@cedarjs/auth-dbauth-setup 7.0.0 → 8.0.0-canary.3265

package/dist/oauth.setupData.d.ts

@@ -0,0 +1,57 @@
+import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers/auth/setupHelpers';
+/**
+ * The OAuth providers `cedar setup auth dbAuth --oauth` knows how to
+ * configure out of the box. Anything else is served by implementing the
+ * `OAuthStrategy` interface, documented at
+ * https://cedarjs.com/docs/auth/dbauth#oauth-custom-strategies
+ */
+export declare const KNOWN_OAUTH_PROVIDERS: readonly ["google", "github"];
+export type OAuthProviderName = (typeof KNOWN_OAUTH_PROVIDERS)[number];
+/**
+ * Parses the comma-separated value of `--oauth` into a deduped list of
+ * provider names, validating every entry against `KNOWN_OAUTH_PROVIDERS`.
+ *
+ * Returns an empty array when `oauth` is nullish (the flag wasn't passed).
+ * Some callers pass `null` explicitly for "flag absent"; others invoke the
+ * setup handler programmatically and simply omit the argument, which comes
+ * through as `undefined`. Both mean "OAuth disabled".
+ */
+export declare function parseOAuthProviders(oauth: string | null | undefined): OAuthProviderName[];
+export declare const apiPackages: string[];
+export declare const createUserModelTask: {
+    title: string;
+    task: (ctx: AuthGeneratorCtx) => Promise<void>;
+};
+export declare const webAuthnCreateUserModelTask: {
+    title: string;
+    task: (ctx: AuthGeneratorCtx) => Promise<void>;
+};
+export declare function envVarNotes(providers: OAuthProviderName[]): string[];
+export declare function notes(): string[];
+export declare function webAuthnOauthNotes(): string[];
+export declare const noteGenerate: string[];
+/**
+ * Strips the config for every OAuth provider that wasn't selected out of the
+ * `auth.oauth.ts`/`auth.webAuthn.oauth.ts` templates, and drops the marker
+ * comments around the config for every provider that was.
+ *
+ * The templates carry every known provider so there's a single source of
+ * truth for the generated file's shape; this function is what turns that
+ * into a file that only configures the providers the user actually asked
+ * for. It's a pure string transform, so re-running setup (which always
+ * starts from a fresh copy of the template) produces byte-identical output.
+ *
+ * Exported for testing.
+ */
+export declare function pruneOAuthProviders(content: string, providers: OAuthProviderName[]): string;
+/**
+ * Rewrites the generated `functions/auth.ts` (or `.js`) in place so it only
+ * configures the OAuth providers the user selected with `--oauth`. Runs
+ * after `generateAuthApiFiles` has written the fresh, unpruned template, so
+ * every run starts from the same source and produces the same result.
+ */
+export declare function configureOAuthProvidersTask(providers: OAuthProviderName[]): {
+    title: string;
+    task: () => void;
+};
+//# sourceMappingURL=oauth.setupData.d.ts.map

package/dist/oauth.setupData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.setupData.d.ts","sourceRoot":"","sources":["../src/oauth.setupData.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AAO9E;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,+BAAgC,CAAA;AAElE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAMtE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,iBAAiB,EAAE,CAqCrB;AAGD,eAAO,MAAM,WAAW,UAAsB,CAAA;AAmB9C,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CAqBnC,CAAA;AAED,eAAO,MAAM,2BAA2B;;gBAEpB,gBAAgB;CAgCnC,CAAA;AAOD,wBAAgB,WAAW,CAAC,SAAS,EAAE,iBAAiB,EAAE,YAWzD;AAuCD,wBAAgB,KAAK,aAkDpB;AAED,wBAAgB,kBAAkB,aAgEjC;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,iBAAiB,EAAE,UA2B/B;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,iBAAiB,EAAE;;;EAsBzE"}

