@cedarjs/cli 8.0.0-canary.3565 → 8.0.0-canary.3567

package/dist/commands/setup/tenancy/authCodemod.js

@@ -18,8 +18,7 @@ function buildMembershipsSelectProperty() {
   }
   return property;
 }
-const TENANCY_AUTH_EXPORT = `export const { hasUserRole, hasOrgRole, requireUserAuth, requireOrgAuth } =
-  createTenancyAuth()
+const TENANCY_AUTH_EXPORT = `export const { hasUserRole, requireUserAuth } = createTenancyAuth()
 `;
 const DEFAULT_REQUIRE_AUTH_STATEMENTS = [
   /^if \(!isAuthenticated\(\)\) \{ throw new AuthenticationError\([^)]*\);? \}$/,

package/dist/commands/setup/tenancy/templates/organizations.sdl.ts.template

@@ -59,9 +59,8 @@ export const schema = gql`
 
     """
     Creates a pending membership (an invitation) in the current organization,
-    for a role the caller's own role may grant (see ROLE_GRANTS in
-    organizations.ts) -- an admin can invite an admin or a member, but not an
-    owner. The app is responsible for emailing input.email a link built from
+    for a role whose permissions the caller all holds -- an admin can invite
+    an admin or a member, but not an owner. The app is responsible for emailing input.email a link built from
     the returned invitationToken; Membership has no email column of its own.
     The invitation can be claimed until the returned invitationExpiresAt.
     Web callers must call reauthenticate() from useAuth() in onCompleted so

package/dist/commands/setup/tenancy/templates/organizations.test.ts.template

@@ -120,6 +120,19 @@ describe('organizations service', () => {
       },
     )
 
+    scenario(
+      'an admin can invite an admin',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.admin)
+
+        const result = await inviteMember({
+          input: { email: 'new-admin@example.com', role: 'admin' },
+        })
+
+        expect(result.invitationToken).toBeTruthy()
+      },
+    )
+
     scenario(
       'an admin cannot invite an owner',
       async (scenario: StandardScenario) => {

package/dist/commands/setup/tenancy/templates/organizations.ts.template

@@ -6,10 +6,13 @@ import type {
   MembershipRelationResolvers,
 } from 'types/graphql'
 
+import { permissions } from '__PERMISSIONS_PACKAGE__'
+
 import { ForbiddenError, ValidationError } from '@cedarjs/graphql-server'
 import { requireCurrentOrg } from '@cedarjs/tenancy'
 
 import { Prisma, db } from 'src/lib/db'
+import { canGrantRole } from 'src/lib/permissions'
 
 /**
  * How long an invitation stays claimable after `inviteMember` creates it.
@@ -37,32 +40,6 @@ const membershipsForUser = (userId: string): Promise<MembershipSummary[]> =>
     select: { id: true, organizationId: true, role: true },
   })
 
-/**
- * Roles this generated service knows how to check, and which of them a
- * membership with that role may grant to someone else (`inviteMember`) or
- * revoke (`removeMember`). `owner` may grant or revoke any known role;
- * `admin` may grant or revoke `admin` and `member`, but never `owner`, so
- * an admin can never create or remove an owner. `member` grants nothing;
- * it's listed anyway so `KNOWN_ROLES` below covers every role a membership
- * can actually hold, which is what makes the "unknown role" check on
- * `inviteMember` meaningful.
- *
- * Add a role here when your app adds one. A role missing from this map can
- * never be granted to, or removed from, anyone by `inviteMember` /
- * `removeMember` -- including by an owner.
- */
-export const ROLE_GRANTS: Readonly<Record<string, readonly string[]>> = {
-  owner: ['owner', 'admin', 'member'],
-  admin: ['admin', 'member'],
-  member: [],
-}
-
-const KNOWN_ROLES = Object.keys(ROLE_GRANTS)
-
-/** Whether a membership with `granterRole` may grant or revoke `targetRole`. */
-const canGrantRole = (granterRole: string, targetRole: string): boolean =>
-  ROLE_GRANTS[granterRole]?.includes(targetRole) ?? false
-
 /**
  * Every membership belonging to the signed-in user, across all
  * organizations. `Membership` is a global model, so this reads plain `db`.
@@ -139,12 +116,12 @@ export const createOrganization: MutationResolvers['createOrganization'] =
 
