@cedarjs/auth-dbauth-setup 7.0.1-next.467 → 7.1.0-rc.32

package/dist/oauth.setupData.js

@@ -1,336 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { colors } from "@cedarjs/cli-helpers/colors";
-import { getPaths } from "@cedarjs/cli-helpers/paths";
-import { isTypeScriptProject } from "@cedarjs/cli-helpers/project";
-import { addModels, functionsPath, hasModel, libPath } from "./shared.js";
-const KNOWN_OAUTH_PROVIDERS = ["google", "github"];
-function isKnownOAuthProvider(value) {
-  return KNOWN_OAUTH_PROVIDERS.includes(value);
-}
-function parseOAuthProviders(oauth) {
-  if (oauth === null || oauth === void 0) {
-    return [];
-  }
-  const requested = oauth.split(",").map((provider) => provider.trim().toLowerCase()).filter(Boolean);
-  const uniqueRequested = [...new Set(requested)];
-  if (uniqueRequested.length === 0) {
-    throw new Error(
-      "--oauth requires at least one provider, e.g. --oauth google,github"
-    );
-  }
-  const unknownProviders = uniqueRequested.filter(
-    (provider) => !isKnownOAuthProvider(provider)
-  );
-  if (unknownProviders.length > 0) {
-    throw new Error(
-      `Unknown OAuth provider(s): ${unknownProviders.join(", ")}. Cedar ships built-in support for ${KNOWN_OAUTH_PROVIDERS.join(
-        ", "
-      )}. For any other provider, implement the \`OAuthStrategy\` interface from \`@cedarjs/auth-dbauth-oauth\` -- see https://cedarjs.com/docs/auth/dbauth#oauth-custom-strategies`
-    );
-  }
-  return uniqueRequested;
-}
-const apiPackages = ["oauth4webapi@^3"];
-const OAUTH_MODEL = `
-model OAuth {
-  id               String   @id @default(uuid())
-  provider         String
-  providerUserId   String
-  providerUsername String?
-  providerEmail    String?
-  userId           String
-  user             User     @relation(fields: [userId], references: [id])
-  createdAt        DateTime @default(now())
-  updatedAt        DateTime @updatedAt
-
-  @@unique([provider, providerUserId])
-  @@unique([userId, provider])
-}
-`;
-const createUserModelTask = {
-  title: "Creating model `User`...",
-  task: async (ctx) => {
-    const hasUserModel = await hasModel("User");
-    if (hasUserModel && !ctx.force) {
-      throw new Error("User model already exists");
-    }
-    addModels(`
-model User {
-  id                  String    @id @default(uuid())
-  email               String    @unique
-  hashedPassword      String?
-  salt                String?
-  resetToken          String?
-  resetTokenExpiresAt DateTime?
-  oauthIdentities     OAuth[]
-  createdAt           DateTime  @default(now())
-  updatedAt           DateTime  @updatedAt
-}
-${OAUTH_MODEL}`);
-  }
-};
-const webAuthnCreateUserModelTask = {
-  title: "Creating model `User`...",
-  task: async (ctx) => {
-    const hasUserModel = await hasModel("User");
-    if (hasUserModel && !ctx.force) {
-      throw new Error("User model already exists");
-    }
-    addModels(`
-model User {
-  id                  String    @id @default(uuid())
-  email               String    @unique
-  hashedPassword      String?
-  salt                String?
-  resetToken          String?
-  resetTokenExpiresAt DateTime?
-  webAuthnChallenge   String? @unique
-  credentials         UserCredential[]
-  oauthIdentities     OAuth[]
-  createdAt           DateTime @default(now())
-  updatedAt           DateTime @updatedAt
-}
-
-model UserCredential {
-  id         String  @id
-  userId     String
-  user       User    @relation(fields: [userId], references: [id])
-  publicKey  Bytes
-  transports String?
