create-aphex 0.1.1 → 0.2.0

package/templates/base/src/lib/server/auth/service.ts

@@ -1,486 +0,0 @@
-import { auth } from './instance.js';
-import { apikey, user } from '../db/auth-schema';
-import { drizzleDb } from '../db';
-import { eq } from 'drizzle-orm';
-import type {
-	SessionAuth,
-	PartialSessionAuth,
-	ApiKeyAuth,
-	CMSUser,
-	NewUserProfileData,
-	DatabaseAdapter
-} from '@aphexcms/cms-core/server';
-import { AuthError } from '@aphexcms/cms-core/server';
-import { cmsLogger } from '@aphexcms/cms-core';
-
-// This is the new AuthService that centralizes all auth-related server operations.
-// It uses dependency injection for the DatabaseAdapter, making it more testable and decoupled.
-
-export interface ApiKey {
-	id: string;
-	name: string | null;
-	organizationId?: string;
-	[key: string]: any;
-}
-
-export interface ApiKeyWithSecret extends ApiKey {
-	key: string;
-	organizationId: string; // Make required (override optional from ApiKey)
-}
-
-export interface CreateApiKeyData {
-	name: string;
-	/**
-	 * Legacy coarse-grained scopes. Optional when `capabilities` is supplied —
-	 * at least one of the two must be present (validator enforces this).
-	 */
-	permissions?: string[];
-	/** Fine-grained capability allowlist for this key. */
-	capabilities?: string[];
-	expiresInDays?: number;
-}
-
-export interface AuthService {
-	getSession(
-		request: Request,
-		db: DatabaseAdapter
-	): Promise<SessionAuth | PartialSessionAuth | null>;
-	requireSession(request: Request, db: DatabaseAdapter): Promise<SessionAuth>;
-	validateApiKey(request: Request): Promise<ApiKeyAuth | null>;
-	requireApiKey(
-		request: Request,
-		db: DatabaseAdapter,
-		permission?: 'read' | 'write'
-	): Promise<ApiKeyAuth>;
-	listApiKeys(db: DatabaseAdapter, userId: string): Promise<ApiKey[]>;
-	createApiKey(
-		userId: string,
-		organizationId: string,
-		data: CreateApiKeyData
-	): Promise<ApiKeyWithSecret>;
-	deleteApiKey(userId: string, keyId: string): Promise<boolean>;
-	getUserById(userId: string): Promise<{ id: string; name?: string; email: string } | null>;
-	getUserByEmail(email: string): Promise<{ id: string; name?: string; email: string } | null>;
-	changeUserName(userId: string, name: string): Promise<void>;
-	requestPasswordReset(email: string, redirectTo?: string): Promise<void>;
-	resetPassword(token: string, newPassword: string): Promise<void>;
-}
-
-export const authService: AuthService = {
-	async getSession(
-		request: Request,
-		db: DatabaseAdapter
-	): Promise<SessionAuth | PartialSessionAuth | null> {
-		try {
-			cmsLogger.debug('[AuthService]', 'getSession called');
-			// 1. Get the base user session from the auth provider
-			const session = await auth.api.getSession({ headers: request.headers });
-			if (!session) {
-				cmsLogger.debug('[AuthService]', 'No active session found from auth provider');
-				return null;
-			}
-			cmsLogger.debug('[AuthService]', `Found session for user ${session.user.id}`);
-
-			// 2. Get the corresponding CMS user profile from our database
-			cmsLogger.debug('[AuthService]', `Checking for user profile for ${session.user.id}`);
-			let userProfile = await db.findUserProfileById(session.user.id);
-
-			// 3. If no profile exists, create one (lazy sync)
-			if (!userProfile) {
-				cmsLogger.info(
-					'[AuthService]',
-					`User profile not found for ${session.user.id}. Creating one now (lazy sync).`
-				);
-
-				// Check if this is the first user in the system
-				const hasExistingUsers =
-					typeof db.hasAnyUserProfiles === 'function' ? await db.hasAnyUserProfiles() : false;
-				const isFirstUser = !hasExistingUsers;
-
-				const newUserProfile: NewUserProfileData = {
-					userId: session.user.id,
-					role: isFirstUser ? 'super_admin' : 'editor' // First user gets super_admin, others get editor
