better-ts-stack 2.1.1 → 2.2.0

package/templates/backend/express/src/env.ts.hbs

@@ -22,8 +22,19 @@ const envSchema = z.object({
   MONGODB_URI: z.url(),
 {{/if}}
 {{#if useAuth}}
-  JWT_SECRET: z.string().min(32, "JWT_SECRET must be at least 32 characters"),
-  JWT_EXPIRES_IN: z.string().default("1h"),
+  BETTER_AUTH_SECRET: z
+    .string()
+    .min(32, "BETTER_AUTH_SECRET must be at least 32 characters"),
+  // The public URL of this server; links in emails point here
+  BETTER_AUTH_URL: z.url(),
+  // Optional: GitHub and Google sign-in are turned on when both are set
+  GITHUB_CLIENT_ID: z.string().optional(),
+  GITHUB_CLIENT_SECRET: z.string().optional(),
+  GOOGLE_CLIENT_ID: z.string().optional(),
+  GOOGLE_CLIENT_SECRET: z.string().optional(),
+  // Optional: without it, emails are printed to the log
+  RESEND_API_KEY: z.string().optional(),
+  EMAIL_FROM: z.string().default("onboarding@resend.dev"),
 {{/if}}
 });
 

package/templates/backend/express/src/index.ts.hbs

@@ -16,9 +16,17 @@ import { connectDB, disconnectDB } from "./lib/db";
 {{#if useRateLimit}}
 import { apiLimiter } from "./middleware/rateLimit";
 {{/if}}
+{{#if useAuth}}
+import { toNodeHandler } from "better-auth/node";
+{{#if (eq database 'mongoose')}}
+import { auth, mongoClient } from "./lib/auth";
+{{else}}
+import { auth } from "./lib/auth";
+{{/if}}
+{{/if}}
 import healthRouter from "./routes/health";
 {{#if useAuth}}
-import authRouter from "./routes/auth";
+import meRouter from "./routes/me";
 {{/if}}
 
 const app: Express = express();
@@ -26,18 +34,35 @@ const port = env.PORT;
 
 // Middleware
 app.use(helmet());
+{{#if useAuth}}
+// Browser clients read the bearer token from the set-auth-token header
+app.use(cors({ origin: env.CORS_ORIGIN, exposedHeaders: ["set-auth-token"] }));
+{{else}}
 app.use(cors({ origin: env.CORS_ORIGIN }));
+{{/if}}
 {{#if useRateLimit}}
 app.use(apiLimiter);
 {{/if}}
 app.use(morgan("dev"));
+{{#if useAuth}}
+// Better Auth reads the client IP for its rate limits from this header. It is
+// set from req.ip on every request, so a client cannot pick its own value.
+// Behind a reverse proxy, set app.set("trust proxy", 1) for the real client IP
+app.use("/api/auth", (req: Request, _res: Response, next: NextFunction) => {
+  req.headers["x-client-ip"] = req.ip;
+  next();
+});
+// Sign-up, sign-in, sessions, email verification, and password reset. Better
+// Auth reads the request body itself, so it is mounted before express.json()
+app.all("/api/auth/*splat", toNodeHandler(auth));
+{{/if}}
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 
 // Routes
 app.use("/health", healthRouter);
 {{#if useAuth}}
-app.use("/auth", authRouter);
+app.use("/api/me", meRouter);
 {{/if}}
 
 // 404 handler
@@ -73,7 +98,11 @@ function closeDatabase(): Promise<void> {
 {{else if (eq database 'drizzle')}}
   return db.$client.end();
 {{else if (eq database 'mongoose')}}
+{{#if useAuth}}
+  return Promise.all([disconnectDB(), mongoClient.close()]).then(() => undefined);
+{{else}}
   return disconnectDB();
+{{/if}}
 {{else}}
   return Promise.resolve();
 {{/if}}

package/templates/backend/express/tsconfig.eslint.json

@@ -1,9 +1,9 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "noEmit": true,
-    "allowJs": true,
-    "rootDir": "."
-  },
-  "include": ["src/**/*", "eslint.config.mjs", "prisma.config.ts"]
-}
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "allowJs": true,
+    "rootDir": "."
+  },
+  "include": ["src/**/*", "eslint.config.mjs", "prisma.config.ts"]
+}

