@cedarjs/cli 8.0.0-canary.3538 → 8.0.0-canary.3540

package/dist/commands/generate/realtime/realtimeHandler.js

@@ -7,6 +7,7 @@ import prompts from "prompts";
 import { colors as c } from "@cedarjs/cli-helpers/colors";
 import { generate as generateTypes } from "@cedarjs/internal/dist/generate/generate";
 import { errorTelemetry } from "@cedarjs/telemetry";
+import { withAuthDirective } from "../../../lib/authDirective.js";
 import {
   generateTemplate,
   getPaths,
@@ -119,14 +120,18 @@ async function handler({
             exampleFile,
             exampleSubscriptionTemplateContent
           );
-          const blankTemplateContent = await generateTemplate(
-            setupScriptContent,
-            templateVariables(name)
+          const blankTemplateContent = withAuthDirective(
+            await generateTemplate(setupScriptContent, templateVariables(name)),
+            // Not about a model, so the safe default
+            { belongsToOrg: true }
           );
           return [
             writeFile(
               sdlFile,
-              await generateTemplate(sdlContent, templateVariables(name)),
+              withAuthDirective(
+                await generateTemplate(sdlContent, templateVariables(name)),
+                { belongsToOrg: true }
+              ),
               {
                 overwriteExisting: force
               }
@@ -176,7 +181,10 @@ async function handler({
           return [
             writeFile(
               sdlFile,
-              await generateTemplate(sdlContent, templateVariables(name)),
+              withAuthDirective(
+                await generateTemplate(sdlContent, templateVariables(name)),
+                { belongsToOrg: true }
+              ),
               {
                 overwriteExisting: force
               }

package/dist/commands/generate/sdl/sdlHandler.js

@@ -9,6 +9,10 @@ import { generate as generateTypes } from "@cedarjs/internal/dist/generate/gener
 import { getConfig } from "@cedarjs/project-config";
 import { errorTelemetry } from "@cedarjs/telemetry";
 import { pluralize } from "@cedarjs/utils/cedarPluralize";
+import {
+  belongsToOrganization,
+  withAuthDirective
+} from "../../../lib/authDirective.js";
 import { transformTSToJS } from "../../../lib/index.js";
 import {
   prepareForRollback,
@@ -159,7 +163,8 @@ const sdlFromSchemaModel = async (name, crud, docs = false) => {
     idType: idType(model, crud),
     idName: idName(model, crud),
     relations: relationsForModel(model),
-    enums
+    enums,
+    belongsToOrg: belongsToOrganization(model)
   };
 };
 const files = async ({
@@ -180,7 +185,10 @@ const files = async ({
     templateVars: { docs, name, crud, ...sdlData },
     outputPath: `${camelcase(pluralize(name))}.sdl.${extension}`
   });
-  const template = typescript ? content : await transformTSToJS(outputPath, content);
+  const sdl = withAuthDirective(content, {
+    belongsToOrg: sdlData.belongsToOrg
+  });
+  const template = typescript ? sdl : await transformTSToJS(outputPath, sdl);
   return {
     [outputPath]: template,
     ...await serviceFiles({

