alchemy 0.37.2 → 0.38.0

package/templates/rwsdk/README.md

@@ -0,0 +1,62 @@
+# Standard RedwoodSDK Starter
+
+This "standard starter" is the recommended implementation for RedwoodSDK. You get a Typescript project with:
+
+- Vite
+- database (Prisma via D1)
+- Session Management (via DurableObjects)
+- Passkey authentication (Webauthn)
+- Storage (via R2)
+
+## Creating your project
+
+```shell
+npx create-rwsdk my-project-name
+cd my-project-name
+pnpm install
+```
+
+## Running the dev server
+
+```shell
+pnpm dev
+```
+
+Point your browser to the URL displayed in the terminal (e.g. `http://localhost:5173/`). You should see a "Hello World" message in your browser.
+
+## Deploying your app
+
+### Wrangler Setup
+
+Within your project's `wrangler.jsonc`:
+
+- Replace the `__change_me__` placeholders with a name for your application
+
+- Create a new D1 database:
+
+```shell
+npx wrangler d1 create my-project-db
+```
+
+Copy the database ID provided and paste it into your project's `wrangler.jsonc` file:
+
+```jsonc
+{
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "my-project-db",
+      "database_id": "your-database-id",
+    },
+  ],
+}
+```
+
+### Authentication Setup
+
+For authentication setup and configuration, including optional bot protection, see the [Authentication Documentation](https://docs.rwsdk.com/core/authentication).
+
+## Further Reading
+
+- [RedwoodSDK Documentation](https://docs.rwsdk.com/)
+- [Cloudflare Workers Secrets](https://developers.cloudflare.com/workers/runtime-apis/secrets/)

package/templates/rwsdk/_env

@@ -0,0 +1,5 @@
+WEBAUTHN_RP_ID=localhost
+AUTH_SECRET_KEY=your-development-secret-key
+# Optional: Enable Turnstile bot protection
+# TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA
+ALCHEMY_PASSWORD=change-me

package/templates/rwsdk/_env.example

@@ -0,0 +1,5 @@
+WEBAUTHN_RP_ID=localhost
+AUTH_SECRET_KEY=your-development-secret-key
+# Optional: Enable Turnstile bot protection
+# TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA
+ALCHEMY_PASSWORD=change-me

package/templates/rwsdk/_gitignore

@@ -0,0 +1,71 @@
+# Node modules
+node_modules
+
+# Logs
+logs
+*.log
+npm-debug.log*
+pnpm-debug.log*
+
+# Environment variables
+.env
+.dev.vars
+
+# Vite build output
+dist
+
+# TypeScript
+*.tsbuildinfo
+
+# IDEs and editors
+.vscode/
+.idea/
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+
+# MacOS
+.DS_Store
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional stylelint cache
+.stylelintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# pnpm store directory
+.pnpm-store
+
+# dotenv environment variables file
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# Vite cache
+.vite
+
+# Coverage directory used by tools like istanbul
+coverage
+
+# Temporary files
+*.tmp
+*.temp
+
+.wrangler
+
+generated/
+
+.alchemy/
+.env

package/templates/rwsdk/alchemy.run.ts

@@ -0,0 +1,29 @@
+/// <reference types="@types/node" />
+import alchemy from "alchemy";
+import { D1Database, DurableObjectNamespace, Redwood } from "alchemy/cloudflare";
+
+const app = await alchemy("my-alchemy-app");
+    
+const database = await D1Database("database", {
+  name: "my-alchemy-app-db",
+  migrationsDir: "migrations",
+});
+
+export const worker = await Redwood("website", {
+  name: "my-alchemy-app-website",
+  command: "bun run build",
+  bindings: {
+    AUTH_SECRET_KEY: alchemy.secret(process.env.AUTH_SECRET_KEY),
+    DB: database,
+    SESSION_DURABLE_OBJECT: new DurableObjectNamespace("session", {
+      className: "SessionDurableObject",
+    }),
+  },
+});
+
+console.log({
+  url: worker.url,
+});
+
+await app.finalize();
+    

