@cedarjs/cli 8.0.0-canary.3538 → 8.0.0-canary.3539

package/dist/commands/generate/realtime/realtimeHandler.js

@@ -7,6 +7,7 @@ import prompts from "prompts";
 import { colors as c } from "@cedarjs/cli-helpers/colors";
 import { generate as generateTypes } from "@cedarjs/internal/dist/generate/generate";
 import { errorTelemetry } from "@cedarjs/telemetry";
+import { withAuthDirective } from "../../../lib/authDirective.js";
 import {
   generateTemplate,
   getPaths,
@@ -119,14 +120,18 @@ async function handler({
             exampleFile,
             exampleSubscriptionTemplateContent
           );
-          const blankTemplateContent = await generateTemplate(
-            setupScriptContent,
-            templateVariables(name)
+          const blankTemplateContent = withAuthDirective(
+            await generateTemplate(setupScriptContent, templateVariables(name)),
+            // Not about a model, so the safe default
+            { belongsToOrg: true }
           );
           return [
             writeFile(
               sdlFile,
-              await generateTemplate(sdlContent, templateVariables(name)),
+              withAuthDirective(
+                await generateTemplate(sdlContent, templateVariables(name)),
+                { belongsToOrg: true }
+              ),
               {
                 overwriteExisting: force
               }
@@ -176,7 +181,10 @@ async function handler({
           return [
             writeFile(
               sdlFile,
-              await generateTemplate(sdlContent, templateVariables(name)),
+              withAuthDirective(
+                await generateTemplate(sdlContent, templateVariables(name)),
+                { belongsToOrg: true }
+              ),
               {
                 overwriteExisting: force
               }

package/dist/commands/generate/sdl/sdlHandler.js

@@ -9,6 +9,10 @@ import { generate as generateTypes } from "@cedarjs/internal/dist/generate/gener
 import { getConfig } from "@cedarjs/project-config";
 import { errorTelemetry } from "@cedarjs/telemetry";
 import { pluralize } from "@cedarjs/utils/cedarPluralize";
+import {
+  belongsToOrganization,
+  withAuthDirective
+} from "../../../lib/authDirective.js";
 import { transformTSToJS } from "../../../lib/index.js";
 import {
   prepareForRollback,
@@ -159,7 +163,8 @@ const sdlFromSchemaModel = async (name, crud, docs = false) => {
     idType: idType(model, crud),
     idName: idName(model, crud),
     relations: relationsForModel(model),
-    enums
+    enums,
+    belongsToOrg: belongsToOrganization(model)
   };
 };
 const files = async ({
@@ -180,7 +185,10 @@ const files = async ({
     templateVars: { docs, name, crud, ...sdlData },
     outputPath: `${camelcase(pluralize(name))}.sdl.${extension}`
   });
-  const template = typescript ? content : await transformTSToJS(outputPath, content);
+  const sdl = withAuthDirective(content, {
+    belongsToOrg: sdlData.belongsToOrg
+  });
+  const template = typescript ? sdl : await transformTSToJS(outputPath, sdl);
   return {
     [outputPath]: template,
     ...await serviceFiles({

package/dist/commands/setup/realtime/realtimeHandler.js

@@ -7,6 +7,7 @@ import { addApiPackages } from "@cedarjs/cli-helpers/installHelpers";
 import { runBinSync } from "@cedarjs/cli-helpers/packageManager/exec";
 import { generate as generateTypes } from "@cedarjs/internal/dist/generate/generate";
 import { errorTelemetry } from "@cedarjs/telemetry";
+import { withAuthDirective } from "../../../lib/authDirective.js";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject, serverFileExists } from "../../../lib/project.js";
 import { setupServerFileTasks } from "../server-file/serverFileHandler.js";
@@ -97,9 +98,13 @@ async function handler(args) {
             exampleSubscriptionTemplateContent
           );
           return [
-            writeFile(exampleFile, setupScriptContent, {
-              overwriteExisting: force
-            })
+            writeFile(
+              exampleFile,
+              withAuthDirective(setupScriptContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            )
           ];
         }
       },
@@ -158,15 +163,23 @@ async function handler(args) {
             exampleSubscriptionTemplateContent
           );
           return [
-            writeFile(sdlFile, sdlContent, {
-              overwriteExisting: force
-            }),
+            writeFile(
+              sdlFile,
+              withAuthDirective(sdlContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            ),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             }),
-            writeFile(exampleFile, setupScriptContent, {
-              overwriteExisting: force
-            })
+            writeFile(
+              exampleFile,
+              withAuthDirective(setupScriptContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            )
           ];
         }
       },
@@ -206,9 +219,13 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(sdlFile, sdlContent, {
-              overwriteExisting: force
-            }),
+            writeFile(
+              sdlFile,
+              withAuthDirective(sdlContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            ),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })
@@ -251,9 +268,13 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(sdlFile, sdlContent, {
-              overwriteExisting: force
-            }),
+            writeFile(
+              sdlFile,
+              withAuthDirective(sdlContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            ),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })
@@ -296,9 +317,13 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(sdlFile, sdlContent, {
-              overwriteExisting: force
-            }),
+            writeFile(
+              sdlFile,
+              withAuthDirective(sdlContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            ),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })

