create-ej-app 26.0.0 → 28.0.0

package/template/saas-starter/tests/helpers/fixtures.ts

@@ -0,0 +1,151 @@
+/**
+ * Throwaway DB fixtures and auth helpers for Bun tests.
+ *
+ *   const fx = new Fixtures()
+ *   afterEach(() => fx.cleanup())
+ *   const ws = await fx.workspace({ plan: 'pro' })
+ *   await asUser(ws.owner, () => someAction(...))
+ */
+import { createId } from '@paralleldrive/cuid2'
+import { inArray } from 'drizzle-orm'
+import { db } from '~/db'
+import {
+  fileUploadsTable,
+  membersTable,
+  organizationSubscriptionsTable,
+  organizationsTable,
+  supportTicketsTable,
+  usersTable
+} from '~/db/schema'
+import { runWithAuthSession } from '../setup/preload'
+
+type User = typeof usersTable.$inferSelect
+type PlanId = (typeof organizationSubscriptionsTable.$inferInsert)['plan']
+
+const uid = () =>
+  `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`
+
+export class Fixtures {
+  private userIds: string[] = []
+  private organizationIds: string[] = []
+
+  async user(
+    overrides: { name?: string; email?: string; role?: string | null } = {}
+  ): Promise<User> {
+    const s = uid()
+    const [row] = await db
+      .insert(usersTable)
+      .values({
+        id: `user_${createId()}`,
+        name: overrides.name ?? `Test User ${s}`,
+        email: overrides.email ?? `test+${s}@example.com`,
+        emailVerified: true,
+        role: overrides.role ?? 'user'
+      })
+      .returning()
+    if (!row) throw new Error('Failed to create test user')
+    this.userIds.push(row.id)
+    return row
+  }
+
+  /** Platform user for admin-panel tests. Belongs to no organization. */
+  platformUser(role: 'admin' | 'superadmin') {
+    return this.user({ name: `Platform ${role}`, role })
+  }
+
+  /**
+   * An organization with an owner, an admin, and a member, plus its
+   * subscription row. A paid `plan` gets an active subscription.
+   */
+  async workspace(options: { plan?: PlanId } = {}) {
+    const plan = options.plan ?? 'free'
+    const owner = await this.user({ name: 'Test Owner' })
+    const admin = await this.user({ name: 'Test Admin' })
+    const member = await this.user({ name: 'Test Member' })
+
+    const s = uid()
+    const [organization] = await db
+      .insert(organizationsTable)
+      .values({ name: `Test Organization ${s}`, slug: `test-org-${s}` })
+      .returning()
+    if (!organization) throw new Error('Failed to create test organization')
+    this.organizationIds.push(organization.id)
+
+    await db.insert(membersTable).values([
+      { organizationId: organization.id, userId: owner.id, role: 'owner' },
+      { organizationId: organization.id, userId: admin.id, role: 'admin' },
+      { organizationId: organization.id, userId: member.id, role: 'member' }
+    ])
+
+    await db.insert(organizationSubscriptionsTable).values({
+      organizationId: organization.id,
+      plan,
+      status: plan === 'free' ? 'free' : 'active'
+    })
+
+    return { organization, owner, admin, member }
+  }
+
+  /** Records an upload the way `generateUploadUrl` does, without R2. */
+  async upload(organizationId: string, uploadedBy: string) {
+    const fileId = createId()
+    const [row] = await db
+      .insert(fileUploadsTable)
+      .values({
+        key: `uploads/organizations/${organizationId}/${fileId}.png`,
+        originalName: 'logo.png',
+        mimeType: 'image/png',
+        size: 1024,
+        uploadedBy,
+        organizationId
+      })
+      .returning()
+    if (!row) throw new Error('Failed to create test upload')
+    return row
+  }
+
+  async cleanup() {
+    if (this.organizationIds.length) {
+      // `file_uploads` restricts organization deletes, as in production.
+      await db
+        .delete(fileUploadsTable)
+        .where(inArray(fileUploadsTable.organizationId, this.organizationIds))
+      await db
+        .delete(organizationsTable)
+        .where(inArray(organizationsTable.id, this.organizationIds))
+      this.organizationIds = []
+    }
+    if (this.userIds.length) {
+      await db
+        .delete(supportTicketsTable)
+        .where(inArray(supportTicketsTable.userId, this.userIds))
+      await db.delete(usersTable).where(inArray(usersTable.id, this.userIds))
+      this.userIds = []
+    }
+  }
+}
+
+/** Runs `fn` with `getAuthSession()` returning this user. */
+export function asUser<T>(user: User, fn: () => Promise<T>): Promise<T> {
+  const isSuperAdmin = user.role === 'superadmin'
+  const isAdmin = user.role === 'admin' || isSuperAdmin
+  return runWithAuthSession(
+    {
+      user: {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        role: user.role
+      },
+      session: { id: `test_session_${user.id}`, userId: user.id },
+      isAdmin,
+      isSuperAdmin
+    },
+    fn
+  )
+}
+
+/** Runs `fn` signed out. */
+export function asAnonymous<T>(fn: () => Promise<T>): Promise<T> {
+  return runWithAuthSession(null, fn)
+}