package/templates/backend/nestjs/.prettierignore

@@ -1,52 +1,52 @@
-# Dependencies
-node_modules
-**/node_modules
-
-# Build outputs
-.next
-out
-dist
-build
-**/dist
-**/.next
-**/out
-**/build
-
-# Generated files
-*.min.js
-*.min.css
-coverage
-.nyc_output
-
-# Lock files
-package-lock.json
-yarn.lock
-pnpm-lock.yaml
-bun.lock
-
-# Logs
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# Environment files
-.env
-.env.local
-.env.*.local
-
-# IDE
-.vscode
-.idea
-*.swp
-*.swo
-*~
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Templates (do not format generated/scaffold content)
-templates
-**/templates/**
-*.hbs
+# Dependencies
+node_modules
+**/node_modules
+
+# Build outputs
+.next
+out
+dist
+build
+**/dist
+**/.next
+**/out
+**/build
+
+# Generated files
+*.min.js
+*.min.css
+coverage
+.nyc_output
+
+# Lock files
+package-lock.json
+yarn.lock
+pnpm-lock.yaml
+bun.lock
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Environment files
+.env
+.env.local
+.env.*.local
+
+# IDE
+.vscode
+.idea
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Templates (do not format generated/scaffold content)
+templates
+**/templates/**
+*.hbs

package/templates/backend/nestjs/gitignore

@@ -18,7 +18,9 @@ yarn-debug.log*
 yarn-error.log*
 
 # IDE
-.vscode/
+.vscode/*
+!.vscode/settings.json
+!.vscode/extensions.json
 .idea/
 *.swp
 *.swo

package/templates/backend/nestjs/src/app.module.ts.hbs

@@ -16,6 +16,9 @@ import { AuthModule } from "./auth/auth.module.js";
 import { DatabaseModule } from "./database/database.module.js";
 {{/if}}
 import { HealthController } from "./health/health.controller.js";
+{{#if useAuth}}
+import { MeController } from "./me/me.controller.js";
+{{/if}}
 {{#if (eq database 'prisma')}}
 import { PrismaModule } from "./prisma/prisma.module.js";
 {{/if}}
@@ -39,7 +42,7 @@ import { PrismaModule } from "./prisma/prisma.module.js";
     ThrottlerModule.forRoot([{ ttl: 15 * 60 * 1000, limit: 100 }]),
     {{/if}}
   ],
-  controllers: [HealthController],
+  controllers: [HealthController{{#if useAuth}}, MeController{{/if}}],
   {{#if useRateLimit}}
   providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
   {{/if}}

package/templates/backend/nestjs/src/env.ts.hbs

@@ -22,8 +22,19 @@ const envSchema = z.object({
   MONGODB_URI: z.url(),
 {{/if}}
 {{#if useAuth}}
-  JWT_SECRET: z.string().min(32, "JWT_SECRET must be at least 32 characters"),
-  JWT_EXPIRES_IN: z.string().default("1h"),
+  BETTER_AUTH_SECRET: z
+    .string()
+    .min(32, "BETTER_AUTH_SECRET must be at least 32 characters"),
+  // The public URL of this server; links in emails point here
+  BETTER_AUTH_URL: z.url(),
+  // Optional: GitHub and Google sign-in are turned on when both are set
+  GITHUB_CLIENT_ID: z.string().optional(),
+  GITHUB_CLIENT_SECRET: z.string().optional(),
+  GOOGLE_CLIENT_ID: z.string().optional(),
+  GOOGLE_CLIENT_SECRET: z.string().optional(),
+  // Optional: without it, emails are printed to the log
+  RESEND_API_KEY: z.string().optional(),
+  EMAIL_FROM: z.string().default("onboarding@resend.dev"),
 {{/if}}
 });
 

package/templates/backend/nestjs/src/health/health.controller.ts.hbs

@@ -2,12 +2,19 @@ import { Controller, Get } from "@nestjs/common";
 {{#if useRateLimit}}
 import { SkipThrottle } from "@nestjs/throttler";
 {{/if}}
+{{#if useAuth}}
+import { AllowAnonymous } from "@thallesp/nestjs-better-auth";
+{{/if}}
 