-				};
-				userProfile = await db.createUserProfile(newUserProfile);
-				cmsLogger.info(
-					'[AuthService]',
-					`Successfully created user profile for ${session.user.id}${isFirstUser ? ' with SUPER_ADMIN role' : ''}`
-				);
-			}
-
-			// 4. Combine the two into the final CMSUser object
-			const cmsUser: CMSUser = {
-				id: session.user.id,
-				email: session.user.email,
-				name: session.user.name ?? undefined,
-				image: session.user.image ?? undefined,
-				role: userProfile.role,
-				preferences: userProfile.preferences
-			};
-			cmsLogger.debug('[AuthService]', `Successfully assembled CMSUser for ${session.user.id}`);
-
-			// 5. Get the user's active organization from their session
-			cmsLogger.debug('[AuthService]', `Fetching active organization for ${session.user.id}`);
-			const userSession = await db.findUserSession(session.user.id);
-
-			// If no session exists, get the user's first organization as the default
-			if (!userSession) {
-				cmsLogger.debug('[AuthService]', `No user session found. Fetching user's organizations.`);
-				const userOrgs = await db.findUserOrganizations(session.user.id);
-
-				if (userOrgs.length === 0) {
-					// If this is a super_admin with no orgs, create a default organization
-					if (cmsUser.role === 'super_admin') {
-						cmsLogger.info(
-							'[AuthService]',
-							`Super admin ${session.user.id} has no organizations. Creating default organization.`
-						);
-
-						const defaultOrg = await db.createOrganization({
-							name: 'Default Organization',
-							slug: 'default',
-							createdBy: session.user.id
-						});
-
-						// Seed built-in roles before assigning membership — member
-						// rows reference roles by name, so they must exist first.
-						await db.seedBuiltinRoles(defaultOrg.id);
-
-						// Add super admin as owner
-						await db.addMember({
-							organizationId: defaultOrg.id,
-							userId: session.user.id,
-							role: 'owner'
-						});
-
-						// Set as active organization
-						await db.updateUserSession(session.user.id, defaultOrg.id);
-
-						cmsLogger.info(
-							'[AuthService]',
-							`Created default organization ${defaultOrg.id} for super admin.`
-						);
-						return {
-							type: 'session',
-							user: cmsUser,
-							session: {
-								id: session.session.id,
-								expiresAt: session.session.expiresAt
-							},
-							organizationId: defaultOrg.id,
-							organizationRole: 'owner'
-						};
-					}
-
-					// User has no organizations — return partial session without org context
-					// Routes like /invitations can use this to identify the user
-					cmsLogger.debug(
-						'[AuthService]',
-						`User ${session.user.id} has no organizations. Returning partial session.`
-					);
-					return {
-						type: 'partial_session',
-						user: cmsUser,
-						session: {
-							id: session.session.id,
-							expiresAt: session.session.expiresAt
-						}
-					};
-				}
-
-				// Set the first organization as active
-				const firstOrg = userOrgs[0]!;
-				await db.updateUserSession(session.user.id, firstOrg.organization.id);
-
-				cmsLogger.debug(
-					'[AuthService]',
-					`Set first organization ${firstOrg.organization.id} as active.`
-				);
-				return {
-					type: 'session',
-					user: cmsUser,
-					session: {
-						id: session.session.id,
-						expiresAt: session.session.expiresAt
-					},
-					organizationId: firstOrg.organization.id,
-					organizationRole: firstOrg.member.role
-				};
-			}
-
-			// 6. Get the user's membership in the active organization
-			cmsLogger.debug(
-				'[AuthService]',
-				`Getting membership for org ${userSession.activeOrganizationId}`
-			);
-			const membership = await db.findUserMembership(
