@tulip-systems/core 0.8.3 → 0.9.0

package/dist/src/modules/auth/handler/service.server.mjs

@@ -0,0 +1,87 @@
+import { url } from "../../../lib/utils/url.mjs";
+import { users } from "../db/schema.mjs";
+import ForgetPasswordEmail from "../../../components/emails/forget-password-email.mjs";
+import { eq } from "drizzle-orm";
+import { passkey } from "@better-auth/passkey";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { createAuthMiddleware } from "better-auth/api";
+import { betterAuth } from "better-auth/minimal";
+import { admin, emailOTP } from "better-auth/plugins";
+
+//#region src/modules/auth/handler/service.server.ts
+const authCookiePrefix = "tulip";
+/**
+* Create the Better Auth server instance.
+*/
+function createAuth(props) {
+	return betterAuth({
+		advanced: {
+			cookiePrefix: authCookiePrefix,
+			database: { generateId: () => false }
+		},
+		baseURL: { allowedHosts: props.allowedHosts },
+		database: drizzleAdapter(props.db, {
+			provider: "pg",
+			usePlural: true
+		}),
+		emailAndPassword: { enabled: true },
+		user: {
+			changeEmail: { enabled: true },
+			additionalFields: {
+				firstName: {
+					type: "string",
+					required: true,
+					input: true
+				},
+				lastName: {
+					type: "string",
+					required: true,
+					input: true
+				}
+			}
+		},
+		hooks: { after: createAuthMiddleware(async (ctx) => {
+			if (!ctx.path.startsWith("/sign-up")) return;
+			const session = ctx.context.newSession;
+			if (!session) return;
+			if ((await props.db.select().from(users)).length === 1) await props.db.update(users).set({ role: "developer" }).where(eq(users.id, session.user.id));
+		}) },
+		plugins: [
+			passkey(),
+			admin({
+				roles: props.roles,
+				ac: props.ac,
+				adminRoles: ["admin", "developer"],
+				defaultRole: props.defaultRole ?? "user"
+			}),
+			emailOTP({ sendVerificationOTP: async ({ email, otp, type }) => {
+				/**
+				* Send a forget password mail
+				*/
+				if (type === "forget-password") {
+					const searchParams = new URLSearchParams();
+					searchParams.set("email", email);
+					searchParams.set("otp", otp);
+					const resetPasswordHref = url(`/auth/reset-password?${searchParams.toString()}`);
+					const result = await props.email.emails.send({
+						from: props.config.email.defaultFrom,
+						to: email,
+						subject: "Wachtwoord herstellen",
+						react: ForgetPasswordEmail({ resetPasswordHref })
+					});
+					if (result.error) throw new Error(result.error.message);
+				}
+			} })
+		]
+	});
+}
+/**
+* Auth service namespace.
+*
+* @example
+* const auth = Auth.init({ db, email, config, ac, roles, allowedHosts });
+*/
+const Auth = { init: createAuth };
+
+//#endregion
+export { Auth, authCookiePrefix };

package/dist/src/modules/auth/hooks/use-auth-client.d.mts

@@ -0,0 +1,23 @@
+import { ClientAuth } from "../handler/create-client.client.mjs";
+import * as react_jsx_runtime0 from "react/jsx-runtime";
+import * as react from "react";
+import { PropsWithChildren } from "react";
+import { AccessControl, Role } from "better-auth/plugins";
+
+//#region src/modules/auth/hooks/use-auth-client.d.ts
+/**
+ * Auth client context
+ */
+declare const AuthClientContext: react.Context<ClientAuth<never, never>>;
+/**
+ * Use auth client
+ */
+declare function useAuthClient<TAccessControl extends AccessControl = never, TRoles extends { [key in string]: Role } = never>(): ClientAuth<TAccessControl, TRoles>;
+/**
+ * Auth client provider
+ */
+declare function AuthProvider<TAccessControl extends AccessControl, TRoles extends { [key in string]: Role }>(props: PropsWithChildren<{
+  authClient: ClientAuth<TAccessControl, TRoles>;
+}>): react_jsx_runtime0.JSX.Element;
+//#endregion
+export { AuthClientContext, AuthProvider, useAuthClient };

package/dist/src/modules/auth/hooks/use-auth-client.mjs

@@ -0,0 +1,30 @@
+"use client";
+
+import { jsx } from "react/jsx-runtime";
+import { createContext, use } from "react";
+
+//#region src/modules/auth/hooks/use-auth-client.tsx
+/**
+* Auth client context
+*/
+const AuthClientContext = createContext(null);
+/**
+* Use auth client
+*/
+function useAuthClient() {
+	const context = use(AuthClientContext);
+	if (!context) throw new Error("Auth client is not provided");
+	return context;
+}
+/**
+* Auth client provider
+*/
+function AuthProvider(props) {
+	return /* @__PURE__ */ jsx(AuthClientContext, {
+		value: props.authClient,
+		children: props.children
+	});
+}
+
+//#endregion
+export { AuthClientContext, AuthProvider, useAuthClient };