package/dist/commands/setup/tenancy/authCodemod.js

@@ -18,6 +18,59 @@ function buildMembershipsSelectProperty() {
   }
   return property;
 }
+const TENANCY_AUTH_EXPORT = `export const { hasUserRole, hasOrgRole, requireUserAuth, requireOrgAuth } =
+  createTenancyAuth()
+`;
+const DEFAULT_REQUIRE_AUTH_STATEMENTS = [
+  /^if \(!isAuthenticated\(\)\) \{ throw new AuthenticationError\([^)]*\);? \}$/,
+  /^if \(roles && !hasRole\(roles\)\) \{ throw new ForbiddenError\([^)]*\);? \}$/,
+  /^return isAuthenticated\(\);?$/
+];
+const DEFAULT_HAS_ROLE_NAMES = /* @__PURE__ */ new Set([
+  "AllowedRoles",
+  "Array",
+  "allowedRole",
+  "allowedRoles",
+  "context",
+  "currentUser",
+  "currentUserRoles",
+  "hasRole",
+  "includes",
+  "isArray",
+  "isAuthenticated",
+  "role",
+  "roles",
+  "some",
+  "undefined"
+]);
+function exportedValue(declaration) {
+  const node = declaration.nodes()[0];
+  return j.VariableDeclaration.check(node?.declaration) ? node.declaration.declarations[0] : void 0;
+}
+function isDefaultHasRole(hasRole) {
+  return hasRole.find(j.Identifier).nodes().every((identifier) => DEFAULT_HAS_ROLE_NAMES.has(identifier.name));
+}
+function isDefaultRequireAuth(requireAuth) {
+  const declarator = exportedValue(requireAuth);
+  const fn = j.VariableDeclarator.check(declarator) ? declarator.init : null;
+  if (!j.ArrowFunctionExpression.check(fn) || !j.BlockStatement.check(fn.body)) {
+    return false;
+  }
+  return fn.body.body.every((statement) => {
+    const source = j(statement).toSource().replace(/\/\/[^\n]*|\/\*[\s\S]*?\*\//g, "").replace(/\s+/g, " ").trim();
+    return DEFAULT_REQUIRE_AUTH_STATEMENTS.some(
+      (pattern) => pattern.test(source)
+    );
+  });
+}
+function findExportedConst(root, name) {
+  return root.find(j.ExportNamedDeclaration, {
+    declaration: {
+      type: "VariableDeclaration",
+      declarations: [{ id: { type: "Identifier", name } }]
+    }
+  });
+}
 function transform(fileInfo) {
   const root = j.withParser("tsx")(fileInfo.source);
   let selectFound = false;
@@ -55,29 +108,52 @@ function transform(fileInfo) {
   if (!selectFound) {
     throw new Error("CEDAR_CODEMOD_ERR_AUTH_SHAPE_NOT_FOUND");
   }
-  const exported = /* @__PURE__ */ new Set();
-  root.find(j.ExportNamedDeclaration, { source: { value: "@cedarjs/tenancy" } }).forEach((path) => {
-    for (const specifier of path.node.specifiers ?? []) {
-      if (j.Identifier.check(specifier.exported)) {
-        exported.add(specifier.exported.name);
-      }
-    }
+  const alreadyWired = root.find(j.ImportSpecifier, { imported: { name: "createTenancyAuth" } }).length > 0;
+  if (alreadyWired) {
+    return changed ? root.toSource() : fileInfo.source;
+  }
+  const hasRole = findExportedConst(root, "hasRole");
+  const requireAuth = findExportedConst(root, "requireAuth");
+  if (hasRole.length !== 1 || requireAuth.length !== 1) {
+    throw new Error("CEDAR_CODEMOD_ERR_AUTH_CHECKS_NOT_FOUND");
+  }
+  if (!isDefaultRequireAuth(requireAuth) || !isDefaultHasRole(hasRole)) {
+    throw new Error("CEDAR_CODEMOD_ERR_AUTH_CHECKS_CHANGED");
+  }
+  const tenancyAuth = j.withParser("ts")(TENANCY_AUTH_EXPORT).find(j.ExportNamedDeclaration).nodes()[0];
+  requireAuth.replaceWith(tenancyAuth);
+  hasRole.remove();
+  root.find(j.Identifier, { name: "hasRole" }).filter(
+    (path) => !(j.MemberExpression.check(path.parent.node) && path.parent.node.property === path.node)
+  ).forEach((path) => {
+    path.node.name = "hasUserRole";
   });
-  const missing = ["hasOrgRole", "requireMembership"].filter(
-    (name) => !exported.has(name)
+  const isUnused = (name) => root.find(j.Identifier, { name }).filter(
+    (path) => !j.ImportSpecifier.check(path.parent.node) && !j.TSTypeAliasDeclaration.check(path.parent.node)
+  ).length === 0;
+  root.find(j.TSTypeAliasDeclaration, { id: { name: "AllowedRoles" } }).filter(() => isUnused("AllowedRoles")).remove();
+  root.find(j.ImportDeclaration, { source: { value: "@cedarjs/graphql-server" } }).forEach((path) => {
+    path.node.specifiers = (path.node.specifiers ?? []).filter(
+      (specifier) => !j.ImportSpecifier.check(specifier) || !j.Identifier.check(specifier.local) || !isUnused(specifier.local.name)
+    );
+  }).filter((path) => (path.node.specifiers ?? []).length === 0).remove();
+  const tenancyImport = j.withParser("ts")(`import { createTenancyAuth } from '@cedarjs/tenancy'
+`).find(j.ImportDeclaration).nodes()[0];
+  const imports = root.find(j.ImportDeclaration);
+  const cedarImports = imports.filter(
+    (path) => String(path.node.source.value).startsWith("@cedarjs/")
   );
-  if (missing.length > 0) {
-    const tenancyExport = j.withParser("ts")(
-      `export { ${missing.join(", ")} } from '@cedarjs/tenancy'
-`
-    ).find(j.ExportNamedDeclaration).nodes()[0];
+  const anchor = cedarImports.length > 0 ? cedarImports : imports;
+  if (anchor.length > 0) {
+    anchor.at(anchor.length - 1).insertAfter(tenancyImport);
+  } else {
     root.find(j.Program).forEach((path) => {
-      path.node.body.push(tenancyExport);
+      path.node.body.unshift(tenancyImport);
     });
-    changed = true;
   }
-  return changed ? root.toSource() : fileInfo.source;
+  return root.toSource();
 }
 export {
+  TENANCY_AUTH_EXPORT,
   transform as default
 };

