@cedarjs/cli 7.0.0-canary.3113 → 7.0.0-canary.3114

package/dist/commands/setup/uploads/schemaPrisma.js

@@ -0,0 +1,41 @@
+const UPLOAD_MODEL = `model Upload {
+  id             String   @id @default(cuid())
+  /// Name of the storage target, as configured in api/src/lib/uploads
+  target         String
+  /// "pending" | "completed" | "failed"
+  status         String   @default("pending")
+  filename       String
+  mimeType       String
+  /// Bytes. BigInt because Int caps at 2 GB.
+  size           BigInt
+  /// Provider-specific reference: S3 object key, filename on disk, or null
+  /// for files stored inline
+  storageKey     String?
+  /// Inline bytes, only for DB targets
+  data           Bytes?
+  /// The user the file belongs to, when it belongs to one
+  userId         String?
+  /// Id of the upload token that created this row
+  tokenId        String?
+  /// The organization the file belongs to, in multi-tenant apps
+  organizationId String?
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+}`;
+function hasModel(schema, modelName) {
+  return new RegExp(`\\bmodel\\s+${modelName}\\s*\\{`).test(schema);
+}
+function addUploadModel(schema) {
+  if (hasModel(schema, "Upload")) {
+    return schema;
+  }
+  return `${schema.trimEnd()}
+
+${UPLOAD_MODEL}
+`;
+}
+export {
+  UPLOAD_MODEL,
+  addUploadModel,
+  hasModel
+};

package/dist/commands/setup/uploads/serverFile.js

@@ -0,0 +1,151 @@
+const START_LINE = /^([ \t]*)await server\.start\(\)/m;
+const FACTORY_IMPORT = /import\s*\{[^}]*\bcreateAuthDecoder\b[^}]*\}\s*from\s*['"](@cedarjs\/auth-[a-z0-9-]+-api)['"]/;
+const DECODER_IMPORT = /import\s*\{[^}]*\bauthDecoder\b[^}]*\}\s*from\s*['"](@cedarjs\/auth-[a-z0-9-]+-api)['"]/;
+function detectServerAuth(graphqlSource) {
+  const factory = FACTORY_IMPORT.exec(graphqlSource);
+  if (factory) {
+    return { decoderPackage: factory[1], usesFactory: true };
+  }
+  const decoder = DECODER_IMPORT.exec(graphqlSource);
+  if (decoder) {
+    return { decoderPackage: decoder[1], usesFactory: false };
+  }
+  return null;
+}
+function importedBindings(source) {
+  const names = /* @__PURE__ */ new Set();
+  const statements = source.matchAll(
+    /^import\s+(type\s+)?([^;]*?)\s+from\s+['"][^'"]+['"]/gm
+  );
+  for (const [, typeOnly, clause] of statements) {
+    if (typeOnly) {
+      continue;
+    }
+    const braces = /\{([^}]*)\}/.exec(clause);
+    const defaultOrNamespace = clause.replace(/\{[^}]*\}/, "");
+    for (const part of defaultOrNamespace.split(",")) {
+      const local = part.replace(/^\s*\*\s+as\s+/, "").trim();
+      if (local) {
+        names.add(local);
+      }
+    }
+    for (const specifier of braces?.[1].split(",") ?? []) {
+      const trimmed = specifier.trim();
+      if (!trimmed || trimmed.startsWith("type ")) {
+        continue;
+      }
+      const alias = / as (\w+)$/.exec(trimmed);
+      names.add(alias ? alias[1] : trimmed);
+    }
+  }
+  return names;
+}
+function hasBinding(source, name) {
+  const declared = new RegExp(
+    `^(?:export\\s+)?(?:const|let|var|function)\\s+${name}\\b`,
+    "m"
+  );
+  return importedBindings(source).has(name) || declared.test(source);
+}
+function uploadsServerImports(source, auth) {
+  const packageSpecs = [];
+  const srcSpecs = [];
+  if (auth) {
+    if (auth.usesFactory) {
+      if (!hasBinding(source, "authDecoder")) {
+        packageSpecs.push({
+          names: ["createAuthDecoder"],
+          from: auth.decoderPackage
+        });
+      }
+    } else {
+      packageSpecs.push({ names: ["authDecoder"], from: auth.decoderPackage });
+    }
+  }
+  packageSpecs.push({
+    names: auth ? ["cedarUploadsPlugin", "createUploadAuthenticator"] : ["cedarUploadsPlugin"],
+    from: "@cedarjs/uploads"
+  });
+  if (auth) {
+    const authNames = ["getCurrentUser"];
+    if (auth.usesFactory && !hasBinding(source, "authDecoder")) {
+      authNames.unshift("cookieName");
+    }
+    srcSpecs.push({ names: authNames, from: "src/lib/auth" });
+  }
+  srcSpecs.push({ names: ["db"], from: "src/lib/db" });
+  srcSpecs.push({ names: ["targets"], from: "src/lib/uploads" });
+  const render = (specs) => specs.map((spec) => ({
+    ...spec,
+    names: spec.names.filter((name) => !hasBinding(source, name))
+  })).filter((spec) => spec.names.length > 0).map((spec) => `import { ${spec.names.join(", ")} } from '${spec.from}'`);
+  const packageLines = render(packageSpecs);
+  const srcLines = render(srcSpecs);
+  if (packageLines.length > 0 && srcLines.length > 0) {
+    return [...packageLines, "", ...srcLines];
+  }
+  return [...packageLines, ...srcLines];
+}
+function uploadsServerRegistration(source, auth) {
+  if (!auth) {
+    return `  await server.register(cedarUploadsPlugin, {
+    tokenSecret: process.env.UPLOAD_TOKEN_SECRET,
+    targets,
+    db,
+    // Once the app has auth, bind upload tokens to the logged-in user:
+    //
+    //   authenticate: createUploadAuthenticator({ authDecoder, getCurrentUser }),
+  })
+`;
+  }
+  const decoder = auth.usesFactory && !hasBinding(source, "authDecoder") ? "  const authDecoder = createAuthDecoder(cookieName)\n\n" : "";
+  return `${decoder}  await server.register(cedarUploadsPlugin, {
+    tokenSecret: process.env.UPLOAD_TOKEN_SECRET,
+    targets,
+    db,
+    // Binds upload tokens to the logged-in user through the same auth
+    // pipeline the GraphQL server uses
+    authenticate: createUploadAuthenticator({ authDecoder, getCurrentUser }),
+  })
+`;
+}
+function hasUploadsPlugin(source) {
+  return /^[ \t]*(?:(?:await|void)\s+|(?:const|let|var)\s+\w+\s*=\s*)?[\w.]+\.register\(\s*cedarUploadsPlugin\b/m.test(
+    source
+  );
+}
+function addUploadsPlugin(source, { auth = null } = {}) {
+  if (hasUploadsPlugin(source)) {
+    return source;
+  }
+  const start = START_LINE.exec(source);
+  if (!start) {
+    throw new Error("CEDAR_UPLOADS_ERR_NO_START");
+  }
+  const lines = source.split("\n");
+  let lastImport = -1;
+  for (const [index, line] of lines.entries()) {
+    if (/^import\s/.test(line)) {
+      lastImport = index;
+    }
+  }
+  const withImports = [
+    ...lines.slice(0, lastImport + 1),
+    ...uploadsServerImports(source, auth),
+    ...lines.slice(lastImport + 1)
+  ].join("\n");
+  return withImports.replace(
+    START_LINE,
+    (line) => `${uploadsServerRegistration(source, auth)}
+${line}`
+  );
+}
+export {
+  addUploadsPlugin,
+  detectServerAuth,
+  hasBinding,
+  hasUploadsPlugin,
+  importedBindings,
+  uploadsServerImports,
+  uploadsServerRegistration
+};

