create-ej-app 26.0.0 → 28.0.0

package/template/saas-starter/src/app/(app)/actions/billing.ts

@@ -7,17 +7,79 @@ import { organizationSubscriptionsTable } from '~/db/schema'
 import { env } from '~/env'
 import { canStartTrial, ensureStripeCustomer } from '~/lib/billing'
 import { TRIAL_DAYS } from '~/lib/constants'
-import { assertUserCanManageOrganization } from '~/lib/organization-access'
-import { PLANS } from '~/lib/plans'
-import { authActionClient } from '~/lib/safe-action'
+import { AppError, AppErrorCode } from '~/lib/errors'
+import { assertCanManageOrganization } from '~/lib/organization-access'
+import { getOrganizationPlan } from '~/lib/plan-limits'
+import { PLANS, hasLiveSubscription } from '~/lib/plans'
+import { authActionClient, withWideEvent } from '~/lib/safe-action'
 import { stripeClient } from '~/lib/stripe'
 import { emailValidation, stringValidation } from '~/lib/validations'
 
-const ACTIVE_STATUSES = ['trialing', 'active', 'past_due'] as const
-
 const billingReturnUrl = (organizationId: string) =>
   `${env.BETTER_AUTH_URL}/app/${organizationId}/settings/billing`
 
+async function getSubscription(organizationId: string) {
+  const sub = await db.query.organizationSubscriptionsTable.findFirst({
+    where: eq(organizationSubscriptionsTable.organizationId, organizationId)
+  })
+
+  if (!sub) {
+    throw new AppError(
+      AppErrorCode.NOT_FOUND,
+      'This organization has no billing record.'
+    )
+  }
+
+  return sub
+}
+
+/**
+ * Everything the billing page shows: the current plan and subscription, and
+ * each plan's public prices. Stripe price IDs stay on the server.
+ */
+export const getBillingOverview = authActionClient
+  .inputSchema(stringValidation)
+  .action(
+    withWideEvent(
+      'getBillingOverview',
+      async ({ parsedInput: organizationId, ctx }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+        const { plan, sub } = await getOrganizationPlan(organizationId)
+
+        return {
+          currentPlan: { id: plan.id, name: plan.name },
+          subscription: {
+            status: sub.status,
+            billingEmail: sub.billingEmail,
+            trialEndsAt: sub.trialEndsAt,
+            currentPeriodEnd: sub.currentPeriodEnd,
+            cancelAtPeriodEnd: sub.cancelAtPeriodEnd,
+            canStartTrial: canStartTrial(sub),
+            hasLiveSubscription: hasLiveSubscription(sub.status)
+          },
+          plans: PLANS.map(item => ({
+            id: item.id,
+            name: item.name,
+            maxMembers: item.maxMembers,
+            canUseTrial: Boolean(item.canUseTrial),
+            prices: item.stripePrice
+              ? {
+                  monthly: {
+                    amount: item.stripePrice.monthly.amount,
+                    currency: item.stripePrice.monthly.currency
+                  },
+                  annual: {
+                    amount: item.stripePrice.annual.amount,
+                    currency: item.stripePrice.annual.currency
+                  }
+                }
+              : null
+          }))
+        }
+      }
+    )
+  )
+
 export const updateBillingEmailAction = authActionClient
   .inputSchema(
     z.object({
@@ -25,30 +87,28 @@ export const updateBillingEmailAction = authActionClient
       billingEmail: emailValidation
     })
   )
-  .action(async ({ parsedInput: { organizationId, billingEmail } }) => {
-    await assertUserCanManageOrganization(organizationId)
-
-    const sub = await db.query.organizationSubscriptionsTable.findFirst({
-      where: eq(organizationSubscriptionsTable.organizationId, organizationId)
-    })
-
-    if (!sub) {
-      throw new Error('Organization does not have a subscription')
-    }
-
-    if (sub.stripeCustomerId) {
-      await stripeClient.customers.update(sub.stripeCustomerId, {
-        email: billingEmail
-      })
-    }
+  .action(
+    withWideEvent(
+      'updateBillingEmailAction',
+      async ({ parsedInput: { organizationId, billingEmail }, ctx }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+        const sub = await getSubscription(organizationId)
+
+        if (sub.stripeCustomerId) {
+          await stripeClient.customers.update(sub.stripeCustomerId, {
+            email: billingEmail
+          })
+        }
 
