
Security News
Security Community Slams MIT-linked Report Claiming AI Powers 80% of Ransomware
Experts push back on new claims about AI-driven ransomware, warning that hype and sponsored research are distorting how the threat is understood.
@flowerforce/flowerbase
Advanced tools
> **A serverless-native MongoDB package designed for modern cloud applications**
A serverless-native MongoDB package designed for modern cloud applications
Unlike MongoDB Realm or other cloud platforms, we do not offer a graphical interface where you can configure services through a dashboard. Instead, everything is code-based and developer-driven, offering full flexibility through configuration files and source code.
This documentation is structured to guide both experienced Realm users and newcomers alike β whether youβre migrating or starting clean.
| Feature | Status | 
|---|---|
| Realm-compatible schema | β Supported (unchanged) | 
| Authentication strategy | β Local Email/Password only | 
| OAuth / API Keys / etc. | π« Not supported (for now) | 
| User data accessibility | β Stored in your main DB | 
| Device Sync | π« Not supported (for now) | 
| Functions | β Supported (unchanged) | 
| Triggers | β Supported (unchanged) | 
| HTTP Endpoints | β Supported (unchanged) | 
β οΈ Already have an existing Realm project?
You can skip ahead to the Migration Guide to quickly adapt your project to Flowerbase.
If you're starting fresh, youβll learn how to:
@flowerforce/flowerbaseCreate a new project directory and initialize it with npm:
mkdir my-app
cd my-app
npm init -y
Install the @flowerforce/flowerbase library, which provides the tools required for managing your data with MongoDB Atlas:
npm install @flowerforce/flowerbase
Add Typescript
npm install --save-dev typescript @types/node ts-node
Add tsconfig.json file
npx tsc --init
In your packages.json, inside the script section add this:
{
  "start": "ts-node index.ts"
}
Inside your project root, create the main source directory:
mkdir src
Within the src folder, add a new file named index.ts:
touch src/index.ts
Ensure the following environment variables are set in your .env file or deployment environment:
| Variable | Description | Example | 
|---|---|---|
| PROJECT_ID | A unique ID to identify your project. This value can be freely invented β it's preserved mainly for compatibility with the old Realm-style project structure. | my-flowerbase-app | 
| PORT | The port on which the server will run. | 3000 | 
| DB_CONNECTION_STRING | MongoDB connection URI, including username, password, and database name. | mongodb+srv://user:pass@cluster.mongodb.net/mydb | 
| APP_SECRET | Secret used to sign and verify JWT tokens (choose a strong secret). | supersecretkey123! | 
| HOST | The host address the server binds to (usually 0.0.0.0for public access). | 0.0.0.0 | 
| HTTPS_SCHEMA | The schema for your server requests (usually httpsorhttp). | http | 
Example:
PROJECT_ID=your-project-id
PORT=3000
DB_CONNECTION_STRING=mongodb+srv://username:password@cluster.mongodb.net/dbname
APP_SECRET=your-jwt-secret
HOST=0.0.0.0
HTTPS_SCHEMA=http
π‘οΈ Note: Never commit .env files to source control. Use a .gitignore file to exclude it.
In your index.ts file, import the initialize function from the @flowerforce/flowerbase package and invoke it:
// src/index.ts
import { initialize } from '@flowerforce/flowerbase';
const projectId = process.env.PROJECT_ID ?? "my-project-id"
const port = process.env.PORT ? Number(process.env.PORT) : undefined
const mongodbUrl = process.env.DB_CONNECTION_STRING
const jwtSecret = process.env.APP_SECRET
const host = process.env.HOST
initialize({
    projectId,
    port,
    mongodbUrl,
    jwtSecret,
    host
})
This initializes the Flowerbase integration, connecting your application to MongoDB Atlas.
After setting up the base Flowerbase integration, you can now configure advanced features to control how your backend behaves.
π my-app/
|
βββ π src/
|   |
β   βββ π index.ts
|   |
β   βββ π auth/
|   |   |
β   β   βββ π custom_user_data.json
|   |   |
β   β   βββ π providers.json
|   |   
β   βββ π data_sources/
|   |   |
β   β   βββ π mongodb-atlas/
|   |       |
β   β       βββ π your_db_name/
|   |           |
β   β           βββ π collection1/
|   |           |    |
β   β           |    βββ π rules.json
β   β           | 
β   β           βββ π collection2/
|   |               |
β   β               βββ π rules.json
β   β  
β   βββ π functions/
β   β   |
β   β   βββ π exampleFunction.ts
β   β   |
β   β   βββ π config.json
β   β  
β   βββ π triggers/
β   β   |
β   β   βββ π trigger1.json
β   β   |
β   β   βββ π trigger2.json
β   β   
β   βββ π http_endpoints/
β   β   |
β   β   βββ π config.json
β   β   
βββ π .env
| Area | Description | Link | 
|---|---|---|
| π§ Functions | Overview of server-side functions in Realm | Functions Documentation | 
| β° Triggers | Triggers that run on database events or schedules | Triggers Documentation | 
| π€ User Management | Managing users, authentication, and providers | Users Documentation | 
| π Custom Endpoints | HTTP endpoints to expose backend functionality via API | Custom Endpoints | 
| π Rules & Permissions | Define fine-grained access control for collections | Rules Documentation | 
The authentication system in @flowerforce/flowerbase reimplements the classic email/password login method (called local-userpass), similar to the one used by MongoDB Realm.
In MongoDB Atlas (Realm), users were stored in a separate internal authentication database, not directly accessible via the standard MongoDB collections.
However, with Flowerbase:
Users are stored directly in a MongoDB collection (by default named auth_users), but this can be customized in the server project via a JSON configuration file, as shown later in this guide.