package/dist/commands/setup/tenancy/authDirectives.js

@@ -0,0 +1,101 @@
+function renameRequireAuthDirective(source) {
+  return source.replace(/@requireAuth(?![\w$])/g, "@requireUserAuth");
+}
+const LIB_AUTH_IMPORT = /import\s*\{([^}]*)\}\s*from\s*(['"])((?:src|\.{1,2})(?:\/[^'"]*)?\/lib\/auth(?:\.[jt]s)?)\2/g;
+const LIB_AUTH_RENAMES = {
+  requireAuth: "requireUserAuth",
+  hasRole: "hasUserRole"
+};
+function renameLibAuthImports(source) {
+  let result = source;
+  for (const [from, to] of Object.entries(LIB_AUTH_RENAMES)) {
+    let renameUses = false;
+    result = result.replace(
+      LIB_AUTH_IMPORT,
+      (statement, specifiers) => {
+        const renamed = specifiers.replace(
+          new RegExp(`(?<![\\w$])${from}(?![\\w$])(\\s+as\\s+[\\w$]+)?`, "g"),
+          (_specifier, alias) => {
+            if (!alias) {
+              renameUses = true;
+            }
+            return `${to}${alias ?? ""}`;
+          }
+        );
+        return statement.replace(specifiers, renamed);
+      }
+    );
+    if (renameUses) {
+      result = result.replace(
+        new RegExp(`(?<![\\w$@.])${from}(?![\\w$])`, "g"),
+        to
+      );
+    }
+  }
+  return result;
+}
+const DEFAULT_REQUIRE_AUTH_DIRECTIVES = [
+  `import { gql } from 'graphql-tag'
+
+import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
+import { createValidatorDirective } from '@cedarjs/graphql-server'
+
+import { requireAuth as applicationRequireAuth } from 'src/lib/auth'
+
+export const schema = gql\`
+  """
+  Use to check whether or not a user is authenticated and is associated
+  with an optional set of roles.
+  """
+  directive @requireAuth(roles: [String]) on FIELD_DEFINITION
+\`
+
+type RequireAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
+
+const validate: RequireAuthValidate = ({ directiveArgs }) => {
+  const { roles } = directiveArgs
+  applicationRequireAuth({ roles })
+}
+
+const requireAuth = createValidatorDirective(schema, validate)
+
+export default requireAuth
+`,
+  `import { gql } from 'graphql-tag'
+
+import { createValidatorDirective } from '@cedarjs/graphql-server'
+
+import { requireAuth as applicationRequireAuth } from 'src/lib/auth'
+
+export const schema = gql\`
+  """
+  Use to check whether or not a user is authenticated and is associated
+  with an optional set of roles.
+  """
+  directive @requireAuth(roles: [String]) on FIELD_DEFINITION
+\`
+
+const validate = ({ directiveArgs }) => {
+  const { roles } = directiveArgs
+  applicationRequireAuth({ roles })
+}
+
+const requireAuth = createValidatorDirective(schema, validate)
+
+export default requireAuth
+`
+];
+function withoutFormatting(source) {
+  return source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, "").replace(/["']/g, "'").replace(/[;\s]/g, "").replace(/,([)\]}>])/g, "$1");
+}
+function isDefaultRequireAuthDirective(source) {
+  return DEFAULT_REQUIRE_AUTH_DIRECTIVES.some(
+    (directive) => withoutFormatting(directive) === withoutFormatting(source)
+  );
+}
+export {
+  DEFAULT_REQUIRE_AUTH_DIRECTIVES,
+  isDefaultRequireAuthDirective,
+  renameLibAuthImports,
+  renameRequireAuthDirective
+};

package/dist/commands/setup/tenancy/templates/OrgScope.tsx.template

@@ -7,6 +7,13 @@ import { useAuth } from 'src/auth'
 export interface OrgScopeProps {
   /** Overrides the `orgSlug` route param. */
   orgSlug?: string
+  /** Only members with one of these roles in the organization get in. */
+  roles?: string | string[]
+  /**
+   * The name of the route a member without one of `roles` is sent to. It
+   * gets the `orgSlug` param when its path has one.
+   */
+  unauthorized?: string
   children: ReactNode
 }
 
@@ -19,15 +26,37 @@ export interface OrgScopeProps {
  *     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
  *   </Set>
  *
+ * `useCurrentOrg().hasOrgRole` checks the user's role in the organization,
+ * and `useAuth().hasUserRole` checks `currentUser.roles`. For pages only some
+ * roles may open, wrap them in a component that passes `roles` (there's no
+ * `<PrivateSet roles>` with tenancy):
+ *
+ *   const OwnersOnly = ({ children }: { children: ReactNode }) => (
+ *     <OrgScope roles="owner" unauthorized="projects">
+ *       {children}
+ *     </OrgScope>
+ *   )
+ *
+ *   <Set wrap={OwnersOnly}>
+ *     <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+ *   </Set>
+ *
  * Routes under `OrgScope` must not carry `prerender`: `OrgScope`'s nested
  * Apollo client shadows the per-route client the prerenderer injects above
  * `App`, so a prerendered query under here would not go through it.
  */
-export const OrgScope = ({ orgSlug, children }: OrgScopeProps) => {
+export const OrgScope = ({
+  orgSlug,
+  roles,
+  unauthorized,
+  children,
+}: OrgScopeProps) => {
   return (
     <TenancyOrgScope
       useAuth={useAuth}
       orgSlug={orgSlug}
+      roles={roles}
+      unauthorized={unauthorized}
       notAMember={
         <div>
           <p>You don&apos;t have access to this organization.</p>

package/dist/commands/setup/tenancy/templates/organizations.sdl.ts.template

@@ -43,16 +43,16 @@ export const schema = gql`
 
   type Query {
     "Every membership belonging to the signed-in user, across all organizations they belong to."
-    myMemberships: [Membership!]! @requireAuth
+    myMemberships: [Membership!]! @requireUserAuth
 
