create-vexcms 0.0.20 → 0.1.0-alpha.2

package/templates/base-nextjs/convex/auth/db.ts

@@ -1,303 +1,45 @@
-import type { BetterAuthDBSchema } from "better-auth/db"
-import type { GenericId } from "convex/values"
+import { internalMutation, internalQuery } from "@convex/_generated/server"
+import { authDbApi } from "@vexcms/better-auth"
 
-import { v } from "convex/values"
-
-import type { WhereClause } from "./adapter/utils"
-
-import { internalMutation, internalQuery } from "../_generated/server"
 import schema from "../schema"
-import { checkUniqueFields, listOne, paginate, selectFields } from "./adapter/utils"
-
-// Helper to get Better Auth schema - we'll pass it from the adapter
-const getBetterAuthSchema = (schemaJson: string): BetterAuthDBSchema => {
-  return JSON.parse(schemaJson)
-}
-
-// Create (insert) operation
-export const dbCreate = internalMutation({
-  args: {
-    betterAuthSchema: v.string(),
-    data: v.any(),
-    model: v.string(),
-    select: v.optional(v.array(v.string())),
-  },
-  handler: async (ctx, { betterAuthSchema, data, model, select }) => {
-    const authSchema = getBetterAuthSchema(betterAuthSchema)
-
-    // Check unique fields before insert
-    await checkUniqueFields(ctx, schema, authSchema, model, data)
-
-    const id = await ctx.db.insert(model as any, data)
-    const doc = await ctx.db.get(id)
-    if (!doc) {
-      throw new Error(`Failed to create ${model}`)
-    }
-
-    return selectFields(doc, select)
-  },
-})
-
-// Find one operation
-export const dbFindOne = internalQuery({
-  args: {
-    betterAuthSchema: v.string(),
-    model: v.string(),
-    select: v.optional(v.array(v.string())),
-    where: v.array(v.any()),
-  },
-  handler: async (ctx, { betterAuthSchema, model, select, where }) => {
-    const authSchema = getBetterAuthSchema(betterAuthSchema)
-    // @ts-expect-error GenericCtx type is a superset
-    const result = await listOne(ctx, schema, authSchema, {
-      model,
-      select,
-      where: where as WhereClause[],
-    })
-
-    return result
-  },
-})
-
-// Find many operation
-export const dbFindMany = internalQuery({
-  args: {
-    betterAuthSchema: v.string(),
-    limit: v.optional(v.number()),
-    model: v.string(),
-    sortBy: v.optional(
-      v.object({
-        direction: v.union(v.literal("asc"), v.literal("desc")),
-        field: v.string(),
-      })
-    ),
-    where: v.optional(v.array(v.any())),
-  },
-  handler: async (ctx, { betterAuthSchema, limit, model, sortBy, where }) => {
-    const authSchema = getBetterAuthSchema(betterAuthSchema)
-    const parsedWhere = (where ?? []) as WhereClause[]
-
-    // Handle OR connector by running parallel queries
-    if (parsedWhere.some((w) => w.connector === "OR")) {
-      const results = await Promise.all(
-        parsedWhere.map(async (w) => {
-          // @ts-expect-error GenericCtx type is a superset
-          const result = await paginate(ctx, schema, authSchema, {
-            model,
-            paginationOpts: { cursor: null, numItems: limit ?? 200 },
-            sortBy,
-            where: [w],
-          })
-          return result.page
-        })
-      )
-
-      // De-duplicate and flatten
-      const seen = new Set<string>()
-      const uniqueDocs: any[] = []
-      for (const docs of results) {
-        for (const doc of docs) {
-          const docId = doc._id as string
-          if (!seen.has(docId)) {
-            seen.add(docId)
-            uniqueDocs.push(doc)
-          }
-        }
-      }
-
-      // Apply sorting if needed
-      if (sortBy) {
-        uniqueDocs.sort((a, b) => {
-          const aVal = a[sortBy.field]
-          const bVal = b[sortBy.field]
-          if (aVal === bVal) {
-            return 0
-          }
-          const comparison = aVal > bVal ? 1 : -1
-          return sortBy.direction === "desc" ? -comparison : comparison
-        })
-      }
-
-      return uniqueDocs.slice(0, limit)
-    }
-
-    // Normal case without OR
-    // @ts-expect-error GenericCtx type is a superset
-    const result = await paginate(ctx, schema, authSchema, {
-      model,
-      paginationOpts: { cursor: null, numItems: limit ?? 200 },
-      sortBy,
-      where: parsedWhere,
-    })
-
-    return result.page
-  },
-})
-
-// Count operation
-export const dbCount = internalQuery({
-  args: {
-    betterAuthSchema: v.string(),
-    model: v.string(),
-    where: v.optional(v.array(v.any())),
-  },