package/dist/commands/setup/uploads/templates/requireUploadToken.ts.template

@@ -0,0 +1,15 @@
+import { createRequireUploadTokenDirective } from '@cedarjs/uploads'
+
+/**
+ * Requires a valid upload token in the x-upload-token request header and
+ * makes its claims available to the resolver through
+ * `getUploadTokenPayload(context)`. The token must have been issued to the
+ * requesting user.
+ */
+const requireUploadToken = createRequireUploadTokenDirective({
+  secret: process.env.UPLOAD_TOKEN_SECRET ?? '',
+})
+
+export const schema = requireUploadToken.schema
+
+export default requireUploadToken

package/dist/commands/setup/uploads/templates/srcLibUploads.ts.template

@@ -1,25 +1,24 @@
-import { createUploadsConfig, setupStorage } from '@cedarjs/storage'
-import { FileSystemStorage } from '@cedarjs/storage/FileSystemStorage'
-import { UrlSigner } from '@cedarjs/storage/UrlSigner'
+__PATH_IMPORT____S3_IMPORTS__import {
+  __FS_IMPORT__
+  __DB_IMPORT__
+  __DB_MAX_IMPORT__
+  defineStorageTargets,
+  defineUploadProfiles,
+} from '@cedarjs/uploads'
+__GET_PATHS_IMPORT__
+__S3_CLIENT__
+/**
+ * Where files live. Each target is a provider instance; the Upload row
+ * records which target holds a file so it can be read, served, and deleted
+ * later. Look one up by name with `resolveTarget(targets, upload.target)`.
+ */
+export const targets = defineStorageTargets({
+__TARGETS__})
 
