@cedarjs/auth-dbauth-setup 7.1.0 → 7.1.1-next.468

package/dist/oauth.setupData.d.ts

@@ -0,0 +1,57 @@
+import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers/auth/setupHelpers';
+/**
+ * The OAuth providers `cedar setup auth dbAuth --oauth` knows how to
+ * configure out of the box. Anything else is served by implementing the
+ * `OAuthStrategy` interface, documented at
+ * https://cedarjs.com/docs/auth/dbauth#oauth-custom-strategies
+ */
+export declare const KNOWN_OAUTH_PROVIDERS: readonly ["google", "github"];
+export type OAuthProviderName = (typeof KNOWN_OAUTH_PROVIDERS)[number];
+/**
+ * Parses the comma-separated value of `--oauth` into a deduped list of
+ * provider names, validating every entry against `KNOWN_OAUTH_PROVIDERS`.
+ *
+ * Returns an empty array when `oauth` is nullish (the flag wasn't passed).
+ * Some callers pass `null` explicitly for "flag absent"; others invoke the
+ * setup handler programmatically and simply omit the argument, which comes
+ * through as `undefined`. Both mean "OAuth disabled".
+ */
+export declare function parseOAuthProviders(oauth: string | null | undefined): OAuthProviderName[];
+export declare const apiPackages: string[];
+export declare const createUserModelTask: {
+    title: string;
+    task: (ctx: AuthGeneratorCtx) => Promise<void>;
+};
+export declare const webAuthnCreateUserModelTask: {
+    title: string;
+    task: (ctx: AuthGeneratorCtx) => Promise<void>;
+};
+export declare function envVarNotes(providers: OAuthProviderName[]): string[];
+export declare function notes(): string[];
+export declare function webAuthnOauthNotes(): string[];
+export declare const noteGenerate: string[];
+/**
+ * Strips the config for every OAuth provider that wasn't selected out of the
+ * `auth.oauth.ts`/`auth.webAuthn.oauth.ts` templates, and drops the marker
+ * comments around the config for every provider that was.
+ *
+ * The templates carry every known provider so there's a single source of
+ * truth for the generated file's shape; this function is what turns that
+ * into a file that only configures the providers the user actually asked
+ * for. It's a pure string transform, so re-running setup (which always
+ * starts from a fresh copy of the template) produces byte-identical output.
+ *
+ * Exported for testing.
+ */
+export declare function pruneOAuthProviders(content: string, providers: OAuthProviderName[]): string;
+/**
+ * Rewrites the generated `functions/auth.ts` (or `.js`) in place so it only
+ * configures the OAuth providers the user selected with `--oauth`. Runs
+ * after `generateAuthApiFiles` has written the fresh, unpruned template, so
+ * every run starts from the same source and produces the same result.
+ */
+export declare function configureOAuthProvidersTask(providers: OAuthProviderName[]): {
+    title: string;
+    task: () => void;
+};
+//# sourceMappingURL=oauth.setupData.d.ts.map

package/dist/oauth.setupData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.setupData.d.ts","sourceRoot":"","sources":["../src/oauth.setupData.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AAO9E;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,+BAAgC,CAAA;AAElE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AAMtE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,iBAAiB,EAAE,CAqCrB;AAGD,eAAO,MAAM,WAAW,UAAsB,CAAA;AAmB9C,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CAqBnC,CAAA;AAED,eAAO,MAAM,2BAA2B;;gBAEpB,gBAAgB;CAgCnC,CAAA;AAOD,wBAAgB,WAAW,CAAC,SAAS,EAAE,iBAAiB,EAAE,YAWzD;AAuCD,wBAAgB,KAAK,aAkDpB;AAED,wBAAgB,kBAAkB,aAgEjC;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,iBAAiB,EAAE,UA2B/B;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,iBAAiB,EAAE;;;EAsBzE"}

