@cedarjs/cli 8.0.0-canary.3542 → 8.0.0-canary.3545

package/dist/commands/lint.js

@@ -1,4 +1,5 @@
 import fs from "node:fs";
+import path from "node:path";
 import { terminalLink } from "termi-link";
 import { runBin } from "@cedarjs/cli-helpers/packageManager/exec";
 import { recordTelemetryAttributes } from "@cedarjs/cli-helpers/telemetry";
@@ -32,6 +33,7 @@ const handler = async ({
 }) => {
   recordTelemetryAttributes({ command: "lint", fix, format });
   try {
+    await generateMissingGraphQLSchema();
     const sbPath = getPaths().web.storybook;
     const eslintArgs = [
       fix && "--fix",
@@ -64,6 +66,29 @@ const handler = async ({
     process.exitCode = 1;
   }
 };
+async function generateMissingGraphQLSchema() {
+  const paths = getPaths();
+  if (fs.existsSync(paths.generated.schema) || !fs.existsSync(paths.api.graphql) || !fs.existsSync(paths.web.src)) {
+    return;
+  }
+  let messages;
+  try {
+    const { generateGraphQLSchema } = await import("@cedarjs/internal/dist/generate/graphqlSchema");
+    fs.mkdirSync(path.dirname(paths.generated.schema), { recursive: true });
+    const { errors } = await generateGraphQLSchema();
+    messages = errors.map(({ message }) => message);
+  } catch (error) {
+    messages = [error instanceof Error ? error.message : String(error)];
+  }
+  if (messages.length > 0) {
+    console.warn(
+      "Could not generate the GraphQL schema, so the GraphQL documents in web/src are not linted against it:"
+    );
+    for (const message of messages) {
+      console.warn(message);
+    }
+  }
+}
 export {
   builder,
   command,

package/dist/commands/setup/tenancy/routerCodemod.js

@@ -1,5 +1,5 @@
 import j from "jscodeshift";
-const TENANCY_WEB = "@cedarjs/tenancy/web";
+const TENANCY_MODULE = "src/tenancy";
 function transform(fileInfo) {
   const root = j.withParser("tsx")(fileInfo.source);
   const routers = root.find(j.JSXOpeningElement, { name: { name: "Router" } });
@@ -12,9 +12,9 @@ function transform(fileInfo) {
   }
   const attributes = router.attributes ?? [];
   const hasProp = attributes.some(
-    (attribute) => j.JSXAttribute.check(attribute) && attribute.name.name === "useOrgRoles"
+    (attribute) => j.JSXAttribute.check(attribute) && attribute.name.name === "tenancy"
   );
-  const hasImport = root.find(j.ImportSpecifier, { local: { name: "useOrgRoles" } }).length > 0;
+  const hasImport = root.find(j.ImportSpecifier, { local: { name: "tenancy" } }).length > 0;
   if (hasProp && hasImport) {
     return fileInfo.source;
   }
@@ -23,8 +23,8 @@ function transform(fileInfo) {
       (attribute) => j.JSXAttribute.check(attribute) && attribute.name.name === "useAuth"
     );
     const prop = j.jsxAttribute(
-      j.jsxIdentifier("useOrgRoles"),
-      j.jsxExpressionContainer(j.identifier("useOrgRoles"))
+      j.jsxIdentifier("tenancy"),
+      j.jsxExpressionContainer(j.identifier("tenancy"))
     );
     attributes.splice(
       useAuthIndex === -1 ? attributes.length : useAuthIndex + 1,
@@ -34,17 +34,12 @@ function transform(fileInfo) {
     router.attributes = attributes;
   }
   if (!hasImport) {
-    const specifier = j.importSpecifier(j.identifier("useOrgRoles"));
-    const tenancyImport = root.find(j.ImportDeclaration, { source: { value: TENANCY_WEB } }).nodes().find(
-      (declaration) => declaration.importKind !== "type" && declaration.specifiers?.every(
-        (existing) => j.ImportSpecifier.check(existing)
+    root.find(j.ImportDeclaration).at(-1).insertAfter(
+      j.importDeclaration(
+        [j.importSpecifier(j.identifier("tenancy"))],
+        j.literal(TENANCY_MODULE)
       )
     );
-    if (tenancyImport?.specifiers) {
-      tenancyImport.specifiers.push(specifier);
-    } else {
-      root.find(j.ImportDeclaration).at(-1).insertAfter(j.importDeclaration([specifier], j.literal(TENANCY_WEB)));
-    }
   }
   return root.toSource();
 }