 /**
  * Creates a pending membership (an invitation) in the current organization,
- * for a role the caller's own role may grant per `ROLE_GRANTS` -- an
- * `admin` can invite an `admin` or a `member`, but not an `owner`, even
- * though `@requirePermission(permission: "members.manage")` lets an admin call
- * this mutation at all. A role that isn't in `ROLE_GRANTS` is rejected
- * outright, so a typo in `input.role` can never create a membership nobody
- * can check against.
+ * for a role the caller may grant (`canGrantRole`): one whose permissions
+ * they all hold. An `admin` can invite an `admin` or a `member`, but not an
+ * `owner`, even though `@requirePermission(permission: "members.manage")`
+ * lets an admin call this mutation at all. A role that isn't in the
+ * permission definitions is rejected outright, so a typo in `input.role`
+ * can never create a membership with no permissions.
  *
  * `Membership` has no email column: the caller is responsible for emailing
  * `input.email` a link built from the returned `invitationToken`, with its
@@ -158,14 +135,14 @@ export const inviteMember: MutationResolvers['inviteMember'] = async ({
 }) => {
   const currentOrg = requireCurrentOrg()
 
-  if (!KNOWN_ROLES.includes(input.role)) {
+  if (!Object.hasOwn(permissions.roles, input.role)) {
     throw new ValidationError(
-      `"${input.role}" is not a known role. Add it to ROLE_GRANTS in ` +
-        'organizations.ts before inviting with it.',
+      `"${input.role}" is not a known role. Add it to your permission ` +
+        'definitions before inviting with it.',
     )
   }
 
-  if (!canGrantRole(currentOrg.role, input.role)) {
+  if (!canGrantRole(input.role)) {
     throw new ForbiddenError(
       `A "${currentOrg.role}" cannot invite a "${input.role}".`,
     )
@@ -288,7 +265,7 @@ export const acceptInvitation: MutationResolvers['acceptInvitation'] = async ({
 /**
  * Removes a membership from the current organization. A caller may only
  * remove a membership whose role they could grant via `inviteMember` (the
- * same `ROLE_GRANTS` rule), so an admin can never remove an owner, and the
+ * same `canGrantRole` rule), so an admin can never remove an owner, and the
  * organization's last owner can never be removed -- including by
  * themselves -- so an organization always keeps at least one owner who has
  * accepted their invitation.
@@ -306,7 +283,7 @@ export const removeMember: MutationResolvers['removeMember'] = async ({
     throw new ForbiddenError("You don't have access to that membership.")
   }
 
-  if (!canGrantRole(currentOrg.role, membership.role)) {
+  if (!canGrantRole(membership.role)) {
     throw new ForbiddenError(
       `A "${currentOrg.role}" cannot remove a "${membership.role}" member.`,
     )

package/dist/commands/setup/tenancy/templates/permissions.ts.template

@@ -9,12 +9,14 @@ import { createPermissions } from '@cedarjs/tenancy'
  * `useAuth().hasPermission()`. The web only decides what to show; these
  * checks are the guard.
  *
- * Who may grant which role is `ROLE_GRANTS` in
- * api/src/services/organizations/organizations.
+ * `canGrantRole` is who may give someone a role, or take it away: whoever
+ * holds every permission it has (`inviteMember` and `removeMember` in
+ * api/src/services/organizations).
  */
 export const {
   hasPermission,
   requirePermission,
+  canGrantRole,
   permissionsOf,
   withPermissions,
 } = createPermissions(permissions)

package/dist/commands/setup/tenancy/templates/permissionsPackage.index.ts.template

@@ -2,12 +2,18 @@ import { definePermissions } from '@cedarjs/tenancy/permissions'
 import type { PermissionName } from '@cedarjs/tenancy/permissions'
 
 /**
- * Every permission the app checks, and what each role may do. Fields ask
- * for a permission (`@requirePermission(permission: "members.manage")`, or
- * `requirePermission()` in a service) instead of listing roles, so a new
- * role is one entry here: it can do exactly what its list says, and a
+ * Every permission the app checks, and what each role may do: a role is a
+ * named bundle of permissions. Fields ask for a permission
+ * (`@requirePermission(permission: "members.manage")`, or
+ * `requirePermission('members.manage')` in a service), never a role, so a
+ * new role is one entry here: it can do exactly what its list says, and a
  * field added later is closed to it unless its permission is on the list.
  *
+ * `organization.read` is "any member": every role lists it, and fields any
+ * member may use ask for it. `organization.manage` is the owner's alone,
+ * which also keeps admins from making someone an owner: a role can only be
+ * given by someone who holds every permission it has.
+ *
  * `roles` are per organization: a membership's role decides what the user
  * may do in that organization. Fields about the user rather than an
  * organization (their own account, say) use `@requireUserAuth` instead.
@@ -17,9 +23,9 @@ import type { PermissionName } from '@cedarjs/tenancy/permissions'
  * membership's permissions from the api, through `getCurrentUser`.
  */
 export const permissions = definePermissions({
-  permissions: ['organization.read', 'members.manage'],
+  permissions: ['organization.read', 'organization.manage', 'members.manage'],
   roles: {
-    owner: ['organization.read', 'members.manage'],
+    owner: ['organization.read', 'organization.manage', 'members.manage'],
     admin: ['organization.read', 'members.manage'],
     member: ['organization.read'],
   },