package/dist/oauth.setupData.js

@@ -0,0 +1,336 @@
+import fs from "node:fs";
+import path from "node:path";
+import { colors } from "@cedarjs/cli-helpers/colors";
+import { getPaths } from "@cedarjs/cli-helpers/paths";
+import { isTypeScriptProject } from "@cedarjs/cli-helpers/project";
+import { addModels, functionsPath, hasModel, libPath } from "./shared.js";
+const KNOWN_OAUTH_PROVIDERS = ["google", "github"];
+function isKnownOAuthProvider(value) {
+  return KNOWN_OAUTH_PROVIDERS.includes(value);
+}
+function parseOAuthProviders(oauth) {
+  if (oauth === null || oauth === void 0) {
+    return [];
+  }
+  const requested = oauth.split(",").map((provider) => provider.trim().toLowerCase()).filter(Boolean);
+  const uniqueRequested = [...new Set(requested)];
+  if (uniqueRequested.length === 0) {
+    throw new Error(
+      "--oauth requires at least one provider, e.g. --oauth google,github"
+    );
+  }
+  const unknownProviders = uniqueRequested.filter(
+    (provider) => !isKnownOAuthProvider(provider)
+  );
+  if (unknownProviders.length > 0) {
+    throw new Error(
+      `Unknown OAuth provider(s): ${unknownProviders.join(", ")}. Cedar ships built-in support for ${KNOWN_OAUTH_PROVIDERS.join(
+        ", "
+      )}. For any other provider, implement the \`OAuthStrategy\` interface from \`@cedarjs/auth-dbauth-oauth\` -- see https://cedarjs.com/docs/auth/dbauth#oauth-custom-strategies`
+    );
+  }
+  return uniqueRequested;
+}
+const apiPackages = ["oauth4webapi@^3"];
+const OAUTH_MODEL = `
+model OAuth {
+  id               String   @id @default(uuid())
+  provider         String
+  providerUserId   String
+  providerUsername String?
+  providerEmail    String?
+  userId           String
+  user             User     @relation(fields: [userId], references: [id])
+  createdAt        DateTime @default(now())
+  updatedAt        DateTime @updatedAt
+
+  @@unique([provider, providerUserId])
+  @@unique([userId, provider])
+}
+`;
+const createUserModelTask = {
+  title: "Creating model `User`...",
+  task: async (ctx) => {
+    const hasUserModel = await hasModel("User");
+    if (hasUserModel && !ctx.force) {
+      throw new Error("User model already exists");
+    }
+    addModels(`
+model User {
+  id                  String    @id @default(uuid())
+  email               String    @unique
+  hashedPassword      String?
+  salt                String?
+  resetToken          String?
+  resetTokenExpiresAt DateTime?
+  oauthIdentities     OAuth[]
+  createdAt           DateTime  @default(now())
+  updatedAt           DateTime  @updatedAt
+}
+${OAUTH_MODEL}`);
+  }
+};
+const webAuthnCreateUserModelTask = {
+  title: "Creating model `User`...",
+  task: async (ctx) => {
+    const hasUserModel = await hasModel("User");
+    if (hasUserModel && !ctx.force) {
+      throw new Error("User model already exists");
+    }
+    addModels(`
+model User {
+  id                  String    @id @default(uuid())
+  email               String    @unique
+  hashedPassword      String?
+  salt                String?
+  resetToken          String?
+  resetTokenExpiresAt DateTime?
+  webAuthnChallenge   String? @unique
+  credentials         UserCredential[]
+  oauthIdentities     OAuth[]
+  createdAt           DateTime @default(now())
+  updatedAt           DateTime @updatedAt
+}
+
+model UserCredential {
+  id         String  @id
+  userId     String
+  user       User    @relation(fields: [userId], references: [id])
+  publicKey  Bytes
+  transports String?
+  counter    BigInt
+}
+${OAUTH_MODEL}`);
+  }
+};
+const OAUTH_ENV_VAR_NAMES = {
+  google: ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
+  github: ["GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET"]
+};
+function envVarNotes(providers) {
+  return [
+    "",
+    "Add the client id and secret for each configured OAuth provider to your .env file (get these from each provider\u2019s developer console):",
+    "",
+    ...providers.flatMap((provider) => [
+      `  # ${provider}`,
+      ...OAUTH_ENV_VAR_NAMES[provider].map((name) => `  ${name}=`)
+    ])
+  ];
+}
+function schemaNotes() {
+  return [
+    "",
+    "You will also need to add an `OAuth` model to your Prisma schema to",
+    "keep track of linked provider accounts:",
+    "",
+    "  model OAuth {",
+    "    id               String   @id @default(uuid())",
+    "    provider         String",
+    "    providerUserId   String",
+    "    providerUsername String?",
+    "    providerEmail    String?",
+    "    userId           String",
+    "    user             User     @relation(fields: [userId], references: [id])",
+    "    createdAt        DateTime @default(now())",
+    "    updatedAt        DateTime @updatedAt",
+    "",
+    "    @@unique([provider, providerUserId])",
+    "    @@unique([userId, provider])",
+    "  }",
+    "",
+    "Since users can now sign up with just an OAuth provider (no password),",
+    "`hashedPassword` and `salt` on your `User` model must be optional (or",
+    "have a default value):",
+    "",
+    "  hashedPassword String?",
+    "  salt           String?",
+    "",
+    "Don't forget to add the inverse relation to `User`:",
+    "",
+    "  oauthIdentities OAuth[]"
+  ];
+}
+function notes() {
+  return [
+    `${colors.warning("Done! But you have a little more work to do:")}
+`,
+    "You will need to add a couple of fields to your User table in order",
+    "to store a hashed password and salt:",
+    "",
+    "  model User {",
+    "    id                  String  @id @default(uuid())",
+    "    email               String  @unique",
+    "    hashedPassword      String?   // <\u2500\u2510",
+    "    salt                String?   // <\u2500\u2534\u2500 add these lines",
+    "    resetToken          String?   // <\u2500\u2524",
+    "    resetTokenExpiresAt DateTime? // <\u2500\u2518",
+    "  }",
+    ...schemaNotes(),
+    "",
+    "If you expose any of your user data via GraphQL be sure to exclude",
+    "`hashedPassword` and `salt` (or whatever you named them) from the",
+    "SDL file that defines the fields for your user.",
+    "",
+    "You'll need to let Cedar know what fields you're using for your users'",