 {{#if useRateLimit}}
 // Docker and load balancers call the health check on a schedule, so it is not
 // counted
 @SkipThrottle()
 {{/if}}
+{{#if useAuth}}
+// Every route needs a session unless it is marked public
+@AllowAnonymous()
+{{/if}}
 @Controller("health")
 export class HealthController {
   @Get()

package/templates/backend/nestjs/src/{main.ts → main.ts.hbs}

@@ -7,11 +7,22 @@ import { AppModule } from "./app.module.js";
 import { env } from "./env.js";
 
 async function bootstrap(): Promise<void> {
+{{#if useAuth}}
+  // Better Auth reads the body of its own routes; the auth module adds the
+  // JSON and form parsers back for every other route
+  const app = await NestFactory.create(AppModule, { bodyParser: false });
+{{else}}
   const app = await NestFactory.create(AppModule);
+{{/if}}
   const port = env.PORT;
 
   app.use(helmet());
+{{#if useAuth}}
+  // Browser clients read the bearer token from the set-auth-token header
+  app.enableCors({ origin: env.CORS_ORIGIN, exposedHeaders: ["set-auth-token"] });
+{{else}}
   app.enableCors({ origin: env.CORS_ORIGIN });
+{{/if}}
   // Lets modules close database connections when the process is stopped
   app.enableShutdownHooks();
 

package/templates/backend/nestjs/tsconfig.eslint.json

@@ -1,9 +1,9 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "noEmit": true,
-    "allowJs": true,
-    "rootDir": "."
-  },
-  "include": ["src/**/*", "eslint.config.mjs", "prisma.config.ts"]
-}
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "allowJs": true,
+    "rootDir": "."
+  },
+  "include": ["src/**/*", "eslint.config.mjs", "prisma.config.ts"]
+}

