create-ej-app 25.0.0 → 26.0.0

package/template/saas-starter/src/lib/auth-permissions.ts

@@ -0,0 +1,22 @@
+import { createAccessControl } from 'better-auth/plugins/access'
+import { defaultStatements } from 'better-auth/plugins/admin/access'
+
+const statement = {
+  ...defaultStatements
+} as const
+
+export const ac = createAccessControl(statement)
+
+const user = ac.newRole({})
+
+const admin = ac.newRole({
+  user: ['list', 'ban', 'impersonate', 'set-password', 'get', 'update'],
+  session: defaultStatements.session
+})
+
+const superadmin = ac.newRole({
+  user: defaultStatements.user,
+  session: defaultStatements.session
+})
+
+export const roles = { user, admin, superadmin }

package/template/saas-starter/src/lib/auth.ts

@@ -0,0 +1,211 @@
+import { validateEmail } from '@ejekanshjain/simple-email-validator'
+import { createId } from '@paralleldrive/cuid2'
+import { APIError, betterAuth } from 'better-auth'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { createAuthMiddleware } from 'better-auth/api'
+import {
+  admin,
+  lastLoginMethod,
+  magicLink,
+  organization
+} from 'better-auth/plugins'
+import { eq } from 'drizzle-orm'
+import { headers } from 'next/headers'
+import { cache } from 'react'
+import { start } from 'workflow/api'
+import { db } from '~/db'
+import {
+  accountsTable,
+  invitationsTable,
+  membersTable,
+  organizationsTable,
+  organizationSubscriptionsTable,
+  sessionsTable,
+  usersTable,
+  verificationsTable
+} from '~/db/schema'
+import { env } from '~/env'
+import { ac, roles } from './auth-permissions'
+import {
+  sendInvitationEmail,
+  sendMagicLinkEmail,
+  sendWelcomeEmail
+} from './email-service'
+import { getOrganizationPlanCached } from './organization-plan-limits'
+import { siteConfig } from './siteConfig'
+import { stripeClient } from './stripe'
+
+export const auth = betterAuth({
+  database: drizzleAdapter(db, {
+    provider: 'pg',
+    schema: {
+      user: usersTable,
+      session: sessionsTable,
+      account: accountsTable,
+      verification: verificationsTable,
+      organization: organizationsTable,
+      member: membersTable,
+      invitation: invitationsTable
+    }
+  }),
+  account: {
+    accountLinking: {
+      enabled: true
+    }
+  },
+  advanced: {
+    database: {
+      generateId: ({ model }) => `${model}_${createId()}`
+    }
+  },
+  socialProviders: {
+    github: {
+      prompt: 'select_account',
+      clientId: env.BETTER_AUTH_GITHUB_ID,
+      clientSecret: env.BETTER_AUTH_GITHUB_SECRET
+    },
+    google: {
+      prompt: 'select_account',
+      clientId: env.BETTER_AUTH_GOOGLE_ID,
+      clientSecret: env.BETTER_AUTH_GOOGLE_SECRET
+    }
+  },
+  databaseHooks: {
+    user: {
+      create: {
+        after: async user => {
+          try {
+            await start(sendWelcomeEmail, [
+              user.email,
+              {
+                userName: user.name,
+                companyName: siteConfig.name
+              }
+            ])
+          } catch (error) {
+            console.error('Failed to send welcome email:', error)
+          }
+        }
+      }
+    }
+  },
+  plugins: [
+    magicLink({
+      sendMagicLink: async ({ email, url }) => {
+        try {
+          await start(sendMagicLinkEmail, [
+            email,
+            {
+              magicLink: url,
+              companyName: siteConfig.name
+            }
+          ])
+        } catch (error) {
