@cedarjs/cli 8.0.0-canary.3538 → 8.0.0-canary.3540

package/dist/commands/setup/tenancy/templates/requirePermission.test.ts.template

@@ -0,0 +1,50 @@
+import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
+
+import requirePermission from './requirePermission.js'
+
+const currentOrg = (role: string) => ({
+  id: 'org-1',
+  slug: 'org-1',
+  role,
+  membershipId: 'membership-1',
+})
+
+describe('requirePermission directive', () => {
+  it('declares the directive sdl as schema, with the correct name', () => {
+    expect(requirePermission.schema).toBeTruthy()
+    expect(getDirectiveName(requirePermission.schema)).toBe('requirePermission')
+  })
+
+  it('throws when there is no current user', () => {
+    const mockExecution = mockRedwoodDirective(requirePermission, {
+      context: {},
+      directiveArgs: { permission: 'organization.read' },
+    })
+
+    expect(mockExecution).toThrowError()
+  })
+
+  it("throws when the role in the current organization doesn't have it", () => {
+    const mockExecution = mockRedwoodDirective(requirePermission, {
+      context: {
+        currentUser: { id: 'user-1' },
+        currentOrg: currentOrg('member'),
+      },
+      directiveArgs: { permission: 'members.manage' },
+    })
+
+    expect(mockExecution).toThrowError()
+  })
+
+  it('passes when the role in the current organization has it', () => {
+    const mockExecution = mockRedwoodDirective(requirePermission, {
+      context: {
+        currentUser: { id: 'user-1' },
+        currentOrg: currentOrg('owner'),
+      },
+      directiveArgs: { permission: 'members.manage' },
+    })
+
+    expect(mockExecution).not.toThrowError()
+  })
+})

package/dist/commands/setup/tenancy/templates/requirePermission.ts.template

@@ -0,0 +1,32 @@
+import type { Permission } from '__PERMISSIONS_PACKAGE__'
+import { gql } from 'graphql-tag'
+
+import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
+import { createValidatorDirective } from '@cedarjs/graphql-server'
+
+import { requirePermission as applicationRequirePermission } from 'src/lib/permissions'
+
+export const schema = gql`
+  """
+  Use to check that the signed-in user may do something: that their role in
+  the current organization has the permission (see packages/permissions).
+  """
+  directive @requirePermission(permission: String!) on FIELD_DEFINITION
+`
+
+// Optional to fit `ValidatorDirectiveFunc`; the SDL makes it required
+type RequirePermissionValidate = ValidatorDirectiveFunc<{
+  permission?: string
+}>
+
+const validate: RequirePermissionValidate = ({ directiveArgs }) => {
+  // A name the permissions map doesn't know throws, so a typo in the SDL is
+  // an error rather than a field nobody can use
+  applicationRequirePermission({
+    permission: directiveArgs.permission as Permission,
+  })
+}
+
+const requirePermission = createValidatorDirective(schema, validate)
+
+export default requirePermission

package/dist/commands/setup/tenancy/templates/requireUserAuth.test.ts.template

@@ -0,0 +1,26 @@
+import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
+
+import requireUserAuth from './requireUserAuth.js'
+
+describe('requireUserAuth directive', () => {
+  it('declares the directive sdl as schema, with the correct name', () => {
+    expect(requireUserAuth.schema).toBeTruthy()
+    expect(getDirectiveName(requireUserAuth.schema)).toBe('requireUserAuth')
+  })
+
+  it('throws when there is no current user', () => {
+    const mockExecution = mockRedwoodDirective(requireUserAuth, {
+      context: {},
+    })
+
+    expect(mockExecution).toThrowError("You don't have permission to do that.")
+  })
+
+  it('does not throw for a signed-in user, with no organization', () => {
+    const mockExecution = mockRedwoodDirective(requireUserAuth, {
+      context: { currentUser: { id: 'user-1' } },
+    })
+
+    expect(mockExecution).not.toThrowError()
+  })
+})

package/dist/commands/setup/tenancy/templates/requireUserAuth.ts.template

@@ -0,0 +1,26 @@
+import { gql } from 'graphql-tag'
+
+import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
+import { createValidatorDirective } from '@cedarjs/graphql-server'
+
+import { requireUserAuth as applicationRequireUserAuth } from 'src/lib/auth'
+
+export const schema = gql`
+  """
+  Use to check whether or not a user is authenticated and is associated
+  with an optional set of roles, in any organization or none. For fields
+  about the user rather than an organization.
+  """
+  directive @requireUserAuth(roles: [String]) on FIELD_DEFINITION
+`
+
+type RequireUserAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
+
+const validate: RequireUserAuthValidate = ({ directiveArgs }) => {
+  const { roles } = directiveArgs
+  applicationRequireUserAuth({ roles })
+}
+
+const requireUserAuth = createValidatorDirective(schema, validate)
+
+export default requireUserAuth