package/dist/oauth.setupData.js

@@ -0,0 +1,336 @@
+import fs from "node:fs";
+import path from "node:path";
+import { colors } from "@cedarjs/cli-helpers/colors";
+import { getPaths } from "@cedarjs/cli-helpers/paths";
+import { isTypeScriptProject } from "@cedarjs/cli-helpers/project";
+import { addModels, functionsPath, hasModel, libPath } from "./shared.js";
+const KNOWN_OAUTH_PROVIDERS = ["google", "github"];
+function isKnownOAuthProvider(value) {
+  return KNOWN_OAUTH_PROVIDERS.includes(value);
+}
+function parseOAuthProviders(oauth) {
+  if (oauth === null || oauth === void 0) {
+    return [];
+  }
+  const requested = oauth.split(",").map((provider) => provider.trim().toLowerCase()).filter(Boolean);
+  const uniqueRequested = [...new Set(requested)];
+  if (uniqueRequested.length === 0) {
+    throw new Error(
+      "--oauth requires at least one provider, e.g. --oauth google,github"
+    );
+  }
+  const unknownProviders = uniqueRequested.filter(
+    (provider) => !isKnownOAuthProvider(provider)
+  );
+  if (unknownProviders.length > 0) {
+    throw new Error(
+      `Unknown OAuth provider(s): ${unknownProviders.join(", ")}. Cedar ships built-in support for ${KNOWN_OAUTH_PROVIDERS.join(
+        ", "
+      )}. For any other provider, implement the \`OAuthStrategy\` interface from \`@cedarjs/auth-dbauth-oauth\` -- see https://cedarjs.com/docs/auth/dbauth#oauth-custom-strategies`
+    );
+  }
+  return uniqueRequested;
+}
+const apiPackages = ["oauth4webapi@^3"];
+const OAUTH_MODEL = `
+model OAuth {
+  id               String   @id @default(uuid())
+  provider         String
+  providerUserId   String
+  providerUsername String?
+  providerEmail    String?
+  userId           String
+  user             User     @relation(fields: [userId], references: [id])
+  createdAt        DateTime @default(now())
+  updatedAt        DateTime @updatedAt
+
+  @@unique([provider, providerUserId])
+  @@unique([userId, provider])
+}
+`;
+const createUserModelTask = {
+  title: "Creating model `User`...",
+  task: async (ctx) => {
+    const hasUserModel = await hasModel("User");
+    if (hasUserModel && !ctx.force) {
+      throw new Error("User model already exists");
+    }
+    addModels(`
+model User {
+  id                  String    @id @default(uuid())
+  email               String    @unique
+  hashedPassword      String?
+  salt                String?
+  resetToken          String?
+  resetTokenExpiresAt DateTime?
+  oauthIdentities     OAuth[]
+  createdAt           DateTime  @default(now())
+  updatedAt           DateTime  @updatedAt
+}
+${OAUTH_MODEL}`);
+  }
+};
+const webAuthnCreateUserModelTask = {
+  title: "Creating model `User`...",
+  task: async (ctx) => {
+    const hasUserModel = await hasModel("User");
+    if (hasUserModel && !ctx.force) {
+      throw new Error("User model already exists");
+    }
+    addModels(`
+model User {
+  id                  String    @id @default(uuid())
+  email               String    @unique
+  hashedPassword      String?
+  salt                String?
+  resetToken          String?
+  resetTokenExpiresAt DateTime?
+  webAuthnChallenge   String? @unique
+  credentials         UserCredential[]
+  oauthIdentities     OAuth[]
+  createdAt           DateTime @default(now())
+  updatedAt           DateTime @updatedAt
+}
+
+model UserCredential {
+  id         String  @id
+  userId     String
+  user       User    @relation(fields: [userId], references: [id])
+  publicKey  Bytes
+  transports String?
+  counter    BigInt
+}
+${OAUTH_MODEL}`);
+  }
+};
+const OAUTH_ENV_VAR_NAMES = {
+  google: ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
+  github: ["GITHUB_CLIENT_ID", "GITHUB_CLIENT_SECRET"]
+};
+function envVarNotes(providers) {
+  return [
+    "",
+    "Add the client id and secret for each configured OAuth provider to your .env file (get these from each provider\u2019s developer console):",
+    "",
+    ...providers.flatMap((provider) => [
+      `  # ${provider}`,
+      ...OAUTH_ENV_VAR_NAMES[provider].map((name) => `  ${name}=`)
+    ])
+  ];
+}
+function schemaNotes() {