-  handler: async (ctx, { betterAuthSchema, model, where }) => {
-    const authSchema = getBetterAuthSchema(betterAuthSchema)
-    const parsedWhere = (where ?? []) as WhereClause[]
-
-    // Handle OR connector
-    if (parsedWhere.some((w) => w.connector === "OR")) {
-      const results = await Promise.all(
-        parsedWhere.map(async (w) => {
-          // @ts-expect-error GenericCtx type is a superset
-          const result = await paginate(ctx, schema, authSchema, {
-            model,
-            paginationOpts: { cursor: null, numItems: 200 },
-            where: [w],
-          })
-          return result.page
-        })
-      )
-
-      // De-duplicate and count
-      const seen = new Set<string>()
-      for (const docs of results) {
-        for (const doc of docs) {
-          const docId = doc._id as string
-          seen.add(docId)
-        }
-      }
-      return seen.size
-    }
-
-    // Normal case
-    // @ts-expect-error GenericCtx type is a superset
-    const result = await paginate(ctx, schema, authSchema, {
-      model,
-      paginationOpts: { cursor: null, numItems: 200 },
-      where: parsedWhere,
-    })
-
-    return result.page.length
-  },
-})
-
-// Update operation
-export const dbUpdate = internalMutation({
-  args: {
-    betterAuthSchema: v.string(),
-    model: v.string(),
-    update: v.any(),
-    where: v.array(v.any()),
-  },
-  handler: async (ctx, { betterAuthSchema, model, update, where }) => {
-    const authSchema = getBetterAuthSchema(betterAuthSchema)
-    const parsedWhere = where as WhereClause[]
-
-    // Find the document to update
-    const doc = await listOne(ctx, schema, authSchema, {
-      model,
-      where: parsedWhere,
-    })
-
-    if (!doc) {
-      return null
-    }
-
-    // Check unique fields before update
-    await checkUniqueFields(ctx, schema, authSchema, model, update, doc)
-
-    await ctx.db.patch(doc._id as GenericId<any>, update)
-    return await ctx.db.get(doc._id as GenericId<any>)
-  },
-})
-
-// Update many operation
-export const dbUpdateMany = internalMutation({
-  args: {
-    betterAuthSchema: v.string(),
-    model: v.string(),
-    update: v.any(),
-    where: v.array(v.any()),
-  },
-  handler: async (ctx, { betterAuthSchema, model, update, where }) => {
-    const authSchema = getBetterAuthSchema(betterAuthSchema)
-    const parsedWhere = where as WhereClause[]
-
-    const result = await paginate(ctx, schema, authSchema, {
-      model,
-      paginationOpts: { cursor: null, numItems: 200 },
-      where: parsedWhere,
-    })
-
-    // Check unique fields if updating multiple docs
-    if (result.page.length > 1) {
-      const uniqueFieldKeys = Object.keys(update).filter(
-        (key) => authSchema[model]?.fields?.[key]?.unique
-      )
-      if (uniqueFieldKeys.length > 0) {
-        throw new Error(
-          `Attempted to set unique fields in multiple documents in ${model} with the same value. Fields: ${uniqueFieldKeys.join(", ")}`
-        )
-      }
-    }
-
-    // Update each document
-    for (const doc of result.page) {
-      await checkUniqueFields(ctx, schema, authSchema, model, update, doc)
-      await ctx.db.patch(doc._id as GenericId<any>, update)
-    }
-
-    return result.page.length
-  },
-})
-
-// Delete operation
-export const dbDelete = internalMutation({
-  args: {
-    betterAuthSchema: v.string(),
-    model: v.string(),
-    where: v.array(v.any()),
-  },
-  handler: async (ctx, { betterAuthSchema, model, where }) => {
-    const authSchema = getBetterAuthSchema(betterAuthSchema)
-    const parsedWhere = where as WhereClause[]
-
-    const doc = await listOne(ctx, schema, authSchema, {
-      model,
-      where: parsedWhere,
-    })
-
-    if (!doc) {
-      return
-    }
-
-    await ctx.db.delete(doc._id as GenericId<any>)
-  },
-})
-
-// Delete many operation
-export const dbDeleteMany = internalMutation({
-  args: {
-    betterAuthSchema: v.string(),
-    model: v.string(),
-    where: v.array(v.any()),
-  },
-  handler: async (ctx, { betterAuthSchema, model, where }) => {
-    const authSchema = getBetterAuthSchema(betterAuthSchema)
-    const parsedWhere = where as WhereClause[]
-
-    const result = await paginate(ctx, schema, authSchema, {
-      model,
-      paginationOpts: { cursor: null, numItems: 200 },
-      where: parsedWhere,
-    })
-
-    // Delete each document
-    for (const doc of result.page) {
-      await ctx.db.delete(doc._id as GenericId<any>)
-    }
 
