create-vexcms 0.0.19 → 0.1.0-alpha.2

package/templates/base-nextjs/convex/vex/firstUser.ts

@@ -6,27 +6,23 @@ import { TABLE_SLUG_USERS } from "~/db/constants"
 import { USER_ROLES } from "~/db/constants/auth"
 
 /**
- * Check if the admin panel has been bootstrapped (at least one admin exists).
- * Used by the landing page to determine whether to show "Sign Up" or "Sign In".
+ * Check whether the admin panel has been bootstrapped (at least one admin
+ * exists). Used by `WelcomePage` to decide between "Sign Up" and "Sign In".
  */
 export const isBootstrapped = query({
   args: {},
   handler: async (ctx) => {
     const allUsers = await ctx.db.query(TABLE_SLUG_USERS).collect()
-
-    return allUsers.some((user) => {
-      const roles = user.role ?? []
-      return roles.includes(USER_ROLES.admin)
-    })
+    return allUsers.some((user) => user.roles?.includes(USER_ROLES.admin))
   },
 })
 
 /**
- * Promote the current user to admin if no admin exists yet.
- * Called after the first user signs up.
+ * Promote the current user to admin if no admin exists yet. Called after the
+ * first user signs up.
  *
- * Convex mutations are serialized, so two simultaneous signups
- * cannot both become admin — the second will see the first's promotion.
+ * Convex mutations are serialized, so two simultaneous signups cannot both
+ * become admin — the second observes the first's promotion and no-ops.
  */
 export const promoteFirstAdmin = mutation({
   args: {},
@@ -36,7 +32,6 @@ export const promoteFirstAdmin = mutation({
       throw new ConvexError("Not authenticated")
     }
 
-    // Find the current user by email
     const currentUser = await ctx.db
       .query(TABLE_SLUG_USERS)
       .withIndex("by_email", (q) => q.eq("email", identity.email!))
@@ -46,89 +41,20 @@ export const promoteFirstAdmin = mutation({
       throw new ConvexError("User not found")
     }
 
-    // Check if any user already has admin role
     const allUsers = await ctx.db.query(TABLE_SLUG_USERS).collect()
-    const hasAdmin = allUsers.some((user) => {
-      const roles = user.role ?? []
-      return roles.includes(USER_ROLES.admin)
-    })
+    const hasAdmin = allUsers.some((user) => user.roles?.includes(USER_ROLES.admin))
 
     if (hasAdmin) {
       return { promoted: false }
     }
 
-    // Promote this user to admin
-    const currentRoles = currentUser.role ?? []
+    const currentRoles = currentUser.roles ?? []
     if (!currentRoles.includes(USER_ROLES.admin)) {
       await ctx.db.patch(currentUser._id, {
-        role: [...currentRoles, USER_ROLES.admin],
+        roles: [...currentRoles, USER_ROLES.admin],
       })
     }
 
     return { promoted: true }
   },
 })
-
-/**
- * Get the onboarding completion status for a user.
- */
-export const getOnboardingStatus = query({
-  args: {},
-  handler: async (ctx) => {
-    const identity = await ctx.auth.getUserIdentity()
-    if (!identity?.email) return { complete: false }
-
-    const user = await ctx.db
-      .query(TABLE_SLUG_USERS)
-      .withIndex("by_email", (q) => q.eq("email", identity.email!))
-      .first()
-
-    if (!user) return { complete: false }
-
-    return { complete: !!(user as any).vex_onboarding_complete }
-  },
-})
-
-/**
- * Mark the onboarding tour as complete for the current user.
- */
-export const completeOnboarding = mutation({
-  args: {},
-  handler: async (ctx) => {
-    const identity = await ctx.auth.getUserIdentity()
-    if (!identity?.email) return
-
-    const user = await ctx.db
-      .query(TABLE_SLUG_USERS)
-      .withIndex("by_email", (q) => q.eq("email", identity.email!))
-      .first()
-
-    if (!user) return
-
-    await ctx.db.patch(user._id, {
-      vex_onboarding_complete: true,
-    } as any)
-  },
-})
-
-/**
- * Reset the onboarding tour for the current user (restart tour).
- */
-export const resetOnboarding = mutation({
-  args: {},
-  handler: async (ctx) => {
-    const identity = await ctx.auth.getUserIdentity()
-    if (!identity?.email) return
-
-    const user = await ctx.db
-      .query(TABLE_SLUG_USERS)
-      .withIndex("by_email", (q) => q.eq("email", identity.email!))
-      .first()
-
-    if (!user) return
-
-    await ctx.db.patch(user._id, {
-      vex_onboarding_complete: false,
-    } as any)
-  },
-})