+  return [
+    "",
+    "You will also need to add an `OAuth` model to your Prisma schema to",
+    "keep track of linked provider accounts:",
+    "",
+    "  model OAuth {",
+    "    id               String   @id @default(uuid())",
+    "    provider         String",
+    "    providerUserId   String",
+    "    providerUsername String?",
+    "    providerEmail    String?",
+    "    userId           String",
+    "    user             User     @relation(fields: [userId], references: [id])",
+    "    createdAt        DateTime @default(now())",
+    "    updatedAt        DateTime @updatedAt",
+    "",
+    "    @@unique([provider, providerUserId])",
+    "    @@unique([userId, provider])",
+    "  }",
+    "",
+    "Since users can now sign up with just an OAuth provider (no password),",
+    "`hashedPassword` and `salt` on your `User` model must be optional (or",
+    "have a default value):",
+    "",
+    "  hashedPassword String?",
+    "  salt           String?",
+    "",
+    "Don't forget to add the inverse relation to `User`:",
+    "",
+    "  oauthIdentities OAuth[]"
+  ];
+}
+function notes() {
+  return [
+    `${colors.warning("Done! But you have a little more work to do:")}
+`,
+    "You will need to add a couple of fields to your User table in order",
+    "to store a hashed password and salt:",
+    "",
+    "  model User {",
+    "    id                  String  @id @default(uuid())",
+    "    email               String  @unique",
+    "    hashedPassword      String?   // <\u2500\u2510",
+    "    salt                String?   // <\u2500\u2534\u2500 add these lines",
+    "    resetToken          String?   // <\u2500\u2524",
+    "    resetTokenExpiresAt DateTime? // <\u2500\u2518",
+    "  }",
+    ...schemaNotes(),
+    "",
+    "If you expose any of your user data via GraphQL be sure to exclude",
+    "`hashedPassword` and `salt` (or whatever you named them) from the",
+    "SDL file that defines the fields for your user.",
+    "",
+    "You'll need to let Cedar know what fields you're using for your users'",
+    "`id` and `username` fields. In this case we're using `id` and `email`,",
+    "so update those in the `authFields` config in",
+    `\`${functionsPath}/auth.js\`. This is also the place to tell Cedar if`,
+    "you used a different name for the `hashedPassword`, `salt`,",
+    "`resetToken` or `resetTokenExpiresAt`, fields:`",
+    "",
+    "  authFields: {",
+    "    id: 'id',",
+    "    username: 'email',",
+    "    hashedPassword: 'hashedPassword',",
+    "    salt: 'salt',",
+    "    resetToken: 'resetToken',",
+    "    resetTokenExpiresAt: 'resetTokenExpiresAt',",
+    "  },",
+    "",
+    "To get the actual user that's logged in, take a look at `getCurrentUser()`",
+    `in \`${libPath}/auth.js\`. We default it to something simple, but you may`,
+    "use different names for your model or unique ID fields, in which case you",
+    "need to update those calls (instructions are in the comment above the code).",
+    "",
+    "Finally, we created a SESSION_SECRET environment variable for you in",
+    `${path.join(getPaths().base, ".env")}. This value should NOT be checked`,
+    "into version control and should be unique for each environment you",
+    "deploy to. If you ever need to log everyone out of your app at once",
+    "change this secret to a new value and deploy. To create a new secret, run:",
+    "",
+    "  yarn cedar generate secret",
+    ""
+  ];
+}
+function webAuthnOauthNotes() {
+  return [
+    `${colors.warning("Done! But you have a little more work to do:")}
+`,
+    "You will need to add a couple of fields to your User table in order",
+    "to store a hashed password, salt, reset token, and to connect it to",
+    "a new UserCredential model to keep track of any devices used with",
+    "WebAuthn authentication:",
+    "",
+    "  model User {",
+    "    id                  String  @id @default(uuid())",
+    "    email               String  @unique",
+    "    hashedPassword      String?",
+    "    salt                String?",