-const uploadsConfig = createUploadsConfig({
-  // Configure your fields here
-  // e.g. modelName: { fields: ['fieldWithUpload']}
-})
-
-export const fsStorage = new FileSystemStorage({
-  baseDir: './uploads',
-})
-
-export const urlSigner = new UrlSigner({
-  secret: process.env.UPLOADS_SECRET,
-  endpoint: '/signedUrl',
-})
-
-const { saveFiles, storagePrismaExtension } = setupStorage({
-  uploadsConfig,
-  storageAdapter: fsStorage,
-  urlSigner,
-})
-
-export { saveFiles, storagePrismaExtension }
+/**
+ * What clients may upload. A profile names a target and the constraints the
+ * server signs into every upload token issued for it. The client never
+ * supplies constraints; it names a profile.
+ */
+export const profiles = defineUploadProfiles({
+__PROFILES__})

package/dist/commands/setup/uploads/templates/uploads.sdl.ts.template

@@ -0,0 +1,79 @@
+export const schema = gql`
+  type Upload {
+    id: String!
+    target: String!
+    status: String!
+    filename: String!
+    mimeType: String!
+    size: BigInt!
+    storageKey: String
+    userId: String
+    organizationId: String
+    createdAt: DateTime!
+    updatedAt: DateTime!
+  }
+
+  type UploadToken {
+    token: String!
+    """
+    The profile's constraints, echoed for client-side UX (file-picker
+    filters, pre-upload validation). The authoritative copy is inside the
+    signed token.
+    """
+    allowedMimeTypes: [String!]!
+    maxFileSize: BigInt!
+    maxFiles: Int!
+  }
+
+  type PresignedUploadUrl {
+    uploadId: String!
+    url: String!
+    method: String!
+    headers: JSON!
+  }
+
+  input CreatePresignedUploadUrlInput {
+    filename: String!
+    contentType: String!
+    size: BigInt!
+  }
+
+  input UploadFileInput {
+    filename: String!
+    mimeType: String!
+    """
+    The file's bytes, base64-encoded. Only for profiles whose target stores
+    files inline in the database.
+    """
+    data: String!
+  }
+
+  type Query {
+    """
+    Issues an upload token for a server-defined profile. The profile name
+    must match a key of \`profiles\` in api/src/lib/uploads.
+    """
+    requestUploadToken(profile: String!): UploadToken! @requireAuth
+  }
+
+  type Mutation {
+    """
+    Direct-to-storage uploads: returns a presigned URL for one file. Send the
+    upload token in the x-upload-token header.
+    """
+    createPresignedUploadUrl(
+      input: CreatePresignedUploadUrlInput!
+    ): PresignedUploadUrl! @requireAuth @requireUploadToken
+
+    """
+    Confirms a direct-to-storage upload once the client has PUT the bytes.
+    """
+    confirmUpload(uploadId: String!): Upload! @requireAuth
+
+    """
+    Stores a small file sent as base64, for profiles whose target keeps files
+    inline in the database.
+    """
+    uploadFile(profile: String!, input: UploadFileInput!): Upload! @requireAuth
+  }
+`

package/dist/commands/setup/uploads/templates/uploads.ts.template

@@ -0,0 +1,89 @@
+import {
+  confirmUpload as confirmUploadRecord,
+  createPresignedUpload,
+  getUploadTokenPayload,
+  isMimeTypeAllowed,
+  issueUploadToken,
+  resolveProfile,
+  resolveTarget,
+  storeFile,
+  UploadError,
+} from '@cedarjs/uploads'
+
+import { db } from 'src/lib/db'
+import { profiles, targets } from 'src/lib/uploads'
+
+const secret = () => {
+  if (!process.env.UPLOAD_TOKEN_SECRET) {
+    throw new Error(
+      'UPLOAD_TOKEN_SECRET is not set. Generate one with `yarn cedar generate secret` and add it to .env.',
+    )
+  }
+
+  return process.env.UPLOAD_TOKEN_SECRET
+}
+
+export const requestUploadToken = ({ profile }: { profile: string }) => {
+  return issueUploadToken({
+    profiles,
+    profile,
+    secret: secret(),
+    currentUser: context.currentUser,
+  })
+}
+
+export const createPresignedUploadUrl = ({
+  input,
+}: {
+  input: { filename: string; contentType: string; size: bigint | number }
+}) => {
+  return createPresignedUpload({
+    db,
+    targets,
+    tokenPayload: getUploadTokenPayload(context),
+    input,
+  })
+}
+
+export const confirmUpload = ({ uploadId }: { uploadId: string }) => {
+  return confirmUploadRecord({
+    db,
+    targets,
+    uploadId,
+    currentUser: context.currentUser,
+  })
+}
+
+export const uploadFile = async ({
+  profile: profileName,
+  input,
+}: {
+  profile: string
+  input: { filename: string; mimeType: string; data: string }
+}) => {
+  const profile = resolveProfile(profiles, profileName)
+  const target = resolveTarget(targets, profile.target)
+
+  if (target.providerType !== 'db') {
+    throw new UploadError(
+      'NOT_SUPPORTED',
+      `Upload profile '${profile.name}' does not store files in the database. Use an upload token instead.`,
+    )
+  }
+
+  if (!isMimeTypeAllowed(profile.allowedMimeTypes, input.mimeType)) {
+    throw new UploadError(
+      'MIME_TYPE_NOT_ALLOWED',
+      `File type '${input.mimeType}' is not allowed for upload profile '${profile.name}'.`,
+    )
+  }
+
+  return storeFile(target, {
+    db,
+    filename: input.filename,
+    mimeType: input.mimeType,
+    data: Buffer.from(input.data, 'base64'),
+    maxSize: profile.maxFileSize,
+    userId: context.currentUser ? String(context.currentUser.id) : undefined,
+  })
+}