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -20,6 +20,16 @@ import { errorTelemetry } from "@cedarjs/telemetry";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
 import { runTransform } from "../../../lib/runTransform.js";
+import { TENANCY_AUTH_EXPORT } from "./authCodemod.js";
+import {
+  isDefaultRequireAuthDirective,
+  renameRequireAuthDirective,
+  renameLibAuthImports
+} from "./authDirectives.js";
+import {
+  addPermissionsPackageTasks,
+  permissionsPackageName
+} from "./permissionsPackage.js";
 import {
   authNotSetUpMessage,
   hasWebAuthFile,
@@ -33,10 +43,15 @@ import {
   ORGANIZATION_MODEL,
   requiredUserFields
 } from "./schemaPrisma.js";
+import { renameUseAuthHasRole } from "./webHasRole.js";
 const DEFAULT_TENANT_FIELD = "organizationId";
 const AUTH_SNIPPET = `
+  import { createTenancyAuth } from '@cedarjs/tenancy'
+
+  import { withPermissions } from 'src/lib/permissions'
+
   export const getCurrentUser = async (session) => {
-    return await db.user.findUnique({
+    return withPermissions(await db.user.findUnique({
       where: { id: session.id },
       select: {
         // ...your existing fields...
@@ -49,11 +64,11 @@ const AUTH_SNIPPET = `
           },
         },
       },
-    })
+    }))
   }
 