package/templates/base-nextjs/convex/vex/globals.ts

@@ -1,82 +1,19 @@
-import type { DataModel } from "@convex/_generated/dataModel"
-import type { TableNamesInDataModel } from "convex/server"
-
-import { query } from "@convex/_generated/server"
-import { getPreviewSnapshot } from "@vexcms/core"
-import { v } from "convex/values"
-
-import config from "../../vex.config"
-import * as Versions from "./model/versions"
-
-/**
- * Get the single document for a global, with draft awareness.
- *
- * - No _vexDrafts or _vexDrafts: false → returns the published document
- * - _vexDrafts: true → returns the latest version (draft or published)
- * - _vexDrafts: "snapshot" → overlays the preview snapshot on the document
- */
-export const get = query({
-  args: {
-    globalSlug: v.string(),
-    _vexDrafts: v.optional(v.union(v.literal("snapshot"), v.boolean())),
-  },
-  handler: async (ctx, { globalSlug, _vexDrafts }) => {
-    const doc = await ctx.db
-      .query(globalSlug as TableNamesInDataModel<DataModel>)
-      .first()
-
-    if (!doc) return null
-
-    const documentId = doc._id as string
-
-    // Check if this global has versioning enabled
-    const globalDef = config.globals?.find((g) => g.slug === globalSlug)
-    const isVersioned = !!globalDef?.versions?.drafts
-
-    // If draft mode is "snapshot", overlay the preview snapshot
-    if (_vexDrafts === "snapshot") {
-      const snapshot = await getPreviewSnapshot<DataModel>({
-        ctx,
-        collection: globalSlug,
-        documentId,
-      })
-
-      if (snapshot) {
-        return {
-          ...doc,
-          ...(snapshot as Record<string, unknown>),
-          _id: doc._id,
-          _creationTime: doc._creationTime,
-        }
-      }
-    }
-
-    // If versioned and draft-aware, return the latest version's snapshot
-    if (isVersioned && _vexDrafts !== false) {
-      const latestVersion = await Versions.getLatestVersion<DataModel>({
-        ctx,
-        collection: globalSlug,
-        documentId,
-      })
-
-      if (latestVersion) {
-        return {
-          _id: doc._id,
-          ...(latestVersion.snapshot as Record<string, unknown>),
-          vex_status: (latestVersion as any).status ?? (doc as any).vex_status ?? "draft",
-          vex_version: latestVersion.version,
-          vex_publishedAt: (doc as any).vex_publishedAt,
-          _creationTime: doc._creationTime,
-        }
-      }
-
-      // No versions yet — treat as published
-      const raw = doc as Record<string, unknown>
-      if (!raw.vex_status) {
-        raw.vex_status = "published"
-      }
-    }
-
-    return doc
-  },
-})
+import { createGetAuth } from "@vexcms/better-auth";
+import { globalsApi } from "@vexcms/core/server";
+
+import { TABLE_SLUG_ORGANIZATIONS, TABLE_SLUG_SESSIONS, TABLE_SLUG_USERS } from "~/db/constants";
+import config from "~/vex.config";
+
+import { mutation, query } from "../_generated/server";
+
+export const { get, find, upsert } = globalsApi({
+  config,
+  query,
+  mutation,
+  getAuth: createGetAuth({
+    orgCollectionSlug: TABLE_SLUG_ORGANIZATIONS,
+    userCollectionSlug: TABLE_SLUG_USERS,
+    sessionCollectionSlug: TABLE_SLUG_SESSIONS,
+    resolveOrgs: true,
+  }),
+});

