@xk2800/nextjs-template 0.7.1-beta.6 → 0.7.1-beta.8

package/dist/auth/helpers.mjs

@@ -1,67 +1,12 @@
-import { auth } from '../chunk-4GGLYS5R.mjs';
-import '../chunk-FVLMSLTX.mjs';
+export { getCurrentSession, hasRole, normalizeCallbackUrl, requireAuth, requireRole } from '../chunk-6Z3WUSDJ.mjs';
+import '../chunk-7QVIOQ47.mjs';
+import '../chunk-7F2POZM6.mjs';
 import '../chunk-6OAHCEDJ.mjs';
-import '../chunk-F776DQAM.mjs';
-import { db } from '../chunk-F7CG5CA3.mjs';
-import { users } from '../chunk-TR5XFBTD.mjs';
-import '../chunk-TMJYAOC2.mjs';
+import '../chunk-P2G23JMY.mjs';
+import '../chunk-OVKVD2HH.mjs';
+import '../chunk-ZJMFE5B2.mjs';
+import '../chunk-TR5XFBTD.mjs';
+import '../chunk-TKWNEKK6.mjs';
 import '../chunk-3465SI5N.mjs';
-import 'server-only';
-import { cache } from 'react';
-import { headers } from 'next/headers';
-import { redirect } from 'next/navigation';
-import { eq } from 'drizzle-orm';
-
-var getCurrentSession = cache(async () => {
-  const session = await auth.api.getSession({
-    headers: await headers()
-  });
-  return session;
-});
-var requireAuth = cache(async () => {
-  var _a;
-  const session = await getCurrentSession();
-  if (!(session == null ? void 0 : session.user)) {
-    redirect("/login");
-  }
-  const user = await db.select().from(users).where(eq(users.id, session.user.id)).limit(1);
-  if ((_a = user[0]) == null ? void 0 : _a.banned) {
-    await auth.api.signOut({
-      headers: await headers()
-    });
-    redirect("/login?error=account_banned");
-  }
-  return session;
-});
-function hasRole(userRole, requiredRole) {
-  if (!userRole) return false;
-  if (requiredRole === "admin") {
-    return userRole === "admin";
-  }
-  return userRole === "user" || userRole === "admin" || userRole === "tester";
-}
-async function requireRole(requiredRole) {
-  const session = await requireAuth();
-  if (!hasRole(session.user.role, requiredRole)) {
-    redirect("/dashboard");
-  }
-  return session;
-}
-function normalizeCallbackUrl(value) {
-  if (typeof value !== "string" || !value.trim()) return "/dashboard";
-  const candidate = value.trim();
-  try {
-    const appOrigin = new URL(process.env.NEXT_PUBLIC_APP_URL || process.env.BETTER_AUTH_URL || "http://localhost:3000").origin;
-    const callbackUrl = new URL(candidate, appOrigin);
-    if (callbackUrl.origin !== appOrigin) {
-      return "/dashboard";
-    }
-    return `${callbackUrl.pathname}${callbackUrl.search}${callbackUrl.hash}` || "/dashboard";
-  } catch (e) {
-    return "/dashboard";
-  }
-}
-
-export { getCurrentSession, hasRole, normalizeCallbackUrl, requireAuth, requireRole };
 //# sourceMappingURL=helpers.mjs.map
 //# sourceMappingURL=helpers.mjs.map

