create-ej-app 25.0.0 → 27.0.0

package/template/saas-starter/src/app/(app)/actions/billing.ts

@@ -0,0 +1,216 @@
+'use server'
+
+import { eq } from 'drizzle-orm'
+import { z } from 'zod'
+import { db } from '~/db'
+import { organizationSubscriptionsTable } from '~/db/schema'
+import { env } from '~/env'
+import { canStartTrial, ensureStripeCustomer } from '~/lib/billing'
+import { TRIAL_DAYS } from '~/lib/constants'
+import { AppError, AppErrorCode } from '~/lib/errors'
+import { assertCanManageOrganization } from '~/lib/organization-access'
+import { getOrganizationPlan } from '~/lib/plan-limits'
+import { PLANS, hasLiveSubscription } from '~/lib/plans'
+import { authActionClient, withWideEvent } from '~/lib/safe-action'
+import { stripeClient } from '~/lib/stripe'
+import { emailValidation, stringValidation } from '~/lib/validations'
+
+const billingReturnUrl = (organizationId: string) =>
+  `${env.BETTER_AUTH_URL}/app/${organizationId}/settings/billing`
+
+async function getSubscription(organizationId: string) {
+  const sub = await db.query.organizationSubscriptionsTable.findFirst({
+    where: eq(organizationSubscriptionsTable.organizationId, organizationId)
+  })
+
+  if (!sub) {
+    throw new AppError(
+      AppErrorCode.NOT_FOUND,
+      'This organization has no billing record.'
+    )
+  }
+
+  return sub
+}
+
+/**
+ * Everything the billing page shows: the current plan and subscription, and
+ * each plan's public prices. Stripe price IDs stay on the server.
+ */
+export const getBillingOverview = authActionClient
+  .inputSchema(stringValidation)
+  .action(
+    withWideEvent(
+      'getBillingOverview',
+      async ({ parsedInput: organizationId, ctx }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+        const { plan, sub } = await getOrganizationPlan(organizationId)
+
+        return {
+          currentPlan: { id: plan.id, name: plan.name },
+          subscription: {
+            status: sub.status,
+            billingEmail: sub.billingEmail,
+            trialEndsAt: sub.trialEndsAt,
+            currentPeriodEnd: sub.currentPeriodEnd,
+            cancelAtPeriodEnd: sub.cancelAtPeriodEnd,
+            canStartTrial: canStartTrial(sub),
+            hasLiveSubscription: hasLiveSubscription(sub.status)
+          },
+          plans: PLANS.map(item => ({
+            id: item.id,
+            name: item.name,
+            maxMembers: item.maxMembers,
+            canUseTrial: Boolean(item.canUseTrial),
+            prices: item.stripePrice
+              ? {
+                  monthly: {
+                    amount: item.stripePrice.monthly.amount,
+                    currency: item.stripePrice.monthly.currency
+                  },
+                  annual: {
+                    amount: item.stripePrice.annual.amount,
+                    currency: item.stripePrice.annual.currency
+                  }
+                }
+              : null
+          }))
+        }
+      }
+    )
+  )
+
+export const updateBillingEmailAction = authActionClient
+  .inputSchema(
+    z.object({
+      organizationId: stringValidation,
+      billingEmail: emailValidation
+    })
+  )
+  .action(
+    withWideEvent(
+      'updateBillingEmailAction',
+      async ({ parsedInput: { organizationId, billingEmail }, ctx }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+        const sub = await getSubscription(organizationId)
+
+        if (sub.stripeCustomerId) {
+          await stripeClient.customers.update(sub.stripeCustomerId, {
+            email: billingEmail
+          })
+        }
+
+        await db
+          .update(organizationSubscriptionsTable)
+          .set({ billingEmail })
+          .where(eq(organizationSubscriptionsTable.id, sub.id))
+
+        return true
+      }
+    )
+  )
+
+export const createCheckoutSessionAction = authActionClient
+  .inputSchema(
+    z.object({
+      organizationId: stringValidation,
+      plan: z.enum(['pro', 'ultimate']),
+      interval: z.enum(['monthly', 'annual']),
+      withTrial: z.boolean().default(false)
+    })
+  )
+  .action(
+    withWideEvent(
+      'createCheckoutSessionAction',
+      async ({
+        parsedInput: { organizationId, plan, interval, withTrial },
+        ctx
+      }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+        const sub = await getSubscription(organizationId)
+
+        if (hasLiveSubscription(sub.status) || sub.stripeSubscriptionId) {
+          throw new AppError(
+            AppErrorCode.CONFLICT,
+            'This organization already has a subscription. Change plans from Manage Billing.'
+          )
+        }
+
+        const planDef = PLANS.find(item => item.id === plan)
+        const price = planDef?.stripePrice?.[interval]
+        if (!price) {
+          throw new AppError(
+            AppErrorCode.BAD_REQUEST,
+            'That plan is not available. Choose another plan.'
+          )
+        }
+
+        // The webhook marks the trial as used once Stripe starts it, so an
+        // abandoned checkout does not use it up.
+        const trialAllowed =
+          withTrial && Boolean(planDef?.canUseTrial) && canStartTrial(sub)
+
+        const customerId = await ensureStripeCustomer(sub)
+
+        const session = await stripeClient.checkout.sessions.create({
+          mode: 'subscription',
+          customer: customerId,
+          line_items: [{ price: price.id, quantity: 1 }],
+          client_reference_id: organizationId,
+          allow_promotion_codes: true,
+          success_url: `${billingReturnUrl(organizationId)}?checkout=success`,
+          cancel_url: `${billingReturnUrl(organizationId)}?checkout=cancel`,
+          subscription_data: {
+            metadata: { organizationId },
+            ...(trialAllowed
+              ? {
+                  trial_period_days: TRIAL_DAYS,
+                  trial_settings: {
+                    end_behavior: { missing_payment_method: 'cancel' }
+                  }
+                }
+              : {})
+          },
+          ...(trialAllowed
+            ? { payment_method_collection: 'always' as const }
+            : {})
+        })
+
+        if (!session.url) {
+          throw new AppError(
+            AppErrorCode.INTERNAL,
+            'Stripe did not return a checkout page. Try again.'
+          )
+        }
+
+        return { url: session.url }
+      }
+    )
+  )
+
+export const createPortalSessionAction = authActionClient
+  .inputSchema(z.object({ organizationId: stringValidation }))
+  .action(
+    withWideEvent(
+      'createPortalSessionAction',
+      async ({ parsedInput: { organizationId }, ctx }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+        const sub = await getSubscription(organizationId)
+
+        if (!sub.stripeCustomerId) {
+          throw new AppError(
+            AppErrorCode.BAD_REQUEST,
+            'This organization has no billing account yet. Choose a paid plan first.'
+          )
+        }
+
+        const session = await stripeClient.billingPortal.sessions.create({
+          customer: sub.stripeCustomerId,
+          return_url: billingReturnUrl(organizationId),
+          configuration: env.STRIPE_PORTAL_CONFIGURATION_ID
+        })
+
+        return { url: session.url }
+      }
+    )
+  )