+    "    resetToken          String?",
+    "    resetTokenExpiresAt DateTime?",
+    "    webAuthnChallenge   String? @unique",
+    "    credentials         UserCredential[]",
+    "  }",
+    "",
+    "  model UserCredential {",
+    "    id         String  @id",
+    "    userId     String",
+    "    user       User    @relation(fields: [userId], references: [id])",
+    "    publicKey  Bytes",
+    "    transports String?",
+    "    counter    BigInt",
+    "  }",
+    ...schemaNotes(),
+    "",
+    "If you expose any of your user data via GraphQL be sure to exclude",
+    "`hashedPassword` and `salt` (or whatever you named them) from the",
+    "SDL file that defines the fields for your user.",
+    "",
+    "You'll need to let Cedar know what fields you're using for your users'",
+    "`id` and `username` fields. In this case we're using `id` and `email`,",
+    "so update those in the `authFields` config in",
+    `\`${functionsPath}/auth.js\`. This is also the place to tell Cedar if`,
+    "you used a different name for the `hashedPassword`, `salt`,",
+    "`resetToken` or `resetTokenExpiresAt`, fields:`",
+    "",
+    "  authFields: {",
+    "    id: 'id',",
+    "    username: 'email',",
+    "    hashedPassword: 'hashedPassword',",
+    "    salt: 'salt',",
+    "    resetToken: 'resetToken',",
+    "    resetTokenExpiresAt: 'resetTokenExpiresAt',",
+    "    challenge: 'webAuthnChallenge'",
+    "  },",
+    "",
+    "To get the actual user that's logged in, take a look at `getCurrentUser()`",
+    `in \`${libPath}/auth.js\`. We default it to something simple, but you may`,
+    "use different names for your model or unique ID fields, in which case you",
+    "need to update those calls (instructions are in the comment above the code).",
+    "",
+    "Finally, we created a SESSION_SECRET environment variable for you in",
+    `${path.join(getPaths().base, ".env")}. This value should NOT be checked`,
+    "into version control and should be unique for each environment you",
+    "deploy to. If you ever need to log everyone out of your app at once",
+    "change this secret to a new value and deploy. To create a new secret, run:",
+    "",
+    "  yarn cedar generate secret",
+    ""
+  ];
+}
+const noteGenerate = [
+  "",
+  "Need simple Login, Signup and Forgot Password pages? We've got a generator",
+  "for those as well:",
+  "",
+  "  yarn cedar generate dbAuth"
+];
+function pruneOAuthProviders(content, providers) {
+  let result = content;
+  for (const provider of KNOWN_OAUTH_PROVIDERS) {
+    const startMarker = `// @oauth-provider:${provider}`;
+    const endMarker = `// @oauth-provider:${provider}:end`;
+    const blockPattern = new RegExp(
+      `[ \\t]*${escapeRegExp(startMarker)}\\n([\\s\\S]*?)[ \\t]*${escapeRegExp(
+        endMarker
+      )}\\n`
+    );
+    if (providers.includes(provider)) {
+      result = result.replace(blockPattern, "$1");
+    } else {
+      result = result.replace(blockPattern, "");
+      result = result.replace(
+        new RegExp(`^[ \\t]*${provider}Provider,\\n`, "m"),
+        ""
+      );
+    }
+  }
+  return result;
+}
+function escapeRegExp(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function configureOAuthProvidersTask(providers) {
+  return {
+    title: "Configuring selected OAuth providers...",
+    task: () => {
+      const ext = isTypeScriptProject() ? "ts" : "js";
+      const authFunctionPath = path.join(
+        getPaths().api.functions,
+        `auth.${ext}`
+      );
+      if (!fs.existsSync(authFunctionPath)) {
+        return;
+      }
+      const content = fs.readFileSync(authFunctionPath, "utf-8");
+      const prunedContent = pruneOAuthProviders(content, providers);
+      if (prunedContent !== content) {
+        fs.writeFileSync(authFunctionPath, prunedContent);
+      }
+    }
+  };
+}
+export {
+  KNOWN_OAUTH_PROVIDERS,
+  apiPackages,
+  configureOAuthProvidersTask,
+  createUserModelTask,
+  envVarNotes,
+  noteGenerate,
+  notes,
+  parseOAuthProviders,
+  pruneOAuthProviders,
+  webAuthnCreateUserModelTask,
+  webAuthnOauthNotes
+};