+          console.error('Failed to send magic link email:', error)
+        }
+      }
+    }),
+    admin({
+      ac,
+      roles
+    }),
+    organization({
+      organizationLimit: 10,
+      invitationExpiresIn: 7 * 24 * 60 * 60, // 7 days
+      cancelPendingInvitationsOnReInvite: true,
+      sendInvitationEmail: async ({ id, email, organization, inviter }) => {
+        try {
+          await start(sendInvitationEmail, [
+            email,
+            {
+              inviterName: inviter.user.name,
+              organizationName: organization.name,
+              inviteLink: `${env.BETTER_AUTH_URL}/accept-invitation/${id}`,
+              companyName: siteConfig.name
+            }
+          ])
+        } catch (error) {
+          console.error('Failed to send invitation email:', error)
+        }
+      },
+      organizationHooks: {
+        afterCreateOrganization: async ({ organization }) => {
+          await db.insert(organizationSubscriptionsTable).values({
+            organizationId: organization.id
+          })
+        },
+        beforeDeleteOrganization: async ({ organization }) => {
+          const sub = await db.query.organizationSubscriptionsTable.findFirst({
+            where: eq(
+              organizationSubscriptionsTable.organizationId,
+              organization.id
+            )
+          })
+
+          if (sub?.stripeSubscriptionId) {
+            try {
+              await stripeClient.subscriptions.cancel(sub.stripeSubscriptionId)
+            } catch (error) {
+              console.error(
+                `Failed to cancel Stripe subscription ${sub.stripeSubscriptionId} for org ${organization.id} on org delete:`,
+                error
+              )
+              throw new APIError('BAD_REQUEST', {
+                message:
+                  'Could not cancel the active subscription. Please try again later.'
+              })
+            }
+          }
+
+          await db
+            .delete(organizationSubscriptionsTable)
+            .where(
+              eq(organizationSubscriptionsTable.organizationId, organization.id)
+            )
+        }
+      },
+      invitationLimit: async ({ organization }) => {
+        const { plan } = await getOrganizationPlanCached(organization.id)
+        return plan.maxMembers
+      },
+      membershipLimit: async (_, organization) => {
+        const { plan } = await getOrganizationPlanCached(organization.id)
+        return plan.maxMembers
+      }
+    }),
+    lastLoginMethod()
+  ],
+  hooks: {
+    before: createAuthMiddleware(async ctx => {
+      if (ctx.path === '/sign-in/magic-link' && ctx.body?.email) {
+        try {
+          const validation = await validateEmail({
+            email: ctx.body.email
+          })
+
+          if (validation.isValid === false) {
+            throw new APIError('BAD_REQUEST', {
+              message: 'Please use a valid email address.'
+            })
+          }
+        } catch (err) {
+          console.error('Email validation failed', err)
+        }
+      }
+    })
+  }
+})
+
+export const getAuthSession = cache(async () => {
+  const authSession = await auth.api.getSession({
+    headers: await headers()
+  })
+
+  if (!authSession || !authSession.user || !authSession.session) return null
+
+  const role = authSession.user.role
+  const isSuperAdmin = role === 'superadmin'
+  const isAdmin = role === 'admin' || isSuperAdmin
+
+  return { ...authSession, isAdmin, isSuperAdmin }
+})