-				session.user.id,
-				userSession.activeOrganizationId!
-			);
-
-			if (!membership) {
-				cmsLogger.error(
-					'[AuthService]',
-					`User ${session.user.id} is not a member of org ${userSession.activeOrganizationId}`
-				);
-				throw new AuthError('kicked_from_org', 'User is not a member of the active organization');
-			}
-
-			// 7. Return the complete SessionAuth object with organization context
-			return {
-				type: 'session',
-				user: cmsUser,
-				session: {
-					id: session.session.id,
-					expiresAt: session.session.expiresAt
-				},
-				organizationId: userSession.activeOrganizationId!,
-				organizationRole: membership.role
-			};
-		} catch (error) {
-			// Re-throw AuthError to preserve error codes
-			if (error instanceof AuthError) {
-				throw error;
-			}
-			cmsLogger.error('[AuthService]', 'Error in getSession:', error);
-			return null;
-		}
-	},
-
-	async requireSession(request: Request, db: DatabaseAdapter): Promise<SessionAuth> {
-		const session = await this.getSession(request, db);
-		if (!session) {
-			throw new AuthError('no_session', 'Unauthorized: Session required');
-		}
-		// User is authenticated but has no organization — redirect to invitations
-		if (session.type === 'partial_session') {
-			throw new AuthError('pending_invitations', 'User has pending invitations to review');
-		}
-		return session;
-	},
-
-	async validateApiKey(request: Request): Promise<ApiKeyAuth | null> {
-		try {
-			const apiKeyHeader = request.headers.get('x-api-key');
-			if (!apiKeyHeader) return null;
-
-			const result = await auth.api.verifyApiKey({ body: { key: apiKeyHeader } });
-			if (!result.valid || !result.key) return null;
-
-			// Better Auth stores metadata in the key object
-			const metadata = result.key.metadata || {};
-			const permissions = metadata.permissions || ['read', 'write'];
-			// Fine-grained capability allowlist — optional. When present, takes
-			// precedence over `permissions` at the capability-resolution layer
-			// (see resolveCapabilities in cms-core).
-			const capabilities = Array.isArray(metadata.capabilities) ? metadata.capabilities : undefined;
-			const organizationId = metadata.organizationId;
-
-			if (!organizationId) {
-				cmsLogger.error(
-					'[AuthService]',
-					`API key ${result.key.id} missing organizationId in metadata`
-				);
-				return null;
-			}
-
-			return {
-				type: 'api_key',
-				keyId: result.key.id,
-				name: result.key.name || 'Unnamed Key',
-				permissions,
-				capabilities,
-				organizationId,
-				lastUsedAt: result.key.lastRequest || undefined
-			};
-		} catch (error) {
-			cmsLogger.error('[AuthService]', 'validateApiKey error:', error);
-			return null;
-		}
-	},
-
-	async requireApiKey(
-		request: Request,
-		db: DatabaseAdapter,
-		permission?: 'read' | 'write'
-	): Promise<ApiKeyAuth> {
-		const apiKeyAuth = await this.validateApiKey(request);
-		if (!apiKeyAuth) {
-			throw new Error('Unauthorized: Valid API key required');
-		}
-
-		if (permission && !apiKeyAuth.permissions.includes(permission)) {
-			throw new Error(`Forbidden: API key missing ${permission} permission`);
-		}
-
-		return apiKeyAuth;
-	},
-
-	async listApiKeys(db: DatabaseAdapter, userId: string): Promise<ApiKey[]> {
-		// Query the apikey table directly using drizzleDb (not the adapter)
-		const userApiKeys = await drizzleDb.query.apikey.findMany({
-			where: eq(apikey.referenceId, userId),
-			columns: {
-				id: true,
-				name: true,
-				metadata: true,
-				expiresAt: true,
-				lastRequest: true,
-				createdAt: true
-			},
-			orderBy: (apikey, { desc }) => [desc(apikey.createdAt)]
-		});
-
-		return userApiKeys.map((key) => {
-			const metadata =
-				typeof key.metadata === 'string' ? JSON.parse(key.metadata) : (key.metadata as any) || {};