package/dist/commands/setup/realtime/realtimeHandler.js

@@ -7,6 +7,7 @@ import { addApiPackages } from "@cedarjs/cli-helpers/installHelpers";
 import { runBinSync } from "@cedarjs/cli-helpers/packageManager/exec";
 import { generate as generateTypes } from "@cedarjs/internal/dist/generate/generate";
 import { errorTelemetry } from "@cedarjs/telemetry";
+import { withAuthDirective } from "../../../lib/authDirective.js";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject, serverFileExists } from "../../../lib/project.js";
 import { setupServerFileTasks } from "../server-file/serverFileHandler.js";
@@ -97,9 +98,13 @@ async function handler(args) {
             exampleSubscriptionTemplateContent
           );
           return [
-            writeFile(exampleFile, setupScriptContent, {
-              overwriteExisting: force
-            })
+            writeFile(
+              exampleFile,
+              withAuthDirective(setupScriptContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            )
           ];
         }
       },
@@ -158,15 +163,23 @@ async function handler(args) {
             exampleSubscriptionTemplateContent
           );
           return [
-            writeFile(sdlFile, sdlContent, {
-              overwriteExisting: force
-            }),
+            writeFile(
+              sdlFile,
+              withAuthDirective(sdlContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            ),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             }),
-            writeFile(exampleFile, setupScriptContent, {
-              overwriteExisting: force
-            })
+            writeFile(
+              exampleFile,
+              withAuthDirective(setupScriptContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            )
           ];
         }
       },
@@ -206,9 +219,13 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(sdlFile, sdlContent, {
-              overwriteExisting: force
-            }),
+            writeFile(
+              sdlFile,
+              withAuthDirective(sdlContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            ),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })
@@ -251,9 +268,13 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(sdlFile, sdlContent, {
-              overwriteExisting: force
-            }),
+            writeFile(
+              sdlFile,
+              withAuthDirective(sdlContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            ),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })
@@ -296,9 +317,13 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(sdlFile, sdlContent, {
-              overwriteExisting: force
-            }),
+            writeFile(
+              sdlFile,
+              withAuthDirective(sdlContent, { belongsToOrg: false }),
+              {
+                overwriteExisting: force
+              }
+            ),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })

package/dist/commands/setup/tenancy/authCodemod.js

@@ -18,9 +18,143 @@ function buildMembershipsSelectProperty() {
   }
   return property;
 }
+const TENANCY_AUTH_EXPORT = `export const { hasUserRole, hasOrgRole, requireUserAuth, requireOrgAuth } =
+  createTenancyAuth()
+`;
+const DEFAULT_REQUIRE_AUTH_STATEMENTS = [
+  /^if \(!isAuthenticated\(\)\) \{ throw new AuthenticationError\([^)]*\);? \}$/,
+  /^if \(roles && !hasRole\(roles\)\) \{ throw new ForbiddenError\([^)]*\);? \}$/,
+  /^return isAuthenticated\(\);?$/
+];
+const DEFAULT_HAS_ROLE_NAMES = /* @__PURE__ */ new Set([
+  "AllowedRoles",
+  "Array",
+  "allowedRole",
+  "allowedRoles",
+  "context",
+  "currentUser",
+  "currentUserRoles",
+  "hasRole",
+  "includes",
+  "isArray",
+  "isAuthenticated",
+  "role",
+  "roles",
+  "some",
+  "undefined"
+]);
+function exportedValue(declaration) {
+  const node = declaration.nodes()[0];
+  return j.VariableDeclaration.check(node?.declaration) ? node.declaration.declarations[0] : void 0;
+}
+function isDefaultHasRole(hasRole) {
+  return hasRole.find(j.Identifier).nodes().every((identifier) => DEFAULT_HAS_ROLE_NAMES.has(identifier.name));
+}
+function isDefaultRequireAuth(requireAuth) {
+  const declarator = exportedValue(requireAuth);
+  const fn = j.VariableDeclarator.check(declarator) ? declarator.init : null;
+  if (!j.ArrowFunctionExpression.check(fn) || !j.BlockStatement.check(fn.body)) {
+    return false;
+  }
+  return fn.body.body.every((statement) => {
+    const source = j(statement).toSource().replace(/\/\/[^\n]*|\/\*[\s\S]*?\*\//g, "").replace(/\s+/g, " ").trim();
+    return DEFAULT_REQUIRE_AUTH_STATEMENTS.some(
+      (pattern) => pattern.test(source)
+    );
+  });
+}
+function findExportedConst(root, name) {
+  return root.find(j.ExportNamedDeclaration, {
+    declaration: {
+      type: "VariableDeclaration",
+      declarations: [{ id: { type: "Identifier", name } }]
+    }
+  });
+}
+const USER_LOOKUP = {
+  callee: {
+    type: "MemberExpression",
+    object: {
+      type: "MemberExpression",
+      object: { name: "db" },
+      property: { name: "user" }
+    },
+    property: { name: "findUnique" }
+  }
+};
+function addContextImport(root) {
+  const usesContext = root.find(j.Identifier, { name: "context" }).filter(
+    (path) => !(j.MemberExpression.check(path.parent.node) && path.parent.node.property === path.node && !path.parent.node.computed) && !(j.ObjectProperty.check(path.parent.node) && path.parent.node.key === path.node)
+  ).length > 0;
+  const declaresContext = root.find(j.ImportDeclaration, {
+    source: { value: "@cedarjs/graphql-server" }
+  }).length > 0 || root.find(j.ImportSpecifier, { local: { name: "context" } }).length > 0 || root.find(j.VariableDeclarator, { id: { name: "context" } }).length > 0;
+  if (!usesContext || declaresContext) {
+    return false;
+  }
+  const contextImport = j.withParser("ts")(`import { context } from '@cedarjs/context'
+`).find(j.ImportDeclaration).nodes()[0];
+  const cedarImports = root.find(j.ImportDeclaration).filter((path) => String(path.node.source.value).startsWith("@cedarjs/"));
+  const before = cedarImports.filter(
+    (path) => String(path.node.source.value) > "@cedarjs/context"
+  );
+  if (before.length > 0) {
+    before.at(0).insertBefore(contextImport);
+  } else if (cedarImports.length > 0) {
+    cedarImports.at(cedarImports.length - 1).insertAfter(contextImport);
+  } else {
+    root.find(j.Program).forEach((path) => {
+      path.node.body.unshift(contextImport);
+    });
+  }
+  return true;
+}
+function addWithPermissions(root, lookups) {
+  const isWithPermissionsCall = (node) => j.CallExpression.check(node) && j.Identifier.check(node.callee) && node.callee.name === "withPermissions";
+  let wrapped = false;
+  root.find(j.CallExpression, USER_LOOKUP).forEach((path) => {
+    if (!lookups.has(path.node)) {
+      return;
+    }
+    const awaited = j.AwaitExpression.check(path.parent.node) ? path.parent : null;
+    const thenCall = path.parent.parent?.node;
+    const isThenWithPermissions = j.MemberExpression.check(path.parent.node) && j.Identifier.check(path.parent.node.property) && path.parent.node.property.name === "then" && j.CallExpression.check(thenCall) && j.Identifier.check(thenCall.arguments[0]) && thenCall.arguments[0].name === "withPermissions";
+    if (isWithPermissionsCall((awaited ?? path).parent.node) || isThenWithPermissions) {
+      return;
+    }
+    wrapped = true;
+    if (awaited) {
+      awaited.replace(
+        j.callExpression(j.identifier("withPermissions"), [awaited.node])
