@cedarjs/cli 8.0.0-canary.3541 → 8.0.0-canary.3542

package/dist/commands/setup/tenancy/routerCodemod.js

@@ -0,0 +1,53 @@
+import j from "jscodeshift";
+const TENANCY_WEB = "@cedarjs/tenancy/web";
+function transform(fileInfo) {
+  const root = j.withParser("tsx")(fileInfo.source);
+  const routers = root.find(j.JSXOpeningElement, { name: { name: "Router" } });
+  if (routers.length !== 1) {
+    throw new Error("CEDAR_CODEMOD_ERR_ROUTER_NOT_FOUND");
+  }
+  const router = routers.get().node;
+  if (!j.JSXOpeningElement.check(router)) {
+    throw new Error("CEDAR_CODEMOD_ERR_ROUTER_NOT_FOUND");
+  }
+  const attributes = router.attributes ?? [];
+  const hasProp = attributes.some(
+    (attribute) => j.JSXAttribute.check(attribute) && attribute.name.name === "useOrgRoles"
+  );
+  const hasImport = root.find(j.ImportSpecifier, { local: { name: "useOrgRoles" } }).length > 0;
+  if (hasProp && hasImport) {
+    return fileInfo.source;
+  }
+  if (!hasProp) {
+    const useAuthIndex = attributes.findIndex(
+      (attribute) => j.JSXAttribute.check(attribute) && attribute.name.name === "useAuth"
+    );
+    const prop = j.jsxAttribute(
+      j.jsxIdentifier("useOrgRoles"),
+      j.jsxExpressionContainer(j.identifier("useOrgRoles"))
+    );
+    attributes.splice(
+      useAuthIndex === -1 ? attributes.length : useAuthIndex + 1,
+      0,
+      prop
+    );
+    router.attributes = attributes;
+  }
+  if (!hasImport) {
+    const specifier = j.importSpecifier(j.identifier("useOrgRoles"));
+    const tenancyImport = root.find(j.ImportDeclaration, { source: { value: TENANCY_WEB } }).nodes().find(
+      (declaration) => declaration.importKind !== "type" && declaration.specifiers?.every(
+        (existing) => j.ImportSpecifier.check(existing)
+      )
+    );
+    if (tenancyImport?.specifiers) {
+      tenancyImport.specifiers.push(specifier);
+    } else {
+      root.find(j.ImportDeclaration).at(-1).insertAfter(j.importDeclaration([specifier], j.literal(TENANCY_WEB)));
+    }
+  }
+  return root.toSource();
+}
+export {
+  transform as default
+};

package/dist/commands/setup/tenancy/templates/OrgScope.tsx.template

@@ -27,17 +27,26 @@ export interface OrgScopeProps {
 /**
  * Wraps organization routes with a per-organization Apollo client and a
  * membership check, using this app's `useAuth`. Use with the router's
- * `Set wrap`:
+ * `PrivateSet wrap`, so a user who isn't signed in is sent to log in:
  *
- *   <Set wrap={OrgScope}>
+ *   <PrivateSet wrap={OrgScope} unauthenticated="login">
  *     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
- *   </Set>
+ *   </PrivateSet>
  *
  * Under it, `useAuth().hasPermission` and `useCurrentOrg().hasOrgRole`
  * check the user's membership in the organization, and
  * `useAuth().hasUserRole` checks `currentUser.roles`. For pages only some
- * members may open, wrap them in a component that passes `permission` (or
- * `roles`; there's no `<PrivateSet roles>` with tenancy):
+ * roles in the organization may open, give the `PrivateSet` `orgRoles`. The
+ * router checks the role in the route's organization with the
+ * `useOrgRoles` passed to it, `<Router useAuth={useAuth}
+ * useOrgRoles={useOrgRoles}>`:
+ *
+ *   <PrivateSet wrap={[OrgScope, OrgLayout]} unauthenticated="login" unauthorized="projects" orgRoles="owner">
+ *     <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+ *   </PrivateSet>
+ *
+ * For pages only members with a permission may open, wrap them in a
+ * component that passes `permission`:
  *
  *   const MemberManagers = ({ children }: { children: ReactNode }) => (
  *     <OrgScope permission="members.manage" unauthorized="projects">

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -454,6 +454,28 @@ ${SIGNUP_SNIPPET}`;
           );
         }
       },
+      {
+        title: "Passing useOrgRoles to the Router in web/src/Routes...",
+        task: async (ctx, task) => {
+          const routesPath = paths.web.routes;
+          if (!routesPath || !fs.existsSync(routesPath)) {
+            ctx.routerNeedsUseOrgRoles = true;
+            task.skip("No web/src/Routes file found; skipping.");
+            return;
+          }
+          const source = fs.readFileSync(routesPath, "utf-8");
+          const transformResult = await runTransform({
+            transformPath: path.join(import.meta.dirname, "routerCodemod.js"),
+            targetPaths: [routesPath]
+          });
+          if (transformResult.error) {
+            ctx.routerNeedsUseOrgRoles = true;
+            task.output = "Could not find the app's <Router> in web/src/Routes, so left it as it is. See the next steps for what to add.";
+          } else if (fs.readFileSync(routesPath, "utf-8") !== source) {
+            writtenFiles.push(routesPath);
+          }
+        }
+      },
       {
         title: "Formatting and linting changed files...",
         task: async (_ctx, task) => {
@@ -521,16 +543,24 @@ ${SIGNUP_SNIPPET}`;
              to ${c.highlight("@requireOrgAuth")}. For each one that stays global, add it
              to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
           3. Wrap your organization routes with the generated OrgScope in
-             web/src/Routes.tsx:
+             web/src/Routes.tsx, in a PrivateSet, so a user who isn't signed
+             in is sent to log in:
 