package/dist/src/modules/auth/hooks/use-permission.d.mts

@@ -0,0 +1,42 @@
+import { Permission } from "../lib/permissions.mjs";
+
+//#region src/modules/auth/hooks/use-permission.d.ts
+type UsePermissionProps = {
+  /**
+   * Strategy to use when checking multiple permissions
+   * - "all": all permissions must be allowed
+   * - "any": at least one permission must be allowed
+   * @default "all"
+   */
+  strategy?: "all";
+  /**
+   * Permission to check
+   * @example { project: ["view", "create"] }
+   */
+  permission?: Permission;
+} | {
+  /**
+   * Strategy to use when checking multiple permissions
+   * - "all": all permissions must be allowed
+   * - "any": at least one permission must be allowed
+   * @default "all"
+   */
+  strategy?: "any";
+  /**
+   * Permission to check
+   * @example [{ project: ["view", "create"] }, { client: ["view"] }, { drive: ["view"] }]
+   */
+  permission?: Permission[];
+};
+/**
+ * UsePermission
+ */
+declare function usePermission({
+  strategy,
+  permission
+}: UsePermissionProps): {
+  permission: Permission | Permission[] | undefined;
+  success: boolean;
+};
+//#endregion
+export { UsePermissionProps, usePermission };

package/dist/src/modules/auth/hooks/use-permission.mjs

@@ -0,0 +1,57 @@
+"use client";
+
+import { useAuthClient } from "./use-auth-client.mjs";
+import { useSession } from "./use-session.mjs";
+
+//#region src/modules/auth/hooks/use-permission.ts
+/**
+* UsePermission
+*/
+function usePermission({ strategy = "all", permission }) {
+	const authClient = useAuthClient();
+	/**
+	* If no role is found in the session, deny by default
+	*/
+	const role = useSession(authClient).data?.user.role;
+	if (!role) return {
+		permission,
+		success: false
+	};
+	/**
+	* If no permission is provided, allow by default
+	*/
+	if (!permission) return {
+		permission,
+		success: true
+	};
+	/**
+	* If the strategy is "any", check if the user has any of the permissions
+	*/
+	if (strategy === "any" && Array.isArray(permission)) return {
+		permission,
+		success: (Array.isArray(permission) ? permission : [permission]).some((permission) => authClient.admin.checkRolePermission({
+			role,
+			permissions: permission
+		}))
+	};
+	/**
+	* If the strategy is "all", check if the user has all of the permissions
+	*/
+	if (strategy === "all" && !Array.isArray(permission)) return {
+		permission,
+		success: authClient.admin.checkRolePermission({
+			role,
+			permissions: permission
+		})
+	};
+	/**
+	* If the strategy is not recognized, deny by default
+	*/
+	return {
+		permission,
+		success: false
+	};
+}
+
+//#endregion
+export { usePermission };

package/dist/src/modules/auth/hooks/use-session.d.mts

@@ -0,0 +1,40 @@
+import { ClientAuth } from "../handler/create-client.client.mjs";
+import "../../../../auth/client.mjs";
+import * as _tanstack_react_query0 from "@tanstack/react-query";
+import * as better_auth0 from "better-auth";
+
+//#region src/modules/auth/hooks/use-session.d.ts
+declare function useSession(authClient: ClientAuth<never, never>): _tanstack_react_query0.UseSuspenseQueryResult<{
+  user: better_auth0.StripEmptyObjects<{
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null | undefined;
+  } & {
+    firstName: string;
+    lastName: string;
+  } & {} & {
+    banned: boolean | null | undefined;
+  } & {
+    role?: string | null | undefined;
+    banReason?: string | null | undefined;
+    banExpires?: Date | null | undefined;
+  }>;
+  session: better_auth0.StripEmptyObjects<{
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null | undefined;
+    userAgent?: string | null | undefined;
+  } & {} & {
+    impersonatedBy?: string | null | undefined;
+  } & {} & {}>;
+} | null, Error>;
+//#endregion
+export { useSession };

package/dist/src/modules/auth/hooks/use-session.mjs

@@ -0,0 +1,22 @@
+"use client";
+
+import { useSuspenseQuery } from "@tanstack/react-query";
+
+//#region src/modules/auth/hooks/use-session.ts
+function useSession(authClient) {
+	return useSuspenseQuery({
+		queryKey: ["session"],
+		queryFn: async () => {
+			const session = await authClient.getSession();
+			if (session.error) {
+				console.error(session.error);
+				return null;
+			}
+			return session.data;
+		},
+		staleTime: 1e3 * 60 * 60
+	});
+}
+
+//#endregion
+export { useSession };

