@cedarjs/cli 8.0.0-canary.3567 → 8.0.0-canary.3568

package/dist/commands/setup/realtime/realtimeHandler.js

@@ -7,7 +7,6 @@ import { addApiPackages } from "@cedarjs/cli-helpers/installHelpers";
 import { runBinSync } from "@cedarjs/cli-helpers/packageManager/exec";
 import { generate as generateTypes } from "@cedarjs/internal/dist/generate/generate";
 import { errorTelemetry } from "@cedarjs/telemetry";
-import { withAuthDirective } from "../../../lib/authDirective.js";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject, serverFileExists } from "../../../lib/project.js";
 import { setupServerFileTasks } from "../server-file/serverFileHandler.js";
@@ -98,13 +97,9 @@ async function handler(args) {
             exampleSubscriptionTemplateContent
           );
           return [
-            writeFile(
-              exampleFile,
-              withAuthDirective(setupScriptContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            )
+            writeFile(exampleFile, setupScriptContent, {
+              overwriteExisting: force
+            })
           ];
         }
       },
@@ -163,23 +158,15 @@ async function handler(args) {
             exampleSubscriptionTemplateContent
           );
           return [
-            writeFile(
-              sdlFile,
-              withAuthDirective(sdlContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            ),
+            writeFile(sdlFile, sdlContent, {
+              overwriteExisting: force
+            }),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             }),
-            writeFile(
-              exampleFile,
-              withAuthDirective(setupScriptContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            )
+            writeFile(exampleFile, setupScriptContent, {
+              overwriteExisting: force
+            })
           ];
         }
       },
@@ -219,13 +206,9 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(
-              sdlFile,
-              withAuthDirective(sdlContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            ),
+            writeFile(sdlFile, sdlContent, {
+              overwriteExisting: force
+            }),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })
@@ -268,13 +251,9 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(
-              sdlFile,
-              withAuthDirective(sdlContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            ),
+            writeFile(sdlFile, sdlContent, {
+              overwriteExisting: force
+            }),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })
@@ -317,13 +296,9 @@ async function handler(args) {
           );
           const serviceContent = ts ? exampleServiceTemplateContent : await transformTSToJS(serviceFile, exampleServiceTemplateContent);
           return [
-            writeFile(
-              sdlFile,
-              withAuthDirective(sdlContent, { belongsToOrg: false }),
-              {
-                overwriteExisting: force
-              }
-            ),
+            writeFile(sdlFile, sdlContent, {
+              overwriteExisting: force
+            }),
             writeFile(serviceFile, serviceContent, {
               overwriteExisting: force
             })