     "The current organization, resolved by resolveCurrentOrg for this request."
-    organization(id: String!): Organization @requireMembership
+    organization(id: String!): Organization @requireOrgAuth
   }
 
   type Mutation {
     "Creates a new organization with the caller as its owner."
     createOrganization(input: CreateOrganizationInput!): Organization!
-      @requireAuth
+      @requireUserAuth
 
     """
     Creates a pending membership (an invitation) in the current organization,
@@ -64,7 +64,7 @@ export const schema = gql`
     the invite shows up if the inviter is also the invitee.
     """
     inviteMember(input: InviteMemberInput!): Invitation!
-      @requireMembership(roles: ["owner", "admin"])
+      @requireOrgAuth(roles: ["owner", "admin"])
 
     """
     Attaches the pending membership matching token to the signed-in user, or
@@ -73,7 +73,8 @@ export const schema = gql`
     Web callers must call reauthenticate() from useAuth() in onCompleted so
     the new membership is reflected in currentUser.memberships.
     """
-    acceptInvitation(token: String!): Organization! @requireAuth
+    acceptInvitation(token: String!): Organization!
+      @requireUserAuth
 
     """
     Removes a membership from the current organization, for a role the
@@ -84,6 +85,6 @@ export const schema = gql`
     removing their own membership.
     """
     removeMember(membershipId: String!): Membership!
-      @requireMembership(roles: ["owner", "admin"])
+      @requireOrgAuth(roles: ["owner", "admin"])
   }
 `

package/dist/commands/setup/tenancy/templates/organizations.test.ts.template

@@ -1,5 +1,3 @@
-import { setContext } from '@cedarjs/context'
-
 import { db } from 'src/lib/db'
 
 import {
@@ -18,39 +16,37 @@ import type { StandardScenario } from './organizations.scenarios.js'
 // CedarJS Testing Docs:
 //       https://cedarjs.com/docs/testing#testing-services
 
-/**
- * `context.currentUser` is typed from this app's `getCurrentUser`, which
- * selects more fields than these tests need.
- */
-const asCurrentUser = (user: { id: string; memberships?: unknown[] }) =>
-  user as unknown as typeof context.currentUser
+/** The id of the user a scenario membership belongs to */
+const userIdOf = (membership: { userId: string | null }) => {
+  if (!membership.userId) {
+    throw new Error('Expected the scenario membership to have a user')
+  }
+
+  return membership.userId
+}
 
 /**
- * Sets `context.currentUser` and `context.currentOrg` the way the GraphQL
- * `context` function does for an authenticated, in-organization request.
+ * Signs in as `membership`'s user, in its organization, the way the GraphQL
+ * `context` function does for an in-organization request
  */
 const asMember = (
   scenario: StandardScenario,
   membership: { id: string; userId: string | null; role: string },
 ) => {
-  setContext({
-    currentUser: asCurrentUser({ id: membership.userId! }),
-    currentOrg: {
-      id: scenario.organization.acme.id,
-      slug: scenario.organization.acme.slug,
-      role: membership.role,
-      membershipId: membership.id,
-    },
-  })
+  mockCurrentUser({ id: userIdOf(membership) })
+  context.currentOrg = {
+    id: scenario.organization.acme.id,
+    slug: scenario.organization.acme.slug,
+    role: membership.role,
+    membershipId: membership.id,
+  }
 }
 
 describe('organizations service', () => {
   scenario(
     "myMemberships returns the signed-in user's memberships",
     async (scenario: StandardScenario) => {
-      setContext({
-        currentUser: asCurrentUser({ id: scenario.membership.owner.userId! }),
-      })
+      mockCurrentUser({ id: userIdOf(scenario.membership.owner) })
 
       const result = await myMemberships()
 
@@ -235,7 +231,7 @@ describe('organizations service', () => {
           },
         })
 
-        setContext({ currentUser: asCurrentUser({ id: invitee.id }) })
+        mockCurrentUser({ id: invitee.id })
 
         const result = await acceptInvitation({
           token: scenario.membership.pending.invitationToken!,
@@ -256,7 +252,7 @@ describe('organizations service', () => {
           },
         })
 
-        setContext({ currentUser: asCurrentUser({ id: invitee.id }) })
+        mockCurrentUser({ id: invitee.id })
 
         const token = scenario.membership.pending.invitationToken!
 
@@ -287,10 +283,10 @@ describe('organizations service', () => {
 
         const token = scenario.membership.pending.invitationToken!
 
-        setContext({ currentUser: asCurrentUser({ id: firstUser.id }) })
+        mockCurrentUser({ id: firstUser.id })
         await acceptInvitation({ token })
 
-        setContext({ currentUser: asCurrentUser({ id: secondUser.id }) })
+        mockCurrentUser({ id: secondUser.id })
         await expect(acceptInvitation({ token })).rejects.toThrow()
       },
     )
@@ -308,7 +304,7 @@ describe('organizations service', () => {
 
         const token = scenario.membership.pending.invitationToken!
 