package/template/saas-starter/src/lib/billing.ts

@@ -0,0 +1,117 @@
+import { eq } from 'drizzle-orm'
+import { db } from '~/db'
+import { organizationSubscriptionsTable, organizationsTable } from '~/db/schema'
+import { PLANS, type Plan } from './plans'
+import { stripeClient } from './stripe'
+
+type SubscriptionRow = typeof organizationSubscriptionsTable.$inferSelect
+
+export const getPlanAndIntervalByPriceId = (
+  priceId: string
+): { planId: Plan['id']; interval: 'month' | 'year' } | null => {
+  for (const plan of PLANS) {
+    if (!plan.stripePrice) continue
+    if (plan.stripePrice.monthly.id === priceId)
+      return { planId: plan.id, interval: 'month' }
+    if (plan.stripePrice.annual.id === priceId)
+      return { planId: plan.id, interval: 'year' }
+  }
+  return null
+}
+
+export const canStartTrial = (
+  sub: Pick<SubscriptionRow, 'status' | 'hasUsedTrial'>
+): boolean => sub.status === 'free' && !sub.hasUsedTrial
+
+export const ensureStripeCustomer = async (
+  organizationId: string
+): Promise<string> => {
+  const sub = await db.query.organizationSubscriptionsTable.findFirst({
+    where: eq(organizationSubscriptionsTable.organizationId, organizationId)
+  })
+
+  if (!sub) {
+    throw new Error('Organization does not have a subscription')
+  }
+
+  if (sub.stripeCustomerId) return sub.stripeCustomerId
+
+  if (!sub.billingEmail) {
+    throw new Error('Set a billing email before subscribing')
+  }
+
+  const org = await db.query.organizationsTable.findFirst({
+    where: eq(organizationsTable.id, organizationId),
+    columns: { name: true }
+  })
+
+  const customer = await stripeClient.customers.create({
+    email: sub.billingEmail,
+    name: org?.name,
+    metadata: { organizationId }
+  })
+
+  await db
+    .update(organizationSubscriptionsTable)
+    .set({ stripeCustomerId: customer.id })
+    .where(eq(organizationSubscriptionsTable.organizationId, organizationId))
+
+  return customer.id
+}
+
+export const syncSubscriptionFromStripe = async (
+  customerId: string
+): Promise<void> => {
+  const subs = await stripeClient.subscriptions.list({
+    customer: customerId,
+    status: 'all',
+    limit: 1
+  })
+
+  const sub = subs.data[0]
+
+  if (
+    !sub ||
+    sub.status === 'canceled' ||
+    sub.status === 'incomplete_expired'
+  ) {
+    await db
+      .update(organizationSubscriptionsTable)
+      .set({
+        plan: 'free',
+        status: 'free',
+        interval: null,
+        stripeSubscriptionId: null,
+        trialEndsAt: null,
+        currentPeriodEnd: null,
+        cancelAtPeriodEnd: false
+      })
+      .where(eq(organizationSubscriptionsTable.stripeCustomerId, customerId))
+    return
+  }
+
+  const item = sub.items.data[0]
+  const resolved = item ? getPlanAndIntervalByPriceId(item.price.id) : null
+
+  if (!resolved) {
+    console.error(
+      `Stripe price ${item?.price.id} on subscription ${sub.id} does not map to a known plan`
+    )
+  }
+
+  const periodEnd = item?.current_period_end ?? null
+
+  await db
+    .update(organizationSubscriptionsTable)
+    .set({
+      plan: resolved?.planId ?? 'free',
+      status: sub.status,
+      interval: resolved?.interval ?? null,
+      stripeSubscriptionId: sub.id,
+      trialEndsAt: sub.trial_end ? new Date(sub.trial_end * 1000) : null,
+      currentPeriodEnd: periodEnd ? new Date(periodEnd * 1000) : null,
+      cancelAtPeriodEnd: sub.cancel_at_period_end,
+      ...(sub.status === 'trialing' ? { hasUsedTrial: true } : {})
+    })
+    .where(eq(organizationSubscriptionsTable.stripeCustomerId, customerId))
+}

package/template/saas-starter/src/lib/cn.ts

@@ -0,0 +1,4 @@
+import { clsx, type ClassValue } from 'clsx'
+import { twMerge } from 'tailwind-merge'
+
+export const cn = (...inputs: ClassValue[]) => twMerge(clsx(inputs))

package/template/saas-starter/src/lib/constants.ts

@@ -0,0 +1,22 @@
+// ============================================
+// BILLING CONFIGURATION
+// ============================================
+
+/* Trial days */
+export const TRIAL_DAYS = 7
+
+// ============================================
+// R2 STORAGE CONFIGURATION
+// ============================================
+
+/* Presigned URL TTL in seconds */
+export const PRESIGNED_URL_TTL_SECONDS = 900 // 15 min to complete the upload
+
+/* Temp cleanup threshold in milliseconds */
+export const TEMP_CLEANUP_THRESHOLD_MS = 2 * 60 * 60 * 1000 // 2 hours
+
+/* Maximum file size in MB */
+export const MAX_FILE_SIZE_MB = 5
+
+/* Maximum file size in bytes */
+export const MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024

package/template/saas-starter/src/lib/delay.ts

@@ -0,0 +1,2 @@
+export const delay = (ms: number) =>
+  new Promise(resolve => setTimeout(resolve, ms))

