@cedarjs/cli 8.0.0-canary.3541 → 8.0.0-canary.3545

package/dist/commands/lint.js

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import path from "node:path";
 import { terminalLink } from "termi-link";
 import { runBin } from "@cedarjs/cli-helpers/packageManager/exec";
 import { recordTelemetryAttributes } from "@cedarjs/cli-helpers/telemetry";
@@ -32,6 +33,7 @@ const handler = async ({
 }) => {
   recordTelemetryAttributes({ command: "lint", fix, format });
   try {
+    await generateMissingGraphQLSchema();
     const sbPath = getPaths().web.storybook;
     const eslintArgs = [
       fix && "--fix",
@@ -64,6 +66,29 @@ const handler = async ({
     process.exitCode = 1;
   }
 };
+async function generateMissingGraphQLSchema() {
+  const paths = getPaths();
+  if (fs.existsSync(paths.generated.schema) || !fs.existsSync(paths.api.graphql) || !fs.existsSync(paths.web.src)) {
+    return;
+  }
+  let messages;
+  try {
+    const { generateGraphQLSchema } = await import("@cedarjs/internal/dist/generate/graphqlSchema");
+    fs.mkdirSync(path.dirname(paths.generated.schema), { recursive: true });
+    const { errors } = await generateGraphQLSchema();
+    messages = errors.map(({ message }) => message);
+  } catch (error) {
+    messages = [error instanceof Error ? error.message : String(error)];
+  }
+  if (messages.length > 0) {
+    console.warn(
+      "Could not generate the GraphQL schema, so the GraphQL documents in web/src are not linted against it:"
+    );
+    for (const message of messages) {
+      console.warn(message);
+    }
+  }
+}
 export {
   builder,
   command,

package/dist/commands/setup/tenancy/routerCodemod.js

@@ -0,0 +1,48 @@
+import j from "jscodeshift";
+const TENANCY_MODULE = "src/tenancy";
+function transform(fileInfo) {
+  const root = j.withParser("tsx")(fileInfo.source);
+  const routers = root.find(j.JSXOpeningElement, { name: { name: "Router" } });
+  if (routers.length !== 1) {
+    throw new Error("CEDAR_CODEMOD_ERR_ROUTER_NOT_FOUND");
+  }
+  const router = routers.get().node;
+  if (!j.JSXOpeningElement.check(router)) {
+    throw new Error("CEDAR_CODEMOD_ERR_ROUTER_NOT_FOUND");
+  }
+  const attributes = router.attributes ?? [];
+  const hasProp = attributes.some(
+    (attribute) => j.JSXAttribute.check(attribute) && attribute.name.name === "tenancy"
+  );
+  const hasImport = root.find(j.ImportSpecifier, { local: { name: "tenancy" } }).length > 0;
+  if (hasProp && hasImport) {
+    return fileInfo.source;
+  }
+  if (!hasProp) {
+    const useAuthIndex = attributes.findIndex(
+      (attribute) => j.JSXAttribute.check(attribute) && attribute.name.name === "useAuth"
+    );
+    const prop = j.jsxAttribute(
+      j.jsxIdentifier("tenancy"),
+      j.jsxExpressionContainer(j.identifier("tenancy"))
+    );
+    attributes.splice(
+      useAuthIndex === -1 ? attributes.length : useAuthIndex + 1,
+      0,
+      prop
+    );
+    router.attributes = attributes;
+  }
+  if (!hasImport) {
+    root.find(j.ImportDeclaration).at(-1).insertAfter(
+      j.importDeclaration(
+        [j.importSpecifier(j.identifier("tenancy"))],
+        j.literal(TENANCY_MODULE)
+      )
+    );
+  }
+  return root.toSource();
+}
+export {
+  transform as default
+};