package/templates/rwsdk/package.json

@@ -0,0 +1,61 @@
+{
+  "type": "module",
+  "name": "rwsdk",
+  "version": "1.0.0",
+  "description": "Build fast, server-driven webapps on Cloudflare with SSR, RSC, and realtime. ",
+  "main": "index.js",
+  "keywords": [],
+  "author": "",
+  "license": "MIT",
+  "private": true,
+  "scripts": {
+    "build": "vite build",
+    "check": "npm run generate && npm run types",
+    "clean": "npm run clean:vite",
+    "clean:vite": "rm -rf ./node_modules/.vite",
+    "deploy": "tsx --env-file .env ./alchemy.run.ts",
+    "destroy": "tsx --env-file .env ./alchemy.run.ts --destroy",
+    "dev": "NODE_ENV=${NODE_ENV:-development} vite dev",
+    "dev:init": "rw-scripts dev-init",
+    "generate": "rw-scripts ensure-env && prisma generate && wrangler types",
+    "migrate:dev": "prisma generate && wrangler d1 migrations apply DB --local",
+    "migrate:new": "rw-scripts migrate-new",
+    "migrate:prd": "wrangler d1 migrations apply DB --remote",
+    "prepare": "vibe-rules install cursor",
+    "preview": "vite preview",
+    "release": "rw-scripts ensure-deploy-env && npm run clean && prisma generate && RWSDK_DEPLOY=1 npm run build && wrangler deploy",
+    "seed": "npm run worker:run ./src/scripts/seed.ts",
+    "types": "tsc",
+    "worker:run": "rw-scripts worker-run"
+  },
+  "dependencies": {
+    "@prisma/adapter-d1": "~6.8.2",
+    "@prisma/client": "~6.8.2",
+    "@simplewebauthn/browser": "^13.1.0",
+    "@simplewebauthn/server": "^13.1.1",
+    "rwsdk": "0.0.89"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20250620.0",
+    "miniflare": "^4.20250617.3",
+    "@types/node": "^22.14.0",
+    "@types/react": "^19.1.2",
+    "@types/react-dom": "^19.1.2",
+    "prisma": "~6.8.2",
+    "typescript": "^5.8.3",
+    "vibe-rules": "^0.2.31",
+    "alchemy": "workspace:*",
+    "vite": "^6.2.6",
+    "wrangler": "^4.16.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@prisma/client",
+      "@prisma/engines",
+      "esbuild",
+      "prisma",
+      "sharp",
+      "workerd"
+    ]
+  }
+}

package/templates/rwsdk/prisma/schema.prisma

@@ -0,0 +1,43 @@
+// This is your Prisma schema file,
+// learn more about it in the docs: https://pris.ly/d/prisma-schema
+
+// Looking for ways to speed up your queries, or scale easily with your serverless or edge functions?
+// Try Prisma Accelerate: https://pris.ly/cli/accelerate-init
+
+generator client {
+  provider = "prisma-client"
+
+  runtime                = "workerd"
+  moduleFormat           = "esm"
+  generatedFileExtension = "ts"
+  importFileExtension    = "ts"
+
+  output          = "../generated/prisma"
+  previewFeatures = ["queryCompiler", "driverAdapters"]
+}
+
+datasource db {
+  provider = "sqlite"
+  url      = env("DATABASE_URL")
+}
+
+model User {
+  id          String      @id @default(uuid()) // User ID (UUID-based)
+  username    String      @unique
+  createdAt   DateTime    @default(now())
+
+  credentials Credential[] // Relationship: One user can have many credentials
+}
+
+model Credential {
+  id            String   @id @default(uuid()) // Internal DB ID
+  userId        String   @unique // Every credential is linked to a specific user
+  user          User     @relation(fields: [userId], references: [id])
+  createdAt     DateTime @default(now())
+  credentialId  String   @unique // WebAuthn credential identifier
+  publicKey     Bytes
+  counter       Int      @default(0)
+  
+  @@index([credentialId])
+  @@index([userId])
+}