-			return {
-				...key,
-				permissions: metadata.permissions || [],
-				capabilities: Array.isArray(metadata.capabilities) ? metadata.capabilities : undefined,
-				organizationId: metadata.organizationId
-			};
-		});
-	},
-
-	async createApiKey(
-		userId: string,
-		organizationId: string,
-		data: CreateApiKeyData
-	): Promise<ApiKeyWithSecret> {
-		const expiresIn = data.expiresInDays ? data.expiresInDays * 24 * 60 * 60 : undefined;
-
-		const result = await auth.api.createApiKey({
-			body: {
-				userId: userId,
-				name: data.name,
-				expiresIn,
-				metadata: {
-					// Keep both fields for forward/backward compatibility:
-					// older validators read `permissions`, newer ones prefer
-					// `capabilities` when the caller supplied them.
-					permissions: data.permissions ?? ['read'],
-					capabilities: data.capabilities,
-					organizationId: organizationId
-				}
-			}
-		});
-
-		if (!result || !result.id) {
-			throw new Error('Failed to create API key');
-		}
-
-		return {
-			id: result.id,
-			name: result.name,
-			key: result.key,
-			permissions: data.permissions ?? ['read'],
-			capabilities: data.capabilities,
-			organizationId: organizationId,
-			expiresAt: result.expiresAt,
-			createdAt: result.createdAt
-		};
-	},
-
-	async deleteApiKey(userId: string, keyId: string): Promise<boolean> {
-		// This will be implemented when we refactor the [id] route
-		cmsLogger.debug('[AuthService]', `Deleting key ${keyId} for user ${userId}`);
-		return Promise.resolve(true);
-	},
-
-	async getUserById(userId: string): Promise<{ id: string; name?: string; email: string } | null> {
-		try {
-			const userRecord = await drizzleDb.query.user.findFirst({
-				where: eq(user.id, userId),
-				columns: {
-					id: true,
-					name: true,
-					email: true
-				}
-			});
-
-			if (!userRecord) {
-				return null;
-			}
-
-			return {
-				id: userRecord.id,
-				name: userRecord.name ?? undefined,
-				email: userRecord.email
-			};
-		} catch (error) {
-			cmsLogger.error('[AuthService]', 'Error fetching user by ID:', error);
-			return null;
-		}
-	},
-
-	async getUserByEmail(
-		email: string
-	): Promise<{ id: string; name?: string; email: string } | null> {
-		try {
-			const userRecord = await drizzleDb.query.user.findFirst({
-				where: eq(user.email, email.toLowerCase()),
-				columns: {
-					id: true,
-					name: true,
-					email: true
-				}
-			});
-
-			if (!userRecord) {
-				return null;
-			}
-
-			return {
-				id: userRecord.id,
-				name: userRecord.name ?? undefined,
-				email: userRecord.email
-			};
-		} catch (error) {
-			cmsLogger.error('[AuthService]', 'Error fetching user by email:', error);
-			return null;
-		}
-	},
-
-	async changeUserName(userId: string, name: string): Promise<void> {
-		await drizzleDb
-			.update(user)
-			.set({
-				name,
-				updatedAt: new Date()
-			})
-			.where(eq(user.id, userId));
-	},
-
-	async requestPasswordReset(email: string, redirectTo?: string): Promise<void> {
-		try {
-			await auth.api.requestPasswordReset({
-				body: {
-					email,
-					redirectTo
-				}
-			});
-
-			// TODO: Send password reset email via email adapter - for true agnoticism
-			// The email adapter can be accessed from event.locals.aphexCMS.emailAdapter
-			// For now, Better Auth handles the email sending internally
-		} catch (error) {
-			cmsLogger.error('[AuthService]', 'Error requesting password reset:', error);
-			throw error;
-		}
-	},
-
-	async resetPassword(token: string, newPassword: string): Promise<void> {
-		try {
-			await auth.api.resetPassword({
-				body: {
-					newPassword,
-					token
-				}
-			});
-		} catch (error) {
-			cmsLogger.error('[AuthService]', 'Error resetting password:', error);
-			throw error;
-		}
-	}
-};

