create-aphex 0.1.0 → 0.1.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Benjamin Sinidol
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -17,7 +17,7 @@ You can also invoke it through the [`aphx`](https://www.npmjs.com/package/aphx)
 CLI, which shells out to this package:
 
 ```bash
-npx aphx create
+pnpm aphex create
 ```
 
 ## What it does

package/package.json

@@ -1,40 +1,41 @@
 {
-	"name": "create-aphex",
-	"version": "0.1.0",
-	"description": "Scaffold a new Aphex CMS project — invoked via `pnpm create aphex`",
-	"publishConfig": {},
-	"repository": {
-		"type": "git",
-		"url": "https://github.com/IcelandicIcecream/aphex.git",
-		"directory": "packages/create-aphex"
-	},
-	"type": "module",
-	"bin": {
-		"create-aphex": "./dist/index.js"
-	},
-	"files": [
-		"dist",
-		"templates"
-	],
-	"scripts": {
-		"build": "node scripts/copy-templates.js && tsc",
-		"prepublishOnly": "pnpm build"
-	},
-	"keywords": [
-		"aphex",
-		"cms",
-		"cli",
-		"scaffolding",
-		"template"
-	],
-	"author": "",
-	"license": "MIT",
-	"dependencies": {
-		"@clack/prompts": "^0.11.0",
-		"picocolors": "^1.1.1"
-	},
-	"devDependencies": {
-		"@types/node": "^22.0.0",
-		"typescript": "^5.9.3"
-	}
-}
+  "name": "create-aphex",
+  "version": "0.1.3",
+  "description": "Scaffold a new Aphex CMS project — invoked via `pnpm create aphex`",
+  "publishConfig": {
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/IcelandicIcecream/aphex.git",
+    "directory": "packages/create-aphex"
+  },
+  "type": "module",
+  "bin": {
+    "create-aphex": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "keywords": [
+    "aphex",
+    "cms",
+    "cli",
+    "scaffolding",
+    "template"
+  ],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "@clack/prompts": "^0.11.0",
+    "picocolors": "^1.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.3"
+  },
+  "scripts": {
+    "build": "node scripts/copy-templates.js && tsc"
+  }
+}

package/templates/base/CHANGELOG.md

@@ -1,5 +1,5 @@
 ---
-**Heads up:** This project was scaffolded from `@aphexcms/base` `v0.0.2`.
+**Heads up:** This project was scaffolded from `@aphexcms/base` `v0.0.3`.
 When upgrading, read `CHANGELOG.md` in the template repo for notes on
 what changed upstream and which files you may want to port into your
 customized project.
@@ -18,6 +18,12 @@ tag matching the version you started from to see the exact changes.
 
 ## Unreleased
 
+## 0.0.4
+- pass authorised origins from .env into better auth  to handle csrf
+- preload dayjs for better UX when going into a fresh studio
+- disallow admins from changing themselves to owners and kicking out original owners
+
+## 0.0.3
 - **feat(api): move invitation email-wrap into `aphex.config.ts → api`**
   - Deleted: `src/routes/api/organizations/invitations/+server.ts` —
     the SK shim that wrapped the built-in invite handler to send email.

package/templates/base/README.md

@@ -9,7 +9,7 @@ A clean starting point for building with Aphex CMS. No example schemas — just
 > cd my-app && pnpm install
 > ```
 >
-> Or scaffold via the CLI: `npx aphx create`.
+> Or scaffold via the CLI: `pnpm aphex create`.
 