package/dist/commands/setup/uploads/templates/withDataUri.ts.template

@@ -0,0 +1,14 @@
+import { createWithDataUriDirective } from '@cedarjs/uploads'
+
+import { db } from 'src/lib/db'
+import { targets } from 'src/lib/uploads'
+
+/**
+ * Resolves a field holding an Upload id to a base64 data: URI of the file.
+ * Every resolved field embeds the whole file, so use it for small files only.
+ */
+const withDataUri = createWithDataUriDirective({ db, targets })
+
+export const schema = withDataUri.schema
+
+export default withDataUri

package/dist/commands/setup/uploads/templates/withSignedUrl.ts.template

@@ -0,0 +1,16 @@
+import { createWithSignedUrlDirective } from '@cedarjs/uploads'
+
+import { db } from 'src/lib/db'
+import { targets } from 'src/lib/uploads'
+
+/**
+ * Resolves a field holding an Upload id to a time-limited URL for the file,
+ * from whichever storage target holds it. Files download by default; pass
+ * `disposition: 'inline'` to render them in the browser instead, and only
+ * for MIME types you trust.
+ */
+const withSignedUrl = createWithSignedUrlDirective({ db, targets })
+
+export const schema = withSignedUrl.schema
+
+export default withSignedUrl

package/dist/commands/setup/uploads/uploads.js

@@ -1,26 +1,68 @@
+import prompts from "prompts";
 import { recordTelemetryAttributes } from "@cedarjs/cli-helpers/telemetry";
+import { requireTTYOrExit } from "@cedarjs/cli-helpers/tty";
 const command = "uploads";
-const description = "Setup uploads and storage. This will install the required packages and add the required initial configuration to your redwood app.";
+const description = "Set up file uploads and storage: storage targets, upload profiles, the upload routes, and the GraphQL API";
+const TARGET_CHOICES = ["fs", "db", "s3"];
+const TARGET_DESCRIPTIONS = {
+  fs: "Local filesystem, uploaded through the api server (development, single-server deploys)",
+  db: "Inline in the database, for small files like avatars and thumbnails",
+  s3: "S3 or S3-compatible storage, uploaded straight from the browser with presigned URLs"
+};
 const builder = (yargs) => {
-  yargs.option("force", {
+  return yargs.option("targets", {
+    choices: TARGET_CHOICES,
+    description: "Storage targets to configure: fs (local filesystem), db (inline in the database), s3 (direct-to-S3 presigned uploads). Prompts when omitted.",
+    type: "array"
+  }).option("force", {
     alias: "f",
     default: false,
     description: "Overwrite existing configuration",
     type: "boolean"
   });
 };
+function toTargetChoices(values) {
+  const choices = TARGET_CHOICES;
+  return [...new Set(values)].filter(
+    (t) => choices.includes(t)
+  );
+}
+async function promptForTargets() {
+  requireTTYOrExit("--targets");
+  const response = await prompts({
+    type: "multiselect",
+    name: "targets",
+    message: "Which storage targets do you want to configure?",
+    instructions: false,
+    hint: "Space to toggle, enter to confirm",
+    min: 1,
+    choices: TARGET_CHOICES.map((value) => ({
+      title: value,
+      description: TARGET_DESCRIPTIONS[value],
+      value,
+      selected: value !== "s3"
+    }))
+  });
+  if (response.targets === void 0) {
+    process.exit(0);
+  }
+  return toTargetChoices(response.targets);
+}
 const handler = async (options) => {
+  const targets = options.targets?.length ? toTargetChoices(options.targets) : await promptForTargets();
   recordTelemetryAttributes({
     command: "setup uploads",
-    force: options.force,
-    skipExamples: options.skipExamples
+    targets: targets.join(","),
+    force: options.force
   });
   const { handler: handler2 } = await import("./uploadsHandler.js");
-  return handler2(options);
+  return handler2({ targets, force: options.force });
 };
 export {
+  TARGET_CHOICES,
   builder,
   command,
   description,
-  handler
+  handler,
+  toTargetChoices
 };

