@cedarjs/cli 7.0.0 → 8.0.0-canary.3263

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -0,0 +1,425 @@
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { Listr } from "listr2";
+import { format } from "prettier";
+import { terminalLink } from "termi-link";
+import { colors as c } from "@cedarjs/cli-helpers/colors";
+import { getPrettierOptions } from "@cedarjs/cli-helpers/fileHelpers";
+import {
+  addApiPackages,
+  addWebPackages
+} from "@cedarjs/cli-helpers/installHelpers";
+import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display";
+import { runTransitiveBin } from "@cedarjs/cli-helpers/packageManager/exec";
+import { getDataMigrationsPath, getSchemaPath } from "@cedarjs/project-config";
+import { errorTelemetry } from "@cedarjs/telemetry";
+import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
+import { isTypeScriptProject } from "../../../lib/project.js";
+import { runTransform } from "../../../lib/runTransform.js";
+import {
+  authNotSetUpMessage,
+  hasWebAuthFile,
+  noUserModelMessage
+} from "./preflight.js";
+import {
+  editSchema,
+  hasModel,
+  MEMBERSHIP_MODEL,
+  ORGANIZATION_MODEL
+} from "./schemaPrisma.js";
+const DEFAULT_TENANT_FIELD = "organizationId";
+const AUTH_SNIPPET = `
+  export const getCurrentUser = async (session) => {
+    return await db.user.findUnique({
+      where: { id: session.id },
+      select: {
+        // ...your existing fields...
+        memberships: {
+          select: {
+            id: true,
+            organizationId: true,
+            role: true,
+            organization: { select: { id: true, slug: true, name: true } },
+          },
+        },
+      },
+    })
+  }
+
+  export { hasOrgRole, requireMembership } from '@cedarjs/tenancy'
+`;
+const SIGNUP_SNIPPET = `
+  handler: async ({ username, hashedPassword, salt, userAttributes }) => {
+    const user = await db.user.create({
+      data: { email: username, hashedPassword, salt },
+    })
+
+    await ensureDefaultOrganization({
+      currentUser: user,
+      invitationToken: userAttributes.invitationToken,
+    })
+
+    return user
+  },
+`;
+const handler = async ({ tenantField, force }) => {
+  const paths = getPaths();
+  if (!hasWebAuthFile(paths.web.src)) {
+    console.error(c.error(authNotSetUpMessage()));
+    process.exit(1);
+  }
+  const preflightSchemaPath = await getSchemaPath(paths.api.prismaConfig);
+  if (!hasModel(fs.readFileSync(preflightSchemaPath, "utf-8"), "User")) {
+    console.error(
+      c.error(
+        noUserModelMessage(path.relative(paths.base, preflightSchemaPath))
+      )
+    );
+    process.exit(1);
+  }
+  const projectIsTypescript = isTypeScriptProject();
+  const ext = projectIsTypescript ? "ts" : "js";
+  const componentExt = projectIsTypescript ? "tsx" : "jsx";
+  const packageJson = await import(pathToFileURL(path.join(paths.base, "package.json")).href, { with: { type: "json" } });
+  const cedarVersion = packageJson.default.devDependencies["@cedarjs/core"] ?? "latest";
+  const authPath = path.join(paths.api.lib, `auth.${ext}`);
+  const graphqlPath = path.join(paths.api.functions, `graphql.${ext}`);
+  const functionsAuthPath = path.join(paths.api.functions, `auth.${ext}`);
+  const isDbAuthProject = fs.existsSync(functionsAuthPath) && fs.readFileSync(functionsAuthPath, "utf-8").includes("DbAuthHandler");
+  const writeTemplateFile = async (templateFile, outputPath, replacements = {}) => {
+    const dirname = import.meta.dirname;
+    const templatePath = path.resolve(dirname, "templates", templateFile);
+    let templateContent = fs.readFileSync(templatePath, "utf-8");
+    for (const [token, value] of Object.entries(replacements)) {
+      templateContent = templateContent.replaceAll(token, value);
+    }
+    const content = projectIsTypescript ? templateContent : await transformTSToJS(outputPath, templateContent);
+    return writeFile(outputPath, content, { overwriteExisting: force });
+  };
+  const tasks = new Listr(
+    [
+      {
+        ...addApiPackages([`@cedarjs/tenancy@${cedarVersion}`]),
+        title: "Adding @cedarjs/tenancy to your api side..."
+      },
+      {
+        ...addWebPackages([`@cedarjs/tenancy@${cedarVersion}`]),
+        title: "Adding @cedarjs/tenancy to your web side..."
+      },
+      {
+        title: "Adding Organization and Membership models to schema.prisma...",
+        task: async (ctx, task) => {
+          const schemaPath = await getSchemaPath(paths.api.prismaConfig);