package/dist/commands/setup/tenancy/authCodemod.js

@@ -18,58 +18,6 @@ function buildMembershipsSelectProperty() {
   }
   return property;
 }
-const TENANCY_AUTH_EXPORT = `export const { hasUserRole, requireUserAuth } = createTenancyAuth()
-`;
-const DEFAULT_REQUIRE_AUTH_STATEMENTS = [
-  /^if \(!isAuthenticated\(\)\) \{ throw new AuthenticationError\([^)]*\);? \}$/,
-  /^if \(roles && !hasRole\(roles\)\) \{ throw new ForbiddenError\([^)]*\);? \}$/,
-  /^return isAuthenticated\(\);?$/
-];
-const DEFAULT_HAS_ROLE_NAMES = /* @__PURE__ */ new Set([
-  "AllowedRoles",
-  "Array",
-  "allowedRole",
-  "allowedRoles",
-  "context",
-  "currentUser",
-  "currentUserRoles",
-  "hasRole",
-  "includes",
-  "isArray",
-  "isAuthenticated",
-  "role",
-  "roles",
-  "some",
-  "undefined"
-]);
-function exportedValue(declaration) {
-  const node = declaration.nodes()[0];
-  return j.VariableDeclaration.check(node?.declaration) ? node.declaration.declarations[0] : void 0;
-}
-function isDefaultHasRole(hasRole) {
-  return hasRole.find(j.Identifier).nodes().every((identifier) => DEFAULT_HAS_ROLE_NAMES.has(identifier.name));
-}
-function isDefaultRequireAuth(requireAuth) {
-  const declarator = exportedValue(requireAuth);
-  const fn = j.VariableDeclarator.check(declarator) ? declarator.init : null;
-  if (!j.ArrowFunctionExpression.check(fn) || !j.BlockStatement.check(fn.body)) {
-    return false;
-  }
-  return fn.body.body.every((statement) => {
-    const source = j(statement).toSource().replace(/\/\/[^\n]*|\/\*[\s\S]*?\*\//g, "").replace(/\s+/g, " ").trim();
-    return DEFAULT_REQUIRE_AUTH_STATEMENTS.some(
-      (pattern) => pattern.test(source)
-    );
-  });
-}
-function findExportedConst(root, name) {
-  return root.find(j.ExportNamedDeclaration, {
-    declaration: {
-      type: "VariableDeclaration",
-      declarations: [{ id: { type: "Identifier", name } }]
-    }
-  });
-}
 const USER_LOOKUP = {
   callee: {
     type: "MemberExpression",
@@ -81,33 +29,6 @@ const USER_LOOKUP = {
     property: { name: "findUnique" }
   }
 };
-function addContextImport(root) {
-  const usesContext = root.find(j.Identifier, { name: "context" }).filter(
-    (path) => !(j.MemberExpression.check(path.parent.node) && path.parent.node.property === path.node && !path.parent.node.computed) && !(j.ObjectProperty.check(path.parent.node) && path.parent.node.key === path.node)
-  ).length > 0;
-  const declaresContext = root.find(j.ImportDeclaration, {
-    source: { value: "@cedarjs/graphql-server" }
-  }).length > 0 || root.find(j.ImportSpecifier, { local: { name: "context" } }).length > 0 || root.find(j.VariableDeclarator, { id: { name: "context" } }).length > 0;
-  if (!usesContext || declaresContext) {
-    return false;
-  }
-  const contextImport = j.withParser("ts")(`import { context } from '@cedarjs/context'
-`).find(j.ImportDeclaration).nodes()[0];
-  const cedarImports = root.find(j.ImportDeclaration).filter((path) => String(path.node.source.value).startsWith("@cedarjs/"));
-  const before = cedarImports.filter(
-    (path) => String(path.node.source.value) > "@cedarjs/context"
-  );
-  if (before.length > 0) {
-    before.at(0).insertBefore(contextImport);
-  } else if (cedarImports.length > 0) {
-    cedarImports.at(cedarImports.length - 1).insertAfter(contextImport);
-  } else {
-    root.find(j.Program).forEach((path) => {
-      path.node.body.unshift(contextImport);
-    });
-  }
-  return true;
-}
 function addWithPermissions(root, lookups) {
   const isWithPermissionsCall = (node) => j.CallExpression.check(node) && j.Identifier.check(node.callee) && node.callee.name === "withPermissions";
   let wrapped = false;
@@ -192,56 +113,8 @@ function transform(fileInfo) {
   if (addWithPermissions(root, membershipLookups)) {
     changed = true;
   }
-  const alreadyWired = root.find(j.ImportSpecifier, { imported: { name: "createTenancyAuth" } }).length > 0;
-  if (alreadyWired) {
-    if (addContextImport(root)) {
-      changed = true;
-    }
-    return addPermissionsImport(changed ? root.toSource() : fileInfo.source);
-  }
-  const hasRole = findExportedConst(root, "hasRole");
-  const requireAuth = findExportedConst(root, "requireAuth");
-  if (hasRole.length !== 1 || requireAuth.length !== 1) {
-    throw new Error("CEDAR_CODEMOD_ERR_AUTH_CHECKS_NOT_FOUND");
-  }
-  if (!isDefaultRequireAuth(requireAuth) || !isDefaultHasRole(hasRole)) {
-    throw new Error("CEDAR_CODEMOD_ERR_AUTH_CHECKS_CHANGED");
-  }
-  const tenancyAuth = j.withParser("ts")(TENANCY_AUTH_EXPORT).find(j.ExportNamedDeclaration).nodes()[0];
-  requireAuth.replaceWith(tenancyAuth);
-  hasRole.remove();
-  root.find(j.Identifier, { name: "hasRole" }).filter(
-    (path) => !(j.MemberExpression.check(path.parent.node) && path.parent.node.property === path.node)
-  ).forEach((path) => {
-    path.node.name = "hasUserRole";
-  });
-  const isUnused = (name) => root.find(j.Identifier, { name }).filter(
-    (path) => !j.ImportSpecifier.check(path.parent.node) && !j.TSTypeAliasDeclaration.check(path.parent.node)
-  ).length === 0;
-  root.find(j.TSTypeAliasDeclaration, { id: { name: "AllowedRoles" } }).filter(() => isUnused("AllowedRoles")).remove();
-  root.find(j.ImportDeclaration, { source: { value: "@cedarjs/graphql-server" } }).forEach((path) => {
-    path.node.specifiers = (path.node.specifiers ?? []).filter(
-      (specifier) => !j.ImportSpecifier.check(specifier) || !j.Identifier.check(specifier.local) || !isUnused(specifier.local.name)
-    );
-  }).filter((path) => (path.node.specifiers ?? []).length === 0).remove();
-  const tenancyImport = j.withParser("ts")(`import { createTenancyAuth } from '@cedarjs/tenancy'
-`).find(j.ImportDeclaration).nodes()[0];
-  const imports = root.find(j.ImportDeclaration);
-  const cedarImports = imports.filter(
-    (path) => String(path.node.source.value).startsWith("@cedarjs/")
-  );
-  const anchor = cedarImports.length > 0 ? cedarImports : imports;
-  if (anchor.length > 0) {
-    anchor.at(anchor.length - 1).insertAfter(tenancyImport);
-  } else {
-    root.find(j.Program).forEach((path) => {
-      path.node.body.unshift(tenancyImport);
-    });
-  }
-  addContextImport(root);
-  return addPermissionsImport(root.toSource());
+  return addPermissionsImport(changed ? root.toSource() : fileInfo.source);
 }
 export {
-  TENANCY_AUTH_EXPORT,
   transform as default
 };