package/templates/base-nextjs/convex/vex/media.ts

@@ -1,246 +1,19 @@
-import type { DataModel } from "@convex/_generated/dataModel"
-import type { GenericQueryCtx, TableNamesInDataModel } from "convex/server"
-
-import { ConvexError } from "convex/values"
-import { mutation, query, action } from "@convex/_generated/server"
-import { paginationOptsValidator } from "convex/server"
-import { v } from "convex/values"
-
-import { findCollectionBySlug, hasPermission } from "@vexcms/core"
-import { TABLE_SLUG_USERS } from "~/db/constants"
-import config from "../../vex.config"
-import { access } from "../../src/vexcms/access"
-
-import * as Media from "./model/media"
-
-async function getUser(ctx: GenericQueryCtx<DataModel>) {
-  const identity = await ctx.auth.getUserIdentity()
-  if (!identity?.email) return null
-
-  const user = await ctx.db
-    .query(TABLE_SLUG_USERS)
-    .withIndex("by_email", (q) => q.eq("email", identity.email!))
-    .first()
-
-  if (!user) return null
-
-  return {
-    user: user as Record<string, unknown>,
-    roles: (user.role as string[]) ?? [],
-  }
-}
-
-async function requireUser(ctx: GenericQueryCtx<DataModel>) {
-  const result = await getUser(ctx)
-  if (!result) {
-    throw new ConvexError("Not authenticated")
-  }
-  return result
-}
-
-function checkPermission(props: Parameters<typeof hasPermission>[0]) {
-  const result = hasPermission(props)
-  const denied =
-    result === false ||
-    (typeof result === "object" && !Object.values(result).some(Boolean))
-
-  if (denied) {
-    const grantingRoles: string[] = []
-    if (props.access) {
-      for (const role of props.access.roles) {
-        const check = hasPermission({ ...props, userRoles: [role] })
-        const allowed =
-          check === true ||
-          (typeof check === "object" && Object.values(check).some(Boolean))
-        if (allowed) grantingRoles.push(role)
-      }
-    }
-
-    const rolesHint =
-      grantingRoles.length > 0
-        ? ` Requires one of: ${grantingRoles.join(", ")}`
-        : ""
-    throw new ConvexError(
-      `Access denied: "${props.action}" on "${props.resource}".${rolesHint}`,
-    )
-  }
-
-  return result
-}
-
-export const generateUploadUrl = mutation({
-  args: {},
-  handler: async (ctx) => {
-    return await ctx.storage.generateUploadUrl()
-  },
-})
-
-export const createMediaDocument = mutation({
-  args: {
-    collectionSlug: v.string(),
-    fields: v.any(),
-  },
-  handler: async (ctx, { collectionSlug, fields }) => {
-    const match = findCollectionBySlug({ slug: collectionSlug, config })
-    if (!match) {
-      throw new ConvexError(`Collection not found: ${collectionSlug}`)
-    }
-
-    const { user, roles } = await requireUser(ctx)
-
-    checkPermission({
-      access,
-      user,
-      userRoles: roles,
-      resource: collectionSlug,
-      action: "create",
-      data: fields as Record<string, unknown>,
-    })
-
-    return await Media.createMediaDocument<DataModel>({
-      ctx,
-      args: {
-        collectionSlug: collectionSlug as TableNamesInDataModel<DataModel>,
-        fields: fields as Record<string, unknown>,
-        collectionFields: match.fields,
-      },
-    })
-  },
-})
-
-export const paginatedSearchDocuments = query({
-  args: {
-    collectionSlug: v.string(),
-    searchIndexName: v.string(),
-    searchField: v.string(),
-    query: v.string(),
-    paginationOpts: paginationOptsValidator,
-  },
-  handler: async (ctx, { collectionSlug, searchIndexName, searchField, query: searchQuery, paginationOpts }) => {
-    const result = await Media.paginatedSearchDocuments<DataModel>({
-      args: {
-        collectionSlug: collectionSlug as TableNamesInDataModel<DataModel>,
-        searchIndexName,
-        searchField,
-        query: searchQuery,
-        paginationOpts,
-      },
-      ctx,
-    })
-
-    // Filter by read permission if user is authenticated
-    const auth = await getUser(ctx)
-    if (!auth) return result