+    "`id` and `username` fields. In this case we're using `id` and `email`,",
+    "so update those in the `authFields` config in",
+    `\`${functionsPath}/auth.js\`. This is also the place to tell Cedar if`,
+    "you used a different name for the `hashedPassword`, `salt`,",
+    "`resetToken` or `resetTokenExpiresAt`, fields:`",
+    "",
+    "  authFields: {",
+    "    id: 'id',",
+    "    username: 'email',",
+    "    hashedPassword: 'hashedPassword',",
+    "    salt: 'salt',",
+    "    resetToken: 'resetToken',",
+    "    resetTokenExpiresAt: 'resetTokenExpiresAt',",
+    "  },",
+    "",
+    "To get the actual user that's logged in, take a look at `getCurrentUser()`",
+    `in \`${libPath}/auth.js\`. We default it to something simple, but you may`,
+    "use different names for your model or unique ID fields, in which case you",
+    "need to update those calls (instructions are in the comment above the code).",
+    "",
+    "Finally, we created a SESSION_SECRET environment variable for you in",
+    `${path.join(getPaths().base, ".env")}. This value should NOT be checked`,
+    "into version control and should be unique for each environment you",
+    "deploy to. If you ever need to log everyone out of your app at once",
+    "change this secret to a new value and deploy. To create a new secret, run:",
+    "",
+    "  yarn cedar generate secret",
+    ""
+  ];
+}
+function webAuthnOauthNotes() {
+  return [
+    `${colors.warning("Done! But you have a little more work to do:")}
+`,
+    "You will need to add a couple of fields to your User table in order",
+    "to store a hashed password, salt, reset token, and to connect it to",
+    "a new UserCredential model to keep track of any devices used with",
+    "WebAuthn authentication:",
+    "",
+    "  model User {",
+    "    id                  String  @id @default(uuid())",
+    "    email               String  @unique",
+    "    hashedPassword      String?",
+    "    salt                String?",
+    "    resetToken          String?",
+    "    resetTokenExpiresAt DateTime?",
+    "    webAuthnChallenge   String? @unique",
+    "    credentials         UserCredential[]",
+    "  }",
+    "",
+    "  model UserCredential {",
+    "    id         String  @id",
+    "    userId     String",
+    "    user       User    @relation(fields: [userId], references: [id])",
+    "    publicKey  Bytes",
+    "    transports String?",
+    "    counter    BigInt",
+    "  }",
+    ...schemaNotes(),
+    "",
+    "If you expose any of your user data via GraphQL be sure to exclude",
+    "`hashedPassword` and `salt` (or whatever you named them) from the",
+    "SDL file that defines the fields for your user.",
+    "",
+    "You'll need to let Cedar know what fields you're using for your users'",
+    "`id` and `username` fields. In this case we're using `id` and `email`,",
+    "so update those in the `authFields` config in",
+    `\`${functionsPath}/auth.js\`. This is also the place to tell Cedar if`,
+    "you used a different name for the `hashedPassword`, `salt`,",
+    "`resetToken` or `resetTokenExpiresAt`, fields:`",
+    "",
+    "  authFields: {",
+    "    id: 'id',",
+    "    username: 'email',",
+    "    hashedPassword: 'hashedPassword',",
+    "    salt: 'salt',",
+    "    resetToken: 'resetToken',",
+    "    resetTokenExpiresAt: 'resetTokenExpiresAt',",
+    "    challenge: 'webAuthnChallenge'",
+    "  },",
+    "",
+    "To get the actual user that's logged in, take a look at `getCurrentUser()`",
+    `in \`${libPath}/auth.js\`. We default it to something simple, but you may`,
+    "use different names for your model or unique ID fields, in which case you",
+    "need to update those calls (instructions are in the comment above the code).",
+    "",
+    "Finally, we created a SESSION_SECRET environment variable for you in",
+    `${path.join(getPaths().base, ".env")}. This value should NOT be checked`,
+    "into version control and should be unique for each environment you",
+    "deploy to. If you ever need to log everyone out of your app at once",
+    "change this secret to a new value and deploy. To create a new secret, run:",
+    "",
+    "  yarn cedar generate secret",
+    ""
+  ];
+}
+const noteGenerate = [
+  "",
+  "Need simple Login, Signup and Forgot Password pages? We've got a generator",
+  "for those as well:",
+  "",
+  "  yarn cedar generate dbAuth"
+];
+function pruneOAuthProviders(content, providers) {
+  let result = content;
+  for (const provider of KNOWN_OAUTH_PROVIDERS) {
+    const startMarker = `// @oauth-provider:${provider}`;
+    const endMarker = `// @oauth-provider:${provider}:end`;
+    const blockPattern = new RegExp(
+      `[ \\t]*${escapeRegExp(startMarker)}\\n([\\s\\S]*?)[ \\t]*${escapeRegExp(
+        endMarker
+      )}\\n`
+    );
+    if (providers.includes(provider)) {
+      result = result.replace(blockPattern, "$1");
+    } else {
+      result = result.replace(blockPattern, "");
+      result = result.replace(
+        new RegExp(`^[ \\t]*${provider}Provider,\\n`, "m"),
+        ""
+      );
+    }
+  }
+  return result;
+}
+function escapeRegExp(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function configureOAuthProvidersTask(providers) {
+  return {
+    title: "Configuring selected OAuth providers...",
+    task: () => {
+      const ext = isTypeScriptProject() ? "ts" : "js";
+      const authFunctionPath = path.join(
+        getPaths().api.functions,
+        `auth.${ext}`
+      );
+      if (!fs.existsSync(authFunctionPath)) {
+        return;
+      }
+      const content = fs.readFileSync(authFunctionPath, "utf-8");
+      const prunedContent = pruneOAuthProviders(content, providers);
+      if (prunedContent !== content) {
+        fs.writeFileSync(authFunctionPath, prunedContent);
+      }
+    }
+  };
+}
+export {
+  KNOWN_OAUTH_PROVIDERS,
+  apiPackages,
+  configureOAuthProvidersTask,
+  createUserModelTask,
+  envVarNotes,
+  noteGenerate,
+  notes,
+  parseOAuthProviders,
+  pruneOAuthProviders,
+  webAuthnCreateUserModelTask,
+  webAuthnOauthNotes
+};