package/dist/commands/setup/tenancy/templates/requirePermission.ts.template

@@ -22,9 +22,7 @@ type RequirePermissionValidate = ValidatorDirectiveFunc<{
 const validate: RequirePermissionValidate = ({ directiveArgs }) => {
   // A name the permissions map doesn't know throws, so a typo in the SDL is
   // an error rather than a field nobody can use
-  applicationRequirePermission({
-    permission: directiveArgs.permission as Permission,
-  })
+  applicationRequirePermission(directiveArgs.permission as Permission)
 }
 
 const requirePermission = createValidatorDirective(schema, validate)

package/dist/commands/setup/tenancy/templates/tenancy.tsx.template

@@ -16,12 +16,8 @@ import { createTenancy } from '@cedarjs/tenancy/web'
  *
  * A user who isn't signed in is sent to log in, and one who isn't a member
  * of the organization sees `notAMember`. Pages only some members may open
- * take `orgRoles` or `orgPermission` (see api/src/lib/permissions), and the
- * one a member without them is sent to is `unauthorized`:
- *
- *   <PrivateSet unauthenticated="login" unauthorized="projects" orgRoles="owner">
- *     <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
- *   </PrivateSet>
+ * take `orgPermission` (see packages/permissions), and the one a member
+ * without it is sent to is `unauthorized`:
  *
  *   <PrivateSet unauthenticated="login" unauthorized="projects" orgPermission="members.manage">
  *     <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -271,7 +271,7 @@ ${SIGNUP_SNIPPET}`;
         skip: () => isDbAuthProject ? false : "Not a dbAuth project; skipping."
       },
       {
-        title: "Switching @requireAuth to @requireOrgAuth and @requireUserAuth, and hasRole to hasUserRole...",
+        title: "Switching @requireAuth to @requireUserAuth, and hasRole to hasUserRole...",
         task: async (ctx) => {
           const oldDirectiveDir = path.join(paths.api.directives, "requireAuth");
           const isInOldDirective = (file) => file.startsWith(oldDirectiveDir + path.sep);
@@ -308,17 +308,18 @@ ${SIGNUP_SNIPPET}`;
           } else if (fs.existsSync(oldDirectivePath)) {
             fs.rmSync(oldDirectiveDir, { recursive: true, force: true });
           }
-          for (const name of ["requireOrgAuth", "requireUserAuth"]) {
-            const directiveDir = path.join(paths.api.directives, name);
-            await writeTemplateFile(
-              `${name}.ts.template`,
-              path.join(directiveDir, `${name}.${ext}`)
-            );
-            await writeTemplateFile(
-              `${name}.test.ts.template`,
-              path.join(directiveDir, `${name}.test.${ext}`)
-            );
-          }
+          const directiveDir = path.join(
+            paths.api.directives,
+            "requireUserAuth"
+          );
+          await writeTemplateFile(
+            "requireUserAuth.ts.template",
+            path.join(directiveDir, `requireUserAuth.${ext}`)
+          );
+          await writeTemplateFile(
+            "requireUserAuth.test.ts.template",
+            path.join(directiveDir, `requireUserAuth.test.${ext}`)
+          );
         }
       },
       {
@@ -375,7 +376,8 @@ ${SIGNUP_SNIPPET}`;
           const withUserFields = (firstNumber) => (content) => addRequiredUserFields(content, userFields, { firstNumber });
           await writeTemplateFile(
             "organizations.ts.template",
-            path.join(serviceDir, `organizations.${ext}`)
+            path.join(serviceDir, `organizations.${ext}`),
+            { __PERMISSIONS_PACKAGE__: permissionsPackageName() }
           );
           await writeTemplateFile(
             "organizations.test.ts.template",
@@ -536,7 +538,8 @@ ${SIGNUP_SNIPPET}`;
              Contact) whose rows belong to one organization, add
              ${c.highlight("organizationId String")} plus ${c.highlight("@@index([organizationId])")} to it in
              schema.prisma, and switch its fields from ${c.highlight("@requireUserAuth")}
