opacacms 0.1.0

package/src/admin/webcomponent.tsx

@@ -0,0 +1,15 @@
+import r2wc from "@r2wc/react-to-web-component";
+import { AdminClient } from "./ui/admin-client";
+import "./ui/styles/index.scss";
+
+const OpacaAdminWebComponent = r2wc(AdminClient, {
+  props: {
+    serverUrl: "string",
+    config: "json",
+    initialNeedsInit: "boolean",
+  },
+});
+
+if (typeof window !== "undefined" && !customElements.get("opaca-admin")) {
+  customElements.define("opaca-admin", OpacaAdminWebComponent);
+}

package/src/api.ts

@@ -0,0 +1,9 @@
+// API-only entry point (runtime agnostic - works in Next.js, Bun, Node, Edge)
+// DB adapters are imported separately via opacacms/db/postgres, opacacms/db/sqlite, etc.
+
+export * from "./config";
+export * from "./db/adapter";
+export * from "./server/admin";
+export * from "./server/handlers";
+export * from "./server/router";
+export * from "./types";

package/src/auth/index.ts

@@ -0,0 +1,194 @@
+import { apiKey } from "@better-auth/api-key";
+import { betterAuth } from "better-auth";
+import { admin } from "better-auth/plugins";
+import { CamelCasePlugin } from "kysely";
+
+import type { OpacaConfig } from "../types";
+import { createPermissions } from "./premissions";
+
+export async function createAuth(config: OpacaConfig) {
+  const userAuth = config.auth || {};
+  const trustedOrigins = config.trustedOrigins;
+
+  const { ac, roles } = createPermissions(config);
+
+  const rawDb = config.db.raw;
+
+  const env = (typeof process !== "undefined" ? process.env : {}) as any;
+
+  const baseURL = String(config.serverURL || env.BETTER_AUTH_URL || "").replace(/\/$/, "");
+
+  if (!baseURL) {
+    throw new Error(
+      "[OpacaAuth] baseURL could not be determined. Please provide 'serverURL' in your config or 'BETTER_AUTH_URL' in your environment.",
+    );
+  }
+
+  const authURL = `${baseURL}/api/auth`;
+
+  const secret = env.OPACA_SECRET || env.BETTER_AUTH_SECRET || config.secret;
+
+  if (!secret) {
+    throw new Error(
+      "[OpacaAuth] No secret found for authentication. Please provide 'OPACA_SECRET' or 'BETTER_AUTH_SECRET'.",
+    );
+  }
+
+  if (typeof process !== "undefined" && !env.BETTER_AUTH_URL) {
+    process.env.BETTER_AUTH_URL = authURL;
+  }
+
+  let databaseConfig: any;
+
+  if (config.db.name === "postgres" && rawDb) {
+    const { PostgresJSDialect } = await import("kysely-postgres-js");
+    const { Kysely } = await import("kysely");
+
+    const kysely = new Kysely({
+      dialect: new PostgresJSDialect({ postgres: rawDb as any }),
+      plugins: [new CamelCasePlugin()],
+    });
+
+    databaseConfig = {
+      db: kysely,
+      type: "pg",
+    };
+  } else if (config.db.name === "d1" && rawDb) {
+    const { D1Dialect } = await import("kysely-d1");
+    const { Kysely } = await import("kysely");
+
+    const kysely = new Kysely({
+      dialect: new D1Dialect({ database: rawDb as any }),
+      plugins: [new CamelCasePlugin()],
+    });
+
+    databaseConfig = {
+      db: kysely,
+      type: "sqlite",
+    };
+  } else {
+    // Fallback for Bun SQLite or other SQLite variants compatible with direct binding
+    databaseConfig = {
+      db: rawDb,
+      type: "sqlite",
+    };
+  }
+
+  const isSecure = baseURL.startsWith("https");
+
+  const plugins = [
+    admin({
+      ac,
+      roles,
+    }),
+    ...(userAuth.features?.apiKeys?.enabled
+      ? [
+          apiKey({
+            defaultPrefix: "opaca_",
+            schema: {
+              apikey: {
+                modelName: "_api_keys",
+              },
+            },
+          }),
+        ]
+      : []),
+  ];
+
+  // Not dynamically importing two-factor as it's not present,
+  // but if we were to support it without installing:
+  // if (userAuth.features?.mfa?.enabled) {
+  //   const { twoFactor } = require('@better-auth/two-factor');
+  //   plugins.push(twoFactor({ issuer: userAuth.features.mfa.issuer }));
+  // }
+
+  const socialProviders: Record<string, any> = {};
+  if (userAuth.socialProviders?.github) {
+    socialProviders.github = userAuth.socialProviders.github;
+  }
+  if (userAuth.socialProviders?.google) {
+    socialProviders.google = userAuth.socialProviders.google;
+  }
+
+  return betterAuth({
+    // FORCE OpacaCMS global database connection
+    database: databaseConfig,
+
+    // FORCE predictable API routing
+    baseURL: baseURL,
+    basePath: "/api/auth",
+    secret: secret,
+    trustedOrigins,
+
+    // Map strictly constrained user strategies
+    emailAndPassword: {
+      enabled: userAuth.strategies?.emailPassword !== false,
+    },
+
+    socialProviders,
+
+    // Forced model names for system integrity
+    user: {
+      modelName: "_users",
+    },
+
+    session: {
+      modelName: "_sessions",
+      expiresIn: (userAuth.session?.expiresInDays || 30) * 86400,
+      updateAge: userAuth.session?.updateAgeSeconds || 86400,
+    },
+
+    account: {
+      modelName: "_accounts",
+    },
+
+    verification: {
+      modelName: "_verifications",
+    },
+
+    advanced: {
+      useSecureCookies: isSecure,
+      defaultCookieAttributes: {
+        sameSite: (isSecure ? "none" : "lax") as any,
+        secure: isSecure,
+      },
+    },
+
+    databaseHooks: {
+      user: {
+        create: {
+          before: async (user) => {
+            try {
+              let userCount = 0;
+              try {
+                userCount = await config.db.count("_users");
+              } catch (e) {
+                // Fallback: the "_users" collection might not be in the OpacaCMS schema
+                // but the table exists in the DB (managed by better-auth).
+                const result = await config.db.unsafe("SELECT COUNT(*) as count FROM _users");
+                // Handle different response formats (D1 vs Others)
+                const rows = (result as any)?.results || result || [];
+                userCount = Number(rows[0]?.count || rows[0]?.["count(*)"] || 0);
+              }
+
+              if (userCount === 0) {
+                return {
+                  data: {
+                    ...user,
+                    role: "admin",
+                  },
+                };
+              }
+            } catch (e) {
+              console.error("[OpacaAuth] Failed to check user count in hook:", e);
+            }
+          },
+        },
+      },
+    },
+
+    plugins,
+  });
+}
+
+export type Auth = Awaited<ReturnType<typeof createAuth>>;