+          const schema = fs.readFileSync(schemaPath, "utf-8");
+          let editResult;
+          try {
+            editResult = editSchema(schema, { force });
+          } catch (e) {
+            const message = e instanceof Error ? e.message : String(e);
+            if (message === "CEDAR_TENANCY_ERR_NO_USER_MODEL") {
+              const authSetup = formatCedarCommand(["setup", "auth", "dbAuth"]);
+              const tenancySetup = formatCedarCommand(["setup", "tenancy"]);
+              throw new Error(
+                `No \`User\` model found in schema.prisma. Set up authentication first (e.g. \`${authSetup}\`) before running \`${tenancySetup}\`.`
+              );
+            }
+            throw e;
+          }
+          ctx.modelsExistOutcome = editResult.outcome;
+          fs.writeFileSync(schemaPath, editResult.schema);
+          if (editResult.outcome === "skipped") {
+            task.output = `\`Organization\` and/or \`Membership\` models already exist in schema.prisma and were left as-is. Add these fields and relations by hand so tenancy can use them:
+
+${ORGANIZATION_MODEL}
+
+${MEMBERSHIP_MODEL}
+
+Re-run with --force to have this command append its own versions beside them instead, so you can diff and merge rather than retype.`;
+            return;
+          }
+          try {
+            await runTransitiveBin(
+              "prisma",
+              ["format", "--config", paths.api.prismaConfig],
+              { cwd: paths.base }
+            );
+          } catch {
+            if (editResult.outcome === "forced") {
+              task.output = '`prisma format` failed because the appended Organization/Membership clash with your existing ones, as requested by --force. Continuing with the rest of the setup; see "Next steps" for how to merge them.';
+              return;
+            }
+            throw new Error(
+              "`prisma format` failed, so the `memberships` relation was not added to the `User` model. Add it by hand: `memberships Membership[]` as the last field of `model User { ... }`, then re-run this command."
+            );
+          }
+          const membershipsOccurrences = (schema2) => (schema2.match(/memberships\s+Membership\[\]/g) ?? []).length;
+          const formattedSchema = fs.readFileSync(schemaPath, "utf-8");
+          if (membershipsOccurrences(formattedSchema) <= membershipsOccurrences(editResult.schema)) {
+            if (editResult.outcome === "forced") {
+              task.output = 'The `memberships` relation was not added to the `User` model, likely because of the clash from --force. Continuing with the rest of the setup; see "Next steps" for how to merge the appended models by hand.';
+              return;
+            }
+            throw new Error(
+              "`prisma format` did not add the `memberships` relation to the `User` model. Add it by hand: `memberships Membership[]` as the last field of `model User { ... }`, then re-run this command."
+            );
+          }
+        }
+      },
+      {
+        title: "Wrapping api/src/lib/db with the tenancy Prisma extension...",
+        task: async () => {
+          const dbPath = path.join(paths.api.lib, `db.${ext}`);
+          const transformResult = await runTransform({
+            transformPath: path.join(import.meta.dirname, "dbCodemod.js"),
+            targetPaths: [dbPath],
+            options: tenantField !== DEFAULT_TENANT_FIELD ? { tenantField } : {}
+          });
+          if (transformResult.error) {
+            if (transformResult.error === "CEDAR_CODEMOD_ERR_OLD_FORMAT") {
+              const tenancySetup = formatCedarCommand(["setup", "tenancy"]);
+              throw new Error(
+                `It looks like your api/src/lib/db file is using the old format. Please update it as per the v8 upgrade guide, then run \`${tenancySetup}\` again.`
+              );
+            }
+            throw new Error(
+              "Could not add the tenancy Prisma extension. Please modify `api/src/lib/db` by hand: wrap the `db` export in `.$extends(createTenancyExtension({ models: { allExcept: ['user', 'organization', 'membership'] } }))`."
+            );
+          }
+        }
+      },
+      {
+        title: "Adding memberships to getCurrentUser and re-exporting tenancy helpers...",
+        task: async (_ctx, task) => {
+          if (!fs.existsSync(authPath)) {
+            task.skip("No api/src/lib/auth file found; skipping.");
+            return;
+          }
