createdAt: t.timestamp().notNull(),
+  updatedAt: t.timestamp().notNull(),
+  role: t.text(),
+  banned: t.boolean(),
+  banReason: t.text(),
+  banExpires: t.timestamp(),
+}));
+
+export const sessions = pgTable("sessions", (t) => ({
+  id: t.text().primaryKey(),
+  expiresAt: t.timestamp().notNull(),
+  token: t.text().notNull().unique(),
+  createdAt: t.timestamp().notNull(),
+  updatedAt: t.timestamp().notNull(),
+  ipAddress: t.text(),
+  userAgent: t.text(),
+  userId: t
+    .text()
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  impersonatedBy: t.text(),
+}));
+
+export const accounts = pgTable("accounts", (t) => ({
+  id: t.text().primaryKey(),
+  accountId: t.text().notNull(),
+  providerId: t.text().notNull(),
+  userId: t
+    .text()
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  accessToken: t.text(),
+  refreshToken: t.text(),
+  idToken: t.text(),
+  accessTokenExpiresAt: t.timestamp(),
+  refreshTokenExpiresAt: t.timestamp(),
+  scope: t.text(),
+  password: t.text(),
+  createdAt: t.timestamp().notNull(),
+  updatedAt: t.timestamp().notNull(),
+}));
+
+export const verifications = pgTable("verifications", (t) => ({
+  id: t.text().primaryKey(),
+  identifier: t.text().notNull(),
+  value: t.text().notNull(),
+  expiresAt: t.timestamp().notNull(),
+  createdAt: t.timestamp(),
+  updatedAt: t.timestamp(),
+}));
+
+/**
+ * Auth schema
+ */
+// export const authSchema = {
+//   users,
+//   sessions,
+//   accounts,
+//   verifications,
+// };
+
+// export type AuthSchema = typeof authSchema;

package/src/modules/auth/entry.client.ts

@@ -0,0 +1,6 @@
+export * from "./components/allowed.client";
+export * from "./components/forget-password-page.client";
+export * from "./components/login-page.client";
+export * from "./components/reset-password-page.client";
+export * from "./components/update-password-command";
+export * from "./handler/client.client";

package/src/modules/auth/entry.server.ts

@@ -0,0 +1,4 @@
+export * from "./components/allowed.server";
+export * from "./components/auth-layout.server";
+export * from "./handler/route.server";
+export * from "./lib/helpers.server";

package/src/modules/auth/entry.ts

@@ -0,0 +1,3 @@
+export * from "./db/schema";
+export * from "./lib/permissions";
+export * from "./lib/validators";

package/src/modules/auth/handler/client.client.ts

@@ -0,0 +1,24 @@
+"use client";
+
+import { type ClientOptions } from "better-auth";
+import { adminClient, emailOTPClient, inferAdditionalFields } from "better-auth/client/plugins";
+import { createAuthClient } from "better-auth/react";
+import { type ServerAuth } from "./server.server";
+
+type AuthClientOptions = Omit<ClientOptions, "plugins"> & {
+  plugins: [
+    ReturnType<typeof emailOTPClient>,
+    ReturnType<typeof adminClient>,
+    ReturnType<typeof inferAdditionalFields<ServerAuth>>,
+  ];
+};
+
+type AuthClient = ReturnType<typeof createAuthClient<AuthClientOptions>>;
+
+export const authClient = createAuthClient({
+  plugins: [emailOTPClient(), adminClient(), inferAdditionalFields<ServerAuth>()],
+});
+
+export type ClientAuth = typeof authClient;
+
+export type ClientSession = typeof authClient.$Infer.Session;

package/src/modules/auth/handler/route.server.ts

@@ -0,0 +1,32 @@
+import { TDatabaseSchema } from "@/modules/config/db/types";
+import { getTulip, GetTulipParams } from "@/modules/config/lib/resolve.server";
+import { toNextJsHandler } from "better-auth/next-js";
+import { NextRequest } from "next/server";
+import "server-cli-only";
+
+/**
+ * Handle the auth routes
+ */
+export function handleAuthRoute<TSchema extends TDatabaseSchema>(params: GetTulipParams<TSchema>) {
+  /**
+   * GET route handler
+   */
+  async function GET(request: NextRequest) {
+    const { auth } = await getTulip(params);
+    const routes = toNextJsHandler(auth.handler);
+
+    return routes.GET(request);
+  }
+
+  /**
+   * POST route handler
+   */
+  async function POST(request: NextRequest) {
+    const { auth } = await getTulip(params);
+    const routes = toNextJsHandler(auth.handler);
+
+    return routes.POST(request);
+  }
+
+  return { GET, POST };
+}

