@cedarjs/cli 7.0.0 → 8.0.0-canary.3263

package/dist/commands/setup/tenancy/preflight.js

@@ -0,0 +1,49 @@
+import fs from "node:fs";
+import path from "node:path";
+import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display";
+const WEB_AUTH_EXTENSIONS = ["ts", "tsx", "js", "jsx"];
+function hasWebAuthFile(webSrcPath) {
+  return WEB_AUTH_EXTENSIONS.some(
+    (extension) => fs.existsSync(path.join(webSrcPath, `auth.${extension}`))
+  );
+}
+function authNotSetUpMessage() {
+  return [
+    "Auth is not set up in this project.",
+    "",
+    "Tenancy builds on your app's auth: it adds memberships to",
+    "`getCurrentUser`, and resolves the current organization from the",
+    "signed-in user's memberships. Set up auth first, then run this command",
+    "again:",
+    "",
+    `  ${formatCedarCommand(["setup", "auth", "dbAuth"])}`,
+    "",
+    "Any provider works. See https://cedarjs.com/docs/authentication"
+  ].join("\n");
+}
+function noUserModelMessage(schemaPath) {
+  return [
+    `No \`User\` model found in ${schemaPath}.`,
+    "",
+    "Tenancy hangs memberships off your app's `User` model, so it needs one",
+    "before it can add `Organization` and `Membership`.",
+    "",
+    "dbAuth adds this model for you. Providers that authenticate against an",
+    "external service leave it to you: give `User` its own id and store the",
+    "provider's id in a column beside it, so memberships keep working if you",
+    "switch providers or add a second one.",
+    "",
+    `Add a model like this one, run \`${formatCedarCommand(["prisma", "migrate", "dev"])}\`, then`,
+    "run this command again:",
+    "",
+    "  model User {",
+    "    id    String @id @default(cuid())",
+    "    email String @unique",
+    "  }"
+  ].join("\n");
+}
+export {
+  authNotSetUpMessage,
+  hasWebAuthFile,
+  noUserModelMessage
+};

package/dist/commands/setup/tenancy/schemaPrisma.js

@@ -0,0 +1,81 @@
+const ORGANIZATION_MODEL = `model Organization {
+  id          String       @id @default(cuid())
+  name        String
+  slug        String       @unique
+  createdAt   DateTime     @default(now())
+  updatedAt   DateTime     @updatedAt
+  memberships Membership[]
+}`;
+const MEMBERSHIP_MODEL = `model Membership {
+  id              String       @id @default(cuid())
+  role            String
+  // Null while the membership is a pending invitation.
+  userId          String?
+  organizationId  String
+  invitedById     String?
+  invitationToken String?      @unique
+  createdAt       DateTime     @default(now())
+  updatedAt   DateTime     @updatedAt
+  user            User?        @relation(fields: [userId], references: [id])
+  organization    Organization @relation(fields: [organizationId], references: [id])
+  invitedBy       Membership?  @relation("Inviter", fields: [invitedById], references: [id])
+  invitees        Membership[] @relation("Inviter")
+
+  @@unique([userId, organizationId])
+  @@index([organizationId])
+}`;
+const RW_DATA_MIGRATION_MODEL = `model RW_DataMigration {
+  version    String   @id
+  name       String
+  startedAt  DateTime
+  finishedAt DateTime
+}`;
+function hasModel(schema, modelName) {
+  return new RegExp(`\\bmodel\\s+${modelName}\\s*\\{`).test(schema);
+}
+function addTenancyModels(schema) {
+  return [ORGANIZATION_MODEL, MEMBERSHIP_MODEL].reduce(appendModel, schema);
+}
+function appendModel(schema, model) {
+  if (schema.includes(model)) {
+    return schema;
+  }
+  return `${schema.trimEnd()}
+
+${model}
+`;
+}
+function addDataMigrationModel(schema) {
+  if (hasModel(schema, "RW_DataMigration")) {
+    return schema;
+  }
+  return `${schema.trimEnd()}
+
+${RW_DATA_MIGRATION_MODEL}
+`;
+}
+function editSchema(schema, options) {
+  if (!hasModel(schema, "User")) {
+    throw new Error("CEDAR_TENANCY_ERR_NO_USER_MODEL");
+  }
+  const organizationIsCustomized = hasModel(schema, "Organization") && !schema.includes(ORGANIZATION_MODEL);
+  const membershipIsCustomized = hasModel(schema, "Membership") && !schema.includes(MEMBERSHIP_MODEL);
+  const modelsCustomized = organizationIsCustomized || membershipIsCustomized;
+  if (modelsCustomized && !options.force) {
+    return { schema: addDataMigrationModel(schema), outcome: "skipped" };
+  }
+  const withTenancyModels = addTenancyModels(schema);
+  return {
+    schema: addDataMigrationModel(withTenancyModels),
+    outcome: modelsCustomized ? "forced" : "added"
+  };
+}
+export {
+  MEMBERSHIP_MODEL,
+  ORGANIZATION_MODEL,
+  RW_DATA_MIGRATION_MODEL,
+  addDataMigrationModel,
+  addTenancyModels,
+  editSchema,
+  hasModel
+};

