Next.js app

A complete Next.js app with two clients. lib/vaif.ts exports vaif, with the publishable key, for Client Components. lib/vaif-server.ts exports createVaifServer(), with the secret key, for Server Components, Route Handlers and Server Actions, and getCurrentUser(), which asks the API who is signed in with the user’s own access token. The secret key bypasses row rules, so lib/vaif-server.ts imports server-only: a build that pulls it into browser code fails.

Create the app

vaif init --template nextjs-fullstack

Run it in a new, empty folder. It writes vaif.config.json and the template's files there. It stops if the folder already has a vaif.config.json, and leaves any other file that already exists alone; --force overwrites both.

It asks which features to include. This template has files for Database, Authentication, Realtime, Storage and Functions; Database and Authentication are selected to start with. To skip the question, name them: vaif init --template nextjs-fullstack --features database,auth,realtime,storage,functions. Add one later with vaif init --template nextjs-fullstack --add-features <feature>.

What it writes

File	Written
package.json	Always
tsconfig.json	Always
next.config.ts	Always
app/layout.tsx	Always
app/providers.tsx	Always
app/page.tsx	Always; replaced by the Authentication version when you include that feature
app/globals.css	Always
lib/vaif.ts	Always
lib/vaif-server.ts	Always
.env.local.example	Always
.gitignore	Always
README.md	Always
drizzle/0001_initial.sql	With Database
drizzle.config.ts	With Database
src/db/schema.ts	With Database
middleware.ts	With Authentication
app/(auth)/login/page.tsx	With Authentication
app/(auth)/signup/page.tsx	With Authentication
hooks/useRealtime.ts	With Realtime
lib/storage.ts	With Storage
app/api/upload/route.ts	With Storage
functions/hello.ts	With Functions

With Authentication, the app gets sign-in and sign-up pages, and a middleware.ts that sends signed-out visitors on the routes it lists to the sign-in page. The middleware asks the API who the access token belongs to, so an expired or revoked token counts as signed out.

Install

Its package.json lists @vaifstudio/client, @vaifstudio/auth and @vaifstudio/react, with next, react, react-dom and server-only, so npm install in the folder installs everything.

Note

@vaifstudio/client 4.0.0, @vaifstudio/auth 2.2.0 and @vaifstudio/react 2.2.0 are the current releases. They are not on npm yet.

Configure

Copy .env.local.example to .env.local and fill it in. The project ID and the keys are on Security > Credentials in the console.

Variable	Value
NEXT_PUBLIC_VAIF_API_URL	The API address. Keep the value in the file, https://api.vaif.studio.
NEXT_PUBLIC_VAIF_PROJECT_ID	Your project ID, for the app.
NEXT_PUBLIC_VAIF_PUBLISHABLE_KEY	The project's publishable key (vk_pub_). Row rules apply to it, so it is safe in an app.
VAIF_SECRET_KEY	The project's secret key (vk_srv_), for server code only. It bypasses row rules; never ship it in a browser or mobile app.
VAIF_PROJECT_ID	Your project ID again, without the prefix, for the server client.

Set up the database

The template writes one SQL file for your database. The comment line above each CREATE TABLE sets that table's row rules.

drizzle/0001_initial.sql, written with the Database feature, is an example: edit it to describe your own tables before you apply it.

drizzle/0001_initial.sql

-- Initial migration. Customize this schema for your project; vaif db push
-- applies it. The comment directly above each CREATE TABLE sets that table's
-- row rules: here each signed-in user reads and changes only their own rows,
-- and the owner column is filled in from their sign-in on insert. Keep a rule
-- comment on every table you add: a table with no row rules is closed to
-- signed-out visitors but open to every signed-in user.

-- vaif:owner id
CREATE TABLE IF NOT EXISTS "users" (
  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  "email" text NOT NULL UNIQUE,
  "name" text,
  "created_at" timestamp with time zone NOT NULL DEFAULT now()
);

-- vaif:owner user_id
CREATE TABLE IF NOT EXISTS "posts" (
  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  "user_id" uuid NOT NULL REFERENCES "users"("id"),
  "title" text NOT NULL,
  "content" text,
  "published" boolean NOT NULL DEFAULT false,
  "created_at" timestamp with time zone NOT NULL DEFAULT now()
);

• users (-- vaif:owner id): each signed-in user reads and changes only their own rows, and id is filled in from their sign-in.
• posts (-- vaif:owner user_id): each signed-in user reads and changes only their own rows, and user_id is filled in from their sign-in.

Put your project ID in vaif.config.json ("projectId"), sign in, and apply it. With no --dir, vaif db push finds the template's SQL folder, or a ./migrations folder, and applies its .sql files in name order.

vaif login
vaif db push --dry-run   # what each file would change
vaif db push

Keep a rule comment on every table you add: a table with no row rules is open to every signed-in user. See Rules from a schema file.

Run it

npm run dev

Next steps

• Authentication for sign-up, sign-in and sessions.
• Querying data for the table queries vaif.from() runs.
• Functions for server code that runs in your project instead of in your app.