package/template/saas-starter/tests/helpers/index.ts

@@ -0,0 +1,2 @@
+export * from './action'
+export * from './fixtures'

package/template/saas-starter/tests/lib/callback-url.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from 'bun:test'
+import { sanitizeCallbackUrl } from '~/lib/callback-url'
+
+// Everything sanitizeCallbackUrl rejects must be something a browser would
+// resolve off-origin, so each case is checked against URL resolution too.
+const APP_ORIGIN = 'https://app.example.com'
+
+const resolvesOffOrigin = (value: string) =>
+  new URL(value, APP_ORIGIN).origin !== APP_ORIGIN
+
+describe('sanitizeCallbackUrl', () => {
+  test('keeps same-origin paths, including query and hash', () => {
+    expect(sanitizeCallbackUrl('/app')).toBe('/app')
+    expect(sanitizeCallbackUrl('/accept-invitation/inv_abc123')).toBe(
+      '/accept-invitation/inv_abc123'
+    )
+    expect(sanitizeCallbackUrl('/app/orders?status=open#top')).toBe(
+      '/app/orders?status=open#top'
+    )
+  })
+
+  test('rejects values that are not a path', () => {
+    expect(sanitizeCallbackUrl(undefined)).toBeNull()
+    expect(sanitizeCallbackUrl(['/app', '/admin'])).toBeNull()
+    expect(sanitizeCallbackUrl('app')).toBeNull()
+    expect(sanitizeCallbackUrl('https://evil.com')).toBeNull()
+  })
+
+  test('rejects the backslash and double-slash escapes out of the origin', () => {
+    for (const value of ['//evil.com', '/\\evil.com', '/\\\\evil.com']) {
+      expect(resolvesOffOrigin(value)).toBe(true)
+      expect(sanitizeCallbackUrl(value)).toBeNull()
+    }
+  })
+
+  test('rejects tabs and newlines, which URL parsing strips before resolving', () => {
+    for (const value of ['/\t/evil.com', '/\n/evil.com', '/\r/evil.com']) {
+      expect(resolvesOffOrigin(value)).toBe(true)
+      expect(sanitizeCallbackUrl(value)).toBeNull()
+    }
+  })
+
+  test('leaves lookalike hosts on the app origin instead of rejecting them', () => {
+    // These stay same-origin, so they are safe to honour.
+    expect(sanitizeCallbackUrl('/@evil.com')).toBe('/@evil.com')
+    expect(sanitizeCallbackUrl('/%5Cevil.com')).toBe('/%5Cevil.com')
+  })
+})