package/dist/commands/setup/tenancy/signupCodemod.js

@@ -0,0 +1,153 @@
+import j from "jscodeshift";
+function useShorthandUserAttributes(fn) {
+  const [firstParam] = fn.params;
+  if (!j.ObjectPattern.check(firstParam)) {
+    throw new Error("CEDAR_CODEMOD_ERR_SIGNUP_SHAPE_NOT_FOUND");
+  }
+  const userAttributesProperty = firstParam.properties.find(
+    (prop) => j.ObjectProperty.check(prop) && j.Identifier.check(prop.key) && prop.key.name === "userAttributes"
+  );
+  if (!userAttributesProperty || !j.ObjectProperty.check(userAttributesProperty)) {
+    throw new Error("CEDAR_CODEMOD_ERR_SIGNUP_SHAPE_NOT_FOUND");
+  }
+  userAttributesProperty.value = j.identifier("userAttributes");
+  userAttributesProperty.shorthand = true;
+}
+function addInvitationTokenToUserAttributes(root) {
+  root.find(j.TSInterfaceDeclaration, { id: { name: "UserAttributes" } }).forEach((path) => {
+    const alreadyHasField = path.node.body.body.some(
+      (member) => j.TSPropertySignature.check(member) && j.Identifier.check(member.key) && member.key.name === "invitationToken"
+    );
+    if (alreadyHasField) {
+      return;
+    }
+    path.node.body.body.push(
+      j.tsPropertySignature(
+        j.identifier("invitationToken"),
+        j.tsTypeAnnotation(j.tsStringKeyword()),
+        true
+        // optional
+      )
+    );
+  });
+}
+function wrapCreateCall(fn) {
+  fn.async = true;
+  const ensureCallStatement = j.expressionStatement(
+    j.awaitExpression(
+      j.callExpression(j.identifier("ensureDefaultOrganization"), [
+        j.objectExpression([
+          j.objectProperty(
+            j.identifier("currentUser"),
+            j.objectExpression([
+              j.objectProperty(
+                j.identifier("id"),
+                j.memberExpression(j.identifier("user"), j.identifier("id"))
+              ),
+              j.objectProperty(
+                j.identifier("memberships"),
+                j.arrayExpression([])
+              )
+            ])
+          ),
+          j.objectProperty(
+            j.identifier("invitationToken"),
+            j.memberExpression(
+              j.identifier("userAttributes"),
+              j.identifier("invitationToken")
+            )
+          )
+        ])
+      ])
+    )
+  );
+  const returnUserStatement = j.returnStatement(j.identifier("user"));
+  if (j.BlockStatement.check(fn.body)) {
+    const returnIndex = fn.body.body.findIndex(
+      (statement) => j.ReturnStatement.check(statement)
+    );
+    const returnStatement = fn.body.body[returnIndex];
+    if (returnIndex === -1 || !j.ReturnStatement.check(returnStatement) || !returnStatement.argument) {
+      throw new Error("CEDAR_CODEMOD_ERR_SIGNUP_SHAPE_NOT_FOUND");
+    }
+    const createUserStatement = j.variableDeclaration("const", [
+      j.variableDeclarator(
+        j.identifier("user"),
+        j.awaitExpression(returnStatement.argument)
+      )
+    ]);
+    fn.body.body.splice(
+      returnIndex,
+      1,
+      createUserStatement,
+      ensureCallStatement,
+      returnUserStatement
+    );
+    return;
+  }
+  if (j.Expression.check(fn.body)) {
+    const createUserStatement = j.variableDeclaration("const", [
+      j.variableDeclarator(
+        j.identifier("user"),
+        j.awaitExpression(
+          // ast-types' `Expression` checker type isn't assignable to
+          // `awaitExpression`'s narrower `ExpressionKind` union (a gap in
+          // ast-types' generated types); the `check()` call above already
+          // guarantees `fn.body` is a valid expression node.
+          fn.body
+        )
+      )
+    ]);
+    fn.body = j.blockStatement([
+      createUserStatement,
+      ensureCallStatement,
+      returnUserStatement
+    ]);
+    return;
+  }
+  throw new Error("CEDAR_CODEMOD_ERR_SIGNUP_SHAPE_NOT_FOUND");
+}
+function transform(fileInfo) {
+  const root = j.withParser("tsx")(fileInfo.source);
+  const signupOptionsDeclarators = root.find(j.VariableDeclarator, {
+    id: { name: "signupOptions" }
+  });
+  if (signupOptionsDeclarators.length === 0) {
+    throw new Error("CEDAR_CODEMOD_ERR_SIGNUP_SHAPE_NOT_FOUND");
+  }
+  let handlerFound = false;
+  signupOptionsDeclarators.forEach((path) => {
+    const init = path.node.init;
+    if (!j.ObjectExpression.check(init)) {
+      return;
+    }
+    const handlerProperty = init.properties.find(
+      (prop) => j.ObjectProperty.check(prop) && j.Identifier.check(prop.key) && prop.key.name === "handler"
+    );
+    if (!handlerProperty || !j.ObjectProperty.check(handlerProperty)) {
+      return;
+    }
+    const handlerFn = handlerProperty.value;
+    if (!j.ArrowFunctionExpression.check(handlerFn) && !j.FunctionExpression.check(handlerFn)) {
+      return;
+    }
+    useShorthandUserAttributes(handlerFn);
+    wrapCreateCall(handlerFn);
+    handlerFound = true;
+  });
+  if (!handlerFound) {
+    throw new Error("CEDAR_CODEMOD_ERR_SIGNUP_SHAPE_NOT_FOUND");
+  }
+  addInvitationTokenToUserAttributes(root);
+  const imports = root.find(j.ImportDeclaration);
+  imports.at(-1).insertAfter(
+    j.importDeclaration(
+      [j.importSpecifier(j.identifier("ensureDefaultOrganization"))],
+      j.literal("src/services/organizations/organizations")
+    )
+  );
+  return root.toSource();
+}
+export {
+  transform as default
+};