+          const transformResult = await runTransform({
+            transformPath: path.join(import.meta.dirname, "authCodemod.js"),
+            targetPaths: [authPath]
+          });
+          if (transformResult.error) {
+            task.output = `Could not update api/src/lib/auth automatically. Please add this by hand:
+${AUTH_SNIPPET}`;
+          }
+        }
+      },
+      {
+        title: "Wiring api/src/functions/graphql for tenancy...",
+        task: async () => {
+          const transformResult = await runTransform({
+            transformPath: path.join(import.meta.dirname, "graphqlCodemod.js"),
+            targetPaths: [graphqlPath]
+          });
+          if (transformResult.error) {
+            if (transformResult.error === "CEDAR_CODEMOD_ERR_GRAPHQL_CONTEXT_EXISTS") {
+              throw new Error(
+                "api/src/functions/graphql already has a `context` option. Please wire it up for tenancy by hand; see the multi-tenancy how-to for the shape it needs."
+              );
+            }
+            throw new Error(
+              "Could not find `createGraphQLHandler({ ... })` in api/src/functions/graphql. Please wire it up for tenancy by hand; see the multi-tenancy how-to for the shape it needs."
+            );
+          }
+        },
+        skip: () => fs.existsSync(graphqlPath) ? false : "No api/src/functions/graphql file found; skipping."
+      },
+      {
+        title: "Adding the dbAuth signup handler for tenancy...",
+        task: async (_ctx, task) => {
+          const transformResult = await runTransform({
+            transformPath: path.join(import.meta.dirname, "signupCodemod.js"),
+            targetPaths: [functionsAuthPath]
+          });
+          if (transformResult.error) {
+            task.output = `Could not update the dbAuth signup handler automatically. Please add this to api/src/functions/auth's signupOptions:
+${SIGNUP_SNIPPET}`;
+          }
+        },
+        skip: () => isDbAuthProject ? false : "Not a dbAuth project; skipping."
+      },
+      {
+        title: "Adding the requireMembership directive...",
+        task: async () => {
+          const directiveDir = path.join(
+            paths.api.directives,
+            "requireMembership"
+          );
+          await writeTemplateFile(
+            "requireMembership.ts.template",
+            path.join(directiveDir, `requireMembership.${ext}`)
+          );
+          await writeTemplateFile(
+            "requireMembership.test.ts.template",
+            path.join(directiveDir, `requireMembership.test.${ext}`)
+          );
+        }
+      },
+      {
+        title: "Adding the organizations service...",
+        task: async () => {
+          const serviceDir = path.join(paths.api.services, "organizations");
+          await writeTemplateFile(
+            "organizations.ts.template",
+            path.join(serviceDir, `organizations.${ext}`)
+          );
+          await writeTemplateFile(
+            "organizations.test.ts.template",
+            path.join(serviceDir, `organizations.test.${ext}`)
+          );
+          await writeTemplateFile(
+            "organizations.scenarios.ts.template",
+            path.join(serviceDir, `organizations.scenarios.${ext}`)
+          );
+          await writeTemplateFile(
+            "organizations.sdl.ts.template",
+            path.join(paths.api.graphql, `organizations.sdl.${ext}`)
+          );
+        }
+      },
+      {
+        title: "Adding a data migration to backfill existing users...",
+        task: async () => {
+          const dataMigrationsPath = await getDataMigrationsPath(
+            paths.api.prismaConfig
+          );
+          const timestamp = (/* @__PURE__ */ new Date()).toISOString().split(".")[0].replace(/\D/g, "");
+          await writeTemplateFile(
+            "ensureDefaultOrganizations.dataMigration.ts.template",
+            path.join(
+              dataMigrationsPath,
+              `${timestamp}-ensure-default-organizations.${ext}`
+            ),
+            {
+              __DATA_MIGRATE_UP_COMMAND__: formatCedarCommand([
+                "data-migrate",
+                "up"
+              ]),
+              __PRISMA_MIGRATE_DEV_COMMAND__: formatCedarCommand([
+                "prisma",
+                "migrate",
+                "dev"
+              ])
+            }
+          );
+        }
+      },
+      {
+        title: "Adding OrgScope and the invitation landing page...",
+        task: async () => {