 ## Getting Started
 

package/templates/base/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@aphexcms/base",
-	"version": "0.0.2",
+	"version": "0.0.4",
 	"private": true,
 	"type": "module",
 	"scripts": {
@@ -29,11 +29,11 @@
 		"test:date": "tsx scripts/test-date-localapi.ts"
 	},
 	"dependencies": {
-		"@aphexcms/cms-core": "^5.0.0",
-		"@aphexcms/nodemailer-adapter": "^7.0.0",
-		"@aphexcms/postgresql-adapter": "^6.0.0",
-		"@aphexcms/resend-adapter": "^6.0.0",
-		"@aphexcms/storage-s3": "^6.0.0",
+		"@aphexcms/cms-core": "^5.0.5",
+		"@aphexcms/nodemailer-adapter": "^7.0.5",
+		"@aphexcms/postgresql-adapter": "^6.0.5",
+		"@aphexcms/resend-adapter": "^6.0.5",
+		"@aphexcms/storage-s3": "^6.0.5",
 		"@aphexcms/ui": "^0.4.0",
 		"@better-auth/api-key": "^1.5.3",
 		"@better-auth/drizzle-adapter": "^1.5.3",

package/templates/base/src/lib/server/auth/better-auth/instance.ts

@@ -16,6 +16,14 @@ import { cacheAdapter } from '../../cache';
 const authSecret = env.AUTH_SECRET || env.BETTER_AUTH_SECRET;
 const authUrl = env.AUTH_URL || env.BETTER_AUTH_URL;
 
+// CSV of origins permitted for cross-origin auth requests. Better Auth uses
+// this for CSRF/origin checks; without it, cookie-auth API mutations are
+// reachable from any site a logged-in admin visits.
+const trustedOrigins = (env.AUTH_TRUSTED_ORIGINS || authUrl || '')
+	.split(',')
+	.map((o) => o.trim())
+	.filter(Boolean);
+
 // This function creates the Better Auth instance, injecting the necessary dependencies.
 export function createAuthInstance(
 	db: DatabaseAdapter,
@@ -51,6 +59,16 @@ export function createAuthInstance(
 	return betterAuth({
 		baseURL: authUrl,
 		secret: authSecret,
+		trustedOrigins,
+		session: {
+			// Validates the session cookie's signature without a DB hit. Short
+			// maxAge keeps revocation lag tight for role/membership changes,
+			// which the per-request RBAC chain re-reads on top of this.
+			cookieCache: {
+				enabled: true,
+				maxAge: 60
+			}
+		},
 		advanced: {
 			backgroundTasks: {
 				handler: (task) => {

package/templates/base/vite.config.ts

@@ -1,7 +1,12 @@
+import { createRequire } from 'node:module';
 import tailwindcss from '@tailwindcss/vite';
 import { sveltekit } from '@sveltejs/kit/vite';
 import { defineConfig } from 'vite';
 
+const require = createRequire(import.meta.url);
+const dayjsEsm = require.resolve('dayjs/esm/index.js');
+const dayjsEsmPluginDir = dayjsEsm.replace(/\/index\.js$/, '/plugin');
+
 export default defineConfig({
 	plugins: [
 		tailwindcss(),
@@ -70,8 +75,8 @@ export default defineConfig({
 		// to dayjs's proper ESM build so those imports work regardless of which
 		// package they come from.
 		alias: [
-			{ find: /^dayjs$/, replacement: 'dayjs/esm/index.js' },
-			{ find: /^dayjs\/plugin\/([^/]+?)(\.js)?$/, replacement: 'dayjs/esm/plugin/$1/index.js' }
+			{ find: /^dayjs$/, replacement: dayjsEsm },
+			{ find: /^dayjs\/plugin\/([^/]+?)(\.js)?$/, replacement: `${dayjsEsmPluginDir}/$1/index.js` }
 		]
 	},
 	server: {
@@ -102,6 +107,9 @@ export default defineConfig({
 			'tailwind-merge',
 			'@internationalized/date',
 			'bits-ui',
+			'dayjs',
+			'dayjs/plugin/customParseFormat',
+			'dayjs/plugin/utc',
 			'@lucide/svelte',
 			'@lucide/svelte/icons/panel-left',
 			'@lucide/svelte/icons/minus',