package/dist/commands/setup/tenancy/templates/organizations.sdl.ts.template

@@ -45,7 +45,7 @@ export const schema = gql`
 
   type Query {
     "Every membership belonging to the signed-in user, across all organizations they belong to."
-    myMemberships: [Membership!]! @requireUserAuth
+    myMemberships: [Membership!]! @requireAuth
 
     "The current organization, resolved by resolveCurrentOrg for this request."
     organization(id: String!): Organization
@@ -55,7 +55,7 @@ export const schema = gql`
   type Mutation {
     "Creates a new organization with the caller as its owner."
     createOrganization(input: CreateOrganizationInput!): Organization!
-      @requireUserAuth
+      @requireAuth
 
     """
     Creates a pending membership (an invitation) in the current organization,
@@ -77,7 +77,7 @@ export const schema = gql`
     the new membership is reflected in currentUser.memberships.
     """
     acceptInvitation(token: String!): Organization!
-      @requireUserAuth
+      @requireAuth
 
     """
     Removes a membership from the current organization, for a role the

package/dist/commands/setup/tenancy/templates/organizations.ts.template

@@ -45,7 +45,7 @@ const membershipsForUser = (userId: string): Promise<MembershipSummary[]> =>
  * organizations. `Membership` is a global model, so this reads plain `db`.
  */
 export const myMemberships: QueryResolvers['myMemberships'] = () => {
-  // @requireUserAuth guarantees a signed-in user before this resolver runs.
+  // @requireAuth guarantees a signed-in user before this resolver runs.
   return db.membership.findMany({
     where: { userId: context.currentUser!.id },
     orderBy: { createdAt: 'asc' },
@@ -72,7 +72,7 @@ export const organization: QueryResolvers['organization'] = async ({ id }) => {
 export const createOrganization: MutationResolvers['createOrganization'] =
   async ({ input }) => {
     const baseSlug = slugify(input.name)
-    // @requireUserAuth guarantees a signed-in user before this resolver runs.
+    // @requireAuth guarantees a signed-in user before this resolver runs.
     const userId = context.currentUser!.id
 
     let slug = baseSlug
@@ -244,7 +244,7 @@ const isExpiredInvitation = async (token: string): Promise<boolean> => {
 export const acceptInvitation: MutationResolvers['acceptInvitation'] = async ({
   token,
 }) => {
-  // @requireUserAuth guarantees a signed-in user before this resolver runs.
+  // @requireAuth guarantees a signed-in user before this resolver runs.
   const userId = context.currentUser!.id
 
   const claim = await claimInvitation(token, userId)

package/dist/commands/setup/tenancy/templates/permissionsPackage.index.ts.template