package/src/auth/migrations.ts

@@ -0,0 +1,87 @@
+import { toSnakeCase } from "../db/kysely/field-mapper";
+import { getSystemCollections } from "../db/system-schema";
+import type { DatabaseAdapter, Field } from "../types";
+import { logger } from "../utils/logger";
+
+/**
+ * Creates the Better Auth core tables using raw SQL if they don't exist.
+ */
+export async function runAuthMigrations(db: DatabaseAdapter) {
+  const rawDb = db.raw;
+
+  if (!rawDb) {
+    logger.error("Database not connected yet. Skipping auth migrations.");
+    return;
+  }
+
+  const isPostgres = db.name === "postgres";
+  const authCollections = getSystemCollections().filter((c) =>
+    ["_users", "_sessions", "_accounts", "_verifications", "_api_keys"].includes(c.slug),
+  );
+
+  try {
+    for (const collection of authCollections) {
+      const columnDefs: string[] = [];
+
+      // Primary Key
+      columnDefs.push(`"id" TEXT PRIMARY KEY`);
+
+      for (const field of collection.fields) {
+        if (field.name === "id") continue;
+
+        let type = "TEXT";
+        if (field.type === "number") type = "INTEGER";
+        if (field.type === "boolean") type = isPostgres ? "BOOLEAN" : "INTEGER";
+        if (field.type === "date") type = isPostgres ? "TIMESTAMPTZ" : "TEXT";
+
+        let definition = `"${toSnakeCase(field.name!)}" ${type}`;
+
+        if (field.required) definition += " NOT NULL";
+        if (field.unique) definition += " UNIQUE";
+
+        if (field.defaultValue !== undefined) {
+          const val =
+            typeof field.defaultValue === "string" ? `'${field.defaultValue}'` : field.defaultValue;
+          definition += ` DEFAULT ${val}`;
+        }
+
+        if (field.references) {
+          definition += ` REFERENCES "${field.references.table}"("${toSnakeCase(field.references.column)}")`;
+          if (field.references.onDelete) {
+            definition += ` ON DELETE ${field.references.onDelete.toUpperCase()}`;
+          }
+        }
+
+        columnDefs.push(definition);
+      }
+
+      const ts = (collection as any).timestamps;
+      if (ts !== false && ts !== undefined) {
+        const config = typeof ts === "object" ? ts : {};
+        const createdField = toSnakeCase(config.createdAt || "createdAt");
+        const updatedField = toSnakeCase(config.updatedAt || "updatedAt");
+
+        // Check if they are already in fields (to avoid duplicates)
+        const fieldNames = new Set(collection.fields.map((f) => toSnakeCase(f.name!)));
+
+        if (!fieldNames.has(createdField)) {
+          columnDefs.push(
+            `"${createdField}" ${isPostgres ? "TIMESTAMPTZ" : "TEXT"} DEFAULT CURRENT_TIMESTAMP`,
+          );
+        }
+        if (!fieldNames.has(updatedField)) {
+          columnDefs.push(
+            `"${updatedField}" ${isPostgres ? "TIMESTAMPTZ" : "TEXT"} DEFAULT CURRENT_TIMESTAMP`,
+          );
+        }
+      }
+
+      logger.info(`  -> Verifying table: ${logger.format("green", `"${collection.slug}"`)}`);
+      await db.unsafe(`CREATE TABLE IF NOT EXISTS "${collection.slug}" (${columnDefs.join(", ")})`);
+    }
+
+    logger.success("Auth tables verified/created successfully.");
+  } catch (error) {
+    logger.error("Failed to create auth tables:", error);
+  }
+}

