@cedarjs/cli 8.0.0-canary.3565 → 8.0.0-canary.3568

package/dist/commands/setup/realtime/realtimeHandler.js

@@ -7,7 +7,6 @@ import { addApiPackages } from "@cedarjs/cli-helpers/installHelpers";
 import { runBinSync } from "@cedarjs/cli-helpers/packageManager/exec";
 import { generate as generateTypes } from "@cedarjs/internal/dist/generate/generate";
 import { errorTelemetry } from "@cedarjs/telemetry";
-import { withAuthDirective } from "../../../lib/authDirective.js";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject, serverFileExists } from "../../../lib/project.js";
 import { setupServerFileTasks } from "../server-file/serverFileHandler.js";
@@ -98,13 +97,9 @@ async function handler(args) {
             exampleSubscriptionTemplateContent
           );
           return [
-            writeFile(
-              exampleFile,
-              withAuthDirective(setupScriptContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            )
+            writeFile(exampleFile, setupScriptContent, {
+              overwriteExisting: force
+            })
           ];
         }
       },
@@ -163,23 +158,15 @@ async function handler(args) {
             exampleSubscriptionTemplateContent
           );
           return [
-            writeFile(
-              sdlFile,
-              withAuthDirective(sdlContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            ),
+            writeFile(sdlFile, sdlContent, {
+              overwriteExisting: force
+            }),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             }),
-            writeFile(
-              exampleFile,
-              withAuthDirective(setupScriptContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            )
+            writeFile(exampleFile, setupScriptContent, {
+              overwriteExisting: force
+            })
           ];
         }
       },
@@ -219,13 +206,9 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(
-              sdlFile,
-              withAuthDirective(sdlContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            ),
+            writeFile(sdlFile, sdlContent, {
+              overwriteExisting: force
+            }),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })
@@ -268,13 +251,9 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(
-              sdlFile,
-              withAuthDirective(sdlContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            ),
+            writeFile(sdlFile, sdlContent, {
+              overwriteExisting: force
+            }),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })
@@ -317,13 +296,9 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(
-              sdlFile,
-              withAuthDirective(sdlContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            ),
+            writeFile(sdlFile, sdlContent, {
+              overwriteExisting: force
+            }),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })

package/dist/commands/setup/tenancy/authCodemod.js

@@ -18,59 +18,6 @@ function buildMembershipsSelectProperty() {
   }
   return property;
 }
-const TENANCY_AUTH_EXPORT = `export const { hasUserRole, hasOrgRole, requireUserAuth, requireOrgAuth } =
-  createTenancyAuth()
-`;
-const DEFAULT_REQUIRE_AUTH_STATEMENTS = [
-  /^if \(!isAuthenticated\(\)\) \{ throw new AuthenticationError\([^)]*\);? \}$/,
-  /^if \(roles && !hasRole\(roles\)\) \{ throw new ForbiddenError\([^)]*\);? \}$/,
-  /^return isAuthenticated\(\);?$/
-];
-const DEFAULT_HAS_ROLE_NAMES = /* @__PURE__ */ new Set([
-  "AllowedRoles",
-  "Array",
-  "allowedRole",
-  "allowedRoles",
-  "context",
-  "currentUser",
-  "currentUserRoles",
-  "hasRole",
-  "includes",
-  "isArray",
-  "isAuthenticated",
-  "role",
-  "roles",
-  "some",
-  "undefined"
-]);
-function exportedValue(declaration) {
-  const node = declaration.nodes()[0];
-  return j.VariableDeclaration.check(node?.declaration) ? node.declaration.declarations[0] : void 0;
-}
-function isDefaultHasRole(hasRole) {
-  return hasRole.find(j.Identifier).nodes().every((identifier) => DEFAULT_HAS_ROLE_NAMES.has(identifier.name));
-}
-function isDefaultRequireAuth(requireAuth) {
-  const declarator = exportedValue(requireAuth);
-  const fn = j.VariableDeclarator.check(declarator) ? declarator.init : null;
-  if (!j.ArrowFunctionExpression.check(fn) || !j.BlockStatement.check(fn.body)) {
-    return false;
-  }
-  return fn.body.body.every((statement) => {
-    const source = j(statement).toSource().replace(/\/\/[^\n]*|\/\*[\s\S]*?\*\//g, "").replace(/\s+/g, " ").trim();
-    return DEFAULT_REQUIRE_AUTH_STATEMENTS.some(
-      (pattern) => pattern.test(source)
-    );
-  });
-}
-function findExportedConst(root, name) {
-  return root.find(j.ExportNamedDeclaration, {
-    declaration: {
-      type: "VariableDeclaration",
-      declarations: [{ id: { type: "Identifier", name } }]
-    }
-  });
-}
 const USER_LOOKUP = {
   callee: {
     type: "MemberExpression",
@@ -82,33 +29,6 @@ const USER_LOOKUP = {
     property: { name: "findUnique" }
   }
 };
-function addContextImport(root) {
-  const usesContext = root.find(j.Identifier, { name: "context" }).filter(
-    (path) => !(j.MemberExpression.check(path.parent.node) && path.parent.node.property === path.node && !path.parent.node.computed) && !(j.ObjectProperty.check(path.parent.node) && path.parent.node.key === path.node)
-  ).length > 0;
-  const declaresContext = root.find(j.ImportDeclaration, {
-    source: { value: "@cedarjs/graphql-server" }
-  }).length > 0 || root.find(j.ImportSpecifier, { local: { name: "context" } }).length > 0 || root.find(j.VariableDeclarator, { id: { name: "context" } }).length > 0;
-  if (!usesContext || declaresContext) {
-    return false;
-  }
-  const contextImport = j.withParser("ts")(`import { context } from '@cedarjs/context'
-`).find(j.ImportDeclaration).nodes()[0];
-  const cedarImports = root.find(j.ImportDeclaration).filter((path) => String(path.node.source.value).startsWith("@cedarjs/"));
-  const before = cedarImports.filter(
-    (path) => String(path.node.source.value) > "@cedarjs/context"
-  );
-  if (before.length > 0) {
-    before.at(0).insertBefore(contextImport);
-  } else if (cedarImports.length > 0) {
-    cedarImports.at(cedarImports.length - 1).insertAfter(contextImport);
-  } else {
-    root.find(j.Program).forEach((path) => {
-      path.node.body.unshift(contextImport);
-    });
-  }
-  return true;
-}
 function addWithPermissions(root, lookups) {
   const isWithPermissionsCall = (node) => j.CallExpression.check(node) && j.Identifier.check(node.callee) && node.callee.name === "withPermissions";
   let wrapped = false;
@@ -193,56 +113,8 @@ function transform(fileInfo) {
   if (addWithPermissions(root, membershipLookups)) {
     changed = true;
   }
-  const alreadyWired = root.find(j.ImportSpecifier, { imported: { name: "createTenancyAuth" } }).length > 0;
-  if (alreadyWired) {
-    if (addContextImport(root)) {
-      changed = true;
-    }
-    return addPermissionsImport(changed ? root.toSource() : fileInfo.source);
-  }
-  const hasRole = findExportedConst(root, "hasRole");
-  const requireAuth = findExportedConst(root, "requireAuth");
-  if (hasRole.length !== 1 || requireAuth.length !== 1) {
-    throw new Error("CEDAR_CODEMOD_ERR_AUTH_CHECKS_NOT_FOUND");
-  }
-  if (!isDefaultRequireAuth(requireAuth) || !isDefaultHasRole(hasRole)) {
-    throw new Error("CEDAR_CODEMOD_ERR_AUTH_CHECKS_CHANGED");
-  }
-  const tenancyAuth = j.withParser("ts")(TENANCY_AUTH_EXPORT).find(j.ExportNamedDeclaration).nodes()[0];
-  requireAuth.replaceWith(tenancyAuth);
-  hasRole.remove();
-  root.find(j.Identifier, { name: "hasRole" }).filter(
-    (path) => !(j.MemberExpression.check(path.parent.node) && path.parent.node.property === path.node)
-  ).forEach((path) => {
-    path.node.name = "hasUserRole";
-  });
-  const isUnused = (name) => root.find(j.Identifier, { name }).filter(
-    (path) => !j.ImportSpecifier.check(path.parent.node) && !j.TSTypeAliasDeclaration.check(path.parent.node)
-  ).length === 0;
-  root.find(j.TSTypeAliasDeclaration, { id: { name: "AllowedRoles" } }).filter(() => isUnused("AllowedRoles")).remove();
-  root.find(j.ImportDeclaration, { source: { value: "@cedarjs/graphql-server" } }).forEach((path) => {
-    path.node.specifiers = (path.node.specifiers ?? []).filter(
-      (specifier) => !j.ImportSpecifier.check(specifier) || !j.Identifier.check(specifier.local) || !isUnused(specifier.local.name)
-    );
-  }).filter((path) => (path.node.specifiers ?? []).length === 0).remove();
-  const tenancyImport = j.withParser("ts")(`import { createTenancyAuth } from '@cedarjs/tenancy'
-`).find(j.ImportDeclaration).nodes()[0];
-  const imports = root.find(j.ImportDeclaration);
-  const cedarImports = imports.filter(
-    (path) => String(path.node.source.value).startsWith("@cedarjs/")
-  );
-  const anchor = cedarImports.length > 0 ? cedarImports : imports;
-  if (anchor.length > 0) {
-    anchor.at(anchor.length - 1).insertAfter(tenancyImport);
-  } else {
-    root.find(j.Program).forEach((path) => {
-      path.node.body.unshift(tenancyImport);
-    });
-  }
-  addContextImport(root);
-  return addPermissionsImport(root.toSource());
+  return addPermissionsImport(changed ? root.toSource() : fileInfo.source);
 }
 export {
-  TENANCY_AUTH_EXPORT,
   transform as default
 };

package/dist/commands/setup/tenancy/templates/organizations.sdl.ts.template

@@ -45,7 +45,7 @@ export const schema = gql`
 
   type Query {
     "Every membership belonging to the signed-in user, across all organizations they belong to."
-    myMemberships: [Membership!]! @requireUserAuth
+    myMemberships: [Membership!]! @requireAuth
 
     "The current organization, resolved by resolveCurrentOrg for this request."
     organization(id: String!): Organization
@@ -55,13 +55,12 @@ export const schema = gql`
   type Mutation {
     "Creates a new organization with the caller as its owner."
     createOrganization(input: CreateOrganizationInput!): Organization!
-      @requireUserAuth
+      @requireAuth
 
     """
     Creates a pending membership (an invitation) in the current organization,
-    for a role the caller's own role may grant (see ROLE_GRANTS in
-    organizations.ts) -- an admin can invite an admin or a member, but not an
-    owner. The app is responsible for emailing input.email a link built from
+    for a role whose permissions the caller all holds -- an admin can invite
+    an admin or a member, but not an owner. The app is responsible for emailing input.email a link built from
     the returned invitationToken; Membership has no email column of its own.
     The invitation can be claimed until the returned invitationExpiresAt.
     Web callers must call reauthenticate() from useAuth() in onCompleted so
@@ -78,7 +77,7 @@ export const schema = gql`
     the new membership is reflected in currentUser.memberships.
     """
     acceptInvitation(token: String!): Organization!
-      @requireUserAuth
+      @requireAuth
 
     """
     Removes a membership from the current organization, for a role the

package/dist/commands/setup/tenancy/templates/organizations.test.ts.template

@@ -120,6 +120,19 @@ describe('organizations service', () => {
       },
     )
 