package/dist/commands/setup/uploads/uploadsHandler.js

@@ -1,91 +1,265 @@
 import fs from "node:fs";
 import path from "node:path";
+import { pathToFileURL } from "node:url";
 import { Listr } from "listr2";
 import { format } from "prettier";
 import { terminalLink } from "termi-link";
 import { colors as c } from "@cedarjs/cli-helpers/colors";
 import { getPrettierOptions } from "@cedarjs/cli-helpers/fileHelpers";
-import { addApiPackages } from "@cedarjs/cli-helpers/installHelpers";
+import {
+  addApiPackages,
+  addWebPackages
+} from "@cedarjs/cli-helpers/installHelpers";
 import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display";
+import { addEnvVar } from "@cedarjs/cli-helpers/project";
+import { getSchemaPath } from "@cedarjs/project-config";
 import { errorTelemetry } from "@cedarjs/telemetry";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
-import { runTransform } from "../../../lib/runTransform.js";
-const handler = async ({ force }) => {
+import { generateSecret } from "../../generate/secret/secret.js";
+import { setupServerFileTasks } from "../server-file/serverFileHandler.js";
+import { addUploadModel } from "./schemaPrisma.js";
+import {
+  addUploadsPlugin,
+  detectServerAuth,
+  hasUploadsPlugin
+} from "./serverFile.js";
+const UPPY_VERSION = "^6.0.0";
+const S3_IMPORTS = `import { S3Client } from '@aws-sdk/client-s3'
+
+import { createS3Provider } from '@cedarjs/uploads/s3'
+`;
+const S3_CLIENT = `
+// Your own S3 client. It stays available for S3-specific work (lifecycle
+// rules, CORS, and so on) alongside the storage target below. Credentials
+// come from the SDK's default chain: AWS_ACCESS_KEY_ID and
+// AWS_SECRET_ACCESS_KEY in .env, or an IAM role, SSO, or container
+// credentials in production. For an S3-compatible service, add \`endpoint\`
+// and \`forcePathStyle: true\`.
+export const s3Client = new S3Client({
+  region: process.env.AWS_REGION,
+})
+`;
+const TARGET_BLOCKS = {
+  fs: `  // Files uploaded through the api server and stored on local disk. Good for
+  // development and single-server deploys.
+  local: createFsProvider({
+    uploadDir: path.join(getPaths().api.base, '.uploads'),
+    serveBaseUrl: process.env.UPLOAD_SERVE_BASE_URL,
+    signSecret: process.env.UPLOAD_TOKEN_SECRET,
+  }),
+`,
+  db: `  // Small files stored inline in the Upload row (avatars, thumbnails).
+  thumbnails: createDbProvider(),
+`,
+  s3: `  // Files uploaded straight from the browser to S3 with presigned URLs.
+  files: createS3Provider({
+    client: s3Client,
+    bucket: process.env.S3_BUCKET_UPLOADS,
+    region: process.env.AWS_REGION,
+    keyPrefix: 'uploads/',
+  }),
+`
+};
+const PROFILE_BLOCKS = {
+  fs: `  attachment: {
+    target: 'local',
+    allowedMimeTypes: ['application/pdf', 'image/png', 'image/jpeg'],
+    maxFileSize: 25 * 1024 * 1024,
+    maxFiles: 10,
+  },
+`,
+  db: `  avatar: {
+    target: 'thumbnails',
+    allowedMimeTypes: ['image/png', 'image/jpeg'],
+    maxFileSize: DB_MAX_FILE_SIZE,
+    maxFiles: 1,
+  },
+`,
+  s3: `  document: {
+    target: 'files',
+    allowedMimeTypes: ['application/pdf', 'image/*'],
+    maxFileSize: 100 * 1024 * 1024,
+    maxFiles: 5,
+  },
+`
+};
+const handler = async ({ targets, force }) => {
+  const paths = getPaths();
   const projectIsTypescript = isTypeScriptProject();
-  const packageJson = await import(path.join(getPaths().base, "package.json"), {
-    with: { type: "json" }
-  });
+  const ext = projectIsTypescript ? "ts" : "js";
+  const wantsFs = targets.includes("fs");
+  const wantsDb = targets.includes("db");
+  const wantsS3 = targets.includes("s3");
+  const wantsUppy = wantsFs || wantsS3;
+  const packageJson = await import(pathToFileURL(path.join(paths.base, "package.json")).href, { with: { type: "json" } });
   const cedarVersion = packageJson.default.devDependencies["@cedarjs/core"] ?? "latest";
+  const serverFilePath = path.join(paths.api.src, `server.${ext}`);
+  const writeTemplateFile = async (templateFile, outputPath, replacements = {}) => {
+    const templatePath = path.resolve(
+      import.meta.dirname,
+      "templates",
+      templateFile
+    );
+    let templateContent = fs.readFileSync(templatePath, "utf-8");
+    for (const [token, value] of Object.entries(replacements)) {
+      templateContent = templateContent.replaceAll(token, value);
+    }
+    const content = projectIsTypescript ? templateContent : await transformTSToJS(outputPath, templateContent);
+    return writeFile(outputPath, content, { overwriteExisting: force });
+  };
+  const apiPackages = [`@cedarjs/uploads@${cedarVersion}`];
+  const webPackages = [`@cedarjs/uploads@${cedarVersion}`];
+  if (wantsS3) {
+    apiPackages.push("@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner");
+  }
+  if (wantsUppy) {
+    webPackages.push(
+      `@uppy/core@${UPPY_VERSION}`,
+      `@uppy/react@${UPPY_VERSION}`,
+      `@uppy/dashboard@${UPPY_VERSION}`
+    );
+  }