-
-    const filteredPage = result.page.filter((doc: Record<string, unknown>) => {
-      const readAllowed = hasPermission({
-        access,
-        user: auth.user,
-        userRoles: auth.roles,
-        resource: collectionSlug,
-        action: "read",
-        data: doc,
-      })
-      return readAllowed === true
-    })
-
-    return { ...result, page: filteredPage }
-  },
-})
-
-/**
- * Downloads a file from a URL and stores it in Convex storage.
- * Returns storageId + file metadata for the client to create a media document.
- */
-export const downloadAndStoreUrl = action({
-  args: {
-    url: v.string(),
-    maxSize: v.number(),
-  },
-  handler: async (ctx, { url, maxSize }) => {
-    // 1. Validate URL
-    let parsedUrl: URL
-    try {
-      parsedUrl = new URL(url)
-    } catch {
-      throw new ConvexError("Invalid URL")
-    }
-
-    // 2. Fetch with timeout
-    const controller = new AbortController()
-    const timeoutId = setTimeout(() => controller.abort(), 30000)
-
-    let response: Response
-    try {
-      response = await fetch(parsedUrl.href, { signal: controller.signal })
-    } catch (err: any) {
-      clearTimeout(timeoutId)
-      if (err.name === "AbortError") {
-        throw new ConvexError("URL fetch timed out")
-      }
-      throw new ConvexError(`Failed to fetch URL: ${err.message}`)
-    } finally {
-      clearTimeout(timeoutId)
-    }
-
-    if (!response.ok) {
-      throw new ConvexError(`Failed to fetch URL: ${response.statusText}`)
-    }
-
-    // 3. Reject HTML
-    const contentType = response.headers.get("Content-Type") || ""
-    if (contentType.includes("text/html")) {
-      throw new ConvexError("URL points to an HTML page, not a file")
-    }
-
-    // 4. Read body and check size
-    const arrayBuffer = await response.arrayBuffer()
-    if (arrayBuffer.byteLength > maxSize) {
-      throw new ConvexError(
-        `File size (${arrayBuffer.byteLength} bytes) exceeds maximum allowed (${maxSize} bytes)`,
-      )
-    }
-
-    // 5. Extract filename
-    let filename = "download"
-    try {
-      const pathname = decodeURIComponent(parsedUrl.pathname)
-      const segments = pathname.split("/").filter(Boolean)
-      if (segments.length > 0) {
-        const lastSegment = segments[segments.length - 1]
-        // Strip query-like suffixes that might leak through
-        const clean = lastSegment.split("?")[0].split("#")[0]
-        if (clean) filename = clean
-      }
-    } catch {
-      // Keep default filename
-    }
-
-    // Check Content-Disposition for filename
-    const disposition = response.headers.get("Content-Disposition")
-    if (disposition) {
-      const filenameMatch = disposition.match(/filename\*?=(?:UTF-8'')?["']?([^"';\n]+)/i)
-      if (filenameMatch?.[1]) {
-        filename = decodeURIComponent(filenameMatch[1].trim())
-      }
-    }
-
-    // 6. Extract mimeType
-    let mimeType = "application/octet-stream"
-    if (contentType) {
-      mimeType = contentType.split(";")[0].trim()
-    }
-
-    // 7. Store in Convex storage
-    const blob = new Blob([arrayBuffer], { type: mimeType })
-    const storageId = await ctx.storage.store(blob)
-
-    // 8. Return metadata
-    return {
-      storageId: storageId as string,
-      filename,
-      mimeType,
-      size: arrayBuffer.byteLength,
-    }
-  },
-})
+import { createGetAuth } from "@vexcms/better-auth";
+import { mediaApi } from "@vexcms/core";
+
+import { TABLE_SLUG_ORGANIZATIONS, TABLE_SLUG_SESSIONS, TABLE_SLUG_USERS } from "~/db/constants";
+import config from "~/vex.config";
+
+import { mutation, query } from "../_generated/server";
+
+export const { getUrl, generateUploadUrl, createMediaDocument, deleteMedia } = mediaApi({
+  config,
+  query,
+  mutation,
+  getAuth: createGetAuth({
+    orgCollectionSlug: TABLE_SLUG_ORGANIZATIONS,
+    userCollectionSlug: TABLE_SLUG_USERS,
+    sessionCollectionSlug: TABLE_SLUG_SESSIONS,
+    resolveOrgs: true,
+  }),
+});