package/dist/commands/setup/tenancy/templates/InvitePage.tsx.template

@@ -25,8 +25,9 @@ const ACCEPT_INVITATION_MUTATION: TypedDocumentNode<
 `
 
 /**
- * Landing page for an invitation link (`/invite/{token}`). Outside
- * `OrgScope`, since the visitor is not a member of the organization yet.
+ * Landing page for an invitation link (`/invite/{token}`). Outside any
+ * `PrivateSet` with `{orgSlug}` routes, since the visitor is not a member of
+ * the organization yet.
  */
 const InvitePage = () => {
   const { token } = useParams()

package/dist/commands/setup/tenancy/templates/tenancy.tsx.template

@@ -0,0 +1,42 @@
+import { createTenancy } from '@cedarjs/tenancy/web'
+
+/**
+ * How the Router handles organizations, passed to it in Routes.tsx:
+ *
+ *   <Router useAuth={useAuth} tenancy={tenancy}>
+ *
+ * The Router renders the organization's provider (its Apollo client with the
+ * `cedar-org` header, `useCurrentOrg()`, and `useAuth().hasPermission`)
+ * around the layouts and page of every `PrivateSet` whose routes have
+ * `{orgSlug}` in their path, so there is nothing to wrap them with:
+ *
+ *   <PrivateSet wrap={OrgLayout} unauthenticated="login">
+ *     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
+ *   </PrivateSet>
+ *
+ * A user who isn't signed in is sent to log in, and one who isn't a member
+ * of the organization sees `notAMember`. Pages only some members may open
+ * take `orgRoles` or `orgPermission` (see api/src/lib/permissions), and the
+ * one a member without them is sent to is `unauthorized`:
+ *
+ *   <PrivateSet unauthenticated="login" unauthorized="projects" orgRoles="owner">
+ *     <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+ *   </PrivateSet>
+ *
+ *   <PrivateSet unauthenticated="login" unauthorized="projects" orgPermission="members.manage">
+ *     <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />
+ *   </PrivateSet>
+ *
+ * Routes with `{orgSlug}` outside a `PrivateSet` are public pages with no
+ * organization context: they can't use `useCurrentOrg()` and their queries
+ * carry no `cedar-org` header.
+ *
+ * Customize the tenancy here, with the options of `createTenancy`:
+ * - `useOrg` finds the organization of a route, for one that doesn't come
+ *   from the `orgSlug` path param, such as from the host
+ * - `onSetOrg` is called by `useCurrentOrg().setOrg` instead of navigating,
+ *   for an organization selected from state rather than the URL
+ */
+export const tenancy = createTenancy({
+  notAMember: <p>You don&apos;t have access to this organization.</p>,
+})

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -434,15 +434,11 @@ ${SIGNUP_SNIPPET}`;
         }
       },
       {
-        title: "Adding OrgScope and the invitation landing page...",
+        title: "Adding the tenancy and the invitation landing page...",
         task: async () => {
           await writeTemplateFile(
-            "OrgScope.tsx.template",
-            path.join(
-              paths.web.components,
-              "OrgScope",
-              `OrgScope.${componentExt}`
-            )
+            "tenancy.tsx.template",
+            path.join(paths.web.src, `tenancy.${componentExt}`)
           );
           await writeTemplateFile(
             "InvitePage.tsx.template",
@@ -454,6 +450,28 @@ ${SIGNUP_SNIPPET}`;
           );
         }
       },
+      {
+        title: "Passing the tenancy to the Router in web/src/Routes...",
+        task: async (ctx, task) => {
+          const routesPath = paths.web.routes;
+          if (!routesPath || !fs.existsSync(routesPath)) {
+            ctx.routerNeedsTenancy = true;
+            task.skip("No web/src/Routes file found; skipping.");
+            return;
+          }
+          const source = fs.readFileSync(routesPath, "utf-8");
+          const transformResult = await runTransform({
+            transformPath: path.join(import.meta.dirname, "routerCodemod.js"),
+            targetPaths: [routesPath]
+          });
+          if (transformResult.error) {
+            ctx.routerNeedsTenancy = true;
+            task.output = "Could not find the app's <Router> in web/src/Routes, so left it as it is. See the next steps for what to add.";
+          } else if (fs.readFileSync(routesPath, "utf-8") !== source) {
+            writtenFiles.push(routesPath);
+          }
+        }
+      },
       {
         title: "Formatting and linting changed files...",
         task: async (_ctx, task) => {
@@ -520,17 +538,29 @@ ${SIGNUP_SNIPPET}`;
              schema.prisma, and switch its fields from ${c.highlight("@requireUserAuth")}
              to ${c.highlight("@requireOrgAuth")}. For each one that stays global, add it
              to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
-          3. Wrap your organization routes with the generated OrgScope in
-             web/src/Routes.tsx:
+          3. Put your organization routes in a PrivateSet in web/src/Routes.tsx.
+             The Router renders the organization for it, using the generated
+             web/src/tenancy, so there is nothing to wrap them with. A user
+             who isn't signed in is sent to log in:
 