+  if (wantsFs) {
+    webPackages.push(`@uppy/xhr-upload@${UPPY_VERSION}`);
+  }
+  if (wantsS3) {
+    webPackages.push(`@uppy/aws-s3@${UPPY_VERSION}`);
+  }
   const tasks = new Listr(
     [
       {
-        title: `Adding api/src/lib/uploads.${projectIsTypescript ? "ts" : "js"}...`,
+        ...addApiPackages(apiPackages),
+        title: "Adding @cedarjs/uploads to your api side..."
+      },
+      {
+        ...addWebPackages(webPackages),
+        title: "Adding @cedarjs/uploads to your web side..."
+      },
+      {
+        title: "Adding the Upload model to schema.prisma...",
         task: async () => {
-          const templatePath = path.resolve(
-            import.meta.dirname,
-            "templates",
-            "srcLibUploads.ts.template"
-          );
-          const templateContent = fs.readFileSync(templatePath, {
-            encoding: "utf8",
-            flag: "r"
-          });
-          const uploadsPath = path.join(
-            getPaths().api.lib,
-            `uploads.${projectIsTypescript ? "ts" : "js"}`
+          const schemaPath = await getSchemaPath(paths.api.prismaConfig);
+          const schema = fs.readFileSync(schemaPath, "utf-8");
+          fs.writeFileSync(schemaPath, addUploadModel(schema));
+        }
+      },
+      {
+        title: `Adding api/src/lib/uploads.${ext}...`,
+        task: async () => {
+          await writeTemplateFile(
+            "srcLibUploads.ts.template",
+            path.join(paths.api.lib, `uploads.${ext}`),
+            {
+              __S3_IMPORTS__: wantsS3 ? S3_IMPORTS : "",
+              __S3_CLIENT__: wantsS3 ? S3_CLIENT : "",
+              __FS_IMPORT__: wantsFs ? "createFsProvider," : "",
+              __DB_IMPORT__: wantsDb ? "createDbProvider," : "",
+              __DB_MAX_IMPORT__: wantsDb ? "DB_MAX_FILE_SIZE," : "",
+              __PATH_IMPORT__: wantsFs ? "import path from 'node:path'\n\n" : "",
+              __GET_PATHS_IMPORT__: wantsFs ? "import { getPaths } from '@cedarjs/project-config'\n" : "",
+              __TARGETS__: targets.map((t) => TARGET_BLOCKS[t]).join("\n"),
+              __PROFILES__: targets.map((t) => PROFILE_BLOCKS[t]).join("\n")
+            }
           );
-          const uploadsContent = projectIsTypescript ? templateContent : await transformTSToJS(uploadsPath, templateContent);
-          return writeFile(uploadsPath, uploadsContent, {
-            overwriteExisting: force
-          });
         }
       },
       {
-        title: `Adding signedUrl function...`,
+        title: "Adding the uploads SDL and service...",
         task: async () => {
-          const templatePath = path.resolve(
-            import.meta.dirname,
-            "templates",
-            "signedUrl.ts.template"
+          await writeTemplateFile(
+            "uploads.sdl.ts.template",
+            path.join(paths.api.graphql, `uploads.sdl.${ext}`)
           );
-          const templateContent = fs.readFileSync(templatePath, {
-            encoding: "utf8",
-            flag: "r"
-          });
-          const uploadsPath = path.join(
-            getPaths().api.functions,
-            `signedUrl.${projectIsTypescript ? "ts" : "js"}`
+          await writeTemplateFile(
+            "uploads.ts.template",
+            path.join(paths.api.services, "uploads", `uploads.${ext}`)
           );
-          const uploadsContent = projectIsTypescript ? templateContent : await transformTSToJS(uploadsPath, templateContent);
-          return writeFile(uploadsPath, uploadsContent, {
-            overwriteExisting: force
-          });
         }
       },
       {
-        ...addApiPackages([`@cedarjs/storage@${cedarVersion}`]),
-        title: "Adding dependencies to your api side..."
+        title: "Adding the upload directives...",
+        task: async () => {
+          const directives = ["requireUploadToken", "withSignedUrl"];
+          if (wantsDb) {
+            directives.push("withDataUri");
+          }
+          for (const name of directives) {
+            await writeTemplateFile(
+              `${name}.ts.template`,
+              path.join(paths.api.directives, name, `${name}.${ext}`)
+            );
+          }
+        }
+      },
+      {
+        title: "Adding the server file...",
+        task: (_ctx, task) => task.newListr(setupServerFileTasks({ force: false })),
+        skip: () => fs.existsSync(serverFilePath) ? "api/src/server already exists; skipping." : false
       },
       {
-        title: "Modifying api/src/lib/db to add uploads prisma extension..",
-        task: async () => {
-          const dbPath = path.join(
-            getPaths().api.lib,
-            `db.${projectIsTypescript ? "ts" : "js"}`
-          );
-          const transformResult = await runTransform({
-            transformPath: path.join(import.meta.dirname, "dbCodemod.js"),
-            targetPaths: [dbPath]
-          });
-          if (transformResult.error) {