package/templates/frontend/nextjs/app/globals.css

@@ -1,89 +1,129 @@
-@import "tailwindcss";
-
-:root {
-  --radius: 0.65rem;
-  --background: oklch(1 0 0);
-  --foreground: oklch(0.145 0 0);
-  --card: oklch(1 0 0);
-  --card-foreground: oklch(0.145 0 0);
-  --popover: oklch(1 0 0);
-  --popover-foreground: oklch(0.145 0 0);
-  --primary: oklch(0.205 0 0);
-  --primary-foreground: oklch(0.985 0 0);
-  --secondary: oklch(0.97 0 0);
-  --secondary-foreground: oklch(0.205 0 0);
-  --muted: oklch(0.97 0 0);
-  --muted-foreground: oklch(0.556 0 0);
-  --accent: oklch(0.97 0 0);
-  --accent-foreground: oklch(0.205 0 0);
-  --destructive: oklch(0.577 0.245 27.325);
-  --border: oklch(0.922 0 0);
-  --input: oklch(0.922 0 0);
-  --ring: oklch(0.708 0 0);
-  --chart-1: oklch(0.646 0.222 41.116);
-  --chart-2: oklch(0.6 0.118 184.704);
-  --chart-3: oklch(0.398 0.07 227.392);
-  --chart-4: oklch(0.828 0.189 84.429);
-  --chart-5: oklch(0.769 0.188 70.08);
-  --radius: 0.625rem;
-  --sidebar: oklch(0.985 0 0);
-  --sidebar-foreground: oklch(0.145 0 0);
-  --sidebar-primary: oklch(0.205 0 0);
-  --sidebar-primary-foreground: oklch(0.985 0 0);
-  --sidebar-accent: oklch(0.97 0 0);
-  --sidebar-accent-foreground: oklch(0.205 0 0);
-  --sidebar-border: oklch(0.922 0 0);
-  --sidebar-ring: oklch(0.708 0 0);
-}
-
-.dark {
-  --background: oklch(0.145 0 0);
-  --foreground: oklch(0.985 0 0);
-  --card: oklch(0.205 0 0);
-  --card-foreground: oklch(0.985 0 0);
-  --popover: oklch(0.205 0 0);
-  --popover-foreground: oklch(0.985 0 0);
-  --primary: oklch(0.922 0 0);
-  --primary-foreground: oklch(0.205 0 0);
-  --secondary: oklch(0.269 0 0);
-  --secondary-foreground: oklch(0.985 0 0);
-  --muted: oklch(0.269 0 0);
-  --muted-foreground: oklch(0.708 0 0);
-  --accent: oklch(0.269 0 0);
-  --accent-foreground: oklch(0.985 0 0);
-  --destructive: oklch(0.704 0.191 22.216);
-  --border: oklch(1 0 0 / 10%);
-  --input: oklch(1 0 0 / 15%);
-  --ring: oklch(0.556 0 0);
-  --chart-1: oklch(0.488 0.243 264.376);
-  --chart-2: oklch(0.696 0.17 162.48);
-  --chart-3: oklch(0.769 0.188 70.08);
-  --chart-4: oklch(0.627 0.265 303.9);
-  --chart-5: oklch(0.645 0.246 16.439);
-  --sidebar: oklch(0.205 0 0);
-  --sidebar-foreground: oklch(0.985 0 0);
-  --sidebar-primary: oklch(0.488 0.243 264.376);
-  --sidebar-primary-foreground: oklch(0.985 0 0);
-  --sidebar-accent: oklch(0.269 0 0);
-  --sidebar-accent-foreground: oklch(0.985 0 0);
-  --sidebar-border: oklch(1 0 0 / 10%);
-  --sidebar-ring: oklch(0.556 0 0);
-}
-* {
-  border-color: var(--border);
-}
-
-body {
-  background: var(--background);
-  color: var(--foreground);
-  font-family: var(--font-geist-sans), sans-serif;
-}
-
-a {
-  text-underline-offset: 0.2rem;
-}
-
-::selection {
-  background: color-mix(in oklab, var(--accent) 65%, white);
-  color: var(--foreground);
-}
+@import "tailwindcss";
+@import "tw-animate-css";
+@import "shadcn/tailwind.css";
+
+@custom-variant dark (&:is(.dark *));
+
+@theme inline {
+    --font-heading: var(--font-sans);
+    --font-sans: var(--font-sans);
+    --color-sidebar-ring: var(--sidebar-ring);
+    --color-sidebar-border: var(--sidebar-border);
+    --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
+    --color-sidebar-accent: var(--sidebar-accent);
+    --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
+    --color-sidebar-primary: var(--sidebar-primary);
+    --color-sidebar-foreground: var(--sidebar-foreground);
+    --color-sidebar: var(--sidebar);
+    --color-chart-5: var(--chart-5);
+    --color-chart-4: var(--chart-4);
+    --color-chart-3: var(--chart-3);
+    --color-chart-2: var(--chart-2);
+    --color-chart-1: var(--chart-1);
+    --color-ring: var(--ring);
+    --color-input: var(--input);
+    --color-border: var(--border);
+    --color-destructive: var(--destructive);
+    --color-accent-foreground: var(--accent-foreground);
+    --color-accent: var(--accent);
+    --color-muted-foreground: var(--muted-foreground);
+    --color-muted: var(--muted);
+    --color-secondary-foreground: var(--secondary-foreground);
+    --color-secondary: var(--secondary);
+    --color-primary-foreground: var(--primary-foreground);
+    --color-primary: var(--primary);
+    --color-popover-foreground: var(--popover-foreground);
+    --color-popover: var(--popover);
+    --color-card-foreground: var(--card-foreground);
+    --color-card: var(--card);
+    --color-foreground: var(--foreground);
+    --color-background: var(--background);
+    --radius-sm: calc(var(--radius) * 0.6);
+    --radius-md: calc(var(--radius) * 0.8);
+    --radius-lg: var(--radius);
+    --radius-xl: calc(var(--radius) * 1.4);
+    --radius-2xl: calc(var(--radius) * 1.8);
+    --radius-3xl: calc(var(--radius) * 2.2);
+    --radius-4xl: calc(var(--radius) * 2.6);
+}
+
+:root {
+    --background: oklch(1 0 0);
+    --foreground: oklch(0.145 0 0);
+    --card: oklch(1 0 0);
+    --card-foreground: oklch(0.145 0 0);
+    --popover: oklch(1 0 0);
+    --popover-foreground: oklch(0.145 0 0);
+    --primary: oklch(0.205 0 0);
+    --primary-foreground: oklch(0.985 0 0);
+    --secondary: oklch(0.97 0 0);
+    --secondary-foreground: oklch(0.205 0 0);
+    --muted: oklch(0.97 0 0);
+    --muted-foreground: oklch(0.556 0 0);
+    --accent: oklch(0.97 0 0);
+    --accent-foreground: oklch(0.205 0 0);
+    --destructive: oklch(0.577 0.245 27.325);
+    --border: oklch(0.922 0 0);
+    --input: oklch(0.922 0 0);
+    --ring: oklch(0.708 0 0);
+    --chart-1: oklch(0.87 0 0);
+    --chart-2: oklch(0.556 0 0);
+    --chart-3: oklch(0.439 0 0);
+    --chart-4: oklch(0.371 0 0);
+    --chart-5: oklch(0.269 0 0);
+    --radius: 0.625rem;
+    --sidebar: oklch(0.985 0 0);
+    --sidebar-foreground: oklch(0.145 0 0);
+    --sidebar-primary: oklch(0.205 0 0);
+    --sidebar-primary-foreground: oklch(0.985 0 0);
+    --sidebar-accent: oklch(0.97 0 0);
+    --sidebar-accent-foreground: oklch(0.205 0 0);
+    --sidebar-border: oklch(0.922 0 0);
+    --sidebar-ring: oklch(0.708 0 0);
+}
+
+.dark {
+    --background: oklch(0.145 0 0);
+    --foreground: oklch(0.985 0 0);
+    --card: oklch(0.205 0 0);
+    --card-foreground: oklch(0.985 0 0);
+    --popover: oklch(0.205 0 0);
+    --popover-foreground: oklch(0.985 0 0);
+    --primary: oklch(0.922 0 0);
+    --primary-foreground: oklch(0.205 0 0);
+    --secondary: oklch(0.269 0 0);
+    --secondary-foreground: oklch(0.985 0 0);
+    --muted: oklch(0.269 0 0);
+    --muted-foreground: oklch(0.708 0 0);
+    --accent: oklch(0.269 0 0);
+    --accent-foreground: oklch(0.985 0 0);
+    --destructive: oklch(0.704 0.191 22.216);
+    --border: oklch(1 0 0 / 10%);
+    --input: oklch(1 0 0 / 15%);
+    --ring: oklch(0.556 0 0);
+    --chart-1: oklch(0.87 0 0);
+    --chart-2: oklch(0.556 0 0);
+    --chart-3: oklch(0.439 0 0);
+    --chart-4: oklch(0.371 0 0);
+    --chart-5: oklch(0.269 0 0);
+    --sidebar: oklch(0.205 0 0);
+    --sidebar-foreground: oklch(0.985 0 0);
+    --sidebar-primary: oklch(0.488 0.243 264.376);
+    --sidebar-primary-foreground: oklch(0.985 0 0);
+    --sidebar-accent: oklch(0.269 0 0);
+    --sidebar-accent-foreground: oklch(0.985 0 0);
+    --sidebar-border: oklch(1 0 0 / 10%);
+    --sidebar-ring: oklch(0.556 0 0);
+}
+
+@layer base {
+  * {
+    @apply border-border outline-ring/50;
+    }
+  body {
+    @apply bg-background text-foreground;
+    }
+  html {
+    @apply font-sans;
+    }
+}