-        setContext({ currentUser: asCurrentUser({ id: invitee.id }) })
+        mockCurrentUser({ id: invitee.id })
         await acceptInvitation({ token })
 
         const claimed = await db.membership.findUnique({
@@ -321,7 +317,7 @@ describe('organizations service', () => {
     )
 
     it('rejects a token that never matched a pending invitation', async () => {
-      setContext({ currentUser: asCurrentUser({ id: 'some-user-id' }) })
+      mockCurrentUser({ id: 'some-user-id' })
 
       await expect(
         acceptInvitation({ token: 'not-a-real-token' }),

package/dist/commands/setup/tenancy/templates/organizations.ts.template

@@ -62,7 +62,7 @@ const canGrantRole = (granterRole: string, targetRole: string): boolean =>
  * organizations. `Membership` is a global model, so this reads plain `db`.
  */
 export const myMemberships: QueryResolvers['myMemberships'] = () => {
-  // @requireAuth guarantees a signed-in user before this resolver runs.
+  // @requireUserAuth guarantees a signed-in user before this resolver runs.
   return db.membership.findMany({
     where: { userId: context.currentUser!.id },
     orderBy: { createdAt: 'asc' },
@@ -72,8 +72,8 @@ export const myMemberships: QueryResolvers['myMemberships'] = () => {
 /**
  * The current organization (the one `resolveCurrentOrg` resolved for this
  * request). `id` is required so callers state which organization they mean,
- * but it must match the current organization: `@requireMembership` only
- * checks that the caller belongs to *some* organization, not to `id`.
+ * but it must match the current organization: `@requireOrgAuth` checks the
+ * caller's membership in the current organization, not in `id`.
  */
 export const organization: QueryResolvers['organization'] = async ({ id }) => {
   const currentOrg = requireCurrentOrg()
@@ -89,7 +89,7 @@ export const organization: QueryResolvers['organization'] = async ({ id }) => {
 export const createOrganization: MutationResolvers['createOrganization'] =
   async ({ input }) => {
     const baseSlug = slugify(input.name)
-    // @requireAuth guarantees a signed-in user before this resolver runs.
+    // @requireUserAuth guarantees a signed-in user before this resolver runs.
     const userId = context.currentUser!.id
 
     let slug = baseSlug
@@ -135,7 +135,7 @@ export const createOrganization: MutationResolvers['createOrganization'] =
  * Creates a pending membership (an invitation) in the current organization,
  * for a role the caller's own role may grant per `ROLE_GRANTS` -- an
  * `admin` can invite an `admin` or a `member`, but not an `owner`, even
- * though `@requireMembership(roles: ["owner", "admin"])` lets an admin call
+ * though `@requireOrgAuth(roles: ["owner", "admin"])` lets an admin call
  * this mutation at all. A role that isn't in `ROLE_GRANTS` is rejected
  * outright, so a typo in `input.role` can never create a membership nobody
  * can check against.
@@ -232,7 +232,7 @@ const claimInvitation = async (
 export const acceptInvitation: MutationResolvers['acceptInvitation'] = async ({
   token,
 }) => {
-  // @requireAuth guarantees a signed-in user before this resolver runs.
+  // @requireUserAuth guarantees a signed-in user before this resolver runs.
   const userId = context.currentUser!.id
 
   const claim = await claimInvitation(token, userId)

package/dist/commands/setup/tenancy/templates/requireOrgAuth.test.ts.template

@@ -0,0 +1,56 @@
+import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
+
+import requireOrgAuth from './requireOrgAuth.js'
+
+const currentOrg = (role: string) => ({
+  id: 'org-1',
+  slug: 'org-1',
+  role,
+  membershipId: 'membership-1',
+})
+
+describe('requireOrgAuth directive', () => {
+  it('declares the directive sdl as schema, with the correct name', () => {
+    expect(requireOrgAuth.schema).toBeTruthy()
+    expect(getDirectiveName(requireOrgAuth.schema)).toBe('requireOrgAuth')
+  })
+
+  it('throws when there is no current user', () => {
+    const mockExecution = mockRedwoodDirective(requireOrgAuth, { context: {} })
+
+    expect(mockExecution).toThrowError("You don't have permission to do that.")
+  })
+
+  it('throws when there is no current organization', () => {
+    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
+      context: { currentUser: { id: 'user-1' } },
+    })
+
+    expect(mockExecution).toThrowError(
+      'You must be a member of an organization to do that.',
+    )
+  })
+
+  it('does not throw for a member of the current organization', () => {
+    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
+      context: {
+        currentUser: { id: 'user-1' },
+        currentOrg: currentOrg('member'),
+      },
+    })
+
+    expect(mockExecution).not.toThrowError()
+  })
+
+  it("throws when the role in the current organization isn't listed", () => {
+    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
+      context: {
+        currentUser: { id: 'user-1' },
+        currentOrg: currentOrg('member'),
+      },
+      directiveArgs: { roles: ['owner'] },
+    })
+
+    expect(mockExecution).toThrowError("You don't have access to do that.")
+  })
+})

package/dist/commands/setup/tenancy/templates/requireOrgAuth.ts.template

@@ -0,0 +1,25 @@
+import { gql } from 'graphql-tag'
+
+import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
+import { createValidatorDirective } from '@cedarjs/graphql-server'
+
+import { requireOrgAuth as applicationRequireOrgAuth } from 'src/lib/auth'
+
+export const schema = gql`
+  """
+  Use to check that the signed-in user is a member of the current
+  organization, with one of an optional set of roles there.
+  """
+  directive @requireOrgAuth(roles: [String]) on FIELD_DEFINITION
+`
+
+type RequireOrgAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
+
+const validate: RequireOrgAuthValidate = ({ directiveArgs }) => {
+  const { roles } = directiveArgs
+  applicationRequireOrgAuth({ roles })
+}
+
+const requireOrgAuth = createValidatorDirective(schema, validate)
+
+export default requireOrgAuth