package/dist/setup.d.ts

@@ -4,6 +4,7 @@ export declare const description = "Set up auth for for dbAuth";
 export declare function builder(yargs: Argv): void;
 export interface Args {
     webauthn: boolean | null;
+    oauth?: string | null;
     createUserModel: boolean | null;
     generateAuthPages: boolean | null;
     force: boolean;

package/dist/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAA;AAEjC,eAAO,MAAM,OAAO,WAAW,CAAA;AAC/B,eAAO,MAAM,WAAW,+BAA+B,CAAA;AAEvD,wBAAgB,OAAO,CAAC,KAAK,EAAE,IAAI,QAgClC;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,eAAe,EAAE,OAAO,GAAG,IAAI,CAAA;IAC/B,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;IACjC,KAAK,EAAE,OAAO,CAAA;CACf;AAED,eAAO,MAAM,OAAO,GAAU,SAAS,IAAI,kBAG1C,CAAA"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAA;AAEjC,eAAO,MAAM,OAAO,WAAW,CAAA;AAC/B,eAAO,MAAM,WAAW,+BAA+B,CAAA;AAEvD,wBAAgB,OAAO,CAAC,KAAK,EAAE,IAAI,QAwClC;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IAKxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,eAAe,EAAE,OAAO,GAAG,IAAI,CAAA;IAC/B,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;IACjC,KAAK,EAAE,OAAO,CAAA;CACf;AAED,eAAO,MAAM,OAAO,GAAU,SAAS,IAAI,kBAG1C,CAAA"}

package/dist/setup.js

@@ -12,6 +12,11 @@ function builder(yargs) {
     default: null,
     description: "Include WebAuthn support (TouchID/FaceID)",
     type: "boolean"
+  }).option("oauth", {
+    alias: "o",
+    default: null,
+    description: "Include OAuth support for the given comma-separated providers (google, github), e.g. --oauth google,github",
+    type: "string"
   }).option("createUserModel", {
     alias: "u",
     default: null,

package/dist/setupData.d.ts

@@ -1,4 +1,4 @@
-import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers';
+import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers/auth/setupHelpers';
 export declare const extraTask: {
     title: string;
     task: () => void;

package/dist/setupData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setupData.d.ts","sourceRoot":"","sources":["../src/setupData.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAM5D,eAAO,MAAM,SAAS;;;CAKrB,CAAA;AAED,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CAoBnC,CAAA;AAGD,eAAO,MAAM,KAAK,UAsDjB,CAAA;AAED,eAAO,MAAM,qBAAqB,UAwBjC,CAAA;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA;AAED,eAAO,MAAM,cAAc,UAO1B,CAAA"}
+{"version":3,"file":"setupData.d.ts","sourceRoot":"","sources":["../src/setupData.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AAS9E,eAAO,MAAM,SAAS;;;CAKrB,CAAA;AAED,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CAoBnC,CAAA;AAGD,eAAO,MAAM,KAAK,UAsDjB,CAAA;AAED,eAAO,MAAM,qBAAqB,UAwBjC,CAAA;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA;AAED,eAAO,MAAM,cAAc,UAO1B,CAAA"}

package/dist/setupData.js

@@ -1,6 +1,8 @@
 import crypto from "node:crypto";
 import path from "node:path";
-import { getPaths, colors, addEnvVarTask } from "@cedarjs/cli-helpers";
+import { colors } from "@cedarjs/cli-helpers/colors";
+import { getPaths } from "@cedarjs/cli-helpers/paths";
+import { addEnvVarTask } from "@cedarjs/cli-helpers/project";
 import { addModels, functionsPath, hasModel, libPath } from "./shared.js";
 const secret = crypto.randomBytes(32).toString("base64");
 const extraTask = addEnvVarTask(

package/dist/setupHandler.d.ts

@@ -1,5 +1,5 @@
 import type { Args } from './setup.js';
-export declare function handler({ webauthn, createUserModel, generateAuthPages, force: forceArg, }: Args): Promise<void>;
+export declare function handler({ webauthn, oauth, createUserModel, generateAuthPages, force: forceArg, }: Args): Promise<void>;
 export declare const createAuthDecoderFunction: {
     title: string;
     task: () => void;