package/dist/commands/setup/tenancy/templates/InvitePage.tsx.template

@@ -25,8 +25,9 @@ const ACCEPT_INVITATION_MUTATION: TypedDocumentNode<
 `
 
 /**
- * Landing page for an invitation link (`/invite/{token}`). Outside
- * `OrgScope`, since the visitor is not a member of the organization yet.
+ * Landing page for an invitation link (`/invite/{token}`). Outside any
+ * `PrivateSet` with `{orgSlug}` routes, since the visitor is not a member of
+ * the organization yet.
  */
 const InvitePage = () => {
   const { token } = useParams()

package/dist/commands/setup/tenancy/templates/tenancy.tsx.template

@@ -0,0 +1,42 @@
+import { createTenancy } from '@cedarjs/tenancy/web'
+
+/**
+ * How the Router handles organizations, passed to it in Routes.tsx:
+ *
+ *   <Router useAuth={useAuth} tenancy={tenancy}>
+ *
+ * The Router renders the organization's provider (its Apollo client with the
+ * `cedar-org` header, `useCurrentOrg()`, and `useAuth().hasPermission`)
+ * around the layouts and page of every `PrivateSet` whose routes have
+ * `{orgSlug}` in their path, so there is nothing to wrap them with:
+ *
+ *   <PrivateSet wrap={OrgLayout} unauthenticated="login">
+ *     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
+ *   </PrivateSet>
+ *
+ * A user who isn't signed in is sent to log in, and one who isn't a member
+ * of the organization sees `notAMember`. Pages only some members may open
+ * take `orgRoles` or `orgPermission` (see api/src/lib/permissions), and the
+ * one a member without them is sent to is `unauthorized`:
+ *
+ *   <PrivateSet unauthenticated="login" unauthorized="projects" orgRoles="owner">
+ *     <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+ *   </PrivateSet>
+ *
+ *   <PrivateSet unauthenticated="login" unauthorized="projects" orgPermission="members.manage">
+ *     <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />
+ *   </PrivateSet>
+ *
+ * Routes with `{orgSlug}` outside a `PrivateSet` are public pages with no
+ * organization context: they can't use `useCurrentOrg()` and their queries
+ * carry no `cedar-org` header.
+ *
+ * Customize the tenancy here, with the options of `createTenancy`:
+ * - `useOrg` finds the organization of a route, for one that doesn't come
+ *   from the `orgSlug` path param, such as from the host
+ * - `onSetOrg` is called by `useCurrentOrg().setOrg` instead of navigating,
+ *   for an organization selected from state rather than the URL
+ */
+export const tenancy = createTenancy({
+  notAMember: <p>You don&apos;t have access to this organization.</p>,
+})

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -434,15 +434,11 @@ ${SIGNUP_SNIPPET}`;
         }
       },
       {
-        title: "Adding OrgScope and the invitation landing page...",
+        title: "Adding the tenancy and the invitation landing page...",
         task: async () => {
           await writeTemplateFile(
-            "OrgScope.tsx.template",
-            path.join(
-              paths.web.components,
-              "OrgScope",
-              `OrgScope.${componentExt}`
-            )
+            "tenancy.tsx.template",
+            path.join(paths.web.src, `tenancy.${componentExt}`)
           );
           await writeTemplateFile(
             "InvitePage.tsx.template",
@@ -455,11 +451,11 @@ ${SIGNUP_SNIPPET}`;
         }
       },
       {
-        title: "Passing useOrgRoles to the Router in web/src/Routes...",
+        title: "Passing the tenancy to the Router in web/src/Routes...",
         task: async (ctx, task) => {
           const routesPath = paths.web.routes;
           if (!routesPath || !fs.existsSync(routesPath)) {
-            ctx.routerNeedsUseOrgRoles = true;
+            ctx.routerNeedsTenancy = true;
             task.skip("No web/src/Routes file found; skipping.");
             return;
           }
@@ -469,7 +465,7 @@ ${SIGNUP_SNIPPET}`;
             targetPaths: [routesPath]
           });
           if (transformResult.error) {
-            ctx.routerNeedsUseOrgRoles = true;
+            ctx.routerNeedsTenancy = true;
             task.output = "Could not find the app's <Router> in web/src/Routes, so left it as it is. See the next steps for what to add.";
           } else if (fs.readFileSync(routesPath, "utf-8") !== source) {
             writtenFiles.push(routesPath);
@@ -542,24 +538,28 @@ ${SIGNUP_SNIPPET}`;
              schema.prisma, and switch its fields from ${c.highlight("@requireUserAuth")}
              to ${c.highlight("@requireOrgAuth")}. For each one that stays global, add it
              to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
-          3. Wrap your organization routes with the generated OrgScope in
-             web/src/Routes.tsx, in a PrivateSet, so a user who isn't signed
-             in is sent to log in:
+          3. Put your organization routes in a PrivateSet in web/src/Routes.tsx.
+             The Router renders the organization for it, using the generated
+             web/src/tenancy, so there is nothing to wrap them with. A user
+             who isn't signed in is sent to log in:
 