-    await db
-      .update(organizationSubscriptionsTable)
-      .set({ billingEmail })
-      .where(eq(organizationSubscriptionsTable.organizationId, organizationId))
+        await db
+          .update(organizationSubscriptionsTable)
+          .set({ billingEmail })
+          .where(eq(organizationSubscriptionsTable.id, sub.id))
 
-    return true
-  })
+        return true
+      }
+    )
+  )
 
 export const createCheckoutSessionAction = authActionClient
   .inputSchema(
@@ -60,93 +120,97 @@ export const createCheckoutSessionAction = authActionClient
     })
   )
   .action(
-    async ({ parsedInput: { organizationId, plan, interval, withTrial } }) => {
-      await assertUserCanManageOrganization(organizationId)
-
-      const sub = await db.query.organizationSubscriptionsTable.findFirst({
-        where: eq(organizationSubscriptionsTable.organizationId, organizationId)
-      })
-
-      if (!sub) {
-        throw new Error('Organization does not have a subscription')
-      }
-
-      if ((ACTIVE_STATUSES as readonly string[]).includes(sub.status)) {
-        throw new Error(
-          'This organization already has a subscription. Manage it from the billing portal.'
-        )
-      }
-
-      const planDef = PLANS.find(p => p.id === plan)
-      const price = planDef?.stripePrice?.[interval]
-      if (!price) {
-        throw new Error('Selected plan is not available')
-      }
-
-      const trialAllowed =
-        withTrial && Boolean(planDef?.canUseTrial) && canStartTrial(sub)
-
-      const customerId = await ensureStripeCustomer(organizationId)
-
-      if (trialAllowed) {
-        await db
-          .update(organizationSubscriptionsTable)
-          .set({ hasUsedTrial: true })
-          .where(
-            eq(organizationSubscriptionsTable.organizationId, organizationId)
+    withWideEvent(
+      'createCheckoutSessionAction',
+      async ({
+        parsedInput: { organizationId, plan, interval, withTrial },
+        ctx
+      }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+        const sub = await getSubscription(organizationId)
+
+        if (hasLiveSubscription(sub.status) || sub.stripeSubscriptionId) {
+          throw new AppError(
+            AppErrorCode.CONFLICT,
+            'This organization already has a subscription. Change plans from Manage Billing.'
           )
-      }
-
-      const session = await stripeClient.checkout.sessions.create({
-        mode: 'subscription',
-        customer: customerId,
-        line_items: [{ price: price.id, quantity: 1 }],
-        client_reference_id: organizationId,
-        allow_promotion_codes: true,
-        success_url: `${billingReturnUrl(organizationId)}?checkout=success`,
-        cancel_url: `${billingReturnUrl(organizationId)}?checkout=cancel`,
-        subscription_data: {
-          metadata: { organizationId },
-          ...(trialAllowed
-            ? {
-                trial_period_days: TRIAL_DAYS,
-                trial_settings: {
-                  end_behavior: { missing_payment_method: 'cancel' }
+        }
+
+        const planDef = PLANS.find(item => item.id === plan)
+        const price = planDef?.stripePrice?.[interval]
+        if (!price) {
+          throw new AppError(
+            AppErrorCode.BAD_REQUEST,
+            'That plan is not available. Choose another plan.'
+          )
+        }
+
+        // The webhook marks the trial as used once Stripe starts it, so an
+        // abandoned checkout does not use it up.
+        const trialAllowed =
+          withTrial && Boolean(planDef?.canUseTrial) && canStartTrial(sub)
+
+        const customerId = await ensureStripeCustomer(sub)
+
+        const session = await stripeClient.checkout.sessions.create({
+          mode: 'subscription',
+          customer: customerId,
+          line_items: [{ price: price.id, quantity: 1 }],
+          client_reference_id: organizationId,
+          allow_promotion_codes: true,
+          success_url: `${billingReturnUrl(organizationId)}?checkout=success`,
+          cancel_url: `${billingReturnUrl(organizationId)}?checkout=cancel`,
+          subscription_data: {
+            metadata: { organizationId },
+            ...(trialAllowed
+              ? {
+                  trial_period_days: TRIAL_DAYS,
+                  trial_settings: {
+                    end_behavior: { missing_payment_method: 'cancel' }
+                  }
                 }
-              }
+              : {})
+          },
+          ...(trialAllowed
+            ? { payment_method_collection: 'always' as const }
             : {})
-        },
-        ...(trialAllowed
-          ? { payment_method_collection: 'always' as const }
-          : {})
-      })
-
-      if (!session.url) {
-        throw new Error('Failed to create checkout session')
-      }
+        })
 