package/templates/base-nextjs/convex/vex.schema.ts

@@ -0,0 +1,138 @@
+// ⚠️ AUTO-GENERATED BY VEX CMS — DO NOT EDIT ⚠️
+// Run 'vex dev' or 'vex generate' to update this file.
+
+import { defineTable } from "convex/server"
+import { v } from "convex/values"
+
+export const user = defineTable({
+  name: v.string(),
+  email: v.string(),
+  emailVerified: v.boolean(),
+  image: v.optional(v.string()),
+  createdAt: v.number(),
+  updatedAt: v.number(),
+  role: v.optional(v.string()),
+  banned: v.optional(v.boolean()),
+  banReason: v.optional(v.string()),
+  banExpires: v.optional(v.number()),
+  isAnonymous: v.optional(v.boolean()),
+  userId: v.optional(v.string()),
+  roles: v.array(v.string()),
+}).index("by_email", ["email"])
+
+export const session = defineTable({
+  expiresAt: v.number(),
+  token: v.string(),
+  createdAt: v.number(),
+  updatedAt: v.number(),
+  ipAddress: v.optional(v.string()),
+  userAgent: v.optional(v.string()),
+  userId: v.string(),
+  impersonatedBy: v.optional(v.string()),
+  activeOrganizationId: v.optional(v.string()),
+})
+  .index("by_token", ["token"])
+  .index("by_userId", ["userId"])
+
+export const account = defineTable({
+  accountId: v.string(),
+  providerId: v.string(),
+  userId: v.string(),
+  accessToken: v.optional(v.string()),
+  refreshToken: v.optional(v.string()),
+  idToken: v.optional(v.string()),
+  accessTokenExpiresAt: v.optional(v.number()),
+  refreshTokenExpiresAt: v.optional(v.number()),
+  scope: v.optional(v.string()),
+  password: v.optional(v.string()),
+  createdAt: v.number(),
+  updatedAt: v.number(),
+}).index("by_userId", ["userId"])
+
+export const verification = defineTable({
+  identifier: v.string(),
+  value: v.string(),
+  expiresAt: v.number(),
+  createdAt: v.number(),
+  updatedAt: v.number(),
+}).index("by_identifier", ["identifier"])
+
+export const apikey = defineTable({
+  configId: v.string(),
+  name: v.optional(v.string()),
+  start: v.optional(v.string()),
+  referenceId: v.string(),
+  prefix: v.optional(v.string()),
+  key: v.string(),
+  refillInterval: v.optional(v.number()),
+  refillAmount: v.optional(v.number()),
+  lastRefillAt: v.optional(v.number()),
+  enabled: v.optional(v.boolean()),
+  rateLimitEnabled: v.optional(v.boolean()),
+  rateLimitTimeWindow: v.optional(v.number()),
+  rateLimitMax: v.optional(v.number()),
+  requestCount: v.optional(v.number()),
+  remaining: v.optional(v.number()),
+  lastRequest: v.optional(v.number()),
+  expiresAt: v.optional(v.number()),
+  createdAt: v.number(),
+  updatedAt: v.number(),
+  permissions: v.optional(v.string()),
+  metadata: v.optional(v.string()),
+})
+  .index("by_configId", ["configId"])
+  .index("by_referenceId", ["referenceId"])
+  .index("by_key", ["key"])
+
+export const jwks = defineTable({
+  publicKey: v.string(),
+  privateKey: v.string(),
+  createdAt: v.number(),
+  expiresAt: v.optional(v.number()),
+})
+
+export const organization = defineTable({
+  name: v.string(),
+  slug: v.string(),
+  logo: v.optional(v.string()),
+  createdAt: v.number(),
+  metadata: v.optional(v.string()),
+}).index("by_slug", ["slug"])
+
+export const member = defineTable({
+  organizationId: v.string(),
+  userId: v.string(),
+  role: v.string(),
+  createdAt: v.number(),
+})
+  .index("by_organizationId", ["organizationId"])
+  .index("by_userId", ["userId"])
+
+export const invitation = defineTable({
+  organizationId: v.string(),
+  email: v.string(),
+  role: v.optional(v.string()),
+  status: v.string(),
+  expiresAt: v.number(),
+  createdAt: v.number(),
+  inviterId: v.string(),
+})
+  .index("by_organizationId", ["organizationId"])
+  .index("by_email", ["email"])
+
+export const images = defineTable({
+  filename: v.string(),
+  alt: v.string(),
+  mimeType: v.string(),
+  size: v.number(),
+  storageId: v.string(),
+  deleted: v.optional(v.boolean()),
+  src: v.string(),
+  width: v.optional(v.number()),
+  height: v.optional(v.number()),
+})
+  .index("by_deleted", ["deleted"])
+  .searchIndex("search_filename", {
+    searchField: "filename",
+    filterFields: ["alt"],
+  })

package/templates/base-nextjs/convex/vex.ts

@@ -0,0 +1,19 @@
+import { createGetAuth } from "@vexcms/better-auth";
+import { collectionsApi } from "@vexcms/core/server";
+
+import { TABLE_SLUG_ORGANIZATIONS, TABLE_SLUG_SESSIONS, TABLE_SLUG_USERS } from "~/db/constants";
+import config from "~/vex.config";
+
+import { mutation, query } from "./_generated/server";
+
+export const { find, get, search, create, update, remove } = collectionsApi({
+  config,
+  query,
+  mutation,
+  getAuth: createGetAuth({
+    orgCollectionSlug: TABLE_SLUG_ORGANIZATIONS,
+    userCollectionSlug: TABLE_SLUG_USERS,
+    sessionCollectionSlug: TABLE_SLUG_SESSIONS,
+    resolveOrgs: true,
+  }),
+});

package/templates/base-nextjs/convex.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "./node_modules/convex/schemas/convex.schema.json",
+  "node": {
+    "externalPackages": ["*"]
+  }
+}