package/dist/setupHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setupHandler.d.ts","sourceRoot":"","sources":["../src/setupHandler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAwBtC,wBAAsB,OAAO,CAAC,EAC5B,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,KAAK,EAAE,QAAQ,GAChB,EAAE,IAAI,iBAyEN;AAsED,eAAO,MAAM,yBAAyB;;;CAuCrC,CAAA"}
+{"version":3,"file":"setupHandler.d.ts","sourceRoot":"","sources":["../src/setupHandler.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAwBtC,wBAAsB,OAAO,CAAC,EAC5B,QAAQ,EACR,KAAK,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,EAAE,QAAQ,GAChB,EAAE,IAAI,iBA0GN;AA4ED,eAAO,MAAM,yBAAyB;;;CAuCrC,CAAA"}

package/dist/setupHandler.js

@@ -1,7 +1,20 @@
 import fs from "node:fs";
 import path from "node:path";
 import prompts from "prompts";
-import { getGraphqlPath, standardAuthHandler } from "@cedarjs/cli-helpers";
+import { standardAuthHandler } from "@cedarjs/cli-helpers/auth/setupHelpers";
+import { getGraphqlPath } from "@cedarjs/cli-helpers/project";
+import { requireTTYOrExit } from "@cedarjs/cli-helpers/tty";
+import {
+  apiPackages as oauthApiPackages,
+  configureOAuthProvidersTask,
+  createUserModelTask as oauthCreateUserModelTask,
+  envVarNotes as oauthEnvVarNotes,
+  noteGenerate as oauthNoteGenerate,
+  notes as oauthNotes,
+  parseOAuthProviders,
+  webAuthnCreateUserModelTask as webAuthnOauthCreateUserModelTask,
+  webAuthnOauthNotes
+} from "./oauth.setupData.js";
 import {
   notes,
   noteGenerate,
@@ -26,6 +39,7 @@ import {
 } from "./webAuthn.setupData.js";
 async function handler({
   webauthn,
+  oauth,
   createUserModel,
   generateAuthPages,
   force: forceArg
@@ -37,10 +51,22 @@ async function handler({
     )
   );
   const webAuthn = await shouldIncludeWebAuthn(webauthn);
+  const oauthProviders = parseOAuthProviders(oauth);
+  const includeOAuth = oauthProviders.length > 0;
   const createDbUserModel = await shouldCreateUserModel(createUserModel);
   const generateDbAuthPages = await shouldGenerateDbAuthPages(generateAuthPages);
   const oneMoreThing = [];
-  if (webAuthn) {
+  if (webAuthn && includeOAuth) {
+    if (createDbUserModel) {
+      oneMoreThing.push(...notesCreatedUserModel);
+    } else {
+      oneMoreThing.push(...webAuthnOauthNotes());
+    }
+    oneMoreThing.push(...oauthEnvVarNotes(oauthProviders));
+    if (!generateDbAuthPages) {
+      oneMoreThing.push(...webAuthnNoteGenerate);
+    }
+  } else if (webAuthn) {
     if (createDbUserModel) {
       oneMoreThing.push(...notesCreatedUserModel);
     } else {
@@ -49,6 +75,16 @@ async function handler({
     if (!generateDbAuthPages) {
       oneMoreThing.push(...webAuthnNoteGenerate);
     }
+  } else if (includeOAuth) {
+    if (createDbUserModel) {
+      oneMoreThing.push(...notesCreatedUserModel);
+    } else {
+      oneMoreThing.push(...oauthNotes());
+    }
+    oneMoreThing.push(...oauthEnvVarNotes(oauthProviders));
+    if (!generateDbAuthPages) {
+      oneMoreThing.push(...oauthNoteGenerate);
+    }
   } else {
     if (createDbUserModel) {
       oneMoreThing.push(...notesCreatedUserModel);
@@ -62,8 +98,12 @@ async function handler({
   oneMoreThing.push(...notePrivateSet);
   let createDbUserModelTask = void 0;
   if (createDbUserModel) {
-    if (webAuthn) {
+    if (webAuthn && includeOAuth) {
+      createDbUserModelTask = webAuthnOauthCreateUserModelTask;
+    } else if (webAuthn) {
       createDbUserModelTask = webAuthnCreateUserModelTask;
+    } else if (includeOAuth) {
+      createDbUserModelTask = oauthCreateUserModelTask;
     } else {
       createDbUserModelTask = createUserModelTask;
     }
@@ -74,18 +114,21 @@ async function handler({
     provider: "dbAuth",
     authDecoderImport: "import { createAuthDecoder } from '@cedarjs/auth-dbauth-api'",
     webAuthn,
+    oauth: includeOAuth,
     webPackages: [
       `@cedarjs/auth-dbauth-web@${version}`,
       ...webAuthn ? webAuthnWebPackages : []
     ],
     apiPackages: [
       `@cedarjs/auth-dbauth-api@${version}`,
-      ...webAuthn ? webAuthnApiPackages : []
+      ...webAuthn ? webAuthnApiPackages : [],
+      ...includeOAuth ? [`@cedarjs/auth-dbauth-oauth@${version}`, ...oauthApiPackages] : []
     ],
     extraTasks: [
       webAuthn ? webAuthnExtraTask : extraTask,
       createDbUserModelTask,
       createAuthDecoderFunction,
+      includeOAuth ? configureOAuthProvidersTask(oauthProviders) : void 0,
       generateDbAuthPages ? generateAuthPagesTask(createDbUserModel) : void 0
     ],
     notes: oneMoreThing
@@ -93,6 +136,7 @@ async function handler({
 }
 async function shouldIncludeWebAuthn(webauthn) {
   if (webauthn === null) {
+    requireTTYOrExit("--webauthn or --webauthn=false");
     const webAuthnResponse = await prompts({
       type: "confirm",
       name: "answer",
@@ -111,6 +155,7 @@ async function shouldCreateUserModel(createUserModel) {
     return true;
   }
   if (createUserModel === null && !hasUserModel) {
+    requireTTYOrExit("--createUserModel or --createUserModel=false");
     const createModelResponse = await prompts({
       type: "confirm",
       name: "answer",
@@ -123,6 +168,7 @@ async function shouldCreateUserModel(createUserModel) {
 }
 async function shouldGenerateDbAuthPages(generateAuthPages) {
   if (generateAuthPages === null && !hasAuthPages()) {
+    requireTTYOrExit("--generateAuthPages or --generateAuthPages=false");
     const generateAuthPagesResponse = await prompts({
       type: "confirm",
       name: "answer",