-  export { hasOrgRole, requireMembership } from '@cedarjs/tenancy'
-`;
+  // In place of your hasRole and requireAuth
+  ${TENANCY_AUTH_EXPORT}`;
 const SIGNUP_SNIPPET = `
   handler: async ({ username, hashedPassword, salt, userAttributes }) => {
     const user = await db.user.create({
@@ -202,7 +217,7 @@ Re-run with --force to have this command append its own versions beside them ins
         }
       },
       {
-        title: "Adding memberships to getCurrentUser and re-exporting tenancy helpers...",
+        title: "Adding memberships to getCurrentUser and the tenancy auth checks to api/src/lib/auth...",
         task: async (_ctx, task) => {
           if (!fs.existsSync(authPath)) {
             task.skip("No api/src/lib/auth file found; skipping.");
@@ -212,7 +227,10 @@ Re-run with --force to have this command append its own versions beside them ins
             transformPath: path.join(import.meta.dirname, "authCodemod.js"),
             targetPaths: [authPath]
           });
-          if (transformResult.error) {
+          if (transformResult.error?.includes("AUTH_CHECKS_CHANGED")) {
+            task.output = `api/src/lib/auth's requireAuth or hasRole has checks of its own, so it was left as it is. Please add this by hand, keeping your checks:
+${AUTH_SNIPPET}`;
+          } else if (transformResult.error) {
             task.output = `Could not update api/src/lib/auth automatically. Please add this by hand:
 ${AUTH_SNIPPET}`;
           }
@@ -253,19 +271,94 @@ ${SIGNUP_SNIPPET}`;
         skip: () => isDbAuthProject ? false : "Not a dbAuth project; skipping."
       },
       {
-        title: "Adding the requireMembership directive...",
+        title: "Switching @requireAuth to @requireOrgAuth and @requireUserAuth, and hasRole to hasUserRole...",
+        task: async (ctx) => {
+          const oldDirectiveDir = path.join(paths.api.directives, "requireAuth");
+          const isInOldDirective = (file) => file.startsWith(oldDirectiveDir + path.sep);
+          const oldDirectivePath = path.join(
+            oldDirectiveDir,
+            `requireAuth.${ext}`
+          );
+          const keepOldDirective = fs.existsSync(oldDirectivePath) && !isDefaultRequireAuthDirective(
+            fs.readFileSync(oldDirectivePath, "utf-8")
+          );
+          const sourceFilesIn = (dir) => fs.readdirSync(dir, { recursive: true, withFileTypes: true }).filter(
+            (entry) => entry.isFile() && /\.[jt]sx?$/.test(entry.name)
+          ).map((entry) => path.join(entry.parentPath, entry.name));
+          for (const file of sourceFilesIn(paths.api.src)) {
+            const source = fs.readFileSync(file, "utf-8");
+            const renamed = renameLibAuthImports(
+              keepOldDirective || isInOldDirective(file) ? source : renameRequireAuthDirective(source)
+            );
+            if (renamed !== source) {
+              fs.writeFileSync(file, renamed);
+              writtenFiles.push(file);
+            }
+          }
+          for (const file of sourceFilesIn(paths.web.src)) {
+            const source = fs.readFileSync(file, "utf-8");
+            const renamed = renameUseAuthHasRole(source);
+            if (renamed !== source) {
+              fs.writeFileSync(file, renamed);
+              writtenFiles.push(file);
+            }
+          }
+          if (keepOldDirective) {
+            ctx.keptRequireAuthDirective = true;
+          } else if (fs.existsSync(oldDirectivePath)) {
+            fs.rmSync(oldDirectiveDir, { recursive: true, force: true });
+          }
+          for (const name of ["requireOrgAuth", "requireUserAuth"]) {
+            const directiveDir = path.join(paths.api.directives, name);
+            await writeTemplateFile(
+              `${name}.ts.template`,
+              path.join(directiveDir, `${name}.${ext}`)
+            );
+            await writeTemplateFile(
+              `${name}.test.ts.template`,
+              path.join(directiveDir, `${name}.test.${ext}`)
+            );
+          }
+        }
+      },
+      {
+        title: "Adding the permissions package...",
+        task: () => addPermissionsPackageTasks({
+          cedarVersion,
+          indexSource: fs.readFileSync(
+            path.resolve(
+              import.meta.dirname,
+              "templates",
+              "permissionsPackage.index.ts.template"
+            ),
+            "utf-8"
+          ),
+          force
+        })
+      },
+      {
+        title: "Adding permission checks and the requirePermission directive...",
         task: async () => {
+          const replacements = {
+            __PERMISSIONS_PACKAGE__: permissionsPackageName()
+          };
+          await writeTemplateFile(
+            "permissions.ts.template",
+            path.join(paths.api.lib, `permissions.${ext}`),
+            replacements
+          );
           const directiveDir = path.join(
             paths.api.directives,
-            "requireMembership"
+            "requirePermission"
           );
           await writeTemplateFile(
-            "requireMembership.ts.template",
-            path.join(directiveDir, `requireMembership.${ext}`)
+            "requirePermission.ts.template",
+            path.join(directiveDir, `requirePermission.${ext}`),
+            replacements
           );
           await writeTemplateFile(
-            "requireMembership.test.ts.template",
-            path.join(directiveDir, `requireMembership.test.${ext}`)
+            "requirePermission.test.ts.template",
+            path.join(directiveDir, `requirePermission.test.${ext}`)
           );
         }
       },
@@ -424,7 +517,8 @@ ${SIGNUP_SNIPPET}`;
              User/Organization/Membership. For each existing model (e.g.
              Contact) whose rows belong to one organization, add
              ${c.highlight("organizationId String")} plus ${c.highlight("@@index([organizationId])")} to it in
-             schema.prisma; for each one that stays global, add it
+             schema.prisma, and switch its fields from ${c.highlight("@requireUserAuth")}
+             to ${c.highlight("@requireOrgAuth")}. For each one that stays global, add it
              to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
           3. Wrap your organization routes with the generated OrgScope in
              web/src/Routes.tsx:
@@ -441,6 +535,26 @@ ${SIGNUP_SNIPPET}`;
              tenant-owned models with ${c.highlight("withTenancy")} from ${c.highlight(
             "@cedarjs/tenancy"
           )}.
+          5. Your permissions, and what each role may do, are in
+             ${c.highlight("packages/permissions")}, shared by the api and web sides${ctx.packagesWorkspaceTurnedOn ? ` (this
+             turned on ${c.highlight("experimental.packagesWorkspace")} in cedar.toml)` : ""}. Guard
+             organization fields with ${c.highlight('@requirePermission(permission: "...")')}
+             (or ${c.highlight("@requireOrgAuth(roles: [...])")}), and check permissions on the
+             web with ${c.highlight("useAuth().hasPermission()")}.
+          6. ${c.highlight("@requireAuth")} is gone. Your fields use ${c.highlight("@requireUserAuth")} now,
+             which checks what ${c.highlight("@requireAuth")} did: there were no organizations
+             before. ${c.highlight("@requireOrgAuth")} needs a current organization, and checks
+             the user's role in it.${ctx.keptRequireAuthDirective ? `
+             api/src/directives/requireAuth was changed from Cedar's, so
+             it and your @requireAuth fields were left as they are: move
+             its checks to requireUserAuth or requireOrgAuth, switch the
+             fields over, then delete it.` : ""}
+          6. Every role check names its kind now. ${c.highlight("hasRole")} is
+             ${c.highlight("hasUserRole")} on both sides (your existing uses were renamed),
+             checking ${c.highlight("currentUser.roles")}; ${c.highlight("hasOrgRole")} checks the role in
+             the organization. ${c.highlight("<PrivateSet roles>")} isn't available with
+             tenancy: guard routes by role with ${c.highlight("OrgScope")}'s ${c.highlight("roles")} and
+             ${c.highlight("unauthorized")}, from a small wrapper component.
 
