@xk2800/nextjs-template 0.7.1-beta.1 → 0.7.1-beta.11

package/dist/auth/helpers.mjs

@@ -1,67 +1,12 @@
-import { auth } from '../chunk-XWVAJXAG.mjs';
-import '../chunk-VQ5B4MA7.mjs';
-import '../chunk-N6ECRCHY.mjs';
-import '../chunk-3MGEAGHU.mjs';
-import { db } from '../chunk-WZDAMCUX.mjs';
-import { users } from '../chunk-ZQCALTKB.mjs';
-import '../chunk-TMJYAOC2.mjs';
+export { getCurrentSession, hasRole, normalizeCallbackUrl, requireAuth, requireRole } from '../chunk-6Z3WUSDJ.mjs';
+import '../chunk-7QVIOQ47.mjs';
+import '../chunk-7F2POZM6.mjs';
+import '../chunk-6OAHCEDJ.mjs';
+import '../chunk-P2G23JMY.mjs';
+import '../chunk-OVKVD2HH.mjs';
+import '../chunk-ZJMFE5B2.mjs';
+import '../chunk-TR5XFBTD.mjs';
+import '../chunk-TKWNEKK6.mjs';
 import '../chunk-3465SI5N.mjs';
-import 'server-only';
-import { cache } from 'react';
-import { headers } from 'next/headers';
-import { redirect } from 'next/navigation';
-import { eq } from 'drizzle-orm';
-
-var getCurrentSession = cache(async () => {
-  const session = await auth.api.getSession({
-    headers: await headers()
-  });
-  return session;
-});
-var requireAuth = cache(async () => {
-  var _a;
-  const session = await getCurrentSession();
-  if (!(session == null ? void 0 : session.user)) {
-    redirect("/login");
-  }
-  const user = await db.select().from(users).where(eq(users.id, session.user.id)).limit(1);
-  if ((_a = user[0]) == null ? void 0 : _a.banned) {
-    await auth.api.signOut({
-      headers: await headers()
-    });
-    redirect("/login?error=account_banned");
-  }
-  return session;
-});
-function hasRole(userRole, requiredRole) {
-  if (!userRole) return false;
-  if (requiredRole === "admin") {
-    return userRole === "admin";
-  }
-  return userRole === "user" || userRole === "admin" || userRole === "tester";
-}
-async function requireRole(requiredRole) {
-  const session = await requireAuth();
-  if (!hasRole(session.user.role, requiredRole)) {
-    redirect("/dashboard");
-  }
-  return session;
-}
-function normalizeCallbackUrl(value) {
-  if (typeof value !== "string" || !value.trim()) return "/dashboard";
-  const candidate = value.trim();
-  try {
-    const appOrigin = new URL(process.env.NEXT_PUBLIC_APP_URL || process.env.BETTER_AUTH_URL || "http://localhost:3000").origin;
-    const callbackUrl = new URL(candidate, appOrigin);
-    if (callbackUrl.origin !== appOrigin) {
-      return "/dashboard";
-    }
-    return `${callbackUrl.pathname}${callbackUrl.search}${callbackUrl.hash}` || "/dashboard";
-  } catch (e) {
-    return "/dashboard";
-  }
-}
-
-export { getCurrentSession, hasRole, normalizeCallbackUrl, requireAuth, requireRole };
 //# sourceMappingURL=helpers.mjs.map
 //# sourceMappingURL=helpers.mjs.map

package/dist/auth/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../lib/auth-helpers.