-    return result.page.length
-  },
-})
+/**
+ * Convex internal mutations and queries that implement Better Auth's DB interface.
+ *
+ * Wire these into your Convex schema so `@vexcms/better-auth` can call them
+ * via `ctx.runMutation(anyApi.auth.db.dbCreate, ...)`:
+ *
+ * ```ts
+ * // convex/schema.ts
+ * import { dbCreate, dbFindOne, ... } from "./auth/db";
+ *
+ * // register as internal (visibility: internal) in your schema tables:
+ * export default defineSchema({
+ *   users: defineTable(...).index("by_email", ["email"]),
+ *   sessions: defineTable(...).index("by_token", ["token"]),
+ * }, {
+ *   internal: {
+ *     dbCreate,
+ *     dbFindOne,
+ *     dbFindMany,
+ *     dbCount,
+ *     dbUpdate,
+ *     dbUpdateMany,
+ *     dbDelete,
+ *     dbDeleteMany,
+ *   },
+ * });
+ * ```
+ *
+ * @see {@link authDbApi} for the factory that produces these functions
+ */
+export const {
+  dbCreate,
+  dbFindOne,
+  dbFindMany,
+  dbCount,
+  dbUpdate,
+  dbUpdateMany,
+  dbDelete,
+  dbDeleteMany,
+} = authDbApi({ schema, internalQuery, internalMutation })

package/templates/base-nextjs/convex/auth/index.ts

@@ -1,14 +1,18 @@
 import type { GenericActionCtx } from "convex/server"
 
+import { createBetterAuthAdapter } from "@vexcms/better-auth"
 import { betterAuth } from "better-auth"
 
-import type { DataModel } from "../_generated/dataModel"
+import { authOptions } from "./options"
 
-import { buildBetterAuthOptions } from "./options"
+import type { DataModel } from "../_generated/dataModel"
 
-export const createAuth = (
-  ctx: GenericActionCtx<DataModel>,
-  { optionsOnly } = { optionsOnly: false }
-) => {
-  return betterAuth(buildBetterAuthOptions({ ctx, optionsOnly }))
+export const createAuth = (ctx: GenericActionCtx<DataModel>, { optionsOnly } = { optionsOnly: false }) => {
+  return betterAuth({
+    database: createBetterAuthAdapter(ctx),
+    logger: {
+      disabled: optionsOnly,
+    },
+    ...authOptions,
+  })
 }

package/templates/base-nextjs/convex/auth/options.ts

@@ -1,7 +1,4 @@
-import { type DataModel } from "@convex/_generated/dataModel"
-import schema from "@convex/schema"
-import { type BetterAuthOptions } from "better-auth"
-import { type GenericActionCtx } from "convex/server"
+import type { BetterAuthOptions } from "better-auth"
 
 import {
   TABLE_SLUG_ACCOUNTS,
@@ -11,20 +8,16 @@ import {
   USER_ROLES,
 } from "~/db/constants"
 
-import { convexAdapter } from "./adapter"
-import betterAuthPlugins from "./plugins"
+import { createPlugins } from "./plugins"
 
-export const betterAuthOptions: BetterAuthOptions = {
+export const authOptions: BetterAuthOptions = {
   account: {
     modelName: TABLE_SLUG_ACCOUNTS,
   },
   baseURL: process.env.SITE_URL,
   // {{EMAIL_PASSWORD_AUTH}}
   // {{OAUTH_PROVIDERS}}
-  logger: {
-    disabled: false,
-  },
-  plugins: betterAuthPlugins,
+  plugins: createPlugins(),
   secret: process.env.BETTER_AUTH_SECRET,
   session: {
     modelName: TABLE_SLUG_SESSIONS,
@@ -32,7 +25,7 @@ export const betterAuthOptions: BetterAuthOptions = {
   trustedOrigins: [process.env.SITE_URL!],
   user: {
     additionalFields: {
-      role: {
+      roles: {
         type: "string[]",
         defaultValue: [USER_ROLES.user],
         required: true,
@@ -44,20 +37,3 @@ export const betterAuthOptions: BetterAuthOptions = {
     modelName: TABLE_SLUG_VERIFICATIONS,
   },
 }
-
-export function buildBetterAuthOptions({
-  ctx,
-  optionsOnly = false,
-}: {
-  ctx: GenericActionCtx<DataModel>
-  optionsOnly?: boolean
-}) {
-  return {
-    ...betterAuthOptions,
-    database: convexAdapter(ctx, schema),
-    logger: {
-      ...betterAuthOptions.logger,
-      disabled: optionsOnly,
-    },
-  }
-}