-            if (transformResult.error === "RW_CODEMOD_ERR_OLD_FORMAT") {
-              throw new Error(
-                "It looks like your src/lib/db file is using the old format. Please update it as per the v8 upgrade guide: https://cedarjs.com/docs/8.x/upgrade-guides/v8#database-file-structure-change. And run again. \n\nYou can also manually modify your api/src/lib/db to include the prisma extension: https://cedarjs.com/docs/uploads/#attaching-the-prisma-extension"
-              );
-            }
+        title: "Registering the upload plugin in api/src/server...",
+        task: async (_ctx, task) => {
+          const source = fs.readFileSync(serverFilePath, "utf-8");
+          if (hasUploadsPlugin(source)) {
+            task.skip("The upload plugin is already registered; skipping.");
+            return;
+          }
+          const graphqlPath = path.join(paths.api.functions, `graphql.${ext}`);
+          const authPath = path.join(paths.api.lib, `auth.${ext}`);
+          const auth = fs.existsSync(graphqlPath) && fs.existsSync(authPath) && fs.readFileSync(authPath, "utf-8").includes("getCurrentUser") ? detectServerAuth(fs.readFileSync(graphqlPath, "utf-8")) : null;
+          let updated;
+          try {
+            updated = addUploadsPlugin(source, { auth });
+          } catch {
             throw new Error(
-              "Could not add the prisma extension. \n Please modify your api/src/lib/db to include the prisma extension: https://cedarjs.com/docs/uploads/#attaching-the-prisma-extension"
+              `Could not find \`await server.start()\` in ${path.relative(
+                paths.base,
+                serverFilePath
+              )}. Register the plugin by hand before the server starts:
+
+  import { cedarUploadsPlugin } from '@cedarjs/uploads'
+  import { db } from 'src/lib/db'
+  import { targets } from 'src/lib/uploads'
+
+  await server.register(cedarUploadsPlugin, {
+    tokenSecret: process.env.UPLOAD_TOKEN_SECRET,
+    targets,
+    db,
+  })
+`
+            );
+          }
+          fs.writeFileSync(serverFilePath, updated);
+        }
+      },
+      {
+        title: "Adding environment variables to .env...",
+        task: () => {
+          addEnvVar(
+            "UPLOAD_TOKEN_SECRET",
+            generateSecret(),
+            "Signs upload tokens and file-serving URLs. Keep it secret and use a different value per environment."
+          );
+          if (wantsFs) {
+            addEnvVar(
+              "UPLOAD_SERVE_BASE_URL",
+              "http://localhost:8911",
+              "Origin the api server is reachable at, used to build signed URLs for locally stored files."
+            );
+          }
+          if (wantsS3) {
+            addEnvVar(
+              "AWS_REGION",
+              "us-east-1",
+              "Region of the uploads bucket."
+            );
+            addEnvVar("AWS_ACCESS_KEY_ID", "replace-me", "");
+            addEnvVar("AWS_SECRET_ACCESS_KEY", "replace-me", "");
+            addEnvVar(
+              "S3_BUCKET_UPLOADS",
+              "replace-me",
+              "Bucket direct uploads land in."
             );
           }
         }
@@ -94,10 +268,10 @@ const handler = async ({ force }) => {
         title: "Prettifying changed files",
         task: async (_ctx, task) => {
           const prettifyPaths = [
-            path.join(getPaths().api.lib, "db.js"),
-            path.join(getPaths().api.lib, "db.ts"),
-            path.join(getPaths().api.lib, "uploads.js"),
-            path.join(getPaths().api.lib, "uploads.ts")
+            serverFilePath,
+            path.join(paths.api.lib, `uploads.${ext}`),
+            path.join(paths.api.graphql, `uploads.sdl.${ext}`),
+            path.join(paths.api.services, "uploads", `uploads.${ext}`)
           ];
           for (const prettifyPath of prettifyPaths) {
             try {
@@ -106,11 +280,11 @@ const handler = async ({ force }) => {
               }
               const source = fs.readFileSync(prettifyPath, "utf-8");
               const prettierOptions = await getPrettierOptions();
-              const prettifiedApp = await format(source, {
+              const prettified = await format(source, {
                 ...prettierOptions,
                 parser: "babel-ts"
               });
-              fs.writeFileSync(prettifyPath, prettifiedApp, "utf-8");
+              fs.writeFileSync(prettifyPath, prettified, "utf-8");
             } catch {
               task.output = "Couldn't prettify the changes. Please reformat the files manually if needed.";
             }
@@ -120,15 +294,30 @@ const handler = async ({ force }) => {
       {
         title: "One more thing...",
         task: (_ctx, task) => {
+          const migrate = c.highlight(
+            formatCedarCommand(["prisma", "migrate", "dev"])
+          );
+          const types = c.highlight(formatCedarCommand(["generate", "types"]));
           task.title = `One more thing...
 