package/template/saas-starter/src/app/(app)/actions/feedbacks.ts

@@ -0,0 +1,28 @@
+'use server'
+
+import { db } from '~/db'
+import { feedbacksTable } from '~/db/schema'
+import { assertMember } from '~/lib/organization-access'
+import { authActionClient, withWideEvent } from '~/lib/safe-action'
+import { createFeedbackSchema } from './feedbacks.validation'
+
+/** Any member can rate the product from inside an organization. */
+export const createFeedbackAction = authActionClient
+  .inputSchema(createFeedbackSchema)
+  .action(
+    withWideEvent('createFeedbackAction', async ({ parsedInput, ctx }) => {
+      await assertMember(parsedInput.organizationId, ctx.user.id)
+
+      const [feedback] = await db
+        .insert(feedbacksTable)
+        .values({
+          userId: ctx.user.id,
+          organizationId: parsedInput.organizationId,
+          rating: parsedInput.rating,
+          comment: parsedInput.comment
+        })
+        .returning()
+
+      return feedback
+    })
+  )

package/template/saas-starter/src/app/(app)/actions/feedbacks.validation.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod'
+import {
+  ratingValidation,
+  requiredCommentValidation,
+  stringValidation
+} from '~/lib/validations'
+
+export const createFeedbackSchema = z.object({
+  organizationId: stringValidation,
+  rating: ratingValidation,
+  comment: requiredCommentValidation
+})

