开源的用户管理解决方案,自带前端组件和管理后台。
Go to file
BilalG1 afa2d74ba0
Fix recurring production Sentry errors (#1768)
Fixes four recurring production Sentry issues (triaged from the last 24h
of `vercel-production`):

## X OAuth: 403 client-not-enrolled → 400 (STACK-BACKEND-1JE)
When a customer's X developer App isn't attached to an X API Project, X
deterministically rejects `GET /2/users/me` with 403
`client-not-enrolled` even though the token exchange succeeds. This
previously surfaced as a `HexclaveAssertionError` (opaque 500 + Sentry
alert) on every sign-in attempt for the misconfigured project. It's now
a 400 `StatusError` telling the developer to attach their App to a
Project, mirroring the existing `invalid_client` handling in
`providers/base.tsx`. Other non-OK statuses still fail loud.

## Stripe: ignore `refund.updated` (STACK-BACKEND-1D9)
Stripe emits `refund.updated` asynchronously when the card network fills
in `destination_details` on refunds we created — and already ledgered —
synchronously in the internal refund route, so it carries no actionable
information. Added it to `ignoredEvents` (same approach as #1667/#1461).
`refund.failed` deliberately stays fail-loud, since a refund failing
after it's ledgered is actionable.

## external-db-sync: fix enqueue deadlocks (STACK-BACKEND-16P)
`enqueueExternalDbSyncBatch` batch-inserts deduplication keys with `ON
CONFLICT DO NOTHING`; two concurrent batches inserting overlapping keys
in different orders could deadlock (Postgres 40P01, surfaced as an
empty-titled `PrismaClientKnownRequestError`). Worse than the noise: the
flag-clearing UPDATE and the enqueue run in separate transactions, so a
deadlocked enqueue silently lost that batch's sync trigger until the
next change for the tenancy. Fixed by deduplicating and inserting keys
in canonical (sorted) order, so the circular wait between two batches
can't form. Deliberately minimal: deadlocks against other
`OutgoingRequest` writers (e.g. `recoverStaleOutgoingRequests`) are
theoretically still possible but not evidenced in the Sentry events; if
40P01 reappears, a retry can be added then.

## Password reset: 404 instead of 500 for deleted users
(STACK-BACKEND-1JD)
Password reset codes embed the `user_id` at issuance time, so a code can
be redeemed after the user was deleted (observed in prod from a scripted
client replaying a reset code). The `usersCrudHandlers.adminUpdate` call
didn't declare `UserNotFound` via `allowedErrorTypes`, so the CRUD
handler wrapped it in `CrudHandlerInvocationError` and the endpoint
returned an internal 500. Now declares it and lets the client-safe
`USER_NOT_FOUND` KnownError propagate as a 404, matching the ~10 sibling
call sites that already do this.

## Testing
- New e2e test: resetting the password of a deleted user returns 404
`USER_NOT_FOUND` (`auth/password/reset.test.ts`) — verified passing
locally against the full stack
- Backend + e2e typecheck and lint pass
- No new tests for the other three: the ignore-list entry is covered by
`satisfies Stripe.Event.Type[]` and the existing unknown-type webhook
tests; the X fix would need the X API base URL to be injectable plus a
mock user-info endpoint (possible follow-up); the deadlock is a Postgres
timing race that can't be deterministically reproduced through the e2e
API surface

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
  * Improved password reset handling when the account no longer exists.
  * Added clearer guidance for X API configuration errors.
* Prevented unsupported Stripe refund update events from triggering
processing.
* Ensured external database synchronization requests are deduplicated
and consistently ordered.