@@ -16,7 +16,7 @@ import type { PermissionName } from '@cedarjs/tenancy/permissions'
  *
  * `roles` are per organization: a membership's role decides what the user
  * may do in that organization. Fields about the user rather than an
- * organization (their own account, say) use `@requireUserAuth` instead.
+ * organization (their own account, say) use `@requireAuth` instead.
  *
  * This package is shared: the api checks these permissions
  * (api/src/lib/permissions), and the web can import the names. The web gets each

package/dist/commands/setup/tenancy/tenancyHandler.js

@@ -20,12 +20,6 @@ import { errorTelemetry } from "@cedarjs/telemetry";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
 import { runTransform } from "../../../lib/runTransform.js";
-import { TENANCY_AUTH_EXPORT } from "./authCodemod.js";
-import {
-  isDefaultRequireAuthDirective,
-  renameRequireAuthDirective,
-  renameLibAuthImports
-} from "./authDirectives.js";
 import {
   addPermissionsPackageTasks,
   permissionsPackageName
@@ -43,11 +37,8 @@ import {
   ORGANIZATION_MODEL,
   requiredUserFields
 } from "./schemaPrisma.js";
-import { renameUseAuthHasRole } from "./webHasRole.js";
 const DEFAULT_TENANT_FIELD = "organizationId";
 const AUTH_SNIPPET = `
-  import { createTenancyAuth } from '@cedarjs/tenancy'
-
   import { withPermissions } from 'src/lib/permissions'
 