package/template/saas-starter/tests/lib/client-server-boundary.test.ts

@@ -0,0 +1,57 @@
+/**
+ * Guard: `'use client'` modules must not import server runtime, secrets, or
+ * the database directly. Transitive imports leak too, but this test only reads
+ * each client file's own imports, so review what a new import pulls in.
+ */
+import { describe, expect, test } from 'bun:test'
+import { readdirSync, readFileSync, statSync } from 'node:fs'
+import path from 'node:path'
+
+const SRC = path.resolve(import.meta.dir, '../../src')
+
+/**
+ * Import paths that must never appear in a `'use client'` module. Add every
+ * new server-only lib here.
+ */
+const FORBIDDEN_IMPORT_RE =
+  /from\s+['"](~\/db(?:\/(?:schema|enums|relations|common|index))?|~\/env|~\/lib\/(?:auth|safe-action|storage|email-service|nodemailer|organization-access|plan-limits|plans|billing|stripe)|server-only|drizzle-orm(?:\/[^'"]*)?)['"]/
+
+function walk(dir: string, out: string[] = []): string[] {
+  for (const name of readdirSync(dir)) {
+    if (name === 'node_modules' || name.startsWith('.')) continue
+    const full = path.join(dir, name)
+    if (statSync(full).isDirectory()) walk(full, out)
+    else if (/\.(ts|tsx)$/.test(name)) out.push(full)
+  }
+  return out
+}
+
+describe('client / server boundary', () => {
+  test('no use-client file imports server runtime or db modules', () => {
+    const violations: string[] = []
+
+    for (const file of walk(SRC)) {
+      const source = readFileSync(file, 'utf8')
+      if (
+        !source.includes("'use client'") &&
+        !source.includes('"use client"')
+      ) {
+        continue
+      }
+
+      for (const [index, line] of source.split('\n').entries()) {
+        // Type-only imports are erased, but they are banned too so a later
+        // value import is harder to slip in.
+        if (!FORBIDDEN_IMPORT_RE.test(line)) continue
+        // Explicit client-safe siblings
+        if (line.includes('auth-client')) continue
+        if (line.includes('safe-action-client')) continue
+
+        const rel = path.relative(SRC, file)
+        violations.push(`${rel}:${index + 1}: ${line.trim()}`)
+      }
+    }
+
+    expect(violations).toEqual([])
+  })
+})

package/template/saas-starter/tests/lib/errors.test.ts

@@ -0,0 +1,10 @@
+import { describe, expect, test } from 'bun:test'
+import { isUniqueViolation } from '~/lib/errors'
+
+describe('postgres error codes', () => {
+  test('an error whose cause points back at itself is not a match and does not hang', () => {
+    const error: { message: string; cause?: unknown } = { message: 'loop' }
+    error.cause = error
+    expect(isUniqueViolation(error)).toBe(false)
+  })
+})

package/template/saas-starter/tests/lib/image-url.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from 'bun:test'
+import { canPersistImageValue, isStoredImageValue } from '~/lib/image-url'
+
+const OWN_KEY = 'uploads/organizations/organization_abc123/logo_1.png'
+const DATA_URL = 'data:image/png;base64,iVBORw0KGgo='
+
+describe('stored image values', () => {
+  test('accepts organization upload keys and image data URLs', () => {
+    expect(isStoredImageValue(OWN_KEY)).toBe(true)
+    expect(isStoredImageValue(DATA_URL)).toBe(true)
+  })
+
+  test('rejects external URLs, scripts, other types, and path traversal', () => {
+    for (const value of [
+      'https://example.com/logo.png',
+      'javascript:alert(1)',
+      'data:text/html;base64,PHNjcmlwdD4=',
+      'data:image/svg+xml;base64,PHN2Zz4=',
+      'uploads/organizations/../other/logo.png',
+      'uploads/organizations/organization_abc123/logo.html'
+    ]) {
+      expect(isStoredImageValue(value)).toBe(false)
+    }
+  })
+
+  test('data URLs are stored only while R2 is off', () => {
+    expect(canPersistImageValue(DATA_URL, false)).toBe(true)
+    expect(canPersistImageValue(DATA_URL, true)).toBe(false)
+    expect(canPersistImageValue(OWN_KEY, true)).toBe(true)
+  })
+})