package/dist/src/modules/auth/lib/helpers.server.d.mts

@@ -0,0 +1,84 @@
+import { CreateUserSchema, UpdateUserSchema } from "./validators.mjs";
+import { TDatabaseSchema } from "../../database/lib/types.mjs";
+import { TulipContext } from "../../config/lib/context.mjs";
+import "../../../../config.mjs";
+import "server-cli-only";
+import * as better_auth_plugins0 from "better-auth/plugins";
+
+//#region src/modules/auth/lib/helpers.server.d.ts
+/**
+ * Get the session
+ */
+declare function getSession<TSchema extends TDatabaseSchema>({
+  auth
+}: Pick<TulipContext<TSchema>, "auth">): Promise<{
+  session: {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    userId: string;
+    expiresAt: Date;
+    token: string;
+    ipAddress?: string | null | undefined | undefined;
+    userAgent?: string | null | undefined | undefined;
+    impersonatedBy?: string | null | undefined;
+  };
+  user: {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    email: string;
+    emailVerified: boolean;
+    name: string;
+    image?: string | null | undefined | undefined;
+    firstName: string;
+    lastName: string;
+    banned: boolean | null | undefined;
+    role?: string | null | undefined;
+    banReason?: string | null | undefined;
+    banExpires?: Date | null | undefined;
+  };
+} | null>;
+/**
+ * Create a user
+ */
+declare function createUser<TSchema extends TDatabaseSchema>({
+  auth,
+  headers
+}: TulipContext<TSchema> & {
+  headers: Headers;
+}, {
+  body
+}: {
+  body: CreateUserSchema;
+}): Promise<{
+  user: better_auth_plugins0.UserWithRole;
+}>;
+/**
+ * Update a user
+ */
+declare function updateUser<TSchema extends TDatabaseSchema>({
+  db
+}: TulipContext<TSchema>, {
+  userId,
+  body
+}: {
+  userId: string;
+  body: Partial<UpdateUserSchema>;
+}): Promise<{
+  name: string;
+  firstName: string;
+  lastName: string;
+  email: string;
+  emailVerified: boolean;
+  image: string | null;
+  role: string | null;
+  banned: boolean | null;
+  banReason: string | null;
+  banExpires: Date | null;
+  id: string;
+  createdAt: Date;
+  updatedAt: Date;
+}>;
+//#endregion
+export { createUser, getSession, updateUser };

package/dist/src/modules/auth/lib/helpers.server.mjs

@@ -0,0 +1,41 @@
+import { ServerError } from "../../router/lib/error.server.mjs";
+import { users } from "../db/schema.mjs";
+import "server-cli-only";
+import { eq } from "drizzle-orm";
+import { headers } from "next/headers";
+
+//#region src/modules/auth/lib/helpers.server.ts
+/**
+* Get the session
+*/
+async function getSession({ auth }) {
+	return auth.api.getSession({ headers: await headers() });
+}
+/**
+* Create a user
+*/
+function createUser({ auth, headers }, { body }) {
+	const { firstName, lastName } = body;
+	return auth.api.createUser({
+		headers,
+		body: {
+			...body,
+			name: `${firstName} ${lastName}`,
+			data: {
+				firstName,
+				lastName
+			}
+		}
+	});
+}
+/**
+* Update a user
+*/
+async function updateUser({ db }, { userId, body }) {
+	const [result] = await db.update(users).set(body).where(eq(users.id, userId)).returning();
+	if (!result) throw new ServerError("INTERNAL_SERVER_ERROR", { message: "Gebruiker kon niet worden aangemaakt" });
+	return result;
+}
+
+//#endregion
+export { createUser, getSession, updateUser };

package/dist/src/modules/auth/lib/permissions.d.mts

@@ -0,0 +1,17 @@
+import { Role, createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements } from "better-auth/plugins/admin/access";
+
+//#region src/modules/auth/lib/permissions.d.ts
+type Permission = Record<string, string[]>;
+/**
+ * Create statements
+ */
+declare const createStatements: <TStatements extends Parameters<typeof createAccessControl>[0]>(statements: TStatements) => TStatements & {
+  readonly user: readonly ["create", "list", "set-role", "ban", "impersonate", "impersonate-admins", "delete", "set-password", "get", "update"];
+  readonly session: readonly ["list", "revoke", "delete"];
+};
+/**
+ * Exports
+ */
+//#endregion
+export { Permission, type Role, adminAc, createAccessControl, createStatements, defaultStatements };

package/dist/src/modules/auth/lib/permissions.mjs

@@ -0,0 +1,14 @@
+import { createAccessControl } from "better-auth/plugins/access";
+import { adminAc, defaultStatements } from "better-auth/plugins/admin/access";
+
+//#region src/modules/auth/lib/permissions.ts
+/**
+* Create statements
+*/
+const createStatements = (statements) => ({
+	...statements,
+	...defaultStatements
+});
+
+//#endregion
+export { adminAc, createAccessControl, createStatements, defaultStatements };