🎉 initial commit

src/lib/auth-client.ts

@@ -0,0 +1,6 @@
+import { createAuthClient } from 'better-auth/react'
+import { adminClient } from 'better-auth/client/plugins'
+
+export const authClient = createAuthClient({
+  plugins: [adminClient()],
+})

src/lib/auth-instance.ts

@@ -0,0 +1,43 @@
+import { betterAuth } from 'better-auth'
+import { drizzleAdapter } from 'better-auth/adapters/drizzle'
+import { admin } from 'better-auth/plugins/admin'
+import { tanstackStartCookies } from 'better-auth/tanstack-start'
+
+import { db } from '#/db'
+import * as schema from '#/db/schema'
+
+function createAuth() {
+  const secret = process.env.BETTER_AUTH_SECRET
+
+  if (!secret) {
+    throw new Error('BETTER_AUTH_SECRET environment variable is not set')
+  }
+
+  return betterAuth({
+    secret,
+    database: drizzleAdapter(db, {
+      provider: 'pg',
+      schema,
+    }),
+    emailAndPassword: {
+      enabled: true,
+      // Staff accounts are provisioned via the seed script, not public self sign-up.
+      disableSignUp: true,
+    },
+    session: {
+      expiresIn: 60 * 60 * 12,
+    },
+    // `tanstackStartCookies` must stay last so it sees every other plugin's Set-Cookie headers.
+    plugins: [admin(), tanstackStartCookies()],
+  })
+}
+
+let authInstance: ReturnType<typeof createAuth> | undefined
+
+// Lazily constructed so nothing here runs at module load time — a top-level
+// `betterAuth(...)` call would get pulled into the client bundle (and with it
+// the Postgres driver) by any route file that imports a sibling export.
+export function getAuth() {
+  authInstance ??= createAuth()
+  return authInstance
+}

src/lib/auth.ts

@@ -0,0 +1,22 @@
+import { createServerFn } from '@tanstack/react-start'
+import { getRequest } from '@tanstack/react-start/server'
+
+export async function getStaffSession() {
+  const { getAuth } = await import('#/lib/auth-instance')
+  return getAuth().api.getSession({ headers: getRequest().headers })
+}
+
+export async function requireStaffSession() {
+  const session = await getStaffSession()
+
+  if (!session) {
+    throw new Error('Not signed in')
+  }
+
+  return session
+}
+
+export const getCurrentStaffUser = createServerFn({ method: 'GET' }).handler(async () => {
+  const session = await getStaffSession()
+  return session?.user ?? null
+})

src/lib/datetime.ts

@@ -0,0 +1,4 @@
+export function formatDateTimeLocal(date: Date) {
+  const pad = (n: number) => String(n).padStart(2, '0')
+  return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}T${pad(date.getHours())}:${pad(date.getMinutes())}`
+}

src/lib/reservations.ts

@@ -1,15 +1,18 @@
 import { createServerFn } from '@tanstack/react-start'
-import { and, eq } from 'drizzle-orm'
+import { and, eq, ne } from 'drizzle-orm'
 import { z } from 'zod'
 
 import { db } from '#/db'
 import { reservations, restaurantTables } from '#/db/schema'
+import { requireStaffSession } from '#/lib/auth'
 
 export const getTables = createServerFn({ method: 'GET' }).handler(async () => {
   return db.select().from(restaurantTables).orderBy(restaurantTables.name)
 })
 
 export const getReservations = createServerFn({ method: 'GET' }).handler(async () => {
+  await requireStaffSession()
+
   return db
     .select({
       id: reservations.id,
@@ -84,3 +87,79 @@ export const createReservation = createServerFn({ method: 'POST' })
 
     return reservation
   })
+
+const updateReservationSchema = createReservationSchema.extend({
+  id: z.number().int().positive(),
+})
+
+export const updateReservation = createServerFn({ method: 'POST' })
+  .validator(updateReservationSchema)
+  .handler(async ({ data }) => {
+    await requireStaffSession()
+
+    const reservationTime = new Date(data.reservationTime)
+
+    const [table] = await db
+      .select()
+      .from(restaurantTables)
+      .where(eq(restaurantTables.id, data.tableId))
+
+    if (!table) {
+      throw new Error('Selected table does not exist')
+    }
+
+    if (data.partySize > table.seats) {
+      throw new Error(`${table.name} only seats up to ${table.seats} guests`)
+    }
+
+    const [conflict] = await db
+      .select()
+      .from(reservations)
+      .where(
+        and(
+          eq(reservations.tableId, data.tableId),
+          eq(reservations.reservationTime, reservationTime),
+          ne(reservations.id, data.id),
+        ),
+      )
+
+    if (conflict) {
+      throw new Error('This table is already booked for that time')
+    }
+
+    const [updated] = await db
+      .update(reservations)
+      .set({
+        tableId: data.tableId,
+        customerName: data.customerName,
+        customerEmail: data.customerEmail,
+        partySize: data.partySize,
+        reservationTime,
+      })
+      .where(eq(reservations.id, data.id))
+      .returning()
+
+    if (!updated) {
+      throw new Error('Reservation not found')
+    }
+
+    return updated
+  })
+
+const deleteReservationSchema = z.object({
+  id: z.number().int().positive(),
+})
+
+export const deleteReservation = createServerFn({ method: 'POST' })
+  .validator(deleteReservationSchema)
+  .handler(async ({ data }) => {
+    await requireStaffSession()
+
+    const [deleted] = await db.delete(reservations).where(eq(reservations.id, data.id)).returning()
+
+    if (!deleted) {
+      throw new Error('Reservation not found')
+    }
+
+    return deleted
+  })

src/lib/staff.ts

@@ -0,0 +1,15 @@
+import { createServerFn } from '@tanstack/react-start'
+
+export const listStaffMembers = createServerFn({ method: 'GET' }).handler(async () => {
+  const [{ getAuth }, { getRequest }] = await Promise.all([
+    import('#/lib/auth-instance'),
+    import('@tanstack/react-start/server'),
+  ])
+
+  const { users } = await getAuth().api.listUsers({
+    headers: getRequest().headers,
+    query: { sortBy: 'createdAt', sortDirection: 'asc', limit: 100 },
+  })
+
+  return users
+})