+          await writeTemplateFile(
+            "OrgScope.tsx.template",
+            path.join(
+              paths.web.components,
+              "OrgScope",
+              `OrgScope.${componentExt}`
+            )
+          );
+          await writeTemplateFile(
+            "InvitePage.tsx.template",
+            path.join(
+              paths.web.pages,
+              "InvitePage",
+              `InvitePage.${componentExt}`
+            )
+          );
+        }
+      },
+      {
+        title: "Prettifying changed files",
+        task: async (_ctx, task) => {
+          const prettifyPaths = [
+            path.join(paths.api.lib, "db.js"),
+            path.join(paths.api.lib, "db.ts"),
+            path.join(paths.api.lib, "auth.js"),
+            path.join(paths.api.lib, "auth.ts"),
+            path.join(paths.api.functions, "graphql.js"),
+            path.join(paths.api.functions, "graphql.ts"),
+            path.join(paths.api.functions, "auth.js"),
+            path.join(paths.api.functions, "auth.ts")
+          ];
+          for (const prettifyPath of prettifyPaths) {
+            try {
+              if (!fs.existsSync(prettifyPath)) {
+                continue;
+              }
+              const source = fs.readFileSync(prettifyPath, "utf-8");
+              const prettierOptions = await getPrettierOptions();
+              const prettifiedApp = await format(source, {
+                ...prettierOptions,
+                parser: "babel-ts"
+              });
+              fs.writeFileSync(prettifyPath, prettifiedApp, "utf-8");
+            } catch {
+              task.output = "Couldn't prettify the changes. Please reformat the files manually if needed.";
+            }
+          }
+        }
+      },
+      {
+        title: "Next steps...",
+        task: (ctx, task) => {
+          const migrateCommand = formatCedarCommand([
+            "prisma",
+            "migrate",
+            "dev"
+          ]);
+          const dataMigrateCommand = formatCedarCommand(["data-migrate", "up"]);
+          const modelsExistWarning = ctx.modelsExistOutcome === "forced" ? c.error(
+            "\nschema.prisma is currently invalid (as requested by --force): merge the appended Organization/Membership blocks with your existing ones, then run `prisma format`.\n"
+          ) : ctx.modelsExistOutcome === "skipped" ? c.warning(
+            "\nOrganization/Membership already existed and were left as-is: add the fields and relations printed above by hand before continuing.\n"
+          ) : "";
+          task.title = `Next steps...
+
+          ${c.success("\nMulti-tenancy configured!\n")}
+          ${modelsExistWarning}
+          1. Run ${c.highlight(migrateCommand)} to create the Organization/Membership
+             tables, then ${c.highlight(dataMigrateCommand)} to give every existing
+             user a default organization.
+          2. \`db.ts\`'s tenancy extension scopes every model except
+             User/Organization/Membership. For each existing model (e.g.
+             Contact) whose rows belong to one organization, add ${c.highlight("organizationId String")} plus ${c.highlight("@@index([organizationId])")}
+             to it in schema.prisma; for each one that stays global, add it
+             to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
+          3. Wrap your organization routes with the generated OrgScope in
+             web/src/Routes.tsx:
+
+               <Set wrap={OrgScope}>
+                 <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
+               </Set>
+
+             and add the invitation route outside it:
+
+               <Route path="/invite/{token}" page={InvitePage} name="invite" />
+
+          4. Wrap any plain api/src/functions/* handler that touches
+             tenant-owned models with ${c.highlight("withTenancy")} from ${c.highlight(
+            "@cedarjs/tenancy"
+          )}.
+
+          Check out the docs for more info:
+          ${terminalLink("", "https://cedarjs.com/docs/tenancy")}
+
+        `;
+        }
+      }
+    ],
+    {
+      rendererOptions: { collapseSubtasks: false }
+    }
+  );
+  try {
+    await tasks.run();
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    const exitCode = e instanceof Error && "exitCode" in e && typeof e.exitCode === "number" ? e.exitCode : 1;
+    errorTelemetry(process.argv, message);
+    console.error(c.error(message));
+    process.exit(exitCode);
+  }
+};
+export {
+  handler
+};