package/src/auth/premissions.ts

@@ -0,0 +1,46 @@
+import { createAccessControl } from "better-auth/plugins/access";
+import type { OpacaConfig } from "../types";
+
+export function createPermissions(config: OpacaConfig): {
+  ac: ReturnType<typeof createAccessControl>;
+  roles: Record<string, any>;
+} {
+  const resources: Record<string, string[]> = {
+    user: ["create", "read", "update", "delete", "ban", "impersonate"],
+    session: ["read", "revoke", "delete"],
+  };
+
+  for (const collection of config.collections) {
+    resources[collection.slug] = ["create", "read", "update", "delete"];
+  }
+
+  const ac = createAccessControl(resources);
+
+  const adminRole = ac.newRole({
+    user: ["create", "read", "update", "delete", "ban", "impersonate"],
+    session: ["read", "revoke", "delete"],
+  });
+
+  for (const collection of config.collections) {
+    // @ts-expect-error dynamic role extension
+    adminRole[collection.slug] = ["create", "read", "update", "delete"];
+  }
+
+  const userRole = ac.newRole({});
+
+  const roles: Record<string, any> = {
+    admin: adminRole,
+    user: userRole,
+  };
+
+  if (config.access?.roles) {
+    for (const [roleName, permissions] of Object.entries(config.access.roles)) {
+      roles[roleName] = ac.newRole(permissions as Record<string, string[]>);
+    }
+  }
+
+  return {
+    ac,
+    roles,
+  };
+}

package/src/cli/commands/generate-types.ts

@@ -0,0 +1,116 @@
+import fs from "node:fs";
+import { resolve } from "node:path";
+import type { SerializableConfig } from "../../types";
+
+export async function generateTypesCommand(url: string, token: string, out: string) {
+  console.log(`[OpacaCMS] Fetching metadata from ${url}/api/__admin/metadata...`);
+
+  let data: SerializableConfig;
+  try {
+    const res = await fetch(`${url.replace(/\/$/, "")}/api/__admin/metadata`, {
+      headers: {
+        Authorization: `Bearer ${token}`,
+      },
+    });
+
+    if (!res.ok) {
+      if (res.status === 401 || res.status === 403) {
+        throw new Error(
+          "Authentication failed. Ensure your API Key is correct and has the necessary permissions.",
+        );
+      }
+      const errorText = await res.text().catch(() => "Unknown error");
+      throw new Error(`Server responded with ${res.status}: ${errorText}`);
+    }
+
+    data = await res.json();
+  } catch (err: any) {
+    console.error(`[OpacaCMS] Failed to fetch metadata: ${err.message}`);
+    process.exit(1);
+  }
+
+  console.log(
+    `[OpacaCMS] Successfully fetched metadata for ${data.collections.length} collections and ${data.globals?.length || 0} globals.`,
+  );
+
+  let dtsContent = `// Automatically generated by OpacaCMS CLI
+// Do not edit this file manually
+
+export interface OpacaAsset {
+  assetId: string;
+  url: string;
+  filename: string;
+  mime_type: string;
+  filesize: number;
+  meta?: Record<string, any>;
+}
+
+export interface OpacaCollections {
+  collections: {
+`;
+
+  // Process Collections
+  for (const collection of data.collections) {
+    dtsContent += `    "${collection.slug}": {\n`;
+    dtsContent += `      id: string | number;\n`;
+    for (const field of collection.fields) {
+      const typeStr = mapFieldToTsType(field.type);
+      const isOptional = field.required ? "" : "?";
+      dtsContent += `      ${field.name}${isOptional}: ${typeStr};\n`;
+    }
+    if (collection.timestamps) {
+      dtsContent += `      createdAt: string;\n`;
+      dtsContent += `      updatedAt: string;\n`;
+    }
+    dtsContent += `    };\n`;
+  }
+
+  dtsContent += `  };\n`;
+
+  // Process Globals
+  if (data.globals && data.globals.length > 0) {
+    dtsContent += `  globals: {\n`;
+    for (const globalConf of data.globals) {
+      dtsContent += `    "${globalConf.slug}": {\n`;
+      for (const field of globalConf.fields) {
+        const typeStr = mapFieldToTsType(field.type);
+        const isOptional = field.required ? "" : "?";
+        dtsContent += `      ${field.name}${isOptional}: ${typeStr};\n`;
+      }
+      dtsContent += `    };\n`;
+    }
+    dtsContent += `  };\n`;
+  } else {
+    dtsContent += `  globals: Record<string, any>;\n`;
+  }
+
+  dtsContent += `}\n`;
+
+  const outputPath = resolve(process.cwd(), out || "opaca-types.d.ts");
+  fs.writeFileSync(outputPath, dtsContent);
+
+  console.log(`[OpacaCMS] Types successfully generated at ${outputPath}`);
+}
+
+function mapFieldToTsType(type: string): string {
+  switch (type) {
+    case "text":
+    case "textarea":
+    case "richtext":
+    case "select":
+    case "date":
+      return "string";
+    case "number":
+      return "number";
+    case "boolean":
+      return "boolean";
+    case "json":
+      return "any | any[]";
+    case "file":
+      return "OpacaAsset";
+    case "relationship":
+      return "string | number | any"; // Can be ID or populated object
+    default:
+      return "any";
+  }
+}