-  counter    BigInt
-}
-${OAUTH_MODEL}`);
-  }
-};
-const OAUTH_ENV_VAR_NAMES = {
-  google: ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
-  github: ["GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET"]
-};
-function envVarNotes(providers) {
-  return [
-    "",
-    "Add the client id and secret for each configured OAuth provider to your .env file (get these from each provider\u2019s developer console):",
-    "",
-    ...providers.flatMap((provider) => [
-      `  # ${provider}`,
-      ...OAUTH_ENV_VAR_NAMES[provider].map((name) => `  ${name}=`)
-    ])
-  ];
-}
-function schemaNotes() {
-  return [
-    "",
-    "You will also need to add an `OAuth` model to your Prisma schema to",
-    "keep track of linked provider accounts:",
-    "",
-    "  model OAuth {",
-    "    id               String   @id @default(uuid())",
-    "    provider         String",
-    "    providerUserId   String",
-    "    providerUsername String?",
-    "    providerEmail    String?",
-    "    userId           String",
-    "    user             User     @relation(fields: [userId], references: [id])",
-    "    createdAt        DateTime @default(now())",
-    "    updatedAt        DateTime @updatedAt",
-    "",
-    "    @@unique([provider, providerUserId])",
-    "    @@unique([userId, provider])",
-    "  }",
-    "",
-    "Since users can now sign up with just an OAuth provider (no password),",
-    "`hashedPassword` and `salt` on your `User` model must be optional (or",
-    "have a default value):",
-    "",
-    "  hashedPassword String?",
-    "  salt           String?",
-    "",
-    "Don't forget to add the inverse relation to `User`:",
-    "",
-    "  oauthIdentities OAuth[]"
-  ];
-}
-function notes() {
-  return [
-    `${colors.warning("Done! But you have a little more work to do:")}
-`,
-    "You will need to add a couple of fields to your User table in order",
-    "to store a hashed password and salt:",
-    "",
-    "  model User {",
-    "    id                  String  @id @default(uuid())",
-    "    email               String  @unique",
-    "    hashedPassword      String?   // <\u2500\u2510",
-    "    salt                String?   // <\u2500\u2534\u2500 add these lines",
-    "    resetToken          String?   // <\u2500\u2524",
-    "    resetTokenExpiresAt DateTime? // <\u2500\u2518",
-    "  }",
-    ...schemaNotes(),
-    "",
-    "If you expose any of your user data via GraphQL be sure to exclude",
-    "`hashedPassword` and `salt` (or whatever you named them) from the",
-    "SDL file that defines the fields for your user.",
-    "",
-    "You'll need to let Cedar know what fields you're using for your users'",
-    "`id` and `username` fields. In this case we're using `id` and `email`,",
-    "so update those in the `authFields` config in",
-    `\`${functionsPath}/auth.js\`. This is also the place to tell Cedar if`,
-    "you used a different name for the `hashedPassword`, `salt`,",
-    "`resetToken` or `resetTokenExpiresAt`, fields:`",
-    "",
-    "  authFields: {",
-    "    id: 'id',",
-    "    username: 'email',",
-    "    hashedPassword: 'hashedPassword',",
-    "    salt: 'salt',",
-    "    resetToken: 'resetToken',",
-    "    resetTokenExpiresAt: 'resetTokenExpiresAt',",
-    "  },",
-    "",
-    "To get the actual user that's logged in, take a look at `getCurrentUser()`",
-    `in \`${libPath}/auth.js\`. We default it to something simple, but you may`,
-    "use different names for your model or unique ID fields, in which case you",
-    "need to update those calls (instructions are in the comment above the code).",
-    "",
-    "Finally, we created a SESSION_SECRET environment variable for you in",
-    `${path.join(getPaths().base, ".env")}. This value should NOT be checked`,
-    "into version control and should be unique for each environment you",
-    "deploy to. If you ever need to log everyone out of your app at once",
-    "change this secret to a new value and deploy. To create a new secret, run:",
-    "",
-    "  yarn cedar generate secret",
-    ""
-  ];
-}
-function webAuthnOauthNotes() {
-  return [
-    `${colors.warning("Done! But you have a little more work to do:")}
-`,
-    "You will need to add a couple of fields to your User table in order",
-    "to store a hashed password, salt, reset token, and to connect it to",
-    "a new UserCredential model to keep track of any devices used with",
-    "WebAuthn authentication:",
-    "",
-    "  model User {",
-    "    id                  String  @id @default(uuid())",
-    "    email               String  @unique",
-    "    hashedPassword      String?",
-    "    salt                String?",
-    "    resetToken          String?",