package/dist/commands/setup/ui/libraries/chakra-uiHandler.js

@@ -1,7 +1,8 @@
 import path from "path";
 import { Listr } from "listr2";
-import { recordTelemetryAttributes, colors as c } from "@cedarjs/cli-helpers";
+import { colors as c } from "@cedarjs/cli-helpers/colors";
 import { addWorkspacePackages } from "@cedarjs/cli-helpers/packageManager/packages";
+import { recordTelemetryAttributes } from "@cedarjs/cli-helpers/telemetry";
 import extendStorybookConfiguration from "../../../../lib/configureStorybook.js";
 import { extendJSXFile, fileIncludes } from "../../../../lib/extendFile.js";
 import { getPaths, writeFile } from "../../../../lib/index.js";

package/dist/commands/setup/ui/libraries/mantineHandler.js

@@ -1,8 +1,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import { Listr } from "listr2";
-import { recordTelemetryAttributes, colors as c } from "@cedarjs/cli-helpers";
+import { colors as c } from "@cedarjs/cli-helpers/colors";
 import { addWorkspacePackages } from "@cedarjs/cli-helpers/packageManager/packages";
+import { recordTelemetryAttributes } from "@cedarjs/cli-helpers/telemetry";
 import extendStorybookConfiguration from "../../../../lib/configureStorybook.js";
 import { extendJSXFile, fileIncludes } from "../../../../lib/extendFile.js";
 import { getPaths, writeFile } from "../../../../lib/index.js";

package/dist/commands/setup/ui/libraries/tailwindcssHandler.js

@@ -4,13 +4,14 @@ import { ListrEnquirerPromptAdapter } from "@listr2/prompt-adapter-enquirer";
 import execa from "execa";
 import { Listr } from "listr2";
 import { terminalLink } from "termi-link";
-import { recordTelemetryAttributes, colors as c } from "@cedarjs/cli-helpers";
+import { colors as c } from "@cedarjs/cli-helpers/colors";
 import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display";
 import { runBin } from "@cedarjs/cli-helpers/packageManager/exec";
 import {
   addRootPackages,
   addWorkspacePackages
 } from "@cedarjs/cli-helpers/packageManager/packages";
+import { recordTelemetryAttributes } from "@cedarjs/cli-helpers/telemetry";
 import { errorTelemetry } from "@cedarjs/telemetry";
 import { getPaths, usingVSCode } from "../../../../lib/index.js";
 const tailwindDirectives = [