package/templates/frontend/nextjs/app/layout.tsx

@@ -1,34 +1,36 @@
-import type { Metadata } from "next";
-import { Geist, Geist_Mono } from "next/font/google";
-import "./globals.css";
-
-const geistSans = Geist({
-  variable: "--font-geist-sans",
-  subsets: ["latin"],
-});
-
-const geistMono = Geist_Mono({
-  variable: "--font-geist-mono",
-  subsets: ["latin"],
-});
-
-export const metadata: Metadata = {
-  title: "better-ts-stack starter",
-  description: "Generated with better-ts-stack",
-};
-
-export default function RootLayout({
-  children,
-}: Readonly<{
-  children: React.ReactNode;
-}>) {
-  return (
-    <html lang="en">
-      <body
-        className={`${geistSans.variable} ${geistMono.variable} bg-background text-foreground antialiased`}
-      >
-        {children}
-      </body>
-    </html>
-  );
-}
+import type { Metadata } from "next";
+import { Geist_Mono, Inter } from "next/font/google";
+
+import { cn } from "@/lib/utils";
+
+import "./globals.css";
+
+const fontSans = Inter({
+  variable: "--font-sans",
+  subsets: ["latin"],
+});
+
+const fontMono = Geist_Mono({
+  variable: "--font-mono",
+  subsets: ["latin"],
+});
+
+export const metadata: Metadata = {
+  title: "better-ts-stack starter",
+  description: "Generated with better-ts-stack",
+};
+
+export default function RootLayout({
+  children,
+}: Readonly<{
+  children: React.ReactNode;
+}>) {
+  return (
+    <html
+      lang="en"
+      className={cn("font-sans antialiased", fontSans.variable, fontMono.variable)}
+    >
+      <body>{children}</body>
+    </html>
+  );
+}