* **Tests**
* Added coverage for password reset attempts involving deleted accounts.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-07-16 17:20:49 -07:00
.agents/skills feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-05-26 19:18:20 -07:00
.changeset Disable changesets changelogs 2026-01-12 15:21:56 -08:00
.claude refactor: migrate config parsing from Babel AST to jiti (#1661) 2026-06-29 10:25:11 -07:00
.cursor Remove afterFileLint hook from Cursor 2026-07-10 10:46:02 -07:00
.devcontainer feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-05-26 19:18:20 -07:00
.github Fix all good script to use pagination 2026-07-13 15:39:10 -07:00
.vscode Make it clear there are more SDK packages 2026-06-16 10:37:58 -07:00
apps Fix recurring production Sentry errors (#1768) 2026-07-16 17:20:49 -07:00
configs Silence spurious import.meta CJS warning during pnpm run dev (#1751) 2026-07-08 20:11:33 -07:00
docker Revert "Migrate backend transport from Next.js to ElysiaJS (WIP) (#1630)" 2026-07-13 12:38:53 -07:00
docs feat: add CLI Auth dashboard app (#1739) 2026-07-08 12:34:34 -07:00
docs-mintlify Update reminders 2026-07-13 15:34:36 -07:00
examples chore: update package versions 2026-07-06 23:34:27 +00:00
packages [Fix]: OOM Risk with Data Table (#1766) 2026-07-14 11:06:41 -07:00
patches Fix MS OAuth (#457) 2025-02-21 19:39:22 +01:00
scripts Various improvements 2026-07-13 13:40:56 -07:00
sdks [Fix]: OOM Risk with Data Table (#1766) 2026-07-14 11:06:41 -07:00
skills/hexclave feat(hexclave): PR 5 — internal symbol/path/package renames + brand strings (#1547) 2026-06-03 18:57:09 -07:00
.dockerignore feat(hexclave): PR 5 — internal symbol/path/package renames + brand strings (#1547) 2026-06-03 18:57:09 -07:00
.gitignore [Feat] [Refactor]: Implement Bulldozer JS (#1700) 2026-07-02 10:09:46 -07:00
.gitmodules Update GitHub URL 2026-05-19 10:27:53 -07:00
AGENTS.md docs(agents): add comment-style guidance and symlink CLAUDE.md to AGENTS.md (#1725) 2026-07-10 19:17:50 -07:00
CHANGELOG.md Add 6/26/26–7/10/26 changelog entries (#1753) 2026-07-13 18:32:53 -07:00
CLAUDE.md docs(agents): add comment-style guidance and symlink CLAUDE.md to AGENTS.md (#1725) 2026-07-10 19:17:50 -07:00
CONTRIBUTING.md Rename port prefix envvar 2026-05-27 18:09:52 -07:00
LICENSE feat(hexclave): PR 2 — visible rebrand (Hexclave brand goes public) (#1481) 2026-05-26 19:18:20 -07:00
package.json Make dev script exit when deps not running 2026-07-10 18:11:22 -07:00
pnpm-lock.yaml Revert "Migrate backend transport from Next.js to ElysiaJS (WIP) (#1630)" 2026-07-13 12:38:53 -07:00
pnpm-workspace.yaml [Feat] [Refactor]: Implement Bulldozer JS (#1700) 2026-07-02 10:09:46 -07:00
README.md Add "For AI agents" section to README (#1563) 2026-06-05 17:01:13 -07:00
skills-lock.json Auth app redesign (#1367) 2026-05-19 23:03:46 -07:00
turbo.json dev:tui now builds packages again 2026-07-10 11:27:57 -07:00
vitest.shared.ts Migrate backend transport from Next.js to ElysiaJS (WIP) (#1630) 2026-07-09 21:39:28 -07:00
vitest.workspace.ts Hosted components (#1229) 2026-03-10 11:29:05 -07:00

Hexclave

Hexclave

The user infrastructure platform.

Hexclave handles everything around your users: authentication, teams, payments, emails, analytics, and much more. Start in minutes on the hosted cloud. Your data is always yours to export and self-host.

Website · Docs · Dashboard · Discord

License SDKs Deploy


Where Hexclave fits in the infrastructure stack

Get started

Setting up Hexclave is one prompt. Paste this into your coding agent of choice:

Read skill.hexclave.com and help me setup hexclave in this project

For AI agents

If you're an AI coding agent, use your web fetch tool or curl the skill documentation for up-to-date integration instructions:

curl -sSL "https://skill.hexclave.com?question=<your-question>&context=<your-context>"

What's included

Hexclave ships as a catalog of apps you switch on as your product needs them. Each one is built on the same user model, and new apps land regularly.

  Authentication

Authentication that just works with passkeys, OAuth, and CLI auth. Drop in one component and ship the whole flow; auth methods toggle from the dashboard with no code changes needed.

Authentication

  Teams

Build for teams, not just users, with workspaces, email invites, and roles that actually gate the work. The workspace switcher remembers selection, invites auto sign up new users, and permissions hold up under audit.

Teams

  RBAC

Permissions, sorted: roles that nest and one permission check that works the same on server or client. Define them in the dashboard, check them anywhere in your code.

RBAC

  API Keys

API keys without the footguns: leaked keys get auto-revoked, work for users and teams, and show the full secret only once. We never keep the plaintext after creation.

API Keys

  Payments

Payments without the plumbing for subscriptions, one-time charges, and usage metering with credits. Bill a person or a whole team with one model, no separate codepath.

Payments

  Emails

Email that delivers and tells you so, handling transactional and marketing sends from one API. Edit templates with an AI editor, theme once, and track every open and click.

Emails

  Analytics

Know your users with no data stack required, with live active user counts and session replays out of the box. Ask in plain English to build dashboards or write SQL to save queries, all with one flag enabled.

Analytics

  Webhooks

React to every user event in real time with signed, tamper-proof webhooks. Retries and backoff are handled for you; verify in five lines and manage endpoints from the dashboard.

Webhooks

  Data Vault

A safe for the secrets your users hand you, locked with your secret so we never see the plaintext. Store and retrieve tokens in two lines each, server-only by design.

Data Vault

  Launch Checklist

Run through the must-do checks before flipping to production: domain setup, callbacks locked, secrets rotated. The progress tracker keeps your team aligned so nothing critical slips through on launch day.

Launch Checklist

Contributing

Hexclave is open source, and contributions are welcome. Read CONTRIBUTING.md to get started, and say hello in Discord before picking up anything large. Found a security issue? Email security@hexclave.com.

❤ Contributors

Contributors