package/templates/base-nextjs/convex/auth/plugins/index.ts

@@ -1,20 +1,30 @@
+import { apiKey } from "@better-auth/api-key"
 import { convex } from "@convex-dev/better-auth/plugins"
 import authConfig from "@convex/auth.config"
 import { nextCookies } from "better-auth/next-js"
-import { admin, apiKey } from "better-auth/plugins"
+import { admin, anonymous } from "better-auth/plugins"
 // {{ORGANIZATIONS_IMPORT}}
 
 import { USER_ROLES } from "~/db/constants"
 
-const plugins = [
+/**
+ * Returns a fresh array of Better Auth plugins for each VexCMS auth session.
+ *
+ * Returns a new array on every call so that plugin initialization — including
+ * the `convex()` factory, which internally calls the deprecated oidc-provider
+ * plugin — runs inside `createAuth()` rather than at module-eval time. This
+ * lets `http.ts`'s console.warn filter suppress the deprecation noise before
+ * it fires.
+ */
+export const createPlugins = () => [
   admin({
     adminRoles: [USER_ROLES.admin],
     defaultRole: USER_ROLES.user,
   }),
+  anonymous(),
   apiKey(),
   convex({ authConfig }),
-  nextCookies(),
   // {{ORGANIZATIONS_PLUGIN}}
+  // this plugin must be last, per the convex dev CLI's own warnings
+  nextCookies(),
 ]
-
-export default plugins

package/templates/base-nextjs/convex/auth/sessions.ts

@@ -1,9 +1,8 @@
+import { type Id } from "@convex/_generated/dataModel"
 import { v } from "convex/values"
 
 import { TABLE_SLUG_SESSIONS, type TABLE_SLUG_USERS } from "~/db/constants"
 
-import type { Id } from "../_generated/dataModel"
-
 import { query } from "../_generated/server"
 
 /**
@@ -15,28 +14,23 @@ export const getSessionWithUser = query({
     sessionToken: v.string(),
   },
   handler: async (ctx, args) => {
-    // Find the session by token
     const session = await ctx.db
       .query(TABLE_SLUG_SESSIONS)
       .withIndex("by_token", (q) => q.eq("token", args.sessionToken))
       .first()
 
-    if (!session) {
-      return null
-    }
+    if (!session) return null
 
-    // Check if session is expired
     if (session.expiresAt < Date.now()) {
-      console.error("Session Expired")
+      console.error("[getSessionWithUser] Session Expired")
       return null
     }
 
-    // Get the user data
-    const user = await ctx.db.get(session.userId as Id<typeof TABLE_SLUG_USERS>)
+    const userId = session.userId
+    if (!userId) return null
 
-    if (!user) {
-      return null
-    }
+    const user = await ctx.db.get(userId as Id<typeof TABLE_SLUG_USERS>)
+    if (!user) return null
 
     return {
       session: {
@@ -48,12 +42,12 @@ export const getSessionWithUser = query({
         userId: session.userId,
       },
       user: {
-        id: user._id,
+        id: user.userId ?? user._id,
         name: user.name,
         email: user.email,
         emailVerified: user.emailVerified,
         image: user.image,
-        role: user.role,
+        roles: user.roles,
       },
     }
   },

package/templates/base-nextjs/convex/http.ts

@@ -7,9 +7,24 @@ const http = httpRouter()
 
 // Auth request handler - basePath hardcoded to /api/auth for now
 const authRequestHandler = httpAction(async (ctx, request) => {
-  // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-  const auth = createAuth(ctx)
-  return await auth.handler(request)
+  // Suppress the oidc-provider deprecation warning spammed by @convex-dev/better-auth
+  // on every request. Convex wraps console.warn per-invocation, so this must run
+  // inside the handler (not at module level) to intercept after Convex's wrapper is set.
+  // Remove once @convex-dev/better-auth migrates to @better-auth/oauth-provider.
+  const _warn = console.warn
+  console.warn = (...args: unknown[]) => {
+    if (typeof args[0] === "string" && args[0].includes("oidc-provider")) {
+      return
+    }
+    _warn(...args)
+  }
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+    const auth = createAuth(ctx)
+    return await auth.handler(request)
+  } finally {
+    console.warn = _warn
+  }
 })
 