package/dist/shared.js

@@ -1,8 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import prismaInternals from "@prisma/internals";
-import { getPaths } from "@cedarjs/cli-helpers";
 import { runBin } from "@cedarjs/cli-helpers/packageManager/exec";
+import { getPaths } from "@cedarjs/cli-helpers/paths";
 import {
   processPagesDir,
   getSchemaPath,

package/dist/templates/api/functions/auth.oauth.ts.template

@@ -0,0 +1,327 @@
+import type { APIGatewayProxyEvent, Context } from 'aws-lambda'
+
+import { DbAuthHandler } from '@cedarjs/auth-dbauth-api'
+import type { DbAuthHandlerOptions, UserType } from '@cedarjs/auth-dbauth-api'
+import {
+  OAuthHandler,
+  googleProvider,
+  githubProvider,
+} from '@cedarjs/auth-dbauth-oauth'
+
+import { cookieName } from 'src/lib/auth'
+import { db } from 'src/lib/db'
+
+// Any request whose path falls under this prefix is routed to the OAuth
+// handler instead of the regular username/password dbAuth handler. This
+// must match the callback URLs registered with each provider below (e.g.
+// `${apiUrl}/auth/oauth/google/callback`).
+const OAUTH_BASE_PATH = '/auth/oauth'
+
+// The base URL of your deployed api side. Used to build the OAuth callback
+// URLs registered with each provider's developer console. Update the
+// production value once you know your deployed URL.
+const apiUrl =
+  process.env.NODE_ENV === 'development'
+    ? 'http://localhost:8911'
+    : 'https://server.com'
+
+const cookieAttributes = {
+  HttpOnly: true,
+  Path: '/',
+  SameSite: 'Lax' as const,
+  Secure: process.env.NODE_ENV !== 'development',
+
+  // If you need to allow other domains (besides the api side) access to
+  // the dbAuth session cookie:
+  // Domain: 'example.com',
+}
+
+export const handler = async (
+  event: APIGatewayProxyEvent,
+  context: Context
+) => {
+  if (event.path?.includes(OAUTH_BASE_PATH)) {
+    const oauthHandler = new OAuthHandler(event, context, {
+      // Provide prisma db client
+      db: db,
+
+      // The name of the property you'd call on `db` to access your user
+      // table. i.e. if your Prisma model is named `User` this value would
+      // be `user`, as in `db.user`
+      authModelAccessor: 'user',
+
+      // The name of the property you'd call on `db` to access your OAuth
+      // identity table. i.e. if your Prisma model is named `OAuth` this
+      // value would be `oAuth`, as in `db.oAuth`
+      oauthModelAccessor: 'oAuth',
+
+      // A map of what dbAuth calls a field to what your database calls it,
+      // matching the same fields used by `DbAuthHandler` below
+      authFields: {
+        id: 'id',
+        username: 'email',
+        hashedPassword: 'hashedPassword',
+      },
+
+      basePath: OAUTH_BASE_PATH,
+
+      // The configured OAuth providers, keyed by the path segment used in
+      // `/auth/oauth/{key}/...`. Get client id/secret values from each
+      // provider's developer console and set them in your `.env` file.
+      providers: {
+        // @oauth-provider:google
+        google: googleProvider({
+          clientId: process.env.GOOGLE_CLIENT_ID as string,
+          clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
+          redirectUri: `${apiUrl}/auth/oauth/google/callback`,
+        }),
+        // @oauth-provider:google:end
+        // @oauth-provider:github
+        github: githubProvider({
+          clientId: process.env.GITHUB_CLIENT_ID as string,
+          clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
+          redirectUri: `${apiUrl}/auth/oauth/github/callback`,
+        }),
+        // @oauth-provider:github:end
+      },
+
+      // Where to send the browser after each flow completes
+      redirects: {
+        afterLogin: '/',
+        error: '/login',
+      },
+
+      signup: {
+        // handler() is invoked the first time a user signs in with a
+        // configured OAuth provider and no account is linked to that
+        // provider identity yet. `profile` is the canonical profile the
+        // provider returned (`providerUserId`, `email`, `username`, etc).
+        //
+        // At a minimum you need to create and return a user row. There's no
+        // password to store here since this account only ever signs in
+        // through the provider -- if your `User` model requires
+        // `hashedPassword`/`salt`, make sure those fields are optional (or
+        // have a default) so provider-only accounts can be created.
+        handler: ({ profile }) => {
+          // Some providers (e.g. GitHub, when the account keeps its email
+          // private) don't return an email at all. Customize this handler
+          // for any such provider you configure -- ask for an email on a
+          // follow-up screen, or derive a placeholder from a field you know
+          // is always present. Throwing here surfaces to the user as a
+          // `provider_error` redirect instead of silently creating an
+          // account with a fabricated address.
+          if (!profile.email) {
+            throw new Error(
+              `OAuth signup handler needs an email, but ${profile.providerUserId} didn't return one. Customize this handler to handle providers that don't supply an email.`,
+            )
+          }
+
+          return db.user.create({
+            data: {
+              email: profile.email,
+            },
+          })
+        },
+      },
+
+      // How long a user will remain logged in, in seconds
+      sessionExpires: 60 * 60 * 24 * 365 * 10,
+
+      // Specifies attributes on the cookie that dbAuth sets in order to
+      // remember who is logged in. See
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
+      cookie: {
+        attributes: cookieAttributes,
+        name: cookieName,
+      },
+    })
+
+    return await oauthHandler.invoke()
+  }
+
+  const forgotPasswordOptions: DbAuthHandlerOptions['forgotPassword'] = {
+    // handler() is invoked after verifying that a user was found with the given
+    // username. This is where you can send the user an email with a link to
+    // reset their password.
+    //
+    // Whatever is returned from this function will be returned from
+    // the `forgotPassword()` function that is destructured from `useAuth()`.
+    // You could use this return value to, for example, show the email
+    // address in a toast message so the user will know it worked and where
+    // to look for the email.
+    //
+    // Note that this return value is sent to the client in *plain text*
+    // so don't include anything you wouldn't want prying eyes to see. The
+    // `user` here has been sanitized to only include the fields listed in
+    // `allowedUserFields` so it should be safe to return as-is.
+    handler: (user, _resetToken) => {
+      // TODO: Send an email/message to the user
+      // The message should include a link to reset their password with the
+      // `resetToken`. The URL should look something like:
+      // `http://localhost:8910/reset-password?resetToken=${resetToken}`
+      // When you implement this, change `_resetToken` to `resetToken` in the
+      // function arguments above.
+
+      return user
+    },
+
+    // How long the resetToken is valid for, in seconds (default is 24 hours)
+    expires: 60 * 60 * 24,
+
+    errors: {
+      // for security reasons you may want to be vague here rather than expose
+      // the fact that the email address wasn't found (prevents fishing for
+      // valid email addresses)
+      usernameNotFound: 'Username not found',
+      // if the user somehow gets around client validation
+      usernameRequired: 'Username is required',
+    },
+  }
+
+  const loginOptions: DbAuthHandlerOptions['login'] = {
+    // handler() is called after finding the user that matches the
+    // username/password provided at login, but before actually considering them
+    // logged in. The `user` argument will be the user in the database that
+    // matched the username/password.
+    //
+    // If you want to allow this user to log in simply return the user.
+    //
+    // If you want to prevent someone logging in for another reason (maybe they
+    // didn't validate their email yet), throw an error and it will be returned
+    // by the `logIn()` function from `useAuth()` in the form of:
+    // `{ message: 'Error message' }`
+    handler: (user) => {
+      return user
+    },
+
+    errors: {
+      usernameOrPasswordMissing: 'Both username and password are required',
+      usernameNotFound: 'Username ${username} not found',
+      // For security reasons you may want to make this the same as the
+      // usernameNotFound error so that a malicious user can't use the error
+      // to narrow down if it's the username or password that's incorrect
+      incorrectPassword: 'Incorrect password for ${username}',
+    },
+
+    // How long a user will remain logged in, in seconds
+    expires: 60 * 60 * 24 * 365 * 10,
+  }
+
+  const resetPasswordOptions: DbAuthHandlerOptions['resetPassword'] = {
+    // handler() is invoked after the password has been successfully updated in
+    // the database. Returning anything truthy will automatically log the user
+    // in. Return `false` otherwise, and in the Reset Password page redirect the
+    // user to the login page.
+    handler: (_user) => {
+      return true
+    },
+
+    // If `false` then the new password MUST be different from the current one
+    allowReusedPassword: true,
+
+    errors: {
+      // the resetToken is valid, but expired
+      resetTokenExpired: 'resetToken is expired',
+      // no user was found with the given resetToken
+      resetTokenInvalid: 'resetToken is invalid',
+      // the resetToken was not present in the URL
+      resetTokenRequired: 'resetToken is required',
+      // new password is the same as the old password (apparently they did not forget it)
+      reusedPassword: 'Must choose a new password',
+    },
+  }
+
+  interface UserAttributes {
+    name: string
+  }
+
+  const signupOptions: DbAuthHandlerOptions<
+    UserType,
+    UserAttributes
+  >['signup'] = {
+    // Whatever you want to happen to your data on new user signup. Cedar will
+    // check for duplicate usernames before calling this handler. At a minimum
+    // you need to save the `username`, `hashedPassword` and `salt` to your
+    // user table. `userAttributes` contains any additional object members that
+    // were included in the object given to the `signUp()` function you got
+    // from `useAuth()`.
+    //
+    // If you want the user to be immediately logged in, return the user that
+    // was created.
+    //
+    // If this handler throws an error, it will be returned by the `signUp()`
+    // function in the form of: `{ error: 'Error message' }`.
+    //
+    // If this returns anything else, it will be returned by the
+    // `signUp()` function in the form of: `{ message: 'String here' }`.
+    handler: ({
+      username,
+      hashedPassword,
+      salt,
+      userAttributes: _userAttributes,
+    }) => {
+      return db.user.create({
+        data: {
+          email: username,
+          hashedPassword: hashedPassword,
+          salt: salt,
+          // name: userAttributes.name
+        },
+      })
+    },
+
+    // Include any format checks for password here. Return `true` if the
+    // password is valid, otherwise throw a `PasswordValidationError`.
+    // Import the error along with `DbAuthHandler` from `@cedarjs/api` above.
+    passwordValidation: (_password) => {
+      return true
+    },
+
+    errors: {
+      // `field` will be either "username" or "password"
+      fieldMissing: '${field} is required',
+      usernameTaken: 'Username `${username}` already in use',
+    },
+  }
+
+  const authHandler = new DbAuthHandler(event, context, {
+    // Provide prisma db client
+    db: db,
+
+    // The name of the property you'd call on `db` to access your user table.
+    // i.e. if your Prisma model is named `User` this value would be `user`, as in `db.user`
+    authModelAccessor: 'user',
+
+    // A map of what dbAuth calls a field to what your database calls it.
+    // `id` is whatever column you use to uniquely identify a user (probably
+    // something like `id` or `userId` or even `email`)
+    authFields: {
+      id: 'id',
+      username: 'email',
+      hashedPassword: 'hashedPassword',
+      salt: 'salt',
+      resetToken: 'resetToken',
+      resetTokenExpiresAt: 'resetTokenExpiresAt',
+    },
+
+    // A list of fields on your user object that are safe to return to the
+    // client when invoking a handler that returns a user (like forgotPassword
+    // and signup). This list should be as small as possible to be sure not to
+    // leak any sensitive information to the client.
+    allowedUserFields: ['id', 'email'],
+
+    // Specifies attributes on the cookie that dbAuth sets in order to remember
+    // who is logged in. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
+    cookie: {
+      attributes: cookieAttributes,
+      name: cookieName,
+    },
+
+    forgotPassword: forgotPasswordOptions,
+    login: loginOptions,
+    resetPassword: resetPasswordOptions,
+    signup: signupOptions,
+  })
+
+  return await authHandler.invoke()
+}