The document structure remains identical to the previous Realm implementation
No changes are required to migrate the user data β existing user documents will continue to work as-is. However, all users will be required to reset their passwords since it is not possible to extract passwords from the old MongoDB authentication system.
The only authentication mode currently re-implemented in @flowerforce/flowerbase is:
Other methods (OAuth, API key, anonymous, etc.) are not supported yet.
{
  "_id": ObjectId("2scgsb3gev99gsty2ev3g2g323d2hs"),
  "email": "myuser@flowerbase.example",
  "password": "your-encrypted-password",
  "status": "confirmed",
  "identities": [
    {
      "id": "example-id",
      "provider_type": "local-userpass",
      "provider_id": "example-provider-id",
      "provider_data": {
        "email":  "myuser@flowerbase.example",
      }
    }
  ]
}
You can specify the MongoDB collection used to store authentication users by configuring the auth_collection field inside the auth/providers.json file.
Example
{
    "api-key": {
        "name": "api-key",
        "type": "api-key",
        "disabled": true
    },
    "local-userpass": {
        "name": "local-userpass",
        "type": "local-userpass",
        "disabled": false,
        "auth_collection": "my-users-collection" //custom collection name
        "config": {
            "autoConfirm": true,
            "resetPasswordSubject": "reset",
            "resetPasswordUrl": "https://my.app.url/password-reset",
            "runConfirmationFunction": false
        }
    }
}
If you're configuring the project from scratch, you can skip ahead to the Build step.
Follow these steps to rebuild your backend in a clean and modern Node.js environment:
Follow these steps to export and download your Realm app from MongoDB Cloud.
Go to https://cloud.mongodb.com/ and sign in with your credentials.
From the dashboard, choose the project that contains the Realm app you want to download.
From the list of applications, click on the app name you wish to export.
In the left sidebar, under the Manage section, click on "Deployment".
Click on the "Export App" tab at the top of the page.
Scroll to the bottom and click the "Download App" button.
This will download a .zip file containing your Realm app's full structure and configuration.
β You are now ready to migrate or inspect your Realm app locally!
npm init -y
npm install @flowerforce/flowerbase
npm install --save-dev typescript @types/node ts-node
tsconfig.json filenpx tsc --init
Inside your project, create index.ts:
touch index.ts
packages.json, inside the script section add this:{
  "start": "ts-node index.ts"
}
Initialize the Flowerbase App
In index.ts, add:
import { initialize } from '@flowerforce/flowerbase';
const projectId = process.env.PROJECT_ID ?? "my-project-id"
const port = process.env.PORT ? Number(process.env.PORT) : undefined
const mongodbUrl = process.env.DB_CONNECTION_STRING
const jwtSecret = process.env.APP_SECRET
const host = process.env.HOST
initialize({
    projectId,
    port,
    mongodbUrl,
    jwtSecret,
    host
})
Ensure the following environment variables are set in your .env file or deployment environment:
| Variable | Description | Example | 
|---|---|---|
| PROJECT_ID | A unique ID to identify your project. This value can be freely invented β it's preserved mainly for compatibility with the old Realm-style project structure. | my-flowerbase-app | 
| PORT | The port on which the server will run. | 3000 | 
| DB_CONNECTION_STRING | MongoDB connection URI, including username, password, and database name. | mongodb+srv://user:pass@cluster.mongodb.net/mydb | 
| APP_SECRET | Secret used to sign and verify JWT tokens (choose a strong secret). | supersecretkey123! | 
| HOST | The host address the server binds to (usually 0.0.0.0for public access). | 0.0.0.0 | 
| HTTPS_SCHEMA | The schema for your server requests (usually httpsorhttp). | http | 
Example:
PROJECT_ID=your-project-id
PORT=3000
DB_CONNECTION_STRING=mongodb+srv://username:password@cluster.mongodb.net/dbname
APP_SECRET=your-jwt-secret
HOST=0.0.0.0
HTTPS_SCHEMA=http
π‘οΈ Note: Never commit .env files to source control. Use a .gitignore file to exclude it.
Once your migration or first configuration is complete, itβs time to build and deploy the backend so it can be accessed by your frontend or external clients.
If you're using for example TypeScript:
npx tsc
You can deploy the application using any Node.js-compatible platform. Once deployed, you'll receive a public URL (e.g. https://your-app-name.up.example.app).
This URL should be used as the base URL in your frontend application, as explained in the next section.
You can use the official realm-web SDK to integrate MongoDB Realm into a React application.
This serves as a sample setup β similar logic can be applied using other official Realm SDKs (e.g. React Native, Node, or Flutter).
npm install realm-web
Create a file to initialize and export the Realm App instance:
// src/realm/realmApp.ts
import * as Realm from "realm-web";
// Replace with your actual Realm App ID and your deployed backend URL
const app = new Realm.App({
  id: "your-realm-app-id", // e.g., my-app-abcde
  baseUrl: "https://your-deployed-backend-url.com" // e.g., https://your-app-name.up.example.app
});
export default app;
π The baseUrl should point to the backend URL you deployed earlier using Flowerbase. This tells the frontend SDK where to send authentication and data requests.
FAQs
> **A serverless-native MongoDB package designed for modern cloud applications**
The npm package @flowerforce/flowerbase receives a total of 34 weekly downloads. As such, @flowerforce/flowerbase popularity was classified as not popular.
We found that @flowerforce/flowerbase demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Experts push back on new claims about AI-driven ransomware, warning that hype and sponsored research are distorting how the threat is understood.

Security News
Ruby's creator Matz assumes control of RubyGems and Bundler repositories while former maintainers agree to step back and transfer all rights to end the dispute.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.