package/dist/setup.d.ts

@@ -4,6 +4,7 @@ export declare const description = "Set up auth for for dbAuth";
 export declare function builder(yargs: Argv): void;
 export interface Args {
     webauthn: boolean | null;
+    oauth?: string | null;
     createUserModel: boolean | null;
     generateAuthPages: boolean | null;
     force: boolean;

package/dist/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAA;AAEjC,eAAO,MAAM,OAAO,WAAW,CAAA;AAC/B,eAAO,MAAM,WAAW,+BAA+B,CAAA;AAEvD,wBAAgB,OAAO,CAAC,KAAK,EAAE,IAAI,QAgClC;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,eAAe,EAAE,OAAO,GAAG,IAAI,CAAA;IAC/B,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;IACjC,KAAK,EAAE,OAAO,CAAA;CACf;AAED,eAAO,MAAM,OAAO,GAAU,SAAS,IAAI,kBAG1C,CAAA"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,OAAO,CAAA;AAEjC,eAAO,MAAM,OAAO,WAAW,CAAA;AAC/B,eAAO,MAAM,WAAW,+BAA+B,CAAA;AAEvD,wBAAgB,OAAO,CAAC,KAAK,EAAE,IAAI,QAwClC;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAA;IAKxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,eAAe,EAAE,OAAO,GAAG,IAAI,CAAA;IAC/B,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;IACjC,KAAK,EAAE,OAAO,CAAA;CACf;AAED,eAAO,MAAM,OAAO,GAAU,SAAS,IAAI,kBAG1C,CAAA"}

package/dist/setup.js

@@ -12,6 +12,11 @@ function builder(yargs) {
     default: null,
     description: "Include WebAuthn support (TouchID/FaceID)",
     type: "boolean"
+  }).option("oauth", {
+    alias: "o",
+    default: null,
+    description: "Include OAuth support for the given comma-separated providers (google, github), e.g. --oauth google,github",
+    type: "string"
   }).option("createUserModel", {
     alias: "u",
     default: null,

package/dist/setupData.d.ts

@@ -1,4 +1,4 @@
-import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers';
+import type { AuthGeneratorCtx } from '@cedarjs/cli-helpers/auth/setupHelpers';
 export declare const extraTask: {
     title: string;
     task: () => void;

package/dist/setupData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setupData.d.ts","sourceRoot":"","sources":["../src/setupData.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAM5D,eAAO,MAAM,SAAS;;;CAKrB,CAAA;AAED,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CAoBnC,CAAA;AAGD,eAAO,MAAM,KAAK,UAsDjB,CAAA;AAED,eAAO,MAAM,qBAAqB,UAwBjC,CAAA;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA;AAED,eAAO,MAAM,cAAc,UAO1B,CAAA"}
+{"version":3,"file":"setupData.d.ts","sourceRoot":"","sources":["../src/setupData.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAA;AAS9E,eAAO,MAAM,SAAS;;;CAKrB,CAAA;AAED,eAAO,MAAM,mBAAmB;;gBAEZ,gBAAgB;CAoBnC,CAAA;AAGD,eAAO,MAAM,KAAK,UAsDjB,CAAA;AAED,eAAO,MAAM,qBAAqB,UAwBjC,CAAA;AAED,eAAO,MAAM,YAAY,UAMxB,CAAA;AAED,eAAO,MAAM,cAAc,UAO1B,CAAA"}