package/dist/commands/setup/uploads/schemaPrisma.js

@@ -0,0 +1,41 @@
+const UPLOAD_MODEL = `model Upload {
+  id             String   @id @default(cuid())
+  /// Name of the storage target, as configured in api/src/lib/uploads
+  target         String
+  /// "pending" | "completed" | "failed"
+  status         String   @default("pending")
+  filename       String
+  mimeType       String
+  /// Bytes. BigInt because Int caps at 2 GB.
+  size           BigInt
+  /// Provider-specific reference: S3 object key, filename on disk, or null
+  /// for files stored inline
+  storageKey     String?
+  /// Inline bytes, only for DB targets
+  data           Bytes?
+  /// The user the file belongs to, when it belongs to one
+  userId         String?
+  /// Id of the upload token that created this row
+  tokenId        String?
+  /// The organization the file belongs to, in multi-tenant apps
+  organizationId String?
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+}`;
+function hasModel(schema, modelName) {
+  return new RegExp(`\\bmodel\\s+${modelName}\\s*\\{`).test(schema);
+}
+function addUploadModel(schema) {
+  if (hasModel(schema, "Upload")) {
+    return schema;
+  }
+  return `${schema.trimEnd()}
+
+${UPLOAD_MODEL}
+`;
+}
+export {
+  UPLOAD_MODEL,
+  addUploadModel,
+  hasModel
+};