+      );
+    } else {
+      path.replace(
+        j.callExpression(j.memberExpression(path.node, j.identifier("then")), [
+          j.identifier("withPermissions")
+        ])
+      );
+    }
+  });
+  return wrapped;
+}
+function addPermissionsImport(source) {
+  if (/import \{[^}]*\bwithPermissions\b[^}]*\} from/.test(source)) {
+    return source;
+  }
+  const eol = source.includes("\r\n") ? "\r\n" : "\n";
+  const dbImport = /^import \{ db \} from (['"])(.*?)db(\.js)?\1;?\r?\n/m;
+  if (dbImport.test(source)) {
+    return source.replace(
+      dbImport,
+      (line, quote, dir, ext = "") => `${line}import { withPermissions } from ${quote}${dir}permissions${ext}${quote}${eol}`
+    );
+  }
+  return `import { withPermissions } from 'src/lib/permissions'${eol}${source}`;
+}
 function transform(fileInfo) {
   const root = j.withParser("tsx")(fileInfo.source);
   let selectFound = false;
+  const membershipLookups = /* @__PURE__ */ new Set();
   let changed = false;
   root.find(j.CallExpression, {
     callee: {
@@ -51,33 +185,64 @@ function transform(fileInfo) {
       changed = true;
     }
     selectFound = true;
+    membershipLookups.add(path.node);
   });
   if (!selectFound) {
     throw new Error("CEDAR_CODEMOD_ERR_AUTH_SHAPE_NOT_FOUND");
   }
-  const exported = /* @__PURE__ */ new Set();
-  root.find(j.ExportNamedDeclaration, { source: { value: "@cedarjs/tenancy" } }).forEach((path) => {
-    for (const specifier of path.node.specifiers ?? []) {
-      if (j.Identifier.check(specifier.exported)) {
-        exported.add(specifier.exported.name);
-      }
+  if (addWithPermissions(root, membershipLookups)) {
+    changed = true;
+  }
+  const alreadyWired = root.find(j.ImportSpecifier, { imported: { name: "createTenancyAuth" } }).length > 0;
+  if (alreadyWired) {
+    if (addContextImport(root)) {
+      changed = true;
     }
+    return addPermissionsImport(changed ? root.toSource() : fileInfo.source);
+  }
+  const hasRole = findExportedConst(root, "hasRole");
+  const requireAuth = findExportedConst(root, "requireAuth");
+  if (hasRole.length !== 1 || requireAuth.length !== 1) {
+    throw new Error("CEDAR_CODEMOD_ERR_AUTH_CHECKS_NOT_FOUND");
+  }
+  if (!isDefaultRequireAuth(requireAuth) || !isDefaultHasRole(hasRole)) {
+    throw new Error("CEDAR_CODEMOD_ERR_AUTH_CHECKS_CHANGED");
+  }
+  const tenancyAuth = j.withParser("ts")(TENANCY_AUTH_EXPORT).find(j.ExportNamedDeclaration).nodes()[0];
+  requireAuth.replaceWith(tenancyAuth);
+  hasRole.remove();
+  root.find(j.Identifier, { name: "hasRole" }).filter(
+    (path) => !(j.MemberExpression.check(path.parent.node) && path.parent.node.property === path.node)
+  ).forEach((path) => {
+    path.node.name = "hasUserRole";
   });
-  const missing = ["hasOrgRole", "requireMembership"].filter(
-    (name) => !exported.has(name)
+  const isUnused = (name) => root.find(j.Identifier, { name }).filter(
+    (path) => !j.ImportSpecifier.check(path.parent.node) && !j.TSTypeAliasDeclaration.check(path.parent.node)
+  ).length === 0;
+  root.find(j.TSTypeAliasDeclaration, { id: { name: "AllowedRoles" } }).filter(() => isUnused("AllowedRoles")).remove();
+  root.find(j.ImportDeclaration, { source: { value: "@cedarjs/graphql-server" } }).forEach((path) => {
+    path.node.specifiers = (path.node.specifiers ?? []).filter(
+      (specifier) => !j.ImportSpecifier.check(specifier) || !j.Identifier.check(specifier.local) || !isUnused(specifier.local.name)
+    );
+  }).filter((path) => (path.node.specifiers ?? []).length === 0).remove();
+  const tenancyImport = j.withParser("ts")(`import { createTenancyAuth } from '@cedarjs/tenancy'
+`).find(j.ImportDeclaration).nodes()[0];
+  const imports = root.find(j.ImportDeclaration);
+  const cedarImports = imports.filter(
+    (path) => String(path.node.source.value).startsWith("@cedarjs/")
   );
-  if (missing.length > 0) {
-    const tenancyExport = j.withParser("ts")(
-      `export { ${missing.join(", ")} } from '@cedarjs/tenancy'
-`
-    ).find(j.ExportNamedDeclaration).nodes()[0];
+  const anchor = cedarImports.length > 0 ? cedarImports : imports;
+  if (anchor.length > 0) {
+    anchor.at(anchor.length - 1).insertAfter(tenancyImport);
+  } else {
     root.find(j.Program).forEach((path) => {
-      path.node.body.push(tenancyExport);
+      path.node.body.unshift(tenancyImport);
     });
-    changed = true;
   }
-  return changed ? root.toSource() : fileInfo.source;
+  addContextImport(root);
+  return addPermissionsImport(root.toSource());
 }
 export {
+  TENANCY_AUTH_EXPORT,
   transform as default
 };