package/dist/commands/setup/tenancy/templates/requireUserAuth.test.ts.template

@@ -0,0 +1,26 @@
+import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
+
+import requireUserAuth from './requireUserAuth.js'
+
+describe('requireUserAuth directive', () => {
+  it('declares the directive sdl as schema, with the correct name', () => {
+    expect(requireUserAuth.schema).toBeTruthy()
+    expect(getDirectiveName(requireUserAuth.schema)).toBe('requireUserAuth')
+  })
+
+  it('throws when there is no current user', () => {
+    const mockExecution = mockRedwoodDirective(requireUserAuth, {
+      context: {},
+    })
+
+    expect(mockExecution).toThrowError("You don't have permission to do that.")
+  })
+
+  it('does not throw for a signed-in user, with no organization', () => {
+    const mockExecution = mockRedwoodDirective(requireUserAuth, {
+      context: { currentUser: { id: 'user-1' } },
+    })
+
+    expect(mockExecution).not.toThrowError()
+  })
+})

package/dist/commands/setup/tenancy/templates/requireUserAuth.ts.template

@@ -0,0 +1,26 @@
+import { gql } from 'graphql-tag'
+
+import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
+import { createValidatorDirective } from '@cedarjs/graphql-server'
+
+import { requireUserAuth as applicationRequireUserAuth } from 'src/lib/auth'
+
+export const schema = gql`
+  """
+  Use to check whether or not a user is authenticated and is associated
+  with an optional set of roles, in any organization or none. For fields
+  about the user rather than an organization.
+  """
+  directive @requireUserAuth(roles: [String]) on FIELD_DEFINITION
+`
+
+type RequireUserAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
+
+const validate: RequireUserAuthValidate = ({ directiveArgs }) => {
+  const { roles } = directiveArgs
+  applicationRequireUserAuth({ roles })
+}
+
+const requireUserAuth = createValidatorDirective(schema, validate)
+
+export default requireUserAuth

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -20,6 +20,12 @@ import { errorTelemetry } from "@cedarjs/telemetry";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
 import { runTransform } from "../../../lib/runTransform.js";
+import { TENANCY_AUTH_EXPORT } from "./authCodemod.js";
+import {
+  isDefaultRequireAuthDirective,
+  renameRequireAuthDirective,
+  renameLibAuthImports
+} from "./authDirectives.js";
 import {
   authNotSetUpMessage,
   hasWebAuthFile,
@@ -33,8 +39,11 @@ import {
   ORGANIZATION_MODEL,
   requiredUserFields
 } from "./schemaPrisma.js";
+import { renameUseAuthHasRole } from "./webHasRole.js";
 const DEFAULT_TENANT_FIELD = "organizationId";
 const AUTH_SNIPPET = `
+  import { createTenancyAuth } from '@cedarjs/tenancy'
+
   export const getCurrentUser = async (session) => {
     return await db.user.findUnique({
       where: { id: session.id },
@@ -52,8 +61,8 @@ const AUTH_SNIPPET = `
     })
   }
 