package/templates/base/src/lib/server/cache/index.ts

@@ -1,10 +0,0 @@
-import { InMemoryCacheAdapter } from '@aphexcms/cms-core/server';
-
-/**
- * Shared cache adapter singleton.
- * Used by both CMS config (document caching) and auth (API key caching).
- * Set to null to disable caching.
- */
-export const cacheAdapter: InMemoryCacheAdapter | null = new InMemoryCacheAdapter({
-	maxSize: 5000
-});

package/templates/base/src/lib/server/db/auth-schema.ts

@@ -1,86 +0,0 @@
-import { pgTable, text, timestamp, boolean, integer } from 'drizzle-orm/pg-core';
-
-export const user = pgTable('user', {
-	id: text('id').primaryKey(),
-	name: text('name').notNull(),
-	email: text('email').notNull().unique(),
-	emailVerified: boolean('email_verified').default(false).notNull(),
-	image: text('image'),
-	createdAt: timestamp('created_at').defaultNow().notNull(),
-	updatedAt: timestamp('updated_at')
-		.defaultNow()
-		.$onUpdate(() => /* @__PURE__ */ new Date())
-		.notNull()
-});
-
-export const session = pgTable('session', {
-	id: text('id').primaryKey(),
-	expiresAt: timestamp('expires_at').notNull(),
-	token: text('token').notNull().unique(),
-	createdAt: timestamp('created_at').defaultNow().notNull(),
-	updatedAt: timestamp('updated_at')
-		.$onUpdate(() => /* @__PURE__ */ new Date())
-		.notNull(),
-	ipAddress: text('ip_address'),
-	userAgent: text('user_agent'),
-	userId: text('user_id')
-		.notNull()
-		.references(() => user.id, { onDelete: 'cascade' })
-});
-
-export const account = pgTable('account', {
-	id: text('id').primaryKey(),
-	accountId: text('account_id').notNull(),
-	providerId: text('provider_id').notNull(),
-	userId: text('user_id')
-		.notNull()
-		.references(() => user.id, { onDelete: 'cascade' }),
-	accessToken: text('access_token'),
-	refreshToken: text('refresh_token'),
-	idToken: text('id_token'),
-	accessTokenExpiresAt: timestamp('access_token_expires_at'),
-	refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),
-	scope: text('scope'),
-	password: text('password'),
-	createdAt: timestamp('created_at').defaultNow().notNull(),
-	updatedAt: timestamp('updated_at')
-		.$onUpdate(() => /* @__PURE__ */ new Date())
-		.notNull()
-});
-
-export const verification = pgTable('verification', {
-	id: text('id').primaryKey(),
-	identifier: text('identifier').notNull(),
-	value: text('value').notNull(),
-	expiresAt: timestamp('expires_at').notNull(),
-	createdAt: timestamp('created_at').defaultNow().notNull(),
-	updatedAt: timestamp('updated_at')
-		.defaultNow()
-		.$onUpdate(() => /* @__PURE__ */ new Date())
-		.notNull()
-});
-
-export const apikey = pgTable('apikey', {
-	id: text('id').primaryKey(),
-	configId: text('config_id').notNull().default('default'),
-	name: text('name'),
-	start: text('start'),
-	prefix: text('prefix'),
-	key: text('key').notNull(),
-	referenceId: text('reference_id').notNull(),
-	refillInterval: integer('refill_interval'),
-	refillAmount: integer('refill_amount'),
-	lastRefillAt: timestamp('last_refill_at'),
-	enabled: boolean('enabled').default(true),
-	rateLimitEnabled: boolean('rate_limit_enabled').default(true),
-	rateLimitTimeWindow: integer('rate_limit_time_window').default(86400000),
-	rateLimitMax: integer('rate_limit_max').default(10000),
-	requestCount: integer('request_count').default(0),
-	remaining: integer('remaining'),
-	lastRequest: timestamp('last_request'),
-	expiresAt: timestamp('expires_at'),
-	createdAt: timestamp('created_at').notNull(),
-	updatedAt: timestamp('updated_at').notNull(),
-	permissions: text('permissions'),
-	metadata: text('metadata')
-});