package/template/saas-starter/tests/lib/search.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, test } from 'bun:test'
+import { escapeLikePattern, likeContains } from '~/lib/search'
+
+describe('escapeLikePattern', () => {
+  test('escapes LIKE wildcards and the escape character', () => {
+    expect(escapeLikePattern('%')).toBe('\\%')
+    expect(escapeLikePattern('_')).toBe('\\_')
+    expect(escapeLikePattern('\\')).toBe('\\\\')
+    expect(escapeLikePattern('100%_off\\sale')).toBe('100\\%\\_off\\\\sale')
+  })
+
+  test('leaves ordinary search text unchanged', () => {
+    expect(escapeLikePattern('Quarterly report')).toBe('Quarterly report')
+  })
+})
+
+describe('likeContains', () => {
+  test('wraps an escaped pattern for contains matching', () => {
+    expect(likeContains('report')).toBe('%report%')
+    expect(likeContains('%')).toBe('%\\%%')
+    expect(likeContains('_')).toBe('%\\_%')
+  })
+})

package/template/saas-starter/tests/marketing/contact-and-feedback.test.ts

@@ -0,0 +1,86 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { eq } from 'drizzle-orm'
+import { getContactLeads } from '~/app/(admin)/actions/contact-leads'
+import { getFeedbacks } from '~/app/(admin)/actions/feedbacks'
+import { createFeedbackAction } from '~/app/(app)/actions/feedbacks'
+import { submitContactForm } from '~/app/(marketing)/contact-us/actions'
+import { db } from '~/db'
+import { contactLeadsTable } from '~/db/schema'
+import {
+  asAnonymous,
+  asUser,
+  expectData,
+  expectServerError,
+  expectValidationError,
+  Fixtures
+} from '../helpers'
+
+describe('contact form and feedback inboxes', () => {
+  const fx = new Fixtures()
+  afterEach(async () => {
+    await db
+      .delete(contactLeadsTable)
+      .where(eq(contactLeadsTable.email, 'visitor@example.com'))
+    await fx.cleanup()
+  })
+
+  test('anyone can send the contact form; only admins read the leads', async () => {
+    const sent = await asAnonymous(() =>
+      submitContactForm({
+        name: 'Alex Morgan',
+        email: 'visitor@example.com',
+        subject: 'Pricing',
+        message: 'Do you offer annual invoicing?'
+      })
+    )
+    expectData(sent)
+
+    const user = await fx.user()
+    expectServerError(
+      await asUser(user, () => getContactLeads({ page: 1, limit: 10 })),
+      'permission'
+    )
+
+    const admin = await fx.platformUser('admin')
+    const leads = await asUser(admin, () =>
+      getContactLeads({ page: 1, limit: 50, search: 'visitor@example.com' })
+    )
+    expectData(leads)
+    expect(leads.data[0].map(lead => lead.subject)).toContain('Pricing')
+  })
+
+  test('the contact form rejects a message too short to answer', async () => {
+    const result = await asAnonymous(() =>
+      submitContactForm({
+        name: 'Alex Morgan',
+        email: 'visitor@example.com',
+        subject: 'Hi',
+        message: 'Hi'
+      })
+    )
+    expectValidationError(result)
+  })
+
+  test('admins see member feedback with its organization', async () => {
+    const ws = await fx.workspace()
+    expectData(
+      await asUser(ws.member, () =>
+        createFeedbackAction({
+          organizationId: ws.organization.id,
+          rating: 4,
+          comment: 'Setup took five minutes.'
+        })
+      )
+    )
+
+    const admin = await fx.platformUser('admin')
+    const list = await asUser(admin, () =>
+      getFeedbacks({ page: 1, limit: 50, filters: { rating: [4] } })
+    )
+    expectData(list)
+    const row = list.data[0].find(
+      item => item.organizationId === ws.organization.id
+    )
+    expect(row?.organizationName).toBe(ws.organization.name)
+  })
+})