-          ${c.success("\nUploads and storage configured!\n")}
+          ${c.success("Uploads configured!")}
+
+          Next steps:
+
+            1. Apply the schema change: ${migrate}
+            2. Regenerate types: ${types}
+            3. Review the storage targets and upload profiles in api/src/lib/uploads.${ext}${wantsS3 ? "\n            4. Fill in the AWS_* and S3_BUCKET_UPLOADS values in .env" : ""}
 
-          Remember to add UPLOADS_SECRET to your .env file. You can generate one with ${c.highlight(formatCedarCommand(["generate", "secret"]))}
+          Upload tokens are bound to the logged-in user when the app has auth.
+          If you add auth later, pass
+          \`authenticate: createUploadAuthenticator({ authDecoder, getCurrentUser })\`
+          to the plugin in api/src/server.${ext}.
+
+          Schedule cleanupStaleUploads() from a recurring job to sweep uploads
+          that never completed.
 
           Check out the docs for more info:
           ${terminalLink("", "https://cedarjs.com/docs/uploads")}
-
         `;
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "7.0.0-canary.3113",
+  "version": "7.0.0-canary.3114",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.8",
     "@babel/types": "7.29.8",
-    "@cedarjs/api-server": "7.0.0-canary.3113",
-    "@cedarjs/babel-config": "7.0.0-canary.3113",
-    "@cedarjs/cli-helpers": "7.0.0-canary.3113",
-    "@cedarjs/internal": "7.0.0-canary.3113",
-    "@cedarjs/prerender": "7.0.0-canary.3113",
-    "@cedarjs/project-config": "7.0.0-canary.3113",
-    "@cedarjs/structure": "7.0.0-canary.3113",
-    "@cedarjs/telemetry": "7.0.0-canary.3113",
-    "@cedarjs/utils": "7.0.0-canary.3113",
-    "@cedarjs/vite": "7.0.0-canary.3113",
-    "@cedarjs/web-server": "7.0.0-canary.3113",
+    "@cedarjs/api-server": "7.0.0-canary.3114",
+    "@cedarjs/babel-config": "7.0.0-canary.3114",
+    "@cedarjs/cli-helpers": "7.0.0-canary.3114",
+    "@cedarjs/internal": "7.0.0-canary.3114",
+    "@cedarjs/prerender": "7.0.0-canary.3114",
+    "@cedarjs/project-config": "7.0.0-canary.3114",
+    "@cedarjs/structure": "7.0.0-canary.3114",
+    "@cedarjs/telemetry": "7.0.0-canary.3114",
+    "@cedarjs/utils": "7.0.0-canary.3114",
+    "@cedarjs/vite": "7.0.0-canary.3114",
+    "@cedarjs/web-server": "7.0.0-canary.3114",
     "@listr2/prompt-adapter-enquirer": "4.3.2",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "1.30.1",
@@ -94,7 +94,7 @@
     "yargs": "17.7.3"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "7.0.0-canary.3113",
+    "@cedarjs/framework-tools": "7.0.0-canary.3114",
     "@prisma/dmmf": "7.10.0",
     "@types/archiver": "^7.0.0",
     "memfs": "4.68.2",

package/dist/commands/setup/uploads/dbCodemod.js

@@ -1,28 +0,0 @@
-import j from "jscodeshift";
-function transform(fileInfo) {
-  const root = j(fileInfo.source);
-  const imports = root.find(j.ImportDeclaration);
-  imports.at(-1).insertAfter(
-    j.importDeclaration(
-      [j.importSpecifier(j.identifier("storagePrismaExtension"))],
-      j.literal("./uploads.js")
-    )
-  );
-  root.find(j.VariableDeclaration, { declarations: [{ id: { name: "db" } }] }).forEach((path) => {
-    const dbDeclaration = path.node.declarations[0];
-    if (j.VariableDeclarator.check(dbDeclaration) && j.NewExpression.check(dbDeclaration.init)) {
-      throw new Error("RW_CODEMOD_ERR_OLD_FORMAT");
-    }
-    if (j.VariableDeclarator.check(dbDeclaration) && j.Expression.check(dbDeclaration.init)) {
-      const newInit = j.callExpression(
-        j.memberExpression(dbDeclaration.init, j.identifier("$extends")),
-        [j.identifier("storagePrismaExtension")]
-      );
-      dbDeclaration.init = newInit;
-    }
-  });
-  return root.toSource();
-}
-export {
-  transform as default
-};

package/dist/commands/setup/uploads/templates/signedUrl.ts.template

@@ -1,21 +0,0 @@
-import type { APIGatewayEvent, Context } from 'aws-lambda'
-
-import type { SignatureValidationArgs } from '@cedarjs/storage/UrlSigner'
-
-import { urlSigner, fsStorage } from 'src/lib/uploads'
-
-export const handler = async (event: APIGatewayEvent, _context: Context) => {
-  const fileToReturn = urlSigner.validateSignature(
-    event.queryStringParameters as SignatureValidationArgs
-  )
-
-  const { contents, type } = await fsStorage.read(fileToReturn)
-
-  return {
-    statusCode: 200,
-    headers: {
-      'Content-Type': type,
-    },
-    body: contents,
-  }
-}