package/dist/commands/setup/tenancy/templates/InvitePage.tsx.template

@@ -0,0 +1,63 @@
+import { useEffect, useState } from 'react'
+
+import { navigate, routes, useParams } from '@cedarjs/router'
+import { Metadata, useMutation } from '@cedarjs/web'
+
+import { useAuth } from 'src/auth'
+
+const ACCEPT_INVITATION_MUTATION = gql`
+  mutation AcceptInvitationMutation($token: String!) {
+    acceptInvitation(token: $token) {
+      id
+      slug
+      name
+    }
+  }
+`
+
+/**
+ * Landing page for an invitation link (`/invite/{token}`). Outside
+ * `OrgScope`, since the visitor is not a member of the organization yet.
+ */
+const InvitePage = () => {
+  const { token } = useParams()
+  const { isAuthenticated, reauthenticate } = useAuth()
+  const [error, setError] = useState<string | null>(null)
+
+  const [acceptInvitation] = useMutation(ACCEPT_INVITATION_MUTATION, {
+    onCompleted: async (data) => {
+      await reauthenticate()
+      // TODO: point this at your app's organization home route, e.g.
+      // navigate(routes.orgHome({ orgSlug: data.acceptInvitation.slug }))
+      navigate(`/org/${data.acceptInvitation.slug}`)
+    },
+    onError: (mutationError) => setError(mutationError.message),
+  })
+
+  useEffect(() => {
+    if (isAuthenticated && token) {
+      acceptInvitation({ variables: { token } })
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [isAuthenticated, token])
+
+  if (!isAuthenticated) {
+    return (
+      <>
+        <Metadata title="Accept invitation" />
+        <p>Sign in or create an account to accept this invitation.</p>
+        <a href={`${routes.login()}?invitationToken=${token}`}>Log in</a>
+        <a href={`${routes.signup()}?invitationToken=${token}`}>Sign up</a>
+      </>
+    )
+  }
+
+  return (
+    <>
+      <Metadata title="Accept invitation" />
+      {error ? <p>{error}</p> : <p>Joining organization…</p>}
+    </>
+  )
+}
+
+export default InvitePage