 // Register auth routes for GET and POST

package/templates/base-nextjs/convex/schema.ts

@@ -1,3 +1,105 @@
-import { defineSchema } from "convex/server"
+import { defineSchema, defineTable } from "convex/server"
+import { v } from "convex/values"
 
-export default defineSchema({})
+import { TABLE_SLUG_ACCOUNTS, TABLE_SLUG_USERS } from "~/db/constants"
+
+import { apikey, images, jwks, session, verification } from "./vex.schema"
+
+export default defineSchema({
+  // `organization`/`team`/`teamMember`/`member`/`invitation`/`vex_globals` are
+  // hand-written, not imported from `./vex.schema` — the generator only emits
+  // them when the `organization()` plugin (`--orgs`) or a registered global is
+  // actually present in `vex.config.ts`. `access.ts` and every `getAuth`
+  // caller (`convex/vex.ts`, `convex/vex/media.ts`, `convex/vex/globals.ts`)
+  // reference `orgCollectionSlug`/`resolveOrgs: true` unconditionally, so
+  // these tables must exist in the schema from day one — enabling `--orgs`
+  // or registering a global later needs no schema migration.
+  vex_globals: defineTable({
+    slug: v.string(),
+    data: v.any(),
+  }).index("by_slug", ["slug"]),
+  images,
+  team: defineTable({
+    name: v.string(),
+    organizationId: v.string(),
+    createdAt: v.number(),
+    updatedAt: v.optional(v.number()),
+  }).index("by_organizationId", ["organizationId"]),
+  teamMember: defineTable({
+    teamId: v.string(),
+    userId: v.string(),
+    createdAt: v.optional(v.number()),
+  })
+    .index("by_teamId", ["teamId"])
+    .index("by_userId", ["userId"]),
+  organization: defineTable({
+    name: v.string(),
+    slug: v.string(),
+    logo: v.optional(v.string()),
+    createdAt: v.number(),
+    metadata: v.optional(v.string()),
+  }).index("by_slug", ["slug"]),
+  member: defineTable({
+    organizationId: v.string(),
+    userId: v.string(),
+    role: v.string(),
+    createdAt: v.number(),
+  })
+    .index("by_organizationId", ["organizationId"])
+    .index("by_userId", ["userId"]),
+  invitation: defineTable({
+    organizationId: v.string(),
+    email: v.string(),
+    role: v.optional(v.string()),
+    teamId: v.optional(v.string()),
+    status: v.string(),
+    expiresAt: v.number(),
+    createdAt: v.number(),
+    inviterId: v.string(),
+    roles: v.array(v.string()),
+  })
+    .index("by_organizationId", ["organizationId"])
+    .index("by_email", ["email"]),
+  session,
+  verification,
+  apikey,
+  jwks,
+
+  [TABLE_SLUG_USERS]: defineTable({
+    name: v.string(),
+    banExpires: v.optional(v.number()), // admin plugin
+    banned: v.optional(v.boolean()), // admin plugin
+    banReason: v.optional(v.string()), // admin plugin
+    createdAt: v.number(),
+    displayUsername: v.optional(v.union(v.null(), v.string())),
+    email: v.string(),
+    emailVerified: v.boolean(),
+    image: v.optional(v.string()),
+    isAnonymous: v.optional(v.union(v.null(), v.boolean())),
+    phoneNumber: v.optional(v.union(v.null(), v.string())),
+    phoneNumberVerified: v.optional(v.union(v.null(), v.boolean())),
+    role: v.optional(v.string()), // admin plugin — single string in BA 1.6
+    roles: v.array(v.string()), // our multi-role field via additionalFields
+    twoFactorEnabled: v.optional(v.union(v.null(), v.boolean())),
+    updatedAt: v.number(),
+    userId: v.optional(v.union(v.null(), v.string())),
+    username: v.optional(v.union(v.null(), v.string())),
+  }).index("by_email", ["email"]),
+
+  [TABLE_SLUG_ACCOUNTS]: defineTable({
+    accessToken: v.optional(v.string()),
+    accessTokenExpiresAt: v.optional(v.number()),
+    accountId: v.string(),
+    createdAt: v.number(),
+    idToken: v.optional(v.string()),
+    password: v.optional(v.string()),
+    providerId: v.string(),
+    refreshToken: v.optional(v.string()),
+    refreshTokenExpiresAt: v.optional(v.number()),
+    scope: v.optional(v.string()),
+    updatedAt: v.number(),
+    userId: v.string(),
+  })
+    .index("by_userId", ["userId"])
+    .index("by_accountId", ["accountId"]),
+})