-      return { url: session.url }
-    }
+        if (!session.url) {
+          throw new AppError(
+            AppErrorCode.INTERNAL,
+            'Stripe did not return a checkout page. Try again.'
+          )
+        }
+
+        return { url: session.url }
+      }
+    )
   )
 
 export const createPortalSessionAction = authActionClient
   .inputSchema(z.object({ organizationId: stringValidation }))
-  .action(async ({ parsedInput: { organizationId } }) => {
-    await assertUserCanManageOrganization(organizationId)
-
-    const sub = await db.query.organizationSubscriptionsTable.findFirst({
-      where: eq(organizationSubscriptionsTable.organizationId, organizationId)
-    })
-
-    if (!sub?.stripeCustomerId) {
-      throw new Error('No billing account exists for this organization yet')
-    }
+  .action(
+    withWideEvent(
+      'createPortalSessionAction',
+      async ({ parsedInput: { organizationId }, ctx }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+        const sub = await getSubscription(organizationId)
+
+        if (!sub.stripeCustomerId) {
+          throw new AppError(
+            AppErrorCode.BAD_REQUEST,
+            'This organization has no billing account yet. Choose a paid plan first.'
+          )
+        }
 
-    const session = await stripeClient.billingPortal.sessions.create({
-      customer: sub.stripeCustomerId,
-      return_url: billingReturnUrl(organizationId),
-      configuration: env.STRIPE_PORTAL_CONFIGURATION_ID
-    })
+        const session = await stripeClient.billingPortal.sessions.create({
+          customer: sub.stripeCustomerId,
+          return_url: billingReturnUrl(organizationId),
+          configuration: env.STRIPE_PORTAL_CONFIGURATION_ID
+        })
 
-    return { url: session.url }
-  })
+        return { url: session.url }
+      }
+    )
+  )

package/template/saas-starter/src/app/(app)/actions/feedbacks.ts

@@ -0,0 +1,28 @@
+'use server'
+
+import { db } from '~/db'
+import { feedbacksTable } from '~/db/schema'
+import { assertMember } from '~/lib/organization-access'
+import { authActionClient, withWideEvent } from '~/lib/safe-action'
+import { createFeedbackSchema } from './feedbacks.validation'
+
+/** Any member can rate the product from inside an organization. */
+export const createFeedbackAction = authActionClient
+  .inputSchema(createFeedbackSchema)
+  .action(
+    withWideEvent('createFeedbackAction', async ({ parsedInput, ctx }) => {
+      await assertMember(parsedInput.organizationId, ctx.user.id)
+
+      const [feedback] = await db
+        .insert(feedbacksTable)
+        .values({
+          userId: ctx.user.id,
+          organizationId: parsedInput.organizationId,
+          rating: parsedInput.rating,
+          comment: parsedInput.comment
+        })
+        .returning()
+
+      return feedback
+    })
+  )

package/template/saas-starter/src/app/(app)/actions/feedbacks.validation.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod'
+import {
+  ratingValidation,
+  requiredCommentValidation,
+  stringValidation
+} from '~/lib/validations'
+
+export const createFeedbackSchema = z.object({
+  organizationId: stringValidation,
+  rating: ratingValidation,
+  comment: requiredCommentValidation
+})

package/template/saas-starter/src/app/(app)/actions/members.ts

@@ -6,10 +6,12 @@ import { SortOrderEnum } from '~/components/data-table/enum'
 import { db } from '~/db'
 import { invitationsTable, membersTable, usersTable } from '~/db/schema'
 import { getPaginationSchema, getSortSchema } from '~/lib/actions'
-import { assertUserCanManageOrganization } from '~/lib/organization-access'
-import { authActionClient } from '~/lib/safe-action'
-import { resolveImageUrl } from '~/lib/storage'
-import { stringValidation } from '~/lib/validations'
+import { MAX_FILTER_VALUES } from '~/lib/constants'
+import { assertCanManageOrganization } from '~/lib/organization-access'
+import { getOrganizationPlan } from '~/lib/plan-limits'
+import { authActionClient, withWideEvent } from '~/lib/safe-action'
+import { likeContains } from '~/lib/search'
+import { optionalStringValidation, stringValidation } from '~/lib/validations'
 