   export const getCurrentUser = async (session) => {
@@ -65,10 +56,7 @@ const AUTH_SNIPPET = `
         },
       },
     }))
-  }
-
-  // In place of your hasRole and requireAuth
-  ${TENANCY_AUTH_EXPORT}`;
+  }`;
 const SIGNUP_SNIPPET = `
   handler: async ({ username, hashedPassword, salt, userAttributes }) => {
     const user = await db.user.create({
@@ -217,7 +205,7 @@ Re-run with --force to have this command append its own versions beside them ins
         }
       },
       {
-        title: "Adding memberships to getCurrentUser and the tenancy auth checks to api/src/lib/auth...",
+        title: "Adding memberships and their permissions to getCurrentUser...",
         task: async (_ctx, task) => {
           if (!fs.existsSync(authPath)) {
             task.skip("No api/src/lib/auth file found; skipping.");
@@ -227,10 +215,7 @@ Re-run with --force to have this command append its own versions beside them ins
             transformPath: path.join(import.meta.dirname, "authCodemod.js"),
             targetPaths: [authPath]
           });
-          if (transformResult.error?.includes("AUTH_CHECKS_CHANGED")) {
-            task.output = `api/src/lib/auth's requireAuth or hasRole has checks of its own, so it was left as it is. Please add this by hand, keeping your checks:
-${AUTH_SNIPPET}`;
-          } else if (transformResult.error) {
+          if (transformResult.error) {
             task.output = `Could not update api/src/lib/auth automatically. Please add this by hand:
 ${AUTH_SNIPPET}`;
           }
@@ -270,58 +255,6 @@ ${SIGNUP_SNIPPET}`;
         },
         skip: () => isDbAuthProject ? false : "Not a dbAuth project; skipping."
       },
-      {
-        title: "Switching @requireAuth to @requireUserAuth, and hasRole to hasUserRole...",
-        task: async (ctx) => {
-          const oldDirectiveDir = path.join(paths.api.directives, "requireAuth");
-          const isInOldDirective = (file) => file.startsWith(oldDirectiveDir + path.sep);
-          const oldDirectivePath = path.join(
-            oldDirectiveDir,
-            `requireAuth.${ext}`
-          );
-          const keepOldDirective = fs.existsSync(oldDirectivePath) && !isDefaultRequireAuthDirective(
-            fs.readFileSync(oldDirectivePath, "utf-8")
-          );
-          const sourceFilesIn = (dir) => fs.readdirSync(dir, { recursive: true, withFileTypes: true }).filter(
-            (entry) => entry.isFile() && /\.[jt]sx?$/.test(entry.name)
-          ).map((entry) => path.join(entry.parentPath, entry.name));
-          for (const file of sourceFilesIn(paths.api.src)) {
-            const source = fs.readFileSync(file, "utf-8");
-            const renamed = renameLibAuthImports(
-              keepOldDirective || isInOldDirective(file) ? source : renameRequireAuthDirective(source)
-            );
-            if (renamed !== source) {
-              fs.writeFileSync(file, renamed);
-              writtenFiles.push(file);
-            }
-          }
-          for (const file of sourceFilesIn(paths.web.src)) {
-            const source = fs.readFileSync(file, "utf-8");
-            const renamed = renameUseAuthHasRole(source);
-            if (renamed !== source) {
-              fs.writeFileSync(file, renamed);
-              writtenFiles.push(file);
-            }
-          }
-          if (keepOldDirective) {
-            ctx.keptRequireAuthDirective = true;
-          } else if (fs.existsSync(oldDirectivePath)) {
-            fs.rmSync(oldDirectiveDir, { recursive: true, force: true });
-          }
-          const directiveDir = path.join(
-            paths.api.directives,
-            "requireUserAuth"
-          );
-          await writeTemplateFile(
-            "requireUserAuth.ts.template",
-            path.join(directiveDir, `requireUserAuth.${ext}`)
-          );
-          await writeTemplateFile(
-            "requireUserAuth.test.ts.template",
-            path.join(directiveDir, `requireUserAuth.test.${ext}`)
-          );
-        }
-      },
       {
         title: "Adding the permissions package...",
         task: () => addPermissionsPackageTasks({
@@ -537,7 +470,7 @@ ${SIGNUP_SNIPPET}`;
              User/Organization/Membership. For each existing model (e.g.
              Contact) whose rows belong to one organization, add
              ${c.highlight("organizationId String")} plus ${c.highlight("@@index([organizationId])")} to it in
-             schema.prisma, and switch its fields from ${c.highlight("@requireUserAuth")}
+             schema.prisma, and switch its fields from ${c.highlight("@requireAuth")}
              to ${c.highlight('@requirePermission(permission: "organization.read")')}, or
              a permission of its own. For each one that stays global, add it
              to the ${c.highlight("allExcept")} list in api/src/lib/db instead.
@@ -576,22 +509,14 @@ ${ctx.routerNeedsTenancy ? `
              permissions on the web with ${c.highlight("useAuth().hasPermission()")}. Fields
              any member may use ask for ${c.highlight("organization.read")}, which every
              role lists.
-          6. ${c.highlight("@requireAuth")} is gone. Your fields use ${c.highlight("@requireUserAuth")} now,
-             which checks what ${c.highlight("@requireAuth")} did: there were no organizations
-             before. ${c.highlight("@requirePermission")} needs a current organization, and
-             checks what the user's role there may do.${ctx.keptRequireAuthDirective ? `
-             api/src/directives/requireAuth was changed from Cedar's, so
-             it and your @requireAuth fields were left as they are: move
-             its checks to requireUserAuth or requirePermission, switch the
-             fields over, then delete it.` : ""}
-          7. Every role check names its kind now. ${c.highlight("hasRole")} is
-             ${c.highlight("hasUserRole")} on both sides (your existing uses were renamed),
-             checking ${c.highlight("currentUser.roles")}. In the organization, check
-             permissions instead. ${c.highlight("<PrivateSet roles>")} isn't available with
-             tenancy: guard routes with ${c.highlight("<PrivateSet userRoles>")} for
-             ${c.highlight("currentUser.roles")}, and with ${c.highlight("<PrivateSet orgPermission>")} for a
-             permission of their membership in the route's organization. A
-             member who lacks it is sent to ${c.highlight("unauthorized")}:
+          6. ${c.highlight("@requireAuth")} is for fields about the signed-in user.
+             ${c.highlight("@requirePermission")} needs a current organization, and checks
+             what the user's role there may do.
+          7. Roles are the user's own: ${c.highlight("hasRole")} and ${c.highlight("<PrivateSet roles>")}
+             check ${c.highlight("currentUser.roles")}. In an organization, check a
+             permission instead: guard routes with ${c.highlight("<PrivateSet orgPermission>")}
+             for a permission of their membership in the route's organization.
+             A member who lacks it is sent to ${c.highlight("unauthorized")}:
 