 ${keptFiles.length > 0 ? `
           Kept these existing files rather than overwriting them (run with

package/dist/commands/setup/tenancy/webHasRole.js

@@ -0,0 +1,45 @@
+const HAS_ROLE = /(?<![\w$])hasRole(?![\w$])/;
+const USE_AUTH_DESTRUCTURING = /\{([^{}]*)\}(\s*=\s*useAuth\(\))/g;
+const USE_AUTH_VARIABLE = /(?:const|let|var)\s+([\w$]+)\s*=\s*useAuth\(\)/g;
+const HAS_ROLE_ON_VARIABLE = /(?<![\w$.])([\w$]+)(\s*\??\.\s*)hasRole(?![\w$])/g;
+function renameUseAuthHasRole(source) {
+  if (!source.includes("useAuth()") || !HAS_ROLE.test(source)) {
+    return source;
+  }
+  let renameUses = false;
+  let result = source.replace(
+    /(useAuth\(\)\s*\??\.\s*)hasRole(?![\w$])/g,
+    "$1hasUserRole"
+  );
+  result = result.replace(
+    USE_AUTH_DESTRUCTURING,
+    (_statement, specifiers, rest) => {
+      const renamed = specifiers.replace(
+        /(?<![\w$])hasRole(?![\w$])(\s*:)?/g,
+        (_specifier, alias) => {
+          if (!alias) {
+            renameUses = true;
+          }
+          return `hasUserRole${alias ?? ""}`;
+        }
+      );
+      return `{${renamed}}${rest}`;
+    }
+  );
+  if (renameUses) {
+    result = result.replace(/(?<![\w$.])hasRole(?![\w$])/g, "hasUserRole");
+  }
+  const authVariables = new Set(
+    Array.from(source.matchAll(USE_AUTH_VARIABLE), ([, name]) => name)
+  );
+  if (authVariables.size === 0) {
+    return result;
+  }
+  return result.replace(
+    HAS_ROLE_ON_VARIABLE,
+    (match, name, access) => authVariables.has(name) ? `${name}${access}hasUserRole` : match
+  );
+}
+export {
+  renameUseAuthHasRole
+};

package/dist/commands/setup/uploads/uploadsHandler.js

@@ -14,6 +14,7 @@ import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display"
 import { addEnvVar } from "@cedarjs/cli-helpers/project";
 import { getSchemaPath } from "@cedarjs/project-config";
 import { errorTelemetry } from "@cedarjs/telemetry";
+import { withAuthDirective } from "../../../lib/authDirective.js";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
 import { generateSecret } from "../../generate/secret/secret.js";
@@ -112,6 +113,9 @@ const handler = async ({ targets, force }) => {
     for (const [token, value] of Object.entries(replacements)) {
       templateContent = templateContent.replaceAll(token, value);
     }
+    templateContent = withAuthDirective(templateContent, {
+      belongsToOrg: false
+    });
     const content = projectIsTypescript ? templateContent : await transformTSToJS(outputPath, templateContent);
     return writeFile(outputPath, content, { overwriteExisting: force });
   };