+    scenario(
+      'an admin can invite an admin',
+      async (scenario: StandardScenario) => {
+        asMember(scenario, scenario.membership.admin)
+
+        const result = await inviteMember({
+          input: { email: 'new-admin@example.com', role: 'admin' },
+        })
+
+        expect(result.invitationToken).toBeTruthy()
+      },
+    )
+
     scenario(
       'an admin cannot invite an owner',
       async (scenario: StandardScenario) => {

package/dist/commands/setup/tenancy/templates/organizations.ts.template

@@ -6,10 +6,13 @@ import type {
   MembershipRelationResolvers,
 } from 'types/graphql'
 
+import { permissions } from '__PERMISSIONS_PACKAGE__'
+
 import { ForbiddenError, ValidationError } from '@cedarjs/graphql-server'
 import { requireCurrentOrg } from '@cedarjs/tenancy'
 
 import { Prisma, db } from 'src/lib/db'
+import { canGrantRole } from 'src/lib/permissions'
 
 /**
  * How long an invitation stays claimable after `inviteMember` creates it.
@@ -37,38 +40,12 @@ const membershipsForUser = (userId: string): Promise<MembershipSummary[]> =>
     select: { id: true, organizationId: true, role: true },
   })
 
-/**
- * Roles this generated service knows how to check, and which of them a
- * membership with that role may grant to someone else (`inviteMember`) or
- * revoke (`removeMember`). `owner` may grant or revoke any known role;
- * `admin` may grant or revoke `admin` and `member`, but never `owner`, so
- * an admin can never create or remove an owner. `member` grants nothing;
- * it's listed anyway so `KNOWN_ROLES` below covers every role a membership
- * can actually hold, which is what makes the "unknown role" check on
- * `inviteMember` meaningful.
- *
- * Add a role here when your app adds one. A role missing from this map can
- * never be granted to, or removed from, anyone by `inviteMember` /
- * `removeMember` -- including by an owner.
- */
-export const ROLE_GRANTS: Readonly<Record<string, readonly string[]>> = {
-  owner: ['owner', 'admin', 'member'],
-  admin: ['admin', 'member'],
-  member: [],
-}
-
-const KNOWN_ROLES = Object.keys(ROLE_GRANTS)
-
-/** Whether a membership with `granterRole` may grant or revoke `targetRole`. */
-const canGrantRole = (granterRole: string, targetRole: string): boolean =>
-  ROLE_GRANTS[granterRole]?.includes(targetRole) ?? false
-
 /**
  * Every membership belonging to the signed-in user, across all
  * organizations. `Membership` is a global model, so this reads plain `db`.
  */
 export const myMemberships: QueryResolvers['myMemberships'] = () => {
-  // @requireUserAuth guarantees a signed-in user before this resolver runs.
+  // @requireAuth guarantees a signed-in user before this resolver runs.
   return db.membership.findMany({
     where: { userId: context.currentUser!.id },
     orderBy: { createdAt: 'asc' },
@@ -95,7 +72,7 @@ export const organization: QueryResolvers['organization'] = async ({ id }) => {
 export const createOrganization: MutationResolvers['createOrganization'] =
   async ({ input }) => {
     const baseSlug = slugify(input.name)
-    // @requireUserAuth guarantees a signed-in user before this resolver runs.
+    // @requireAuth guarantees a signed-in user before this resolver runs.
     const userId = context.currentUser!.id
 
     let slug = baseSlug
@@ -139,12 +116,12 @@ export const createOrganization: MutationResolvers['createOrganization'] =
 
 /**
  * Creates a pending membership (an invitation) in the current organization,
- * for a role the caller's own role may grant per `ROLE_GRANTS` -- an
- * `admin` can invite an `admin` or a `member`, but not an `owner`, even
- * though `@requirePermission(permission: "members.manage")` lets an admin call
- * this mutation at all. A role that isn't in `ROLE_GRANTS` is rejected
- * outright, so a typo in `input.role` can never create a membership nobody
- * can check against.
+ * for a role the caller may grant (`canGrantRole`): one whose permissions
+ * they all hold. An `admin` can invite an `admin` or a `member`, but not an
+ * `owner`, even though `@requirePermission(permission: "members.manage")`
+ * lets an admin call this mutation at all. A role that isn't in the
+ * permission definitions is rejected outright, so a typo in `input.role`
+ * can never create a membership with no permissions.
  *
  * `Membership` has no email column: the caller is responsible for emailing
  * `input.email` a link built from the returned `invitationToken`, with its
@@ -158,14 +135,14 @@ export const inviteMember: MutationResolvers['inviteMember'] = async ({
 }) => {
   const currentOrg = requireCurrentOrg()
 
-  if (!KNOWN_ROLES.includes(input.role)) {
+  if (!Object.hasOwn(permissions.roles, input.role)) {
     throw new ValidationError(
-      `"${input.role}" is not a known role. Add it to ROLE_GRANTS in ` +
-        'organizations.ts before inviting with it.',
+      `"${input.role}" is not a known role. Add it to your permission ` +
+        'definitions before inviting with it.',
     )
   }
 