package/template/saas-starter/src/lib/email-service.ts

@@ -0,0 +1,89 @@
+import { render, toPlainText } from '@react-email/render'
+import InvitationEmail, { InvitationEmailProps } from '~/emails/invitation'
+import MagicLinkEmail, { MagicLinkEmailProps } from '~/emails/magic-link'
+import WelcomeEmail, { WelcomeEmailProps } from '~/emails/welcome'
+import { sendEmail } from './nodemailer'
+
+/**
+ * Mapping of template types to their corresponding props
+ */
+type EmailTemplateMap = {
+  welcome: WelcomeEmailProps
+  magicLink: MagicLinkEmailProps
+  invitation: InvitationEmailProps
+}
+
+type EmailTemplateType = keyof EmailTemplateMap
+
+// Map of email template components with proper type safety
+const componentMap: Record<
+  EmailTemplateType,
+  (props: EmailTemplateMap[EmailTemplateType]) => React.ReactElement
+> = {
+  welcome: props => WelcomeEmail(props as WelcomeEmailProps),
+  magicLink: props => MagicLinkEmail(props as MagicLinkEmailProps),
+  invitation: props => InvitationEmail(props as InvitationEmailProps)
+}
+
+async function renderEmailTemplate<T extends EmailTemplateType>(
+  templateType: T,
+  props: EmailTemplateMap[T]
+): Promise<{ html: string; text: string }>
+
+async function renderEmailTemplate(
+  templateType: EmailTemplateType,
+  props: EmailTemplateMap[EmailTemplateType]
+) {
+  'use step'
+
+  const emailComponent = componentMap[templateType](props)
+
+  const html = await render(emailComponent)
+  const text = toPlainText(html)
+  return { html, text }
+}
+
+export async function sendWelcomeEmail(to: string, props: WelcomeEmailProps) {
+  'use workflow'
+
+  const { html, text } = await renderEmailTemplate('welcome', props)
+
+  return await sendEmail({
+    to,
+    subject: `Welcome to ${props.companyName}! 🎉`,
+    html,
+    text
+  })
+}
+
+export async function sendMagicLinkEmail(
+  to: string,
+  props: MagicLinkEmailProps
+) {
+  'use workflow'
+
+  const { html, text } = await renderEmailTemplate('magicLink', props)
+
+  return await sendEmail({
+    to,
+    subject: `Sign in to ${props.companyName}`,
+    html,
+    text
+  })
+}
+
+export async function sendInvitationEmail(
+  to: string,
+  props: InvitationEmailProps
+) {
+  'use workflow'
+
+  const { html, text } = await renderEmailTemplate('invitation', props)
+
+  return await sendEmail({
+    to,
+    subject: `You've been invited to join ${props.organizationName}`,
+    html,
+    text
+  })
+}

package/template/saas-starter/src/lib/format-currency.ts

@@ -0,0 +1,27 @@
+export const formatCurrency = (
+  currencyCode: string,
+  num: number | string,
+  precision = 2
+) => {
+  const numCopy = Number(num)
+
+  switch (currencyCode) {
+    case 'INR':
+      return new Intl.NumberFormat('en-IN', {
+        style: 'currency',
+        currency: 'INR',
+        signDisplay: 'negative'
+      }).format(numCopy)
+    case 'USD':
+      return new Intl.NumberFormat('en-US', {
+        style: 'currency',
+        currency: 'USD',
+        signDisplay: 'negative'
+      }).format(numCopy)
+    default:
+      console.warn(
+        `Unsupported currency: ${currencyCode}. Defaulting to fixed format.`
+      )
+      return numCopy.toFixed(precision)
+  }
+}

package/template/saas-starter/src/lib/format-date.ts

@@ -0,0 +1,12 @@
+export const formatDate = (
+  date: Date | string | number | null | undefined,
+  options?: { short?: boolean; time?: boolean; noYear?: boolean }
+): string => {
+  if (date == null) return '-'
+  return new Date(date).toLocaleDateString('en-US', {
+    ...(options?.noYear ? {} : { year: 'numeric' }),
+    month: options?.short ? 'short' : 'long',
+    day: 'numeric',
+    ...(options?.time ? { hour: '2-digit', minute: '2-digit' } : {})
+  })
+}

package/template/saas-starter/src/lib/nodemailer.ts

@@ -0,0 +1,43 @@
+import nodemailer, { SentMessageInfo } from 'nodemailer'
+import { env } from '~/env'
+
+const transporter = nodemailer.createTransport({
+  host: env.EMAIL_SERVER_HOST,
+  port: parseInt(env.EMAIL_SERVER_PORT),
+  secure: parseInt(env.EMAIL_SERVER_PORT) === 465, // Use secure for port 465, false for other ports
+  auth: {
+    user: env.EMAIL_SERVER_USER,
+    pass: env.EMAIL_SERVER_PASSWORD
+  }
+})
+
+interface SendEmailParams {
+  to: string
+  subject: string
+  text?: string
+  html?: string
+}
+
+export const sendEmail = async ({
+  to,
+  subject,
+  text,
+  html
+}: SendEmailParams): Promise<SentMessageInfo> => {
+  'use step'
+
+  try {
+    const info = await transporter.sendMail({
+      from: env.EMAIL_FROM,
+      to,
+      subject,
+      text,
+      html
+    })
+
+    return info
+  } catch (error) {
+    console.error('Error sending email:', error)
+    throw new Error('Failed to send email')
+  }
+}