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAgBO,IAAM,iBAAA,GAAoB,MAAM,YAAY;AACjD,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW;AAAA,IACxC,OAAA,EAAS,MAAM,OAAA;AAAQ,GACxB,CAAA;AAED,EAAA,OAAO,OAAA;AACT,CAAC;AASM,IAAM,WAAA,GAAc,MAAM,YAAY;AA/B7C,EAAA,IAAA,EAAA;AAgCE,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AAExC,EAAA,IAAI,EAAC,mCAAS,IAAA,CAAA,EAAM;AAClB,IAAA,QAAA,CAAS,QAAQ,CAAA;AAAA,EACnB;AAGA,EAAA,MAAM,OAAO,MAAM,EAAA,CAChB,QAAO,CACP,IAAA,CAAK,KAAK,CAAA,CACV,KAAA,CAAM,EAAA,CAAG,KAAA,CAAM,IAAI,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA,CACnC,MAAM,CAAC,CAAA;AAEV,EAAA,IAAA,CAAI,EAAA,GAAA,IAAA,CAAK,CAAC,CAAA,KAAN,IAAA,GAAA,MAAA,GAAA,EAAA,CAAS,MAAA,EAAQ;AAEnB,IAAA,MAAM,IAAA,CAAK,IAAI,OAAA,CAAQ;AAAA,MACrB,OAAA,EAAS,MAAM,OAAA;AAAQ,KACxB,CAAA;AACD,IAAA,QAAA,CAAS,6BAA6B,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT,CAAC;AAKM,SAAS,OAAA,CAAQ,UAAqC,YAAA,EAAyC;AACpG,EAAA,IAAI,CAAC,UAAU,OAAO,KAAA;AAEtB,EAAA,IAAI,iBAAiB,OAAA,EAAS;AAC5B,IAAA,OAAO,QAAA,KAAa,OAAA;AAAA,EACtB;AAGA,EAAA,OAAO,QAAA,KAAa,MAAA,IAAU,QAAA,KAAa,OAAA,IAAW,QAAA,KAAa,QAAA;AACrE;AAKA,eAAsB,YAAY,YAAA,EAAgC;AAChE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAElC,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,IAAA,EAAM,YAAY,CAAA,EAAG;AAC7C,IAAA,QAAA,CAAS,YAAY,CAAA;AAAA,EACvB;AAEA,EAAA,OAAO,OAAA;AACT;AAQO,SAAS,qBAAqB,KAAA,EAAmC;AACtE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,IAAA,IAAQ,OAAO,YAAA;AAEvD,EAAA,MAAM,SAAA,GAAY,MAAM,IAAA,EAAK;AAE7B,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,uBAAuB,OAAA,CAAQ,GAAA,CAAI,eAAA,IAAmB,uBAAuB,CAAA,CAAE,MAAA;AACrH,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,SAAA,EAAW,SAAS,CAAA;AAEhD,IAAA,IAAI,WAAA,CAAY,WAAW,SAAA,EAAW;AACpC,MAAA,OAAO,YAAA;AAAA,IACT;AAEA,IAAA,OAAO,CAAA,EAAG,YAAY,QAAQ,CAAA,EAAG,YAAY,MAAM,CAAA,EAAG,WAAA,CAAY,IAAI,CAAA,CAAA,IAAM,YAAA;AAAA,EAC9E,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,OAAO,YAAA;AAAA,EACT;AACF","file":"helpers.mjs","sourcesContent":["import \"server-only\"\nimport { cache } from \"react\"\nimport { auth } from \"../server/auth\"\nimport { headers } from \"next/headers\"\nimport { redirect } from \"next/navigation\"\nimport { db } from \"../server/db\"\nimport { users } from \"../server/db/schema\"\nimport { eq } from \"drizzle-orm\"\n\n/**\n * Get current session (server-side only)\n * Returns session data or null if not authenticated\n *\n * Wrapped in React's cache() so the layout and page (both of which call\n * requireAuth per request) share one auth.api.getSession call instead of two.\n */\nexport const getCurrentSession = cache(async () => {\n  const session = await auth.api.getSession({\n    headers: await headers()\n  })\n\n  return session\n})\n\n/**\n * Require authentication - redirect to login if not authenticated\n * Use in server components/layouts that need protection\n *\n * Wrapped in cache() so the layout, page, and any admin layout that all call\n * requireAuth per request share one banned-status DB lookup instead of several.\n */\nexport const requireAuth = cache(async () => {\n  const session = await getCurrentSession()\n\n  if (!session?.user) {\n    redirect('/login')\n  }\n\n  // Check if user is banned\n  const user = await db\n    .select()\n    .from(users)\n    .where(eq(users.id, session.user.id))\n    .limit(1)\n\n  if (user[0]?.banned) {\n    // Sign out the user\n    await auth.api.signOut({\n      headers: await headers()\n    })\n    redirect('/login?error=account_banned')\n  }\n\n  return session\n})\n\n/**\n * Check if user has specific role\n */\nexport function hasRole(userRole: string | null | undefined, requiredRole: 'user' | 'admin'): boolean {\n  if (!userRole) return false\n\n  if (requiredRole === 