package/dist/templates/api/functions/auth.webAuthn.oauth.ts.template

@@ -0,0 +1,345 @@
+import type { APIGatewayProxyEvent, Context } from 'aws-lambda'
+
+import { DbAuthHandler } from '@cedarjs/auth-dbauth-api'
+import type { DbAuthHandlerOptions, UserType } from '@cedarjs/auth-dbauth-api'
+import {
+  OAuthHandler,
+  googleProvider,
+  githubProvider,
+} from '@cedarjs/auth-dbauth-oauth'
+
+import { cookieName } from 'src/lib/auth'
+import { db } from 'src/lib/db'
+
+// Any request whose path falls under this prefix is routed to the OAuth
+// handler instead of the regular username/password dbAuth handler. This
+// must match the callback URLs registered with each provider below (e.g.
+// `${apiUrl}/auth/oauth/google/callback`).
+const OAUTH_BASE_PATH = '/auth/oauth'
+
+// The base URL of your deployed api side. Used to build the OAuth callback
+// URLs registered with each provider's developer console. Update the
+// production value once you know your deployed URL.
+const apiUrl =
+  process.env.NODE_ENV === 'development'
+    ? 'http://localhost:8911'
+    : 'https://server.com'
+
+const cookieAttributes = {
+  HttpOnly: true,
+  Path: '/',
+  SameSite: 'Lax' as const,
+  Secure: process.env.NODE_ENV !== 'development',
+
+  // If you need to allow other domains (besides the api side) access to
+  // the dbAuth session cookie:
+  // Domain: 'example.com',
+}
+
+export const handler = async (
+  event: APIGatewayProxyEvent,
+  context: Context
+) => {
+  if (event.path?.includes(OAUTH_BASE_PATH)) {
+    const oauthHandler = new OAuthHandler(event, context, {
+      // Provide prisma db client
+      db: db,
+
+      // The name of the property you'd call on `db` to access your user
+      // table. i.e. if your Prisma model is named `User` this value would
+      // be `user`, as in `db.user`
+      authModelAccessor: 'user',
+
+      // The name of the property you'd call on `db` to access your OAuth
+      // identity table. i.e. if your Prisma model is named `OAuth` this
+      // value would be `oAuth`, as in `db.oAuth`
+      oauthModelAccessor: 'oAuth',
+
+      // A map of what dbAuth calls a field to what your database calls it,
+      // matching the same fields used by `DbAuthHandler` below
+      authFields: {
+        id: 'id',
+        username: 'email',
+        hashedPassword: 'hashedPassword',
+      },
+
+      basePath: OAUTH_BASE_PATH,
+
+      // The configured OAuth providers, keyed by the path segment used in
+      // `/auth/oauth/{key}/...`. Get client id/secret values from each
+      // provider's developer console and set them in your `.env` file.
+      providers: {
+        // @oauth-provider:google
+        google: googleProvider({
+          clientId: process.env.GOOGLE_CLIENT_ID as string,
+          clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
+          redirectUri: `${apiUrl}/auth/oauth/google/callback`,
+        }),
+        // @oauth-provider:google:end
+        // @oauth-provider:github
+        github: githubProvider({
+          clientId: process.env.GITHUB_CLIENT_ID as string,
+          clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
+          redirectUri: `${apiUrl}/auth/oauth/github/callback`,
+        }),
+        // @oauth-provider:github:end
+      },
+
+      // Where to send the browser after each flow completes
+      redirects: {
+        afterLogin: '/',
+        error: '/login',
+      },
+
+      signup: {
+        // handler() is invoked the first time a user signs in with a
+        // configured OAuth provider and no account is linked to that
+        // provider identity yet. `profile` is the canonical profile the
+        // provider returned (`providerUserId`, `email`, `username`, etc).
+        //
+        // At a minimum you need to create and return a user row. There's no
+        // password to store here since this account only ever signs in
+        // through the provider -- if your `User` model requires
+        // `hashedPassword`/`salt`, make sure those fields are optional (or
+        // have a default) so provider-only accounts can be created.
+        handler: ({ profile }) => {
+          // Some providers (e.g. GitHub, when the account keeps its email
+          // private) don't return an email at all. Customize this handler
+          // for any such provider you configure -- ask for an email on a
+          // follow-up screen, or derive a placeholder from a field you know
+          // is always present. Throwing here surfaces to the user as a
+          // `provider_error` redirect instead of silently creating an
+          // account with a fabricated address.
+          if (!profile.email) {
+            throw new Error(
+              `OAuth signup handler needs an email, but ${profile.providerUserId} didn't return one. Customize this handler to handle providers that don't supply an email.`,
+            )
+          }
+
+          return db.user.create({
+            data: {
+              email: profile.email,
+            },
+          })
+        },
+      },
+
+      // How long a user will remain logged in, in seconds
+      sessionExpires: 60 * 60 * 24 * 365 * 10,
+
+      // Specifies attributes on the cookie that dbAuth sets in order to
+      // remember who is logged in. See
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
+      cookie: {
+        attributes: cookieAttributes,
+        name: cookieName,
+      },
+    })
+
+    return await oauthHandler.invoke()
+  }
+
+  const forgotPasswordOptions: DbAuthHandlerOptions['forgotPassword'] = {
+    // handler() is invoked after verifying that a user was found with the given
+    // username. This is where you can send the user an email with a link to
+    // reset their password. With the default dbAuth routes and field names, the
+    // URL to reset the password will be:
+    //
+    // https://example.com/reset-password?resetToken=${user.resetToken}
+    //
+    // Whatever is returned from this function will be returned from
+    // the `forgotPassword()` function that is destructured from `useAuth()`
+    // You could use this return value to, for example, show the email
+    // address in a toast message so the user will know it worked and where
+    // to look for the email.
+    handler: (user) => {
+      return user
+    },
+
+    // How long the resetToken is valid for, in seconds (default is 24 hours)
+    expires: 60 * 60 * 24,
+
+    errors: {
+      // for security reasons you may want to be vague here rather than expose
+      // the fact that the email address wasn't found (prevents fishing for
+      // valid email addresses)
+      usernameNotFound: 'Username not found',
+      // if the user somehow gets around client validation
+      usernameRequired: 'Username is required',
+    },
+  }
+
+  const loginOptions: DbAuthHandlerOptions['login'] = {
+    // handler() is called after finding the user that matches the
+    // username/password provided at login, but before actually considering them
+    // logged in. The `user` argument will be the user in the database that
+    // matched the username/password.
+    //
+    // If you want to allow this user to log in simply return the user.
+    //
+    // If you want to prevent someone logging in for another reason (maybe they
+    // didn't validate their email yet), throw an error and it will be returned
+    // by the `logIn()` function from `useAuth()` in the form of:
+    // `{ message: 'Error message' }`
+    handler: (user) => {
+      return user
+    },
+
+    errors: {
+      usernameOrPasswordMissing: 'Both username and password are required',
+      usernameNotFound: 'Username ${username} not found',
+      // For security reasons you may want to make this the same as the
+      // usernameNotFound error so that a malicious user can't use the error
+      // to narrow down if it's the username or password that's incorrect
+      incorrectPassword: 'Incorrect password for ${username}',
+    },
+
+    // How long a user will remain logged in, in seconds
+    expires: 60 * 60 * 24 * 365 * 10,
+  }
+
+  const resetPasswordOptions: DbAuthHandlerOptions['resetPassword'] = {
+    // handler() is invoked after the password has been successfully updated in
+    // the database. Returning anything truthy will automatically logs the user
+    // in. Return `false` otherwise, and in the Reset Password page redirect the
+    // user to the login page.
+    handler: (_user) => {
+      return true
+    },
+
+    // If `false` then the new password MUST be different than the current one
+    allowReusedPassword: true,
+
+    errors: {
+      // the resetToken is valid, but expired
+      resetTokenExpired: 'resetToken is expired',
+      // no user was found with the given resetToken
+      resetTokenInvalid: 'resetToken is invalid',
+      // the resetToken was not present in the URL
+      resetTokenRequired: 'resetToken is required',
+      // new password is the same as the old password (apparently they did not forget it)
+      reusedPassword: 'Must choose a new password',
+    },
+  }
+
+  interface UserAttributes {
+    name: string
+  }
+
+  const signupOptions: DbAuthHandlerOptions<
+    UserType,
+    UserAttributes
+  >['signup'] = {
+    // Whatever you want to happen to your data on new user signup. Cedar will
+    // check for duplicate usernames before calling this handler. At a minimum
+    // you need to save the `username`, `hashedPassword` and `salt` to your
+    // user table. `userAttributes` contains any additional object members that
+    // were included in the object given to the `signUp()` function you got
+    // from `useAuth()`.
+    //
+    // If you want the user to be immediately logged in, return the user that
+    // was created.
+    //
+    // If this handler throws an error, it will be returned by the `signUp()`
+    // function in the form of: `{ error: 'Error message' }`.
+    //
+    // If this returns anything else, it will be returned by the
+    // `signUp()` function in the form of: `{ message: 'String here' }`.
+    handler: ({
+      username,
+      hashedPassword,
+      salt,
+      userAttributes: _userAttributes,
+    }) => {
+      return db.user.create({
+        data: {
+          email: username,
+          hashedPassword: hashedPassword,
+          salt: salt,
+          // name: userAttributes.name
+        },
+      })
+    },
+
+    // Include any format checks for password here. Return `true` if the
+    // password is valid, otherwise throw a `PasswordValidationError`.
+    // Import the error along with `DbAuthHandler` from `@cedarjs/api` above.
+    passwordValidation: (_password) => {
+      return true
+    },
+
+    errors: {
+      // `field` will be either "username" or "password"
+      fieldMissing: '${field} is required',
+      usernameTaken: 'Username `${username}` already in use',
+    },
+  }
+
+  const authHandler = new DbAuthHandler(event, context, {
+    // Provide prisma db client
+    db: db,
+
+    // The name of the property you'd call on `db` to access your user table.
+    // ie. if your Prisma model is named `User` this value would be `user`, as in `db.user`
+    authModelAccessor: 'user',
+
+    // The name of the property you'd call on `db` to access your user credentials table.
+    // ie. if your Prisma model is named `UserCredential` this value would be `userCredential`, as in `db.userCredential`
+    credentialModelAccessor: 'userCredential',
+
+    // A map of what dbAuth calls a field to what your database calls it.
+    // `id` is whatever column you use to uniquely identify a user (probably
+    // something like `id` or `userId` or even `email`)
+    authFields: {
+      id: 'id',
+      username: 'email',
+      hashedPassword: 'hashedPassword',
+      salt: 'salt',
+      resetToken: 'resetToken',
+      resetTokenExpiresAt: 'resetTokenExpiresAt',
+      challenge: 'webAuthnChallenge',
+    },
+
+    // Specifies attributes on the cookie that dbAuth sets in order to remember
+    // who is logged in. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
+    cookie: {
+      attributes: cookieAttributes,
+      name: cookieName,
+    },
+
+    forgotPassword: forgotPasswordOptions,
+    login: loginOptions,
+    resetPassword: resetPasswordOptions,
+    signup: signupOptions,
+
+    // See https://cedarjs.com/docs/auth/dbauth#webauthn for options
+    webAuthn: {
+      enabled: true,
+      // How long to allow re-auth via WebAuthn in seconds (default is 10 years).
+      // The `login.expires` time denotes how many seconds before a user will be
+      // logged out, and this value is how long they'll be to continue to use a
+      // fingerprint/face scan to log in again. When this one expires they
+      // *must* re-enter username and password to authenticate (WebAuthn will
+      // then be re-enabled for this amount of time).
+      expires: 60 * 60 * 24 * 365 * 10,
+      name: 'Cedar Application',
+      domain:
+        process.env.NODE_ENV === 'development' ? 'localhost' : 'server.com',
+      origin:
+        process.env.NODE_ENV === 'development'
+          ? 'http://localhost:8910'
+          : 'https://server.com',
+      type: 'platform',
+      timeout: 60000,
+      credentialFields: {
+        id: 'id',
+        userId: 'userId',
+        publicKey: 'publicKey',
+        transports: 'transports',
+        counter: 'counter',
+      },
+    },
+  })
+
+  return await authHandler.invoke()
+}