                <PrivateSet unauthenticated="login" unauthorized="projects" orgPermission="organization.manage">
                  <Route path="/org/{orgSlug}/settings" page={SettingsPage} name="settings" />

package/dist/commands/setup/uploads/uploadsHandler.js

@@ -14,7 +14,6 @@ import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display"
 import { addEnvVar } from "@cedarjs/cli-helpers/project";
 import { getSchemaPath } from "@cedarjs/project-config";
 import { errorTelemetry } from "@cedarjs/telemetry";
-import { withAuthDirective } from "../../../lib/authDirective.js";
 import { getPaths, transformTSToJS, writeFile } from "../../../lib/index.js";
 import { isTypeScriptProject } from "../../../lib/project.js";
 import { generateSecret } from "../../generate/secret/secret.js";
@@ -113,9 +112,6 @@ const handler = async ({ targets, force }) => {
     for (const [token, value] of Object.entries(replacements)) {
       templateContent = templateContent.replaceAll(token, value);
     }
-    templateContent = withAuthDirective(templateContent, {
-      belongsToOrg: false
-    });
     const content = projectIsTypescript ? templateContent : await transformTSToJS(outputPath, templateContent);
     return writeFile(outputPath, content, { overwriteExisting: force });
   };

package/dist/lib/authDirective.js

@@ -1,8 +1,16 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getPaths } from "./index.js";
-function hasTenancyAuthDirectives() {
-  return fs.existsSync(path.join(getPaths().api.directives, "requireUserAuth"));
+function hasTenancy() {
+  let packageJson;
+  try {
+    packageJson = JSON.parse(
+      fs.readFileSync(path.join(getPaths().api.base, "package.json"), "utf-8")
+    );
+  } catch {
+    return false;
+  }
+  return !!packageJson.dependencies?.["@cedarjs/tenancy"] || !!packageJson.devDependencies?.["@cedarjs/tenancy"];
 }
 const MEMBER_PERMISSION = "organization.read";
 function tenantField() {
@@ -22,18 +30,18 @@ function belongsToOrganization(model) {
   );
 }
 function withAuthDirective(source, { belongsToOrg }) {
-  if (!hasTenancyAuthDirectives()) {
+  if (!belongsToOrg || !hasTenancy()) {
     return source;
   }
   return source.replace(
     /@requireAuth(?![\w$])/g,
-    belongsToOrg ? `@requirePermission(permission: "${MEMBER_PERMISSION}")` : "@requireUserAuth"
+    `@requirePermission(permission: "${MEMBER_PERMISSION}")`
   );
 }
 export {
   MEMBER_PERMISSION,
   belongsToOrganization,
-  hasTenancyAuthDirectives,
+  hasTenancy,
   tenantField,
   withAuthDirective
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/cli",
-  "version": "8.0.0-canary.3567",
+  "version": "8.0.0-canary.3568",
   "description": "The CedarJS Command Line",
   "repository": {
     "type": "git",
@@ -36,17 +36,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.11",
-    "@cedarjs/api-server": "8.0.0-canary.3567",
-    "@cedarjs/babel-config": "8.0.0-canary.3567",
-    "@cedarjs/cli-helpers": "8.0.0-canary.3567",
-    "@cedarjs/internal": "8.0.0-canary.3567",
-    "@cedarjs/prerender": "8.0.0-canary.3567",
-    "@cedarjs/project-config": "8.0.0-canary.3567",
-    "@cedarjs/structure": "8.0.0-canary.3567",
-    "@cedarjs/telemetry": "8.0.0-canary.3567",
-    "@cedarjs/utils": "8.0.0-canary.3567",
-    "@cedarjs/vite": "8.0.0-canary.3567",
-    "@cedarjs/web-server": "8.0.0-canary.3567",
+    "@cedarjs/api-server": "8.0.0-canary.3568",
+    "@cedarjs/babel-config": "8.0.0-canary.3568",
+    "@cedarjs/cli-helpers": "8.0.0-canary.3568",
+    "@cedarjs/internal": "8.0.0-canary.3568",
+    "@cedarjs/prerender": "8.0.0-canary.3568",
+    "@cedarjs/project-config": "8.0.0-canary.3568",
+    "@cedarjs/structure": "8.0.0-canary.3568",
+    "@cedarjs/telemetry": "8.0.0-canary.3568",
+    "@cedarjs/utils": "8.0.0-canary.3568",
+    "@cedarjs/vite": "8.0.0-canary.3568",
+    "@cedarjs/web-server": "8.0.0-canary.3568",
     "@listr2/prompt-adapter-enquirer": "4.4.3",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/core": "2.12.0",
@@ -93,7 +93,7 @@
     "yargs": "18.2.0"
   },
   "devDependencies": {
-    "@cedarjs/framework-tools": "8.0.0-canary.3567",
+    "@cedarjs/framework-tools": "8.0.0-canary.3568",
     "@prisma/dmmf": "7.10.1",
     "@types/archiver": "^7.0.0",
     "memfs": "4.80.0",