-  export { hasOrgRole, requireMembership } from '@cedarjs/tenancy'
-`;
+  // In place of your hasRole and requireAuth
+  ${TENANCY_AUTH_EXPORT}`;
 const SIGNUP_SNIPPET = `
   handler: async ({ username, hashedPassword, salt, userAttributes }) => {
     const user = await db.user.create({
@@ -202,7 +211,7 @@ Re-run with --force to have this command append its own versions beside them ins
         }
       },
       {
-        title: "Adding memberships to getCurrentUser and re-exporting tenancy helpers...",
+        title: "Adding memberships to getCurrentUser and the tenancy auth checks to api/src/lib/auth...",
         task: async (_ctx, task) => {
           if (!fs.existsSync(authPath)) {
             task.skip("No api/src/lib/auth file found; skipping.");
@@ -212,7 +221,10 @@ Re-run with --force to have this command append its own versions beside them ins
             transformPath: path.join(import.meta.dirname, "authCodemod.js"),
             targetPaths: [authPath]
           });
-          if (transformResult.error) {
+          if (transformResult.error?.includes("AUTH_CHECKS_CHANGED")) {
+            task.output = `api/src/lib/auth's requireAuth or hasRole has checks of its own, so it was left as it is. Please add this by hand, keeping your checks:
+${AUTH_SNIPPET}`;
+          } else if (transformResult.error) {
             task.output = `Could not update api/src/lib/auth automatically. Please add this by hand:
 ${AUTH_SNIPPET}`;
           }
@@ -253,20 +265,54 @@ ${SIGNUP_SNIPPET}`;
         skip: () => isDbAuthProject ? false : "Not a dbAuth project; skipping."
       },
       {
-        title: "Adding the requireMembership directive...",
-        task: async () => {
-          const directiveDir = path.join(
-            paths.api.directives,
-            "requireMembership"
-          );
-          await writeTemplateFile(
-            "requireMembership.ts.template",
-            path.join(directiveDir, `requireMembership.${ext}`)
+        title: "Switching @requireAuth to @requireOrgAuth and @requireUserAuth, and hasRole to hasUserRole...",
+        task: async (ctx) => {
+          const oldDirectiveDir = path.join(paths.api.directives, "requireAuth");
+          const isInOldDirective = (file) => file.startsWith(oldDirectiveDir + path.sep);
+          const oldDirectivePath = path.join(
+            oldDirectiveDir,
+            `requireAuth.${ext}`
           );
-          await writeTemplateFile(
-            "requireMembership.test.ts.template",
-            path.join(directiveDir, `requireMembership.test.${ext}`)
+          const keepOldDirective = fs.existsSync(oldDirectivePath) && !isDefaultRequireAuthDirective(
+            fs.readFileSync(oldDirectivePath, "utf-8")
           );
+          const sourceFilesIn = (dir) => fs.readdirSync(dir, { recursive: true, withFileTypes: true }).filter(
+            (entry) => entry.isFile() && /\.[jt]sx?$/.test(entry.name)
+          ).map((entry) => path.join(entry.parentPath, entry.name));
+          for (const file of sourceFilesIn(paths.api.src)) {
+            const source = fs.readFileSync(file, "utf-8");
+            const renamed = renameLibAuthImports(
+              keepOldDirective || isInOldDirective(file) ? source : renameRequireAuthDirective(source)
+            );
+            if (renamed !== source) {
+              fs.writeFileSync(file, renamed);
+              writtenFiles.push(file);
+            }
+          }
+          for (const file of sourceFilesIn(paths.web.src)) {
+            const source = fs.readFileSync(file, "utf-8");
+            const renamed = renameUseAuthHasRole(source);
+            if (renamed !== source) {
+              fs.writeFileSync(file, renamed);
+              writtenFiles.push(file);
+            }
+          }
+          if (keepOldDirective) {
+            ctx.keptRequireAuthDirective = true;
+          } else if (fs.existsSync(oldDirectivePath)) {
+            fs.rmSync(oldDirectiveDir, { recursive: true, force: true });
+          }
+          for (const name of ["requireOrgAuth", "requireUserAuth"]) {
+            const directiveDir = path.join(paths.api.directives, name);
+            await writeTemplateFile(
+              `${name}.ts.template`,
+              path.join(directiveDir, `${name}.${ext}`)
+            );
+            await writeTemplateFile(
+              `${name}.test.ts.template`,
+              path.join(directiveDir, `${name}.test.${ext}`)
+            );
+          }
         }
       },
       {
@@ -424,7 +470,8 @@ ${SIGNUP_SNIPPET}`;
              User/Organization/Membership. For each existing model (e.g.
              Contact) whose rows belong to one organization, add
              ${c.highlight("organizationId String")} plus ${c.highlight("@@index([organizationId])")} to it in
-             schema.prisma; for each one that stays global, add it
+             schema.prisma, and switch its fields from ${c.highlight("@requireUserAuth")}
+             to ${c.highlight("@requireOrgAuth")}. For each one that stays global, add it
              to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
           3. Wrap your organization routes with the generated OrgScope in
              web/src/Routes.tsx:
@@ -441,6 +488,20 @@ ${SIGNUP_SNIPPET}`;
              tenant-owned models with ${c.highlight("withTenancy")} from ${c.highlight(
             "@cedarjs/tenancy"
           )}.
+          5. ${c.highlight("@requireAuth")} is gone. Your fields use ${c.highlight("@requireUserAuth")} now,
+             which checks what ${c.highlight("@requireAuth")} did: there were no organizations
+             before. ${c.highlight("@requireOrgAuth")} needs a current organization, and checks
+             the user's role in it.${ctx.keptRequireAuthDirective ? `
+             api/src/directives/requireAuth was changed from Cedar's, so
+             it and your @requireAuth fields were left as they are: move
+             its checks to requireUserAuth or requireOrgAuth, switch the
+             fields over, then delete it.` : ""}
+          6. Every role check names its kind now. ${c.highlight("hasRole")} is
+             ${c.highlight("hasUserRole")} on both sides (your existing uses were renamed),
+             checking ${c.highlight("currentUser.roles")}; ${c.highlight("hasOrgRole")} checks the role in
+             the organization. ${c.highlight("<PrivateSet roles>")} isn't available with
+             tenancy: guard routes by role with ${c.highlight("OrgScope")}'s ${c.highlight("roles")} and
+             ${c.highlight("unauthorized")}, from a small wrapper component.
 
 ${keptFiles.length > 0 ? `
           Kept these existing files rather than overwriting them (run with

package/dist/commands/setup/tenancy/webHasRole.js

@@ -0,0 +1,45 @@
+const HAS_ROLE = /(?<![\w$])hasRole(?![\w$])/;
+const USE_AUTH_DESTRUCTURING = /\{([^{}]*)\}(\s*=\s*useAuth\(\))/g;
+const USE_AUTH_VARIABLE = /(?:const|let|var)\s+([\w$]+)\s*=\s*useAuth\(\)/g;
+const HAS_ROLE_ON_VARIABLE = /(?<![\w$.])([\w$]+)(\s*\??\.\s*)hasRole(?![\w$])/g;
+function renameUseAuthHasRole(source) {
+  if (!source.includes("useAuth()") || !HAS_ROLE.test(source)) {
+    return source;
+  }
+  let renameUses = false;
+  let result = source.replace(
+    /(useAuth\(\)\s*\??\.\s*)hasRole(?![\w$])/g,
+    "$1hasUserRole"
+  );
+  result = result.replace(
+    USE_AUTH_DESTRUCTURING,
+    (_statement, specifiers, rest) => {
+      const renamed = specifiers.replace(
+        /(?<![\w$])hasRole(?![\w$])(\s*:)?/g,
+        (_specifier, alias) => {
+          if (!alias) {
+            renameUses = true;
+          }
+          return `hasUserRole${alias ?? ""}`;
+        }
+      );
+      return `{${renamed}}${rest}`;
+    }
+  );
+  if (renameUses) {
+    result = result.replace(/(?<![\w$.])hasRole(?![\w$])/g, "hasUserRole");
+  }
+  const authVariables = new Set(
+    Array.from(source.matchAll(USE_AUTH_VARIABLE), ([, name]) => name)
+  );
+  if (authVariables.size === 0) {
+    return result;
+  }
+  return result.replace(
+    HAS_ROLE_ON_VARIABLE,
+    (match, name, access) => authVariables.has(name) ? `${name}${access}hasUserRole` : match
+  );
+}
+export {
+  renameUseAuthHasRole
+};