-    "    resetTokenExpiresAt DateTime?",
-    "    webAuthnChallenge   String? @unique",
-    "    credentials         UserCredential[]",
-    "  }",
-    "",
-    "  model UserCredential {",
-    "    id         String  @id",
-    "    userId     String",
-    "    user       User    @relation(fields: [userId], references: [id])",
-    "    publicKey  Bytes",
-    "    transports String?",
-    "    counter    BigInt",
-    "  }",
-    ...schemaNotes(),
-    "",
-    "If you expose any of your user data via GraphQL be sure to exclude",
-    "`hashedPassword` and `salt` (or whatever you named them) from the",
-    "SDL file that defines the fields for your user.",
-    "",
-    "You'll need to let Cedar know what fields you're using for your users'",
-    "`id` and `username` fields. In this case we're using `id` and `email`,",
-    "so update those in the `authFields` config in",
-    `\`${functionsPath}/auth.js\`. This is also the place to tell Cedar if`,
-    "you used a different name for the `hashedPassword`, `salt`,",
-    "`resetToken` or `resetTokenExpiresAt`, fields:`",
-    "",
-    "  authFields: {",
-    "    id: 'id',",
-    "    username: 'email',",
-    "    hashedPassword: 'hashedPassword',",
-    "    salt: 'salt',",
-    "    resetToken: 'resetToken',",
-    "    resetTokenExpiresAt: 'resetTokenExpiresAt',",
-    "    challenge: 'webAuthnChallenge'",
-    "  },",
-    "",
-    "To get the actual user that's logged in, take a look at `getCurrentUser()`",
-    `in \`${libPath}/auth.js\`. We default it to something simple, but you may`,
-    "use different names for your model or unique ID fields, in which case you",
-    "need to update those calls (instructions are in the comment above the code).",
-    "",
-    "Finally, we created a SESSION_SECRET environment variable for you in",
-    `${path.join(getPaths().base, ".env")}. This value should NOT be checked`,
-    "into version control and should be unique for each environment you",
-    "deploy to. If you ever need to log everyone out of your app at once",
-    "change this secret to a new value and deploy. To create a new secret, run:",
-    "",
-    "  yarn cedar generate secret",
-    ""
-  ];
-}
-const noteGenerate = [
-  "",
-  "Need simple Login, Signup and Forgot Password pages? We've got a generator",
-  "for those as well:",
-  "",
-  "  yarn cedar generate dbAuth"
-];
-function pruneOAuthProviders(content, providers) {
-  let result = content;
-  for (const provider of KNOWN_OAUTH_PROVIDERS) {
-    const startMarker = `// @oauth-provider:${provider}`;
-    const endMarker = `// @oauth-provider:${provider}:end`;
-    const blockPattern = new RegExp(
-      `[ \\t]*${escapeRegExp(startMarker)}\\n([\\s\\S]*?)[ \\t]*${escapeRegExp(
-        endMarker
-      )}\\n`
-    );
-    if (providers.includes(provider)) {
-      result = result.replace(blockPattern, "$1");
-    } else {
-      result = result.replace(blockPattern, "");
-      result = result.replace(
-        new RegExp(`^[ \\t]*${provider}Provider,\\n`, "m"),
-        ""
-      );
-    }
-  }
-  return result;
-}
-function escapeRegExp(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function configureOAuthProvidersTask(providers) {
-  return {
-    title: "Configuring selected OAuth providers...",
-    task: () => {
-      const ext = isTypeScriptProject() ? "ts" : "js";
-      const authFunctionPath = path.join(
-        getPaths().api.functions,
-        `auth.${ext}`
-      );
-      if (!fs.existsSync(authFunctionPath)) {
-        return;
-      }
-      const content = fs.readFileSync(authFunctionPath, "utf-8");
-      const prunedContent = pruneOAuthProviders(content, providers);
-      if (prunedContent !== content) {
-        fs.writeFileSync(authFunctionPath, prunedContent);
-      }
-    }
-  };
-}
-export {
-  KNOWN_OAUTH_PROVIDERS,
-  apiPackages,
-  configureOAuthProvidersTask,
-  createUserModelTask,
-  envVarNotes,
-  noteGenerate,
-  notes,
-  parseOAuthProviders,
-  pruneOAuthProviders,
-  webAuthnCreateUserModelTask,
-  webAuthnOauthNotes
-};

package/dist/templates/api/functions/auth.oauth.ts.template

@@ -1,364 +0,0 @@
-import type { APIGatewayProxyEvent, Context } from 'aws-lambda'
-
-import { DbAuthHandler } from '@cedarjs/auth-dbauth-api'
-import type { DbAuthHandlerOptions, UserType } from '@cedarjs/auth-dbauth-api'
-import {
-  OAuthHandler,
-  googleProvider,
-  githubProvider,
-} from '@cedarjs/auth-dbauth-oauth'
-
-import { cookieName } from 'src/lib/auth'
-import { db } from 'src/lib/db'
-
-// Any request whose path falls under this prefix is routed to the OAuth
-// handler instead of the regular username/password dbAuth handler. This
-// must match the callback URLs registered with each provider below (e.g.