package/dist/commands/setup/tenancy/templates/OrgScope.tsx.template

@@ -0,0 +1,40 @@
+import type { ReactNode } from 'react'
+
+import { OrgScope as TenancyOrgScope } from '@cedarjs/tenancy/web'
+
+import { useAuth } from 'src/auth'
+
+export interface OrgScopeProps {
+  /** Overrides the `orgSlug` route param. */
+  orgSlug?: string
+  children: ReactNode
+}
+
+/**
+ * Wraps organization routes with a per-organization Apollo client and a
+ * membership check, using this app's `useAuth`. Use with the router's
+ * `Set wrap`:
+ *
+ *   <Set wrap={OrgScope}>
+ *     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
+ *   </Set>
+ *
+ * Routes under `OrgScope` must not carry `prerender`: `OrgScope`'s nested
+ * Apollo client shadows the per-route client the prerenderer injects above
+ * `App`, so a prerendered query under here would not go through it.
+ */
+export const OrgScope = ({ orgSlug, children }: OrgScopeProps) => {
+  return (
+    <TenancyOrgScope
+      useAuth={useAuth}
+      orgSlug={orgSlug}
+      notAMember={
+        <div>
+          <p>You don&apos;t have access to this organization.</p>
+        </div>
+      }
+    >
+      {children}
+    </TenancyOrgScope>
+  )
+}

package/dist/commands/setup/tenancy/templates/ensureDefaultOrganizations.dataMigration.ts.template

@@ -0,0 +1,39 @@
+import type { PrismaClient } from 'src/lib/db'
+import { ensureDefaultOrganization } from 'src/services/organizations/organizations'
+
+const BATCH_SIZE = 100
+
+/**
+ * Existing users have no organization until this runs once: `setup tenancy`
+ * only wires new signups (via the GraphQL `context` function and, for dbAuth,
+ * the signup handler). Every user without a membership gets one, in batches,
+ * using the same `ensureDefaultOrganization` new signups use.
+ *
+ * Run with `__DATA_MIGRATE_UP_COMMAND__`, after
+ * `__PRISMA_MIGRATE_DEV_COMMAND__` has applied the
+ * `Organization`/`Membership` migration.
+ */
+export default async ({ db }: { db: PrismaClient }) => {
+  let cursor: string | undefined
+  let hasMore = true
+
+  while (hasMore) {
+    const users = await db.user.findMany({
+      take: BATCH_SIZE,
+      orderBy: { id: 'asc' },
+      ...(cursor ? { skip: 1, cursor: { id: cursor } } : {}),
+      include: { memberships: { select: { id: true } } },
+    })
+
+    for (const user of users) {
+      if (user.memberships.length === 0) {
+        await ensureDefaultOrganization({
+          currentUser: { id: user.id, memberships: [] },
+        })
+      }
+    }
+
+    cursor = users[users.length - 1]?.id
+    hasMore = users.length === BATCH_SIZE
+  }
+}

package/dist/commands/setup/tenancy/templates/organizations.scenarios.ts.template