-  if (!canGrantRole(currentOrg.role, input.role)) {
+  if (!canGrantRole(input.role)) {
     throw new ForbiddenError(
       `A "${currentOrg.role}" cannot invite a "${input.role}".`,
     )
@@ -267,7 +244,7 @@ const isExpiredInvitation = async (token: string): Promise<boolean> => {
 export const acceptInvitation: MutationResolvers['acceptInvitation'] = async ({
   token,
 }) => {
-  // @requireUserAuth guarantees a signed-in user before this resolver runs.
+  // @requireAuth guarantees a signed-in user before this resolver runs.
   const userId = context.currentUser!.id
 
   const claim = await claimInvitation(token, userId)
@@ -288,7 +265,7 @@ export const acceptInvitation: MutationResolvers['acceptInvitation'] = async ({
 /**
  * Removes a membership from the current organization. A caller may only
  * remove a membership whose role they could grant via `inviteMember` (the
- * same `ROLE_GRANTS` rule), so an admin can never remove an owner, and the
+ * same `canGrantRole` rule), so an admin can never remove an owner, and the
  * organization's last owner can never be removed -- including by
  * themselves -- so an organization always keeps at least one owner who has
  * accepted their invitation.
@@ -306,7 +283,7 @@ export const removeMember: MutationResolvers['removeMember'] = async ({
     throw new ForbiddenError("You don't have access to that membership.")
   }
 
-  if (!canGrantRole(currentOrg.role, membership.role)) {
+  if (!canGrantRole(membership.role)) {
     throw new ForbiddenError(
       `A "${currentOrg.role}" cannot remove a "${membership.role}" member.`,
     )

package/dist/commands/setup/tenancy/templates/permissions.ts.template

@@ -9,12 +9,14 @@ import { createPermissions } from '@cedarjs/tenancy'
  * `useAuth().hasPermission()`. The web only decides what to show; these
  * checks are the guard.
  *
- * Who may grant which role is `ROLE_GRANTS` in
- * api/src/services/organizations/organizations.
+ * `canGrantRole` is who may give someone a role, or take it away: whoever
+ * holds every permission it has (`inviteMember` and `removeMember` in
+ * api/src/services/organizations).
  */
 export const {
   hasPermission,
   requirePermission,
+  canGrantRole,
   permissionsOf,
   withPermissions,
 } = createPermissions(permissions)

package/dist/commands/setup/tenancy/templates/permissionsPackage.index.ts.template

@@ -2,24 +2,30 @@ import { definePermissions } from '@cedarjs/tenancy/permissions'
 import type { PermissionName } from '@cedarjs/tenancy/permissions'
 
 /**
- * Every permission the app checks, and what each role may do. Fields ask
- * for a permission (`@requirePermission(permission: "members.manage")`, or
- * `requirePermission()` in a service) instead of listing roles, so a new
- * role is one entry here: it can do exactly what its list says, and a
+ * Every permission the app checks, and what each role may do: a role is a
+ * named bundle of permissions. Fields ask for a permission
+ * (`@requirePermission(permission: "members.manage")`, or
+ * `requirePermission('members.manage')` in a service), never a role, so a
+ * new role is one entry here: it can do exactly what its list says, and a
  * field added later is closed to it unless its permission is on the list.
  *
+ * `organization.read` is "any member": every role lists it, and fields any
+ * member may use ask for it. `organization.manage` is the owner's alone,
+ * which also keeps admins from making someone an owner: a role can only be
+ * given by someone who holds every permission it has.
+ *
  * `roles` are per organization: a membership's role decides what the user
  * may do in that organization. Fields about the user rather than an
- * organization (their own account, say) use `@requireUserAuth` instead.
+ * organization (their own account, say) use `@requireAuth` instead.
  *
  * This package is shared: the api checks these permissions
  * (api/src/lib/permissions), and the web can import the names. The web gets each
  * membership's permissions from the api, through `getCurrentUser`.
  */
 export const permissions = definePermissions({
-  permissions: ['organization.read', 'members.manage'],
+  permissions: ['organization.read', 'organization.manage', 'members.manage'],
   roles: {
-    owner: ['organization.read', 'members.manage'],
+    owner: ['organization.read', 'organization.manage', 'members.manage'],
     admin: ['organization.read', 'members.manage'],
     member: ['organization.read'],
   },

package/dist/commands/setup/tenancy/templates/requirePermission.ts.template

@@ -22,9 +22,7 @@ type RequirePermissionValidate = ValidatorDirectiveFunc<{
 const validate: RequirePermissionValidate = ({ directiveArgs }) => {
   // A name the permissions map doesn't know throws, so a typo in the SDL is
   // an error rather than a field nobody can use
-  applicationRequirePermission({
-    permission: directiveArgs.permission as Permission,
-  })
+  applicationRequirePermission(directiveArgs.permission as Permission)
 }
 
 const requirePermission = createValidatorDirective(schema, validate)

package/dist/commands/setup/tenancy/templates/tenancy.tsx.template

@@ -16,12 +16,8 @@ import { createTenancy } from '@cedarjs/tenancy/web'
  *
  * A user who isn't signed in is sent to log in, and one who isn't a member
  * of the organization sees `notAMember`. Pages only some members may open
- * take `orgRoles` or `orgPermission` (see api/src/lib/permissions), and the
- * one a member without them is sent to is `unauthorized`:
- *
- *   <PrivateSet unauthenticated="login" unauthorized="projects" orgRoles="owner">
- *     <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
- *   </PrivateSet>
+ * take `orgPermission` (see packages/permissions), and the one a member
+ * without it is sent to is `unauthorized`:
  *
  *   <PrivateSet unauthenticated="login" unauthorized="projects" orgPermission="members.manage">
  *     <Route path="/org/{orgSlug}/members" page={MembersPage} name="members" />