-// `${apiUrl}/auth/oauth/google/callback`).
-const OAUTH_BASE_PATH = '/auth/oauth'
-
-// The base URL of your deployed api side. Used to build the OAuth callback
-// URLs registered with each provider's developer console. Update the
-// production value once you know your deployed URL.
-const apiUrl =
-  process.env.NODE_ENV === 'development'
-    ? 'http://localhost:8911'
-    : 'https://server.com'
-
-const cookieAttributes = {
-  HttpOnly: true,
-  Path: '/',
-  SameSite: 'Lax' as const,
-  Secure: process.env.NODE_ENV !== 'development',
-
-  // If you need to allow other domains (besides the api side) access to
-  // the dbAuth session cookie:
-  // Domain: 'example.com',
-}
-
-export const handler = async (
-  event: APIGatewayProxyEvent,
-  context: Context
-) => {
-  if (event.path?.includes(OAUTH_BASE_PATH)) {
-    const oauthHandler = new OAuthHandler(event, context, {
-      // Provide prisma db client
-      db: db,
-
-      // The name of the property you'd call on `db` to access your user
-      // table. i.e. if your Prisma model is named `User` this value would
-      // be `user`, as in `db.user`
-      authModelAccessor: 'user',
-
-      // The name of the property you'd call on `db` to access your OAuth
-      // identity table. i.e. if your Prisma model is named `OAuth` this
-      // value would be `oAuth`, as in `db.oAuth`
-      oauthModelAccessor: 'oAuth',
-
-      // A map of what dbAuth calls a field to what your database calls it,
-      // matching the same fields used by `DbAuthHandler` below
-      authFields: {
-        id: 'id',
-        username: 'email',
-        hashedPassword: 'hashedPassword',
-      },
-
-      basePath: OAUTH_BASE_PATH,
-
-      // The configured OAuth providers, keyed by the path segment used in
-      // `/auth/oauth/{key}/...`. Get client id/secret values from each
-      // provider's developer console and set them in your `.env` file.
-      providers: {
-        // @oauth-provider:google
-        google: googleProvider({
-          clientId: process.env.GOOGLE_CLIENT_ID as string,
-          clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
-          redirectUri: `${apiUrl}/auth/oauth/google/callback`,
-        }),
-        // @oauth-provider:google:end
-        // @oauth-provider:github
-        github: githubProvider({
-          clientId: process.env.GITHUB_CLIENT_ID as string,
-          clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
-          redirectUri: `${apiUrl}/auth/oauth/github/callback`,
-        }),
-        // @oauth-provider:github:end
-      },
-
-      // Where to send the browser after each flow completes
-      redirects: {
-        afterLogin: '/',
-        error: '/login',
-      },
-
-      signup: {
-        // handler() is invoked the first time a user signs in with a
-        // configured OAuth provider and no account is linked to that
-        // provider identity yet. `profile` is the canonical profile the
-        // provider returned (`providerUserId`, `email`, `username`, etc).
-        //
-        // At a minimum you need to create and return a user row. There's no
-        // password to store here since this account only ever signs in
-        // through the provider -- if your `User` model requires
-        // `hashedPassword`/`salt`, make sure those fields are optional (or
-        // have a default) so provider-only accounts can be created.
-        handler: ({ profile }) => {
-          // Some providers (e.g. GitHub, when the account keeps its email
-          // private) don't return an email at all. Customize this handler
-          // for any such provider you configure -- ask for an email on a
-          // follow-up screen, or derive a placeholder from a field you know
-          // is always present. Throwing here surfaces to the user as a
-          // `provider_error` redirect instead of silently creating an
-          // account with a fabricated address.
