@webtwizz/cloud 0.4.0 → 0.4.1

package/AI_GUIDE.md

@@ -41,7 +41,7 @@ if (error) setMessage(authMessage(error));
 
 For wording that fits the site, pass overrides: `authMessage(error, { USER_ALREADY_EXISTS: 'You already have a booking account.' })`.
 
-When the owner turns on Confirm email, sign-up returns no session and the 6-digit code is emailed automatically. Show a code step: `authClient.emailOtp.verifyEmail({ email, otp })`, then sign them in, with a "Send a new code" button that calls `authClient.emailOtp.sendVerificationOtp({ email, type: 'email-verification' })`. Never send the first code yourself.
+Confirm email is off unless the owner turns it on in Settings > Cloud > Users, so sign-up signs people straight in and an unconfirmed email never stops a sign-in. When the owner turns on Confirm email, sign-up returns no session and the 6-digit code is emailed automatically. Show a code step: `authClient.emailOtp.verifyEmail({ email, otp })`, then sign them in, with a "Send a new code" button that calls `authClient.emailOtp.sendVerificationOtp({ email, type: 'email-verification' })`. Never send the first code yourself.
 
 5. Protect pages in `src/proxy.ts`, listing only the protected routes in the matcher (a matcher over every path blocks the sign-in page's own scripts):
 
@@ -66,6 +66,15 @@ Never destructure `{ user }` from the top level.
 
 8. Every sign-in page gets a "Forgot password?" link to `/reset-password`, a client page in two steps: their email, then `authClient.forgetPassword.emailOtp({ email })`, which emails a 6-digit code; then the code and a new password, then `authClient.emailOtp.resetPassword({ email, otp, password })`, then send them to sign in. Leave `/reset-password` out of the proxy matcher. The owner can also send a reset code from the Data panel, and it lands on this page.
 
+9. Admins are accounts whose role is `'admin'`. Admin pages and admin writes check it on the server, the same way as step 6:
+
+```ts
+const { data: session } = await auth.getSession();
+if (session?.user?.role !== 'admin') return Response.json({ error: 'Admins only' }, { status: 403 });
+```
+
+The first admin is the owner's own account on the site: they sign up like any visitor (their WebTwizz account is separate), then make that account an admin under Users in the Data panel, or ask you to do it. A new role reaches their session within a few minutes, or right away when they sign in again.
+
 Sign-ins are email and password only. Sign-in emails (reset codes, confirmations) are sent for the site automatically; never build email sending or add an email service for them. If the user asks for another way to sign in, say WebTwizz Cloud sign-ins are email and password for now and build that.
 
 Sites built before this package import sign-ins from another package in `src/lib/auth/`. When you work on their sign-ins, move `server.ts`, `client.ts` and the auth route to the files above (same sign-ins, same users) and remove the old package.
@@ -102,6 +111,17 @@ The database can pause or fill up on the owner's plan. Wrap reads and saves in t
 
 Pages that only show data set `export const revalidate = 60`, and the server action that saves calls `revalidatePath` for them. Pages for a signed-in user stay dynamic.
 
+The database runs while pages read or save data and stops after 5 quiet minutes; its running time comes out of the owner's monthly allowance. So a page that refreshes data on a timer (a feed, a chat, a dashboard) refreshes only while the tab is visible, and again when the visitor comes back:
+
+```ts
+useEffect(() => {
+  const refresh = () => { if (document.visibilityState === 'visible') load(); };
+  const timer = setInterval(refresh, 60_000);
+  document.addEventListener('visibilitychange', refresh);
+  return () => { clearInterval(timer); document.removeEventListener('visibilitychange', refresh); };
+}, []);
+```
+
 ## Files
 
 Two buckets: `public` (anyone can view, for images shown on the site) and `private` (documents, opened through short-lived links). Images you place on pages yourself keep using the usual image tools; this is for what visitors or the site's features upload.
@@ -132,4 +152,4 @@ Show files with `createFiles().publicUrl(key)` in a plain `<img>` or link, or `a
 
 ## Owner tools
 
-The owner manages users under Users in the Data panel (password reset, block, delete with their rows, export), sets who can sign up and the sign-in emails in Settings > Cloud > Users, and downloads everything from Settings > Cloud > Database. Point them there when they ask.
+The owner manages users under Users in the Data panel (make admin, password reset, block, delete with their rows, export), sets who can sign up and the sign-in emails in Settings > Cloud > Users, and downloads everything from Settings > Cloud > Database. Point them there when they ask.

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @webtwizz/cloud
 
+## 0.4.1
+
+### Patch Changes
+
+- 67343d5: Signed-in visitors can sign out, and `authClient` can read their session: since 0.2.0 the sign-in route answered both with a server error inside Next, because it copied a request Next hands over as a Proxy. Visitors who pressed Sign out stayed signed in.
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -40,6 +40,8 @@ npm run build
 
 `test/fixture` is a small Next app that CI builds against the packed tarball.
 
+To try a change in the local WebTwizz preview site without publishing: `npm run preview` builds the package, puts it in the preview container's `node_modules` under a unique dev version, and restarts its dev server (about 10 seconds). `npm run dev` does the same on every save.
+
 ## Releases
 
 - Add a changeset (`npx changeset`) to any PR that changes what sites get.

package/dist/server.js

@@ -1435,7 +1435,8 @@ function forLibrary(request, make) {
   if (translated === cookie) return request;
   const headers2 = new Headers(request.headers);
   headers2.set("cookie", translated);
-  return make(request, headers2);
+  const body = request.method === "GET" || request.method === "HEAD" ? void 0 : request.body;
+  return make(request.url, { method: request.method, headers: headers2, body, signal: request.signal, ...body ? { duplex: "half" } : {} });
 }
 function forBrowser(response) {
   const provider = [...response.headers.keys()].filter((name) => PROVIDER_HEADER.test(name));
@@ -1481,7 +1482,7 @@ function createAuth(options = {}) {
   const middleware = auth.middleware.bind(auth);
   auth.handler = () => {
     const methods = handler();
-    const wrap = (method) => async (request, context) => forBrowser(await method(forLibrary(request, (original, headers2) => new Request(original, { headers: headers2 })), context));
+    const wrap = (method) => async (request, context) => forBrowser(await method(forLibrary(request, (url, init) => new Request(url, init)), context));
     const post = wrap(methods.POST);
     const signUp = async (request, context) => {
       const response = await post(request, context);
@@ -1493,7 +1494,7 @@ function createAuth(options = {}) {
   };
   auth.middleware = (config) => {
     const run = middleware(config);
-    return async (request) => forBrowser(await run(forLibrary(request, (original, headers2) => new NextRequest2(original, { headers: headers2 }))));
+    return async (request) => forBrowser(await run(forLibrary(request, (url, init) => new NextRequest2(url, init))));
   };
   return auth;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webtwizz/cloud",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Sign-ins, database and file storage for sites built on WebTwizz Cloud",
   "license": "MIT",
   "type": "module",
@@ -55,7 +55,9 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:integration": "npm run build && vitest run --config vitest.integration.config.ts",
-    "prepublishOnly": "npm run build && npm run typecheck && npm test"
+    "prepublishOnly": "npm run build && npm run typecheck && npm test",
+    "preview": "tsup && node scripts/preview.mjs",
+    "dev": "tsup --watch --onSuccess \"node scripts/preview.mjs\""
   },
   "engines": {
     "node": ">=20"