package/src/cli/commands/init.ts

@@ -0,0 +1,95 @@
+import fs from "node:fs";
+import { resolve } from "node:path";
+
+export async function initCommand(target: string, example?: string) {
+  console.log(`[OpacaCMS] Initializing new project in ./${target}...`);
+
+  if (example) {
+    console.log(`[OpacaCMS] Using example template: ${example}`);
+
+    // Breadth-first or climbing up search for examples
+    let currentDir = resolve(import.meta.dirname);
+    let exampleDir = "";
+
+    // Try process.cwd() first
+    const localExample = resolve(process.cwd(), "examples", example);
+    if (fs.existsSync(localExample)) {
+      exampleDir = localExample;
+    } else {
+      // Climb up from source
+      while (currentDir !== resolve(currentDir, "..")) {
+        const potential = resolve(currentDir, "examples", example);
+        if (fs.existsSync(potential)) {
+          exampleDir = potential;
+          break;
+        }
+        currentDir = resolve(currentDir, "..");
+      }
+    }
+
+    if (!exampleDir) {
+      console.error(
+        `[OpacaCMS] Example ${example} not found.`,
+      );
+      process.exit(1);
+    }
+    fs.cpSync(exampleDir, resolve(process.cwd(), target), { recursive: true });
+    console.log(`[OpacaCMS] Copied example ${example} to ${target}!`);
+    return;
+  }
+
+  console.log(`[OpacaCMS] Generating default boilerplate...`);
+  fs.mkdirSync(resolve(process.cwd(), target), { recursive: true });
+
+  const configCode = `import { defineConfig } from 'opacacms';
+import { createSQLiteAdapter } from 'opacacms/db/sqlite';
+
+export default defineConfig({
+  appName: "My OpacaCMS App",
+  db: createSQLiteAdapter('local.db'),
+  collections: [
+    {
+      slug: 'posts',
+      fields: [
+        { name: 'title', type: 'text', required: true },
+        { name: 'content', type: 'text' }
+      ]
+    }
+  ]
+});
+`;
+  fs.writeFileSync(resolve(process.cwd(), target, "opacacms.config.ts"), configCode);
+
+  const serverCode = `import { Hono } from 'hono';
+import { createAPIRouter } from 'opacacms/server';
+import config from './opacacms.config';
+
+const app = new Hono();
+app.route('/api', createAPIRouter(config));
+
+export default app;
+`;
+  fs.writeFileSync(resolve(process.cwd(), target, "index.ts"), serverCode);
+
+  const pkgJson = {
+    name: target,
+    type: "module",
+    scripts: {
+      start: "bun run index.ts",
+      dev: "bun run --watch index.ts",
+    },
+    dependencies: {
+      opacacms: "latest",
+      hono: "^4.0.0",
+    },
+  };
+  fs.writeFileSync(
+    resolve(process.cwd(), target, "package.json"),
+    JSON.stringify(pkgJson, null, 2),
+  );
+
+  console.log(`[OpacaCMS] Project created successfully!`);
+  console.log(`\ncd ${target}`);
+  console.log(`bun install`);
+  console.log(`bun run dev\n`);
+}