-          if (!profile.email) {
-            throw new Error(
-              `OAuth signup handler needs an email, but ${profile.providerUserId} didn't return one. Customize this handler to handle providers that don't supply an email.`,
-            )
-          }
-
-          return db.user.create({
-            data: {
-              email: profile.email,
-            },
-          })
-        },
-      },
-
-      // How long a user will remain logged in, in seconds
-      sessionExpires: 60 * 60 * 24 * 365 * 10,
-
-      // Specifies attributes on the cookie that dbAuth sets in order to
-      // remember who is logged in. See
-      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
-      cookie: {
-        attributes: cookieAttributes,
-        name: cookieName,
-      },
-    })
-
-    return await oauthHandler.invoke()
-  }
-
-  const forgotPasswordOptions: DbAuthHandlerOptions['forgotPassword'] = {
-    // handler() is invoked after verifying that a user was found with the given
-    // username. This is where you can send the user an email with a link to
-    // reset their password.
-    //
-    // Whatever is returned from this function will be returned from
-    // the `forgotPassword()` function that is destructured from `useAuth()`.
-    // You could use this return value to, for example, show the email
-    // address in a toast message so the user will know it worked and where
-    // to look for the email.
-    //
-    // Note that this return value is sent to the client in *plain text*
-    // so don't include anything you wouldn't want prying eyes to see. The
-    // `user` here has been sanitized to only include the fields listed in
-    // `allowedUserFields` so it should be safe to return as-is.
-    handler: (user, _resetToken) => {
-      // TODO: Send an email/message to the user
-      // The message should include a link to reset their password with the
-      // `resetToken`. The URL should look something like:
-      // `http://localhost:8910/reset-password?resetToken=${resetToken}`
-      // When you implement this, change `_resetToken` to `resetToken` in the
-      // function arguments above.
-
-      return user
-    },
-
-    // How long the resetToken is valid for, in seconds (default is 24 hours)
-    expires: 60 * 60 * 24,
-
-    errors: {
-      // for security reasons you may want to be vague here rather than expose
-      // the fact that the email address wasn't found (prevents fishing for
-      // valid email addresses)
-      usernameNotFound: 'Username not found',
-      // if the user somehow gets around client validation
-      usernameRequired: 'Username is required',
-    },
-  }
-
-  const loginOptions: DbAuthHandlerOptions['login'] = {
-    // handler() is called after finding the user that matches the
-    // username/password provided at login, but before actually considering them
-    // logged in. The `user` argument will be the user in the database that
-    // matched the username/password.
-    //
-    // If you want to allow this user to log in simply return the user.
-    //
-    // If you want to prevent someone logging in for another reason (maybe they
-    // didn't validate their email yet), throw an error and it will be returned
-    // by the `logIn()` function from `useAuth()` in the form of:
-    // `{ message: 'Error message' }`
-    handler: (user) => {
-      return user
-    },
-
-    errors: {
-      usernameOrPasswordMissing: 'Both username and password are required',
-      usernameNotFound: 'Username ${username} not found',
-      // For security reasons you may want to make this the same as the
-      // usernameNotFound error so that a malicious user can't use the error
-      // to narrow down if it's the username or password that's incorrect
-      incorrectPassword: 'Incorrect password for ${username}',
-    },
-
-    // How long a user will remain logged in, in seconds
-    expires: 60 * 60 * 24 * 365 * 10,
-  }
-
-  const resetPasswordOptions: DbAuthHandlerOptions['resetPassword'] = {
-    // handler() is invoked after the password has been successfully updated in
-    // the database. Returning anything truthy will automatically log the user
-    // in. Return `false` otherwise, and in the Reset Password page redirect the
-    // user to the login page.
-    handler: (_user) => {
-      return true
-    },
-
-    // If `false` then the new password MUST be different from the current one
-    allowReusedPassword: true,
-
-    errors: {
-      // the resetToken is valid, but expired
-      resetTokenExpired: 'resetToken is expired',
-      // no user was found with the given resetToken
-      resetTokenInvalid: 'resetToken is invalid',
-      // the resetToken was not present in the URL
-      resetTokenRequired: 'resetToken is required',
-      // new password is the same as the old password (apparently they did not forget it)
-      reusedPassword: 'Must choose a new password',
-    },
-  }
-
-  const changePasswordOptions: DbAuthHandlerOptions['changePassword'] = {
-    // handler() is invoked after a logged in user has entered their current
-    // password correctly and the new password has been saved to the database.