package/template/saas-starter/tests/organizations/organizations.test.ts

@@ -0,0 +1,175 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { eq } from 'drizzle-orm'
+import { createFeedbackAction } from '~/app/(app)/actions/feedbacks'
+import { getMembers } from '~/app/(app)/actions/members'
+import {
+  getOrganization,
+  transferOrganizationOwnershipAction,
+  updateOrganizationAction
+} from '~/app/(app)/actions/organizations'
+import { db } from '~/db'
+import { membersTable, organizationsTable } from '~/db/schema'
+import {
+  asUser,
+  expectData,
+  expectServerError,
+  expectValidationError,
+  Fixtures
+} from '../helpers'
+
+const PNG_DATA_URL = 'data:image/png;base64,iVBORw0KGgo='
+
+describe('organization access', () => {
+  const fx = new Fixtures()
+  afterEach(() => fx.cleanup())
+
+  test('an outsider gets no data for an organization', async () => {
+    const ws = await fx.workspace()
+    const outsider = await fx.user()
+
+    const result = await asUser(outsider, () =>
+      getOrganization(ws.organization.id)
+    )
+
+    expect(result?.data ?? null).toBeNull()
+  })
+
+  test('members cannot manage settings or list members', async () => {
+    const ws = await fx.workspace()
+
+    const update = await asUser(ws.member, () =>
+      updateOrganizationAction({
+        organizationId: ws.organization.id,
+        name: 'Renamed',
+        slug: 'renamed',
+        logo: ''
+      })
+    )
+    expectServerError(update, 'permission')
+
+    const members = await asUser(ws.member, () =>
+      getMembers({ organizationId: ws.organization.id, page: 1, limit: 10 })
+    )
+    expectServerError(members, 'permission')
+  })
+
+  test('an admin can rename the organization and set a data URL logo without R2', async () => {
+    const ws = await fx.workspace()
+
+    const result = await asUser(ws.admin, () =>
+      updateOrganizationAction({
+        organizationId: ws.organization.id,
+        name: 'Renamed Org',
+        slug: `renamed-${ws.organization.id.slice(-8)}`,
+        logo: PNG_DATA_URL
+      })
+    )
+    expectData(result)
+
+    const org = await db.query.organizationsTable.findFirst({
+      where: eq(organizationsTable.id, ws.organization.id)
+    })
+    expect(org?.name).toBe('Renamed Org')
+    expect(org?.logo).toBe(PNG_DATA_URL)
+  })
+
+  test("an organization cannot use another organization's upload as its logo", async () => {
+    const mine = await fx.workspace()
+    const theirs = await fx.workspace()
+    const foreign = await fx.upload(theirs.organization.id, theirs.owner.id)
+
+    const result = await asUser(mine.owner, () =>
+      updateOrganizationAction({
+        organizationId: mine.organization.id,
+        name: mine.organization.name,
+        slug: mine.organization.slug,
+        logo: foreign.key
+      })
+    )
+    expectServerError(result, 'permission')
+  })
+
+  test('external image URLs are rejected before the action runs', async () => {
+    const ws = await fx.workspace()
+
+    const result = await asUser(ws.owner, () =>
+      updateOrganizationAction({
+        organizationId: ws.organization.id,
+        name: ws.organization.name,
+        slug: ws.organization.slug,
+        logo: 'https://example.com/logo.png'
+      })
+    )
+    expectValidationError(result)
+  })
+
+  test('a duplicate slug returns a message you can act on', async () => {
+    const mine = await fx.workspace()
+    const theirs = await fx.workspace()
+
+    const result = await asUser(mine.owner, () =>
+      updateOrganizationAction({
+        organizationId: mine.organization.id,
+        name: mine.organization.name,
+        slug: theirs.organization.slug,
+        logo: ''
+      })
+    )
+    expectServerError(result, 'slug')
+  })
+
+  test('only the owner can transfer ownership, and they become an admin', async () => {
+    const ws = await fx.workspace()
+    const adminMembership = await db.query.membersTable.findFirst({
+      where: eq(membersTable.userId, ws.admin.id)
+    })
+
+    const byAdmin = await asUser(ws.admin, () =>
+      transferOrganizationOwnershipAction({
+        organizationId: ws.organization.id,
+        targetMemberId: adminMembership!.id
+      })
+    )
+    expectServerError(byAdmin, 'permission')
+
+    const byOwner = await asUser(ws.owner, () =>
+      transferOrganizationOwnershipAction({
+        organizationId: ws.organization.id,
+        targetMemberId: adminMembership!.id
+      })
+    )
+    expectData(byOwner)
+
+    const roles = await db
+      .select({ userId: membersTable.userId, role: membersTable.role })
+      .from(membersTable)
+      .where(eq(membersTable.organizationId, ws.organization.id))
+    const roleOf = (userId: string) =>
+      roles.find(row => row.userId === userId)?.role
+    expect(roleOf(ws.admin.id)).toBe('owner')
+    expect(roleOf(ws.owner.id)).toBe('admin')
+  })
+
+  test('feedback requires membership in the organization', async () => {
+    const ws = await fx.workspace()
+    const outsider = await fx.user()
+
+    const denied = await asUser(outsider, () =>
+      createFeedbackAction({
+        organizationId: ws.organization.id,
+        rating: 5,
+        comment: 'Looks great.'
+      })
+    )
+    expectServerError(denied, 'access')
+
+    const allowed = await asUser(ws.member, () =>
+      createFeedbackAction({
+        organizationId: ws.organization.id,
+        rating: 4,
+        comment: 'Looks great.'
+      })
+    )
+    expectData(allowed)
+  })
+})