package/dist/commands/setup/tenancy/authDirectives.js

@@ -0,0 +1,101 @@
+function renameRequireAuthDirective(source) {
+  return source.replace(/@requireAuth(?![\w$])/g, "@requireUserAuth");
+}
+const LIB_AUTH_IMPORT = /import\s*\{([^}]*)\}\s*from\s*(['"])((?:src|\.{1,2})(?:\/[^'"]*)?\/lib\/auth(?:\.[jt]s)?)\2/g;
+const LIB_AUTH_RENAMES = {
+  requireAuth: "requireUserAuth",
+  hasRole: "hasUserRole"
+};
+function renameLibAuthImports(source) {
+  let result = source;
+  for (const [from, to] of Object.entries(LIB_AUTH_RENAMES)) {
+    let renameUses = false;
+    result = result.replace(
+      LIB_AUTH_IMPORT,
+      (statement, specifiers) => {
+        const renamed = specifiers.replace(
+          new RegExp(`(?<![\\w$])${from}(?![\\w$])(\\s+as\\s+[\\w$]+)?`, "g"),
+          (_specifier, alias) => {
+            if (!alias) {
+              renameUses = true;
+            }
+            return `${to}${alias ?? ""}`;
+          }
+        );
+        return statement.replace(specifiers, renamed);
+      }
+    );
+    if (renameUses) {
+      result = result.replace(
+        new RegExp(`(?<![\\w$@.])${from}(?![\\w$])`, "g"),
+        to
+      );
+    }
+  }
+  return result;
+}
+const DEFAULT_REQUIRE_AUTH_DIRECTIVES = [
+  `import { gql } from 'graphql-tag'
+
+import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
+import { createValidatorDirective } from '@cedarjs/graphql-server'
+
+import { requireAuth as applicationRequireAuth } from 'src/lib/auth'
+
+export const schema = gql\`
+  """
+  Use to check whether or not a user is authenticated and is associated
+  with an optional set of roles.
+  """
+  directive @requireAuth(roles: [String]) on FIELD_DEFINITION
+\`
+
+type RequireAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
+
+const validate: RequireAuthValidate = ({ directiveArgs }) => {
+  const { roles } = directiveArgs
+  applicationRequireAuth({ roles })
+}
+
+const requireAuth = createValidatorDirective(schema, validate)
+
+export default requireAuth
+`,
+  `import { gql } from 'graphql-tag'
+
+import { createValidatorDirective } from '@cedarjs/graphql-server'
+
+import { requireAuth as applicationRequireAuth } from 'src/lib/auth'
+
+export const schema = gql\`
+  """
+  Use to check whether or not a user is authenticated and is associated
+  with an optional set of roles.
+  """
+  directive @requireAuth(roles: [String]) on FIELD_DEFINITION
+\`
+
+const validate = ({ directiveArgs }) => {
+  const { roles } = directiveArgs
+  applicationRequireAuth({ roles })
+}
+
+const requireAuth = createValidatorDirective(schema, validate)
+
+export default requireAuth
+`
+];
+function withoutFormatting(source) {
+  return source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, "").replace(/["']/g, "'").replace(/[;\s]/g, "").replace(/,([)\]}>])/g, "$1");
+}
+function isDefaultRequireAuthDirective(source) {
+  return DEFAULT_REQUIRE_AUTH_DIRECTIVES.some(
+    (directive) => withoutFormatting(directive) === withoutFormatting(source)
+  );
+}
+export {
+  DEFAULT_REQUIRE_AUTH_DIRECTIVES,
+  isDefaultRequireAuthDirective,
+  renameLibAuthImports,
+  renameRequireAuthDirective
+};