-               <Set wrap={OrgScope}>
+               <PrivateSet wrap={OrgLayout} unauthenticated="login">
                  <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
-               </Set>
+               </PrivateSet>
 
              and add the invitation route outside it:
 
                <Route path="/invite/{token}" page={InvitePage} name="invite" />
 
+             Routes with {orgSlug} outside a PrivateSet are public pages
+             with no organization context.
+${ctx.routerNeedsTenancy ? `
+             Your ${c.highlight("<Router>")} couldn't be found, so pass it ${c.highlight("tenancy")} by
+             hand, so it renders the organization for the routes below:
+
+               import { tenancy } from 'src/tenancy'
+
+               <Router useAuth={useAuth} tenancy={tenancy}>
+` : ""}
           4. Wrap any plain api/src/functions/* handler that touches
              tenant-owned models with ${c.highlight("withTenancy")} from ${c.highlight(
             "@cedarjs/tenancy"
@@ -549,12 +579,19 @@ ${SIGNUP_SNIPPET}`;
              it and your @requireAuth fields were left as they are: move
              its checks to requireUserAuth or requireOrgAuth, switch the
              fields over, then delete it.` : ""}
-          6. Every role check names its kind now. ${c.highlight("hasRole")} is
+          7. Every role check names its kind now. ${c.highlight("hasRole")} is
              ${c.highlight("hasUserRole")} on both sides (your existing uses were renamed),
              checking ${c.highlight("currentUser.roles")}; ${c.highlight("hasOrgRole")} checks the role in
              the organization. ${c.highlight("<PrivateSet roles>")} isn't available with
-             tenancy: guard routes by role with ${c.highlight("OrgScope")}'s ${c.highlight("roles")} and
-             ${c.highlight("unauthorized")}, from a small wrapper component.
+             tenancy: guard routes with ${c.highlight("<PrivateSet userRoles>")} for
+             ${c.highlight("currentUser.roles")}, and with ${c.highlight("<PrivateSet orgRoles>")} for the
+             role in the route's organization. A member who lacks it is sent
+             to ${c.highlight("unauthorized")}, and ${c.highlight("<PrivateSet orgPermission>")} checks a
+             permission of their membership the same way:
+
+               <PrivateSet unauthenticated="login" unauthorized="projects" orgRoles="owner">
+                 <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+               </PrivateSet>
 