package/dist/setupData.js

@@ -1,6 +1,8 @@
 import crypto from "node:crypto";
 import path from "node:path";
-import { getPaths, colors, addEnvVarTask } from "@cedarjs/cli-helpers";
+import { colors } from "@cedarjs/cli-helpers/colors";
+import { getPaths } from "@cedarjs/cli-helpers/paths";
+import { addEnvVarTask } from "@cedarjs/cli-helpers/project";
 import { addModels, functionsPath, hasModel, libPath } from "./shared.js";
 const secret = crypto.randomBytes(32).toString("base64");
 const extraTask = addEnvVarTask(

package/dist/setupHandler.d.ts

@@ -1,5 +1,5 @@
 import type { Args } from './setup.js';
-export declare function handler({ webauthn, createUserModel, generateAuthPages, force: forceArg, }: Args): Promise<void>;
+export declare function handler({ webauthn, oauth, createUserModel, generateAuthPages, force: forceArg, }: Args): Promise<void>;
 export declare const createAuthDecoderFunction: {
     title: string;
     task: () => void;

package/dist/setupHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setupHandler.d.ts","sourceRoot":"","sources":["../src/setupHandler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAwBtC,wBAAsB,OAAO,CAAC,EAC5B,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,KAAK,EAAE,QAAQ,GAChB,EAAE,IAAI,iBAyEN;AAsED,eAAO,MAAM,yBAAyB;;;CAuCrC,CAAA"}
+{"version":3,"file":"setupHandler.d.ts","sourceRoot":"","sources":["../src/setupHandler.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAwBtC,wBAAsB,OAAO,CAAC,EAC5B,QAAQ,EACR,KAAK,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,EAAE,QAAQ,GAChB,EAAE,IAAI,iBA0GN;AA4ED,eAAO,MAAM,yBAAyB;;;CAuCrC,CAAA"}