package/templates/rwsdk/src/app/Document.tsx

@@ -0,0 +1,16 @@
+export const Document: React.FC<{ children: React.ReactNode }> = ({
+  children,
+}) => (
+  <html lang="en">
+    <head>
+      <meta charSet="utf-8" />
+      <meta name="viewport" content="width=device-width, initial-scale=1" />
+      <title>@redwoodjs/starter-standard</title>
+      <link rel="modulepreload" href="/src/client.tsx" />
+    </head>
+    <body>
+      <div id="root">{children}</div>
+      <script>import("/src/client.tsx")</script>
+    </body>
+  </html>
+);

package/templates/rwsdk/src/app/headers.ts

@@ -0,0 +1,32 @@
+import { RouteMiddleware } from "rwsdk/router";
+import { IS_DEV } from "rwsdk/constants";
+
+export const setCommonHeaders =
+  (): RouteMiddleware =>
+  ({ headers, rw: { nonce } }) => {
+    if (!IS_DEV) {
+      // Forces browsers to always use HTTPS for a specified time period (2 years)
+      headers.set(
+        "Strict-Transport-Security",
+        "max-age=63072000; includeSubDomains; preload",
+      );
+    }
+
+    // Forces browser to use the declared content-type instead of trying to guess/sniff it
+    headers.set("X-Content-Type-Options", "nosniff");
+
+    // Stops browsers from sending the referring webpage URL in HTTP headers
+    headers.set("Referrer-Policy", "no-referrer");
+
+    // Explicitly disables access to specific browser features/APIs
+    headers.set(
+      "Permissions-Policy",
+      "geolocation=(), microphone=(), camera=()",
+    );
+
+    // Defines trusted sources for content loading and script execution:
+    headers.set(
+      "Content-Security-Policy",
+      `default-src 'self'; script-src 'self' 'nonce-${nonce}' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; frame-src https://challenges.cloudflare.com; object-src 'none';`,
+    );
+  };

package/templates/rwsdk/src/app/pages/Home.tsx

@@ -0,0 +1,13 @@
+import { RequestInfo } from "rwsdk/worker";
+
+export function Home({ ctx }: RequestInfo) {
+  return (
+    <div>
+      <p>
+        {ctx.user?.username
+          ? `You are logged in as user ${ctx.user.username}`
+          : "You are not logged in"}
+      </p>
+    </div>
+  );
+}

package/templates/rwsdk/src/app/pages/user/Login.tsx

@@ -0,0 +1,79 @@
+"use client";
+
+import { useState, useTransition } from "react";
+import {
+  startAuthentication,
+  startRegistration,
+} from "@simplewebauthn/browser";
+import {
+  finishPasskeyLogin,
+  finishPasskeyRegistration,
+  startPasskeyLogin,
+  startPasskeyRegistration,
+} from "./functions";
+
+export function Login() {
+  const [username, setUsername] = useState("");
+  const [result, setResult] = useState("");
+  const [isPending, startTransition] = useTransition();
+
+  const passkeyLogin = async () => {
+    // 1. Get a challenge from the worker
+    const options = await startPasskeyLogin();
+
+    // 2. Ask the browser to sign the challenge
+    const login = await startAuthentication({ optionsJSON: options });
+
+    // 3. Give the signed challenge to the worker to finish the login process
+    const success = await finishPasskeyLogin(login);
+
+    if (!success) {
+      setResult("Login failed");
+    } else {
+      setResult("Login successful!");
+    }
+  };
+
+  const passkeyRegister = async () => {
+    // 1. Get a challenge from the worker
+    const options = await startPasskeyRegistration(username);
+
+    // 2. Ask the browser to sign the challenge
+    const registration = await startRegistration({ optionsJSON: options });
+
+    // 3. Give the signed challenge to the worker to finish the registration process
+    const success = await finishPasskeyRegistration(username, registration);
+
+    if (!success) {
+      setResult("Registration failed");
+    } else {
+      setResult("Registration successful!");
+    }
+  };
+
+  const handlePerformPasskeyLogin = () => {
+    startTransition(() => void passkeyLogin());
+  };
+
+  const handlePerformPasskeyRegister = () => {
+    startTransition(() => void passkeyRegister());
+  };
+
+  return (
+    <>
+      <input
+        type="text"
+        value={username}
+        onChange={(e) => setUsername(e.target.value)}
+        placeholder="Username"
+      />
+      <button onClick={handlePerformPasskeyLogin} disabled={isPending}>
+        {isPending ? <>...</> : "Login with passkey"}
+      </button>
+      <button onClick={handlePerformPasskeyRegister} disabled={isPending}>
+        {isPending ? <>...</> : "Register with passkey"}
+      </button>
+      {result && <div>{result}</div>}
+    </>
+  );
+}