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -20,12 +20,6 @@ import { errorTelemetry } from "@cedarjs/telemetry";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
 import { runTransform } from "../../../lib/runTransform.js";
-import { TENANCY_AUTH_EXPORT } from "./authCodemod.js";
-import {
-  isDefaultRequireAuthDirective,
-  renameRequireAuthDirective,
-  renameLibAuthImports
-} from "./authDirectives.js";
 import {
   addPermissionsPackageTasks,
   permissionsPackageName
@@ -43,11 +37,8 @@ import {
   ORGANIZATION_MODEL,
   requiredUserFields
 } from "./schemaPrisma.js";
-import { renameUseAuthHasRole } from "./webHasRole.js";
 const DEFAULT_TENANT_FIELD = "organizationId";
 const AUTH_SNIPPET = `
-  import { createTenancyAuth } from '@cedarjs/tenancy'
-
   import { withPermissions } from 'src/lib/permissions'
 
   export const getCurrentUser = async (session) => {
@@ -65,10 +56,7 @@ const AUTH_SNIPPET = `
         },
       },
     }))
-  }
-
-  // In place of your hasRole and requireAuth
-  ${TENANCY_AUTH_EXPORT}`;
+  }`;
 const SIGNUP_SNIPPET = `
   handler: async ({ username, hashedPassword, salt, userAttributes }) => {
     const user = await db.user.create({
@@ -217,7 +205,7 @@ Re-run with --force to have this command append its own versions beside them ins
         }
       },
       {
-        title: "Adding memberships to getCurrentUser and the tenancy auth checks to api/src/lib/auth...",
+        title: "Adding memberships and their permissions to getCurrentUser...",
         task: async (_ctx, task) => {
           if (!fs.existsSync(authPath)) {
             task.skip("No api/src/lib/auth file found; skipping.");
@@ -227,10 +215,7 @@ Re-run with --force to have this command append its own versions beside them ins
             transformPath: path.join(import.meta.dirname, "authCodemod.js"),
             targetPaths: [authPath]
           });
-          if (transformResult.error?.includes("AUTH_CHECKS_CHANGED")) {
-            task.output = `api/src/lib/auth's requireAuth or hasRole has checks of its own, so it was left as it is. Please add this by hand, keeping your checks:
-${AUTH_SNIPPET}`;
-          } else if (transformResult.error) {
+          if (transformResult.error) {
             task.output = `Could not update api/src/lib/auth automatically. Please add this by hand:
 ${AUTH_SNIPPET}`;
           }
@@ -270,57 +255,6 @@ ${SIGNUP_SNIPPET}`;
         },
         skip: () => isDbAuthProject ? false : "Not a dbAuth project; skipping."
       },
-      {
-        title: "Switching @requireAuth to @requireOrgAuth and @requireUserAuth, and hasRole to hasUserRole...",
-        task: async (ctx) => {
-          const oldDirectiveDir = path.join(paths.api.directives, "requireAuth");
-          const isInOldDirective = (file) => file.startsWith(oldDirectiveDir + path.sep);
-          const oldDirectivePath = path.join(
-            oldDirectiveDir,
-            `requireAuth.${ext}`
-          );
-          const keepOldDirective = fs.existsSync(oldDirectivePath) && !isDefaultRequireAuthDirective(
-            fs.readFileSync(oldDirectivePath, "utf-8")
-          );
-          const sourceFilesIn = (dir) => fs.readdirSync(dir, { recursive: true, withFileTypes: true }).filter(
-            (entry) => entry.isFile() && /\.[jt]sx?$/.test(entry.name)
-          ).map((entry) => path.join(entry.parentPath, entry.name));
-          for (const file of sourceFilesIn(paths.api.src)) {
-            const source = fs.readFileSync(file, "utf-8");
-            const renamed = renameLibAuthImports(
-              keepOldDirective || isInOldDirective(file) ? source : renameRequireAuthDirective(source)
-            );
-            if (renamed !== source) {
-              fs.writeFileSync(file, renamed);
-              writtenFiles.push(file);
-            }
-          }
-          for (const file of sourceFilesIn(paths.web.src)) {
-            const source = fs.readFileSync(file, "utf-8");
-            const renamed = renameUseAuthHasRole(source);
-            if (renamed !== source) {
-              fs.writeFileSync(file, renamed);
-              writtenFiles.push(file);
-            }
-          }
-          if (keepOldDirective) {
-            ctx.keptRequireAuthDirective = true;
-          } else if (fs.existsSync(oldDirectivePath)) {
-            fs.rmSync(oldDirectiveDir, { recursive: true, force: true });
-          }
-          for (const name of ["requireOrgAuth", "requireUserAuth"]) {
-            const directiveDir = path.join(paths.api.directives, name);
-            await writeTemplateFile(
-              `${name}.ts.template`,
-              path.join(directiveDir, `${name}.${ext}`)
-            );
-            await writeTemplateFile(
-              `${name}.test.ts.template`,
-              path.join(directiveDir, `${name}.test.${ext}`)
-            );