package/dist/setupHandler.js

@@ -1,7 +1,20 @@
 import fs from "node:fs";
 import path from "node:path";
 import prompts from "prompts";
-import { getGraphqlPath, standardAuthHandler } from "@cedarjs/cli-helpers";
+import { standardAuthHandler } from "@cedarjs/cli-helpers/auth/setupHelpers";
+import { getGraphqlPath } from "@cedarjs/cli-helpers/project";
+import { requireTTYOrExit } from "@cedarjs/cli-helpers/tty";
+import {
+  apiPackages as oauthApiPackages,
+  configureOAuthProvidersTask,
+  createUserModelTask as oauthCreateUserModelTask,
+  envVarNotes as oauthEnvVarNotes,
+  noteGenerate as oauthNoteGenerate,
+  notes as oauthNotes,
+  parseOAuthProviders,
+  webAuthnCreateUserModelTask as webAuthnOauthCreateUserModelTask,
+  webAuthnOauthNotes
+} from "./oauth.setupData.js";
 import {
   notes,
   noteGenerate,
@@ -26,6 +39,7 @@ import {
 } from "./webAuthn.setupData.js";
 async function handler({
   webauthn,
+  oauth,
   createUserModel,
   generateAuthPages,
   force: forceArg
@@ -37,10 +51,22 @@ async function handler({
     )
   );
   const webAuthn = await shouldIncludeWebAuthn(webauthn);
+  const oauthProviders = parseOAuthProviders(oauth);
+  const includeOAuth = oauthProviders.length > 0;
   const createDbUserModel = await shouldCreateUserModel(createUserModel);
   const generateDbAuthPages = await shouldGenerateDbAuthPages(generateAuthPages);
   const oneMoreThing = [];
-  if (webAuthn) {
+  if (webAuthn && includeOAuth) {
+    if (createDbUserModel) {
+      oneMoreThing.push(...notesCreatedUserModel);
+    } else {
+      oneMoreThing.push(...webAuthnOauthNotes());
+    }
+    oneMoreThing.push(...oauthEnvVarNotes(oauthProviders));
+    if (!generateDbAuthPages) {
+      oneMoreThing.push(...webAuthnNoteGenerate);
+    }
+  } else if (webAuthn) {
     if (createDbUserModel) {
       oneMoreThing.push(...notesCreatedUserModel);
     } else {
@@ -49,6 +75,16 @@ async function handler({
     if (!generateDbAuthPages) {
       oneMoreThing.push(...webAuthnNoteGenerate);
     }
+  } else if (includeOAuth) {
+    if (createDbUserModel) {
+      oneMoreThing.push(...notesCreatedUserModel);
+    } else {
+      oneMoreThing.push(...oauthNotes());
+    }
+    oneMoreThing.push(...oauthEnvVarNotes(oauthProviders));
+    if (!generateDbAuthPages) {
+      oneMoreThing.push(...oauthNoteGenerate);
+    }
   } else {
     if (createDbUserModel) {
       oneMoreThing.push(...notesCreatedUserModel);
@@ -62,8 +98,12 @@ async function handler({
   oneMoreThing.push(...notePrivateSet);
   let createDbUserModelTask = void 0;
   if (createDbUserModel) {
-    if (webAuthn) {
+    if (webAuthn && includeOAuth) {
+      createDbUserModelTask = webAuthnOauthCreateUserModelTask;
+    } else if (webAuthn) {
       createDbUserModelTask = webAuthnCreateUserModelTask;
+    } else if (includeOAuth) {
+      createDbUserModelTask = oauthCreateUserModelTask;
     } else {
       createDbUserModelTask = createUserModelTask;
     }
@@ -74,18 +114,21 @@ async function handler({
     provider: "dbAuth",
     authDecoderImport: "import { createAuthDecoder } from '@cedarjs/auth-dbauth-api'",
     webAuthn,
+    oauth: includeOAuth,
     webPackages: [
       `@cedarjs/auth-dbauth-web@${version}`,
       ...webAuthn ? webAuthnWebPackages : []
     ],
     apiPackages: [
       `@cedarjs/auth-dbauth-api@${version}`,
-      ...webAuthn ? webAuthnApiPackages : []
+      ...webAuthn ? webAuthnApiPackages : [],
+      ...includeOAuth ? [`@cedarjs/auth-dbauth-oauth@${version}`, ...oauthApiPackages] : []
     ],
     extraTasks: [
       webAuthn ? webAuthnExtraTask : extraTask,
       createDbUserModelTask,
       createAuthDecoderFunction,
+      includeOAuth ? configureOAuthProvidersTask(oauthProviders) : void 0,
       generateDbAuthPages ? generateAuthPagesTask(createDbUserModel) : void 0
     ],
     notes: oneMoreThing
@@ -93,6 +136,7 @@ async function handler({
 }
 async function shouldIncludeWebAuthn(webauthn) {
   if (webauthn === null) {
+    requireTTYOrExit("--webauthn or --webauthn=false");
     const webAuthnResponse = await prompts({
       type: "confirm",
       name: "answer",
@@ -111,6 +155,7 @@ async function shouldCreateUserModel(createUserModel) {
     return true;
   }
   if (createUserModel === null && !hasUserModel) {
+    requireTTYOrExit("--createUserModel or --createUserModel=false");
     const createModelResponse = await prompts({
       type: "confirm",
       name: "answer",
@@ -123,6 +168,7 @@ async function shouldCreateUserModel(createUserModel) {
 }
 async function shouldGenerateDbAuthPages(generateAuthPages) {
   if (generateAuthPages === null && !hasAuthPages()) {
+    requireTTYOrExit("--generateAuthPages or --generateAuthPages=false");
     const generateAuthPagesResponse = await prompts({
       type: "confirm",
       name: "answer",

package/dist/shared.js

@@ -1,8 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
 import prismaInternals from "@prisma/internals";
-import { getPaths } from "@cedarjs/cli-helpers";
 import { runBin } from "@cedarjs/cli-helpers/packageManager/exec";
+import { getPaths } from "@cedarjs/cli-helpers/paths";
 import {
   processPagesDir,
   getSchemaPath,