package/dist/commands/setup/uploads/serverFile.js

@@ -0,0 +1,151 @@
+const START_LINE = /^([ \t]*)await server\.start\(\)/m;
+const FACTORY_IMPORT = /import\s*\{[^}]*\bcreateAuthDecoder\b[^}]*\}\s*from\s*['"](@cedarjs\/auth-[a-z0-9-]+-api)['"]/;
+const DECODER_IMPORT = /import\s*\{[^}]*\bauthDecoder\b[^}]*\}\s*from\s*['"](@cedarjs\/auth-[a-z0-9-]+-api)['"]/;
+function detectServerAuth(graphqlSource) {
+  const factory = FACTORY_IMPORT.exec(graphqlSource);
+  if (factory) {
+    return { decoderPackage: factory[1], usesFactory: true };
+  }
+  const decoder = DECODER_IMPORT.exec(graphqlSource);
+  if (decoder) {
+    return { decoderPackage: decoder[1], usesFactory: false };
+  }
+  return null;
+}
+function importedBindings(source) {
+  const names = /* @__PURE__ */ new Set();
+  const statements = source.matchAll(
+    /^import\s+(type\s+)?([^;]*?)\s+from\s+['"][^'"]+['"]/gm
+  );
+  for (const [, typeOnly, clause] of statements) {
+    if (typeOnly) {
+      continue;
+    }
+    const braces = /\{([^}]*)\}/.exec(clause);
+    const defaultOrNamespace = clause.replace(/\{[^}]*\}/, "");
+    for (const part of defaultOrNamespace.split(",")) {
+      const local = part.replace(/^\s*\*\s+as\s+/, "").trim();
+      if (local) {
+        names.add(local);
+      }
+    }
+    for (const specifier of braces?.[1].split(",") ?? []) {
+      const trimmed = specifier.trim();
+      if (!trimmed || trimmed.startsWith("type ")) {
+        continue;
+      }
+      const alias = / as (\w+)$/.exec(trimmed);
+      names.add(alias ? alias[1] : trimmed);
+    }
+  }
+  return names;
+}
+function hasBinding(source, name) {
+  const declared = new RegExp(
+    `^(?:export\\s+)?(?:const|let|var|function)\\s+${name}\\b`,
+    "m"
+  );
+  return importedBindings(source).has(name) || declared.test(source);
+}
+function uploadsServerImports(source, auth) {
+  const packageSpecs = [];
+  const srcSpecs = [];
+  if (auth) {
+    if (auth.usesFactory) {
+      if (!hasBinding(source, "authDecoder")) {
+        packageSpecs.push({
+          names: ["createAuthDecoder"],
+          from: auth.decoderPackage
+        });
+      }
+    } else {
+      packageSpecs.push({ names: ["authDecoder"], from: auth.decoderPackage });
+    }
+  }
+  packageSpecs.push({
+    names: auth ? ["cedarUploadsPlugin", "createUploadAuthenticator"] : ["cedarUploadsPlugin"],
+    from: "@cedarjs/uploads"
+  });
+  if (auth) {
+    const authNames = ["getCurrentUser"];
+    if (auth.usesFactory && !hasBinding(source, "authDecoder")) {
+      authNames.unshift("cookieName");
+    }
+    srcSpecs.push({ names: authNames, from: "src/lib/auth" });
+  }
+  srcSpecs.push({ names: ["db"], from: "src/lib/db" });
+  srcSpecs.push({ names: ["targets"], from: "src/lib/uploads" });
+  const render = (specs) => specs.map((spec) => ({
+    ...spec,
+    names: spec.names.filter((name) => !hasBinding(source, name))
+  })).filter((spec) => spec.names.length > 0).map((spec) => `import { ${spec.names.join(", ")} } from '${spec.from}'`);
+  const packageLines = render(packageSpecs);
+  const srcLines = render(srcSpecs);
+  if (packageLines.length > 0 && srcLines.length > 0) {
+    return [...packageLines, "", ...srcLines];
+  }
+  return [...packageLines, ...srcLines];
+}
+function uploadsServerRegistration(source, auth) {
+  if (!auth) {
+    return `  await server.register(cedarUploadsPlugin, {
+    tokenSecret: process.env.UPLOAD_TOKEN_SECRET,
+    targets,
+    db,
+    // Once the app has auth, bind upload tokens to the logged-in user:
+    //
+    //   authenticate: createUploadAuthenticator({ authDecoder, getCurrentUser }),
+  })
+`;
+  }
+  const decoder = auth.usesFactory && !hasBinding(source, "authDecoder") ? "  const authDecoder = createAuthDecoder(cookieName)\n\n" : "";
+  return `${decoder}  await server.register(cedarUploadsPlugin, {
+    tokenSecret: process.env.UPLOAD_TOKEN_SECRET,
+    targets,
+    db,
+    // Binds upload tokens to the logged-in user through the same auth
+    // pipeline the GraphQL server uses
+    authenticate: createUploadAuthenticator({ authDecoder, getCurrentUser }),
+  })
+`;
+}
+function hasUploadsPlugin(source) {
+  return /^[ \t]*(?:(?:await|void)\s+|(?:const|let|var)\s+\w+\s*=\s*)?[\w.]+\.register\(\s*cedarUploadsPlugin\b/m.test(
+    source
+  );
+}
+function addUploadsPlugin(source, { auth = null } = {}) {
+  if (hasUploadsPlugin(source)) {
+    return source;
+  }
+  const start = START_LINE.exec(source);
+  if (!start) {
+    throw new Error("CEDAR_UPLOADS_ERR_NO_START");
+  }
+  const lines = source.split("\n");
+  let lastImport = -1;
+  for (const [index, line] of lines.entries()) {
+    if (/^import\s/.test(line)) {
+      lastImport = index;
+    }
+  }
+  const withImports = [
+    ...lines.slice(0, lastImport + 1),
+    ...uploadsServerImports(source, auth),
+    ...lines.slice(lastImport + 1)
+  ].join("\n");
+  return withImports.replace(
+    START_LINE,
+    (line) => `${uploadsServerRegistration(source, auth)}
+${line}`
+  );
+}
+export {
+  addUploadsPlugin,
+  detectServerAuth,
+  hasBinding,
+  hasUploadsPlugin,
+  importedBindings,
+  uploadsServerImports,
+  uploadsServerRegistration
+};

package/dist/commands/setup/uploads/templates/requireUploadToken.ts.template

@@ -0,0 +1,15 @@
+import { createRequireUploadTokenDirective } from '@cedarjs/uploads'
+
+/**
+ * Requires a valid upload token in the x-upload-token request header and
+ * makes its claims available to the resolver through
+ * `getUploadTokenPayload(context)`. The token must have been issued to the
+ * requesting user.
+ */
+const requireUploadToken = createRequireUploadTokenDirective({
+  secret: process.env.UPLOAD_TOKEN_SECRET ?? '',
+})
+
+export const schema = requireUploadToken.schema
+
+export default requireUploadToken