package/dist/commands/setup/tenancy/authDirectives.js

@@ -1,101 +0,0 @@
-function renameRequireAuthDirective(source) {
-  return source.replace(/@requireAuth(?![\w$])/g, "@requireUserAuth");
-}
-const LIB_AUTH_IMPORT = /import\s*\{([^}]*)\}\s*from\s*(['"])((?:src|\.{1,2})(?:\/[^'"]*)?\/lib\/auth(?:\.[jt]s)?)\2/g;
-const LIB_AUTH_RENAMES = {
-  requireAuth: "requireUserAuth",
-  hasRole: "hasUserRole"
-};
-function renameLibAuthImports(source) {
-  let result = source;
-  for (const [from, to] of Object.entries(LIB_AUTH_RENAMES)) {
-    let renameUses = false;
-    result = result.replace(
-      LIB_AUTH_IMPORT,
-      (statement, specifiers) => {
-        const renamed = specifiers.replace(
-          new RegExp(`(?<![\\w$])${from}(?![\\w$])(\\s+as\\s+[\\w$]+)?`, "g"),
-          (_specifier, alias) => {
-            if (!alias) {
-              renameUses = true;
-            }
-            return `${to}${alias ?? ""}`;
-          }
-        );
-        return statement.replace(specifiers, renamed);
-      }
-    );
-    if (renameUses) {
-      result = result.replace(
-        new RegExp(`(?<![\\w$@.])${from}(?![\\w$])`, "g"),
-        to
-      );
-    }
-  }
-  return result;
-}
-const DEFAULT_REQUIRE_AUTH_DIRECTIVES = [
-  `import { gql } from 'graphql-tag'
-
-import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireAuth as applicationRequireAuth } from 'src/lib/auth'
-
-export const schema = gql\`
-  """
-  Use to check whether or not a user is authenticated and is associated
-  with an optional set of roles.
-  """
-  directive @requireAuth(roles: [String]) on FIELD_DEFINITION
-\`
-
-type RequireAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
-
-const validate: RequireAuthValidate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireAuth({ roles })
-}
-
-const requireAuth = createValidatorDirective(schema, validate)
-
-export default requireAuth
-`,
-  `import { gql } from 'graphql-tag'
-
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireAuth as applicationRequireAuth } from 'src/lib/auth'
-
-export const schema = gql\`
-  """
-  Use to check whether or not a user is authenticated and is associated
-  with an optional set of roles.
-  """
-  directive @requireAuth(roles: [String]) on FIELD_DEFINITION
-\`
-
-const validate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireAuth({ roles })
-}
-
-const requireAuth = createValidatorDirective(schema, validate)
-
-export default requireAuth
-`
-];
-function withoutFormatting(source) {
-  return source.replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, "").replace(/["']/g, "'").replace(/[;\s]/g, "").replace(/,([)\]}>])/g, "$1");
-}
-function isDefaultRequireAuthDirective(source) {
-  return DEFAULT_REQUIRE_AUTH_DIRECTIVES.some(
-    (directive) => withoutFormatting(directive) === withoutFormatting(source)
-  );
-}
-export {
-  DEFAULT_REQUIRE_AUTH_DIRECTIVES,
-  isDefaultRequireAuthDirective,
-  renameLibAuthImports,
-  renameRequireAuthDirective
-};