'admin') {\n    return userRole === 'admin'\n  }\n\n  // 'user' role check - every role ('user', 'admin', 'tester') has access\n  return userRole === 'user' || userRole === 'admin' || userRole === 'tester'\n}\n\n/**\n * Require specific role - throw error if user doesn't have it\n */\nexport async function requireRole(requiredRole: 'user' | 'admin') {\n  const session = await requireAuth()\n\n  if (!hasRole(session.user.role, requiredRole)) {\n    redirect('/dashboard')\n  }\n\n  return session\n}\n\n/**\n * Normalize a callbackUrl query param to a same-origin path before it's ever\n * passed to redirect() or an auth form's callbackURL. Guards against open\n * redirects (e.g. /login?callbackUrl=https://evil.com) — anything that\n * doesn't resolve to this app's own origin falls back to /dashboard.\n */\nexport function normalizeCallbackUrl(value?: string | string[]): string {\n  if (typeof value !== 'string' || !value.trim()) return '/dashboard'\n\n  const candidate = value.trim()\n\n  try {\n    const appOrigin = new URL(process.env.NEXT_PUBLIC_APP_URL || process.env.BETTER_AUTH_URL || 'http://localhost:3000').origin\n    const callbackUrl = new URL(candidate, appOrigin)\n\n    if (callbackUrl.origin !== appOrigin) {\n      return '/dashboard'\n    }\n\n    return `${callbackUrl.pathname}${callbackUrl.search}${callbackUrl.hash}` || '/dashboard'\n  } catch {\n    return '/dashboard'\n  }\n}\n\n"]}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"helpers.mjs"}

package/dist/auth/index.js

@@ -207,6 +207,7 @@ __export(schema_exports, {
   accounts: () => accounts,
   activityLogs: () => activityLogs,
   authThrottle: () => authThrottle,
+  consentLog: () => consentLog,
   deviceFingerprints: () => deviceFingerprints,
   errorRefs: () => errorRefs,
   passkeys: () => passkeys,
@@ -361,10 +362,32 @@ var deviceFingerprints = pgCore.pgTable("device_fingerprint", {
   userAgent: pgCore.text("userAgent"),
   country: pgCore.text("country"),
   city: pgCore.text("city"),
+  // Latest FingerprintJS signals for this device (lib/device-fingerprint.ts
+  // getDeviceSignals(): accessibility signals dropped, large values hashed),
+  // shown on the admin user page. Null for rows from before this column.
+  components: pgCore.jsonb("components").$type(),
   createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
 }, (table) => [
   pgCore.unique("device_fingerprint_user_visitor").on(table.userId, table.visitorId)
 ]);
+var consentLog = pgCore.pgTable("consent_log", {
+  id: pgCore.text("id").notNull().primaryKey().$defaultFn(() => cuid2.createId()),
+  userId: pgCore.text("userId").notNull().references(() => users.id, { onDelete: "cascade" }),
+  // The cookie_consent value: "all", "necessary" or a comma list of purposes.
+  choice: pgCore.text("choice").notNull(),
+  // CONSENT_VERSION (lib/cookie-names.ts) at the time — which banner/policy
+  // wording the user agreed to.
+  version: pgCore.integer("version").notNull(),
+  // id of the user's record this one follows ("" for their first). Unique per
+  // user, so concurrent posts from several tabs that all saw the same latest
+  // record can't each insert a duplicate — one wins, the rest conflict. Works
+  // without transactions (neon-http has none). Null on rows from before it.