package/templates/rwsdk/src/app/pages/user/functions.ts

@@ -0,0 +1,171 @@
+"use server";
+import {
+  generateRegistrationOptions,
+  generateAuthenticationOptions,
+  verifyRegistrationResponse,
+  verifyAuthenticationResponse,
+  RegistrationResponseJSON,
+  AuthenticationResponseJSON,
+} from "@simplewebauthn/server";
+
+import { sessions } from "@/session/store";
+import { requestInfo } from "rwsdk/worker";
+import { db } from "@/db";
+import { env } from "cloudflare:workers";
+
+const IS_DEV = process.env.NODE_ENV === "development";
+
+function getWebAuthnConfig(request: Request) {
+  const rpID = env.WEBAUTHN_RP_ID ?? new URL(request.url).hostname;
+  const rpName = IS_DEV ? "Development App" : env.WEBAUTHN_APP_NAME;
+  return {
+    rpName,
+    rpID,
+  };
+}
+
+export async function startPasskeyRegistration(username: string) {
+  const { rpName, rpID } = getWebAuthnConfig(requestInfo.request);
+  const { headers } = requestInfo;
+
+  const options = await generateRegistrationOptions({
+    rpName,
+    rpID,
+    userName: username,
+    authenticatorSelection: {
+      // Require the authenticator to store the credential, enabling a username-less login experience
+      residentKey: "required",
+      // Prefer user verification (biometric, PIN, etc.), but allow authentication even if it's not available
+      userVerification: "preferred",
+    },
+  });
+
+  await sessions.save(headers, { challenge: options.challenge });
+
+  return options;
+}
+
+export async function startPasskeyLogin() {
+  const { rpID } = getWebAuthnConfig(requestInfo.request);
+  const { headers } = requestInfo;
+
+  const options = await generateAuthenticationOptions({
+    rpID,
+    userVerification: "preferred",
+    allowCredentials: [],
+  });
+
+  await sessions.save(headers, { challenge: options.challenge });
+
+  return options;
+}
+
+export async function finishPasskeyRegistration(
+  username: string,
+  registration: RegistrationResponseJSON,
+) {
+  const { request, headers } = requestInfo;
+  const { origin } = new URL(request.url);
+
+  const session = await sessions.load(request);
+  const challenge = session?.challenge;
+
+  if (!challenge) {
+    return false;
+  }
+
+  const verification = await verifyRegistrationResponse({
+    response: registration,
+    expectedChallenge: challenge,
+    expectedOrigin: origin,
+    expectedRPID: env.WEBAUTHN_RP_ID || new URL(request.url).hostname,
+  });
+
+  if (!verification.verified || !verification.registrationInfo) {
+    return false;
+  }
+
+  await sessions.save(headers, { challenge: null });
+
+  const user = await db.user.create({
+    data: {
+      username,
+    },
+  });
+
+  await db.credential.create({
+    data: {
+      userId: user.id,
+      credentialId: verification.registrationInfo.credential.id,
+      publicKey: verification.registrationInfo.credential.publicKey,
+      counter: verification.registrationInfo.credential.counter,
+    },
+  });
+
+  return true;
+}
+
+export async function finishPasskeyLogin(login: AuthenticationResponseJSON) {
+  const { request, headers } = requestInfo;
+  const { origin } = new URL(request.url);
+
+  const session = await sessions.load(request);
+  const challenge = session?.challenge;
+
+  if (!challenge) {
+    return false;
+  }
+
+  const credential = await db.credential.findUnique({
+    where: {
+      credentialId: login.id,
+    },
+  });
+
+  if (!credential) {
+    return false;
+  }
+
+  const verification = await verifyAuthenticationResponse({
+    response: login,
+    expectedChallenge: challenge,
+    expectedOrigin: origin,
+    expectedRPID: env.WEBAUTHN_RP_ID || new URL(request.url).hostname,
+    requireUserVerification: false,
+    credential: {
+      id: credential.credentialId,
+      publicKey: credential.publicKey,
+      counter: credential.counter,
+    },
+  });
+
+  if (!verification.verified) {
+    return false;
+  }
+
+  await db.credential.update({
+    where: {
+      credentialId: login.id,
+    },
+    data: {
+      counter: verification.authenticationInfo.newCounter,
+    },
+  });
+
+  const user = await db.user.findUnique({
+    where: {
+      id: credential.userId,
+    },
+  });
+
+  if (!user) {
+    return false;
+  }
+
+  await sessions.save(headers, {
+    userId: user.id,
+    challenge: null,
+  });
+
+  return true;
+}