package/template/saas-starter/src/app/(app)/actions/members.ts

@@ -0,0 +1,189 @@
+'use server'
+
+import { and, asc, count, desc, eq, ilike, inArray, or } from 'drizzle-orm'
+import { z } from 'zod'
+import { SortOrderEnum } from '~/components/data-table/enum'
+import { db } from '~/db'
+import { invitationsTable, membersTable, usersTable } from '~/db/schema'
+import { getPaginationSchema, getSortSchema } from '~/lib/actions'
+import { MAX_FILTER_VALUES } from '~/lib/constants'
+import { assertCanManageOrganization } from '~/lib/organization-access'
+import { getOrganizationPlan } from '~/lib/plan-limits'
+import { authActionClient, withWideEvent } from '~/lib/safe-action'
+import { likeContains } from '~/lib/search'
+import { optionalStringValidation, stringValidation } from '~/lib/validations'
+
+export const getMembers = authActionClient
+  .inputSchema(
+    z.object({
+      organizationId: stringValidation,
+      ...getPaginationSchema(),
+      ...getSortSchema(['name', 'email', 'role', 'createdAt']),
+      search: optionalStringValidation,
+      filters: z
+        .object({
+          role: z.array(z.string()).max(MAX_FILTER_VALUES).optional()
+        })
+        .optional()
+    })
+  )
+  .action(
+    withWideEvent(
+      'getMembers',
+      async ({
+        parsedInput: {
+          organizationId,
+          page,
+          limit,
+          sortBy,
+          sortOrder,
+          search,
+          filters
+        },
+        ctx
+      }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+
+        const where = and(
+          eq(membersTable.organizationId, organizationId),
+          search
+            ? or(
+                ilike(usersTable.name, likeContains(search)),
+                ilike(usersTable.email, likeContains(search))
+              )
+            : undefined,
+          filters?.role?.length
+            ? inArray(membersTable.role, filters.role)
+            : undefined
+        )
+
+        const sortColumn =
+          sortBy === 'name'
+            ? usersTable.name
+            : sortBy === 'email'
+              ? usersTable.email
+              : sortBy === 'role'
+                ? membersTable.role
+                : membersTable.createdAt
+
+        const direction = sortOrder === SortOrderEnum.ASC ? asc : desc
+
+        const [rows, total] = await Promise.all([
+          db
+            .select({
+              id: membersTable.id,
+              userId: usersTable.id,
+              name: usersTable.name,
+              email: usersTable.email,
+              image: usersTable.image,
+              role: membersTable.role,
+              createdAt: membersTable.createdAt
+            })
+            .from(membersTable)
+            .innerJoin(usersTable, eq(membersTable.userId, usersTable.id))
+            .where(where)
+            .orderBy(direction(sortColumn))
+            .limit(limit)
+            .offset((page - 1) * limit),
+          db
+            .select({ count: count() })
+            .from(membersTable)
+            .innerJoin(usersTable, eq(membersTable.userId, usersTable.id))
+            .where(where)
+        ])
+
+        return [rows, total[0]?.count ?? 0] as const
+      }
+    )
+  )
+
+export const getInvitations = authActionClient
+  .inputSchema(
+    z.object({
+      organizationId: stringValidation,
+      ...getPaginationSchema(),
+      ...getSortSchema(['email', 'status', 'createdAt', 'expiresAt']),
+      search: optionalStringValidation,
+      filters: z
+        .object({
+          status: z.array(z.string()).max(MAX_FILTER_VALUES).optional()
+        })
+        .optional()
+    })
+  )
+  .action(
+    withWideEvent(
+      'getInvitations',
+      async ({
+        parsedInput: {
+          organizationId,
+          page,
+          limit,
+          sortBy,
+          sortOrder,
+          search,
+          filters
+        },
+        ctx
+      }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+
+        const where = and(
+          eq(invitationsTable.organizationId, organizationId),
+          search
+            ? ilike(invitationsTable.email, likeContains(search))
+            : undefined,
+          filters?.status?.length
+            ? inArray(invitationsTable.status, filters.status)
+            : undefined
+        )
+
+        const direction = sortOrder === SortOrderEnum.ASC ? asc : desc
+
+        const [rows, total] = await Promise.all([
+          db.query.invitationsTable.findMany({
+            where,
+            with: { inviter: { columns: { name: true } } },
+            limit,
+            offset: (page - 1) * limit,
+            orderBy: [direction(invitationsTable[sortBy ?? 'createdAt'])]
+          }),
+          db.select({ count: count() }).from(invitationsTable).where(where)
+        ])
+
+        const data = rows.map(row => ({
+          id: row.id,
+          email: row.email,
+          role: row.role ?? 'member',
+          status: row.status,
+          expiresAt: row.expiresAt,
+          createdAt: row.createdAt,
+          inviterName: row.inviter?.name ?? null
+        }))
+
+        return [data, total[0]?.count ?? 0] as const
+      }
+    )
+  )
+
+/** Member count and the plan's member limit, for the invite button. */
+export const getMemberUsage = authActionClient
+  .inputSchema(stringValidation)
+  .action(
+    withWideEvent(
+      'getMemberUsage',
+      async ({ parsedInput: organizationId, ctx }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+
+        const [[row], { plan }] = await Promise.all([
+          db
+            .select({ count: count() })
+            .from(membersTable)
+            .where(eq(membersTable.organizationId, organizationId)),
+          getOrganizationPlan(organizationId)
+        ])
+
+        return { memberCount: row?.count ?? 0, maxMembers: plan.maxMembers }
+      }
+    )
+  )