package/src/modules/auth/handler/server.server.ts

@@ -0,0 +1,82 @@
+import "server-cli-only";
+
+import ForgetPasswordEmail from "@/components/emails/forget-password-email";
+import { url } from "@/lib/utils/url";
+import { TDatabaseSchema } from "@/modules/config/db/types";
+import { TulipConfig } from "@/modules/config/lib/config.server";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { nextCookies } from "better-auth/next-js";
+import { admin, emailOTP } from "better-auth/plugins";
+import { Resend } from "resend";
+
+type CreateServerAuthParams<TSchema extends TDatabaseSchema> = Pick<
+  TulipConfig<TSchema>,
+  "email" | "auth"
+> & {
+  db: Parameters<typeof drizzleAdapter>[0];
+  schema: Parameters<typeof drizzleAdapter>[1]["schema"];
+  resend: Resend;
+};
+
+export const createServerAuth = <TSchema extends TDatabaseSchema>(
+  config: CreateServerAuthParams<TSchema>,
+) =>
+  betterAuth({
+    database: drizzleAdapter(config.db, {
+      provider: "pg",
+      schema: config.schema,
+      usePlural: true,
+    }),
+    emailAndPassword: {
+      enabled: true,
+    },
+    user: {
+      changeEmail: {
+        enabled: true,
+      },
+      additionalFields: {
+        firstName: {
+          type: "string",
+          required: true,
+          input: true,
+        },
+        lastName: {
+          type: "string",
+          required: true,
+          input: true,
+        },
+      },
+    },
+    plugins: [
+      nextCookies(),
+      admin({
+        ...config.auth,
+        adminRoles: ["admin", "developer"],
+      }),
+      emailOTP({
+        sendVerificationOTP: async ({ email, otp, type }) => {
+          /**
+           * Send a forget password mail
+           */
+          if (type === "forget-password") {
+            const searchParams = new URLSearchParams();
+            searchParams.set("email", email);
+            searchParams.set("otp", otp);
+
+            const resetPasswordHref = url(`/auth/reset-password?${searchParams.toString()}`);
+
+            const result = await config.resend.emails.send({
+              from: config.email.from,
+              to: email,
+              subject: "Wachtwoord herstellen",
+              react: ForgetPasswordEmail({ resetPasswordHref }),
+            });
+            if (result.error) throw new Error(result.error.message);
+          }
+        },
+      }),
+    ],
+  });
+
+export type ServerAuth = ReturnType<typeof createServerAuth>;

package/src/modules/auth/hooks/use-permission.client.ts

@@ -0,0 +1,48 @@
+"use client";
+
+import { useSuspenseQueries } from "@tanstack/react-query";
+import { LiteralString } from "better-auth";
+import { authClient } from "../handler/client.client";
+import { type Permission } from "../lib/permissions";
+
+/**
+ * UsePermission
+ */
+export function usePermission(permission?: Permission) {
+  const keys = Object.entries(permission ?? {}).flatMap(([resource, permissions]) =>
+    permissions.map((permission) => [resource, permission] as const),
+  );
+
+  return useSuspenseQueries({
+    queries: keys.map((key) => ({
+      queryKey: ["permission", ...key],
+      queryFn: async () => {
+        const resource = key[0]?.toString() as string;
+        const permission: Permission = { [resource]: [key[1]] as LiteralString[] };
+
+        const session = await authClient.getSession();
+        const userId = session.data?.user.id;
+
+        const { data, error } = await authClient.admin.hasPermission({ permission, userId });
+        if (error) {
+          console.error(error);
+          throw error;
+        }
+
+        return {
+          permission,
+          success: data.success,
+        };
+      },
+    })),
+    combine: (results) => {
+      const errors = results.filter(({ error }) => error);
+      if (errors.length) return { data: null, errors };
+
+      const values = results.map(({ data }) => data);
+      const success = results.every(({ data }) => data.success);
+
+      return { data: { success, values }, errors: null };
+    },
+  });
+}

package/src/modules/auth/lib/helpers.server.ts

@@ -0,0 +1,59 @@
+import "server-cli-only";
+
+import { type TDatabaseSchema } from "@/modules/config/db/types";
+import { GetTulipReturn } from "@/modules/config/lib/resolve.server";
+import { ServerError } from "@/modules/config/router/error.server";
+import { eq } from "drizzle-orm";
+import { headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { users } from "../entry";
+import { CreateUserSchema, UpdateUserSchema } from "./validators";
+
+/**
+ * Get the session
+ */
+export async function getSession<TSchema extends TDatabaseSchema>({
+  auth,
+}: Pick<GetTulipReturn<TSchema>, "auth">) {
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) redirect("/auth/login");
+
+  return session;
+}
+
+/**
+ * Create a user
+ */
+export function createUser<TSchema extends TDatabaseSchema>(
+  { auth, headers }: GetTulipReturn<TSchema> & { headers: Headers },
+  { body }: { body: CreateUserSchema },
+) {
+  const { firstName, lastName } = body;
+
+  return auth.api.createUser({
+    headers,
+    body: {
+      ...body,
+      name: `${firstName} ${lastName}`,
+      data: { firstName, lastName },
+    },
+  });
+}
+
+/**
+ * Update a user
+ */
+
+export async function updateUser<TSchema extends TDatabaseSchema>(
+  { db }: GetTulipReturn<TSchema>,
+  { userId, body }: { userId: string; body: Partial<UpdateUserSchema> },
+) {
+  const [result] = await db.update(users).set(body).where(eq(users.id, userId)).returning();
+  if (!result) {
+    throw new ServerError("INTERNAL_SERVER_ERROR", {
+      message: "Gebruiker kon niet worden aangemaakt",
+    });
+  }
+
+  return result;
+}

