create-aphex 0.1.1 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-aphex",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Scaffold a new Aphex CMS project — invoked via `pnpm create aphex`",
   "publishConfig": {
     "provenance": true

package/templates/base/CHANGELOG.md

@@ -18,6 +18,11 @@ tag matching the version you started from to see the exact changes.
 
 ## Unreleased
 
+## 0.0.4
+- pass authorised origins from .env into better auth  to handle csrf
+- preload dayjs for better UX when going into a fresh studio
+- disallow admins from changing themselves to owners and kicking out original owners
+
 ## 0.0.3
 - **feat(api): move invitation email-wrap into `aphex.config.ts → api`**
   - Deleted: `src/routes/api/organizations/invitations/+server.ts` —

package/templates/base/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@aphexcms/base",
-	"version": "0.0.3",
+	"version": "0.0.4",
 	"private": true,
 	"type": "module",
 	"scripts": {
@@ -29,11 +29,11 @@
 		"test:date": "tsx scripts/test-date-localapi.ts"
 	},
 	"dependencies": {
-		"@aphexcms/cms-core": "^5.0.3",
-		"@aphexcms/nodemailer-adapter": "^7.0.3",
-		"@aphexcms/postgresql-adapter": "^6.0.3",
-		"@aphexcms/resend-adapter": "^6.0.3",
-		"@aphexcms/storage-s3": "^6.0.3",
+		"@aphexcms/cms-core": "^5.0.5",
+		"@aphexcms/nodemailer-adapter": "^7.0.5",
+		"@aphexcms/postgresql-adapter": "^6.0.5",
+		"@aphexcms/resend-adapter": "^6.0.5",
+		"@aphexcms/storage-s3": "^6.0.5",
 		"@aphexcms/ui": "^0.4.0",
 		"@better-auth/api-key": "^1.5.3",
 		"@better-auth/drizzle-adapter": "^1.5.3",

package/templates/base/src/lib/server/auth/better-auth/instance.ts

@@ -16,6 +16,14 @@ import { cacheAdapter } from '../../cache';
 const authSecret = env.AUTH_SECRET || env.BETTER_AUTH_SECRET;
 const authUrl = env.AUTH_URL || env.BETTER_AUTH_URL;
 
+// CSV of origins permitted for cross-origin auth requests. Better Auth uses
+// this for CSRF/origin checks; without it, cookie-auth API mutations are
+// reachable from any site a logged-in admin visits.
+const trustedOrigins = (env.AUTH_TRUSTED_ORIGINS || authUrl || '')
+	.split(',')
+	.map((o) => o.trim())
+	.filter(Boolean);
+
 // This function creates the Better Auth instance, injecting the necessary dependencies.
 export function createAuthInstance(
 	db: DatabaseAdapter,
@@ -51,6 +59,16 @@ export function createAuthInstance(
 	return betterAuth({
 		baseURL: authUrl,
 		secret: authSecret,
+		trustedOrigins,
+		session: {
+			// Validates the session cookie's signature without a DB hit. Short
+			// maxAge keeps revocation lag tight for role/membership changes,
+			// which the per-request RBAC chain re-reads on top of this.
+			cookieCache: {
+				enabled: true,
+				maxAge: 60
+			}
+		},
 		advanced: {
 			backgroundTasks: {
 				handler: (task) => {

package/templates/base/vite.config.ts

@@ -1,7 +1,12 @@
+import { createRequire } from 'node:module';
 import tailwindcss from '@tailwindcss/vite';
 import { sveltekit } from '@sveltejs/kit/vite';
 import { defineConfig } from 'vite';
 
+const require = createRequire(import.meta.url);
+const dayjsEsm = require.resolve('dayjs/esm/index.js');
+const dayjsEsmPluginDir = dayjsEsm.replace(/\/index\.js$/, '/plugin');
+
 export default defineConfig({
 	plugins: [
 		tailwindcss(),
@@ -70,8 +75,8 @@ export default defineConfig({
 		// to dayjs's proper ESM build so those imports work regardless of which
 		// package they come from.
 		alias: [
-			{ find: /^dayjs$/, replacement: 'dayjs/esm/index.js' },
-			{ find: /^dayjs\/plugin\/([^/]+?)(\.js)?$/, replacement: 'dayjs/esm/plugin/$1/index.js' }
+			{ find: /^dayjs$/, replacement: dayjsEsm },
+			{ find: /^dayjs\/plugin\/([^/]+?)(\.js)?$/, replacement: `${dayjsEsmPluginDir}/$1/index.js` }
 		]
 	},
 	server: {
@@ -102,6 +107,9 @@ export default defineConfig({
 			'tailwind-merge',
 			'@internationalized/date',
 			'bits-ui',
+			'dayjs',
+			'dayjs/plugin/customParseFormat',
+			'dayjs/plugin/utc',
 			'@lucide/svelte',
 			'@lucide/svelte/icons/panel-left',
 			'@lucide/svelte/icons/minus',