package/dist/auth/helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../lib/auth-helpers.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAgBO,IAAM,iBAAA,GAAoB,MAAM,YAAY;AACjD,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW;AAAA,IACxC,OAAA,EAAS,MAAM,OAAA;AAAQ,GACxB,CAAA;AAED,EAAA,OAAO,OAAA;AACT,CAAC;AASM,IAAM,WAAA,GAAc,MAAM,YAAY;AA/B7C,EAAA,IAAA,EAAA;AAgCE,EAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,EAAkB;AAExC,EAAA,IAAI,EAAC,mCAAS,IAAA,CAAA,EAAM;AAClB,IAAA,QAAA,CAAS,QAAQ,CAAA;AAAA,EACnB;AAGA,EAAA,MAAM,OAAO,MAAM,EAAA,CAChB,QAAO,CACP,IAAA,CAAK,KAAK,CAAA,CACV,KAAA,CAAM,EAAA,CAAG,KAAA,CAAM,IAAI,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAC,CAAA,CACnC,MAAM,CAAC,CAAA;AAEV,EAAA,IAAA,CAAI,EAAA,GAAA,IAAA,CAAK,CAAC,CAAA,KAAN,IAAA,GAAA,MAAA,GAAA,EAAA,CAAS,MAAA,EAAQ;AAEnB,IAAA,MAAM,IAAA,CAAK,IAAI,OAAA,CAAQ;AAAA,MACrB,OAAA,EAAS,MAAM,OAAA;AAAQ,KACxB,CAAA;AACD,IAAA,QAAA,CAAS,6BAA6B,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,OAAA;AACT,CAAC;AAKM,SAAS,OAAA,CAAQ,UAAqC,YAAA,EAAyC;AACpG,EAAA,IAAI,CAAC,UAAU,OAAO,KAAA;AAEtB,EAAA,IAAI,iBAAiB,OAAA,EAAS;AAC5B,IAAA,OAAO,QAAA,KAAa,OAAA;AAAA,EACtB;AAGA,EAAA,OAAO,QAAA,KAAa,MAAA,IAAU,QAAA,KAAa,OAAA,IAAW,QAAA,KAAa,QAAA;AACrE;AAKA,eAAsB,YAAY,YAAA,EAAgC;AAChE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAElC,EAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,IAAA,EAAM,YAAY,CAAA,EAAG;AAC7C,IAAA,QAAA,CAAS,YAAY,CAAA;AAAA,EACvB;AAEA,EAAA,OAAO,OAAA;AACT;AAQO,SAAS,qBAAqB,KAAA,EAAmC;AACtE,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,IAAA,IAAQ,OAAO,YAAA;AAEvD,EAAA,MAAM,SAAA,GAAY,MAAM,IAAA,EAAK;AAE7B,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,uBAAuB,OAAA,CAAQ,GAAA,CAAI,eAAA,IAAmB,uBAAuB,CAAA,CAAE,MAAA;AACrH,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,SAAA,EAAW,SAAS,CAAA;AAEhD,IAAA,IAAI,WAAA,CAAY,WAAW,SAAA,EAAW;AACpC,MAAA,OAAO,YAAA;AAAA,IACT;AAEA,IAAA,OAAO,CAAA,EAAG,YAAY,QAAQ,CAAA,EAAG,YAAY,MAAM,CAAA,EAAG,WAAA,CAAY,IAAI,CAAA,CAAA,IAAM,YAAA;AAAA,EAC9E,CAAA,CAAA,OAAQ,CAAA,EAAA;AACN,IAAA,OAAO,YAAA;AAAA,EACT;AACF","file":"helpers.mjs","sourcesContent":["import \"server-only\"\nimport { cache } from \"react\"\nimport { auth } from \"../server/auth\"\nimport { headers } from \"next/headers\"\nimport { redirect } from \"next/navigation\"\nimport { db } from \"../server/db\"\nimport { users } from \"../server/db/schema\"\nimport { eq } from \"drizzle-orm\"\n\n/**\n * Get current session (server-side only)\n * Returns session data or null if not authenticated\n *\n * Wrapped in React's cache() so the layout and page (both of which call\n * requireAuth per request) share one auth.api.getSession call instead of two.\n */\nexport const getCurrentSession = cache(async () => {\n  const session = await auth.api.getSession({\n    headers: await headers()\n  })\n\n  return session\n})\n\n/**\n * Require authentication - redirect to login if not authenticated\n * Use in server components/layouts that need protection\n *\n * Wrapped in cache() so the layout, page, and any admin layout that all call\n * requireAuth per request share one banned-status DB lookup instead of several.\n */\nexport const requireAuth = cache(async () => {\n  const session = await getCurrentSession()\n\n  if (!session?.user) {\n    redirect('/login')\n  }\n\n  // Check if user is banned\n  const user = await db\n    .select()\n    .from(users)\n    .where(eq(users.id, session.user.id))\n    .limit(1)\n\n  if (user[0]?.banned) {\n    // Sign out the user\n    await auth.api.signOut({\n      headers: await headers()\n    })\n    redirect('/login?error=account_banned')\n  }\n\n  return session\n})\n\n/**\n * Check if user has specific role\n */\nexport function hasRole(userRole: string | null | undefined, requiredRole: 'user' | 'admin'): boolean {\n  if (!userRole) return false\n\n  if (requiredRole === 'admin') {\n    return userRole === 'admin'\n  }\n\n  // 'user' role check - every role ('user', 'admin', 'tester') has access\n  return userRole === 'user' || userRole === 'admin' || userRole === 'tester'\n}\n\n/**\n * Require specific role - throw error if user doesn't have it\n */\nexport async function requireRole(requiredRole: 'user' | 'admin') {\n  const session = await requireAuth()\n\n  if (!hasRole(session.user.role, requiredRole)) {\n    redirect('/dashboard')\n  }\n\n  return session\n}\n\n/**\n * Normalize a callbackUrl query param to a same-origin path before it's ever\n * passed to redirect() or an auth form's callbackURL. Guards against open\n * redirects (e.g. /login?callbackUrl=https://evil.com) — anything that\n * doesn't resolve to this app's own origin falls back to /dashboard.\n */\nexport function normalizeCallbackUrl(value?: string | string[]): string {\n  if (typeof value !== 'string' || !value.trim()) return '/dashboard'\n\n  const candidate = value.trim()\n\n  try {\n    const appOrigin = new URL(process.env.NEXT_PUBLIC_APP_URL || process.env.BETTER_AUTH_URL || 'http://localhost:3000').origin\n    const callbackUrl = new URL(candidate, appOrigin)\n\n    if (callbackUrl.origin !== appOrigin) {\n      return '/dashboard'\n    }\n\n    return `${callbackUrl.pathname}${callbackUrl.search}${callbackUrl.hash}` || '/dashboard'\n  } catch {\n    return '/dashboard'\n  }\n}\n\n"]}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"helpers.mjs"}

package/dist/auth/index.js

@@ -445,6 +445,12 @@ var envSchema = zod.z.object({
   PORT: zod.z.string().default("3000").transform(Number),
   DATABASE_URL: zod.z.string().default(""),
   RESEND_API_KEY: zod.z.string().default(""),
+  // Full access key for marketing broadcasts (admin Marketing email page).
+  // Blank = use RESEND_API_KEY.
+  RESEND_BROADCAST_API_KEY: zod.z.string().default(""),
+  // Resend segment users join from the dashboard "Email updates" toggle.
+  // Blank = toggle hidden.
+  RESEND_MARKETING_SEGMENT_ID: zod.z.string().default(""),
   // Sender for every transactional email. Must be on a domain verified in
   // your Resend account.
   EMAIL_FROM: zod.z.string().default("Acme <onboarding@xavierkhew.xyz>"),
@@ -706,6 +712,7 @@ async function getResend() {
   }
   return resend;
 }
+config.RESEND_BROADCAST_API_KEY || config.RESEND_API_KEY;
 
 // server/auth.ts
 async function logFailedLogin(ctx) {