+  previousId: pgCore.text("previousId"),
+  createdAt: pgCore.timestamp("createdAt").notNull().defaultNow()
+}, (table) => [
+  pgCore.index("consent_log_user_idx").on(table.userId, table.createdAt),
+  pgCore.unique("consent_log_chain").on(table.userId, table.previousId)
+]);
 var authThrottle = pgCore.pgTable("auth_throttle", {
   fingerprint: pgCore.text("fingerprint").notNull().primaryKey(),
   count: pgCore.integer("count").notNull().default(0),
@@ -394,6 +417,13 @@ var systemSettings = pgCore.pgTable("system_settings", {
   // Attach the error a user hit to feedback they send from it (see
   // lib/feedback-route.ts). Off = only what the user typed is sent.
   feedbackAttachErrors: pgCore.boolean("feedbackAttachErrors").notNull().default(true),
+  // GDPR/ePrivacy consent mode. On: cookie banner, FingerprintJS and One Tap
+  // only after "Accept all", device record erased on withdrawal. Off (no EU/UK
+  // users): no banner, treated as consented. Null = follow
+  // NEXT_PUBLIC_COOKIE_BANNER (nullable so migrating never flips a deployed
+  // banner on or off). proxy.ts mirrors the effective value into the
+  // consent_required cookie for the client (lib/cookie-consent.ts).
+  consentRequired: pgCore.boolean("consentRequired"),
   updatedAt: pgCore.timestamp("updatedAt").notNull().defaultNow(),
   // Who last changed a setting. This row doesn't "belong" to that admin the
   // way sessions/activityLogs belong to their user, so deleting that admin's
@@ -415,6 +445,12 @@ var envSchema = zod.z.object({
   PORT: zod.z.string().default("3000").transform(Number),
   DATABASE_URL: zod.z.string().default(""),
   RESEND_API_KEY: zod.z.string().default(""),
+  // Full access key for marketing broadcasts (admin Marketing email page).
+  // Blank = use RESEND_API_KEY.
+  RESEND_BROADCAST_API_KEY: zod.z.string().default(""),
+  // Resend segment users join from the dashboard "Email updates" toggle.
+  // Blank = toggle hidden.
+  RESEND_MARKETING_SEGMENT_ID: zod.z.string().default(""),
   // Sender for every transactional email. Must be on a domain verified in
   // your Resend account.
   EMAIL_FROM: zod.z.string().default("Acme <onboarding@xavierkhew.xyz>"),
@@ -554,6 +590,7 @@ var DEVICE_FINGERPRINT_HEADER = "x-device-fingerprint";
 var WINDOW_MS = 15 * 60 * 1e3;
 var MAX = 10;
 var MAX_IP = MAX * 3;
+var RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
 function isOverLimit(row, now, max = MAX) {
   if (!row) return false;
   if (now - row.windowStart.getTime() >= WINDOW_MS) return false;
@@ -591,6 +628,18 @@ async function recordDeviceAttempt(fingerprint, meta) {
   } catch (error) {
     console.error("auth-throttle write failed", error);
   }
+  await pruneStaleRows(now);
+}
+var PRUNE_EVERY_MS = 60 * 60 * 1e3;
+var lastPrune = 0;
+async function pruneStaleRows(now = /* @__PURE__ */ new Date()) {
+  if (now.getTime() - lastPrune < PRUNE_EVERY_MS) return;
+  lastPrune = now.getTime();
+  try {
+    await db.delete(authThrottle).where(drizzleOrm.lt(authThrottle.lastAttemptAt, new Date(now.getTime() - RETENTION_MS)));
+  } catch (error) {
+    console.error("auth-throttle prune failed", error);
+  }
 }
 async function clearDeviceThrottle(fingerprint) {
   try {
@@ -613,6 +662,7 @@ function fallbackSettings() {
     authEnableOneTap: config.AUTH_ENABLE_ONE_TAP,
     enableSessionRevocation: config.ENABLE_SESSION_REVOCATION,
     feedbackAttachErrors: true,
+    consentRequired: null,
     updatedAt: /* @__PURE__ */ new Date(0),
     updatedBy: null
   };
@@ -662,6 +712,7 @@ async function getResend() {
   }
   return resend;
 }
+config.RESEND_BROADCAST_API_KEY || config.RESEND_API_KEY;
 
 // server/auth.ts
 async function logFailedLogin(ctx) {