-          }
-        }
-      },
       {
         title: "Adding the permissions package...",
         task: () => addPermissionsPackageTasks({
@@ -375,7 +309,8 @@ ${SIGNUP_SNIPPET}`;
           const withUserFields = (firstNumber) => (content) => addRequiredUserFields(content, userFields, { firstNumber });
           await writeTemplateFile(
             "organizations.ts.template",
-            path.join(serviceDir, `organizations.${ext}`)
+            path.join(serviceDir, `organizations.${ext}`),
+            { __PERMISSIONS_PACKAGE__: permissionsPackageName() }
           );
           await writeTemplateFile(
             "organizations.test.ts.template",
@@ -535,8 +470,9 @@ ${SIGNUP_SNIPPET}`;
              User/Organization/Membership. For each existing model (e.g.
              Contact) whose rows belong to one organization, add
              ${c.highlight("organizationId String")} plus ${c.highlight("@@index([organizationId])")} to it in
-             schema.prisma, and switch its fields from ${c.highlight("@requireUserAuth")}
-             to ${c.highlight("@requireOrgAuth")}. For each one that stays global, add it
+             schema.prisma, and switch its fields from ${c.highlight("@requireAuth")}
+             to ${c.highlight('@requirePermission(permission: "organization.read")')}, or
+             a permission of its own. For each one that stays global, add it
              to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
           3. Put your organization routes in a PrivateSet in web/src/Routes.tsx.
              The Router renders the organization for it, using the generated
@@ -567,29 +503,22 @@ ${ctx.routerNeedsTenancy ? `
           )}.
           5. Your permissions, and what each role may do, are in
              ${c.highlight("packages/permissions")}, shared by the api and web sides${ctx.packagesWorkspaceTurnedOn ? ` (this
-             turned on ${c.highlight("experimental.packagesWorkspace")} in cedar.toml)` : ""}. Guard
-             organization fields with ${c.highlight('@requirePermission(permission: "...")')}
-             (or ${c.highlight("@requireOrgAuth(roles: [...])")}), and check permissions on the
-             web with ${c.highlight("useAuth().hasPermission()")}.
-          6. ${c.highlight("@requireAuth")} is gone. Your fields use ${c.highlight("@requireUserAuth")} now,
-             which checks what ${c.highlight("@requireAuth")} did: there were no organizations
-             before. ${c.highlight("@requireOrgAuth")} needs a current organization, and checks
-             the user's role in it.${ctx.keptRequireAuthDirective ? `
-             api/src/directives/requireAuth was changed from Cedar's, so
-             it and your @requireAuth fields were left as they are: move
-             its checks to requireUserAuth or requireOrgAuth, switch the
-             fields over, then delete it.` : ""}
-          7. Every role check names its kind now. ${c.highlight("hasRole")} is
-             ${c.highlight("hasUserRole")} on both sides (your existing uses were renamed),
-             checking ${c.highlight("currentUser.roles")}; ${c.highlight("hasOrgRole")} checks the role in
-             the organization. ${c.highlight("<PrivateSet roles>")} isn't available with
-             tenancy: guard routes with ${c.highlight("<PrivateSet userRoles>")} for
-             ${c.highlight("currentUser.roles")}, and with ${c.highlight("<PrivateSet orgRoles>")} for the
-             role in the route's organization. A member who lacks it is sent
-             to ${c.highlight("unauthorized")}, and ${c.highlight("<PrivateSet orgPermission>")} checks a
-             permission of their membership the same way:
+             turned on ${c.highlight("experimental.packagesWorkspace")} in cedar.toml)` : ""}. A role is a bundle of
+             permissions: guard organization fields with
+             ${c.highlight('@requirePermission(permission: "...")')}, never a role, and check
+             permissions on the web with ${c.highlight("useAuth().hasPermission()")}. Fields
+             any member may use ask for ${c.highlight("organization.read")}, which every
+             role lists.
+          6. ${c.highlight("@requireAuth")} is for fields about the signed-in user.
+             ${c.highlight("@requirePermission")} needs a current organization, and checks
+             what the user's role there may do.
+          7. Roles are the user's own: ${c.highlight("hasRole")} and ${c.highlight("<PrivateSet roles>")}
+             check ${c.highlight("currentUser.roles")}. In an organization, check a
+             permission instead: guard routes with ${c.highlight("<PrivateSet orgPermission>")}
+             for a permission of their membership in the route's organization.
+             A member who lacks it is sent to ${c.highlight("unauthorized")}:
 