 ${keptFiles.length > 0 ? `
           Kept these existing files rather than overwriting them (run with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "8.0.0-canary.3541",
+  "version": "8.0.0-canary.3545",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.11",
-    "@cedarjs/api-server": "8.0.0-canary.3541",
-    "@cedarjs/babel-config": "8.0.0-canary.3541",
-    "@cedarjs/cli-helpers": "8.0.0-canary.3541",
-    "@cedarjs/internal": "8.0.0-canary.3541",
-    "@cedarjs/prerender": "8.0.0-canary.3541",
-    "@cedarjs/project-config": "8.0.0-canary.3541",
-    "@cedarjs/structure": "8.0.0-canary.3541",
-    "@cedarjs/telemetry": "8.0.0-canary.3541",
-    "@cedarjs/utils": "8.0.0-canary.3541",
-    "@cedarjs/vite": "8.0.0-canary.3541",
-    "@cedarjs/web-server": "8.0.0-canary.3541",
+    "@cedarjs/api-server": "8.0.0-canary.3545",
+    "@cedarjs/babel-config": "8.0.0-canary.3545",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3545",
+    "@cedarjs/internal": "8.0.0-canary.3545",
+    "@cedarjs/prerender": "8.0.0-canary.3545",
+    "@cedarjs/project-config": "8.0.0-canary.3545",
+    "@cedarjs/structure": "8.0.0-canary.3545",
+    "@cedarjs/telemetry": "8.0.0-canary.3545",
+    "@cedarjs/utils": "8.0.0-canary.3545",
+    "@cedarjs/vite": "8.0.0-canary.3545",
+    "@cedarjs/web-server": "8.0.0-canary.3545",
     "@listr2/prompt-adapter-enquirer": "4.4.3",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "2.12.0",
@@ -93,7 +93,7 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "8.0.0-canary.3541",
+    "@cedarjs/framework-tools": "8.0.0-canary.3545",
     "@prisma/dmmf": "7.10.1",
     "@types/archiver": "^7.0.0",
     "memfs": "4.80.0",

package/dist/commands/setup/tenancy/templates/OrgScope.tsx.template

@@ -1,79 +0,0 @@
-import type { ReactNode } from 'react'
-
-import { OrgScope as TenancyOrgScope } from '@cedarjs/tenancy/web'
-import type { OrgScopeProps as TenancyOrgScopeProps } from '@cedarjs/tenancy/web'
-
-import { useAuth } from 'src/auth'
-
-export interface OrgScopeProps {
-  /** Overrides the `orgSlug` route param. */
-  orgSlug?: string
-  /** Only members with one of these roles in the organization get in. */
-  roles?: string | string[]
-  /**
-   * Only members whose role has this permission (api/src/lib/permissions)
-   * get in.
-   */
-  permission?: TenancyOrgScopeProps['permission']
-  /**
-   * The name of the route a member without one of `roles`, or without
-   * `permission`, is sent to. It gets the `orgSlug` param when its path has
-   * one.
-   */
-  unauthorized?: string
-  children: ReactNode
-}
-
-/**
- * Wraps organization routes with a per-organization Apollo client and a
- * membership check, using this app's `useAuth`. Use with the router's
- * `Set wrap`:
- *
- *   <Set wrap={OrgScope}>
- *     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
- *   </Set>
- *
- * Under it, `useAuth().hasPermission` and `useCurrentOrg().hasOrgRole`
- * check the user's membership in the organization, and
- * `useAuth().hasUserRole` checks `currentUser.roles`. For pages only some
- * members may open, wrap them in a component that passes `permission` (or
- * `roles`; there's no `<PrivateSet roles>` with tenancy):
- *
- *   const MemberManagers = ({ children }: { children: ReactNode }) => (
- *     <OrgScope permission="members.manage" unauthorized="projects">
- *       {children}
- *     </OrgScope>
- *   )
- *
- *   <Set wrap={MemberManagers}>
- *     <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />
- *   </Set>
- *
- * Routes under `OrgScope` must not carry `prerender`: `OrgScope`'s nested
- * Apollo client shadows the per-route client the prerenderer injects above
- * `App`, so a prerendered query under here would not go through it.
- */
-export const OrgScope = ({
-  orgSlug,
-  roles,
-  permission,
-  unauthorized,
-  children,
-}: OrgScopeProps) => {
-  return (
-    <TenancyOrgScope
-      useAuth={useAuth}
-      orgSlug={orgSlug}
-      roles={roles}
-      permission={permission}
-      unauthorized={unauthorized}
-      notAMember={
-        <div>
-          <p>You don&apos;t have access to this organization.</p>
-        </div>
-      }
-    >
-      {children}
-    </TenancyOrgScope>
-  )
-}