package/dist/webAuthn.setupData.d.ts

@@ -1,4 +1,4 @@
-import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers';
+import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers/auth/setupHelpers';
 export { extraTask } from './setupData.js';
 export declare const webPackages: string[];
 export declare const apiPackages: string[];

package/dist/webAuthn.setupData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webAuthn.setupData.d.ts","sourceRoot":"","sources":["../src/webAuthn.setupData.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAK5D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG1C,eAAO,MAAM,WAAW,UAAkC,CAAA;AAG1D,eAAO,MAAM,WAAW,UAAiC,CAAA;AAEzD,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CA+BnC,CAAA;AAGD,eAAO,MAAM,KAAK,UAoEjB,CAAA;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA"}
+{"version":3,"file":"webAuthn.setupData.d.ts","sourceRoot":"","sources":["../src/webAuthn.setupData.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AAO9E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG1C,eAAO,MAAM,WAAW,UAAkC,CAAA;AAG1D,eAAO,MAAM,WAAW,UAAiC,CAAA;AAEzD,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CA+BnC,CAAA;AAGD,eAAO,MAAM,KAAK,UAoEjB,CAAA;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA"}

package/dist/webAuthn.setupData.js

@@ -1,9 +1,10 @@
 import path from "node:path";
-import { getPaths, colors } from "@cedarjs/cli-helpers";
+import { colors } from "@cedarjs/cli-helpers/colors";
+import { getPaths } from "@cedarjs/cli-helpers/paths";
 import { addModels, functionsPath, hasModel, libPath } from "./shared.js";
 import { extraTask } from "./setupData.js";
-const webPackages = ["@simplewebauthn/browser@^10"];
-const apiPackages = ["@simplewebauthn/server@^10"];
+const webPackages = ["@simplewebauthn/browser@^13"];
+const apiPackages = ["@simplewebauthn/server@^13"];
 const createUserModelTask = {
   title: "Creating model `User`...",
   task: async (ctx) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/auth-dbauth-setup",
-  "version": "7.0.0",
+  "version": "8.0.0-canary.3265",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cedarjs/cedar.git",
@@ -23,16 +23,16 @@
     "test:watch": "yarn test --watch"
   },
   "dependencies": {
-    "@cedarjs/cli-helpers": "7.0.0",
-    "@cedarjs/project-config": "7.0.0",
-    "@prisma/internals": "7.8.0",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3265",
+    "@cedarjs/project-config": "8.0.0-canary.3265",
+    "@prisma/internals": "7.10.0",
     "prompts": "2.4.2",
     "termi-link": "1.1.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "7.0.0",
+    "@cedarjs/framework-tools": "8.0.0-canary.3265",
     "@types/yargs": "17.0.35",
-    "memfs": "4.78.1",
+    "memfs": "4.79.0",
     "nodemon": "3.1.14",
     "ts-dedent": "2.3.0",
     "typescript": "5.9.3",