-               <PrivateSet unauthenticated="login" unauthorized="projects" orgRoles="owner">
+               <PrivateSet unauthenticated="login" unauthorized="projects" orgPermission="organization.manage">
                  <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />
                </PrivateSet>
 

package/dist/commands/setup/uploads/uploadsHandler.js

@@ -14,7 +14,6 @@ import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display"
 import { addEnvVar } from "@cedarjs/cli-helpers/project";
 import { getSchemaPath } from "@cedarjs/project-config";
 import { errorTelemetry } from "@cedarjs/telemetry";
-import { withAuthDirective } from "../../../lib/authDirective.js";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
 import { generateSecret } from "../../generate/secret/secret.js";
@@ -113,9 +112,6 @@ const handler = async ({ targets, force }) => {
     for (const [token, value] of Object.entries(replacements)) {
       templateContent = templateContent.replaceAll(token, value);
     }
-    templateContent = withAuthDirective(templateContent, {
-      belongsToOrg: false
-    });
     const content = projectIsTypescript ? templateContent : await transformTSToJS(outputPath, templateContent);
     return writeFile(outputPath, content, { overwriteExisting: force });
   };

package/dist/lib/authDirective.js

@@ -1,9 +1,18 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getPaths } from "./index.js";
-function hasTenancyAuthDirectives() {
-  return fs.existsSync(path.join(getPaths().api.directives, "requireOrgAuth"));
+function hasTenancy() {
+  let packageJson;
+  try {
+    packageJson = JSON.parse(
+      fs.readFileSync(path.join(getPaths().api.base, "package.json"), "utf-8")
+    );
+  } catch {
+    return false;
+  }
+  return !!packageJson.dependencies?.["@cedarjs/tenancy"] || !!packageJson.devDependencies?.["@cedarjs/tenancy"];
 }
+const MEMBER_PERMISSION = "organization.read";
 function tenantField() {
   for (const ext of ["ts", "js"]) {
     const dbPath = path.join(getPaths().api.lib, `db.${ext}`);
@@ -21,17 +30,18 @@ function belongsToOrganization(model) {
   );
 }
 function withAuthDirective(source, { belongsToOrg }) {
-  if (!hasTenancyAuthDirectives()) {
+  if (!belongsToOrg || !hasTenancy()) {
     return source;
   }
   return source.replace(
     /@requireAuth(?![\w$])/g,
-    belongsToOrg ? "@requireOrgAuth" : "@requireUserAuth"
+    `@requirePermission(permission: "${MEMBER_PERMISSION}")`
   );
 }
 export {
+  MEMBER_PERMISSION,
   belongsToOrganization,
-  hasTenancyAuthDirectives,
+  hasTenancy,
   tenantField,
   withAuthDirective
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "8.0.0-canary.3565",
+  "version": "8.0.0-canary.3568",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.11",
-    "@cedarjs/api-server": "8.0.0-canary.3565",
-    "@cedarjs/babel-config": "8.0.0-canary.3565",
-    "@cedarjs/cli-helpers": "8.0.0-canary.3565",
-    "@cedarjs/internal": "8.0.0-canary.3565",
-    "@cedarjs/prerender": "8.0.0-canary.3565",
-    "@cedarjs/project-config": "8.0.0-canary.3565",
-    "@cedarjs/structure": "8.0.0-canary.3565",
-    "@cedarjs/telemetry": "8.0.0-canary.3565",
-    "@cedarjs/utils": "8.0.0-canary.3565",
-    "@cedarjs/vite": "8.0.0-canary.3565",
-    "@cedarjs/web-server": "8.0.0-canary.3565",
+    "@cedarjs/api-server": "8.0.0-canary.3568",
+    "@cedarjs/babel-config": "8.0.0-canary.3568",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3568",
+    "@cedarjs/internal": "8.0.0-canary.3568",
+    "@cedarjs/prerender": "8.0.0-canary.3568",
+    "@cedarjs/project-config": "8.0.0-canary.3568",
+    "@cedarjs/structure": "8.0.0-canary.3568",
+    "@cedarjs/telemetry": "8.0.0-canary.3568",
+    "@cedarjs/utils": "8.0.0-canary.3568",
+    "@cedarjs/vite": "8.0.0-canary.3568",
+    "@cedarjs/web-server": "8.0.0-canary.3568",
     "@listr2/prompt-adapter-enquirer": "4.4.3",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "2.12.0",
@@ -93,7 +93,7 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "8.0.0-canary.3565",
+    "@cedarjs/framework-tools": "8.0.0-canary.3568",
     "@prisma/dmmf": "7.10.1",
     "@types/archiver": "^7.0.0",
     "memfs": "4.80.0",

package/dist/commands/setup/tenancy/authDirectives.js

@@ -1,101 +0,0 @@
-function renameRequireAuthDirective(source) {
-  return source.replace(/@requireAuth(?![\w$])/g, "@requireUserAuth");
-}
-const LIB_AUTH_IMPORT = /import\s*\{([^}]*)\}\s*from\s*(['"])((?:src|\.{1,2})(?:\/[^'"]*)?\/lib\/auth(?:\.[jt]s)?)\2/g;
-const LIB_AUTH_RENAMES = {
-  requireAuth: "requireUserAuth",
-  hasRole: "hasUserRole"
-};
-function renameLibAuthImports(source) {
-  let result = source;
-  for (const [from, to] of Object.entries(LIB_AUTH_RENAMES)) {
-    let renameUses = false;
-    result = result.replace(
-      LIB_AUTH_IMPORT,
-      (statement, specifiers) => {
-        const renamed = specifiers.replace(
-          new RegExp(`(?<![\\w$])${from}(?![\\w$])(\\s+as\\s+[\\w$]+)?`, "g"),
-          (_specifier, alias) => {
-            if (!alias) {
-              renameUses = true;
-            }
-            return `${to}${alias ?? ""}`;
-          }
-        );
-        return statement.replace(specifiers, renamed);
-      }
-    );
-    if (renameUses) {
-      result = result.replace(
-        new RegExp(`(?<![\\w$@.])${from}(?![\\w$])`, "g"),
-        to
-      );
-    }
-  }
-  return result;
-}
-const DEFAULT_REQUIRE_AUTH_DIRECTIVES = [
-  `import { gql } from 'graphql-tag'
-
-import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireAuth as applicationRequireAuth } from 'src/lib/auth'
-
-export const schema = gql\`
-  """
-  Use to check whether or not a user is authenticated and is associated
-  with an optional set of roles.
-  """
-  directive @requireAuth(roles: [String]) on FIELD_DEFINITION
-\`
-
-type RequireAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
-
-const validate: RequireAuthValidate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireAuth({ roles })
-}
-
-const requireAuth = createValidatorDirective(schema, validate)
-
-export default requireAuth
-`,
-  `import { gql } from 'graphql-tag'
-
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireAuth as applicationRequireAuth } from 'src/lib/auth'
-
-export const schema = gql\`
-  """
-  Use to check whether or not a user is authenticated and is associated
-  with an optional set of roles.
-  """
-  directive @requireAuth(roles: [String]) on FIELD_DEFINITION
-\`
-
-const validate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireAuth({ roles })
-}
-
-const requireAuth = createValidatorDirective(schema, validate)
-
-export default requireAuth
-`
-];
-function withoutFormatting(source) {
-  return source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, "").replace(/["']/g, "'").replace(/[;\s]/g, "").replace(/,([)\]}>])/g, "$1");
-}
-function isDefaultRequireAuthDirective(source) {
-  return DEFAULT_REQUIRE_AUTH_DIRECTIVES.some(
-    (directive) => withoutFormatting(directive) === withoutFormatting(source)
-  );
-}
-export {
-  DEFAULT_REQUIRE_AUTH_DIRECTIVES,
-  isDefaultRequireAuthDirective,
-  renameLibAuthImports,
-  renameRequireAuthDirective
-};