-             to ${c.highlight("@requireOrgAuth")}. For each one that stays global, add it
+             to ${c.highlight('@requirePermission(permission: "organization.read")')}, or
+             a permission of its own. For each one that stays global, add it
              to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
           3. Put your organization routes in a PrivateSet in web/src/Routes.tsx.
              The Router renders the organization for it, using the generated
@@ -567,29 +570,30 @@ ${ctx.routerNeedsTenancy ? `
           )}.
           5. Your permissions, and what each role may do, are in
              ${c.highlight("packages/permissions")}, shared by the api and web sides${ctx.packagesWorkspaceTurnedOn ? ` (this
-             turned on ${c.highlight("experimental.packagesWorkspace")} in cedar.toml)` : ""}. Guard
-             organization fields with ${c.highlight('@requirePermission(permission: "...")')}
-             (or ${c.highlight("@requireOrgAuth(roles: [...])")}), and check permissions on the
-             web with ${c.highlight("useAuth().hasPermission()")}.
+             turned on ${c.highlight("experimental.packagesWorkspace")} in cedar.toml)` : ""}. A role is a bundle of
+             permissions: guard organization fields with
+             ${c.highlight('@requirePermission(permission: "...")')}, never a role, and check
+             permissions on the web with ${c.highlight("useAuth().hasPermission()")}. Fields
+             any member may use ask for ${c.highlight("organization.read")}, which every
+             role lists.
           6. ${c.highlight("@requireAuth")} is gone. Your fields use ${c.highlight("@requireUserAuth")} now,
              which checks what ${c.highlight("@requireAuth")} did: there were no organizations
-             before. ${c.highlight("@requireOrgAuth")} needs a current organization, and checks
-             the user's role in it.${ctx.keptRequireAuthDirective ? `
+             before. ${c.highlight("@requirePermission")} needs a current organization, and
+             checks what the user's role there may do.${ctx.keptRequireAuthDirective ? `
              api/src/directives/requireAuth was changed from Cedar's, so
              it and your @requireAuth fields were left as they are: move
-             its checks to requireUserAuth or requireOrgAuth, switch the
+             its checks to requireUserAuth or requirePermission, switch the
              fields over, then delete it.` : ""}
           7. Every role check names its kind now. ${c.highlight("hasRole")} is
              ${c.highlight("hasUserRole")} on both sides (your existing uses were renamed),
-             checking ${c.highlight("currentUser.roles")}; ${c.highlight("hasOrgRole")} checks the role in
-             the organization. ${c.highlight("<PrivateSet roles>")} isn't available with
+             checking ${c.highlight("currentUser.roles")}. In the organization, check
+             permissions instead. ${c.highlight("<PrivateSet roles>")} isn't available with
              tenancy: guard routes with ${c.highlight("<PrivateSet userRoles>")} for
-             ${c.highlight("currentUser.roles")}, and with ${c.highlight("<PrivateSet orgRoles>")} for the
-             role in the route's organization. A member who lacks it is sent
-             to ${c.highlight("unauthorized")}, and ${c.highlight("<PrivateSet orgPermission>")} checks a
-             permission of their membership the same way:
+             ${c.highlight("currentUser.roles")}, and with ${c.highlight("<PrivateSet orgPermission>")} for a
+             permission of their membership in the route's organization. A
+             member who lacks it is sent to ${c.highlight("unauthorized")}:
 
-               <PrivateSet unauthenticated="login" unauthorized="projects" orgRoles="owner">
+               <PrivateSet unauthenticated="login" unauthorized="projects" orgPermission="organization.manage">
                  <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
                </PrivateSet>
 