package/template/saas-starter/src/lib/organization-access.ts

@@ -0,0 +1,93 @@
+import 'server-only'
+
+import { and, count, desc, eq } from 'drizzle-orm'
+import { cache } from 'react'
+import { db } from '~/db'
+import { membersTable, organizationsTable } from '~/db/schema'
+import type { UserOrganization } from './app-navigation'
+import { getAuthSession } from './auth'
+import { resolveImageUrl } from './storage'
+
+const getUserOrganizations = async (): Promise<UserOrganization[]> => {
+  const session = await getAuthSession()
+  if (!session) return []
+
+  const orgs = await db
+    .select({
+      id: organizationsTable.id,
+      name: organizationsTable.name,
+      slug: organizationsTable.slug,
+      logo: organizationsTable.logo,
+      role: membersTable.role,
+      userId: membersTable.userId,
+      memberId: membersTable.id
+    })
+    .from(membersTable)
+    .innerJoin(
+      organizationsTable,
+      eq(membersTable.organizationId, organizationsTable.id)
+    )
+    .where(eq(membersTable.userId, session.user.id))
+    .orderBy(desc(membersTable.createdAt))
+
+  return orgs.map(o => ({ ...o, logo: resolveImageUrl(o.logo) }))
+}
+
+export const getUserOrganizationsCached = cache(getUserOrganizations)
+
+export const getUserMembershipCached = cache(async (organizationId: string) => {
+  const session = await getAuthSession()
+  if (!session) return null
+
+  const member = await db.query.membersTable.findFirst({
+    where: and(
+      eq(membersTable.organizationId, organizationId),
+      eq(membersTable.userId, session.user.id)
+    )
+  })
+
+  return member ?? null
+})
+
+export const getOrganizationMembers = cache(async (organizationId: string) =>
+  db.query.membersTable.findMany({
+    where: eq(membersTable.organizationId, organizationId),
+    with: {
+      user: {
+        columns: { id: true, name: true, email: true, image: true }
+      }
+    },
+    orderBy: [desc(membersTable.createdAt)]
+  })
+)
+
+export const getOrganizationMemberCount = cache(
+  async (organizationId: string) => {
+    const [row] = await db
+      .select({ count: count() })
+      .from(membersTable)
+      .where(eq(membersTable.organizationId, organizationId))
+
+    return row?.count ?? 0
+  }
+)
+
+export const assertUserMembership = async (organizationId: string) => {
+  const membership = await getUserMembershipCached(organizationId)
+  if (!membership) {
+    throw new Error('User does not have access to this organization')
+  }
+  return membership
+}
+
+const MANAGER_ROLES = ['owner', 'admin']
+
+export const assertUserCanManageOrganization = async (
+  organizationId: string
+) => {
+  const membership = await getUserMembershipCached(organizationId)
+  if (!membership || !MANAGER_ROLES.includes(membership.role)) {
+    throw new Error('User does not have permission to manage this organization')
+  }
+  return membership
+}

package/template/saas-starter/src/lib/organization-plan-limits.ts

@@ -0,0 +1,38 @@
+import { eq } from 'drizzle-orm'
+import { cache } from 'react'
+import { db } from '~/db'
+import { organizationSubscriptionsTable } from '~/db/schema'
+import { PLANS } from './plans'
+
+export const getOrganizationPlan = async (organizationId: string) => {
+  const sub = await db.query.organizationSubscriptionsTable.findFirst({
+    where: eq(organizationSubscriptionsTable.organizationId, organizationId)
+  })
+
+  if (!sub) {
+    throw new Error(
+      `Organization: ${organizationId} does not have a subscription`
+    )
+  }
+
+  const effectivePlan =
+    sub.status === 'trialing' ||
+    sub.status === 'active' ||
+    sub.status === 'past_due'
+      ? sub.plan
+      : 'free'
+
+  const plan = PLANS.find(plan => plan.id === effectivePlan)
+  if (!plan) {
+    throw new Error(
+      `Organization: ${organizationId} does not have a valid subscription plan, ${effectivePlan}`
+    )
+  }
+
+  return {
+    plan,
+    sub
+  }
+}
+
+export const getOrganizationPlanCached = cache(getOrganizationPlan)