@@ -0,0 +1,59 @@
+import type { ScenarioData } from '@cedarjs/testing/api'
+
+import type { Membership, Organization, Prisma } from 'src/lib/db'
+
+// This scenario assumes a dbAuth-style `User` model (`email`,
+// `hashedPassword`, `salt`). Adjust the `user` fixture below to match your
+// app's actual `User` fields if you use a different auth provider.
+export const standard = defineScenario<
+  Prisma.OrganizationCreateArgs | Prisma.MembershipCreateArgs
+>({
+  organization: {
+    acme: {
+      data: {
+        name: 'Acme Inc',
+        slug: 'acme-inc',
+      },
+    },
+  },
+  membership: {
+    owner: {
+      data: {
+        role: 'owner',
+        organization: { connect: { slug: 'acme-inc' } },
+        user: {
+          create: {
+            email: 'owner@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Org Owner',
+          },
+        },
+      },
+    },
+    admin: {
+      data: {
+        role: 'admin',
+        organization: { connect: { slug: 'acme-inc' } },
+        user: {
+          create: {
+            email: 'admin@example.com',
+            hashedPassword: 'x',
+            salt: 'x',
+            fullName: 'Org Admin',
+          },
+        },
+      },
+    },
+    pending: {
+      data: {
+        role: 'admin',
+        invitationToken: 'invite-token',
+        organization: { connect: { slug: 'acme-inc' } },
+      },
+    },
+  },
+})
+
+export type StandardScenario = ScenarioData<Organization, 'organization', 'acme'> &
+  ScenarioData<Membership, 'membership', 'owner' | 'admin' | 'pending'>

package/dist/commands/setup/tenancy/templates/organizations.sdl.ts.template

@@ -0,0 +1,89 @@
+export const schema = gql`
+  type Organization {
+    id: String!
+    name: String!
+    slug: String!
+    createdAt: DateTime!
+    updatedAt: DateTime!
+  }
+
+  type Membership {
+    id: String!
+    role: String!
+    userId: String
+    organizationId: String!
+    invitedById: String
+    createdAt: DateTime!
+    updatedAt: DateTime!
+    organization: Organization!
+  }
+
+  """
+  inviteMember's result. invitationToken is deliberately not a Membership
+  field: Membership is readable by any member (myMemberships, removeMember),
+  and a selectable invitationToken there would let any member read a
+  pending invitation's token and claim it themselves. Invitation exists only
+  as inviteMember's return type, so the token reaches only the caller who
+  just created the invitation -- the one the generated flow expects to email
+  it onward.
+  """
+  type Invitation {
+    membership: Membership!
+    invitationToken: String!
+  }
+
+  input CreateOrganizationInput {
+    name: String!
+  }
+
+  input InviteMemberInput {
+    email: String!
+    role: String!
+  }
+
+  type Query {
+    "Every membership belonging to the signed-in user, across all organizations they belong to."
+    myMemberships: [Membership!]! @requireAuth
+
+    "The current organization, resolved by resolveCurrentOrg for this request."
+    organization(id: String!): Organization @requireMembership
+  }
+
+  type Mutation {
+    "Creates a new organization with the caller as its owner."
+    createOrganization(input: CreateOrganizationInput!): Organization!
+      @requireAuth
+
+    """
+    Creates a pending membership (an invitation) in the current organization,
+    for a role the caller's own role may grant (see ROLE_GRANTS in
+    organizations.ts) -- an admin can invite an admin or a member, but not an
+    owner. The app is responsible for emailing input.email a link built from
+    the returned invitationToken; Membership has no email column of its own.
+    Web callers must call reauthenticate() from useAuth() in onCompleted so
+    the invite shows up if the inviter is also the invitee.
+    """
+    inviteMember(input: InviteMemberInput!): Invitation!
+      @requireMembership(roles: ["owner", "admin"])
+
+    """
+    Attaches the pending membership matching token to the signed-in user, or
+    is a no-op if it is already attached to them. Throws if the token is
+    invalid or was already claimed by someone else.
+    Web callers must call reauthenticate() from useAuth() in onCompleted so
+    the new membership is reflected in currentUser.memberships.
+    """
+    acceptInvitation(token: String!): Organization! @requireAuth
+
+    """
+    Removes a membership from the current organization, for a role the
+    caller's own role may grant (the same rule inviteMember uses) -- an
+    admin can never remove an owner, and an organization's last owner can
+    never be removed.
+    Web callers must call reauthenticate() from useAuth() in onCompleted when
+    removing their own membership.
+    """
+    removeMember(membershipId: String!): Membership!
+      @requireMembership(roles: ["owner", "admin"])
+  }
+`