-               <PrivateSet wrap={OrgScope} unauthenticated="login">
+               <PrivateSet wrap={OrgLayout} unauthenticated="login">
                  <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
                </PrivateSet>
 
              and add the invitation route outside it:
 
                <Route path="/invite/{token}" page={InvitePage} name="invite" />
-${ctx.routerNeedsUseOrgRoles ? `
-             Your ${c.highlight("<Router>")} couldn't be found, so pass it ${c.highlight("useOrgRoles")} by
-             hand, for ${c.highlight("<PrivateSet orgRoles>")} below:
 
-               import { useOrgRoles } from '@cedarjs/tenancy/web'
+             Routes with {orgSlug} outside a PrivateSet are public pages
+             with no organization context.
+${ctx.routerNeedsTenancy ? `
+             Your ${c.highlight("<Router>")} couldn't be found, so pass it ${c.highlight("tenancy")} by
+             hand, so it renders the organization for the routes below:
 
-               <Router useAuth={useAuth} useOrgRoles={useOrgRoles}>
+               import { tenancy } from 'src/tenancy'
+
+               <Router useAuth={useAuth} tenancy={tenancy}>
 ` : ""}
           4. Wrap any plain api/src/functions/* handler that touches
              tenant-owned models with ${c.highlight("withTenancy")} from ${c.highlight(
@@ -585,13 +585,13 @@ ${ctx.routerNeedsUseOrgRoles ? `
              the organization. ${c.highlight("<PrivateSet roles>")} isn't available with
              tenancy: guard routes with ${c.highlight("<PrivateSet userRoles>")} for
              ${c.highlight("currentUser.roles")}, and with ${c.highlight("<PrivateSet orgRoles>")} for the
-             role in the route's organization, which the router checks with
-             the ${c.highlight("useOrgRoles")} passed to it:
+             role in the route's organization. A member who lacks it is sent
+             to ${c.highlight("unauthorized")}, and ${c.highlight("<PrivateSet orgPermission>")} checks a
+             permission of their membership the same way:
 
-               <Router useAuth={useAuth} useOrgRoles={useOrgRoles}>
-                 <PrivateSet wrap={[OrgScope, OrgLayout]} unauthenticated="login" unauthorized="projects" orgRoles="owner">
-                   <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
-                 </PrivateSet>
+               <PrivateSet unauthenticated="login" unauthorized="projects" orgRoles="owner">
+                 <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
+               </PrivateSet>
 