package/templates/rwsdk/src/app/pages/user/routes.ts

@@ -0,0 +1,17 @@
+import { route } from "rwsdk/router";
+import { Login } from "./Login";
+import { sessions } from "@/session/store";
+
+export const userRoutes = [
+  route("/login", [Login]),
+  route("/logout", async function ({ request }) {
+    const headers = new Headers();
+    await sessions.remove(request, headers);
+    headers.set("Location", "/");
+
+    return new Response(null, {
+      status: 302,
+      headers,
+    });
+  }),
+];

package/templates/rwsdk/src/app/shared/links.ts

@@ -0,0 +1,3 @@
+import { defineLinks } from "rwsdk/router";
+
+export const link = defineLinks(["/", "/user/login", "/user/logout"]);

package/templates/rwsdk/src/client.tsx

@@ -0,0 +1,3 @@
+import { initClient } from "rwsdk/client";
+
+initClient();

package/templates/rwsdk/src/db.ts

@@ -0,0 +1,26 @@
+import { PrismaClient } from "@generated/prisma";
+import { PrismaD1 } from "@prisma/adapter-d1";
+
+export type * from "@generated/prisma";
+
+export let db: PrismaClient;
+
+// context(justinvdm, 21-05-2025): We need to instantiate the client via a
+// function rather that at the module level for several reasons:
+// * For prisma-client-js generator or cases where there are dynamic import to
+//   the prisma wasm modules, we need to make sure we are instantiating the
+//   prisma client later in the flow when the wasm would have been initialized
+// * So that we can encapsulate workarounds, e.g. see `SELECT 1` workaround
+//   below
+export const setupDb = async (env: Env) => {
+  db = new PrismaClient({
+    // context(justinvdm, 21-05-2025): prisma-client generated type appears to
+    // consider D1 adapter incompatible, though in runtime (dev and production)
+    // it works
+    // @ts-ignore
+    adapter: new PrismaD1(env.DB),
+  });
+
+  // context(justinvdm, 21-05-2025): https://github.com/cloudflare/workers-sdk/pull/8283
+  await db.$queryRaw`SELECT 1`;
+};

package/templates/rwsdk/src/scripts/seed.ts

@@ -0,0 +1,21 @@
+import { defineScript } from "rwsdk/worker";
+import { db, setupDb } from "@/db";
+import { env } from "cloudflare:workers";
+
+export default defineScript(async () => {
+  await setupDb(env);
+
+  await db.$executeRawUnsafe(`\
+    DELETE FROM User;
+    DELETE FROM sqlite_sequence;
+  `);
+
+  await db.user.create({
+    data: {
+      id: "1",
+      username: "testuser",
+    },
+  });
+
+  console.log("🌱 Finished seeding");
+});