package/src/modules/auth/lib/permissions.ts

@@ -0,0 +1,19 @@
+import { createAccessControl, type Role } from "better-auth/plugins/access";
+import { adminAc, defaultStatements } from "better-auth/plugins/admin/access";
+
+export type Permission = Record<string, string[]>;
+
+/**
+ * Create statements
+ */
+const createStatements = <TStatements extends Parameters<typeof createAccessControl>[0]>(
+  statements: TStatements,
+) => ({
+  ...statements,
+  ...defaultStatements,
+});
+
+/**
+ * Exports
+ */
+export { adminAc, createAccessControl, createStatements, defaultStatements, type Role };

package/src/modules/auth/lib/utils.ts

@@ -0,0 +1,17 @@
+import { Permission } from "./permissions";
+
+/**
+ * mergePermissions
+ */
+export function mergePermissions(permissions: Permission[]): Permission {
+  return permissions.flatMap(Object.entries).reduce((acc, [key, value]) => {
+    const accValue = acc[key];
+
+    if (!accValue) return { ...acc, [key]: [...value] };
+
+    return {
+      ...acc,
+      [key]: Array.from(new Set([...accValue, ...value])),
+    };
+  }, {} as Permission);
+}

package/src/modules/auth/lib/validators.ts

@@ -0,0 +1,91 @@
+import { userSchema } from "better-auth/db";
+import { createInsertSchema } from "drizzle-zod";
+import { z } from "zod";
+import { users } from "../db/schema";
+
+/**
+ * User type
+ */
+export type User = typeof users.$inferSelect;
+
+/**
+ * Login schema
+ */
+export const loginSchema = z.object({
+  email: z
+    .email({ message: "Email moet een geldig email adres zijn" })
+    .min(2, { message: "Email moet langer zijn dan 2 karakters" })
+    .max(50, { message: "Email mag niet langer zijn dan 50 karakters" }),
+  password: z
+    .string()
+    .min(2, { message: "Wachtwoord moet langer zijn dan 2 karakters" })
+    .max(50, { message: "Wachtwoord mag niet langer zijn dan 50 karakters" }),
+});
+
+/**
+ * Reset password schema
+ */
+export const resetPasswordSchema = z
+  .object({
+    password: z
+      .string()
+      .min(2, { message: "Wachtwoord moet langer zijn dan 2 karakters" })
+      .max(50, { message: "Wachtwoord mag niet langer zijn dan 50 karakters" }),
+    passwordConfirmation: z
+      .string()
+      .min(2, { message: "Wachtwoord moet langer zijn dan 2 karakters" })
+      .max(50, { message: "Wachtwoord mag niet langer zijn dan 50 karakters" }),
+  })
+  .refine((data) => data.password === data.passwordConfirmation, {
+    message: "Wachtwoorden komen niet overeen",
+    path: ["passwordConfirmation"],
+  });
+
+/**
+ * Forgot password schema
+ */
+export const forgotPasswordSchema = z.object({
+  email: z
+    .email({ error: "Email moet een geldig email adres zijn" })
+    .min(2, { message: "Email moet langer zijn dan 2 karakters" })
+    .max(50, { message: "Email mag niet langer zijn dan 50 karakters" }),
+});
+
+/**
+ * Create user schema
+ */
+export const createUserSchema = userSchema.pick({ email: true, image: true }).extend({
+  firstName: z
+    .string()
+    .min(2, { message: "Voornaam moet langer zijn dan 2 karakters" })
+    .max(50, { message: "Voornaam mag niet langer zijn dan 50 karakters" }),
+  lastName: z
+    .string()
+    .min(2, { message: "Achternaam moet langer zijn dan 2 karakters" })
+    .max(50, { message: "Achternaam mag niet langer zijn dan 50 karakters" }),
+  password: z.string().min(6, { message: "Wachtwoord moet minimaal 6 karakters hebben" }),
+  role: z.string(),
+});
+
+export type CreateUserSchema = z.infer<typeof createUserSchema>;
+
+/**
+ * Update user schema
+ */
+export const updateUserSchema = createInsertSchema(users).pick({
+  firstName: true,
+  lastName: true,
+  email: true,
+  image: true,
+});
+
+export type UpdateUserSchema = z.infer<typeof updateUserSchema>;
+
+/**
+ * Update password input validation
+ */
+export const updatePasswordSchema = z.object({
+  password: z.string().min(6, { message: "Wachtwoord moet minimaal 6 karakters hebben" }),
+});
+
+export type UpdatePasswordSchema = z.infer<typeof updatePasswordSchema>;