 ${keptFiles.length > 0 ? `
           Kept these existing files rather than overwriting them (run with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "8.0.0-canary.3542",
+  "version": "8.0.0-canary.3545",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.11",
-    "@cedarjs/api-server": "8.0.0-canary.3542",
-    "@cedarjs/babel-config": "8.0.0-canary.3542",
-    "@cedarjs/cli-helpers": "8.0.0-canary.3542",
-    "@cedarjs/internal": "8.0.0-canary.3542",
-    "@cedarjs/prerender": "8.0.0-canary.3542",
-    "@cedarjs/project-config": "8.0.0-canary.3542",
-    "@cedarjs/structure": "8.0.0-canary.3542",
-    "@cedarjs/telemetry": "8.0.0-canary.3542",
-    "@cedarjs/utils": "8.0.0-canary.3542",
-    "@cedarjs/vite": "8.0.0-canary.3542",
-    "@cedarjs/web-server": "8.0.0-canary.3542",
+    "@cedarjs/api-server": "8.0.0-canary.3545",
+    "@cedarjs/babel-config": "8.0.0-canary.3545",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3545",
+    "@cedarjs/internal": "8.0.0-canary.3545",
+    "@cedarjs/prerender": "8.0.0-canary.3545",
+    "@cedarjs/project-config": "8.0.0-canary.3545",
+    "@cedarjs/structure": "8.0.0-canary.3545",
+    "@cedarjs/telemetry": "8.0.0-canary.3545",
+    "@cedarjs/utils": "8.0.0-canary.3545",
+    "@cedarjs/vite": "8.0.0-canary.3545",
+    "@cedarjs/web-server": "8.0.0-canary.3545",
     "@listr2/prompt-adapter-enquirer": "4.4.3",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "2.12.0",
@@ -93,7 +93,7 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "8.0.0-canary.3542",
+    "@cedarjs/framework-tools": "8.0.0-canary.3545",
     "@prisma/dmmf": "7.10.1",
     "@types/archiver": "^7.0.0",
     "memfs": "4.80.0",

package/dist/commands/setup/tenancy/templates/OrgScope.tsx.template

@@ -1,88 +0,0 @@
-import type { ReactNode } from 'react'
-
-import { OrgScope as TenancyOrgScope } from '@cedarjs/tenancy/web'
-import type { OrgScopeProps as TenancyOrgScopeProps } from '@cedarjs/tenancy/web'
-
-import { useAuth } from 'src/auth'
-
-export interface OrgScopeProps {
-  /** Overrides the `orgSlug` route param. */
-  orgSlug?: string
-  /** Only members with one of these roles in the organization get in. */
-  roles?: string | string[]
-  /**
-   * Only members whose role has this permission (api/src/lib/permissions)
-   * get in.
-   */
-  permission?: TenancyOrgScopeProps['permission']
-  /**
-   * The name of the route a member without one of `roles`, or without
-   * `permission`, is sent to. It gets the `orgSlug` param when its path has
-   * one.
-   */
-  unauthorized?: string
-  children: ReactNode
-}
-
-/**
- * Wraps organization routes with a per-organization Apollo client and a
- * membership check, using this app's `useAuth`. Use with the router's
- * `PrivateSet wrap`, so a user who isn't signed in is sent to log in:
- *
- *   <PrivateSet wrap={OrgScope} unauthenticated="login">
- *     <Route path="/org/{orgSlug}/projects" page={ProjectsPage} name="projects" />
- *   </PrivateSet>
- *
- * Under it, `useAuth().hasPermission` and `useCurrentOrg().hasOrgRole`
- * check the user's membership in the organization, and
- * `useAuth().hasUserRole` checks `currentUser.roles`. For pages only some
- * roles in the organization may open, give the `PrivateSet` `orgRoles`. The
- * router checks the role in the route's organization with the
- * `useOrgRoles` passed to it, `<Router useAuth={useAuth}
- * useOrgRoles={useOrgRoles}>`:
- *
- *   <PrivateSet wrap={[OrgScope, OrgLayout]} unauthenticated="login" unauthorized="projects" orgRoles="owner">
- *     <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
- *   </PrivateSet>
- *
- * For pages only members with a permission may open, wrap them in a
- * component that passes `permission`:
- *
- *   const MemberManagers = ({ children }: { children: ReactNode }) => (
- *     <OrgScope permission="members.manage" unauthorized="projects">
- *       {children}
- *     </OrgScope>
- *   )
- *
- *   <Set wrap={MemberManagers}>
- *     <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />
- *   </Set>
- *
- * Routes under `OrgScope` must not carry `prerender`: `OrgScope`'s nested
- * Apollo client shadows the per-route client the prerenderer injects above
- * `App`, so a prerendered query under here would not go through it.
- */
-export const OrgScope = ({
-  orgSlug,
-  roles,
-  permission,
-  unauthorized,
-  children,
-}: OrgScopeProps) => {
-  return (
-    <TenancyOrgScope
-      useAuth={useAuth}
-      orgSlug={orgSlug}
-      roles={roles}
-      permission={permission}
-      unauthorized={unauthorized}
-      notAMember={
-        <div>
-          <p>You don&apos;t have access to this organization.</p>
-        </div>
-      }
-    >
-      {children}
-    </TenancyOrgScope>
-  )
-}