package/template/saas-starter/src/app/(app)/actions/organizations.ts

@@ -0,0 +1,230 @@
+'use server'
+
+import { and, desc, eq, ne } from 'drizzle-orm'
+import { cache } from 'react'
+import { z } from 'zod'
+import { db } from '~/db'
+import { membersTable, organizationsTable, usersTable } from '~/db/schema'
+import { AppError, AppErrorCode, rethrowUniqueViolation } from '~/lib/errors'
+import {
+  assertCanManageOrganization,
+  assertRole
+} from '~/lib/organization-access'
+import { authActionClient, withWideEvent } from '~/lib/safe-action'
+import {
+  assertOwnedR2Key,
+  assertPersistableImageValue,
+  confirmUpload,
+  deleteOwnedFileQuietly,
+  isR2Key,
+  resolveImageUrl
+} from '~/lib/storage'
+import { stringValidation } from '~/lib/validations'
+import { updateOrganizationSchema } from './organizations.validation'
+
+/** Every organization the caller belongs to, newest membership first. */
+export const getOrganizations = authActionClient.action(
+  withWideEvent('getOrganizations', async ({ ctx: { user } }) => {
+    const rows = await db
+      .select({
+        id: organizationsTable.id,
+        name: organizationsTable.name,
+        slug: organizationsTable.slug,
+        logo: organizationsTable.logo,
+        role: membersTable.role,
+        memberId: membersTable.id
+      })
+      .from(membersTable)
+      .innerJoin(
+        organizationsTable,
+        eq(membersTable.organizationId, organizationsTable.id)
+      )
+      .where(eq(membersTable.userId, user.id))
+      .orderBy(desc(membersTable.createdAt))
+
+    return rows.map(row => ({ ...row, logoUrl: resolveImageUrl(row.logo) }))
+  })
+)
+
+/** Per-request cache, so layouts and pages share one query. */
+export const getOrganizationsCached = cache(getOrganizations)
+
+/**
+ * One organization with the caller's role in it. Returns no data when the
+ * caller is not a member, so pages can respond with `notFound()`.
+ */
+export const getOrganization = authActionClient
+  .inputSchema(stringValidation)
+  .action(
+    withWideEvent(
+      'getOrganization',
+      async ({ parsedInput: organizationId, ctx: { user } }) => {
+        const [row] = await db
+          .select({
+            id: organizationsTable.id,
+            name: organizationsTable.name,
+            slug: organizationsTable.slug,
+            logo: organizationsTable.logo,
+            role: membersTable.role,
+            memberId: membersTable.id
+          })
+          .from(membersTable)
+          .innerJoin(
+            organizationsTable,
+            eq(membersTable.organizationId, organizationsTable.id)
+          )
+          .where(
+            and(
+              eq(membersTable.organizationId, organizationId),
+              eq(membersTable.userId, user.id)
+            )
+          )
+
+        return row ? { ...row, logoUrl: resolveImageUrl(row.logo) } : null
+      }
+    )
+  )
+
+export const getOrganizationCached = cache(getOrganization)
+
+/**
+ * Saves the organization's name, slug, and logo. The logo must be an upload
+ * this organization owns (or a data URL while R2 is off); the replaced file
+ * is deleted.
+ */
+export const updateOrganizationAction = authActionClient
+  .inputSchema(updateOrganizationSchema)
+  .action(
+    withWideEvent(
+      'updateOrganizationAction',
+      async ({ parsedInput, ctx: { user } }) => {
+        const { organizationId } = parsedInput
+        await assertCanManageOrganization(organizationId, user.id)
+
+        const org = await db.query.organizationsTable.findFirst({
+          where: eq(organizationsTable.id, organizationId),
+          columns: { logo: true }
+        })
+
+        if (!org) {
+          throw new AppError(AppErrorCode.NOT_FOUND, 'Organization not found.')
+        }
+
+        const logo = parsedInput.logo || null
+        const logoChanged = logo !== org.logo
+        // An unchanged logo is already stored, even a data URL saved before R2
+        // was configured, so only a new value has to pass the storage rules.