package/templates/base/src/lib/server/db/cms-schema.ts

@@ -1,23 +0,0 @@
-// Database schema for Aphex CMS using Drizzle ORM
-// This file combines CMS package schema with app-specific tables
-// Re-export CMS core schema tables from PostgreSQL adapter package
-// Import from /schema to avoid loading the entire adapter
-export {
-	// Multi-tenancy tables
-	organizations,
-	organizationMembers,
-	invitations,
-	roles,
-	instanceSettings,
-	userSessions,
-	// Content tables
-	documents,
-	documentVersions,
-	assets,
-	schemaTypes,
-	userProfiles,
-	// Enums
-	documentStatusEnum,
-	versionEventEnum,
-	schemaTypeEnum
-} from '@aphexcms/postgresql-adapter/schema';

package/templates/base/src/lib/server/db/index.ts

@@ -1,55 +0,0 @@
-import { drizzle } from 'drizzle-orm/postgres-js';
-import type { Logger } from 'drizzle-orm';
-import postgres from 'postgres';
-import { env } from '$env/dynamic/private';
-import { createPostgreSQLProvider, pgConnectionUrl } from '@aphexcms/postgresql-adapter';
-import * as cmsSchema from './cms-schema';
-import * as authSchema from './auth-schema';
-
-const schema = {
-	...cmsSchema,
-	...authSchema
-};
-
-import type { DatabaseAdapter } from '@aphexcms/cms-core/server';
-
-const SLOW_QUERY_THRESHOLD_MS = parseInt(env.SLOW_QUERY_MS || '100');
-
-class SlowQueryLogger implements Logger {
-	logQuery(query: string, params: unknown[]): void {
-		const start = performance.now();
-		// Store start time — Drizzle calls logQuery before execution
-		// We use queueMicrotask to measure after the query completes
-		queueMicrotask(() => {
-			const duration = performance.now() - start;
-			if (duration >= SLOW_QUERY_THRESHOLD_MS) {
-				const truncatedQuery = query.length > 200 ? query.slice(0, 200) + '...' : query;
-				console.warn(`[SLOW QUERY] ${duration.toFixed(1)}ms — ${truncatedQuery}`);
-			}
-		});
-	}
-}
-
-const databaseUrl = pgConnectionUrl(env);
-
-export const client = postgres(databaseUrl, {
-	max: 50,
-	idle_timeout: 20, // Release idle connections after 20s
-	connect_timeout: 10, // Fail fast if can't connect in 10s
-	max_lifetime: 60 * 5 // Recycle connections every 5 minutes
-});
-export const drizzleDb = drizzle(client, {
-	schema,
-	logger: env.ENABLE_QUERY_LOG === 'true' ? new SlowQueryLogger() : undefined
-});
-
-const provider = createPostgreSQLProvider({
-	client,
-	multiTenancy: {
-		enableRLS: true,
-		enableHierarchy: true
-	}
-});
-
-const adapter = provider.createAdapter();
-export const db = adapter as DatabaseAdapter;

package/templates/base/src/lib/server/db/schema.ts

@@ -1,3 +0,0 @@
-// 1. Import the separate schema parts
-export * from './cms-schema';
-export * from './auth-schema';

package/templates/base/src/lib/server/email/components/EmailLayout.svelte

@@ -1,24 +0,0 @@
-<script lang="ts">
-	import { Html, Head, Body, Preview, Container, Section, Text, Hr } from 'better-svelte-email';
-	import type { Snippet } from 'svelte';
-
-	let { preview = '', children }: { preview?: string; children: Snippet } = $props();
-</script>
-
-<Html>
-	<Head />
-	<Body class="bg-[#f6f9fc] font-sans">
-		{#if preview}
-			<Preview {preview} />
-		{/if}
-		<Container class="mx-auto my-[40px] max-w-[580px] rounded-[8px] bg-white p-[32px]">
-			{@render children()}
-
-			<Hr class="my-[24px] border-[#e6ebf1]" />
-
-			<Section>
-				<Text class="text-[12px] leading-[16px] text-[#8898aa]">Sent by Aphex CMS</Text>
-			</Section>
-		</Container>
-	</Body>
-</Html>