package/dist/commands/setup/uploads/uploadsHandler.js

@@ -14,6 +14,7 @@ import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display"
 import { addEnvVar } from "@cedarjs/cli-helpers/project";
 import { getSchemaPath } from "@cedarjs/project-config";
 import { errorTelemetry } from "@cedarjs/telemetry";
+import { withAuthDirective } from "../../../lib/authDirective.js";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
 import { generateSecret } from "../../generate/secret/secret.js";
@@ -112,6 +113,9 @@ const handler = async ({ targets, force }) => {
     for (const [token, value] of Object.entries(replacements)) {
       templateContent = templateContent.replaceAll(token, value);
     }
+    templateContent = withAuthDirective(templateContent, {
+      belongsToOrg: false
+    });
     const content = projectIsTypescript ? templateContent : await transformTSToJS(outputPath, templateContent);
     return writeFile(outputPath, content, { overwriteExisting: force });
   };

package/dist/lib/authDirective.js

@@ -0,0 +1,37 @@
+import fs from "node:fs";
+import path from "node:path";
+import { getPaths } from "./index.js";
+function hasTenancyAuthDirectives() {
+  return fs.existsSync(path.join(getPaths().api.directives, "requireOrgAuth"));
+}
+function tenantField() {
+  for (const ext of ["ts", "js"]) {
+    const dbPath = path.join(getPaths().api.lib, `db.${ext}`);
+    if (fs.existsSync(dbPath)) {
+      const match = fs.readFileSync(dbPath, "utf-8").match(/\btenantField:\s*['"](\w+)['"]/);
+      return match?.[1] ?? "organizationId";
+    }
+  }
+  return "organizationId";
+}
+function belongsToOrganization(model) {
+  const field = tenantField();
+  return model.fields.some(
+    ({ name, type }) => name === field || type === "Organization"
+  );
+}
+function withAuthDirective(source, { belongsToOrg }) {
+  if (!hasTenancyAuthDirectives()) {
+    return source;
+  }
+  return source.replace(
+    /@requireAuth(?![\w$])/g,
+    belongsToOrg ? "@requireOrgAuth" : "@requireUserAuth"
+  );
+}
+export {
+  belongsToOrganization,
+  hasTenancyAuthDirectives,
+  tenantField,
+  withAuthDirective
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "8.0.0-canary.3538",
+  "version": "8.0.0-canary.3539",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.11",
-    "@cedarjs/api-server": "8.0.0-canary.3538",
-    "@cedarjs/babel-config": "8.0.0-canary.3538",
-    "@cedarjs/cli-helpers": "8.0.0-canary.3538",
-    "@cedarjs/internal": "8.0.0-canary.3538",
-    "@cedarjs/prerender": "8.0.0-canary.3538",
-    "@cedarjs/project-config": "8.0.0-canary.3538",
-    "@cedarjs/structure": "8.0.0-canary.3538",
-    "@cedarjs/telemetry": "8.0.0-canary.3538",
-    "@cedarjs/utils": "8.0.0-canary.3538",
-    "@cedarjs/vite": "8.0.0-canary.3538",
-    "@cedarjs/web-server": "8.0.0-canary.3538",
+    "@cedarjs/api-server": "8.0.0-canary.3539",
+    "@cedarjs/babel-config": "8.0.0-canary.3539",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3539",
+    "@cedarjs/internal": "8.0.0-canary.3539",
+    "@cedarjs/prerender": "8.0.0-canary.3539",
+    "@cedarjs/project-config": "8.0.0-canary.3539",
+    "@cedarjs/structure": "8.0.0-canary.3539",
+    "@cedarjs/telemetry": "8.0.0-canary.3539",
+    "@cedarjs/utils": "8.0.0-canary.3539",
+    "@cedarjs/vite": "8.0.0-canary.3539",
+    "@cedarjs/web-server": "8.0.0-canary.3539",
     "@listr2/prompt-adapter-enquirer": "4.4.3",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "2.12.0",
@@ -93,7 +93,7 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "8.0.0-canary.3538",
+    "@cedarjs/framework-tools": "8.0.0-canary.3539",
     "@prisma/dmmf": "7.10.1",
     "@types/archiver": "^7.0.0",
     "memfs": "4.80.0",

package/dist/commands/setup/tenancy/templates/requireMembership.test.ts.template

@@ -1,35 +0,0 @@
-import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
-
-import requireMembership from './requireMembership.js'
-
-/**
- * `context.currentUser` is typed from this app's `getCurrentUser`, which
- * selects more fields than these tests need.
- */
-const asCurrentUser = (user: { id: string; memberships?: unknown[] }) =>
-  user as unknown as NonNullable<typeof context.currentUser>
-
-describe('requireMembership directive', () => {
-  it('declares the directive sdl as schema, with the correct name', () => {
-    expect(requireMembership.schema).toBeTruthy()
-    expect(getDirectiveName(requireMembership.schema)).toBe(
-      'requireMembership',
-    )
-  })
-
-  it('throws when there is no current user', () => {
-    const mockExecution = mockRedwoodDirective(requireMembership, {
-      context: {},
-    })
-
-    expect(mockExecution).toThrowError()
-  })
-
-  it('throws when there is a current user but no current organization', () => {
-    const mockExecution = mockRedwoodDirective(requireMembership, {
-      context: { currentUser: asCurrentUser({ id: '1' }) },
-    })
-
-    expect(mockExecution).toThrowError()
-  })
-})

package/dist/commands/setup/tenancy/templates/requireMembership.ts.template

@@ -1,25 +0,0 @@
-import { gql } from 'graphql-tag'
-
-import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireMembership as applicationRequireMembership } from 'src/lib/auth'
-
-export const schema = gql`
-  """
-  Use to check whether or not the current user is a member of the current
-  organization, optionally restricted to a set of roles.
-  """
-  directive @requireMembership(roles: [String]) on FIELD_DEFINITION
-`
-
-type RequireMembershipValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
-
-const validate: RequireMembershipValidate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireMembership({ roles })
-}
-
-const requireMembership = createValidatorDirective(schema, validate)
-
-export default requireMembership