Route handlers

@quickben/next serves every collection over REST from one catch-all route file. It also has helpers for server components and server actions.

pnpm add @quickben/next

import { createRouteHandlers } from "@quickben/next";
 
import config from "../../../quickben.config";
 
export const { GET, POST, PATCH, DELETE } = createRouteHandlers(config);

No next.config wrapper is needed.

Routes

• The user comes from config.auth.getUser(req) on every request. Access rules and hooks run as in the local API.
• Bodies must be JSON objects sent with Content-Type: application/json. id, createdAt and updatedAt are removed from bodies.
• Responses have Cache-Control: private, no-store.

Options

import { createRouteHandlers } from "@quickben/next";
 
import config from "../../../quickben.config";
 
export const { GET, POST, PATCH, DELETE } = createRouteHandlers(config, {
  basePath: "/api",
  maxLimit: 100,
  csrf: { trustedOrigins: ["https://app.example.com"] },
});

Query string

• GET /:collection/:id accepts depth and select.
• Unknown parameters return 400 VALIDATION.
• where is JSON so numbers, booleans and arrays keep their types. where[views][gte]=10 is not supported.

curl -G http://localhost:3000/api/posts \
  --data-urlencode 'where={"status":{"eq":"published"}}' \
  --data-urlencode 'sort=-createdAt' \
  --data-urlencode 'select=title,status'

In client code, toSearchParams builds the query string:

import { toSearchParams } from "@quickben/next";
 
const params = toSearchParams({
  where: { status: { eq: "draft" } },
  sort: "-createdAt",
  limit: 20,
});
const res = await fetch(`/api/posts?${params.toString()}`);

Errors

Every error has the same body:

{
  "error": {
    "code": "VALIDATION",
    "message": "Validation failed. title: Required",
    "details": { "issues": [{ "path": "title", "message": "Required" }] }
  }
}

errorResponse(error) builds the same response in your own route handlers.

CSRF

POST, PATCH and DELETE check where the request comes from:

A rejected request returns 403 FORBIDDEN. The JSON content type also forces a CORS preflight for cross-site fetch calls.

GET /_meta

Returns the collections and modules the user can read: fields, labels, admin options and access: { create, update, delete }.

• Collections whose read rule returns false are left out. A rule that returns a filter counts as allowed.
• Functions (validate, function defaults) are not included.

Server helpers

In Next.js apps, use getQuickben from @quickben/next, not from @quickben/core. The core version caches per module copy, and Next.js can load a module more than once.

Server component

import { getQuickben, getRequestContext } from "@quickben/next";
 
import config from "../../quickben.config";
 
export default async function PostsPage() {
  const qb = await getQuickben(config);
  const posts = await qb.find("posts", { limit: 10 }, await getRequestContext(config));
  return (
    <ul>
      {posts.docs.map((post) => (
        <li key={post.id}>{post.title}</li>
      ))}
    </ul>
  );
}

Server action

"use server";
 
import { getQuickben, getRequestContext } from "@quickben/next";
 
import config from "../../quickben.config";
 
export async function createPost(formData: FormData) {
  const qb = await getQuickben(config);
  const title = String(formData.get("title"));
  await qb.create("posts", { title }, await getRequestContext(config));
}

currentRequest() reads cookies from cookies(). A cookie set earlier in the same server action, such as a sign-in cookie, is visible to the auth adapter.

Database client

db: singleton("db", () => drizzleAdapter({ dialect: "pglite", dataDir: "./.pglite" })),

Limits

Cache Components  (cacheComponents: true) is not supported yet. Pages that call the local API fail to prerender. Create apps with create-next-app --no-cache-components, or remove cacheComponents from next.config.ts.