package/dist/commands/setup/tenancy/templates/requireUserAuth.test.ts.template

@@ -1,26 +0,0 @@
-import { mockRedwoodDirective, getDirectiveName } from '@cedarjs/testing/api'
-
-import requireUserAuth from './requireUserAuth.js'
-
-describe('requireUserAuth directive', () => {
-  it('declares the directive sdl as schema, with the correct name', () => {
-    expect(requireUserAuth.schema).toBeTruthy()
-    expect(getDirectiveName(requireUserAuth.schema)).toBe('requireUserAuth')
-  })
-
-  it('throws when there is no current user', () => {
-    const mockExecution = mockRedwoodDirective(requireUserAuth, {
-      context: {},
-    })
-
-    expect(mockExecution).toThrowError("You don't have permission to do that.")
-  })
-
-  it('does not throw for a signed-in user, with no organization', () => {
-    const mockExecution = mockRedwoodDirective(requireUserAuth, {
-      context: { currentUser: { id: 'user-1' } },
-    })
-
-    expect(mockExecution).not.toThrowError()
-  })
-})

package/dist/commands/setup/tenancy/templates/requireUserAuth.ts.template

@@ -1,26 +0,0 @@
-import { gql } from 'graphql-tag'
-
-import type { ValidatorDirectiveFunc } from '@cedarjs/graphql-server'
-import { createValidatorDirective } from '@cedarjs/graphql-server'
-
-import { requireUserAuth as applicationRequireUserAuth } from 'src/lib/auth'
-
-export const schema = gql`
-  """
-  Use to check whether or not a user is authenticated and is associated
-  with an optional set of roles, in any organization or none. For fields
-  about the user rather than an organization.
-  """
-  directive @requireUserAuth(roles: [String]) on FIELD_DEFINITION
-`
-
-type RequireUserAuthValidate = ValidatorDirectiveFunc<{ roles?: string[] }>
-
-const validate: RequireUserAuthValidate = ({ directiveArgs }) => {
-  const { roles } = directiveArgs
-  applicationRequireUserAuth({ roles })
-}
-
-const requireUserAuth = createValidatorDirective(schema, validate)
-
-export default requireUserAuth

package/dist/commands/setup/tenancy/webHasRole.js

@@ -1,45 +0,0 @@
-const HAS_ROLE = /(?<![\w$])hasRole(?![\w$])/;
-const USE_AUTH_DESTRUCTURING = /\{([^{}]*)\}(\s*=\s*useAuth\(\))/g;
-const USE_AUTH_VARIABLE = /(?:const|let|var)\s+([\w$]+)\s*=\s*useAuth\(\)/g;
-const HAS_ROLE_ON_VARIABLE = /(?<![\w$.])([\w$]+)(\s*\??\.\s*)hasRole(?![\w$])/g;
-function renameUseAuthHasRole(source) {
-  if (!source.includes("useAuth()") || !HAS_ROLE.test(source)) {
-    return source;
-  }
-  let renameUses = false;
-  let result = source.replace(
-    /(useAuth\(\)\s*\??\.\s*)hasRole(?![\w$])/g,
-    "$1hasUserRole"
-  );
-  result = result.replace(
-    USE_AUTH_DESTRUCTURING,
-    (_statement, specifiers, rest) => {
-      const renamed = specifiers.replace(
-        /(?<![\w$])hasRole(?![\w$])(\s*:)?/g,
-        (_specifier, alias) => {
-          if (!alias) {
-            renameUses = true;
-          }
-          return `hasUserRole${alias ?? ""}`;
-        }
-      );
-      return `{${renamed}}${rest}`;
-    }
-  );
-  if (renameUses) {
-    result = result.replace(/(?<![\w$.])hasRole(?![\w$])/g, "hasUserRole");
-  }
-  const authVariables = new Set(
-    Array.from(source.matchAll(USE_AUTH_VARIABLE), ([, name]) => name)
-  );
-  if (authVariables.size === 0) {
-    return result;
-  }
-  return result.replace(
-    HAS_ROLE_ON_VARIABLE,
-    (match, name, access) => authVariables.has(name) ? `${name}${access}hasUserRole` : match
-  );
-}
-export {
-  renameUseAuthHasRole
-};