package/dist/lib/authDirective.js

@@ -0,0 +1,37 @@
+import fs from "node:fs";
+import path from "node:path";
+import { getPaths } from "./index.js";
+function hasTenancyAuthDirectives() {
+  return fs.existsSync(path.join(getPaths().api.directives, "requireOrgAuth"));
+}
+function tenantField() {
+  for (const ext of ["ts", "js"]) {
+    const dbPath = path.join(getPaths().api.lib, `db.${ext}`);
+    if (fs.existsSync(dbPath)) {
+      const match = fs.readFileSync(dbPath, "utf-8").match(/\btenantField:\s*['"](\w+)['"]/);
+      return match?.[1] ?? "organizationId";
+    }
+  }
+  return "organizationId";
+}
+function belongsToOrganization(model) {
+  const field = tenantField();
+  return model.fields.some(
+    ({ name, type }) => name === field || type === "Organization"
+  );
+}
+function withAuthDirective(source, { belongsToOrg }) {
+  if (!hasTenancyAuthDirectives()) {
+    return source;
+  }
+  return source.replace(
+    /@requireAuth(?![\w$])/g,
+    belongsToOrg ? "@requireOrgAuth" : "@requireUserAuth"
+  );
+}
+export {
+  belongsToOrganization,
+  hasTenancyAuthDirectives,
+  tenantField,
+  withAuthDirective
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "8.0.0-canary.3538",
+  "version": "8.0.0-canary.3540",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.11",
-    "@cedarjs/api-server": "8.0.0-canary.3538",
-    "@cedarjs/babel-config": "8.0.0-canary.3538",
-    "@cedarjs/cli-helpers": "8.0.0-canary.3538",
-    "@cedarjs/internal": "8.0.0-canary.3538",
-    "@cedarjs/prerender": "8.0.0-canary.3538",
-    "@cedarjs/project-config": "8.0.0-canary.3538",
-    "@cedarjs/structure": "8.0.0-canary.3538",
-    "@cedarjs/telemetry": "8.0.0-canary.3538",
-    "@cedarjs/utils": "8.0.0-canary.3538",
-    "@cedarjs/vite": "8.0.0-canary.3538",
-    "@cedarjs/web-server": "8.0.0-canary.3538",
+    "@cedarjs/api-server": "8.0.0-canary.3540",
+    "@cedarjs/babel-config": "8.0.0-canary.3540",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3540",
+    "@cedarjs/internal": "8.0.0-canary.3540",
+    "@cedarjs/prerender": "8.0.0-canary.3540",
+    "@cedarjs/project-config": "8.0.0-canary.3540",
+    "@cedarjs/structure": "8.0.0-canary.3540",
+    "@cedarjs/telemetry": "8.0.0-canary.3540",
+    "@cedarjs/utils": "8.0.0-canary.3540",
+    "@cedarjs/vite": "8.0.0-canary.3540",
+    "@cedarjs/web-server": "8.0.0-canary.3540",
     "@listr2/prompt-adapter-enquirer": "4.4.3",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "2.12.0",
@@ -93,7 +93,7 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "8.0.0-canary.3538",
+    "@cedarjs/framework-tools": "8.0.0-canary.3540",
     "@prisma/dmmf": "7.10.1",
     "@types/archiver": "^7.0.0",
     "memfs": "4.80.0",

package/dist/commands/setup/tenancy/templates/requireMembership.test.ts.template

@@ -1,35 +0,0 @@
-import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
-
-import requireMembership from './requireMembership.js'
-
-/**
- * `context.currentUser` is typed from this app's `getCurrentUser`, which
- * selects more fields than these tests need.
- */
-const asCurrentUser = (user: { id: string; memberships?: unknown[] }) =>
-  user as unknown as NonNullable<typeof context.currentUser>
-
-describe('requireMembership directive', () => {
-  it('declares the directive sdl as schema, with the correct name', () => {
-    expect(requireMembership.schema).toBeTruthy()
-    expect(getDirectiveName(requireMembership.schema)).toBe(
-      'requireMembership',
-    )
-  })
-
-  it('throws when there is no current user', () => {
-    const mockExecution = mockRedwoodDirective(requireMembership, {
-      context: {},
-    })
-
-    expect(mockExecution).toThrowError()
-  })
-
-  it('throws when there is a current user but no current organization', () => {
-    const mockExecution = mockRedwoodDirective(requireMembership, {
-      context: { currentUser: asCurrentUser({ id: '1' }) },
-    })
-
-    expect(mockExecution).toThrowError()
-  })
-})

package/dist/commands/setup/tenancy/templates/requireMembership.ts.template

@@ -1,25 +0,0 @@
-import { gql } from 'graphql-tag'
-
-import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireMembership as applicationRequireMembership } from 'src/lib/auth'
-
-export const schema = gql`
-  """
-  Use to check whether or not the current user is a member of the current
-  organization, optionally restricted to a set of roles.
-  """
-  directive @requireMembership(roles: [String]) on FIELD_DEFINITION
-`
-
-type RequireMembershipValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
-
-const validate: RequireMembershipValidate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireMembership({ roles })
-}
-
-const requireMembership = createValidatorDirective(schema, validate)
-
-export default requireMembership