 export const getMembers = authActionClient
   .inputSchema(
@@ -17,83 +19,82 @@ export const getMembers = authActionClient
       organizationId: stringValidation,
       ...getPaginationSchema(),
       ...getSortSchema(['name', 'email', 'role', 'createdAt']),
-      search: z.string().trim().optional(),
+      search: optionalStringValidation,
       filters: z
         .object({
-          role: z.array(z.string()).optional()
+          role: z.array(z.string()).max(MAX_FILTER_VALUES).optional()
         })
         .optional()
     })
   )
   .action(
-    async ({
-      parsedInput: {
-        organizationId,
-        page,
-        limit,
-        sortBy,
-        sortOrder,
-        search,
-        filters
+    withWideEvent(
+      'getMembers',
+      async ({
+        parsedInput: {
+          organizationId,
+          page,
+          limit,
+          sortBy,
+          sortOrder,
+          search,
+          filters
+        },
+        ctx
+      }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+
+        const where = and(
+          eq(membersTable.organizationId, organizationId),
+          search
+            ? or(
+                ilike(usersTable.name, likeContains(search)),
+                ilike(usersTable.email, likeContains(search))
+              )
+            : undefined,
+          filters?.role?.length
+            ? inArray(membersTable.role, filters.role)
+            : undefined
+        )
+
+        const sortColumn =
+          sortBy === 'name'
+            ? usersTable.name
+            : sortBy === 'email'
+              ? usersTable.email
+              : sortBy === 'role'
+                ? membersTable.role
+                : membersTable.createdAt
+
+        const direction = sortOrder === SortOrderEnum.ASC ? asc : desc
+
+        const [rows, total] = await Promise.all([
+          db
+            .select({
+              id: membersTable.id,
+              userId: usersTable.id,
+              name: usersTable.name,
+              email: usersTable.email,
+              image: usersTable.image,
+              role: membersTable.role,
+              createdAt: membersTable.createdAt
+            })
+            .from(membersTable)
+            .innerJoin(usersTable, eq(membersTable.userId, usersTable.id))
+            .where(where)
+            .orderBy(direction(sortColumn))
+            .limit(limit)
+            .offset((page - 1) * limit),
+          db
+            .select({ count: count() })
+            .from(membersTable)
+            .innerJoin(usersTable, eq(membersTable.userId, usersTable.id))
+            .where(where)
+        ])
+
+        return [rows, total[0]?.count ?? 0] as const
       }
-    }) => {
-      await assertUserCanManageOrganization(organizationId)
-
-      const where = and(
-        eq(membersTable.organizationId, organizationId),
-        search
-          ? or(
-              ilike(usersTable.name, `%${search}%`),
-              ilike(usersTable.email, `%${search}%`)
-            )
-          : undefined,
-        filters?.role && filters.role.length > 0
-          ? inArray(membersTable.role, filters.role)
-          : undefined
-      )
-
-      const sortColumn =
-        sortBy === 'name'
-          ? usersTable.name
-          : sortBy === 'email'
-            ? usersTable.email
-            : sortBy === 'role'
-              ? membersTable.role
-              : membersTable.createdAt
-
-      const direction = sortOrder === SortOrderEnum.ASC ? asc : desc
-
-      const [rows, total] = await Promise.all([
-        db
-          .select({
-            id: membersTable.id,
-            userId: usersTable.id,
-            name: usersTable.name,
-            email: usersTable.email,
-            image: usersTable.image,
-            role: membersTable.role,
-            createdAt: membersTable.createdAt
-          })
-          .from(membersTable)
-          .innerJoin(usersTable, eq(membersTable.userId, usersTable.id))
-          .where(where)
-          .orderBy(direction(sortColumn))
-          .limit(limit)
-          .offset((page - 1) * limit),
-        db
-          .select({ count: count() })
-          .from(membersTable)
-          .innerJoin(usersTable, eq(membersTable.userId, usersTable.id))
-          .where(where)
-      ])
-
-      const data = rows.map(row => ({
-        ...row,
-        image: resolveImageUrl(row.image)
-      }))
-
-      return [data, total[0]?.count ?? 0] as const
-    }
+    )
   )
 