+        if (logoChanged) assertPersistableImageValue(logo)
+
+        // Check ownership before saving, and delete the old file only after
+        // the save succeeds, so a failed save never loses the current logo.
+        if (logoChanged && isR2Key(logo)) {
+          await assertOwnedR2Key(logo, organizationId)
+        }
+
+        await db
+          .update(organizationsTable)
+          .set({ name: parsedInput.name, slug: parsedInput.slug, logo })
+          .where(eq(organizationsTable.id, organizationId))
+          .catch(error =>
+            rethrowUniqueViolation(
+              error,
+              'Another organization already uses this slug. Choose a different one.'
+            )
+          )
+
+        if (logoChanged && isR2Key(logo)) {
+          await confirmUpload(logo, organizationId, org.logo)
+        } else if (logoChanged && org.logo) {
+          await deleteOwnedFileQuietly(org.logo, organizationId)
+        }
+
+        return true
+      }
+    )
+  )
+
+/** Members the owner can hand ownership to: everyone except themselves. */
+export const getTransferTargets = authActionClient
+  .inputSchema(stringValidation)
+  .action(
+    withWideEvent(
+      'getTransferTargets',
+      async ({ parsedInput: organizationId, ctx: { user } }) => {
+        const owner = await assertRole(organizationId, user.id, ['owner'])
+
+        return db
+          .select({
+            memberId: membersTable.id,
+            name: usersTable.name,
+            email: usersTable.email,
+            role: membersTable.role
+          })
+          .from(membersTable)
+          .innerJoin(usersTable, eq(membersTable.userId, usersTable.id))
+          .where(
+            and(
+              eq(membersTable.organizationId, organizationId),
+              ne(membersTable.id, owner.id)
+            )
+          )
+          .orderBy(usersTable.name)
+      }
+    )
+  )
+
+/** Makes another member the owner. The current owner becomes an admin. */
+export const transferOrganizationOwnershipAction = authActionClient
+  .inputSchema(
+    z.object({
+      organizationId: stringValidation,
+      targetMemberId: stringValidation
+    })
+  )
+  .action(
+    withWideEvent(
+      'transferOrganizationOwnershipAction',
+      async ({
+        parsedInput: { organizationId, targetMemberId },
+        ctx: { user }
+      }) => {
+        const owner = await assertRole(organizationId, user.id, ['owner'])
+
+        if (targetMemberId === owner.id) {
+          throw new AppError(
+            AppErrorCode.BAD_REQUEST,
+            'You already own this organization. Choose another member.'
+          )
+        }
+
+        const target = await db.query.membersTable.findFirst({
+          where: and(
+            eq(membersTable.id, targetMemberId),
+            eq(membersTable.organizationId, organizationId)
+          ),
+          columns: { id: true }
+        })
+
+        if (!target) {
+          throw new AppError(
+            AppErrorCode.NOT_FOUND,
+            'That member is no longer in this organization. Refresh and choose again.'
+          )
+        }
+
+        await db.transaction(async tx => {
+          await tx
+            .update(membersTable)
+            .set({ role: 'owner' })
+            .where(eq(membersTable.id, target.id))
+
+          await tx
+            .update(membersTable)
+            .set({ role: 'admin' })
+            .where(eq(membersTable.id, owner.id))
+        })
+
+        return true
+      }
+    )
+  )

package/template/saas-starter/src/app/(app)/actions/organizations.validation.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod'
+import {
+  imageUrlValidation,
+  slugValidation,
+  stringValidation
+} from '~/lib/validations'
+
+export const organizationDetailsSchema = z.object({
+  name: stringValidation,
+  slug: slugValidation
+})
+
+export const updateOrganizationSchema = organizationDetailsSchema.extend({
+  organizationId: stringValidation,
+  /** Empty string clears the logo. */
+  logo: imageUrlValidation
+})