-               <Set wrap={OrgScope}>
+               <PrivateSet wrap={OrgScope} unauthenticated="login">
                  <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
-               </Set>
+               </PrivateSet>
 
              and add the invitation route outside it:
 
                <Route path="/invite/{token}" page={InvitePage} name="invite" />
+${ctx.routerNeedsUseOrgRoles ? `
+             Your ${c.highlight("<Router>")} couldn't be found, so pass it ${c.highlight("useOrgRoles")} by
+             hand, for ${c.highlight("<PrivateSet orgRoles>")} below:
+
+               import { useOrgRoles } from '@cedarjs/tenancy/web'
 
+               <Router useAuth={useAuth} useOrgRoles={useOrgRoles}>
+` : ""}
           4. Wrap any plain api/src/functions/* handler that touches
              tenant-owned models with ${c.highlight("withTenancy")} from ${c.highlight(
             "@cedarjs/tenancy"
@@ -549,12 +579,19 @@ ${SIGNUP_SNIPPET}`;
              it and your @requireAuth fields were left as they are: move
              its checks to requireUserAuth or requireOrgAuth, switch the
              fields over, then delete it.` : ""}
-          6. Every role check names its kind now. ${c.highlight("hasRole")} is
+          7. Every role check names its kind now. ${c.highlight("hasRole")} is
              ${c.highlight("hasUserRole")} on both sides (your existing uses were renamed),
              checking ${c.highlight("currentUser.roles")}; ${c.highlight("hasOrgRole")} checks the role in
              the organization. ${c.highlight("<PrivateSet roles>")} isn't available with
-             tenancy: guard routes by role with ${c.highlight("OrgScope")}'s ${c.highlight("roles")} and
-             ${c.highlight("unauthorized")}, from a small wrapper component.
+             tenancy: guard routes with ${c.highlight("<PrivateSet userRoles>")} for
+             ${c.highlight("currentUser.roles")}, and with ${c.highlight("<PrivateSet orgRoles>")} for the
+             role in the route's organization, which the router checks with
+             the ${c.highlight("useOrgRoles")} passed to it:
+
+               <Router useAuth={useAuth} useOrgRoles={useOrgRoles}>
+                 <PrivateSet wrap={[OrgScope, OrgLayout]} unauthenticated="login" unauthorized="projects" orgRoles="owner">
+                   <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+                 </PrivateSet>
 
 ${keptFiles.length > 0 ? `
           Kept these existing files rather than overwriting them (run with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "8.0.0-canary.3541",
+  "version": "8.0.0-canary.3542",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.11",
-    "@cedarjs/api-server": "8.0.0-canary.3541",
-    "@cedarjs/babel-config": "8.0.0-canary.3541",
-    "@cedarjs/cli-helpers": "8.0.0-canary.3541",
-    "@cedarjs/internal": "8.0.0-canary.3541",
-    "@cedarjs/prerender": "8.0.0-canary.3541",
-    "@cedarjs/project-config": "8.0.0-canary.3541",
-    "@cedarjs/structure": "8.0.0-canary.3541",
-    "@cedarjs/telemetry": "8.0.0-canary.3541",
-    "@cedarjs/utils": "8.0.0-canary.3541",
-    "@cedarjs/vite": "8.0.0-canary.3541",
-    "@cedarjs/web-server": "8.0.0-canary.3541",
+    "@cedarjs/api-server": "8.0.0-canary.3542",
+    "@cedarjs/babel-config": "8.0.0-canary.3542",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3542",
+    "@cedarjs/internal": "8.0.0-canary.3542",
+    "@cedarjs/prerender": "8.0.0-canary.3542",
+    "@cedarjs/project-config": "8.0.0-canary.3542",
+    "@cedarjs/structure": "8.0.0-canary.3542",
+    "@cedarjs/telemetry": "8.0.0-canary.3542",
+    "@cedarjs/utils": "8.0.0-canary.3542",
+    "@cedarjs/vite": "8.0.0-canary.3542",
+    "@cedarjs/web-server": "8.0.0-canary.3542",
     "@listr2/prompt-adapter-enquirer": "4.4.3",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "2.12.0",
@@ -93,7 +93,7 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "8.0.0-canary.3541",
+    "@cedarjs/framework-tools": "8.0.0-canary.3542",
     "@prisma/dmmf": "7.10.1",
     "@types/archiver": "^7.0.0",
     "memfs": "4.80.0",