 export const getInvitations = authActionClient
@@ -102,62 +103,87 @@ export const getInvitations = authActionClient
       organizationId: stringValidation,
       ...getPaginationSchema(),
       ...getSortSchema(['email', 'status', 'createdAt', 'expiresAt']),
-      search: z.string().trim().optional(),
+      search: optionalStringValidation,
       filters: z
         .object({
-          status: z.array(z.string()).optional()
+          status: z.array(z.string()).max(MAX_FILTER_VALUES).optional()
         })
         .optional()
     })
   )
   .action(
-    async ({
-      parsedInput: {
-        organizationId,
-        page,
-        limit,
-        sortBy,
-        sortOrder,
-        search,
-        filters
-      }
-    }) => {
-      await assertUserCanManageOrganization(organizationId)
-
-      const where = and(
-        eq(invitationsTable.organizationId, organizationId),
-        search ? ilike(invitationsTable.email, `%${search}%`) : undefined,
-        filters?.status && filters.status.length > 0
-          ? inArray(invitationsTable.status, filters.status)
-          : undefined
-      )
-
-      const sortColumn = invitationsTable[sortBy ?? 'createdAt']
-      const direction = sortOrder === SortOrderEnum.ASC ? asc : desc
-
-      const [rows, total] = await Promise.all([
-        db.query.invitationsTable.findMany({
-          where,
-          with: {
-            user: { columns: { name: true } }
-          },
+    withWideEvent(
+      'getInvitations',
+      async ({
+        parsedInput: {
+          organizationId,
+          page,
           limit,
-          offset: (page - 1) * limit,
-          orderBy: [direction(sortColumn)]
-        }),
-        db.select({ count: count() }).from(invitationsTable).where(where)
-      ])
-
-      const data = rows.map(row => ({
-        id: row.id,
-        email: row.email,
-        role: row.role ?? 'member',
-        status: row.status,
-        expiresAt: row.expiresAt,
-        createdAt: row.createdAt,
-        inviterName: row.user?.name ?? null
-      }))
-
-      return [data, total[0]?.count ?? 0] as const
-    }
+          sortBy,
+          sortOrder,
+          search,
+          filters
+        },
+        ctx
+      }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+
+        const where = and(
+          eq(invitationsTable.organizationId, organizationId),
+          search
+            ? ilike(invitationsTable.email, likeContains(search))
+            : undefined,
+          filters?.status?.length
+            ? inArray(invitationsTable.status, filters.status)
+            : undefined
+        )
+
+        const direction = sortOrder === SortOrderEnum.ASC ? asc : desc
+
+        const [rows, total] = await Promise.all([
+          db.query.invitationsTable.findMany({
+            where,
+            with: { inviter: { columns: { name: true } } },
+            limit,
+            offset: (page - 1) * limit,
+            orderBy: [direction(invitationsTable[sortBy ?? 'createdAt'])]
+          }),
+          db.select({ count: count() }).from(invitationsTable).where(where)
+        ])
+
+        const data = rows.map(row => ({
+          id: row.id,
+          email: row.email,
+          role: row.role ?? 'member',
+          status: row.status,
+          expiresAt: row.expiresAt,
+          createdAt: row.createdAt,
+          inviterName: row.inviter?.name ?? null
+        }))
+
+        return [data, total[0]?.count ?? 0] as const
+      }
+    )
+  )
+
+/** Member count and the plan's member limit, for the invite button. */
+export const getMemberUsage = authActionClient
+  .inputSchema(stringValidation)
+  .action(
+    withWideEvent(
+      'getMemberUsage',
+      async ({ parsedInput: organizationId, ctx }) => {
+        await assertCanManageOrganization(organizationId, ctx.user.id)
+
+        const [[row], { plan }] = await Promise.all([
+          db
+            .select({ count: count() })
+            .from(membersTable)
+            .where(eq(membersTable.organizationId, organizationId)),
+          getOrganizationPlan(organizationId)
+        ])
+
+        return { memberCount: row?.count ?? 0, maxMembers: plan.maxMembers }
+      }
+    )
   )