package/dist/lib/authDirective.js

@@ -2,8 +2,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { getPaths } from "./index.js";
 function hasTenancyAuthDirectives() {
-  return fs.existsSync(path.join(getPaths().api.directives, "requireOrgAuth"));
+  return fs.existsSync(path.join(getPaths().api.directives, "requireUserAuth"));
 }
+const MEMBER_PERMISSION = "organization.read";
 function tenantField() {
   for (const ext of ["ts", "js"]) {
     const dbPath = path.join(getPaths().api.lib, `db.${ext}`);
@@ -26,10 +27,11 @@ function withAuthDirective(source, { belongsToOrg }) {
   }
   return source.replace(
     /@requireAuth(?![\w$])/g,
-    belongsToOrg ? "@requireOrgAuth" : "@requireUserAuth"
+    belongsToOrg ? `@requirePermission(permission: "${MEMBER_PERMISSION}")` : "@requireUserAuth"
   );
 }
 export {
+  MEMBER_PERMISSION,
   belongsToOrganization,
   hasTenancyAuthDirectives,
   tenantField,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "8.0.0-canary.3565",
+  "version": "8.0.0-canary.3567",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.11",
-    "@cedarjs/api-server": "8.0.0-canary.3565",
-    "@cedarjs/babel-config": "8.0.0-canary.3565",
-    "@cedarjs/cli-helpers": "8.0.0-canary.3565",
-    "@cedarjs/internal": "8.0.0-canary.3565",
-    "@cedarjs/prerender": "8.0.0-canary.3565",
-    "@cedarjs/project-config": "8.0.0-canary.3565",
-    "@cedarjs/structure": "8.0.0-canary.3565",
-    "@cedarjs/telemetry": "8.0.0-canary.3565",
-    "@cedarjs/utils": "8.0.0-canary.3565",
-    "@cedarjs/vite": "8.0.0-canary.3565",
-    "@cedarjs/web-server": "8.0.0-canary.3565",
+    "@cedarjs/api-server": "8.0.0-canary.3567",
+    "@cedarjs/babel-config": "8.0.0-canary.3567",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3567",
+    "@cedarjs/internal": "8.0.0-canary.3567",
+    "@cedarjs/prerender": "8.0.0-canary.3567",
+    "@cedarjs/project-config": "8.0.0-canary.3567",
+    "@cedarjs/structure": "8.0.0-canary.3567",
+    "@cedarjs/telemetry": "8.0.0-canary.3567",
+    "@cedarjs/utils": "8.0.0-canary.3567",
+    "@cedarjs/vite": "8.0.0-canary.3567",
+    "@cedarjs/web-server": "8.0.0-canary.3567",
     "@listr2/prompt-adapter-enquirer": "4.4.3",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "2.12.0",
@@ -93,7 +93,7 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "8.0.0-canary.3565",
+    "@cedarjs/framework-tools": "8.0.0-canary.3567",
     "@prisma/dmmf": "7.10.1",
     "@types/archiver": "^7.0.0",
     "memfs": "4.80.0",

package/dist/commands/setup/tenancy/templates/requireOrgAuth.test.ts.template

@@ -1,56 +0,0 @@
-import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
-
-import requireOrgAuth from './requireOrgAuth.js'
-
-const currentOrg = (role: string) => ({
-  id: 'org-1',
-  slug: 'org-1',
-  role,
-  membershipId: 'membership-1',
-})
-
-describe('requireOrgAuth directive', () => {
-  it('declares the directive sdl as schema, with the correct name', () => {
-    expect(requireOrgAuth.schema).toBeTruthy()
-    expect(getDirectiveName(requireOrgAuth.schema)).toBe('requireOrgAuth')
-  })
-
-  it('throws when there is no current user', () => {
-    const mockExecution = mockRedwoodDirective(requireOrgAuth, { context: {} })
-
-    expect(mockExecution).toThrowError("You don't have permission to do that.")
-  })
-
-  it('throws when there is no current organization', () => {
-    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
-      context: { currentUser: { id: 'user-1' } },
-    })
-
-    expect(mockExecution).toThrowError(
-      'You must be a member of an organization to do that.',
-    )
-  })
-
-  it('does not throw for a member of the current organization', () => {
-    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
-      context: {
-        currentUser: { id: 'user-1' },
-        currentOrg: currentOrg('member'),
-      },
-    })
-
-    expect(mockExecution).not.toThrowError()
-  })
-
-  it("throws when the role in the current organization isn't listed", () => {
-    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
-      context: {
-        currentUser: { id: 'user-1' },
-        currentOrg: currentOrg('member'),
-      },
-      directiveArgs: { roles: ['owner'] },
-    })
-
-    expect(mockExecution).toThrowError("You don't have access to do that.")
-  })
-})

package/dist/commands/setup/tenancy/templates/requireOrgAuth.ts.template

@@ -1,25 +0,0 @@
-import { gql } from 'graphql-tag'
-
-import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireOrgAuth as applicationRequireOrgAuth } from 'src/lib/auth'
-
-export const schema = gql`
-  """
-  Use to check that the signed-in user is a member of the current
-  organization, with one of an optional set of roles there.
-  """
-  directive @requireOrgAuth(roles: [String]) on FIELD_DEFINITION
-`
-
-type RequireOrgAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
-
-const validate: RequireOrgAuthValidate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireOrgAuth({ roles })
-}
-
-const requireOrgAuth = createValidatorDirective(schema, validate)
-
-export default requireOrgAuth