package/dist/commands/setup/tenancy/templates/requireOrgAuth.test.ts.template

@@ -1,56 +0,0 @@
-import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
-
-import requireOrgAuth from './requireOrgAuth.js'
-
-const currentOrg = (role: string) => ({
-  id: 'org-1',
-  slug: 'org-1',
-  role,
-  membershipId: 'membership-1',
-})
-
-describe('requireOrgAuth directive', () => {
-  it('declares the directive sdl as schema, with the correct name', () => {
-    expect(requireOrgAuth.schema).toBeTruthy()
-    expect(getDirectiveName(requireOrgAuth.schema)).toBe('requireOrgAuth')
-  })
-
-  it('throws when there is no current user', () => {
-    const mockExecution = mockRedwoodDirective(requireOrgAuth, { context: {} })
-
-    expect(mockExecution).toThrowError("You don't have permission to do that.")
-  })
-
-  it('throws when there is no current organization', () => {
-    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
-      context: { currentUser: { id: 'user-1' } },
-    })
-
-    expect(mockExecution).toThrowError(
-      'You must be a member of an organization to do that.',
-    )
-  })
-
-  it('does not throw for a member of the current organization', () => {
-    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
-      context: {
-        currentUser: { id: 'user-1' },
-        currentOrg: currentOrg('member'),
-      },
-    })
-
-    expect(mockExecution).not.toThrowError()
-  })
-
-  it("throws when the role in the current organization isn't listed", () => {
-    const mockExecution = mockRedwoodDirective(requireOrgAuth, {
-      context: {
-        currentUser: { id: 'user-1' },
-        currentOrg: currentOrg('member'),
-      },
-      directiveArgs: { roles: ['owner'] },
-    })
-
-    expect(mockExecution).toThrowError("You don't have access to do that.")
-  })
-})

package/dist/commands/setup/tenancy/templates/requireOrgAuth.ts.template

@@ -1,25 +0,0 @@
-import { gql } from 'graphql-tag'
-
-import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireOrgAuth as applicationRequireOrgAuth } from 'src/lib/auth'
-
-export const schema = gql`
-  """
-  Use to check that the signed-in user is a member of the current
-  organization, with one of an optional set of roles there.
-  """
-  directive @requireOrgAuth(roles: [String]) on FIELD_DEFINITION
-`
-
-type RequireOrgAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
-
-const validate: RequireOrgAuthValidate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireOrgAuth({ roles })
-}
-
-const requireOrgAuth = createValidatorDirective(schema, validate)
-
-export default requireOrgAuth

package/dist/commands/setup/tenancy/templates/requireUserAuth.test.ts.template

@@ -1,26 +0,0 @@
-import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
-
-import requireUserAuth from './requireUserAuth.js'
-
-describe('requireUserAuth directive', () => {
-  it('declares the directive sdl as schema, with the correct name', () => {
-    expect(requireUserAuth.schema).toBeTruthy()
-    expect(getDirectiveName(requireUserAuth.schema)).toBe('requireUserAuth')
-  })
-
-  it('throws when there is no current user', () => {
-    const mockExecution = mockRedwoodDirective(requireUserAuth, {
-      context: {},
-    })
-
-    expect(mockExecution).toThrowError("You don't have permission to do that.")
-  })
-
-  it('does not throw for a signed-in user, with no organization', () => {
-    const mockExecution = mockRedwoodDirective(requireUserAuth, {
-      context: { currentUser: { id: 'user-1' } },
-    })
-
-    expect(mockExecution).not.toThrowError()
-  })
-})

package/dist/commands/setup/tenancy/templates/requireUserAuth.ts.template

@@ -1,26 +0,0 @@
-import { gql } from 'graphql-tag'
-
-import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireUserAuth as applicationRequireUserAuth } from 'src/lib/auth'
-
-export const schema = gql`
-  """
-  Use to check whether or not a user is authenticated and is associated
-  with an optional set of roles, in any organization or none. For fields
-  about the user rather than an organization.
-  """
-  directive @requireUserAuth(roles: [String]) on FIELD_DEFINITION
-`
-
-type RequireUserAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
-
-const validate: RequireUserAuthValidate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireUserAuth({ roles })
-}
-
-const requireUserAuth = createValidatorDirective(schema, validate)
-
-export default requireUserAuth

package/dist/commands/setup/tenancy/webHasRole.js

@@ -1,45 +0,0 @@
-const HAS_ROLE = /(?<![\w$])hasRole(?![\w$])/;
-const USE_AUTH_DESTRUCTURING = /\{([^{}]*)\}(\s*=\s*useAuth\(\))/g;
-const USE_AUTH_VARIABLE = /(?:const|let|var)\s+([\w$]+)\s*=\s*useAuth\(\)/g;
-const HAS_ROLE_ON_VARIABLE = /(?<![\w$.])([\w$]+)(\s*\??\.\s*)hasRole(?![\w$])/g;
-function renameUseAuthHasRole(source) {
-  if (!source.includes("useAuth()") || !HAS_ROLE.test(source)) {
-    return source;
-  }
-  let renameUses = false;
-  let result = source.replace(
-    /(useAuth\(\)\s*\??\.\s*)hasRole(?![\w$])/g,
-    "$1hasUserRole"
-  );
-  result = result.replace(
-    USE_AUTH_DESTRUCTURING,
-    (_statement, specifiers, rest) => {
-      const renamed = specifiers.replace(
-        /(?<![\w$])hasRole(?![\w$])(\s*:)?/g,
-        (_specifier, alias) => {
-          if (!alias) {
-            renameUses = true;
-          }
-          return `hasUserRole${alias ?? ""}`;
-        }
-      );
-      return `{${renamed}}${rest}`;
-    }
-  );
-  if (renameUses) {
-    result = result.replace(/(?<![\w$.])hasRole(?![\w$])/g, "hasUserRole");
-  }
-  const authVariables = new Set(
-    Array.from(source.matchAll(USE_AUTH_VARIABLE), ([, name]) => name)
-  );
-  if (authVariables.size === 0) {
-    return result;
-  }
-  return result.replace(
-    HAS_ROLE_ON_VARIABLE,
-    (match, name, access) => authVariables.has(name) ? `${name}${access}hasUserRole` : match
-  );
-}
-export {
-  renameUseAuthHasRole
-};