package/template/saas-starter/tests/setup/pglite-db.ts

@@ -0,0 +1,67 @@
+/**
+ * In-memory Postgres for Bun tests via Electric PGlite (WASM).
+ *
+ * One instance per Bun worker process:
+ *   1. Start PGlite
+ *   2. pushSchema from Drizzle table definitions
+ *   3. Install functions and triggers (same as production setup-db)
+ */
+import { PGlite } from '@electric-sql/pglite'
+import { pushSchema } from 'drizzle-kit/api'
+import { drizzle, type PgliteDatabase } from 'drizzle-orm/pglite'
+import * as relations from '~/db/relations'
+import * as schema from '~/db/schema'
+import { setupDatabase } from '~/scripts/setup-db'
+
+const fullSchema = { ...schema, ...relations }
+
+type TestDatabase = PgliteDatabase<typeof fullSchema>
+
+let initPromise: Promise<TestDatabase> | null = null
+
+async function bootstrap(): Promise<TestDatabase> {
+  // PGlite's Emscripten runtime sets process.exitCode to 99 via proc_exit on
+  // the first WASM query. bun test then exits with that code even when every
+  // assertion passed. Snapshot first, restore only the spurious 99, and leave
+  // any real non-zero code alone.
+  const exitCodeBeforePglite = process.exitCode
+
+  const client = new PGlite()
+  const db = drizzle({ client, schema: fullSchema })
+
+  const { apply, warnings, hasDataLoss } = await pushSchema(
+    schema,
+    db as unknown as Parameters<typeof pushSchema>[1]
+  )
+  if (warnings.length) {
+    console.warn('[pglite] schema push warnings:', warnings)
+  }
+  if (hasDataLoss) {
+    throw new Error(
+      '[pglite] schema push reported data loss on a fresh database. Aborting.'
+    )
+  }
+  await apply()
+
+  await setupDatabase(db as unknown as Parameters<typeof setupDatabase>[0])
+
+  if (process.exitCode === 99) {
+    process.exitCode =
+      exitCodeBeforePglite !== undefined && exitCodeBeforePglite !== 99
+        ? exitCodeBeforePglite
+        : 0
+  }
+
+  return db
+}
+
+/**
+ * Idempotent: first call boots PGlite + schema; later calls return the same db.
+ * Safe to await from preload (once per worker).
+ */
+export function initPgliteDatabase(): Promise<TestDatabase> {
+  if (!initPromise) {
+    initPromise = bootstrap()
+  }
+  return initPromise
+}