-    // This is a good place to let the user know, by email for example, that
-    // their password was changed.
-    //
-    // Returning anything truthy keeps the user logged in. Return `false` to
-    // log them out, and in the Change Password page redirect the user to the
-    // login page.
-    handler: (_user) => {
-      // TODO: Send an email/message to the user letting them know that their
-      // password was changed. When you implement this, change `_user` to
-      // `user` in the function arguments above.
-
-      return true
-    },
-
-    // If `false` then the new password MUST be different from the current one
-    allowReusedPassword: false,
-
-    errors: {
-      // the current password was not provided
-      currentPasswordRequired: 'Current password is required',
-      // the new password was not provided
-      newPasswordRequired: 'New password is required',
-      // the current password is not correct
-      incorrectCurrentPassword: 'Current password is incorrect',
-      // the user doesn't have a password yet (they signed up with a third
-      // party login provider, for example)
-      passwordNotSet:
-        'This account does not have a password. Use "Forgot password" to set one',
-      // new password is the same as the current password
-      reusedPassword: 'Must choose a new password',
-    },
-  }
-
-  interface UserAttributes {
-    name: string
-  }
-
-  const signupOptions: DbAuthHandlerOptions<
-    UserType,
-    UserAttributes
-  >['signup'] = {
-    // Whatever you want to happen to your data on new user signup. Cedar will
-    // check for duplicate usernames before calling this handler. At a minimum
-    // you need to save the `username`, `hashedPassword` and `salt` to your
-    // user table. `userAttributes` contains any additional object members that
-    // were included in the object given to the `signUp()` function you got
-    // from `useAuth()`.
-    //
-    // If you want the user to be immediately logged in, return the user that
-    // was created.
-    //
-    // If this handler throws an error, it will be returned by the `signUp()`
-    // function in the form of: `{ error: 'Error message' }`.
-    //
-    // If this returns anything else, it will be returned by the
-    // `signUp()` function in the form of: `{ message: 'String here' }`.
-    handler: ({
-      username,
-      hashedPassword,
-      salt,
-      userAttributes: _userAttributes,
-    }) => {
-      return db.user.create({
-        data: {
-          email: username,
-          hashedPassword: hashedPassword,
-          salt: salt,
-          // name: userAttributes.name
-        },
-      })
-    },
-
-    // Include any format checks for password here. Return `true` if the
-    // password is valid, otherwise throw a `PasswordValidationError`.
-    // Import the error along with `DbAuthHandler` from `@cedarjs/api` above.
-    passwordValidation: (_password) => {
-      return true
-    },
-
-    errors: {
-      // `field` will be either "username" or "password"
-      fieldMissing: '${field} is required',
-      usernameTaken: 'Username `${username}` already in use',
-    },
-  }
-
-  const authHandler = new DbAuthHandler(event, context, {
-    // Provide prisma db client
-    db: db,
-
-    // The name of the property you'd call on `db` to access your user table.
-    // i.e. if your Prisma model is named `User` this value would be `user`, as in `db.user`
-    authModelAccessor: 'user',
-
-    // A map of what dbAuth calls a field to what your database calls it.
-    // `id` is whatever column you use to uniquely identify a user (probably
-    // something like `id` or `userId` or even `email`)
-    authFields: {
-      id: 'id',
-      username: 'email',
-      hashedPassword: 'hashedPassword',
-      salt: 'salt',
-      resetToken: 'resetToken',
-      resetTokenExpiresAt: 'resetTokenExpiresAt',
-    },
-
-    // A list of fields on your user object that are safe to return to the
-    // client when invoking a handler that returns a user (like forgotPassword
-    // and signup). This list should be as small as possible to be sure not to
-    // leak any sensitive information to the client.
-    allowedUserFields: ['id', 'email'],
-
-    // Specifies attributes on the cookie that dbAuth sets in order to remember
-    // who is logged in. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies
-    cookie: {
-      attributes: cookieAttributes,
-      name: cookieName,
-    },
-
-    changePassword: changePasswordOptions,
-    forgotPassword: forgotPasswordOptions,
-    login: loginOptions,
-    resetPassword: resetPasswordOptions,
-    signup: signupOptions,
-  })
-
-  return await authHandler.invoke()
-}